06102026_1538_05102026_PDF_VC20VR.img.zip
- SHA256 ec50c0b97201469574509159de00c4bcc538b99d0bf3a405bb8ea2ee1e0752e2
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VCRUNTIME140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral2
Sample
VCRUNTIME140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral3
Sample
文件.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral4
Sample
文件.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target 06102026_1538_05102026_PDF_VC20VR.img.zip
- Size 19KB
- Sample261006-s3dsaaat41
- SHA256 ec50c0b97201469574509159de00c4bcc538b99d0bf3a405bb8ea2ee1e0752e2
- MD5 4bbee3e89922835663d80ab2c1108efd
- SHA1 f75f938c2b9f23a71c5904b5bb6ff297c9f92f06
- SHA512 7065c646e6133e234449fcb7d22c8238044cde1c463c5609c0e91a46010fe452839d3955379300cf25cd6c634ff992b4ce28dfe1de319ee8baa14c3bc80bf9c8
- SSDEEP 384:j0Xwnynv8gdshTxs9Ob4lbscnCyBMaToPQBVvt6TifwNbpkMUFgtxz:4Xzn4c9ObmnCPQzvt6VBSMaAz
- TLSH T1EE92C061ECA164106C46F23C16BE8E7C623EC9344977A9CC5A56FE68D3D60B5D332A8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/VCRUNTIME140.dll
File Explorer
-
06102026_1538_05102026_PDF_VC20VR.img.zip.zip 19KB
-
PDF_VC20VR.img.iso 104KB
-
VCRUNTIME140.dll.dll 12KB
-
文件.exe.exe 30KB
PDF_VC20VR.img
- SHA256 0a3e4c34cd53ec48b75bf9007deb2484f880ad222e2738427724ed0136cfabc5
- MD5 e17d924480b081685f117828de09df55
- SHA1 b6727c1f86b16677108e76bac1cca5a02f0131d7
- SHA512 f0fc737477ded1a61be58445a2f4f7904b7d3cfd0439a82d597cfef4de6ddff4896477c3f8b467a7097bfdf5d1207ea0176615b9ab1a9f923e8871131bcb9e49
- SSDEEP 768:3XvlO+hbx6e12sf3/XPTx6XBPeMfEpYi6Fe/gCCoYiB2R2E:nvlOobQe1NXPd0BPeD76cd7QR
- TLSH T1CBA35B52CE144C02CE454AB031E6953B9DB7B7722AB181D7B36EC2510B933817EA93BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
VCRUNTIME140.dll
- IMPHASH 6ddbc9cd383bc27afeb428a627825d14
- SHA256 fe48cbe98e12a5b891949ebd3c3054920ed40d261080ba7f5b7a3b174cfb08bc
- MD5 6fec97602115eda3339f43eee3b1c13f
- SHA1 788e6ba1e9909db70066ea2b85d08cc3607a1eba
- SHA512 61b8d4c853b537ad9d96d47f6612e2985a31efef9db6acc40b73d79cc86ee517d6dba59f8e38a97d5a4f0368b71600d95a466eb60760a50bc7928b4b80188efc
- SSDEEP 192:Gnx9BlY3z0y+mlD+O/En9dTp3TWe12NpAf3r1F3X/0qxK3ox:6xvlZg+hbF3TWe12sf3r1ZPs
- TLSH T18B420819F90AC263E9C406BA525F15A799BD5A33368F246FF3830B1105A11E07D3AA23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
9344
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ExitProcess
GetModuleHandleA
GetProcAddress
GetLocalTime
DisableThreadLibraryCalls
CompareFileTime
CreateFileA
GetFileSize
ReadFile
GetCurrentProcess
CloseHandle
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
msvcr90
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
??3@YAXPAX@Z
memset
__current_exception
__current_exception_context
_except_handler4_common
efadfte
memset
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
558B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=150, version=20413,
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=12, id=131, productName=VS2008 build 21022, version=21022,
count=4, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=59, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=4, id=138, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
文件.exe
- IMPHASH a6ad551bd591b8b4c5176cddf2183da2
- SHA256 f1147d55d4c7af03d8d88e990b32fa273f2719513a440834cf56473c9d04be98
- MD5 b97cea0fe9d1d573fb730fc7b0cbdcc7
- SHA1 f8c0e0b08133c03e152aa006cb761537f424a954
- SHA512 039c3f8f503d52b85d940428773d5ef2e6f16c043bafd95f5d86ac7758e80e41c5136cc4309c5e702f09e9b4d8dd6e505972960e39d969849adc23c933b4bc18
- SSDEEP 384:OPTx5sXBPJxHRvjsTid0kApeNyb8E9VF6IYijSJIVce2GFhgCCMGvvIYiBeiyNm3:OPTx6XBPeMfEpYi6Fe/gCCoYiB2R2Eg
- TLSH T15CE26D63CE245C01CF568FB074E1893AEE75B7924A9082D3733EC2518B923427B991FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
14:ab:b3:a1:75:d8:f1:92:2a:39:52:c4:0c:0c:57:7d:2e:4b:49:b0:77:10:91:54:7a:93:25:31:76:de:31:5a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Apr 17, 2025
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
52:b5:c2:7d:e5:14:19:6a:e5:fc:8b:fa:d4:52:27:9b:2e:47:56:7e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Apr 17, 2025
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
SERIALNUMBER=91440115783790925T,CN=Guangzhou Kugou Technology Co.\, Ltd.,O=Guangzhou Kugou Technology Co.\, Ltd.,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e5a4a9e6b2b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
03:38:82:1e:28:c9:9e:a3:9d:2e:a3:7c:fe:39:d1:06
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 13, 2023 - Dec 12, 2026
Minor OS version
0
Major OS version
6
Entry point
4789
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\buildbot\reorder\kugou_pgo\build\Release\Win32\dataimporter.exe.pdb
kernel32
GetProcAddress
FreeLibrary
LoadLibraryExW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
user32
MessageBoxW
vcruntime140
_except_handler4_common
memset
__current_exception_context
__current_exception
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_exit
exit
_configure_wide_argv
_register_thread_local_exe_atexit_callback
_cexit
_set_app_type
_seh_filter_exe
_c_exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
404B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33731,
count=1, id=259, version=33731,
count=12, id=260, version=33731,
count=19, id=261, version=33731,
count=5, id=257, version=33136,
count=49, id=1, productName=Unmarked objects,
count=1, id=265, version=33811,
count=1, id=255, version=33811,
count=1, id=258, version=33811,