766e4bbdd89658440458280df30f08687eed82ef353d36aa09c104d8c1832369

Sharing

Copy URL Twitter E-mail

General

Target
766e4bbdd89658440458280df30f08687eed82ef353d36aa09c104d8c1832369
Size 1.8MB
Sample261030-e3j3eawt7r
SHA256 766e4bbdd89658440458280df30f08687eed82ef353d36aa09c104d8c1832369
MD5 beedfdc1f4eb47c13183531800d8bcca
SHA1 1853d78b79383025e23d68b98587db7eb9093221
SHA512 c441260d1f28f828b5a259bbda82188d605ca1902924e15192a9b837cf2bf0f34b74454ea16412d852d411c6e3cb34ec82a897d04468daf7b6d18e61ef68c9c0
SSDEEP 49152:zU5I12i/Bbl7r7CHwwmPDUDYDrhfKDD3+6yW7WhXAXMLeVcD:0w1UDwrhIDp7WhXAXM6Vi
TLSH
T11795BF83F1A695EDC44AC9784365B137F636BC4D45306AFAEBC4AF146E66F005E0C32A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

766e4bbdd89658440458280df30f08687eed82ef353d36aa09c104d8c1832369

.exe 1.8MB

766e4bbdd89658440458280df30f08687eed82ef353d36aa09c104d8c1832369

IMPHASH cfa3acf770f056c421246c889851d667
SHA256 766e4bbdd89658440458280df30f08687eed82ef353d36aa09c104d8c1832369
MD5 beedfdc1f4eb47c13183531800d8bcca
SHA1 1853d78b79383025e23d68b98587db7eb9093221
SHA512 c441260d1f28f828b5a259bbda82188d605ca1902924e15192a9b837cf2bf0f34b74454ea16412d852d411c6e3cb34ec82a897d04468daf7b6d18e61ef68c9c0
SSDEEP 49152:zU5I12i/Bbl7r7CHwwmPDUDYDrhfKDD3+6yW7WhXAXMLeVcD:0w1UDwrhIDp7WhXAXM6Vi
TLSH
T11795BF83F1A695EDC44AC9784365B137F636BC4D45306AFAEBC4AF146E66F005E0C32A
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

45:f1:f2:a4:01:c8:98:33:93:ef:32:39:e4:f1:bb:65:aa:92:8b:64:d0:fb:ab:01:5f:15:9d:5b:51:ad:e5:7e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91530100MA6Q29L43C,CN=云南趣连科技有限公司,O=云南趣连科技有限公司,L=昆明市,ST=云南省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e69886e6988ee5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e4ba91e58d97e79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Oct 28, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0a:94:0f:08:7e:01:ab:5a:6a:b1:9c:9f:7d:31:78:73

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 20, 2024 - Jan 26, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FormatMessageW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetEnvironmentVariableW GetStdHandle InitializeCriticalSection LeaveCriticalSection Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter VirtualProtect VirtualQuery WriteConsoleW __C_specific_handler CloseHandle CreateDirectoryW CreateFileMappingA CreateFileW CreateMutexW CreateThread DeleteFileW DuplicateHandle FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetCurrentProcess GetCurrentThread GetCurrentThreadId GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetSystemDirectoryW GetSystemTimePreciseAsFileTime HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete LoadLibraryExW LocalFree MapViewOfFile SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee Sleep SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForSingleObject

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr acosf acos ceil ceilf cos cosf floor floorf fmodf powf roundf truncf

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

ntdll

NtWriteFile RtlNtStatusToDosError

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

combase

CoTaskMemFree

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass

crypt32

CertGetNameStringW

dwmapi

DwmExtendFrameIntoClientArea

gdi32

BitBlt CreateCompatibleDC CreateDIBSection CreateRoundRectRgn DeleteDC DeleteObject GetDeviceCaps SelectObject

msi

MsiCloseHandle MsiDatabaseOpenViewW MsiEnableLogW MsiInstallProductW MsiOpenDatabaseW MsiQueryProductStateW MsiRecordGetStringW MsiSetInternalUI MsiViewExecute MsiViewFetch

ole32

CLSIDFromString CoCreateGuid

shell32

SHGetKnownFolderPath ShellExecuteW

user32

BeginPaint CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EnableWindow EndPaint GetCursorPos GetDC GetFocus GetMessageW GetMonitorInfoW GetParent InvalidateRect IsDialogMessageW IsIconic IsWindowEnabled IsWindowVisible KillTimer LoadCursorW LoadIconW MessageBoxW MonitorFromRect MonitorFromWindow MoveWindow PostMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageW SetFocus SetProcessDPIAware SetTimer SetWindowPos SetWindowRgn SetWindowTextW ShowWindow TrackMouseEvent TranslateMessage

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrustEx

Name

.text

Size

924KB

Virtual Size

923KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

814KB

Virtual Size

813KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

766e4bbdd89658440458280df30f08687eed82ef353d36aa09c104d8c1832369

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

advapi32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

combase

comctl32

crypt32

dwmapi

gdi32

msi

ole32

shell32

user32

winhttp

wintrust

generic