SplashtopSOS_Win_v3[.]8[.]6[.]1_RZZAWPJYALYXEU[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe
Size 20.1MB
Sample260929-vpcdeayfpg
SHA256 7670f7bc893c63807642b7cb56df36441055cb0e65b6408aa69a858a0f19149e
MD5 eb5308dbc6ad8524fa63f7682cb0792c
SHA1 28fe13dcce7dc4ced6f543803a02cb8a50c6273e
SHA512 0f34faf3b6e4b722dca0954d3cd7d3b804bd7c935292784e3969cba6541f3a68654914f90510489a84b6a876f2322129634e50487c84aaee562d71e705cdc860
SSDEEP 393216:9BA6V6y07YgW3UHQzaXSVqkQJY7PTiDvXnaQhqfkQIITC65MAAya5biUTt:L1r023UvzkUYaDvXhqfrRu6eBPT
TLSH
T13C273375F1483CE5E2A64036B965B92A0364B7538ECE50C993B8B64506B27E2FF23D0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe

.exe 20.1MB

SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe

IMPHASH 67ae5c7b77ed3563acdaa8e440808d86
SHA256 7670f7bc893c63807642b7cb56df36441055cb0e65b6408aa69a858a0f19149e
MD5 eb5308dbc6ad8524fa63f7682cb0792c
SHA1 28fe13dcce7dc4ced6f543803a02cb8a50c6273e
SHA512 0f34faf3b6e4b722dca0954d3cd7d3b804bd7c935292784e3969cba6541f3a68654914f90510489a84b6a876f2322129634e50487c84aaee562d71e705cdc860
SSDEEP 393216:9BA6V6y07YgW3UHQzaXSVqkQJY7PTiDvXnaQhqfkQIITC65MAAya5biUTt:L1r023UvzkUYaDvXhqfrRu6eBPT
TLSH
T13C273375F1483CE5E2A64036B965B92A0364B7538ECE50C993B8B64506B27E2FF23D0D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

ba:a9:29:06:5f:5f:40:08:f1:78:6f:0c:19:30:c9:fe:19:ea:93:2b:c9:e0:4a:cd:ed:1d:61:af:dd:c5:54:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4169881,CN=Splashtop Inc.,O=Splashtop Inc.,L=Cupertino,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 22, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:d2:3a:70:6a:b8:5c:32:49:08:37:95:4b:9e:41:a3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2025 - May 19, 2028

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

82099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\slave\workspace\GIT_WIN_SRS_Formal\Source\irisserver\Release\SRUnPackSOS.pdb

kernel32

GetStartupInfoW HeapAlloc HeapFree ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree GetTickCount GetCPInfo GetACP GlobalFlags IsValidCodePage VirtualAlloc InitializeCriticalSectionAndSpinCount LCMapStringW GetTimeFormatA GetDateFormatA GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap CreateFileA SetEnvironmentVariableA SetErrorMode lstrlenA TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement InterlockedDecrement GetModuleHandleA GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA GlobalAddAtomW GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange lstrcmpW GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime FileTimeToSystemTime GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer MoveFileW FormatMessageW FreeResource GlobalUnlock GlobalLock DeleteFileW DeviceIoControl FindClose QueryPerformanceCounter GlobalFree GlobalAlloc FindNextFileW GetFileAttributesW FindFirstFileW GetSystemTimeAsFileTime GetVersionExW Process32NextW Process32FirstW CreateToolhelp32Snapshot WriteFile CreateProcessW GetCurrentProcess LocalFree SetLastError ReadFile CreateFileW GetModuleFileNameW GetModuleHandleW WritePrivateProfileStringW GetExitCodeProcess GetProcessId GetSystemWindowsDirectoryW TerminateProcess OpenProcess GetCurrentThreadId GetCommandLineW GetSystemDirectoryW SetDllDirectoryW GetLastError CreateMutexW MultiByteToWideChar GetDiskFreeSpaceExW RemoveDirectoryW SetCurrentDirectoryW Sleep GetTempPathW CreateThread WaitForSingleObject GetWindowsDirectoryW CreateDirectoryW WideCharToMultiByte GetCurrentProcessId ProcessIdToSessionId lstrlenW OutputDebugStringW FreeLibrary GetProcAddress LoadLibraryW CloseHandle FindResourceW LoadResource LockResource SizeofResource GetOEMCP GetPrivateProfileStringW

user32

UnregisterClassW DestroyMenu GetSysColorBrush MoveWindow SetWindowTextW GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW RegisterWindowMessageW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetMenu CreateWindowExW GetClassInfoExW RegisterClassW GetSysColor AdjustWindowRectEx ScreenToClient GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowLongW GetLastActivePopup IsWindowEnabled SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow GetKeyState PeekMessageW ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW EnableMenuItem CheckMenuItem PostQuitMessage CharUpperW GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu EnableWindow GetCursorPos SetLayeredWindowAttributes RedrawWindow ReleaseDC SetWindowRgn GetClientRect SetTimer PostMessageW KillTimer DisableProcessWindowsGhosting SendMessageW LoadIconW SystemParametersInfoW PtInRect GetWindowRect GetWindowPlacement GetWindow LoadCursorW SetCursor GetClassNameW IsWindowVisible GetWindowTextW SetForegroundWindow AttachThreadInput GetWindowThreadProcessId GetForegroundWindow SwitchToThisWindow ShowWindow IsWindow FindWindowW GetSystemMetrics MessageBoxW GetClassInfoW

gdi32

GetStockObject DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible CreateRoundRectRgn DeleteObject SetMapMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox CreateBitmap GetDeviceCaps BitBlt CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetFileTitleW

advapi32

RegQueryValueW RegOpenKeyW CreateWellKnownSid CreateProcessAsUserW OpenProcessToken DuplicateTokenEx DuplicateToken CheckTokenMembership GetTokenInformation RegSetValueExW RegEnumKeyW RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegDeleteKeyW RegFlushKey RegCreateKeyExW RegCloseKey RegOpenCurrentUser RevertToSelf ImpersonateLoggedOnUser

shell32

SHCreateDirectoryExW ShellExecuteExW SHFileOperationW SHGetFolderPathW

shlwapi

PathFileExistsW PathAppendW PathStripToRootW PathIsUNCW PathFindExtensionW PathFindFileNameW

ole32

CreateStreamOnHGlobal

oleaut32

VariantInit VariantClear VariantChangeType

gdiplus

GdipDeleteFontFamily GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipDisposeImage GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipDrawImageRectI GdipDeleteGraphics GdipCreateFromHDC GdiplusShutdown GdipFree GdipAlloc GdiplusStartup

Sharing

General

Malware Config

Signatures

File Explorer

SplashtopSOS_Win_v3.8.6.1_RZZAWPJYALYXEU.exe

kernel32

user32

gdi32

comdlg32

advapi32

shell32

shlwapi

ole32

oleaut32

gdiplus

generic