10b9c94b1154e96db35a55cc9d6a9389ba5d4fd9c974669f4968c0d63c37457c
- SHA256 10b9c94b1154e96db35a55cc9d6a9389ba5d4fd9c974669f4968c0d63c37457c
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PDF_C8569_20260911100752.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
PDF_C8569_20260911100752.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
active_desktop_render_x64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
active_desktop_render_x64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
General
- Target 10b9c94b1154e96db35a55cc9d6a9389ba5d4fd9c974669f4968c0d63c37457c
- Size 4.1MB
- Sample260925-p9a37aec85
- SHA256 10b9c94b1154e96db35a55cc9d6a9389ba5d4fd9c974669f4968c0d63c37457c
- MD5 bb760419f5c81452d7f4c5b4412a2902
- SHA1 cbbe5d8818001ad226f2f518d73be83d14f55a31
- SHA512 3b9fb71091ac03ced586df02855c4f4ceed760ec49fcd61934b42c954f897e78db98cb8d9773319b34a3a0ccaec5f4fa8518617a17a36a8fb9106aeee0f6d0fd
- SSDEEP 24576:/tHXjyBO2YoA2PxUIsFpJFc0omYcdYNwksXv8rdjvgBhq9MBecsnZGcs:BjGOPtMWnFc0hxMLw8rdMqsJgZGZ
- TLSH T1B416ACDA883CE07BD3E21273619A86622639A44547665DD38DBAF24437C26F7C332FD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/active_desktop_render_x64.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/active_desktop_render_x64.dll
File Explorer
-
10b9c94b1154e96db35a55cc9d6a9389ba5d4fd9c974669f4968c0d63c37457c.iso 4.1MB
-
out.iso.iso 4.1MB
-
PDF_C8569_20260911100752.exe.exe 100KB
-
active_desktop_render_x64.dll.dll 4.0MB
out.iso
- SHA256 10b9c94b1154e96db35a55cc9d6a9389ba5d4fd9c974669f4968c0d63c37457c
- MD5 bb760419f5c81452d7f4c5b4412a2902
- SHA1 cbbe5d8818001ad226f2f518d73be83d14f55a31
- SHA512 3b9fb71091ac03ced586df02855c4f4ceed760ec49fcd61934b42c954f897e78db98cb8d9773319b34a3a0ccaec5f4fa8518617a17a36a8fb9106aeee0f6d0fd
- SSDEEP 24576:/tHXjyBO2YoA2PxUIsFpJFc0omYcdYNwksXv8rdjvgBhq9MBecsnZGcs:BjGOPtMWnFc0hxMLw8rdMqsJgZGZ
- TLSH T1B416ACDA883CE07BD3E21273619A86622639A44547665DD38DBAF24437C26F7C332FD4
- MD5 SHA1 SHA512 SSDEEP TLSH
PDF_C8569_20260911100752.exe
- IMPHASH 1ad7d70d7b6c16d05f66818c394cb860
- SHA256 f712c2a8b4abf2e299a2b480020333deb0f43364e9686cda78b1243c62e4830d
- MD5 1ea7d59053d8bd45bea95355b3d8d499
- SHA1 de0c8fba8d7ac8f547c88b6e5f7f5cd422ec2903
- SHA512 6e978f16c2f7a8d5918f4ebc8f71fc4b796487aa1e3dbc02faeac35a2d4ec0cb0d35408297778fbbe0d77a4247b9f4e9a7733252fef4f575d17b33374c07bc40
- SSDEEP 1536:9LT11uyRFNsa9N/urOKwjAEHxPNgE71x48suYjsW4dTRR6f7HxE7Qxa:xTzuyRFNN9N/wwjtHxvWuYsTRUf+5
- TLSH T1B5A37C9767E078F9E8638B34ACE14915E736F96706B0CB8E1394415A4F233C19E78B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
83:09:6f:d6:db:8c:a2:55:22:f2:b3:ce:b9:26:47:e2:28:fe:a4:1e:d8:ae:e6:ea:3a:7e:d5:70:1d:b7:b5:36
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Apr 7, 2024
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
1d:df:0a:bf:39:d0:dd:d6:5f:f7:36:f4:57:15:00:64:19:7f:9d:ad
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Apr 7, 2024
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
03:38:82:1e:28:c9:9e:a3:9d:2e:a3:7c:fe:39:d1:06
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 13, 2023 - Dec 12, 2026
Minor OS version
2
Major OS version
5
Entry point
4616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\buildbot\build1\desktop_screen\build\bin\active_desktop_launcher_x64.pdb
active_desktop_render_x64
SetDesktopMonitorHook
ClearDesktopMonitorHook
kernel32
TlsAlloc
CreateFileW
CloseHandle
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
GetCurrentThreadId
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
HeapAlloc
HeapReAlloc
GetStringTypeW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
Name
.text
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=225, version=20806,
count=97, id=224, version=20806,
count=8, id=223, version=20806,
count=3, id=221, productName=VS2013 UPD5 build 40629, version=40629,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=79, id=1, productName=Unmarked objects,
count=1, id=229, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
active_desktop_render_x64.dll
- IMPHASH 1f30733dc095f8f7cea4a37683b09ce2
- SHA256 3201b3c4bcacbe8bc0a242b5d92267923a6eb1cb608131ca99bf8569ecb65a4d
- MD5 13dc6c11905e7c4383970d448f77374e
- SHA1 d592958468ce7288afadab26724e7611dc8d95f2
- SHA512 4719566c94db5e02155a407e49756778a9a456898d0c8f90fb3ed74f6d8d3fd286eb23eb5710e0864dcab1a9e664bd9aa14c529f1571d65bb92d447472705e40
- SSDEEP 24576:pHXjyBO2YoA2PxUIsFpJFc0omYcdYNwksXv8rdjvgBhq9MBecsnZGcs:NjGOPtMWnFc0hxMLw8rdMqsJgZGZ
- TLSH T1C5169CDA883CE07B93E21273619A86623639A44547665DD38DBAF24437C26F7C332FD4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
10112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
user32
GetDesktopWindow
GetKeyboardType
GetSystemMetrics
ClearDesktopMonitorHook
ReleaseFromExplorer
SetDesktopMonitorHook
_gkppg_udcj
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33145,
count=3, id=1, productName=Unmarked objects,
count=1, id=261, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,