1ca3d190198fb2e3f0698007140769bec5e75d9ab3fc1c5b92a9c86d6731ab21

Sharing

Copy URL Twitter E-mail

General

Target
1ca3d190198fb2e3f0698007140769bec5e75d9ab3fc1c5b92a9c86d6731ab21
Size 3.7MB
Sample260831-e29lnsxsbw
SHA256 1ca3d190198fb2e3f0698007140769bec5e75d9ab3fc1c5b92a9c86d6731ab21
MD5 46edf898654d7736fd1c01e10d9b2529
SHA1 26d7bae01a9aa8b7b452aa64519b7b257f385049
SHA512 85668c716c4e89b0afad96ba84c94243592d153d4bc751d8a172aef3477d42089c636ab79da52f6ca3f5176d445861fdc2f924c13649305ea23e8c2531c13d08
SSDEEP 6144:XPFCRr4iLJT0ibPtucDSGibB77jADwunl2CP5U7bAOv007ZDp0ZglSb7wgw0i1+S:X1ilt9D4l77UcGN5Un93ZDShxri
TLSH
T19E069EA1F544C032C4A246314D78DF79983DBDA02FB085FBB3D87AAE6D312D22975726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
1ca3d190198fb2e3f0698007140769bec5e75d9ab3fc1c5b92a9c86d6731ab21

File Explorer

1ca3d190198fb2e3f0698007140769bec5e75d9ab3fc1c5b92a9c86d6731ab21

.exe 3.7MB

1ca3d190198fb2e3f0698007140769bec5e75d9ab3fc1c5b92a9c86d6731ab21

IMPHASH 1197bcd81255eb61a7c4b651cc9e63c0
SHA256 1ca3d190198fb2e3f0698007140769bec5e75d9ab3fc1c5b92a9c86d6731ab21
MD5 46edf898654d7736fd1c01e10d9b2529
SHA1 26d7bae01a9aa8b7b452aa64519b7b257f385049
SHA512 85668c716c4e89b0afad96ba84c94243592d153d4bc751d8a172aef3477d42089c636ab79da52f6ca3f5176d445861fdc2f924c13649305ea23e8c2531c13d08
SSDEEP 6144:XPFCRr4iLJT0ibPtucDSGibB77jADwunl2CP5U7bAOv007ZDp0ZglSb7wgw0i1+S:X1ilt9D4l77UcGN5Un93ZDShxri
TLSH
T19E069EA1F544C032C4A246314D78DF79983DBDA02FB085FBB3D87AAE6D312D22975726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

9f:14:10:e3:03:06:04:44:b4:de:05:fe:cb:f7:05:10:97:88:c5:34:1b:6b:81:b8:f1:9e:ff:32:b3:4b:bf:b5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Chains

Aug 27, 2021

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Aug 21, 2024

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

3979503

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\project\sogouime\dev_11.1_pc_modify\Bin\SogouPdb\SogouInput\SGDownload.pdb

wininet

InternetReadFile HttpQueryInfoW HttpSendRequestExW HttpEndRequestW InternetOpenW InternetOpenUrlW InternetSetOptionW InternetConnectW InternetWriteFile InternetQueryOptionW HttpOpenRequestW InternetCloseHandle HttpAddRequestHeadersW

shlwapi

PathFileExistsW

kernel32

OutputDebugStringW SetUnhandledExceptionFilter GetCurrentProcess GetCurrentProcessId GetCurrentThreadId CreateProcessW GetLocalTime VirtualQuery GetModuleFileNameW GetModuleHandleW GetProcAddress FormatMessageW lstrcpyW IsDebuggerPresent lstrlenW LoadLibraryW InitializeCriticalSection ReadFileEx WriteFileEx GetLastError ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetOverlappedResult EnterCriticalSection LeaveCriticalSection SetEvent WaitForMultipleObjectsEx CreateEventW DeleteFileW GetFileSize SetEndOfFile SetFileAttributesW HeapAlloc HeapFree GetProcessHeap ResumeThread GetFileAttributesW OpenFileMappingW MapViewOfFile UnmapViewOfFile CopyFileW GetVersionExW CreateFileMappingW SetLastError OpenEventW WriteFile SetFilePointer CreateFileW WideCharToMultiByte WaitForMultipleObjects GetTickCount Sleep WaitForSingleObject DeleteCriticalSection CloseHandle lstrcatW WriteConsoleW GetConsoleCP HeapSize DecodePointer ReadFile FlushFileBuffers InitializeCriticalSectionAndSpinCount MultiByteToWideChar LoadLibraryExW FindNextFileW FindClose GetSystemDirectoryW FreeLibrary CreateDirectoryW ExitThread CreateThread LocalFree CreateMutexW ReleaseMutex OpenMutexW LocalAlloc QueryPerformanceFrequency QueryPerformanceCounter RaiseException GetCommandLineW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer LCMapStringW GetStringTypeW GetCPInfo UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ResetEvent WaitForSingleObjectEx GetStartupInfoW InitializeSListHead RtlUnwind FreeLibraryAndExitThread GetModuleHandleExW GetFileType HeapReAlloc ExitProcess GetStdHandle GetACP GetConsoleMode ReadConsoleW IsValidCodePage GetOEMCP SetFilePointerEx SetStdHandle FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW

user32

wsprintfW MsgWaitForMultipleObjectsEx PeekMessageW DispatchMessageW TranslateMessage wvsprintfW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

advapi32

SetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyExW GetSecurityDescriptorSacl SetSecurityDescriptorDacl BuildExplicitAccessWithNameW SetEntriesInAclW SetSecurityInfo GetNamedSecurityInfoW SetSecurityDescriptorSacl InitializeSecurityDescriptor InitializeAcl AddAccessAllowedAceEx GetLengthSid RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

1ca3d190198fb2e3f0698007140769bec5e75d9ab3fc1c5b92a9c86d6731ab21

PE Signature issue

wininet

shlwapi

kernel32

user32

version

advapi32

shell32

generic