92826a34e03683aa710099c8b3c679a99f4ea0bfdd65f4485e30b04dda9b7f41

Sharing

Copy URL Twitter E-mail

General

Target
92826a34e03683aa710099c8b3c679a99f4ea0bfdd65f4485e30b04dda9b7f41
Size 112KB
Sample260930-xkk6vszenc
SHA256 92826a34e03683aa710099c8b3c679a99f4ea0bfdd65f4485e30b04dda9b7f41
MD5 5c1844feb177d7274eabbb7a25fdb032
SHA1 b806c50f07f6e72322f088789bb0dbdf8c2086b1
SHA512 dcf9c4585510853c887890190f1ec55e58217a400ecde57c2b8c8ed0e02128cb1a8937c99b78b4deb39d575a8b2d596d394b1ad35ea75623857652b0d39164fe
SSDEEP 3072:Ix/+ZGPdbBXbLqFpKsypNDq8Gdsw+Sf5ouZ1JR1e/drY4DVQbmQd:O+dX8Ws5SmLFNDVQv
TLSH
T15FB38D0075D1C072E9B659364878CEB58A3EF9611F646DDB33A4127E0F383D0AA3697B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
92826a34e03683aa710099c8b3c679a99f4ea0bfdd65f4485e30b04dda9b7f41

File Explorer

92826a34e03683aa710099c8b3c679a99f4ea0bfdd65f4485e30b04dda9b7f41

.exe 112KB

92826a34e03683aa710099c8b3c679a99f4ea0bfdd65f4485e30b04dda9b7f41

IMPHASH 1c855b53144287d72513f99ba0f15e06
SHA256 92826a34e03683aa710099c8b3c679a99f4ea0bfdd65f4485e30b04dda9b7f41
MD5 5c1844feb177d7274eabbb7a25fdb032
SHA1 b806c50f07f6e72322f088789bb0dbdf8c2086b1
SHA512 dcf9c4585510853c887890190f1ec55e58217a400ecde57c2b8c8ed0e02128cb1a8937c99b78b4deb39d575a8b2d596d394b1ad35ea75623857652b0d39164fe
SSDEEP 3072:Ix/+ZGPdbBXbLqFpKsypNDq8Gdsw+Sf5ouZ1JR1e/drY4DVQbmQd:O+dX8Ws5SmLFNDVQv
TLSH
T15FB38D0075D1C072E9B659364878CEB58A3EF9611F646DDB33A4127E0F383D0AA3697B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ef:0d:0d:8f:c7:0a:ac:22:4a:b0:b0:a8:43:e5:9a:22:ff:58:ee:22:a0:97:b3:97:ba:6d:0d:6a:85:d1:7e:30

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91310000MA1G8B8AXD,CN=上海哔哩哔哩科技有限公司,O=上海哔哩哔哩科技有限公司,STREET=杨浦区四平路1945号1641室,L=上海,ST=上海,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 13, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

1f:57:d8:d4:f4:cd:04:02:89:15:98:70

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 18, 2023 - May 18, 2026

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:03:32:e1:65:bf:9b:78:43:e0:99:75:94:63:77:0b

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 11, 2025 - Dec 10, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

7008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect VirtualAlloc LoadLibraryExA DecodePointer WriteConsoleW SetEndOfFile HeapReAlloc HeapSize GetConsoleOutputCP FlushFileBuffers CreateFileW GetProcessHeap GetLastError MultiByteToWideChar WideCharToMultiByte LocalFree QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW IsProcessorFeaturePresent RtlUnwind RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReadFile GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsDebuggerPresent UnhandledExceptionFilter SetFilePointerEx GetConsoleMode ReadConsoleW GetFileType HeapFree CloseHandle HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW LoadLibraryExW LCMapStringW

ole32

CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

SysFreeString SysAllocString VariantClear

Name

.text

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

92826a34e03683aa710099c8b3c679a99f4ea0bfdd65f4485e30b04dda9b7f41

PE Signature issue

kernel32

ole32

oleaut32

generic