98c0c290d510c077a7145be6ec4a8f34d1472aa09fd760668937d57b5034f4e2

Sharing

Copy URL Twitter E-mail

General

Target
98c0c290d510c077a7145be6ec4a8f34d1472aa09fd760668937d57b5034f4e2
Size 4.2MB
Sample261002-jg7c2axalg
SHA256 98c0c290d510c077a7145be6ec4a8f34d1472aa09fd760668937d57b5034f4e2
MD5 83f47837e6115220e9594f912823e8ef
SHA1 d90ad1190477ddea07db9b2acb19246b3a5593d4
SHA512 72d26b872f8d74d5c90ddfd5a3dfefe6624fd992e7f33e55df36c5ed830f89e501591dbe96fe5802447035df75b69ac0a3b3c6b3e298c6845c2702e2dcb1ab30
SSDEEP 49152:E7VoFKsBI7Qy2LFCxA/h5Ng57RZosQjaNCz/iQX1yiokRZWk0qRKFTmO0gnYPjr:oQZp/VgFRAjNjBlyV8Wk0VuX
TLSH
T156162A8B3AEB1178C36E863B9121740FB7717AD50755C293A65A8F42FAB70FE6438311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
98c0c290d510c077a7145be6ec4a8f34d1472aa09fd760668937d57b5034f4e2

File Explorer

98c0c290d510c077a7145be6ec4a8f34d1472aa09fd760668937d57b5034f4e2

.exe 4.2MB

98c0c290d510c077a7145be6ec4a8f34d1472aa09fd760668937d57b5034f4e2

IMPHASH e84a5be962866900f181df60df1a2965
SHA256 98c0c290d510c077a7145be6ec4a8f34d1472aa09fd760668937d57b5034f4e2
MD5 83f47837e6115220e9594f912823e8ef
SHA1 d90ad1190477ddea07db9b2acb19246b3a5593d4
SHA512 72d26b872f8d74d5c90ddfd5a3dfefe6624fd992e7f33e55df36c5ed830f89e501591dbe96fe5802447035df75b69ac0a3b3c6b3e298c6845c2702e2dcb1ab30
SSDEEP 49152:E7VoFKsBI7Qy2LFCxA/h5Ng57RZosQjaNCz/iQX1yiokRZWk0qRKFTmO0gnYPjr:oQZp/VgFRAjNjBlyV8Wk0VuX
TLSH
T156162A8B3AEB1178C36E863B9121740FB7717AD50755C293A65A8F42FAB70FE6438311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

91:9a:95:1f:87:7e:2d:f4:52:ba:f4:75:50:9b:5e:22:2c:6c:48:c4:a1:ea:d2:13:bc:a0:6d:5b:f0:b0:4d:15

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

Chains

Jan 22, 2025

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

fc:9e:84:0b:e6:98:4f:27:55:d0:51:7e:9e:d6:3f:17:41:d4:93:e0

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

Chains

Jan 22, 2025

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

Serial Number

0f:84:4f:05:a8:06:45:4d:52:ef:d9:c9:c4:d3:00:e0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 22, 2022 - Sep 24, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

10983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstFileA lstrcpyA Sleep GetTickCount HeapFree HeapAlloc GetCommandLineA HeapSetInformation UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent DecodePointer EncodePointer HeapCreate GetStdHandle GetModuleFileNameW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId EnterCriticalSection LeaveCriticalSection FindNextFileA WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode LoadLibraryW LCMapStringW MultiByteToWideChar GetStringTypeW RtlUnwind SetStdHandle WriteConsoleW HeapReAlloc HeapSize FlushFileBuffers CreateFileW FindClose GetModuleHandleA GetSystemDirectoryA DeleteFileA GetModuleHandleW GetProcAddress CreateEventA CreateThread lstrcatA CreateProcessA WaitForMultipleObjects TerminateProcess GetCurrentDirectoryA GetLastError WaitForSingleObject GetExitCodeProcess ExitProcess GetVersionExA GetCurrentProcess SetEvent GetLocalTime CreateFileA SetFilePointer WriteFile CloseHandle FreeEnvironmentStringsW GetModuleFileNameA

shell32

ShellExecuteExA

advapi32

RegCreateKeyExA RegCloseKey LookupPrivilegeValueA AdjustTokenPrivileges ReportEventA SetServiceStatus RegisterEventSourceA RegisterServiceCtrlHandlerExA StartServiceCtrlDispatcherA ControlService DeleteService CreateServiceA OpenSCManagerA OpenServiceA QueryServiceConfigA LockServiceDatabase ChangeServiceConfigA UnlockServiceDatabase QueryServiceStatus StartServiceA CloseServiceHandle OpenProcessToken GetTokenInformation RegSetValueExA

shlwapi

PathRemoveFileSpecA

Sharing

General

Malware Config

Signatures

File Explorer

98c0c290d510c077a7145be6ec4a8f34d1472aa09fd760668937d57b5034f4e2

PE Signature issue

PE Signature issue

kernel32

shell32

advapi32

shlwapi

generic