7553cfca0bf7a550d6f92585fdeadf458af3285a98a942e9b39d81b41fa62324

Sharing

Copy URL Twitter E-mail

General

Target
7553cfca0bf7a550d6f92585fdeadf458af3285a98a942e9b39d81b41fa62324
Size 427KB
Sample260924-k9yr2aad49
SHA256 7553cfca0bf7a550d6f92585fdeadf458af3285a98a942e9b39d81b41fa62324
MD5 37403c1bf52e95870d54d3ca7b576366
SHA1 9d0e5858046b13445df11851516fd837ada2d850
SHA512 e2bc333eba50beb570ad7531e7c391b4f1ec03084e42cbe7c4806ab1d697245e4e903f3176a570ac1ed7d264324efe45cbb4b33e14577f61edbb9f11cbb25d53
SSDEEP 12288:fKCXiXNuANy9osP1Rnj2zVr5hOBjvrEH7F1:IgANy9osPnnj2RFurEH7D
TLSH
T1F594AE10B785C375E9A201317B7D9FBB50BDBA39172A44C7E3C41A5A68387D36A30B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
7553cfca0bf7a550d6f92585fdeadf458af3285a98a942e9b39d81b41fa62324

File Explorer

7553cfca0bf7a550d6f92585fdeadf458af3285a98a942e9b39d81b41fa62324

.exe 427KB

7553cfca0bf7a550d6f92585fdeadf458af3285a98a942e9b39d81b41fa62324

IMPHASH 5075afb2ad7c8426cd86ab194ff333a8
SHA256 7553cfca0bf7a550d6f92585fdeadf458af3285a98a942e9b39d81b41fa62324
MD5 37403c1bf52e95870d54d3ca7b576366
SHA1 9d0e5858046b13445df11851516fd837ada2d850
SHA512 e2bc333eba50beb570ad7531e7c391b4f1ec03084e42cbe7c4806ab1d697245e4e903f3176a570ac1ed7d264324efe45cbb4b33e14577f61edbb9f11cbb25d53
SSDEEP 12288:fKCXiXNuANy9osP1Rnj2zVr5hOBjvrEH7F1:IgANy9osPnnj2RFurEH7D
TLSH
T1F594AE10B785C375E9A201317B7D9FBB50BDBA39172A44C7E3C41A5A68387D36A30B27
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

42:a0:43:9c:f8:00:13:cd:75:29:90:25:8a:ad:80:42:4d:8f:bb:2f:32:25:3e:8f:5a:7b:a1:6d:be:1d:56:48

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 8, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

29:5b:f8:6e:85:26:53:40:33:13:83:7b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Apr 26, 2026

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2023 - Dec 4, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

154480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\827272\out\Release\360webshield.pdb

kernel32

InitializeCriticalSectionAndSpinCount DeleteCriticalSection MultiByteToWideChar GetCurrentProcessId GetTickCount InitializeCriticalSection lstrlenW lstrcmpiW lstrcpynW GetPrivateProfileSectionW RaiseException SetEvent WaitForSingleObject CreateEventW Sleep WaitForMultipleObjects CreateThread GetCurrentThreadId lstrcpynA WideCharToMultiByte CreateFileW ReadFile OutputDebugStringW GetFileAttributesExW FreeLibrary lstrlenA GetCommandLineW SetLastError GetCurrentProcess TerminateProcess FlushInstructionCache GetModuleHandleW LoadLibraryExW LoadLibraryW LocalFree GetEnvironmentVariableW CreateDirectoryW SetUnhandledExceptionFilter SetErrorMode CreateProcessW GetLocalTime GetWindowsDirectoryW GetPrivateProfileStringW CreateToolhelp32Snapshot TlsFree EnterCriticalSection TlsGetValue TlsAlloc OpenThread CreateMutexW ReleaseMutex HeapWalk HeapUnlock HeapLock SetFilePointerEx GetFileSizeEx SystemTimeToFileTime LocalFileTimeToFileTime CreateFileA FindResourceW SizeofResource LockResource GetModuleHandleExW ExitProcess LoadResource GetModuleFileNameW FindResourceExW OpenProcess GetLastError CloseHandle GetProcAddress GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc RtlUnwind GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent GetSystemDirectoryW DeviceIoControl VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent HeapDestroy GetVersion Process32NextW LeaveCriticalSection TlsSetValue Process32FirstW GetStringTypeW

user32

DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW LoadCursorW SetWindowLongW GetWindowLongW MessageBoxW GetActiveWindow CharNextW GetClassInfoExW RegisterClassExW CallWindowProcW RegisterWindowMessageW PostMessageW DispatchMessageW TranslateMessage GetMessageW SetTimer PostThreadMessageW FindWindowW IsWindow SendMessageTimeoutW PeekMessageW KillTimer

advapi32

RegQueryValueExA RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegCloseKey

shell32

ShellExecuteW SHGetSpecialFolderPathW CommandLineToArgvW

ole32

CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

SHGetValueW PathFileExistsW PathCombineW StrStrIW PathFindFileNameW StrCpyNW StrCmpNIW StrStrIA PathIsDirectoryW PathAppendW PathRemoveFileSpecW UrlGetPartA StrCmpIW

comctl32

InitCommonControlsEx

psapi

GetModuleFileNameExW

imm32

ImmDisableIME

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

msvcrt

__wgetmainargs __setusermatherr _initterm __p__commode _stricmp _strnicmp __CxxFrameHandler ___lc_codepage_func _lock _unlock _iob _setmode _wcslwr __pctype_func _strlwr _msize __set_app_type _wcmdln memchr _control87 _XcptFilter _fmode _isatty abort _fileno _wcsnicmp strncpy strncmp strrchr atoi ?terminate@@YAXXZ strstr _wtoi ??_U@YAPAXI@Z _setjmp3 longjmp fgetc fflush ferror tolower realloc free wcsstr ??_V@YAXPAX@Z malloc memset memmove memcpy _CxxThrowException _errno ??2@YAPAXI@Z ??3@YAXPAX@Z fputc _time64 fwrite isdigit ??1exception@@UAE@XZ ??0exception@@QAE@ABV0@@Z memcmp ___mb_cur_max_func wcstol strtol localeconv iswctype isspace calloc mbtowc ___lc_handle_func _isctype ??0exception@@QAE@ABQBD@Z _CIlog10 ceil _clearfp _wcstoui64 _strtoui64 _localtime64 isalnum ?what@exception@@UBEPBDXZ

generic

count=2, id=257, version=24225,

count=2, id=257, productName=VS2019 v16.7.0 build 29110, version=29110,

count=11, id=259, version=26706,

count=3, id=260, version=26706,

count=12, id=242, version=40116,

count=2, id=257, version=27032,

count=32, id=261, productName=VS2019 v16.7.0 build 29110, version=29110,

count=4, id=261, productName=VS2019 v16.7.1 build 29111, version=29111,

count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=260, version=27040,

count=23, id=199, version=41118,

count=11, id=260, version=27034,

count=11, id=261, version=27040,

count=3, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=10, id=260, productName=VS2017 v15.7.5 build 26433, version=26433,

count=26, id=261, version=27034,

count=7, id=261, version=26706,

count=1, id=260, version=29395,

count=27, id=257, version=29395,

count=378, id=1, productName=Unmarked objects,

count=25, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,