6d66fb5630ddb55a963137f08d4f779aa6d85258a8bc149bf5f37d2c27f59b1c

Sharing

Copy URL Twitter E-mail

General

Target
6d66fb5630ddb55a963137f08d4f779aa6d85258a8bc149bf5f37d2c27f59b1c
Size 877KB
Sample261031-japveagf99
SHA256 6d66fb5630ddb55a963137f08d4f779aa6d85258a8bc149bf5f37d2c27f59b1c
MD5 690aa303074dd77bc8dd1bb8d0f858c9
SHA1 799c6559fd2ee1a4eaaf137dd1723bdedca74bbd
SHA512 c93be91ce14353ca77f4c77c57d6c853b415e63880d6ab4a4389e1d759048295795712a4c2848dd6f9b3ff853375305c9da1e6ccd4a08cb5d1fc2d3e333bcdd2
SSDEEP 24576:8Q8aDWQuuS4SbzfOZwE5cZTYmxVDgySsMRGJ/qofbGs:8jaRxS44E5oTYcVDgyx1qa
TLSH
T1F015AF117FCDC3F6D34D1571642EAB2F167AA668173086D3F7801E6A5D34AC2AE3824B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
6d66fb5630ddb55a963137f08d4f779aa6d85258a8bc149bf5f37d2c27f59b1c

File Explorer

6d66fb5630ddb55a963137f08d4f779aa6d85258a8bc149bf5f37d2c27f59b1c

.dll 877KB

6d66fb5630ddb55a963137f08d4f779aa6d85258a8bc149bf5f37d2c27f59b1c

IMPHASH 5fdda80ef5a9f4b6fd42205fa199a9bb
SHA256 6d66fb5630ddb55a963137f08d4f779aa6d85258a8bc149bf5f37d2c27f59b1c
MD5 690aa303074dd77bc8dd1bb8d0f858c9
SHA1 799c6559fd2ee1a4eaaf137dd1723bdedca74bbd
SHA512 c93be91ce14353ca77f4c77c57d6c853b415e63880d6ab4a4389e1d759048295795712a4c2848dd6f9b3ff853375305c9da1e6ccd4a08cb5d1fc2d3e333bcdd2
SSDEEP 24576:8Q8aDWQuuS4SbzfOZwE5cZTYmxVDgySsMRGJ/qofbGs:8jaRxS44E5oTYcVDgyx1qa
TLSH
T1F015AF117FCDC3F6D34D1571642EAB2F167AA668173086D3F7801E6A5D34AC2AE3824B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7b:fc:64:ec:18:b4:30:71:c7:e0:66:bc:8f:05:d1:1f:63:11:58:67:01:d2:6e:82:43:94:b3:a6:93:d2:0c:60

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 17, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

29:5b:f8:6e:85:26:53:40:33:13:83:7b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Apr 26, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

535106

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\vmagent_new\bin\joblist\909727\out\Release\360zipc.pdb

kernel32

CreateFileW DeviceIoControl DeleteCriticalSection CloseHandle GetCurrentProcessId GetFileSizeEx SetFilePointerEx ReadFile SetFilePointer WriteFile SetEndOfFile MultiByteToWideChar WideCharToMultiByte InterlockedCompareExchange lstrlenW GetFileAttributesExW SetFileTime SetFileAttributesW MoveFileExW GetTickCount DeleteFileW GetTempFileNameW WaitForSingleObject CreateFileMappingW MapViewOfFile UnmapViewOfFile LoadLibraryW CreateFileA GetVersionExW LoadLibraryA Sleep CreateEventW ResetEvent SetEvent WaitForMultipleObjects GetSystemDirectoryW GetCurrentDirectoryW GetTempPathW GetCurrentThreadId GetFileInformationByHandle GetStdHandle GetModuleHandleA GetFileSize CompareFileTime VirtualFree VirtualAlloc GetProcessAffinityMask GetSystemInfo FileTimeToLocalFileTime GetSystemTimeAsFileTime CopyFileW GetSystemTime SystemTimeToFileTime GetVolumeInformationW GetShortPathNameW VirtualQuery AreFileApisANSI FoldStringW CompareStringA CompareStringW InitializeCriticalSection GetCPInfo SystemTimeToTzSpecificLocalTime FileTimeToSystemTime TzSpecificLocalTimeToSystemTime LocalFileTimeToFileTime SetThreadExecutionState SetThreadPriority FlushFileBuffers GetFileType GetConsoleMode CreateThread CreateSemaphoreW ReleaseSemaphore OutputDebugStringW SetEnvironmentVariableA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW GetTimeZoneInformation GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID SetStdHandle SetLastError FindNextFileW FindClose GetLastError GetFileAttributesW CreateDirectoryW FindFirstFileW GetPrivateProfileIntW LoadLibraryExW GetCurrentProcess GetModuleHandleW GetProcAddress FreeLibrary LeaveCriticalSection EnterCriticalSection FindResourceExW FindResourceW LoadResource LockResource SizeofResource QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA InitializeCriticalSectionAndSpinCount GetConsoleCP GetStartupInfoA SetHandleCount IsValidCodePage GetOEMCP GetACP GetModuleFileNameA HeapCreate GetStringTypeW GetDateFormatA GetTimeFormatA LCMapStringW LCMapStringA RtlUnwind GetCommandLineA ExitProcess ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess TlsFree TlsAlloc ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock TlsSetValue TlsGetValue CreateMutexW RaiseException GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc GetModuleFileNameW IsDBCSLeadByte HeapDestroy GetLocaleInfoA InterlockedExchange InterlockedDecrement InterlockedIncrement

user32

CharUpperW OemToCharA OemToCharBuffA CharLowerW

advapi32

RegQueryValueExW RegEnumKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExA

shell32

SHChangeNotify SHFileOperationW SHGetFolderPathW SHGetSpecialFolderPathW SHCreateDirectoryExW

oleaut32

SysStringByteLen SysStringLen VariantClear VariantCopy SysAllocString SysFreeString SysAllocStringLen

shlwapi

PathRenameExtensionW StrCmpIW PathRemoveExtensionW PathFindFileNameW PathFindExtensionW PathIsRootW PathFileExistsW PathCombineW PathAppendW PathRemoveFileSpecW StrStrW PathIsDirectoryW PathRemoveBackslashW PathFileExistsA

Sharing

General

Malware Config

Signatures

File Explorer

6d66fb5630ddb55a963137f08d4f779aa6d85258a8bc149bf5f37d2c27f59b1c

PE Signature issue

kernel32

user32

advapi32

shell32

oleaut32

shlwapi

generic