configcenterdll_2.5024.2170.528.cab
- SHA256 d7f9a77e143a1d34ffde137e2a9d5e289e9e9db2dc7a2336f0acf9e15a81fd02
Static task
static1
Behavioral task
behavioral1
Sample
ConfigCenter.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ConfigCenter.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target configcenterdll_2.5024.2170.528.cab
- Size 372KB
- Sample260930-algthawzfx
- SHA256 d7f9a77e143a1d34ffde137e2a9d5e289e9e9db2dc7a2336f0acf9e15a81fd02
- MD5 0284bba46ec9bac8bcb2934d165444b4
- SHA1 0c566e07696957bf7c8dbe2e87cb4881f6c43dd9
- SHA512 008d68fa0dcf633d24e96e8392d7be31f39c71c55a66936df4d73a13a906e23a176163b32ae2479a94dc3f666d0d249a254efd985a607ebf64dff635d0e11017
- SSDEEP 6144:8PtZKzoWCBJPiciSU259ODQxDE5Go3N531SQ1M8A1/Hhi3g/:8PGkxjPishxxxHhi3g/
- TLSH T1C984236ADFAE524145D0160016A95F4C3AE696E6E17F08BCDFE8F0BF037C9C8499ED06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
configcenterdll_2.5024.2170.528.cab.cab 372KB
-
ConfigCenter.dll.dll 773KB
ConfigCenter.dll
- IMPHASH 19de718f63cd7fdba13a05697b642ff3
- SHA256 73561da062613bf3a52aa38a282a60a1ad4c764d81f52e2fda382731a1517377
- MD5 63e6153ef6e74e82d0f29bf3e30bce58
- SHA1 0a259b33ffa321a9629c0d4798cb80d390e45542
- SHA512 f0aab32da680191e056d5a9db0bf74f73eea672a35b08817710ee0a2919fd4cf7b3003c8c6d202f820560b8625ffa146a9ca8287647a16a3b04ede516ce05f4d
- SSDEEP 12288:d78lOnZ5JVLV/X8WcjrXJQ+TlG95uHo59aC4ZonAWOky69SQoQmIH:tZVhGjrGHu09R4ZoA9kiep
- TLSH T1D7F46C21394AC036E5AD11B1583CDFBB046CAE710B7584C7A3D8AA795E705C3AF36E27
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
45:c4:61:94:25:f2:aa:f5:ce:bc:a1:85:15:a8:91:48:8e:1c:9a:35:85:b7:21:f7:76:4a:ad:ae:1e:aa:c1:9f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91510100350570169M,CN=成都知安天下信息技术有限公司,O=成都知安天下信息技术有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Jun 11, 2025
SERIALNUMBER=91510100350570169M,CN=成都知安天下信息技术有限公司,O=成都知安天下信息技术有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91510100350570169M,CN=成都知安天下信息技术有限公司,O=成都知安天下信息技术有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=91510100350570169M,CN=成都知安天下信息技术有限公司,O=成都知安天下信息技术有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
01:b1:ad:43:04:bb:3b:ba:27:cd:24:77:db:be:0f:f0
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 22, 2024 - Aug 21, 2025
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
342355
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Jenkins\.jenkins\workspace\lib_common\config_center\config_center\Release\ConfigCenter.pdb
kernel32
GetTickCount
FreeLibrary
GetModuleFileNameW
GetProcAddress
WaitForMultipleObjects
LoadLibraryW
GetPrivateProfileSectionW
WideCharToMultiByte
GetCurrentProcess
GetModuleHandleW
CreateThread
Sleep
CreateEventW
ResetEvent
SetEvent
WaitForSingleObject
DecodePointer
MultiByteToWideChar
WritePrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetCurrentThreadId
CreateMutexW
DeleteCriticalSection
WriteConsoleW
ReadConsoleW
SetEndOfFile
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetStdHandle
GetACP
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetLastError
GetLastError
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
RaiseException
CloseHandle
CreateFileW
DeleteFileW
GetFileSizeEx
GetLocalTime
FlushFileBuffers
GetFileSize
GetLogicalDriveStringsW
GetLongPathNameW
QueryDosDeviceW
ReadFile
WriteFile
GetStartupInfoW
OpenProcess
lstrlenW
GetPrivateProfileStringW
K32EnumProcesses
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
LoadLibraryExW
GetVersionExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
InterlockedIncrement
InterlockedDecrement
InterlockedExchangeAdd
GetCurrentProcessId
CopyFileW
FindClose
FindNextFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
DeviceIoControl
lstrcmpA
lstrcmpiA
GetSystemDirectoryW
CreateFileA
InterlockedCompareExchange
FreeResource
GetSystemWindowsDirectoryW
LocalFree
ReleaseMutex
FormatMessageW
RtlUnwind
InterlockedFlushSList
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetFileType
user32
KillTimer
PostThreadMessageW
DestroyWindow
CallWindowProcW
PostQuitMessage
DefWindowProcW
RegisterWindowMessageW
LoadCursorW
SetWindowLongW
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
SendMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
FindWindowW
SendMessageTimeoutW
wsprintfW
GetWindowLongW
SetTimer
ShowWindow
PostMessageW
shell32
SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
ord165
SHGetPathFromIDListW
ole32
CoTaskMemFree
CoUninitialize
CoInitialize
CoInitializeEx
CoCreateGuid
shlwapi
PathFindFileNameW
SHGetValueW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathCombineW
SHGetValueA
PathIsDirectoryW
PathRenameExtensionW
StrStrIW
SHSetValueA
StrTrimA
StrStrIA
StrCmpNIW
StrCmpIW
SHSetValueW
urlmon
URLDownloadToCacheFileW
URLDownloadToFileW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
crypt32
CertGetNameStringW
wintrust
WinVerifyTrust
WTHelperProvDataFromStateData
wininet
InternetGetConnectedState
iphlpapi
GetAdaptersInfo
advapi32
RegCreateKeyExW
GetTokenInformation
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumValueW
RegGetValueW
CreateTrayClient
RunConfigCenter
Name
.text
Size
566KB
Virtual Size
565KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
151KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=208, version=65501,
count=18, id=241, version=40116,
count=164, id=243, version=40116,
count=31, id=242, version=40116,
count=2, id=264, version=27051,
count=1, productName=Unmarked objects (old),
count=6, id=261, version=27032,
count=1, id=199, version=41118,
count=26, id=259, version=26706,
count=4, id=261, version=27031,
count=12, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,
count=11, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,
count=33, id=260, version=26706,
count=64, id=261, version=26706,
count=27, id=203, version=65501,
count=261, id=1, productName=Unmarked objects,
count=1, id=260, version=27051,
count=30, id=261, version=27051,
count=1, id=256, version=27051,
count=1, id=255, version=27051,
count=1, id=151,
count=1, id=258, version=27051,