LDPlayer9_es_1009_ld[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
LDPlayer9_es_1009_ld.exe
Size 1.2MB
Sample261105-e15w4asz4l
SHA256 e76e6696685037da3f115cf182877bf5901fef1db0b0a5aeafb810e9b0766440
MD5 612bcb3e8e577be68fd17d69c75ee58e
SHA1 9e01e7cc397a450dd0e9f4e3510e31ab96ee4927
SHA512 0df44ffe0d8f44d13d042887d5d7387a4aa093ddf838b81c7cd044e55cfa0215910e8be0cf97d53c545f2f37c225651f0ee4c5c2861a46317697dc13ba42cef1
SSDEEP 24576:5WSlOC3Na4R8sfORscaINBNGQb6lq3VkUE:XlOsNa/RsublC4kU
TLSH
T14A55BE2179509033E2730075A9BDB766547EBDB40B2189CFA3C43B3E1962AC17B36B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

LDPlayer9_es_1009_ld.exe

.exe 1.2MB

LDPlayer9_es_1009_ld.exe

IMPHASH 936e61b7b789b8dae5a2bf831dded80a
SHA256 e76e6696685037da3f115cf182877bf5901fef1db0b0a5aeafb810e9b0766440
MD5 612bcb3e8e577be68fd17d69c75ee58e
SHA1 9e01e7cc397a450dd0e9f4e3510e31ab96ee4927
SHA512 0df44ffe0d8f44d13d042887d5d7387a4aa093ddf838b81c7cd044e55cfa0215910e8be0cf97d53c545f2f37c225651f0ee4c5c2861a46317697dc13ba42cef1
SSDEEP 24576:5WSlOC3Na4R8sfORscaINBNGQb6lq3VkUE:XlOsNa/RsublC4kU
TLSH
T14A55BE2179509033E2730075A9BDB766547EBDB40B2189CFA3C43B3E1962AC17B36B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

4d:61:80:2c:12:db:cd:63:1e:c7:67:6c:67:86:5f:61:4c:4d:04:58:04:47:fd:1a:c1:7e:21:66:55:e7:03:8e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Chains

Sep 23, 2026

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

8d:77:9a:0a:23:13:1d:3c:6a:52:ea:c6:c2:a6:dc:88:f7:88:33:ff

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Chains

Sep 23, 2026

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

SERIALNUMBER=72759881,CN=JUST OKAY LIMITED,O=JUST OKAY LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Serial Number

09:74:28:8f:ad:05:a2:88:a7:ca:76:c2:04:46:69:6f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 13, 2025 - Dec 18, 2026

Minor OS version

Major OS version

Entry point

516836

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\downloader_en_2026_1\ldsmaller\bin\ldsmaller.pdb

kernel32

HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect GetFileType HeapAlloc HeapFree HeapReAlloc GetStdHandle FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent GetCPInfo GetStringTypeW LCMapStringEx DecodePointer InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime FlsFree FlsSetValue FlsGetValue FlsAlloc QueryPerformanceCounter MulDiv GetACP ExitProcess GlobalLock GlobalUnlock LoadLibraryW FindResourceW SizeofResource LoadResource GetProcAddress FreeResource GetVersionExW ReadFile FindFirstFileW FindClose GetLocalTime GetModuleHandleW TerminateThread GetCurrentThreadId SetFilePointer WriteFile DeleteFileW MoveFileExW UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSize GetFileSizeEx MultiByteToWideChar CreateMutexW VerifyVersionInfoW VerSetConditionMask GetUserDefaultUILanguage GetExitCodeProcess CreateProcessW WritePrivateProfileStringA GetPrivateProfileStringW GetModuleFileNameW WritePrivateProfileStringW OpenMutexW Sleep WideCharToMultiByte DeleteCriticalSection SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetDriveTypeW CloseHandle GetDiskFreeSpaceExW SetFilePointerEx SetEndOfFile WriteConsoleW FindNextFileW FindFirstFileExW GetExitCodeThread WaitForSingleObjectEx TryEnterCriticalSection InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException GetLogicalDriveStringsW CreateFileW DeviceIoControl SetLastError GetVolumeInformationW GetTickCount GetLastError WaitForMultipleObjects GlobalFree EncodePointer GlobalAlloc

user32

SetWindowPos DefWindowProcW PostMessageW CreateWindowExW SetWindowLongW DestroyWindow RegisterClassW FindWindowExW SetPropW GetPropW GetClassNameW EnumWindows GetMessageW TranslateMessage DispatchMessageW IsWindow IsWindowVisible CharNextW GetWindowLongW GetActiveWindow GetFocus GetKeyState SetCapture MonitorFromWindow ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect GetCursorPos ScreenToClient MapWindowPoints IntersectRect UnionRect IsRectEmpty PtInRect GetParent SetForegroundWindow IsIconic SendMessageW SetFocus SetTimer GetMonitorInfoW KillTimer GetWindowRect GetDC GetWindow IsZoomed SetWindowRgn MessageBoxW wvsprintfW SetCursor OffsetRect LoadCursorW CallWindowProcW SetWindowTextW MoveWindow CloseWindow ShowWindow BringWindowToTop PostQuitMessage EnableWindow ReleaseCapture RegisterClassExW GetGUIThreadInfo InvalidateRgn CreateAcceleratorTableW GetWindowTextLengthW GetWindowTextW GetSysColor ClientToScreen GetCaretPos SetCaretPos ShowCaret HideCaret GetCaretBlinkTime CreateCaret SetRect FillRect DrawTextW CharPrevW LoadImageW GetSystemMetrics GetClassInfoExW

gdi32

DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap CreateDIBSection GetStockObject CreatePatternBrush GetDeviceCaps GetObjectA GdiFlush ExtTextOutW TextOutW MoveToEx BitBlt SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRectRgnIndirect CreatePenIndirect CombineRgn CreateRoundRectRgn SetWindowOrgEx GetObjectW GetTextMetricsW SelectObject SaveDC RestoreDC Rectangle

advapi32

RegCreateKeyW RegCloseKey RegSetValueExW RegCreateKeyExW RegOpenKeyExA RegQueryValueExA RegQueryValueExW

shell32

ShellExecuteW SHGetMalloc SHGetPathFromIDListW ord165 SHBrowseForFolderW ShellExecuteExW SHGetSpecialFolderLocation

ole32

CreateStreamOnHGlobal OleLockRunning CLSIDFromProgID CLSIDFromString CoUninitialize CoCreateInstance CoInitialize CoCreateGuid CoInitializeEx CoTaskMemFree

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

shlwapi

PathFileExistsW PathIsRootW

ws2_32

WSAStartup

wininet

InternetGetConnectedState InternetReadFile InternetSetOptionW InternetConnectW InternetCloseHandle HttpSendRequestW InternetCrackUrlW HttpQueryInfoW InternetOpenW InternetOpenUrlW HttpOpenRequestW

gdiplus

GdipSetCompositingQuality GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromScan0 GdipSetSmoothingMode GdipDisposeImage GdipCloneImage GdipCreateLineBrushI GdipDeleteBrush GdipCloneBrush GdipGetImageGraphicsContext GdipAlloc GdipFree GdiplusStartup GdipSetPixelOffsetMode GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipLoadImageFromStream GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipGetFamily GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDeleteFontFamily GdipDrawImageRectI GdipDrawImage GdipGraphicsClear GdipSetInterpolationMode GdipSetTextRenderingHint GdiplusShutdown

iphlpapi

GetAdaptersInfo

imm32

ImmSetCompositionWindow ImmSetCompositionFontW ImmReleaseContext ImmGetContext ImmGetVirtualKey

comctl32

_TrackMouseEvent ord17

Name

.text

Size

674KB

Virtual Size

674KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

162KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

340KB

Virtual Size

340KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

LDPlayer9_es_1009_ld.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

wininet

gdiplus

iphlpapi

imm32

comctl32

generic