sanghyun[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
sanghyun.exe
Size 83KB
Sample261014-apa55awsft
SHA256 e5436505bdbf18d2b1ee707e48348d2390f02e2779fdd7fb9762f9428c9e5cc7
MD5 84f9262d0e27c7362c9c4c116bd0e85b
SHA1 3f0530745c668bbd61bf5e9e23b491ede66107c6
SHA512 0123a1654abcc65829f51b41813827c6d9e1f34cea86e039ee68e80f2d9fa542acef75f8b4e81e70145c50b46adab795475fa3bc594d25717a1ef2bd63b21714
SSDEEP 1536:fOXQrSji6XN9+GVqQ7zgN9ebqvjoJExemwHX9wc21wjHD:fOXQA+QqQfgNY0emckijj
TLSH
T13A83396B23A414C9D7E786F9C2A15607D3B070611F24A3CF17A4878A2F2B6E19F3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

sanghyun.exe

.exe 83KB

sanghyun.exe

IMPHASH 312f2bf564e698d4a1587fc2ad0c03ff
SHA256 e5436505bdbf18d2b1ee707e48348d2390f02e2779fdd7fb9762f9428c9e5cc7
MD5 84f9262d0e27c7362c9c4c116bd0e85b
SHA1 3f0530745c668bbd61bf5e9e23b491ede66107c6
SHA512 0123a1654abcc65829f51b41813827c6d9e1f34cea86e039ee68e80f2d9fa542acef75f8b4e81e70145c50b46adab795475fa3bc594d25717a1ef2bd63b21714
SSDEEP 1536:fOXQrSji6XN9+GVqQ7zgN9ebqvjoJExemwHX9wc21wjHD:fOXQA+QqQfgNY0emckijj
TLSH
T13A83396B23A414C9D7E786F9C2A15607D3B070611F24A3CF17A4878A2F2B6E19F3D355
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Digest

64:c3:72:07:7f:89:92:93:44:57:fd:36:90:24:e2:8e:77:4a:31:b2:72:1d:64:7d:de:8e:9f:48:fd:94:aa:49

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=285011-0308599,CN=DTPZONE Corp.,O=DTPZONE Corp.,STREET=140 Tongil-ro\, Deogyang-gu,L=Goyang-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 9, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

31:5a:f8:0f:60:7b:00:94:f4:20:1d:c1

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2024 - Jun 19, 2027

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msvcrt

memset memcpy strncmp memmove strncpy _strnicmp strlen strcmp strcpy strcat sprintf fabs ceil malloc floor free fclose _stricmp tolower

kernel32

GetModuleHandleA HeapCreate GetCommandLineA RemoveDirectoryA GetTempFileNameA GetShortPathNameA HeapDestroy ExitProcess FindResourceA LoadResource SizeofResource HeapAlloc HeapFree Sleep LoadLibraryA GetProcAddress FreeLibrary GetCurrentThreadId GetCurrentProcessId CloseHandle InitializeCriticalSection GetModuleFileNameA GetEnvironmentVariableA SetEnvironmentVariableA GetCurrentProcess DuplicateHandle CreatePipe GetStdHandle CreateProcessA WaitForSingleObject EnterCriticalSection LeaveCriticalSection PeekNamedPipe GetExitCodeProcess TerminateProcess RtlLookupFunctionEntry RtlVirtualUnwind RemoveVectoredExceptionHandler AddVectoredExceptionHandler GetVersionExA HeapReAlloc SetLastError TlsAlloc GetCurrentDirectoryA SetCurrentDirectoryA GetTempPathA SetFileAttributesA DeleteFileA CreateDirectoryA WriteFile CreateFileA SetFilePointer ReadFile DeleteCriticalSection

ole32

CoInitialize CoTaskMemFree RevokeDragDrop

shell32

ShellExecuteExA

winmm

timeBeginPeriod

shlwapi

PathRemoveArgsA PathGetArgsA PathAddBackslashA PathQuoteSpacesA

user32

MessageBoxA SendMessageA PostMessageA GetWindowThreadProcessId IsWindowVisible GetWindowLongPtrA GetForegroundWindow IsWindowEnabled EnableWindow EnumWindows SetWindowPos DestroyWindow GetDC GetWindowTextLengthA GetWindowTextA SetRect DrawTextA GetWindowLongA GetSystemMetrics ReleaseDC GetSysColor GetSysColorBrush CreateWindowExA CallWindowProcA SetWindowLongPtrA SetFocus RedrawWindow RemovePropA DefWindowProcA SetPropA GetPropA GetParent GetWindow SetActiveWindow UnregisterClassA DestroyAcceleratorTable LoadIconA LoadCursorA RegisterClassA AdjustWindowRectEx ShowWindow CreateAcceleratorTableA PeekMessageA MsgWaitForMultipleObjects GetMessageA GetActiveWindow TranslateAcceleratorA TranslateMessage DispatchMessageA EnumChildWindows GetClientRect FillRect GetFocus DefFrameProcA GetWindowRect IsChild GetClassNameA GetKeyState DestroyIcon RegisterWindowMessageA

gdi32

GetStockObject SelectObject SetTextColor SetBkColor GetTextExtentPoint32A CreateSolidBrush DeleteObject GetObjectA CreateCompatibleDC GetDIBits DeleteDC GetObjectType CreateDIBSection BitBlt CreateBitmap SetPixel

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

sanghyun.exe

msvcrt

kernel32

ole32

shell32

winmm

shlwapi

user32

gdi32

comctl32

generic