4e12c6e197db1f4e21c68b14a70319395548847585e3391c7eed61dc13f15971

Sharing

Copy URL Twitter E-mail

General

Target
4e12c6e197db1f4e21c68b14a70319395548847585e3391c7eed61dc13f15971
Size 4.0MB
Sample260930-ktmptstfpf
SHA256 4e12c6e197db1f4e21c68b14a70319395548847585e3391c7eed61dc13f15971
MD5 bd972e064b2b0ef6a59f220a57ebcb7e
SHA1 8f96f9b6b323fe3e247d82ea5bab92b28a803fca
SHA512 e2ca7432f491c15344ef3550afee917585fc6bc94ae652263a6212b52daeb137460b8a3d86629631529996273966aa5be519cae90a935dd05d9dc50731d9de4b
SSDEEP 49152:ParIFSS6mahEByhgHkauXhQ1J2rmW8HY5X/B5sIGoCyP00eYsnk4Wk8tw6LLlUO2:Pda2/Hkaw16WouCyP0xvuON2oScLUO
TLSH
T1B01633A80A7B1493C1D92CF85F59580DC86FDC3880AC813A6EA379505D7FFE55CF68A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
4e12c6e197db1f4e21c68b14a70319395548847585e3391c7eed61dc13f15971
unpack001/$PLUGINSDIR/OP_Logging.dll
unpack001/$PLUGINSDIR/System.dll

File Explorer

4e12c6e197db1f4e21c68b14a70319395548847585e3391c7eed61dc13f15971

.exe 4.0MB
$PLUGINSDIR/InstallHelper.exe

.exe 172KB
$PLUGINSDIR/OP_Logging.dll

.dll 45KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/dict.7z

.7z 3.7MB

4e12c6e197db1f4e21c68b14a70319395548847585e3391c7eed61dc13f15971

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 4e12c6e197db1f4e21c68b14a70319395548847585e3391c7eed61dc13f15971
MD5 bd972e064b2b0ef6a59f220a57ebcb7e
SHA1 8f96f9b6b323fe3e247d82ea5bab92b28a803fca
SHA512 e2ca7432f491c15344ef3550afee917585fc6bc94ae652263a6212b52daeb137460b8a3d86629631529996273966aa5be519cae90a935dd05d9dc50731d9de4b
SSDEEP 49152:ParIFSS6mahEByhgHkauXhQ1J2rmW8HY5X/B5sIGoCyP00eYsnk4Wk8tw6LLlUO2:Pda2/Hkaw16WouCyP0xvuON2oScLUO
TLSH
T1B01633A80A7B1493C1D92CF85F59580DC86FDC3880AC813A6EA379505D7FFE55CF68A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/InstallHelper.exe

IMPHASH 73766ef2ff085b70d10247efdd237d0f
SHA256 bd28408bed1843f1cba95b55a2fa24166958421378b2021e8d082438b0a7a817
MD5 df4bf1abbcdfca1b0687c62185ebe31f
SHA1 e899cf0b4e7549786db351a5b9d7f96d66ba9c1c
SHA512 23da71f8c4e0dd9bb28e18bfd45b60bba0ef30ad366c753f156600a541e9d1fc1eb10f1a88680e012ccfe6edad39e3d327aac4f29511393c3b960dadbb4aadef
SSDEEP 3072:hrth72uTIFFihhQ600vG4EhEMMaxp6Nngt7pTVgaARh3JOTGHCok9d:RtQDFi0600unWdaxpwngBJKpNHCokd
TLSH
T142047D11F982D033C66A4C7059E89A76EE7DB9B00FA0A9CB7B841FFA5D305C16738653
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

35:65:98:4b:07:ce:f2:00:de:a4:e1:80:6b:83:8c:96:18:6a:8e:94:56:56:08:55:32:c9:e5:fa:ba:8b:04:20

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,O=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,ST=Beijing,C=CN

Chains

Sep 16, 2026

CN=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,O=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,O=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,ST=Beijing,C=CN

Serial Number

08:2a:ff:1b:38:9a:02:07:e1:90:f4:92:d0:52:2a:17

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 11, 2024 - Nov 11, 2026

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

43978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TeamCity\workspace\YoudaoProject\dict-pc\src\bin\Win32\Release\InstallHelper.pdb

kernel32

CreateDirectoryW SetFileAttributesW HeapFree InitializeCriticalSectionEx HeapSize GetLastError HeapReAlloc HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap SizeofResource FindFirstFileW FindClose Sleep LockResource FindResourceExW LoadResource FindResourceW FindNextFileW ReadFile WriteFile SetFilePointer CreateFileW CloseHandle GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetStringTypeW SetStdHandle ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW WriteConsoleW

shell32

SHFileOperationW CommandLineToArgvW

shlwapi

PathFileExistsW

Name

.text

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/OP_Logging.dll

IMPHASH 431652968e11d0384b9b2d0bc6775da4
SHA256 4a802d435fb605a78e74e5a481bf047e1017942537d0a5e526266316c1e85af4
MD5 a72c2dca77dcc121d8a8fe8806d1f1d8
SHA1 680308d6ae3d53913205f3dd2245cbf7125ab3de
SHA512 14911c94d8b19a848b95d4fb0cd9f23a701b7b4396d2bc1a2a44b8ba1eadf8ba27579ef1c3caf2cfe588d609f542df021445085fa72a6f2202c5d3c405923ec5
SSDEEP 768:8rJTRgiB5umVUAu753m86ohDkeDmnyEDQovx7tqq1:8r7Zx8dB6ADkZD7tq
TLSH
T1DC234A107280C0B3D166163425B9D772AA7FBC516BF040CB7FA9166E9FB0BD1AA78317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7089

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\tmp\CrashRpt\source\dlls\Release\OP_Logging.pdb

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

4e12c6e197db1f4e21c68b14a70319395548847585e3391c7eed61dc13f15971

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/InstallHelper.exe

kernel32

shell32

shlwapi

generic

$PLUGINSDIR/OP_Logging.dll

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/dict.7z