tung_full[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
tung_full.exe
Size 16.0MB
Sample260922-txlrdaad49
SHA256 1f0bfbfa0771600d9325ca85b2e8103161b98cfbebe20abbd1be3f8390412b7f
MD5 e509ba90832ebea2d8af27f53736cbf7
SHA1 8e5628cbb02e4d4e43e11154e5582b4175b690a8
SHA512 b8607fbb3b33b5bda79085240dfd6419fa0ed67cc903b40a570e56a08388f3ae7b17f0105d3554fc54524e4ec40a8dc2ea8c186665a85f3bd510101638913744
SSDEEP 196608:hRupgvHk9t2agl6VYcIKevf+SUWg/ZJ1q464NZZEl0QfRwMnFdEZpndS6642a5+6:hYo3fRwZpdd2aX
TLSH
T19EF65C0367874DE5CCC26B74A59F233DA720FD219E391F7B9A6886301E533D89D2AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
tung_full.exe

File Explorer

tung_full.exe

.exe 16.0MB

tung_full.exe

IMPHASH 7567831612022b59e8d5e0a95265c096
SHA256 1f0bfbfa0771600d9325ca85b2e8103161b98cfbebe20abbd1be3f8390412b7f
MD5 e509ba90832ebea2d8af27f53736cbf7
SHA1 8e5628cbb02e4d4e43e11154e5582b4175b690a8
SHA512 b8607fbb3b33b5bda79085240dfd6419fa0ed67cc903b40a570e56a08388f3ae7b17f0105d3554fc54524e4ec40a8dc2ea8c186665a85f3bd510101638913744
SSDEEP 196608:hRupgvHk9t2agl6VYcIKevf+SUWg/ZJ1q464NZZEl0QfRwMnFdEZpndS6642a5+6:hYo3fRwZpdd2aX
TLSH
T19EF65C0367874DE5CCC26B74A59F233DA720FD219E391F7B9A6886301E533D89D2AB50
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4b:44:5b:99:44:3d:7f:57:a8:41:7b:39:21:8b:c9:46:71:ce:e7:b1:97:ee:52:a2:ac:3b:24:3c:6f:c1:14:61

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Runtime Systems Code Signing,O=Runtime Systems Ltd.,C=US

Chains

Sep 22, 2026

CN=Runtime Systems Code Signing,O=Runtime Systems Ltd.,C=US

Subject

CN=Runtime Systems Code Signing,O=Runtime Systems Ltd.,C=US

Serial Number

11:9b:3a:93:23:3e:b2:80:70:6f:ff:fc:46:e6:b7:39:31:e0:41:70

Issuer

CN=Runtime Systems Code Signing,O=Runtime Systems Ltd.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 16, 2026 - Sep 15, 2029

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegGetValueA RegQueryValueExA

bcrypt

BCryptGenRandom

kernel32

AreFileApisANSI CloseHandle CopyFileA CreateDirectoryA CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexA CreateMutexW CreatePipe CreateProcessA CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileA DeleteFileW DisconnectNamedPipe DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeLibrary GetComputerNameExA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetDriveTypeA GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileSize GetFullPathNameA GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStartupInfoA GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempFileNameA GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GetVersionExA GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection IsDBCSLeadByte K32GetModuleInformation LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveDirectoryA ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEvent SetFileAttributesA SetFilePointer SetFileTime SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile __C_specific_handler

api-ms-win-crt-convert-l1-1-0

atoi atol mbrtowc mbsrtowcs strtol strtoul strtoull wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

longjmp memchr memcmp memcpy memmove strchr strrchr __intrinsic_setjmp

api-ms-win-crt-runtime-l1-1-0

_set_app_type _assert __p___argc __p___argv __p__acmdln _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _initterm _initterm_e _register_thread_local_exe_atexit_callback _set_errno _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s _get_osfhandle _setmode _wfopen fclose fflush fputc fputs fwrite setvbuf fopen _write _read _lseeki64 _fileno

api-ms-win-crt-string-l1-1-0

iswctype isalnum isxdigit memset strcmp strcoll strcspn strlen strncmp strncpy_s strnlen strspn strxfrm tolower towlower towupper wcscmp wcscoll wcslen wcsnlen wcsxfrm wctype _stricmp _strdup

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

user32

CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA DispatchMessageW GetCursorPos GetDC GetMessageA GetMessageW GetPropA GetSystemMetrics GetWindowLongA LoadIconA LockWorkStation MessageBoxA PeekMessageW PostMessageA PostQuitMessage RegisterClassA ReleaseDC RemovePropA SetLayeredWindowAttributes SetPropA SetTimer SetWindowLongA SetWindowPos ShowWindow SystemParametersInfoA ToUnicode TranslateMessage

winmm

mciSendStringA

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

540KB

Virtual Size

540KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

243KB

Virtual Size

243KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

268KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/107

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/123

Size

357KB

Virtual Size

357KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tung_full.exe

PE Signature issue

advapi32

bcrypt

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

user32

winmm

generic