1317188d155e6c61df4b29b7ea6e2c86fbd5bd8fb5301a4f92f708ae4f93519b
- SHA256 1317188d155e6c61df4b29b7ea6e2c86fbd5bd8fb5301a4f92f708ae4f93519b
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026.11.02裁员名单及补偿方案WPS.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026.11.02裁员名单及补偿方案WPS.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
teamspeak_control.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
teamspeak_control.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 1317188d155e6c61df4b29b7ea6e2c86fbd5bd8fb5301a4f92f708ae4f93519b
- Size 588KB
- Sample261102-cxt93set8v
- SHA256 1317188d155e6c61df4b29b7ea6e2c86fbd5bd8fb5301a4f92f708ae4f93519b
- MD5 456b4df0a20e95b9a0b611a0c5a762a1
- SHA1 2dc4f318c4db4c53245df01af6d3be12f8f62a36
- SHA512 c95a2969d0de694cdfb7b4fb276bd421b9a2a4e92b2efdd736953aeb270773cba70d92e6247d2dde72ce59d18aa65085fe506eba9ee43e6569b5e714edc21bad
- SSDEEP 12288:1p8ltKEIijyp8sdeg/fN5uRjmRSuCM3aQPBzSvxZ0F5a8wNl:1p8vKEIijy+i//fNYRmwELZ95sNl
- TLSH T154D4339C218ABBD9F2E0E7B796FC60E14794E17F2C37B56A2F989756480BC7504EC084
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/teamspeak_control.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack002/teamspeak_control.dll
File Explorer
-
1317188d155e6c61df4b29b7ea6e2c86fbd5bd8fb5301a4f92f708ae4f93519b.zip 588KB
-
2026.11.02裁员名单及补偿方案WPS.img.iso 2.3MB
-
1.dat301KB
-
2.dat168KB
-
2026.11.02裁员名单及补偿方案WPS.exe.exe 585KB
-
teamspeak_control.dll.dll 135KB
2026.11.02裁员名单及补偿方案WPS.img
- SHA256 f0ce80105d46f87cb97d73004ced752538f1f2f9f33eae9a74e5f6977ab3c6d8
- MD5 f64026680bce0df50c3cee8f5e0d4f75
- SHA1 16e5c2aab83e9fc534cc8f96b84110acb6c965e6
- SHA512 507bb649ed20c29248f3565a5950bfcea2626510663a75a701852c509ce17e1369254f20934ec8319442242ee0fa885e2ceda3d9d3d3712cab21427bae8edaeb
- SSDEEP 12288:PrO2AnXi51kqpLa/9eg+tjyf8M4EaDKZGMsqsN9MpxJsse796CvbFJTtSW8kAgmq:P+iYqpu/9Qjy0qgKZBsqsNoxabTTsS
- TLSH T1BFB58E9A7A7886F6E02ED17484A6414BD7BAB4558B31878F12F3162D5F233D29D3F320
- MD5 SHA1 SHA512 SSDEEP TLSH
1.dat
- SHA256 084b451a7153a8d7222d0c1f8ccbb2334838ceecd1d443fb1c4fef23041f1f86
- MD5 b9e7b5edae7bd4403326afd816c5013f
- SHA1 6f163ceced2a194804ac5bed2bbccf3c52909fcc
- SHA512 0262b2721ed5baf761139b79b8e0c09b43e5dab9a516b66855ec1dcef2ff5cdaf900e94708e219f61b7c3db7a9e19f4250ff6b19b474101fcb31ceb4c1e584be
- SSDEEP 3072:tSQvlz45r0hn53mmwIxdLn+47A5NJqdaz8laJ8K4iSoM8MdSTAo3e5NPTFJx0Cp1:arOMqmSFnOCpY51kqpL2xaInpsTU9ecz
- TLSH T193643AFA297ED89F743DD0445874044F4CBFDB6AC7B4E92873D31A268F44267EA0A918
- MD5 SHA1 SHA512 SSDEEP TLSH
2.dat
- SHA256 dda22a771417fcebb04839ee246a425384b50b5257cbffb148d0362a1176adcc
- MD5 b09902231ff7a7585d34a34c0640c79f
- SHA1 61c515274f325e86acc28d03b2b75d683436680e
- SHA512 dd0883047cc794374f4593dce9555c3bfc7e4dbca8813bdc9056de751668564a79c2809b4d42bf7e0ed9171ff88bcde3ec77bc653333e4c61874102aee19df7f
- SSDEEP 3072:t+8MWGM9IET/OsiSzNxitoU4vhtArEA22pLIXlabfT0:t+t4IET/USz8MvhuEALXY
- TLSH T1C0F301F9987F005E057CC243E558A0C8921C9A53DF34970F6BE32366CEA91A5F5CFA29
- MD5 SHA1 SHA512 SSDEEP TLSH
2026.11.02裁员名单及补偿方案WPS.exe
- IMPHASH f7c72a60c1414ed464def9cdd98fe022
- SHA256 2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d
- MD5 315bda377beafb746f1c2f4fba430867
- SHA1 62e3ba37a23669139a222cd43ec2b202277a4030
- SHA512 dbf0dfd5e062c1869a20876013cb30c6e6a563c4e46027396c0590ad93d1c3fef5b42a0f68a82c20db90cfd5cfc4d3fae0452c784f0d40c63049d0c7a3d26018
- SSDEEP 6144:vMTDKZGfvKRhPTyB0fVL3A8AG1myJ0bLehmzQnZoMTroJRoKhiz3ZZs+PE7b39By:wDKZGMsqsN9MpxJsse796CvbFJTG
- TLSH T1B3D45A9ABB6887F5D02BE17984D68242E3B574520B2197CB02B12B6D1F377E25D3F321
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a3:7a:c5:34:4e:0a:cd:2e:da:e1:c7:df:03:e8:90:7b:2c:13:ca:e1:07:c7:c8:46:90:45:c2:fb:25:34:83:53
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Overwolf Ltd,O=Overwolf Ltd,L=Ramat Gan,C=IL
Chains
Jun 22, 2021
CN=Overwolf Ltd,O=Overwolf Ltd,L=Ramat Gan,C=IL
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=Overwolf Ltd,O=Overwolf Ltd,L=Ramat Gan,C=IL
Serial Number
0e:e0:0d:4b:1a:48:0c:a8:70:01:b5:40:80:63:da:71
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 27, 2020 - Mar 3, 2023
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
2
Major OS version
5
Entry point
160440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
F:\src\overwolf-git\overwolf-client_dev\OverwolfTeamSpeakHelper\x64\Release\OverwolfTSHelper.pdb
teamspeak_control
tscontrol_connectToClient_async
tscontrol_isRunning
tscontrol_getTS3BinLocation
tscontrol_startTS3Client
tscontrol_requestSendServerTextMsg_async
tscontrol_requestSendChannelTextMsg_async
tscontrol_requestSendPrivateTextMsg_async
tscontrol_getServerConnectInfo_async
tscontrol_getCurrentServerConnectionHandlerID_async
tscontrol_getConnectionStatus_async
tscontrol_getServerVariableAsString_async
tscontrol_getChannelVariableAsString_async
tscontrol_getChannelOfClient_async
tscontrol_getClientID_async
tscontrol_getChannelClientList_async
tscontrol_getClientDisplayName_async
tscontrol_getClientVariableAsString_async
tscontrol_getClientVariableAsInt_async
kernel32
IsDebuggerPresent
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FlushFileBuffers
CreateFileW
WriteConsoleW
SetStdHandle
GetConsoleMode
lstrlenW
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetProcAddress
GetModuleHandleW
lstrcmpiW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
FreeLibrary
MultiByteToWideChar
RtlVirtualUnwind
LoadResource
FindResourceW
LoadLibraryExW
InitializeCriticalSection
CloseHandle
WaitForSingleObject
Sleep
CreateThread
CreateEventW
GetCurrentThreadId
SetEvent
GetCommandLineW
WaitForMultipleObjectsEx
OutputDebugStringW
OpenProcess
TerminateThread
GetConsoleCP
SetFilePointer
IsValidCodePage
GetOEMCP
GetACP
LoadLibraryW
RtlCaptureContext
ExitProcess
GetDateFormatA
GetTimeFormatA
CompareStringW
ReadFile
GetTimeZoneInformation
SizeofResource
SetEnvironmentVariableA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
LCMapStringW
HeapSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
FlsAlloc
SetLastError
FlsFree
FlsSetValue
FlsGetValue
HeapCreate
GetVersion
lstrlenA
WideCharToMultiByte
LocalFree
DecodePointer
EncodePointer
HeapFree
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
GetCPInfo
GetStartupInfoW
WriteFile
GetStdHandle
GetLocaleInfoW
HeapSetInformation
HeapReAlloc
user32
CharNextW
TranslateMessage
GetMessageW
PostThreadMessageW
CharUpperW
DispatchMessageW
advapi32
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
ole32
CoUninitialize
CoInitialize
CoRevokeClassObject
CoTaskMemRealloc
CoTaskMemAlloc
CoRegisterClassObject
StringFromGUID2
CoCreateInstance
CoAddRefServerProcess
CoReleaseServerProcess
CoTaskMemFree
oleaut32
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
LoadTypeLi
LoadRegTypeLi
SysStringLen
VarUI4FromStr
SysFreeString
Name
.text
Size
383KB
Virtual Size
382KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
124KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=171, productName=VS2010 build 30319, version=30319,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=221, productName=VS2013 UPD4 build 31101, version=31101,
count=162, id=1, productName=Unmarked objects,
count=153, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=81, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
teamspeak_control.dll
- IMPHASH 3e788503c83aa456b8dad70b0ef5c232
- SHA256 52fbd5166412c41e6580dc149712492f1eb0ed561650b7fabc326014f9c3057a
- MD5 319836c99f2187f6057c1e0ec6008101
- SHA1 1f13956a99144360b4a8928a67e3c9ba96bf67f2
- SHA512 cc98c706bf624de5675d8096cf8e6d6262400ce06e3b741963be0138fd3171cac64b02724198d6056eea6cc9e93078160c37df39718a99ae721ff8dbcba73c28
- SSDEEP 3072:g/l/KTPtHM1yyI4+ojUgmesRDqd68tnFGy:e/KT1HM8yuoAgmg0cFv
- TLSH T1AAD37C1777A501BBE4B79238C8530646E773B8150A709B6F03B4469A2F273999E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
6f:e3:07:5d:4c:f2:d5:41:25:24:6f:55:ec:b0:c6:68
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Lbh-ssy-CA v1.01
Chains
Jan 1, 0001
Subject
CN=Lbh-ssy-CA v1.01
Serial Number
0c:bf:a1:0c:ee:b1:f7:81:48:af:58:92:56:9d:fe:85
Issuer
CN=Lbh-ssy-CA v1.01
Timespan
Dec 31, 1999 - Aug 7, 8888
Minor OS version
0
Major OS version
0
Entry point
6340
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
.\kernel32
ReadFile
GetModuleFileNameA
VirtualFree
VirtualAlloc
lstrlenA
GetEnvironmentVariableA
GetModuleHandleExA
CreateFileA
DisableThreadLibraryCalls
lstrcpyA
CloseHandle
CreateThread
GetFileSize
lstrcmpiA
WriteConsoleW
CreateFileW
GetConsoleMode
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
.\./shlwapi
PathAppendA
PathRemoveBackslashA
PathRemoveFileSpecA
??4__c_functions__@@QEAAAEAV0@$$QEAV0@@Z
??4__c_functions__@@QEAAAEAV0@AEBV0@@Z
tscontrol_connectToClient_async
tscontrol_getChannelClientList_async
tscontrol_getChannelOfClient_async
tscontrol_getChannelVariableAsString_async
tscontrol_getClientDisplayName_async
tscontrol_getClientID_async
tscontrol_getClientVariableAsInt_async
tscontrol_getClientVariableAsString_async
tscontrol_getConnectionStatus_async
tscontrol_getCurrentServerConnectionHandlerID_async
tscontrol_getServerConnectInfo_async
tscontrol_getServerVariableAsString_async
tscontrol_getTS3BinLocation
tscontrol_isRunning
tscontrol_requestSendChannelTextMsg_async
tscontrol_requestSendPrivateTextMsg_async
tscontrol_requestSendServerTextMsg_async
tscontrol_startTS3Client
Name
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE