3a7bae6f394298348534708b746a49baae2df2dc0618190ecbf64cdbcf599021

resource
3a7bae6f394298348534708b746a49baae2df2dc0618190ecbf64cdbcf599021

resource	yara_rule
sample	upx

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 3a7bae6f394298348534708b746a49baae2df2dc0618190ecbf64cdbcf599021
MD5 12fdb92dee6c0fc8d75eb3cb03e671c2
SHA1 ffafab993e2a7e902efc1020b0123de25ff01730
SHA512 07a8395c8de0206f3150ea22567f3c4a0702d8c8662940a8a26f1e853c01fdc4e6de71ace78c9dfb21406a9dfcc61e2064c98713c49d4266a44fbea009fc1f35
SSDEEP 196608:fqDJET1Bir3Tq8oWel9JC1Gpd8vd5jFrvPTTxX8K91ZFQARR+p2kGQvuD7wX:f7T1BijTq8oWeh3POFFrv/NzRRrkDAcX
TLSH
T194C633C20D0596A3EC18F6314924DAEB5544D6EE83AB0F4C36F9FD8C7BC259B9A10E17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

e2:b8:ad:b4:a3:88:9a:11:18:e8:47:8e:c2:14:28:48:28:18:91:99:06:55:80:a1:8e:3d:63:96:84:f8:74:06

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91310110779301025N,CN=上海宽娱数码科技有限公司,O=上海宽娱数码科技有限公司,L=上海,ST=上海,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 11, 2025

SERIALNUMBER=91310110779301025N,CN=上海宽娱数码科技有限公司,O=上海宽娱数码科技有限公司,L=上海,ST=上海,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=91310110779301025N,CN=上海宽娱数码科技有限公司,O=上海宽娱数码科技有限公司,L=上海,ST=上海,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

49:af:c9:66:8e:4c:2a:53:77:af:dc:b2

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2023 - Jun 19, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

.data

SHA256 f382d804344ebc29cbc21b83080c050a81379e8a478ce109aac23cf53a2dc137
MD5 caa377d001cfc3215a3edff6d7702132
SHA1 12e015a7fa2a29356d00dee7e685246788254fef
SHA512 e079579a422bec47498e855e7364ef54b6777793ba63ae2e281e547ad65f5ed36616cf5ee800f39face6847d5b0eb06ebe42cd0492de42bc6f701dbe98ef03dc
TLSH
T14A310150B3E9820DF2F35BB52D7989660ABB7CA1D9B0E25C0240941E2872A1599FC737
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rdata

SHA256 3feef820a9f96f0298da3113f8636dfeceef551c295fe0170dd77befe32d3b2e
MD5 bd82d08a08da8783923a22b467699302
SHA1 8677bad7d268e6798da158299b8cde5996219d6a
SHA512 541b3fd95cbe9a4aab6172c4200719480ade0f2b423b4ffcaf51f95cb7481dc471c69cbae0d97afb3d5d55c7320f1651894976d13640c23083246629b178ebfc
SSDEEP 96:EJQrMl8xCBvaJqFdlzDPhxyPYPkcmkJqiy0BjKwrY:iQrLFqBDLyPYyk8UjKG
TLSH
T108B1B89915B8094BD9A6AF30347D1E0FCCF9901A641EA31C2084F1DEFF695D2896E7E2
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.text

SHA256 b81c5543120c0b7d5834e690201f549dbc855a5f25abff3a8b1e9a9c34ff06e4
MD5 6d77513573f9c5f6ea445291643583a7
SHA1 b13f987b9ffe8603936bcde64655bfc4706e935a
SHA512 5a958f00983045ef63cecee2b70c7c5a727742a1587f667fb5fe14fcd8c47670c6a2f292070a9796c9a2fea464efa8b07d1f52fc325db51b4a72c42f081701b3
SSDEEP 768:ztFnHvd7bpT4+C/iuK8Smidwy3zWuCCBEnz8PE4WnMVu:zrnHvdmBiuK8Xidw4TCRIu
TLSH
T109C27D1477E0C4F3CD6347714E7A67B6BFEA872212E05A4B47102F987D635C2EA0E692
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

CERTIFICATE

SHA256 7c0a88167b042aa1ae4c0115e23dfea5e5bc4da6432aad0944680bd3a16e8b90
MD5 fb811695897c5ac210faf14ae3229092
SHA1 a9de6ae0d55500ae7b7bb9a5f3868d662a425ffc
SHA512 d2ef14ce05fa64def5b9a1370246584eb8edb9f65643d35ddf8be698b179ac92093a7b6638dab25922eced243ce276947b8974e29f32d1d6ce97abc10a56c960
SSDEEP 192:e6kSDnicMGX6iiXzo2jOmzz7hgULc8pq8RuwdmL4pUQrNyrFj:e6ki2Oij5j/z3Hy8RbmL4nNyrFj
TLSH
T14A226B6348246C03AF47EE54F0C89927ADB4A6866EE1D4C3725AC2188F803D23FDE55D
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

UPX1

SHA256 fd3e0f812525d489081304846946c1fa18cc21fa4e525c3eadff9863736eb759
MD5 012e308ee4625393ea47c9e4b27bfa86
SHA1 b45d2d87dded8e2cba303cce05f1d83bec203222
SHA512 d8703a1312244a08cdf7f75008757f17a8fcc5b5b1e41edcf87f8b33a1274b29d666b327df9e0a1fa368b45b217ecdd2c859b248672d2a1f85340fdd41900964
SSDEEP 24576:GNQvN+JOrj4DZhsMvxub8IIR6i7KlaadbU0IOW0weCvx0ltZb:42sDEGxubdNNVdb9IPK
TLSH
T14D152393DC4003B2FE249771781EDD9D31416EBDC22F2B4EB8D5B5AEF8D1AAA8325015
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

[0]

SHA256 180285621a1eafcdff17b86aad23ace88882ef3916b5381764c3c2aba7e8fa83
MD5 a08f6232d9f61b7271e23a9247b8acb6
SHA1 0ab77c89145e76406573195143e810d20df62b38
SHA512 422461a4185be43eba1ee9fe6b274b7426b3e7fd1d0609e56936ed0ae0a3920dd2cc655d575b59e74f198b490d722369f43b4dce39931c5343dc923c325f36f2
SSDEEP 196608:/ir3Tq8oWel9JC1Gpd8vd5jFrvPTTxX8K91ZFQARR+p2kGQvuD7wH:/ijTq8oWeh3POFFrv/NzRRrkDAcH
TLSH
T1A4B633D20B0AE993D81DF9318520DBF78508D6DA46D70E5C25BEED843BCA49B9D10F2B
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Sharing

General

Malware Config

Signatures

File Explorer