aa8e13666996b296eb1e78ea3c4896ca27b987eecb026b393b987811b1d573fb

Sharing

Copy URL Twitter E-mail

General

Target
aa8e13666996b296eb1e78ea3c4896ca27b987eecb026b393b987811b1d573fb
Size 478KB
Sample261019-e679eaxz4j
SHA256 aa8e13666996b296eb1e78ea3c4896ca27b987eecb026b393b987811b1d573fb
MD5 811a66d72d86d65af0e7fe4d4245dfa8
SHA1 b6ecb668b7d4673835c632fd1406beccc02f213d
SHA512 ed27d9eb81025ff866983bed91bae45348f9dee0e44765653b13bf75d02c0134fbd0ab1359b1af0b836223eac6bb9689e2f4be558091b28e034c2a4464258a84
SSDEEP 12288:Z/yNVua0q5V49PMdYRe1hQE7ZBjvrEH7ro:MTOq56GX7HrEH7E
TLSH
T158A48D017384C3B5D561013236699B665ABDBD383F56CDCB63D03A2CAE782C1AB3572B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
aa8e13666996b296eb1e78ea3c4896ca27b987eecb026b393b987811b1d573fb

File Explorer

aa8e13666996b296eb1e78ea3c4896ca27b987eecb026b393b987811b1d573fb

.exe 478KB

aa8e13666996b296eb1e78ea3c4896ca27b987eecb026b393b987811b1d573fb

IMPHASH 69ecf606ba5c33f4fd1591e27d0b0143
SHA256 aa8e13666996b296eb1e78ea3c4896ca27b987eecb026b393b987811b1d573fb
MD5 811a66d72d86d65af0e7fe4d4245dfa8
SHA1 b6ecb668b7d4673835c632fd1406beccc02f213d
SHA512 ed27d9eb81025ff866983bed91bae45348f9dee0e44765653b13bf75d02c0134fbd0ab1359b1af0b836223eac6bb9689e2f4be558091b28e034c2a4464258a84
SSDEEP 12288:Z/yNVua0q5V49PMdYRe1hQE7ZBjvrEH7ro:MTOq56GX7HrEH7E
TLSH
T158A48D017384C3B5D561013236699B665ABDBD383F56CDCB63D03A2CAE782C1AB3572B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

13:f9:63:ca:84:11:8f:91:1f:98:63:84:26:9b:01:50:71:bd:25:32:e7:26:2d:e5:96:04:21:0a:3c:39:34:4f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

Chains

Sep 17, 2024

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

f6:a2:45:8d:31:5b:ff:7d:a6:5b:e4:42:e9:34:67:84:28:99:82:cd

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

Chains

Sep 17, 2024

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

Serial Number

36:6c:9e:b6:18:b4:f6:58:42:70:8a:72:5b:29:69:95

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 15, 2023 - May 14, 2026

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Minor OS version

Major OS version

Entry point

99290

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

BeginPaint RegisterWindowMessageW FindWindowA PostQuitMessage KillTimer GetClassNameW FindWindowW TranslateMessage ChangeWindowMessageFilter GetWindowThreadProcessId DefWindowProcW GetMessageA PostMessageW DispatchMessageA LoadCursorA SetWindowPos keybd_event PostMessageA CreateWindowExW SendMessageW RegisterClassExW ShowWindow IsWindow TranslateAcceleratorA SetTimer SetWindowsHookExA LoadAcceleratorsA SetMenu UnhookWindowsHookEx EndPaint

ole32

CoInitializeEx CoInitializeSecurity CoCreateInstance

oleaut32

VariantInit VariantClear

kernel32

GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapAlloc HeapFree SetFilePointerEx GetFileType SetStdHandle IsWow64Process2 GetCurrentProcess WaitForSingleObject OpenFileMappingW OpenProcess Sleep CloseHandle LoadLibraryW K32EnumProcesses SetCurrentDirectoryW GetProcAddress FreeLibrary QueryFullProcessImageNameW DeleteFileW GetCurrentThreadId FreeEnvironmentStringsW MultiByteToWideChar GetStringTypeW WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime WriteConsoleW GetModuleHandleW GetCPInfo WriteFile GetStdHandle GetModuleFileNameW ExitProcess GetProcessHeap CreateFileW FlushFileBuffers HeapSize SetEndOfFile ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue

shell32

ShellExecuteA ShellExecuteW

advapi32

CreateServiceW CloseServiceHandle OpenSCManagerW DeleteService ControlService StartServiceW OpenServiceW

virtdisk

OpenVirtualDisk DetachVirtualDisk

shlwapi

PathFindExtensionW PathRemoveBackslashW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

aa8e13666996b296eb1e78ea3c4896ca27b987eecb026b393b987811b1d573fb

PE Signature issue

PE Signature issue

user32

ole32

oleaut32

kernel32

shell32

advapi32

virtdisk

shlwapi

generic