0a7de8bc6e203ee817060c796665e06a965890ce7bdb06a61932667dc206ad6f

Sharing

Copy URL Twitter E-mail

General

Target
0a7de8bc6e203ee817060c796665e06a965890ce7bdb06a61932667dc206ad6f
Size 1.5MB
Sample260924-e64wzsyfmg
SHA256 0a7de8bc6e203ee817060c796665e06a965890ce7bdb06a61932667dc206ad6f
MD5 cf9c42d2845e566b9fb86bcd1c8a750b
SHA1 a00ed2b22880a09ca05b3eab8e0aae0baa4c41b4
SHA512 65e376ca822658a813324a496c4061f198874fb288a94523ff7ee63f880fa74e4bb2f003faeb3b90531516f3f331e9ae1fc231ff6993ba0855109bc637e8a826
SSDEEP 24576:XNTUAnXoEYHEYEeEqIjUidI0H+sK5da041/OqcYtK7F6PuA1B9hyZo+jlIs9:FUAXoEkEYEeEqhcH+sK5daHWP7F6PuU4
TLSH
T190758D1175808135F9BF11728B7DAE6D419CA9600B2488DB63DC1A7E9F30EE37E32A57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

0a7de8bc6e203ee817060c796665e06a965890ce7bdb06a61932667dc206ad6f

.dll 1.5MB

0a7de8bc6e203ee817060c796665e06a965890ce7bdb06a61932667dc206ad6f

IMPHASH c26df103fe4291c2e26d587e5798ff1f
SHA256 0a7de8bc6e203ee817060c796665e06a965890ce7bdb06a61932667dc206ad6f
MD5 cf9c42d2845e566b9fb86bcd1c8a750b
SHA1 a00ed2b22880a09ca05b3eab8e0aae0baa4c41b4
SHA512 65e376ca822658a813324a496c4061f198874fb288a94523ff7ee63f880fa74e4bb2f003faeb3b90531516f3f331e9ae1fc231ff6993ba0855109bc637e8a826
SSDEEP 24576:XNTUAnXoEYHEYEeEqIjUidI0H+sK5da041/OqcYtK7F6PuA1B9hyZo+jlIs9:FUAXoEkEYEeEqhcH+sK5daHWP7F6PuU4
TLSH
T190758D1175808135F9BF11728B7DAE6D419CA9600B2488DB63DC1A7E9F30EE37E32A57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

ce:51:bb:f2:03:c0:1f:82:74:5d:c9:72:be:2a:68:5f:52:3b:38:7d:e4:b2:01:ac:1a:fe:b6:ee:0a:e7:de:02

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91120104MAD2WA688E,CN=天津星聚时代科技有限公司,O=天津星聚时代科技有限公司,ST=天津市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e58d97e5bc80e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Sep 23, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0f:18:cf:7d:00:72:0d:a8:da:36:11:96:b0:94:b7:6d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 30, 2026 - Apr 21, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

432855

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\Jenkins\.jenkins\workspace\clean_master\fresh_home_support\base\webview2\webview2\Release\web_vision_base.pdb

kernel32

LeaveCriticalSection SetEvent WaitForSingleObject CreateEventW WaitForMultipleObjects GetCurrentThreadId RegisterWaitForSingleObject UnregisterWait GetTempFileNameW GetTempPathW InitializeCriticalSectionEx FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar WideCharToMultiByte GetModuleFileNameW GetExitCodeProcess GetCommandLineW CreateProcessW EnterCriticalSection GetProcAddress LoadLibraryW RtlCaptureStackBackTrace InitializeCriticalSectionAndSpinCount WriteConsoleW FlushFileBuffers ReadConsoleW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW InitializeCriticalSection SetLastError CloseHandle FreeLibrary DeleteCriticalSection HeapSize HeapFree HeapReAlloc HeapAlloc GetDateFormatW GetStdHandle GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType DeleteFileW ExitProcess GetModuleHandleExW ResumeThread ExitThread RtlUnwind WaitForMultipleObjectsEx CreateTimerQueue UnregisterWaitEx QueryDepthSList HeapDestroy GetLastError RaiseException SetEndOfFile DecodePointer IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA FormatMessageW TryEnterCriticalSection GetCPInfo SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW QueryPerformanceCounter QueryPerformanceFrequency CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW GetCurrentProcessId ReleaseMutex CreateMutexW LocalFree CreateFileW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW GetFileSizeEx ReadFile WriteFile WaitForSingleObjectEx Sleep SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualProtect SetProcessAffinityMask DuplicateHandle ReleaseSemaphore InterlockedFlushSList GetFileSize

user32

SetWindowLongW GetWindowLongW SetWindowTextW FindWindowW IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostMessageW SendMessageTimeoutW SendMessageW wsprintfW UnregisterClassW LoadCursorW WaitForInputIdle CopyRect DestroyWindow

gdi32

GetTextExtentPoint32W GetStockObject DeleteObject SelectObject

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW RegGetValueW

shell32

SHCreateDirectoryExW ShellExecuteExW SHGetSpecialFolderPathW

ole32

CoCreateGuid CoInitialize StringFromGUID2 CoUninitialize

oleaut32

SysAllocStringLen SysFreeString

shlwapi

PathCombineW PathFindExtensionW PathIsRelativeW PathIsDirectoryW PathAppendA PathFindExtensionA PathCompactPathW PathRemoveFileSpecW PathAppendW StrStrIW PathIsRootW PathFileExistsW

crypt32

CryptStringToBinaryW CryptBinaryToStringA CryptBinaryToStringW CryptStringToBinaryA

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

228KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shared

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0a7de8bc6e203ee817060c796665e06a965890ce7bdb06a61932667dc206ad6f

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

version

generic