bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9

Sharing

Copy URL Twitter E-mail

General

Target
bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9
Size 4.1MB
Sample260909-ja9vkstdqf
SHA256 bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9
MD5 6238844401f8aff02d953a77b401e4b5
SHA1 dd57cd19231fa739c72b64a82b79565a57012c13
SHA512 9e23383b5f458ac2f51d1ca2dc3514c65431f364f71613b92d3361514b4ca4153406df2fd4afaf47e11aa9b97a895b15cee00c90cb935d9bea24931c61122acd
SSDEEP 49152:3zMByvUrn8JzFg2xG8jRsoWdr20DeC/HTg2mO1qkSKxqHD52MSgvz0qDS9bU82+w:ISxv48aa5KxqH/Sgww82+/kl
TLSH
T15A167C596AEC00E5D4B6D03AC91B891BD7F27C421730479F02A0769BAF737A50E7E326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9

File Explorer

bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9

.exe 4.1MB

bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9

IMPHASH a8ad973ac4c33e01b2886bda2cc83ef5
SHA256 bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9
MD5 6238844401f8aff02d953a77b401e4b5
SHA1 dd57cd19231fa739c72b64a82b79565a57012c13
SHA512 9e23383b5f458ac2f51d1ca2dc3514c65431f364f71613b92d3361514b4ca4153406df2fd4afaf47e11aa9b97a895b15cee00c90cb935d9bea24931c61122acd
SSDEEP 49152:3zMByvUrn8JzFg2xG8jRsoWdr20DeC/HTg2mO1qkSKxqHD52MSgvz0qDS9bU82+w:ISxv48aa5KxqH/Sgww82+/kl
TLSH
T15A167C596AEC00E5D4B6D03AC91B891BD7F27C421730479F02A0769BAF737A50E7E326
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fd:e4:89:c5:07:de:54:44:a7:bb:a7:39:a7:e1:e9:56:1f:d8:9a:d8:b7:2e:1f:7f:0f:bd:50:c5:b8:22:b3:60

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91441900MABXEGDY8D,CN=Dongguan Yingping Technology Co.\, Ltd.,O=Dongguan Yingping Technology Co.\, Ltd.,ST=Guangdong Sheng,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Nov 7, 2025

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

2d:1d:c3:c2:e0:b0:68:2a:b3:59:4e:52:37:dd:7c:23

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Oct 22, 2025

Timespan

Oct 22, 2025 - Jan 20, 2027

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:00:0b:20:05:b3:94:07:62:db:3e:36:79:94:9b:a9

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 11, 2025 - Dec 10, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

2415620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

WinDirStat_x64.pdb

kernel32

GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW IsValidLocale LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetStdHandle GetFileType SetStdHandle HeapQueryInformation VirtualQuery VirtualAlloc GetSystemInfo GetCommandLineW GetCommandLineA FreeLibraryAndExitThread ExitThread CreateThread RtlPcToFileHeader RtlUnwindEx FreeEnvironmentStringsW GetCPInfo CompareStringEx QueryPerformanceFrequency LCMapStringEx GetStringTypeW GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle FindNextFileW FindFirstFileExW WakeConditionVariable WaitForSingleObjectEx GetLocaleInfoEx FormatMessageA TryAcquireSRWLockExclusive RaiseException OutputDebugStringW GetEnvironmentStringsW SetEnvironmentVariableW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetTempPathW SetErrorMode SearchPathW GetProfileIntW Sleep GetCurrentDirectoryW SystemTimeToTzSpecificLocalTime LocalFileTimeToFileTime GetFileSizeEx GetFileAttributesExW GetStringTypeExW MoveFileW lstrcmpiW WriteConsoleW DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile LockFile GetShortPathNameW FlushFileBuffers FindFirstFileW FindClose GetUserDefaultUILanguage GetSystemDefaultUILanguage GetThreadLocale LocalReAlloc LocalAlloc GlobalHandle TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GlobalFlags WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GlobalReAlloc InitializeCriticalSectionAndSpinCount GetFileSize lstrcpyW VirtualProtect CompareStringA lstrcmpA GetCurrentThread GetVersionExW GlobalGetAtomNameW GetUserDefaultLCID ReplaceFileW SetFileTime GetTempFileNameW GetFullPathNameW GetDiskFreeSpaceW SuspendThread SetThreadPriority CreateEventW WaitForSingleObject SetEvent CompareStringW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryExW EncodePointer CopyFileW MulDiv GlobalSize QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GetModuleHandleExW SetLastError OutputDebugStringA GetWindowsDirectoryW GetCurrentProcessId TerminateProcess OpenProcess K32GetProcessMemoryInfo GetModuleHandleW GetDiskFreeSpaceExW ResumeThread ExitProcess GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc HeapReAlloc HeapSize InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapFree GetUserDefaultLangID GetVolumePathNamesForVolumeNameW FindNextVolumeW FindVolumeClose FindFirstVolumeW GetDriveTypeW GlobalUnlock GlobalLock GlobalFree GlobalAlloc LocaleNameToLCID EnumResourceLanguagesExW ReadFile GetFileTime DeviceIoControl DeleteFileW SizeofResource FormatMessageW LocalFree GetFinalPathNameByHandleW CreateFileW GetVolumePathNameW GetCurrentThreadId GetSystemDirectoryW GetCurrentProcess QueryDosDeviceW GetLogicalDrives GetEnvironmentVariableW GetVolumeInformationW GetTimeFormatW GetDateFormatW FileTimeToLocalFileTime GetLocaleInfoW GetCompressedFileSizeW GetFileAttributesW GetProcAddress GetModuleFileNameW FreeLibrary LoadLibraryW CloseHandle GetLastError CreateProcessW VerSetConditionMask VerifyVersionInfoW GetExitCodeThread MultiByteToWideChar WideCharToMultiByte SystemTimeToFileTime FileTimeToSystemTime GetTickCount64 FindResourceW FindResourceExW LoadResource LockResource RtlUnwind

user32

GetActiveWindow IntersectRect GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW IsDialogMessageW IsWindowEnabled CheckDlgButton MoveWindow ShowWindow GetMenuCheckMarkDimensions SetMenuItemBitmaps CheckMenuItem GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow GetLastActivePopup GetTopWindow GetClassNameW GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW EqualRect MapWindowPoints MessageBoxW AdjustWindowRectEx GetWindowTextLengthW RemovePropW GetPropW SetPropW DrawFrameControl GetSysColorBrush SetParent MonitorFromPoint DestroyMenu DestroyIcon InflateRect SendMessageW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow ValidateRect EndPaint BeginPaint GetForegroundWindow SetActiveWindow TrackPopupMenuEx TrackPopupMenu SetMenu GetMenu SetFocus GetDlgCtrlID GetDlgItem IsWindowVisible SetWindowPlacement GetWindowPlacement SetWindowPos DestroyWindow IsChild SendDlgItemMessageA GetClassInfoExW ReuseDDElParam CreateDialogIndirectParamW EndDialog GetNextDlgTabItem PostQuitMessage GetAsyncKeyState MapDialogRect SetCursorPos DestroyCursor DestroyAcceleratorTable SetWindowRgn NotifyWinEvent IsZoomed IsRectEmpty CopyImage GetIconInfo TrackMouseEvent CharUpperW GetSystemMenu MessageBeep SystemParametersInfoW CallWindowProcW DefWindowProcW GetMessageTime SetRectEmpty LoadAcceleratorsW TranslateAcceleratorW InsertMenuItemW SetCursor LoadImageW GetSysColor UnpackDDElParam EnableWindow InvalidateRect GetSystemMetrics DrawFocusRect IsWindow CopyRect OffsetRect PostMessageW GetFocus GetClientRect FillRect GetKeyState PtInRect LockWindowUpdate LoadMenuW GetSubMenu DeleteMenu SetMenuDefaultItem ModifyMenuW GetWindowRect GetDesktopWindow GetParent DrawEdge RedrawWindow SetCapture GetMessageW GetCapture ScreenToClient DispatchMessageW ReleaseCapture GetMenuState CreatePopupMenu PeekMessageW MsgWaitForMultipleObjects GetWindowThreadProcessId RegisterWindowMessageW TranslateMessage LoadIconW LoadCursorW BeginDeferWindowPos EndDeferWindowPos DeferWindowPos InvertRect GetMenuItemCount GetMenuItemInfoW SetMenuItemInfoW IsMenu GetWindowTextW SetWindowTextW EnumChildWindows OpenClipboard EmptyClipboard CloseClipboard LoadBitmapW SetTimer KillTimer IsIconic SetClipboardData EnableMenuItem AppendMenuW UnregisterClassW GetClassInfoW RegisterClassW GetCursorPos UpdateWindow BringWindowToTop SetForegroundWindow ClientToScreen DrawIconEx CopyIcon HideCaret GetKeyNameTextW MapVirtualKeyW GetDC ReleaseDC GetMenuStringW GetMenuItemID InsertMenuW EnableScrollBar FrameRect PostThreadMessageW SetWindowContextHelpId RemoveMenu GetMessagePos WindowFromPoint DrawStateW RegisterClipboardFormatW ShowOwnedPopups WaitMessage RealChildWindowFromPoint UnionRect GetMenuDefaultItem UpdateLayeredWindow DrawIcon CopyAcceleratorTableW SetLayeredWindowAttributes EnumDisplayMonitors SetRect IsClipboardFormatAvailable SetClassLongPtrW CharUpperBuffW ToUnicodeEx GetKeyboardLayout GetKeyboardState CreateAcceleratorTableW GetDoubleClickTime DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel SubtractRect GetUpdateRect GetNextDlgGroupItem CharNextW InvalidateRgn CreateMenu GetWindowRgn IsCharLowerW MapVirtualKeyExW GetComboBoxInfo CreateWindowExW

gdi32

GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PtVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectObject SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CombineRgn CreateFontIndirectW GetMapMode SetRectRgn GetStockObject GetTextMetricsW CreateRoundRectRgn GetDIBits RealizePalette SetPixel StretchBlt CreateDIBSection SetDIBColorTable GetTextColor CreateEllipticRgn GetBkColor CreatePolygonRgn Polygon Polyline CreatePalette GetNearestPaletteIndex GetSystemPaletteEntries EnumFontFamiliesExW LPtoDP CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetRgnBox OffsetRgn RoundRect FrameRgn PtInRegion SetPixelV GetWindowOrgEx FillRgn GetBoundsRect GetViewportOrgEx GetPaletteEntries ExtFloodFill SetPaletteEntries GetTextFaceW GetPixel GetObjectType GetClipBox ExcludeClipRect Escape DeleteObject CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush GetObjectW SetTextColor SetBkColor GetDeviceCaps CreateDCW CopyMetaFileW PatBlt CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateBitmap Rectangle Ellipse GetTextExtentPoint32W DeleteDC DPtoLP RectVisible CreateRectRgnIndirect

msimg32

TransparentBlt AlphaBlend

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegSetValueW AllocateAndInitializeSid CheckTokenMembership OpenProcessToken GetTokenInformation RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW SetFileSecurityW GetFileSecurityW FreeSid RegQueryValueExW RegOpenKeyExW RegCloseKey RegDeleteTreeW GetNamedSecurityInfoW ConvertSidToStringSidW LookupAccountSidW AdjustTokenPrivileges LookupPrivilegeValueW

shell32

ExtractIconW SHGetDesktopFolder SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc SHAddToRecentDocs SHAppBarMessage DragFinish DragQueryFileW SHGetFileInfoW ShellExecuteW SHQueryRecycleBinW SHBindToParent SHOpenFolderAndSelectItems SHEmptyRecycleBinW ShellExecuteExW ord190 SHGetSpecialFolderLocation SHCreateItemFromIDList SHGetKnownFolderIDList

comctl32

InitCommonControlsEx ord8

shlwapi

PathStripToRootW PathIsUNCW PathRemoveFileSpecW PathFindFileNameW PathFindExtensionW PathFileExistsW StrFormatKBSizeW

uxtheme

DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetThemeSysColor GetWindowTheme GetCurrentThemeName IsAppThemed DrawThemeText IsThemeBackgroundPartiallyTransparent GetThemePartSize

ole32

OleTranslateAccelerator OleLockRunning IsAccelerator StgCreateDocfileOnILockBytes CoRevokeClassObject CoGetClassObject RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop OleIsCurrentClipboard OleFlushClipboard CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes CoDisconnectObject CLSIDFromProgID CLSIDFromString OleUninitialize CoFreeUnusedLibraries CoRegisterMessageFilter CoInitialize CreateStreamOnHGlobal CoCreateGuid CoInitializeEx CoUninitialize ReleaseStgMedium OleDuplicateData CoTaskMemAlloc StringFromCLSID OleInitialize CoCreateInstance CoTaskMemFree OleDestroyMenuDescriptor OleCreateMenuDescriptor

oleaut32

SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime LoadTypeLi SysAllocString VariantChangeType VariantClear VariantInit SysAllocStringLen SysFreeString VarBstrFromDate OleCreateFontIndirect VariantCopy SysStringLen

oledlg

OleUIBusyW

gdiplus

GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipGetImageWidth GdipCreateBitmapFromHBITMAP GdipSetInterpolationMode GdipDrawImageRectI GdipGetImageGraphicsContext GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDeleteFont GdipCreatePen1 GdipDeletePen GdipCreateSolidFill GdipDisposeImage GdipCloneImage GdiplusStartup GdiplusShutdown GdipDrawString GdipDrawPieI GdipDrawImageI GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipDeleteBrush GdipFillPieI GdipFree GdipAlloc

ntdll

NtOpenFile RtlDecompressBuffer NtClose

powrprof

CallNtPowerInformation

crypt32

CryptBinaryToStringW

bcrypt

BCryptCreateHash BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptFinishHash

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9

PE Signature issue

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ntdll

powrprof

crypt32

bcrypt

version

oleacc

imm32

winmm

generic