Dock_64[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Dock_64.exe
Size 21.2MB
Sample260903-xpwhdszza1
SHA256 b7ced52c16438e4a2b853ca0950452a854296d0ce35db3acb9a84f355b7d1082
MD5 56d752c5439761974b9e89117949c7fa
SHA1 0255bb2cdd7185871a3c5bed55f3bde352232c8e
SHA512 e4d7be795bd43373d6c88df2bff787c09fae5a99ab5ea5ea376877f6d510f1429d01e2d9e1c2559910945d311751e9dbff53520ab8fc72c4ddc89ae152bc9df8
SSDEEP 98304:JsRrpfUHaorV6HmEw+eR/snIgvcGRlRlSR4W:y3fUHrvEwf2vxRlRlSD
TLSH
T1FF27EE23DAB40266FF6498B5CF53F3257B2139C5F75090EB0A05AD6BFA12651007BBE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Dock_64.exe

.exe 21.2MB

Dock_64.exe

IMPHASH 3561a5054b466fabfac4912c1da4945e
SHA256 b7ced52c16438e4a2b853ca0950452a854296d0ce35db3acb9a84f355b7d1082
MD5 56d752c5439761974b9e89117949c7fa
SHA1 0255bb2cdd7185871a3c5bed55f3bde352232c8e
SHA512 e4d7be795bd43373d6c88df2bff787c09fae5a99ab5ea5ea376877f6d510f1429d01e2d9e1c2559910945d311751e9dbff53520ab8fc72c4ddc89ae152bc9df8
SSDEEP 98304:JsRrpfUHaorV6HmEw+eR/snIgvcGRlRlSR4W:y3fUHrvEwf2vxRlRlSD
TLSH
T1FF27EE23DAB40266FF6498B5CF53F3257B2139C5F75090EB0A05AD6BFA12651007BBE2
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

bb:86:27:52:eb:67:93:ec:1a:4a:a0:32:08:e2:52:4d:c1:33:ab:88:de:5a:28:a9:ef:8b:1a:97:8f:ce:41:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

Chains

Jan 25, 2025

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

79:01:dc:5d:ed:d9:a8:a4:a1:90:d0:91:26:3e:5d:32:8f:47:fe:9b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

Chains

Jan 25, 2025

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

Serial Number

36:6c:9e:b6:18:b4:f6:58:42:70:8a:72:5b:29:69:95

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 15, 2023 - May 14, 2026

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Minor OS version

Major OS version

Entry point

2435832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\Dock1.10.4\x64\Release\Dock_64.pdb

api-ms-win-core-com-l1-1-0

CoInitializeSecurity StringFromGUID2 CLSIDFromString CoInitializeEx CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream CoSetProxyBlanket CoUninitialize CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoTaskMemFree CoCreateInstance PropVariantClear

api-ms-win-core-libraryloader-l1-2-1

FindResourceW LoadLibraryA LoadLibraryW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA LoadStringW LoadLibraryExW SizeofResource LoadResource LockResource GetProcAddress FreeLibrary GetModuleFileNameW FreeLibraryAndExitThread GetModuleHandleW

api-ms-win-ntuser-sysparams-l1-1-0

GetMonitorInfoW SystemParametersInfoW EnumDisplayMonitors EnumDisplayDevicesW GetSystemMetrics

oleaut32

VariantClear SysStringLen GetErrorInfo VariantInit SysFreeString SysAllocString SetErrorInfo SysAllocStringByteLen SysStringByteLen

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-1-0

WriteFile FindNextFileW GetDiskFreeSpaceExW CreateFileW GetVolumeInformationW GetFileTime GetDriveTypeW SetEndOfFile CreateDirectoryW ReadFile GetFinalPathNameByHandleW DeleteFileW GetShortPathNameW SetFilePointerEx SetFileTime SetFilePointer GetFileAttributesW FindClose GetFileSize LocalFileTimeToFileTime GetLogicalDriveStringsW GetFileInformationByHandle GetFileSizeEx SetFileAttributesW FlushFileBuffers FindFirstFileExW GetFileType GetLongPathNameW

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA lstrlenW

d3dcompiler_47

D3DCompile

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

api-ms-win-mm-time-l1-1-0

timeGetTime timeEndPeriod timeBeginPeriod

api-ms-win-core-processthreads-l1-1-0

ExitThread CreateThread TlsFree ExitProcess CreateProcessW TlsSetValue GetCurrentProcess TlsAlloc TerminateProcess OpenThread GetCurrentThreadId GetCurrentProcessId GetProcessTimes SuspendThread ResumeThread GetExitCodeThread GetExitCodeProcess OpenProcessToken TlsGetValue

api-ms-win-core-errorhandling-l1-1-0

RaiseException SetLastError SetUnhandledExceptionFilter SetErrorMode GetLastError

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW GetComputerNameW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo K32EnumProcesses QueryFullProcessImageNameW

api-ms-win-core-kernel32-legacy-l1-1-1

SetDllDirectoryW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW IsValidLocale GetUserDefaultLCID IsValidCodePage EnumSystemLocalesW GetACP GetOEMCP LCMapStringW GetSystemDefaultLCID

api-ms-win-service-management-l1-1-0

OpenSCManagerW

dwrite

DWriteCreateFactory

d2d1

ord1 ord2

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64 GetLocalTime GetSystemInfo GlobalMemoryStatusEx GetSystemDirectoryW GetWindowsDirectoryW GetSystemTime

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection SetEvent LeaveCriticalSection WaitForSingleObject SetWaitableTimer CreateEventW DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionAndSpinCount OpenEventW

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFamilyName

api-ms-win-core-memory-l1-1-0

VirtualProtect ReadProcessMemory VirtualFreeEx VirtualQuery OpenFileMappingW UnmapViewOfFile CreateFileMappingW VirtualAllocEx MapViewOfFile

api-ms-win-core-privateprofile-l1-1-0

WritePrivateProfileStringW GetPrivateProfileStringW

api-ms-win-security-base-l1-1-0

GetTokenInformation AdjustTokenPrivileges

api-ms-win-core-registry-l1-1-0

RegSetValueExW RegQueryInfoKeyW RegCloseKey RegDeleteValueW RegNotifyChangeKeyValue RegEnumValueW RegQueryValueExW

rpcrt4

UuidFromStringW

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_Status CM_Get_Parent

api-ms-win-core-registry-l2-1-0

RegEnumKeyW RegCreateKeyW RegOpenKeyW

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapFree HeapSize HeapAlloc HeapReAlloc

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW SetEnvironmentVariableW GetCommandLineW SetCurrentDirectoryW FreeEnvironmentStringsW GetEnvironmentVariableW GetStdHandle GetCommandLineA SetStdHandle GetCurrentDirectoryW

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc GlobalAlloc

ext-ms-win-networking-wlanapi-l1-1-0

WlanSetProfile WlanCloseHandle WlanQueryInterface WlanGetAvailableNetworkList WlanGetProfileList WlanOpenHandle WlanEnumInterfaces WlanFreeMemory

iphlpapi

GetAdaptersInfo

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar CompareStringW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock GlobalSize

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime FileTimeToSystemTime GetTimeZoneInformation

api-ms-win-power-setting-l1-1-0

PowerGetActiveScheme

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW

powrprof

PowerSetActiveScheme PowerReadFriendlyName SetSuspendState GetPwrCapabilities PowerEnumerate

api-ms-win-core-wow64-l1-1-1

IsWow64Process2

api-ms-win-core-processthreads-l1-1-3

SetProcessInformation

api-ms-win-core-processthreads-l1-1-2

GetSystemTimes

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW CreateToolhelp32Snapshot Process32NextW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-debug-l1-1-1

ContinueDebugEvent WaitForDebugEvent

wlanapi

WlanScan WlanConnect WlanDisconnect WlanRegisterNotification

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer WindowsDeleteString WindowsGetStringLen

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW

oleacc

AccessibleChildren WindowFromAccessibleObject AccessibleObjectFromWindow

imm32

ImmGetCompositionStringW ImmGetContext ImmGetDefaultIMEWnd ImmSetCompositionWindow ImmReleaseContext ImmAssociateContext

user32

ReleaseDC GetWindowLongW TrackMouseEvent GetWindowPlacement SetActiveWindow GetParent GetTouchInputInfo GetDC GetWindowTextLengthW GetWindow CloseTouchInputHandle ShowWindowAsync CloseWindow SendMessageTimeoutW DeregisterShellHookWindow wsprintfW MsgWaitForMultipleObjects PeekMessageW AllowSetForegroundWindow CopyIcon WindowFromPoint keybd_event OpenClipboard CloseClipboard EmptyClipboard ExitWindowsEx ActivateKeyboardLayout SetWindowTextW SetClipboardData IsClipboardFormatAvailable GetDpiForSystem SetWindowPlacement SendMessageW MonitorFromPoint MonitorFromRect MonitorFromWindow QueryDisplayConfig GetSystemMenu GetDisplayConfigBufferSizes SetForegroundWindow DisplayConfigSetDeviceInfo DisplayConfigGetDeviceInfo EnumDisplaySettingsW SetDisplayConfig GetDpiForWindow GetDoubleClickTime CreatePopupMenu CallNextHookEx MoveWindow DestroyMenu IsGUIThread GetKeyState RegisterClassExW LoadIconW SetCursor UpdateLayeredWindow GetKeyboardLayoutList LoadKeyboardLayoutW SetWindowLongW RegisterShellHookWindow SendMessageTimeoutA GetShellWindow GetLayeredWindowAttributes SetMenu GetClassNameW IsZoomed IsIconic LoadCursorW GetClipboardData GetAncestor BeginPaint SwitchToThisWindow SetFocus AttachThreadInput EndPaint LockWorkStation GetKeyboardLayout GetMessageExtraInfo IsWindow PostMessageA RegisterWindowMessageW GetWindowTextLengthA FindWindowW GetMenuStringW GetSubMenu GetMenuItemCount GetMenu GetMenuItemID FindWindowExW GetMenuState GetCursorPos SetWindowLongPtrA PostQuitMessage KillTimer TranslateMessage SetPropW TranslateAcceleratorW ChangeWindowMessageFilter UnhookWindowsHookEx GetForegroundWindow RegisterHotKey MessageBoxA RegisterTouchWindow SetTimer DispatchMessageW LoadAcceleratorsW RemovePropW CreateWindowExW GetPropW MessageBoxW SetWindowPos IsWindowVisible DestroyWindow PostMessageW UnregisterHotKey DefWindowProcW GetMessageW GetWindowThreadProcessId GetWindowRect FindWindowA GetWindowLongA FindWindowExA SetWindowLongA EnableWindow GetWindowLongPtrA SetLayeredWindowAttributes IsWindowEnabled UnhookWinEvent SetWinEventHook GetDesktopWindow SetWindowsHookExW SendMessageA SendNotifyMessageW UpdateLayeredWindowIndirect SetWindowsHookExA DestroyIcon ShowWindow GetWindowTextW

ole32

CoInitialize OleInitialize OleUninitialize RevokeDragDrop RegisterDragDrop

cfgmgr32

CM_Query_And_Remove_SubTreeW CM_Request_Device_EjectW

comdlg32

GetOpenFileNameW GetSaveFileNameW

kernel32

GetLocaleInfoEx WaitForSingleObjectEx SleepConditionVariableSRW WakeConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork SetFileInformationByHandle AreFileApisANSI FindFirstFileW GetFileInformationByHandleEx GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency EnterCriticalSection InitializeCriticalSectionEx EncodePointer FreeLibraryWhenCallbackReturns DecodePointer LCMapStringEx CompareStringEx GetCPInfo IsProcessorFeaturePresent RtlPcToFileHeader GetPrivateProfileSectionNamesW GetPrivateProfileSectionW GetCompressedFileSizeW GetSystemTimeAsFileTime GetFileAttributesExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter InitializeSListHead GetStartupInfoW WakeAllConditionVariable

shell32

ord6 SHCreateItemFromIDList SHFileOperationW SHGetFileInfoW SHOpenFolderAndSelectItems SHCreateItemFromParsingName SHGetFolderLocation ord727 SHBrowseForFolderW ord195 SHQueryUserNotificationState ShellExecuteW SHAppBarMessage SHGetPathFromIDListW SHGetSpecialFolderLocation ord155 SHCreateItemInKnownFolder SHGetPropertyStoreForWindow SHParseDisplayName SHGetDesktopFolder SHBindToParent SHGetKnownFolderPath DragQueryFileW DragFinish DragAcceptFiles ShellExecuteExW SHEmptyRecycleBinW ord190 SHCreateShellItemArrayFromIDLists ord88

advapi32

CloseServiceHandle GetUserNameW InitiateShutdownW OpenServiceW ControlService

winmm

PlaySoundW

shlwapi

PathFileExistsW PathFindFileNameW PathRemoveFileSpecW PathFindExtensionW PathIsNetworkPathW PathRemoveBackslashW PathIsDirectoryW StrStrIA StrStrIW StrRetToBufW ord487 ord176

gdi32

GetPixel DeleteObject CreateCompatibleDC GetDeviceCaps BitBlt Rectangle SetDIBitsToDevice CreatePen SetBkMode CreateDIBSection SelectObject DeleteDC GetBitmapBits GetStockObject SetLayout GetObjectW

dwmapi

DwmIsCompositionEnabled DwmSetWindowAttribute DwmGetWindowAttribute DwmUnregisterThumbnail DwmRegisterThumbnail DwmQueryThumbnailSourceSize DwmUpdateThumbnailProperties

msimg32

AlphaBlend

dxva2

DestroyPhysicalMonitors GetPhysicalMonitorsFromHMONITOR SetMonitorBrightness GetNumberOfPhysicalMonitorsFromHMONITOR GetMonitorBrightness

steam_api64

SteamAPI_RegisterCallResult SteamAPI_UnregisterCallback SteamAPI_Init SteamAPI_IsSteamRunning SteamAPI_RunCallbacks SteamAPI_UnregisterCallResult SteamInternal_FindOrCreateUserInterface SteamAPI_GetHSteamUser SteamAPI_Shutdown SteamInternal_ContextInit SteamAPI_RegisterCallback

dbghelp

MiniDumpWriteDump

imagehlp

MapFileAndCheckSumW

wtsapi32

WTSRegisterSessionNotification WTSDisconnectSession WTSUnRegisterSessionNotification

virtdisk

OpenVirtualDisk GetStorageDependencyInformation DetachVirtualDisk

bluetoothapis

BluetoothGetRadioInfo BluetoothFindRadioClose BluetoothSetServiceState BluetoothFindFirstRadio

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

version

GetFileVersionInfoSizeW

comctl32

ImageList_Draw ImageList_Create ImageList_ReplaceIcon ImageList_Destroy

rasapi32

RasGetEntryDialParamsW RasHangUpW RasDialW RasEnumConnectionsW RasEnumEntriesW

pdh

PdhCollectQueryData PdhGetFormattedCounterValue PdhCloseQuery PdhOpenQueryW PdhRemoveCounter PdhAddCounterW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InterlockedFlushSList

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP GetConsoleMode ReadConsoleW WriteConsoleW

api-ms-win-core-fibers-l1-1-0

FlsFree FlsGetValue FlsAlloc FlsSetValue

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException