1308343392eed27b9bb36cb154246b9fc44eeacf1ba85fc283d310af063ecd4b

Sharing

Copy URL Twitter E-mail

General

Target
1308343392eed27b9bb36cb154246b9fc44eeacf1ba85fc283d310af063ecd4b
Size 1.9MB
Sample261028-e7qezsyshw
SHA256 1308343392eed27b9bb36cb154246b9fc44eeacf1ba85fc283d310af063ecd4b
MD5 37135e23d2a237da9a8ed664f81d8cbc
SHA1 6720b22683b71acb6c67191549c9ce3310610695
SHA512 5f56cfedcec89d2143e9f450e8a27a7b84900657c199f43ca956bb40b150a1e7a7f742dc0d0aa2af5cd6ddecf5e344d3cc91cc71dc92ac983df2e5bbef5c5609
SSDEEP 24576:+3+63b6K4YyOv065kAAat6hTRsrwUDorEH7p8:+3+0v06czhTRsrwUDq
TLSH
T12C959F10B95EC1B1D24E11707429BBBB967DBA350FB599C7E3C01F3A99202C25B36E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
1308343392eed27b9bb36cb154246b9fc44eeacf1ba85fc283d310af063ecd4b

File Explorer

1308343392eed27b9bb36cb154246b9fc44eeacf1ba85fc283d310af063ecd4b

.dll 1.9MB

1308343392eed27b9bb36cb154246b9fc44eeacf1ba85fc283d310af063ecd4b

IMPHASH 04dc2868906eaa347a4ea94684e4d904
SHA256 1308343392eed27b9bb36cb154246b9fc44eeacf1ba85fc283d310af063ecd4b
MD5 37135e23d2a237da9a8ed664f81d8cbc
SHA1 6720b22683b71acb6c67191549c9ce3310610695
SHA512 5f56cfedcec89d2143e9f450e8a27a7b84900657c199f43ca956bb40b150a1e7a7f742dc0d0aa2af5cd6ddecf5e344d3cc91cc71dc92ac983df2e5bbef5c5609
SSDEEP 24576:+3+63b6K4YyOv065kAAat6hTRsrwUDorEH7p8:+3+0v06czhTRsrwUDq
TLSH
T12C959F10B95EC1B1D24E11707429BBBB967DBA350FB599C7E3C01F3A99202C25B36E1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1d:b0:d8:86:43:f3:e0:5a:11:05:b1:b1:97:e4:b5:9f:c5:37:49:b9:76:84:a1:a5:fb:21:7d:62:a5:cf:8a:96

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,STREET=1 F.\, No. 15\, Lide Rd.\, Beitou Dist.\,,L=Taipei,ST=Taipei,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 22, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

2a:91:e5:cb:06:d3:b4:81:b1:0d:2f:94

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2025 - Mar 26, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

494367

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess SwitchToThread CreateThread GetModuleHandleW GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableW GetFileAttributesW QueryPerformanceCounter QueryPerformanceFrequency DecodePointer DuplicateHandle HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection Sleep OpenProcess FindResourceExW LoadResource LockResource SizeofResource FindResourceW EnterCriticalSection LeaveCriticalSection GetStdHandle GetConsoleMode WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetLastError GlobalLock GlobalUnlock GetModuleFileNameW GetLocalTime CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject MoveFileExW GetFileAttributesExW FindNextFileW FindFirstFileW FindClose DeleteFileW CloseHandle WriteFile GetFileSizeEx ReadFile CreateFileW CreateDirectoryW GetModuleFileNameA GetTickCount GetCurrentThreadId GetCurrentProcessId GetCurrentThread OutputDebugStringA GetTimeZoneInformation SetFilePointerEx ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetConsoleOutputCP FlushFileBuffers GetFileType ExitProcess FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError InterlockedFlushSList RtlUnwind RaiseException OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent GetCPInfo SetEndOfFile GetStringTypeW LCMapStringEx EncodePointer SleepConditionVariableSRW WakeAllConditionVariable GetSystemTimeAsFileTime InitializeCriticalSectionEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive

user32

wsprintfW RegisterWindowMessageA SystemParametersInfoW

gdi32

ExtTextOutW CreateDIBSection GetTextMetricsA SetTextAlign SetTextColor SetBkMode SelectObject GetGlyphIndicesW GetTextExtentPoint32W GetGlyphOutlineW GetCurrentObject GetCharWidth32W DeleteObject DeleteDC CreateFontIndirectW CreateFontIndirectA CreateCompatibleDC

advapi32

RegEnumValueW RegEnumKeyExW GetTokenInformation OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryInfoKeyW

shell32

SHGetFolderPathW

ole32

PropVariantClear CreateStreamOnHGlobal GetHGlobalFromStream CoUninitialize CoInitializeEx CoCreateInstance

vulkan-1

vkCmdCopyImage vkCmdDrawIndexed vkCmdBindVertexBuffers vkCmdBindIndexBuffer vkCmdBindDescriptorSets vkCmdSetScissor vkCmdSetViewport vkCmdBindPipeline vkResetCommandBuffer vkEndCommandBuffer vkBeginCommandBuffer vkFreeCommandBuffers vkAllocateCommandBuffers vkDestroyCommandPool vkCreateCommandPool vkDestroyRenderPass vkCreateRenderPass vkDestroyFramebuffer vkCreateFramebuffer vkUpdateDescriptorSets vkAllocateDescriptorSets vkDestroyDescriptorPool vkCreateDescriptorPool vkDestroyDescriptorSetLayout vkCreateDescriptorSetLayout vkDestroySampler vkCreateSampler vkDestroyPipelineLayout vkCreatePipelineLayout vkDestroyPipeline vkCreateGraphicsPipelines vkDestroySurfaceKHR vkDestroyPipelineCache vkGetPhysicalDeviceSurfaceFormatsKHR vkDestroyShaderModule vkDestroyImageView vkCreateImageView vkDestroyImage vkCreateImage vkDestroyBuffer vkCreateBuffer vkDestroySemaphore vkCreateSemaphore vkWaitForFences vkGetFenceStatus vkResetFences vkDestroyFence vkCreateFence vkGetImageMemoryRequirements vkGetBufferMemoryRequirements vkBindImageMemory vkBindBufferMemory vkUnmapMemory vkMapMemory vkFreeMemory vkAllocateMemory vkDeviceWaitIdle vkQueueWaitIdle vkQueueSubmit vkDestroyDevice vkGetPhysicalDeviceMemoryProperties vkGetPhysicalDeviceProperties vkDestroyInstance vkGetPhysicalDeviceSurfaceCapabilitiesKHR vkCreateSwapchainKHR vkQueuePresentKHR vkAcquireNextImageKHR vkGetSwapchainImagesKHR vkCreatePipelineCache vkCmdEndRenderPass vkCmdBeginRenderPass vkDestroySwapchainKHR vkCmdPushConstants vkCmdPipelineBarrier vkCmdClearAttachments vkCmdClearColorImage vkCmdCopyImageToBuffer vkCmdCopyBufferToImage vkGetPipelineCacheData vkCmdBlitImage vkCreateShaderModule

Name

.text

Size

665KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

126.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Shared

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1308343392eed27b9bb36cb154246b9fc44eeacf1ba85fc283d310af063ecd4b

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

vulkan-1

generic