47d68061ab2f006bcad7acdc0c52849535e374b8ee5cf57610642fba68b86c3b

Sharing

Copy URL Twitter E-mail

General

Target
47d68061ab2f006bcad7acdc0c52849535e374b8ee5cf57610642fba68b86c3b
Size 4.3MB
Sample261030-jmpp6saw2v
SHA256 47d68061ab2f006bcad7acdc0c52849535e374b8ee5cf57610642fba68b86c3b
MD5 2126a4649591bf021305b3c199306f03
SHA1 c8300ccd1dad5802a8b9c369d894007a692121ce
SHA512 bfb6a8aa0dca09ff4902c316f941771693254b40deeb2267319ccfacc0f97f7f4ef71d7db2022f4c0738c69eeba43aca3d51263020a2e8669c67124954ba5a03
SSDEEP 98304:ALrSD9eAChYMqBU+dM7is7v8eK2NuwX5Y0RXB0/TB:ALAATl7i2PXtXw
TLSH
T1FF261115ACDFE4AEFE2CC278C059C6181C23F46AB48818DDAD896A1434E675361BFF1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
47d68061ab2f006bcad7acdc0c52849535e374b8ee5cf57610642fba68b86c3b

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

47d68061ab2f006bcad7acdc0c52849535e374b8ee5cf57610642fba68b86c3b

.exe 4.3MB
.data

512B
.rdata

10KB
.text

29KB
CERTIFICATE

21KB
UPX1

1.1MB
[0]

3.1MB

47d68061ab2f006bcad7acdc0c52849535e374b8ee5cf57610642fba68b86c3b

IMPHASH 86c687639882e442c0170bf9bd8d2957
SHA256 47d68061ab2f006bcad7acdc0c52849535e374b8ee5cf57610642fba68b86c3b
MD5 2126a4649591bf021305b3c199306f03
SHA1 c8300ccd1dad5802a8b9c369d894007a692121ce
SHA512 bfb6a8aa0dca09ff4902c316f941771693254b40deeb2267319ccfacc0f97f7f4ef71d7db2022f4c0738c69eeba43aca3d51263020a2e8669c67124954ba5a03
SSDEEP 98304:ALrSD9eAChYMqBU+dM7is7v8eK2NuwX5Y0RXB0/TB:ALAATl7i2PXtXw
TLSH
T1FF261115ACDFE4AEFE2CC278C059C6181C23F46AB48818DDAD896A1434E675361BFF1D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

b4:52:fd:f1:46:2c:eb:cd:b2:d8:c5:53:5c:f3:3a:c6:a5:a4:d1:61:cf:6b:1a:73:6c:04:95:7f:3f:87:81:6f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Chains

Jul 6, 2026

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

2e:03:da:a1:df:c6:7b:05:5a:f2:33:2e:6b:50:58:c5:d6:c8:0e:9b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Chains

Jul 6, 2026

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Serial Number

0d:6e:19:12:bb:a3:1f:61:ea:6a:ef:ee:89:21:fc:c8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 17, 2023 - Jan 13, 2027

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

15196

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WritePrivateProfileStringW MoveFileW MultiByteToWideChar WideCharToMultiByte CreateFileW GetFileSize GetTickCount GetModuleFileNameW GetCommandLineW SetEnvironmentVariableW GetTempPathW SetErrorMode GetCurrentProcess ExitProcess GetVersion GetWindowsDirectoryW CopyFileW GetDiskFreeSpaceW CreateThread GetPrivateProfileStringW GlobalUnlock lstrcpynW lstrlenW CreateDirectoryW GetTempFileNameW RemoveDirectoryW WriteFile WaitForSingleObject GetExitCodeProcess CreateProcessW GetSystemDirectoryW GetModuleHandleA GetProcAddress lstrcmpiA lstrcpyA lstrcatW MoveFileExW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep GetLastError CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW ExpandEnvironmentStringsW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW GlobalLock

user32

EndDialog CheckDlgButton IsDlgButtonChecked OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetAsyncKeyState IsWindowEnabled GetSystemMetrics GetSystemMenu CreatePopupMenu EnableMenuItem AppendMenuW TrackPopupMenu GetWindowRect SetCursor ScreenToClient GetSysColor GetWindowLongW DialogBoxParamW LoadCursorW SystemParametersInfoW wvsprintfW wsprintfA DispatchMessageW PeekMessageW SetDlgItemTextW GetDlgItemTextW CharNextA CharPrevW MessageBoxIndirectW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW RegisterClassW SetClassLongW CallWindowProcW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW SetWindowLongW

gdi32

SetBkColor GetDeviceCaps SetTextColor SetBkMode SelectObject DeleteObject CreateFontIndirectW CreateBrushIndirect

shell32

ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumValueW OpenProcessToken RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW SetFileSecurityW LookupPrivilegeValueW RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW AdjustTokenPrivileges

comctl32

ImageList_Create ImageList_Destroy ord17 ImageList_AddMasked

ole32

OleInitialize OleUninitialize CoTaskMemFree CoCreateInstance

Sharing

General

Malware Config

Signatures

File Explorer

47d68061ab2f006bcad7acdc0c52849535e374b8ee5cf57610642fba68b86c3b

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

.data

.rdata

.text

CERTIFICATE

UPX1

[0]