双击打开极速安装[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
双击打开极速安装.exe
Size 8.2MB
Sample260930-g7q3magg38
SHA256 ded865ae2b11d087c5d6184001b571c000b93a3a2e09e2563d20526dca9a2448
MD5 1f41d1dc8dea094aed81c2524dedb915
SHA1 b70020a50d91207235c9fb294935320cddc3a45a
SHA512 7df8d3854b696b8c890ab790310cda473c759a9b844c19fac34f666b580dbe15b7c50e23e61da9229f477851ddb1080ff43efbc258962340f33e1487f63a97d9
SSDEEP 98304:40UDqm/TZ6b+w0WCB+T5doCXziCfGNiHRNIEoo0UDqmUTZ6b+w0WCB+T5doCXziJ:bSPf6VcSAEoLSEf6VcSAEoR
TLSH
T10496E012BB81C073E59E0171517AA77B193EB6320735C4C7A3D42EA9AD306D2AB3D397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

双击打开极速安装.exe

.exe 8.2MB

双击打开极速安装.exe

IMPHASH 22c67069e019fd068a56e96f40392001
SHA256 ded865ae2b11d087c5d6184001b571c000b93a3a2e09e2563d20526dca9a2448
MD5 1f41d1dc8dea094aed81c2524dedb915
SHA1 b70020a50d91207235c9fb294935320cddc3a45a
SHA512 7df8d3854b696b8c890ab790310cda473c759a9b844c19fac34f666b580dbe15b7c50e23e61da9229f477851ddb1080ff43efbc258962340f33e1487f63a97d9
SSDEEP 98304:40UDqm/TZ6b+w0WCB+T5doCXziCfGNiHRNIEoo0UDqmUTZ6b+w0WCB+T5doCXziJ:bSPf6VcSAEoLSEf6VcSAEoR
TLSH
T10496E012BB81C073E59E0171517AA77B193EB6320735C4C7A3D42EA9AD306D2AB3D397
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

05:b2:e9:15:be:6d:c2:63:d9:61:cd:40:83:96:4d:32:f8:4c:9c:be:43:4a:1f:d6:0d:d0:7b:5b:41:86:c1:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 28, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

77:d9:12:68:10:b4:7a:d8:41:65:66:51

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 8, 2024 - Feb 7, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

325541

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\861621\out\Release\CPInstaller.pdb

kernel32

DeviceIoControl GetLogicalDriveStringsW FlushInstructionCache RaiseException InitializeCriticalSection DeleteCriticalSection GetVersionExW GetExitCodeThread WriteFile SetFilePointer WaitForSingleObject SetEvent CreateEventW FlushFileBuffers MoveFileExW ReadFile FreeResource EndUpdateResourceW UpdateResourceW BeginUpdateResourceW SetEnvironmentVariableW GetPrivateProfileIntW GetPrivateProfileStringW GetTempPathW WritePrivateProfileStringW InterlockedIncrement InterlockedDecrement GetTempFileNameW CreateMutexW GetCurrentProcessId ResetEvent WaitForMultipleObjects CreateThread CopyFileW GetPrivateProfileStringA GetCurrentThread lstrcmpiW LocalFileTimeToFileTime SetFileTime CloseHandle SetFileAttributesW ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock OutputDebugStringW SetFilePointerEx SystemTimeToFileTime SetEnvironmentVariableA CompareStringW CompareStringA GetTickCount Sleep GetLocaleInfoA QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileW GetStringTypeA GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetModuleFileNameA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetStartupInfoA GetFileType SetHandleCount GetModuleHandleA IsValidCodePage GetOEMCP GetACP HeapCreate TlsFree GetCPInfo LCMapStringW LCMapStringA GetStartupInfoW GetDateFormatA GetTimeFormatA GetSystemTimeAsFileTime ExitThread ExitProcess VirtualQuery GetSystemInfo VirtualProtect GetConsoleMode GetConsoleCP IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlUnwind GetSystemWindowsDirectoryW lstrcmpiA lstrcmpA CreateFileA GetSystemDirectoryW VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetModuleFileNameW RemoveDirectoryW SetLastError lstrlenA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryW GetCurrentProcess OpenProcess GetFileSizeEx GetDriveTypeW GetDiskFreeSpaceExW TlsAlloc GetWindowsDirectoryW DeleteFileW FormatMessageW CreateDirectoryW GetLastError GetStdHandle SetEndOfFile SetConsoleTextAttribute TlsSetValue TlsGetValue GetCurrentThreadId GetFileAttributesW MultiByteToWideChar InterlockedExchange WideCharToMultiByte EnterCriticalSection LeaveCriticalSection FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW InterlockedCompareExchange FindResourceExW FindResourceW LoadResource LockResource GetStringTypeW DosDateTimeToFileTime SizeofResource lstrlenW

user32

GetClassInfoExW SendMessageTimeoutW IsWindow GetDC UnregisterClassA GetWindowThreadProcessId GetShellWindow SetWindowPos SetForegroundWindow BringWindowToTop IsIconic ShowWindow IsWindowVisible MessageBoxW GetActiveWindow FillRect GetClientRect RedrawWindow GetParent DefWindowProcW SetWindowLongW GetWindowLongW CallWindowProcW BeginPaint EndPaint EndDialog MoveWindow GetWindowRect ScreenToClient GetDlgItem MapWindowPoints GetMonitorInfoW MonitorFromWindow GetWindow ReleaseDC GetWindowTextW EnableWindow SetWindowTextW RegisterClassW CharNextW PrintWindow PostQuitMessage IsDlgButtonChecked GetSystemMetrics LoadImageW SetDlgItemTextW CreateDialogParamW PeekMessageW GetMessageW GetClassInfoW DispatchMessageW FindWindowExW SystemParametersInfoW UpdateLayeredWindow SetWindowRgn KillTimer SetTimer CopyRect DialogBoxParamW RegisterClassExW GetCursorPos IsWindowEnabled DestroyWindow LoadCursorW TranslateMessage IsDialogMessageW ClientToScreen CreateWindowExW PtInRect GetWindowTextLengthW InvalidateRect UpdateWindow ScrollWindow SetFocus SendMessageW PostMessageW

gdi32

CombineRgn CreateRectRgn SetBkColor ExtTextOutW BeginPath MoveToEx AngleArc LineTo EndPath PathToRegion SelectClipRgn BitBlt CreateCompatibleBitmap SetViewportOrgEx CreateDIBSection SelectObject DeleteDC CreateCompatibleDC DeleteObject CreateSolidBrush GetDeviceCaps GetObjectW CreateFontW

advapi32

LookupPrivilegeValueW RegOpenKeyExA RegEnumKeyExA RegEnumKeyExW RegQueryInfoKeyW RegCreateKeyExW RegDeleteValueW RegDeleteKeyW InitiateSystemShutdownW OpenThreadToken ImpersonateSelf RegSetValueExW OpenProcessToken AdjustTokenPrivileges DuplicateTokenEx CreateProcessAsUserW RegOpenKeyExW RegQueryValueExW RegCloseKey RegQueryValueExA GetTokenInformation

shell32

SHGetSpecialFolderPathW ShellExecuteExW SHCreateDirectoryExW SHBrowseForFolderW SHGetPathFromIDListW SHFileOperationW CommandLineToArgvW ShellExecuteW ord165

ole32

CoInitialize CoUninitialize CoCreateGuid CreateStreamOnHGlobal CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree

oleaut32

VarUI4FromStr SysStringByteLen SysAllocStringByteLen VariantClear VariantInit SysStringLen SysFreeString SysAllocString

shlwapi

SHGetValueW SHSetValueW StrCpyW PathCombineW PathRemoveFileSpecW AssocQueryStringW PathFindExtensionW PathIsRelativeW PathCompactPathExW StrStrIW PathIsPrefixW PathIsDirectoryEmptyW PathUnquoteSpacesW PathQuoteSpacesW PathAddBackslashW PathFindFileNameW StrCmpNIW PathRemoveExtensionW PathIsSameRootW PathStripToRootW PathCanonicalizeW PathAppendW PathFileExistsW StrCmpIW StrTrimA SHSetValueA SHGetValueA StrStrIA

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipAlloc GdipFree GdiplusShutdown GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipDrawImageRectRectI GdipDrawImagePointRectI GdipCreateFromHDC GdipDeleteGraphics GdipCloneImage GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipSaveImageToFile GdipDisposeImage

wininet

InternetCloseHandle HttpOpenRequestW HttpSendRequestW InternetOpenW InternetConnectW HttpQueryInfoW

version

GetFileVersionInfoW VerQueryValueW

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

双击打开极速安装.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

wininet

version

iphlpapi

generic