0d9cb74a4d0a457cd7dbf72106845e4171e3124768148fa0e1e55aba5911c074

Sharing

Copy URL Twitter E-mail

General

Target
0d9cb74a4d0a457cd7dbf72106845e4171e3124768148fa0e1e55aba5911c074
Size 1.1MB
Sample261111-fr3aaaee95
SHA256 0d9cb74a4d0a457cd7dbf72106845e4171e3124768148fa0e1e55aba5911c074
MD5 abcf12080a812ac0d432fe054e626d93
SHA1 945d987f92dc0b4f8bb0b61c9acd1b6b0ae161c1
SHA512 9b812f08715302e67f47d90d3fc2c8f86a36a20a14187189f7c1dbf8c0c5268afbdcd559215bfdff8e1e202f76a581f2d3de927570e8e89c9f7b699da1dee883
SSDEEP 24576:V2mj42MtVQPGEorkSYCuX/7DkbSrh/qtoT/cgB8SnLZrEH7V:xjnMtVQuFkSCvkurNqtoTkgCSnC
TLSH
T1F435BF117A86C176E9AE0130643CEB7B047D7A360B2184CBEBD83EADAC345E25735B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
0d9cb74a4d0a457cd7dbf72106845e4171e3124768148fa0e1e55aba5911c074

File Explorer

0d9cb74a4d0a457cd7dbf72106845e4171e3124768148fa0e1e55aba5911c074

.dll 1.1MB

0d9cb74a4d0a457cd7dbf72106845e4171e3124768148fa0e1e55aba5911c074

IMPHASH 42dd31ca86c177758d73ef96895182f6
SHA256 0d9cb74a4d0a457cd7dbf72106845e4171e3124768148fa0e1e55aba5911c074
MD5 abcf12080a812ac0d432fe054e626d93
SHA1 945d987f92dc0b4f8bb0b61c9acd1b6b0ae161c1
SHA512 9b812f08715302e67f47d90d3fc2c8f86a36a20a14187189f7c1dbf8c0c5268afbdcd559215bfdff8e1e202f76a581f2d3de927570e8e89c9f7b699da1dee883
SSDEEP 24576:V2mj42MtVQPGEorkSYCuX/7DkbSrh/qtoT/cgB8SnLZrEH7V:xjnMtVQuFkSCvkurNqtoTkgCSnC
TLSH
T1F435BF117A86C176E9AE0130643CEB7B047D7A360B2184CBEBD83EADAC345E25735B57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b8:04:21:8a:02:32:61:67:dc:13:45:55:9f:1e:5e:0a:ed:76:5d:d1:2e:51:98:b6:61:c6:8f:f4:78:bc:87:2b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 24, 2023

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 5, 2022 - Jan 6, 2024

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

466445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\vmagent_new\bin\joblist\719743\out\Release\360Base.pdb

kernel32

DeleteCriticalSection GetModuleHandleW lstrcmpiW SizeofResource LoadResource FindResourceW InterlockedDecrement InterlockedIncrement GetCurrentProcessId ReadFile InterlockedCompareExchange SetFilePointer FreeLibraryAndExitThread HeapSize GetPrivateProfileStringW LockResource FindResourceExW HeapDestroy GetProcessHeap GetCurrentProcess GetSystemWindowsDirectoryW GetVersionExW FreeResource SetFilePointerEx GetFileSizeEx CreateFileMappingW MapViewOfFileEx UnmapViewOfFile lstrcmpA LocalFree GetFileSize WriteFile GetLocalTime GetCurrentThreadId FlushFileBuffers SystemTimeToFileTime FindFirstFileW FindNextFileW FindClose DeleteFileW FileTimeToLocalFileTime FileTimeToSystemTime GetFileAttributesExW MoveFileExW QueryPerformanceCounter LockFileEx UnlockFileEx MapViewOfFile GetModuleHandleExW CreateThread GetFileType ReleaseMutex GetACP lstrlenA LocalFileTimeToFileTime InterlockedExchange MultiByteToWideChar GetUserDefaultLCID LoadLibraryW GetProcAddress GetModuleFileNameW FreeLibrary VirtualProtect GetSystemDirectoryW GetSystemTimeAsFileTime GetSystemInfo TerminateProcess Sleep CreateMutexW WaitForSingleObject InitializeCriticalSectionAndSpinCount GetLocaleInfoW WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage CreateFileW FindNextFileA FindFirstFileExA SetStdHandle GetConsoleCP GetConsoleMode EnumSystemLocalesW IsValidLocale GetModuleFileNameA ExitProcess InterlockedFlushSList RtlUnwind OpenThread HeapWalk HeapUnlock HeapLock CreateFileA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter lstrcatA GlobalMemoryStatus LoadLibraryA GetSystemDirectoryA GetModuleHandleA GetStdHandle GetCPInfo GetStringTypeW LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread OutputDebugStringW IsDebuggerPresent InitializeCriticalSection GetTickCount WideCharToMultiByte LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle GetFileAttributesW lstrcmpiA

user32

MessageBoxA CharNextW GetProcessWindowStation GetUserObjectInformationW

advapi32

ReportEventA DeregisterEventSource RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken CryptReleaseContext CryptGenRandom CryptAcquireContextW ConvertStringSecurityDescriptorToSecurityDescriptorW RegisterEventSourceA

ole32

CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoCreateInstance CoCreateGuid CreateStreamOnHGlobal

oleaut32

SysAllocString VarUI4FromStr

shlwapi

SHGetValueA PathFindFileNameW StrRChrW PathCombineW PathAppendW StrTrimA PathFileExistsW SHGetValueW PathRemoveFileSpecW StrCmpIW StrCmpNIW StrStrIW StrStrIA PathAddBackslashW SHSetValueA SHSetValueW

version

VerQueryValueW GetFileVersionInfoSizeW

crypt32

CryptMsgControl CertFindCertificateInStore CryptQueryObject CertFreeCertificateContext CertGetCertificateContextProperty CertGetNameStringW CryptDecodeObjectEx CryptDecodeObject CertGetCertificateChain CertAddStoreToCollection CertOpenStore CertCloseStore CertOpenSystemStoreW CryptMsgGetParam CryptMsgClose CryptMsgUpdate CertFreeCertificateChain CryptMsgOpenToDecode

iphlpapi

GetAdaptersInfo

generic

count=17, id=241, version=40116,

count=166, id=243, version=40116,

count=30, id=242, version=40116,

count=10, id=260, productName=VS2017 v15.4.5 build 25547, version=25547,

count=3, id=261, version=27045,

count=9, id=260, version=27045,

count=9, id=260, productName=VS2017 v15.5.2 build 25831, version=25831,

count=7, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=199, version=41118,

count=24, id=259, version=26706,

count=9, productName=Unmarked objects (old),

count=247, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=33, id=260, version=26706,

count=60, id=261, version=26706,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=319, id=1, productName=Unmarked objects,

count=1, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=61, id=265, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,