381e5c5ee54f0df50a499bf7519f806b25be2612819a278c067550b5f9b0402f

General

Target
381e5c5ee54f0df50a499bf7519f806b25be2612819a278c067550b5f9b0402f
Size 2.5MB
Sample261009-heaevab15s
SHA256 381e5c5ee54f0df50a499bf7519f806b25be2612819a278c067550b5f9b0402f
MD5 b168bed59e7341ba30c80124851e64a9
SHA1 03e985d2bdc8b8578b0f60e00a6727729581ce2e
SHA512 2e709db57569e2646bc9fca60f89c5db558db3e1896e109af4a5a61daebf6d21279e850b50c3cadfde2ac27ebdb10afd14bf52c9247c498a722963560de726f2
SSDEEP 49152:w3o6Y8xllqwo8qWUdkdxWu6nos0t7XVm4:d8x+woYy0xp6nN0tzVb
TLSH
T10FC5E0B672043394D06B8830A123BE59B2F2221E4BA585FBB6D769C03B5B5D0F536F47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
381e5c5ee54f0df50a499bf7519f806b25be2612819a278c067550b5f9b0402f

File Explorer

381e5c5ee54f0df50a499bf7519f806b25be2612819a278c067550b5f9b0402f

.exe 2.5MB

381e5c5ee54f0df50a499bf7519f806b25be2612819a278c067550b5f9b0402f

IMPHASH 5dbb7bcda197e66e5aa007adb6d32b7a
SHA256 381e5c5ee54f0df50a499bf7519f806b25be2612819a278c067550b5f9b0402f
MD5 b168bed59e7341ba30c80124851e64a9
SHA1 03e985d2bdc8b8578b0f60e00a6727729581ce2e
SHA512 2e709db57569e2646bc9fca60f89c5db558db3e1896e109af4a5a61daebf6d21279e850b50c3cadfde2ac27ebdb10afd14bf52c9247c498a722963560de726f2
SSDEEP 49152:w3o6Y8xllqwo8qWUdkdxWu6nos0t7XVm4:d8x+woYy0xp6nN0tzVb
TLSH
T10FC5E0B672043394D06B8830A123BE59B2F2221E4BA585FBB6D769C03B5B5D0F536F47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3f:e7:e0:66:4b:8c:55:56:2b:79:ed:41:34:e0:64:11:05:62:37:a0:ee:f3:20:2e:d5:4a:18:68:69:2a:08:ec

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 12, 2021

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

PE Signature issue

Digest

79:8b:d3:0e:fc:fe:b6:64:b3:d6:1f:1c:43:22:4d:69:84:1c:a2:3a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 12, 2021

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

07:aa:52:5b:f1:73:f0:e5:e3:68:d8:ae:77:0f:8a:af

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2019 - Oct 12, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

5

Entry point

10807

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcpyA Sleep GetTickCount HeapFree HeapAlloc GetCommandLineA HeapSetInformation UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent DecodePointer EncodePointer HeapCreate GetModuleHandleW GetStdHandle GetModuleFileNameW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId EnterCriticalSection LeaveCriticalSection FindFirstFileA WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode LoadLibraryW LCMapStringW MultiByteToWideChar GetStringTypeW RtlUnwind SetStdHandle WriteConsoleW HeapReAlloc HeapSize FlushFileBuffers CreateFileW FindNextFileA FindClose GetModuleHandleA GetProcAddress GetSystemDirectoryA DeleteFileA CreateEventA CreateThread lstrcatA CreateProcessA WaitForMultipleObjects TerminateProcess GetCurrentDirectoryA GetLastError WaitForSingleObject GetExitCodeProcess ExitProcess GetVersionExA GetCurrentProcess SetEvent GetLocalTime CreateFileA SetFilePointer WriteFile CloseHandle FreeEnvironmentStringsW GetModuleFileNameA

shell32

ShellExecuteExA

advapi32

RegCreateKeyExA RegCloseKey LookupPrivilegeValueA AdjustTokenPrivileges ReportEventA SetServiceStatus RegisterEventSourceA RegisterServiceCtrlHandlerExA StartServiceCtrlDispatcherA ControlService DeleteService CreateServiceA OpenSCManagerA OpenServiceA QueryServiceConfigA LockServiceDatabase ChangeServiceConfigA UnlockServiceDatabase QueryServiceStatus StartServiceA CloseServiceHandle OpenProcessToken GetTokenInformation RegSetValueExA

shlwapi

PathRemoveFileSpecA

Sharing

General

Malware Config

Signatures

File Explorer

381e5c5ee54f0df50a499bf7519f806b25be2612819a278c067550b5f9b0402f

PE Signature issue

PE Signature issue

kernel32

shell32

advapi32

shlwapi

generic