d3a15753a27374bf7a0e12eccfc5c64664d5d2179bda700bfa87bd68b844732a

Sharing

Copy URL Twitter E-mail

General

Target
d3a15753a27374bf7a0e12eccfc5c64664d5d2179bda700bfa87bd68b844732a
Size 836KB
Sample260908-n3zmjayvb1
SHA256 d3a15753a27374bf7a0e12eccfc5c64664d5d2179bda700bfa87bd68b844732a
MD5 874e1d32427c5099c3888de934f65cb3
SHA1 5348b73ac306a58abe3e03fc72734f3a4b78bc27
SHA512 798c03849cf3a1f1f0c043565719fa66071e4b16cb0766dd48aac24019e8d66041b72c612dd10d942cfaef53dcac8f1d23477e5b157b12595a4a9ff942e45c77
SSDEEP 12288:Gu2P5/u0P8VbAL96X1lD9r2IFeyPJoXBdvRO:GZP5/u0PAbAL0xzFeyJ6O
TLSH
T18B058C2539569D27C3514675B8E6F2BACE2A7EEC291142476EC3BEDF3D317402AF1208
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
d3a15753a27374bf7a0e12eccfc5c64664d5d2179bda700bfa87bd68b844732a

File Explorer

d3a15753a27374bf7a0e12eccfc5c64664d5d2179bda700bfa87bd68b844732a

.exe 836KB

d3a15753a27374bf7a0e12eccfc5c64664d5d2179bda700bfa87bd68b844732a

IMPHASH 85511798f7b1a0baece22d2e6c560f92
SHA256 d3a15753a27374bf7a0e12eccfc5c64664d5d2179bda700bfa87bd68b844732a
MD5 874e1d32427c5099c3888de934f65cb3
SHA1 5348b73ac306a58abe3e03fc72734f3a4b78bc27
SHA512 798c03849cf3a1f1f0c043565719fa66071e4b16cb0766dd48aac24019e8d66041b72c612dd10d942cfaef53dcac8f1d23477e5b157b12595a4a9ff942e45c77
SSDEEP 12288:Gu2P5/u0P8VbAL96X1lD9r2IFeyPJoXBdvRO:GZP5/u0PAbAL0xzFeyJ6O
TLSH
T18B058C2539569D27C3514675B8E6F2BACE2A7EEC291142476EC3BEDF3D317402AF1208
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ce:1c:04:cd:c6:a4:af:03:07:33:fb:c0:fe:3e:45:05:4f:06:b7:9c:02:27:f1:6a:7f:39:c6:fd:13:2e:15:a1

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Chains

Apr 19, 2025

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Serial Number

0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2022 - Oct 17, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

43899

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\dailybuild_dev\wegame_client\build\bin\Release\wegameservice.pdb

7s9k2f

?name@Shared_mem_obj@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV45@@Z ?file_exists@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?is_shared_mem_exist@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?size@Shared_mem_obj@common@ierd_tgp@@QAEIXZ ??1Shared_mem_obj@common@ierd_tgp@@QAE@XZ ?close@Shared_mem_obj@common@ierd_tgp@@QAEXXZ ?open@Shared_mem_obj@common@ierd_tgp@@QAEPAXW4mode_t@interprocess@boost@@_N@Z ??0Shared_mem_obj@common@ierd_tgp@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I0_N@Z ?get_log_instance@base@@YAPAVILogger@1@XZ

kernel32

QueryPerformanceCounter TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent GetProcAddress Sleep GetSystemInfo GetModuleHandleA GlobalAddAtomA GetCurrentProcessId CloseHandle GetTickCount OpenMutexW GetModuleFileNameW GetCurrentThreadId GetCommandLineW OutputDebugStringA GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitializeSListHead GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent SetEvent LeaveCriticalSection EnterCriticalSection OutputDebugStringW IsDebuggerPresent GetSystemTimeAsFileTime CreateProcessW

user32

LoadIconA GetCursorPos SetForegroundWindow GetClassInfoA AppendMenuW DestroyMenu CreatePopupMenu IsMenu IsWindow CreateWindowExA TrackPopupMenu RegisterClassA DefWindowProcA UnregisterHotKey RegisterHotKey RegisterWindowMessageA PeekMessageA DispatchMessageA TranslateMessage

shell32

Shell_NotifyIconW ShellExecuteExW

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor

msvcp140

?id@?$ctype@D@std@@2V0locale@2@A ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Xlength_error@std@@YAXPBD@Z ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPBD@Z ??Bid@locale@std@@QAEIXZ ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?is@?$ctype@D@std@@QBE_NFD@Z ?widen@?$ctype@D@std@@QBEDD@Z ?narrow@?$ctype@D@std@@QBEDDD@Z ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?good@ios_base@std@@QBE_NXZ ?exceptions@ios_base@std@@QAEXH@Z ?flags@ios_base@std@@QBEHXZ ?flags@ios_base@std@@QAEHH@Z ?precision@ios_base@std@@QAE_J_J@Z ?width@ios_base@std@@QBE_JXZ ?width@ios_base@std@@QAE_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ

vcruntime140

memchr _except_handler4_common _purecall __std_type_info_compare __std_exception_destroy __std_exception_copy wcsrchr _CxxThrowException memmove memset memcpy __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _get_initial_narrow_environment _initterm _initialize_narrow_environment exit _exit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _invalid_parameter_noinfo_noreturn terminate _controlfp_s _initterm_e _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

wcslen wcscpy_s

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

d3a15753a27374bf7a0e12eccfc5c64664d5d2179bda700bfa87bd68b844732a

PE Signature issue

7s9k2f

kernel32

user32

shell32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic