e9392a46e01c3c5d8429324fdb4fcbde7bf0a9f79ec8849f385d1fd5d3e8eb5e

Sharing

Copy URL Twitter E-mail

General

Target
e9392a46e01c3c5d8429324fdb4fcbde7bf0a9f79ec8849f385d1fd5d3e8eb5e
Size 941KB
Sample260925-jhepeawsbv
SHA256 e9392a46e01c3c5d8429324fdb4fcbde7bf0a9f79ec8849f385d1fd5d3e8eb5e
MD5 d4e0a825d571705b2605a69720bb652d
SHA1 9127bc06fda996b78545368dc656ef1f1869c239
SHA512 ab7fa66e8810be0db13e29716d0d9036cfb4fdd30cae4e4960c8b58e95599c37b4ce79dce00d5fa2a74a49d121d61e683fd160e7b3b35790359ca32ce23a3fa8
SSDEEP 24576:sCOV/48FsDQJVm0izmQmock3D1rrbAV9:EW5MQtckT1Xk
TLSH
T10A25BF11F880D033D5561032606DE739DA39F6118F708DE7D3949EA92EB26C15E3ABBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
e9392a46e01c3c5d8429324fdb4fcbde7bf0a9f79ec8849f385d1fd5d3e8eb5e

File Explorer

e9392a46e01c3c5d8429324fdb4fcbde7bf0a9f79ec8849f385d1fd5d3e8eb5e

.exe 941KB

e9392a46e01c3c5d8429324fdb4fcbde7bf0a9f79ec8849f385d1fd5d3e8eb5e

IMPHASH 2349f2f5240cfbdea97d94464a527fe1
SHA256 e9392a46e01c3c5d8429324fdb4fcbde7bf0a9f79ec8849f385d1fd5d3e8eb5e
MD5 d4e0a825d571705b2605a69720bb652d
SHA1 9127bc06fda996b78545368dc656ef1f1869c239
SHA512 ab7fa66e8810be0db13e29716d0d9036cfb4fdd30cae4e4960c8b58e95599c37b4ce79dce00d5fa2a74a49d121d61e683fd160e7b3b35790359ca32ce23a3fa8
SSDEEP 24576:sCOV/48FsDQJVm0izmQmock3D1rrbAV9:EW5MQtckT1Xk
TLSH
T10A25BF11F880D033D5561032606DE739DA39F6118F708DE7D3949EA92EB26C15E3ABBB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e4:f6:6d:5e:55:f2:8b:f3:b5:09:b4:8d:83:87:f8:ef:19:7f:95:75:a1:3b:c8:ef:84:8b:8b:08:1f:4c:fc:18

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Chains

Jul 5, 2022

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

48:7f:32:ea:9f:c1:e4:8b:5e:50:26:19:98:ea:5f:7b:a4:81:01:2a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Chains

Jul 5, 2022

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 22, 2019 - Feb 4, 2023

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:1c:b2:8a:00:00:00:00:00:26

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 9, 2022 - Nov 9, 2031

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 22, 2019 - Feb 4, 2023

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1410224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

seup.exe.pdb

advapi32

CreateProcessAsUserW DuplicateTokenEx OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExW

gdi32

BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateFontW CreatePatternBrush CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetCurrentObject GetObjectW GetStockObject OffsetViewportOrgEx PtInRegion SelectObject SetBkMode SetTextColor SetViewportOrgEx

msimg32

AlphaBlend

oleaut32

VarUI4FromStr

shell32

CommandLineToArgvW SHGetFolderPathW SHGetSpecialFolderPathA SHGetSpecialFolderPathW Shell_NotifyIconW

shlwapi

PathAppendW PathFileExistsW PathFindFileNameA PathFindFileNameW PathGetDriveNumberW PathRemoveFileSpecW SHGetValueA SHGetValueW StrStrIW

user32

AdjustWindowRectEx AllowSetForegroundWindow AppendMenuW BeginPaint BringWindowToTop CallWindowProcW CharNextW ClientToScreen CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyMenu DestroyWindow DispatchMessageW DrawEdge DrawFocusRect DrawTextW EnableWindow EndPaint FillRect FindWindowExW FindWindowW GetCapture GetClassInfoExW GetClientRect GetCursorPos GetDC GetDesktopWindow GetDlgCtrlID GetDlgItem GetMenu GetMessageW GetMonitorInfoW GetParent GetShellWindow GetSysColor GetSystemMetrics GetWindow GetWindowLongW GetWindowRect GetWindowRgn GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InflateRect InvalidateRect IsIconic IsWindow IsWindowEnabled KillTimer LoadCursorW LoadImageW MapWindowPoints MessageBoxW MonitorFromPoint MonitorFromWindow MoveWindow OffsetRect PeekMessageW PostMessageW PostQuitMessage PtInRect RedrawWindow RegisterClassExW ReleaseCapture SendMessageW SetCapture SetCursor SetForegroundWindow SetTimer SetWindowLongW SetWindowPos SetWindowRgn SetWindowTextW ShowWindow SystemParametersInfoW TrackMouseEvent TrackPopupMenu TranslateMessage UnregisterClassW UpdateWindow WindowFromPoint

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

FtpCommandW FtpGetFileSize FtpOpenFileW HttpEndRequestW HttpOpenRequestW HttpQueryInfoW HttpSendRequestExW InternetCloseHandle InternetConnectW InternetCrackUrlW InternetGetLastResponseInfoW InternetOpenW InternetQueryOptionW InternetReadFile InternetReadFileExA InternetSetOptionA InternetSetOptionW InternetSetStatusCallbackW InternetWriteFile

psapi

GetModuleFileNameExW

kernel32

AssignProcessToJobObject CancelWaitableTimer CloseHandle CompareStringW CreateEventW CreateFileA CreateFileW CreateMutexW CreateProcessW CreateThread CreateWaitableTimerW DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FindResourceW FlushFileBuffers FlushInstructionCache FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSize GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree HeapAlloc HeapDestroy HeapFree HeapLock HeapReAlloc HeapSize HeapUnlock HeapWalk InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsBadReadPtr IsBadWritePtr IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFileTimeToFileTime LocalFree LockResource MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ResetEvent RtlCaptureStackBackTrace RtlUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer SizeofResource Sleep SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile lstrcmpA lstrcmpiA lstrcmpiW

ole32

CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUninitialize CreateStreamOnHGlobal

comctl32

ImageList_Add ImageList_Create ImageList_Destroy ImageList_Draw ImageList_GetIconSize InitCommonControlsEx

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipFree GdiplusShutdown GdiplusStartup

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

winmm

timeGetTime

netapi32

Netbios

Name

.text

Size

618KB

Virtual Size

618KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

430KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

145B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

306B

Characteristics

Name

.rsrc

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

e9392a46e01c3c5d8429324fdb4fcbde7bf0a9f79ec8849f385d1fd5d3e8eb5e

PE Signature issue

PE Signature issue

advapi32

gdi32

msimg32

oleaut32

shell32

shlwapi

user32

version

wininet

psapi

kernel32

ole32

comctl32

gdiplus

userenv

winmm

netapi32

generic