f477868efb6ca82535247803867a24d48c26a12ecd60f886fb437314cce76a54

Sharing

Copy URL Twitter E-mail

General

Target
f477868efb6ca82535247803867a24d48c26a12ecd60f886fb437314cce76a54
Size 2.1MB
Sample260925-kxdw4acf49
SHA256 f477868efb6ca82535247803867a24d48c26a12ecd60f886fb437314cce76a54
MD5 00814ebd21eadb16b7c2b01c3f614699
SHA1 beddc604d78b532364f8d25da4602f90ab558cce
SHA512 8065297090320e4093f648b06e5bf309f6a915c94ec0a4bd4883d51e0612d51b70f41fc4f533eaa78d2fddf61b0e230ede77ca6defbc7e81c07a57dfe541b5df
SSDEEP 49152:f652GragjgjvHIkVGDA/CCF0pqdMMAdwsDXwTar0f+AY3lmH:f651rPjOvokVGDA/CCepqdADsy0f+33K
TLSH
T149A5C0137BC18072E2A30270557A5B365AFEBE301B30C5DBD3942A1D6E705D2E639B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
f477868efb6ca82535247803867a24d48c26a12ecd60f886fb437314cce76a54

File Explorer

f477868efb6ca82535247803867a24d48c26a12ecd60f886fb437314cce76a54

.exe 2.1MB

f477868efb6ca82535247803867a24d48c26a12ecd60f886fb437314cce76a54

IMPHASH 695bb5a76e58e03fbe8b9dca32d02cde
SHA256 f477868efb6ca82535247803867a24d48c26a12ecd60f886fb437314cce76a54
MD5 00814ebd21eadb16b7c2b01c3f614699
SHA1 beddc604d78b532364f8d25da4602f90ab558cce
SHA512 8065297090320e4093f648b06e5bf309f6a915c94ec0a4bd4883d51e0612d51b70f41fc4f533eaa78d2fddf61b0e230ede77ca6defbc7e81c07a57dfe541b5df
SSDEEP 49152:f652GragjgjvHIkVGDA/CCF0pqdMMAdwsDXwTar0f+AY3lmH:f651rPjOvokVGDA/CCepqdADsy0f+33K
TLSH
T149A5C0137BC18072E2A30270557A5B365AFEBE301B30C5DBD3942A1D6E705D2E639B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

94:0a:b1:5e:cb:b9:79:f5:2f:9f:d8:77:12:71:4f:89:9e:d8:bb:6e:64:2d:f7:57:68:32:fe:f8:2e:b2:98:b0

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Chains

May 13, 2022

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

ee:ac:ef:91:ef:e8:ad:41:e3:b8:06:91:fa:74:21:b3:98:5c:a3:bb

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Chains

May 13, 2022

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 22, 2019 - Feb 4, 2023

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 22, 2019 - Feb 4, 2023

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

2329796

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\autobuild_sesvc_13\360sesvc\bin\Release\sesvc.pdb

kernel32

UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileA GetVersionExA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetVersionExW GetFileAttributesW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW InterlockedCompareExchange GetFullPathNameW HeapFree HeapCreate AreFileApisANSI TryEnterCriticalSection GetPrivateProfileStringW WritePrivateProfileStringW CopyFileW OpenProcess DebugBreak lstrlenA lstrlenW GetDiskFreeSpaceExW CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenMutexW GetCurrentThread WaitForMultipleObjects CreateProcessW GetPrivateProfileIntW GetSystemDirectoryW VirtualAlloc VirtualFree GetTempFileNameW QueryDosDeviceW GetFileType SetFileTime DuplicateHandle DosDateTimeToFileTime GetCurrentDirectoryW GetExitCodeProcess GetSystemTimes LockResource VirtualQuery SetUnhandledExceptionFilter GetCommandLineW WritePrivateProfileStructW DeviceIoControl ResetEvent TlsAlloc TlsSetValue TlsFree CreateWaitableTimerW SetWaitableTimer CancelWaitableTimer IsBadReadPtr IsBadWritePtr GetSystemTimeAsFileTime TerminateThread SuspendThread lstrcmpA lstrcmpiA GetFileSizeEx ExitProcess GetModuleHandleA GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers LocalFree SetLastError IsProcessInJob QueryInformationJobObject FindResourceW OutputDebugStringA GetModuleHandleW LoadLibraryExW CreateMutexW lstrcmpiW SizeofResource LoadResource Sleep SetErrorMode GetCurrentThreadId TerminateProcess GetCurrentProcess InterlockedDecrement InterlockedIncrement GetTickCount GlobalUnlock GlobalLock GlobalAlloc FindNextFileW FindFirstFileW RemoveDirectoryW FindClose FreeLibrary ReadFile GetFileSize LeaveCriticalSection WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA SetStdHandle GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode GetModuleFileNameA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread RtlUnwind ReleaseMutex OpenThread HeapWalk HeapUnlock HeapLock SetFilePointerEx LocalFileTimeToFileTime GetStartupInfoW UnhandledExceptionFilter GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EnterCriticalSection InitializeCriticalSection ExitThread LockFileEx MoveFileExW SetFileAttributesW CreateFileW GetStringTypeW TlsGetValue SwitchToThread IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent LoadLibraryExA VirtualProtect VerifyVersionInfoA VerSetConditionMask PeekNamedPipe GetStdHandle GetEnvironmentVariableA MoveFileExA GetSystemDirectoryA DecodePointer QueryPerformanceFrequency SleepEx GetLocalTime MulDiv FreeResource GetACP CreateFileMappingA GetCurrentProcessId GetProcessHeap SystemTimeToFileTime CreateDirectoryW GetModuleFileNameW LoadLibraryW WriteFile CreateThread GetProcAddress CreateEventW CloseHandle WaitForSingleObject SetEvent WideCharToMultiByte MultiByteToWideChar DeleteFileW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException lstrcpynW

user32

ChangeClipboardChain SetClipboardViewer CloseClipboard OpenClipboard IsWindow SendMessageW CreateWindowExW DispatchMessageW RegisterClassExW PostQuitMessage SetClipboardData TranslateMessage PostThreadMessageW GetMessageW DefWindowProcW SetPropW GetPropW RegisterClassW PtInRect IsRectEmpty GetClipboardData EmptyClipboard IsClipboardFormatAvailable GetForegroundWindow IsZoomed IntersectRect MapWindowPoints ScreenToClient GetClientRect GetUpdateRect EndPaint BeginPaint ReleaseCapture SetWindowRgn MessageBoxW CharPrevW GetClassNameW DestroyWindow SetWindowPos IsWindowVisible SetTimer KillTimer GetSystemMetrics GetDC ReleaseDC GetWindowRect GetCursorPos MoveWindow EnableWindow PeekMessageW CharNextW CallWindowProcW GetGUIThreadInfo InvalidateRgn CreateAcceleratorTableW UnregisterClassW CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen GetSysColor SetWindowTextW PostMessageW SetCapture GetFocus GetShellWindow SetRect FillRect InvalidateRect IsIconic DrawTextW GetParent MsgWaitForMultipleObjects CloseWindow SystemParametersInfoW GetWindowThreadProcessId WindowFromPoint GetLastInputInfo SendMessageTimeoutW wsprintfW EnumDisplayDevicesW EnumDisplaySettingsW CharLowerW GetWindow GetWindowTextW wvsprintfW ShowWindow GetMonitorInfoW MonitorFromWindow LoadCursorW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW FindWindowExW FindWindowW GetDesktopWindow SetWindowLongW GetWindowLongW SetForegroundWindow GetKeyState GetClassInfoExW SetCursor UnionRect OffsetRect SetFocus GetActiveWindow GetWindowTextLengthW

gdi32

DeleteObject CreateSolidBrush GetDeviceCaps BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreatePen DeleteDC GetStockObject Rectangle RestoreDC SaveDC SelectObject GetTextMetricsW GetObjectW SetWindowOrgEx CreateRoundRectRgn CombineRgn CreateDCW CreatePenIndirect CreateRectRgnIndirect GetCharABCWidthsW GetClipBox GetDIBits GetTextExtentPoint32W LineTo RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection GetObjectA MoveToEx TextOutW ExtTextOutW GdiFlush CreatePatternBrush

shell32

ord680 SHFileOperationW SHGetFolderPathW ShellExecuteW SHAppBarMessage ord165 SHGetSpecialFolderPathW

ws2_32

closesocket htonl htons listen recv socket WSAStartup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSAGetLastError bind connect accept gethostname send ioctlsocket getpeername getsockname getsockopt ntohs setsockopt WSASetLastError WSAIoctl WSACleanup __WSAFDIsSet select getaddrinfo freeaddrinfo recvfrom sendto

wldap32

ord143 ord301 ord217 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord200

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertCloseStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenStore CertAddCertificateContextToStore

shlwapi

PathFindExtensionW SHGetValueA PathIsRootW PathGetDriveNumberW PathAddBackslashW PathFileExistsW PathRemoveFileSpecW PathCombineW SHGetValueW SHSetValueW PathAppendW StrCmpIW PathFindFileNameW SHDeleteValueW StrStrIA PathFindFileNameA StrStrIW StrDupW

psapi

GetProcessImageFileNameW GetModuleFileNameExW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

setupapi

SetupIterateCabinetW

netapi32

NetUserChangePassword Netbios

imm32

ImmSetCompositionWindow ImmSetCompositionFontW ImmGetContext ImmReleaseContext

generic

count=20, id=241, version=40116,

count=201, id=243, version=40116,

count=30, id=242, version=40116,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=7, id=199, version=41118,

count=27, id=259, version=26706,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=260, version=26706,

count=75, id=261, version=26706,

count=113, id=260, version=27034,

count=33, id=261, version=27034,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=695, id=1, productName=Unmarked objects,

count=9, id=260, version=27043,

count=102, id=261, version=27043,

count=1, id=256, version=27043,

count=1, id=255, version=27043,

count=1, id=151,

count=1, id=258, version=27043,