MDE_File_Sample_9672ef25b5f192870beb530b1282b48771daba62.zip
- SHA256 01a29aa32aee096ff1df4e0e45133d06fdb3f793810e20b12558b47c42052453
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
CefHelper.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
CefHelper.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target MDE_File_Sample_9672ef25b5f192870beb530b1282b48771daba62.zip
- Size 184KB
- Sample261014-dgfmesex61
- SHA256 01a29aa32aee096ff1df4e0e45133d06fdb3f793810e20b12558b47c42052453
- MD5 9a539ee28dfb7eb2dfe50f165e3dcae7
- SHA1 60507b35a7adc313785402f6b581ae32b6b2ba4b
- SHA512 dac86271be598cc4e9895926cf0503e280247354a46e6381d1ef972dbf880d13e6ee002645b9d74b14ad87f3f0a929e7b7d6dc1bedc67e923adc53a056a10820
- SSDEEP 3072:hvERqK+37/6ZlobvgtlJqvGFggzFPId8NPGnnGrc3vMzCt2Vj0JiO4nfz:hMRZc/6Zq8zFPmnCc/aC4Cctfz
- TLSH T1610412A7DCE84D8182E0A9B6C537B5B612F2BCA0B61F54D547425C1F6BB924C8C0B86D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
MDE_File_Sample_9672ef25b5f192870beb530b1282b48771daba62.zip.zip 184KB
-
CefHelper.dll.dll 407KB
CefHelper.dll
- IMPHASH 5ee6a6ba7ba604be517f7a0ddd18033f
- SHA256 89ae624005a561552ce0e33c27106c0bda38a338e02e761e84ce23d431c8699b
- MD5 d119629c5bd9b5329ab0d4023e042190
- SHA1 9672ef25b5f192870beb530b1282b48771daba62
- SHA512 b4a6d70823ed0a32d2b340618bf6e47276201ddaf90e5fdf34124eae6cf61bcac5e38ca234a739e303c8be8d4960150c331b98d27fdbaf735b55f69d3381cc4d
- SSDEEP 6144:QNWlAgDOPqxlarIfomGG7FMNFParhyP7jiWaEjgfAOXxY7ch:QNWlAgJlaEfomBmNFPSsfbbWRMch
- TLSH T175946C11B555C432D86D42F17E28DEAF446C3E744BA598EB9BDC0A6B0E201D2EB34F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
f3:2c:4a:81:03:84:7d:8c:60:0c:9e:19:5d:75:2b:ba:23:d9:d1:54:05:1c:3a:b8:80:5b:0c:ef:80:2d:11:ee
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91510100MAC8UQ3N8F,CN=成都盈畅时代文化传播有限公司,O=成都盈畅时代文化传播有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Apr 18, 2024
SERIALNUMBER=91510100MAC8UQ3N8F,CN=成都盈畅时代文化传播有限公司,O=成都盈畅时代文化传播有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91510100MAC8UQ3N8F,CN=成都盈畅时代文化传播有限公司,O=成都盈畅时代文化传播有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
0b:c5:16:ff:01:20:36:c0:91:cb:7f:1b:dc:96:ad:a6:ac:49:c0:20
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91510100MAC8UQ3N8F,CN=成都盈畅时代文化传播有限公司,O=成都盈畅时代文化传播有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Apr 18, 2024
SERIALNUMBER=91510100MAC8UQ3N8F,CN=成都盈畅时代文化传播有限公司,O=成都盈畅时代文化传播有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91510100MAC8UQ3N8F,CN=成都盈畅时代文化传播有限公司,O=成都盈畅时代文化传播有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=91510100MAC8UQ3N8F,CN=成都盈畅时代文化传播有限公司,O=成都盈畅时代文化传播有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
0c:00:de:5d:42:aa:12:3a:53:ed:7c:c3:77:73:06:bc
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 12, 2024 - Jan 12, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
5
Entry point
112781
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Jenkins\.jenkins\workspace\bird_cef_helper\cef_helper\Release\CefHelper.pdb
kernel32
LoadResource
SizeofResource
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FindResourceExW
CopyFileW
MultiByteToWideChar
GetLastError
SetEvent
WaitForSingleObject
CloseHandle
GetCurrentProcess
GetTempPathW
DeleteFileW
WaitForMultipleObjects
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
FlushFileBuffers
SetEnvironmentVariableA
FreeEnvironmentStringsW
CreateEventW
LockResource
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetStringTypeW
FormatMessageW
EncodePointer
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
LocalFree
GetCurrentProcessId
GetCurrentThreadId
InitializeCriticalSection
ReleaseMutex
CreateMutexW
LoadLibraryExW
GetVersionExW
ReadFile
SetFilePointer
CreateFileW
SetFileTime
CreateDirectoryW
SetFileAttributesW
FindClose
FindFirstFileW
GetFileSize
WriteFile
SetEndOfFile
GetStdHandle
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
InterlockedFlushSList
GetFileType
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
ReadConsoleW
WriteConsoleW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
user32
wsprintfW
ole32
CoCreateGuid
shlwapi
PathAppendW
PathCombineW
PathFileExistsW
PathRemoveFileSpecW
SHGetValueW
StrStrIW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
crypt32
CertGetNameStringW
wintrust
WTHelperProvDataFromStateData
WinVerifyTrust
shell32
ord165
oleaut32
VariantClear
SysAllocString
ScriptStart
SetProductInfo
Start
StartEx
StartFlashEx
StartFlashWithProcessEx
StartWithProgress
StartWithProgressEx
Stop
Name
.text
Size
286KB
Virtual Size
285KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=144, id=243, version=40116,
count=29, id=242, version=40116,
count=1, id=261, version=27051,
count=24, id=259, version=26706,
count=12, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,
count=6, id=261, version=27049,
count=1, id=261, version=27031,
count=32, id=260, version=26706,
count=57, id=261, version=26706,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=165, id=1, productName=Unmarked objects,
count=8, id=261, version=27045,
count=1, id=256, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,