95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee

Sharing

Copy URL Twitter E-mail

General

Target
95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee
Size 8.9MB
Sample260922-ry6f3age74
SHA256 95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee
MD5 28ec41d6b31566a5d31c9350257e104f
SHA1 c233bf3ce8902821154ec56d4ebaf2d580ba1295
SHA512 b75a4b8bbd0398b611d549dafcaa059e13880c428ad5979d6856c4150e95397899bd0065374584f5e8687ae8fb250b35540f6f49218482066d5b95aa11309157
SSDEEP 196608:oqo0R5Sm4toXN7iFn6u9LrX8HvkdF3/nRg:oU7Sm1969LryvkD/nRg
TLSH
T1A196DF466EE8C0B9C5E6C03DC6678A9BD3F178410933C7DF56954A0A2F337528F2A366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee

File Explorer

95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee

.dll 8.9MB

95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee

IMPHASH 03662adbb69a5cbf8665483856af6b37
SHA256 95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee
MD5 28ec41d6b31566a5d31c9350257e104f
SHA1 c233bf3ce8902821154ec56d4ebaf2d580ba1295
SHA512 b75a4b8bbd0398b611d549dafcaa059e13880c428ad5979d6856c4150e95397899bd0065374584f5e8687ae8fb250b35540f6f49218482066d5b95aa11309157
SSDEEP 196608:oqo0R5Sm4toXN7iFn6u9LrX8HvkdF3/nRg:oU7Sm1969LryvkD/nRg
TLSH
T1A196DF466EE8C0B9C5E6C03DC6678A9BD3F178410933C7DF56954A0A2F337528F2A366
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

59:86:8f:bb:ba:51:3e:d9:07:e9:c8:70:59:a5:55:a5:32:12:f2:e9:03:99:38:c3:9b:8e:2f:56:fb:a2:e9:c5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91440703345542411W,CN=Jiangmen Eyun Network Co.\, Ltd.,O=Jiangmen Eyun Network Co.\, Ltd.,STREET=蓬江区万达广场16幢2402室,L=Jiangmen,ST=Guangdong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13084a69616e676d656e,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 25, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:3e:c4:8e:b1:e0:d2:fd:e2:e3:00:1d:34:80

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

Serial Number

19:26:1c:f0:1e:83:d6:56:97:04:08:62

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 15, 2024 - May 16, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1845852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

F:\dd\vctools\vc7libs\ship\atlmfc\src\SecurityGuardSDK64\x64\Release\SecurityGuardSDK64.pdb

kernel32

InitializeSListHead CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList VirtualFree GetModuleHandleA GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetStartupInfoW RtlLookupFunctionEntry GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW IsValidLocale FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType SetStdHandle HeapQueryInformation FreeLibraryAndExitThread ExitThread GetCommandLineW GetCommandLineA VirtualQuery VirtualAlloc GetSystemInfo InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx GetCPInfo LCMapStringW SwitchToThread RtlPcToFileHeader TryEnterCriticalSection QueryPerformanceFrequency GetStringTypeW OutputDebugStringW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter QueryPerformanceCounter ReadConsoleW RtlCaptureContext WaitForSingleObjectEx GetUserDefaultLCID FindResourceExW GetProfileIntW SearchPathW GetWindowsDirectoryW lstrcmpiW DuplicateHandle UnlockFile SetEndOfFile LockFile GetVolumeInformationW GetFullPathNameW FlushFileBuffers GetFileTime GetFileAttributesExW FileTimeToLocalFileTime VirtualProtect GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GetCurrentDirectoryW GlobalGetAtomNameW RtlVirtualUnwind LocalReAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc GlobalFlags GetThreadLocale VerifyVersionInfoW VerSetConditionMask WritePrivateProfileStringW SuspendThread SetThreadPriority CreateEventW ReleaseSemaphore FileTimeToSystemTime SystemTimeToTzSpecificLocalTime LocalAlloc lstrcmpA GetVersionExW GetCurrentThread GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryExW GetSystemDirectoryW EncodePointer GetCurrentThreadId FormatMessageW MulDiv LocalFree GlobalSize GlobalAlloc QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GlobalFree GlobalUnlock GlobalLock FreeResource OutputDebugStringA CompareStringW InitializeCriticalSectionAndSpinCount GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc HeapSize InitializeCriticalSectionEx HeapFree CreateThread CreateMutexW SetLastError WriteConsoleW GetStdHandle DeviceIoControl GetComputerNameW GetComputerNameExW GetProductInfo RemoveDirectoryW TerminateProcess GetCurrentProcessId GetModuleHandleExW ResetEvent ResumeThread GetSystemTimeAsFileTime GetModuleHandleW SetEvent SetFileInformationByHandle GetTempFileNameW ExitProcess SetFileAttributesW GetExitCodeProcess WaitForSingleObject lstrcatW VirtualQueryEx Process32NextW GetNativeSystemInfo IsWow64Process OpenProcess CopyFileW Process32FirstW CreateToolhelp32Snapshot GetTempPathW GetLocalTime GetCurrentProcess ReadProcessMemory lstrcpyW lstrlenW GetEnvironmentVariableW GetTickCount SetFilePointerEx GetFileSizeEx LeaveCriticalSection SetFilePointer EnterCriticalSection InitializeCriticalSection UnmapViewOfFile MapViewOfFile CreateFileMappingW GetModuleFileNameW FreeLibrary GetProcAddress LoadLibraryW FindResourceW LoadResource LockResource SizeofResource GetPrivateProfileIntW FindClose FindNextFileW FindFirstFileW CreateProcessW CreateDirectoryW MultiByteToWideChar ReadFile GetFileSize GetPrivateProfileStringW GetPrivateProfileSectionNamesW DeleteFileW GetFileAttributesW CloseHandle WriteFile CreateFileW WideCharToMultiByte Sleep GetLastError GetConsoleMode RtlUnwind

user32

RealChildWindowFromPoint EnumDisplayMonitors LoadCursorW GetSysColorBrush SetLayeredWindowAttributes SystemParametersInfoW InflateRect GetMenuItemInfoW DestroyMenu OffsetRect SetRectEmpty SendDlgItemMessageA SetCursor ShowOwnedPopups MapVirtualKeyW GetKeyNameTextW MapDialogRect SetWindowContextHelpId RegisterClipboardFormatW KillTimer SetTimer WaitMessage TranslateMessage GetMessageW IsDialogMessageW SetWindowTextW CheckDlgButton MoveWindow ShowWindow PostQuitMessage SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW EqualRect CopyRect MapWindowPoints IntersectRect LoadImageW DrawEdge DrawFrameControl DrawFocusRect DrawIconEx ToUnicodeEx EnableWindow AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow ValidateRect SetForegroundWindow GetForegroundWindow GetKeyboardLayout TrackPopupMenu SetMenu GetMenu GetCapture GetKeyState NotifyWinEvent GetDlgCtrlID EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement SetWindowPos IsChild IsMenu CreateWindowExW CreatePopupMenu GetMenuDefaultItem SetMenuDefaultItem IsRectEmpty UpdateLayeredWindow EnableScrollBar UnionRect MonitorFromPoint CopyImage PostThreadMessageW GetNextDlgGroupItem CharNextW CopyAcceleratorTableW InvalidateRgn SetRect TrackMouseEvent GetClassInfoExW GetClassInfoW IsZoomed CharUpperW GetAsyncKeyState SetCapture ReleaseCapture LoadMenuW DeleteMenu SetWindowRgn MessageBeep DestroyIcon WindowFromPoint GetSystemMetrics GetDC ReleaseDC MessageBoxW GetTopWindow GetWindowThreadProcessId IsWindowVisible GetWindowLongW GetWindow LoadIconW GetSystemMenu AppendMenuW SendMessageW IsIconic GetClientRect DrawIcon CharUpperBuffW PostMessageW DrawStateW UpdateWindow InvalidateRect FillRect GetClassNameW LoadBitmapW IsWindow DestroyWindow CreateDialogIndirectParamW EndDialog GetDlgItem GetNextDlgTabItem GetActiveWindow IsWindowEnabled SetActiveWindow GetDesktopWindow GetParent GetLastActivePopup GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW RemoveMenu DrawTextW DrawTextExW GrayStringW TabbedTextOutW GetWindowDC BeginPaint EndPaint ClientToScreen ScreenToClient GetSysColor GetFocus GetWindowRect GetCursorPos PtInRect SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx RegisterWindowMessageW DispatchMessageW PeekMessageW GetMessagePos GetMessageTime DefWindowProcW GetKeyboardState LoadAcceleratorsW CreateAcceleratorTableW DestroyAcceleratorTable CallWindowProcW RegisterClassW SetFocus SetCursorPos SetParent BringWindowToTop LockWindowUpdate SetClassLongPtrW OpenClipboard CloseClipboard SetClipboardData EmptyClipboard ModifyMenuW TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam CopyIcon FrameRect GetIconInfo HideCaret InvertRect GetDoubleClickTime IsCharLowerW MapVirtualKeyExW DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel IsClipboardFormatAvailable GetUpdateRect SubtractRect CreateMenu DestroyCursor GetComboBoxInfo GetWindowRgn

gdi32

SelectClipRgn ExtSelectClipRgn SelectPalette SetBkColor SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextColor SetTextAlign MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateRectRgnIndirect PatBlt CreateFontIndirectW GetTextExtentPoint32W CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetTextMetricsW CombineRgn GetMapMode SetRectRgn SaveDC CreateRoundRectRgn CreateDIBSection GetBkColor GetTextColor GetRgnBox CreateEllipticRgn Ellipse CreatePolygonRgn Polygon Polyline RealizePalette SetPixel StretchBlt SetDIBColorTable OffsetRgn Rectangle EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries LPtoDP RoundRect ExtFloodFill SetPaletteEntries FillRgn FrameRgn GetBoundsRect PtInRegion GetWindowOrgEx GetViewportOrgEx SetPixelV GetTextFaceW RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel GetObjectType GetClipBox ExcludeClipRect Escape CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateBitmap GetDeviceCaps CreateDCW CopyMetaFileW GetObjectW GetStockObject CreateSolidBrush DeleteObject BitBlt SelectObject DeleteDC CreateCompatibleDC DPtoLP CreateCompatibleBitmap

msimg32

TransparentBlt AlphaBlend

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

ControlService RegQueryValueExW RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW FreeSid AllocateAndInitializeSid CheckTokenMembership CreateWellKnownSid GetTokenInformation DeleteService RegOpenKeyExW StartServiceW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW RegDeleteTreeW RegCreateKeyW RegSetValueExW RegCreateKeyExW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey

shell32

DragFinish DragQueryFileW SHAppBarMessage ShellExecuteW SHGetFileInfoW SHGetDesktopFolder SHBrowseForFolderW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc ShellExecuteExW SHGetSpecialFolderPathW SHGetFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootW PathIsUNCW PathFindExtensionW PathFileExistsW PathFindFileNameW PathAppendW PathRemoveFileSpecW StrFormatKBSizeW

uxtheme

GetThemeColor IsAppThemed DrawThemeParentBackground DrawThemeText OpenThemeData CloseThemeData DrawThemeBackground IsThemeBackgroundPartiallyTransparent GetCurrentThemeName GetThemeSysColor GetWindowTheme GetThemePartSize

ole32

RevokeDragDrop RegisterDragDrop OleGetClipboard IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning CreateStreamOnHGlobal DoDragDrop CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoRegisterMessageFilter OleIsCurrentClipboard OleFlushClipboard CoRevokeClassObject CoGetClassObject CoDisconnectObject CoInitialize CoCreateInstance CLSIDFromProgID CLSIDFromString OleUninitialize OleInitialize CoFreeUnusedLibraries CoCreateGuid CoUninitialize ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoInitializeEx CoLockObjectExternal

oleaut32

VariantTimeToSystemTime SystemTimeToVariantTime LoadTypeLi SysStringLen VariantChangeType VariantCopy SysAllocStringLen SysFreeString SysAllocString VariantClear VarBstrFromDate OleCreateFontIndirect SafeArrayDestroy VariantInit

oledlg

OleUIBusyW

gdiplus

GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDrawImageRectI GdipSetInterpolationMode GdipDeleteGraphics GdipCreateFromHDC GdiplusShutdown GdiplusStartup GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdipAlloc GdipFree GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageI GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0

ws2_32

WSASetLastError WSACleanup gethostname WSAStartup

wininet

InternetSetStatusCallbackW InternetReadFile InternetOpenUrlW InternetOpenW InternetWriteFile FtpOpenFileW FtpDeleteFileW FtpGetCurrentDirectoryW InternetConnectW FtpCommandW FtpCreateDirectoryW FtpFindFirstFileW InternetGetLastResponseInfoW InternetCloseHandle InternetSetOptionW InternetQueryOptionW

iphlpapi

GetAdaptersAddresses

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

800KB

Virtual Size

800KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.赞助0

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee

PE Signature issue

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ws2_32

wininet

iphlpapi

oleacc

imm32

winmm

generic