EWdPQbu[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
EWdPQbu.exe
Size 17.7MB
Sample260924-dr4f8scg75
SHA256 ac6939cd0831155c28b25ee2495f1334d1e731aecd195e0a422f485d53900e09
MD5 4d82fa9776e5452063fabf59a66c4347
SHA1 6671b41a6fbdb005d61126309846478a29018e1d
SHA512 a21ccbf3f799b356c4e3991f96635c8424147895d2eca908403f01d129265db64097341182927acdb509b093eee5d6e70d3d75d419fda262ae81e6dc62722f29
SSDEEP 98304:6NCZYlyiPFJOBkUYbBhKmObcLCVyBtcNuWIT7MSbd614/waNqS+7Gg71JUufBtr:Q9bOBYBhFE4ehIT7dbk4/waNlJgppr
TLSH
T1FC177C14AA4F68ACC55EC070838646725A713CDB0B35B9FF48D5BA743F79AF42E38618
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
EWdPQbu.exe

File Explorer

EWdPQbu.exe

.exe 17.7MB

EWdPQbu.exe

IMPHASH f136e06a4c64d76df4467c5c7114f97f
SHA256 ac6939cd0831155c28b25ee2495f1334d1e731aecd195e0a422f485d53900e09
MD5 4d82fa9776e5452063fabf59a66c4347
SHA1 6671b41a6fbdb005d61126309846478a29018e1d
SHA512 a21ccbf3f799b356c4e3991f96635c8424147895d2eca908403f01d129265db64097341182927acdb509b093eee5d6e70d3d75d419fda262ae81e6dc62722f29
SSDEEP 98304:6NCZYlyiPFJOBkUYbBhKmObcLCVyBtcNuWIT7MSbd614/waNqS+7Gg71JUufBtr:Q9bOBYBhFE4ehIT7dbk4/waNlJgppr
TLSH
T1FC177C14AA4F68ACC55EC070838646725A713CDB0B35B9FF48D5BA743F79AF42E38618
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

78:80:8a:e6:ee:df:9d:60:c2:5f:1d:77:cf:6f:4e:c6:82:3c:6a:e0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=322100100004335,CN=IP Chegodaev Vladislav Vladimirovich,O=IP Chegodaev Vladislav Vladimirovich,L=Petrozavodsk,ST=Republic of Karelia,C=RU,1.2.840.113549.1.9.1=#0c18636865672e766c616469736c61764079616e6465782e7275,1.3.6.1.4.1.311.60.2.1.2=#131352657075626c6963206f66204b6172656c6961,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Jul 3, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

23:cb:28:53:af:16:6c:42:b3:95:da:f9

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 3, 2026 - Jul 26, 2027

Minor OS version

Major OS version

Entry point

8749568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

melonity_launcher.pdb

kernel32

LoadLibraryA FormatMessageW CloseHandle LoadLibraryExA LoadLibraryW GetLastError GetUserDefaultLocaleName GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable lstrlenW WaitForSingleObject AcquireSRWLockExclusive CreateFileW SetHandleInformation Sleep GetModuleHandleA LoadLibraryExW GetCurrentProcessId VirtualQueryEx GetSystemInfo SetNamedPipeHandleState GetTimeZoneInformationForYear GetProcessTimes LocalFree GetExitCodeProcess OpenProcess GetSystemTimes GetProcessIoCounters ReadProcessMemory FreeLibrary OutputDebugStringW LCIDToLocaleName GetUserDefaultUILanguage OutputDebugStringA GetProcAddress HeapFree GetCurrentThreadId GetProcessHeap HeapAlloc GetModuleHandleW GetOverlappedResult PostQueuedCompletionStatus ReadFile WriteFile CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx ReleaseSRWLockExclusive GetModuleFileNameW SetFileCompletionNotificationModes GetFileAttributesW SetThreadErrorMode GetCurrentProcess InitializeSListHead SetUnhandledExceptionFilter AllocConsole SetConsoleTitleA RtlVirtualUnwind GetEnvironmentVariableW CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW MoveFileExW SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread ReadFileEx DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer SetCurrentDirectoryW FindNextFileW

advapi32

RegOpenKeyTransactedW GetLengthSid EventRegister EventSetInformation EventWriteTransfer EventUnregister SystemFunction036 IsValidSid GetTokenInformation OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey CopySid RegGetValueW RegCreateKeyTransactedW RegCreateKeyExW

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

ntdll

RtlGetVersion NtCancelIoFileEx NtCreateNamedPipeFile NtOpenFile NtWriteFile NtReadFile NtQueryInformationProcess NtQuerySystemInformation RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile

user32

GetMenuItemInfoW CreateIcon LoadImageW DestroyIcon SetForegroundWindow SetWindowLongPtrW GetWindowLongPtrW RegisterClassW SendMessageW SetMenu DrawMenuBar RegisterWindowMessageA DestroyAcceleratorTable CreateAcceleratorTableW IsIconic GetSystemMetrics DestroyWindow PostMessageW EnumWindows SendMessageA PostQuitMessage SendInput GetActiveWindow InsertMenuW AppendMenuW SetMenuItemInfoW GetMenu CreateMenu CreatePopupMenu RemoveMenu CheckMenuItem SendMessageTimeoutA EnableMenuItem GetWindowThreadProcessId IsWindowVisible EnumChildWindows RegisterClassExW DispatchMessageA GetMessageA GetDC GetWindowRect MoveWindow InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW DefWindowProcW GetMessageW ShowWindow SetWindowPos GetAsyncKeyState MessageBoxW FindWindowA SystemParametersInfoA ToUnicodeEx ReleaseDC DrawIconEx MapVirtualKeyW DestroyMenu IsProcessDPIAware GetKeyboardLayout GetMenuBarInfo RegisterTouchWindow IsWindow CreateWindowExW AdjustWindowRectEx LoadCursorW DispatchMessageW TranslateMessage GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect SetCursor CloseTouchInputHandle GetTouchInputInfo RedrawWindow TrackMouseEvent SystemParametersInfoW FillRect GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient MapWindowPoints GetForegroundWindow OffsetRect GetWindowDC DrawTextW GetKeyState SetFocus GetWindow MsgWaitForMultipleObjectsEx SetCapture ReleaseCapture RegisterRawInputDevices ShowCursor GetClipCursor ClipCursor GetSystemMenu SetWindowLongW SetPropW SetWindowDisplayAffinity SetWindowTextW MonitorFromPoint EnumDisplayMonitors GetRawInputData MapVirtualKeyExW GetKeyboardState

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shell32

DragFinish SHAppBarMessage CommandLineToArgvW DragQueryFileW SHCreateItemFromParsingName

ole32

CoCreateInstance CoUninitialize CoTaskMemFree CoCreateFreeThreadedMarshaler RegisterDragDrop OleInitialize RevokeDragDrop CoTaskMemAlloc CoInitializeEx

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass

gdi32

CreateCompatibleDC CreateRectRgn CreateDIBSection SelectObject DeleteDC GetDeviceCaps CreateSolidBrush DeleteObject SetBkMode SetTextColor

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

shlwapi

SHCreateMemStream AssocQueryStringW

bcryptprimitives

ProcessPrng

secur32

EncryptMessage AcceptSecurityContext InitializeSecurityContextW FreeContextBuffer DecryptMessage QueryContextAttributesW DeleteSecurityContext AcquireCredentialsHandleA FreeCredentialsHandle ApplyControlToken

ws2_32

WSACleanup WSAStartup freeaddrinfo listen getaddrinfo bind WSASocketW WSAIoctl connect ioctlsocket setsockopt send WSASend recv closesocket getsockname WSAGetLastError getsockopt accept getpeername shutdown

crypt32

CertDuplicateStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChain CertDuplicateCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext CertAddCertificateContextToStore CertOpenStore CertEnumCertificatesInStore CertCloseStore

pdh

PdhRemoveCounter PdhCloseQuery

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

bcrypt

BCryptGenRandom

vcruntime140

__C_specific_handler __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __CxxFrameHandler3 _CxxThrowException _purecall wcsrchr memmove memset memcmp memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

pow round roundf floor __setusermatherr trunc ceil

api-ms-win-crt-string-l1-1-0

wcslen strlen _wcsicmp wcscmp

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _set_app_type _crt_atexit _register_onexit_function _cexit _wassert _initialize_onexit_table _seh_filter_exe __p___argc __p___argv

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode calloc _callnewh

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

EWdPQbu.exe

kernel32

advapi32

oleaut32

ntdll

user32

api-ms-win-core-synch-l1-2-0

shell32

ole32

comctl32

gdi32

dwmapi

shlwapi

bcryptprimitives

secur32

ws2_32

crypt32

pdh

powrprof

psapi

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic