d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18.exe
Size 985KB
Sample261113-b3pfcaev91
SHA256 d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18
MD5 552d979fea44774298a7bc6c40f9044d
SHA1 0609b6e551ae04085b9b1e39a053365b498377d1
SHA512 93b73998501da4a84e40ebda55f31cc64bd20082dbee7be3abbcb0c505ea87eef7ee4746831912e89dd4423b63685309e38db9b1234abebad65454152d6859af
SSDEEP 24576:mHB/e7SdgIMw6fr967Vqr8Oe4Jz2gRWQQQQQQQQQQ+QQQQQQQQQQQQQQlQQQQQQs:+SSdFMC7kxJz3WQQQQQQQQQQ+QQQQQQy
TLSH
T1EF256C11F2B2F039CD96D0FD8AEB537B582C9B254B94BCC7E2845D6E2B103D0B57528A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18.exe

.exe 985KB

d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18.exe

IMPHASH e450699ab5212aaec51dcc1a43a85d7c
SHA256 d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18
MD5 552d979fea44774298a7bc6c40f9044d
SHA1 0609b6e551ae04085b9b1e39a053365b498377d1
SHA512 93b73998501da4a84e40ebda55f31cc64bd20082dbee7be3abbcb0c505ea87eef7ee4746831912e89dd4423b63685309e38db9b1234abebad65454152d6859af
SSDEEP 24576:mHB/e7SdgIMw6fr967Vqr8Oe4Jz2gRWQQQQQQQQQQ+QQQQQQQQQQQQQQlQQQQQQs:+SSdFMC7kxJz3WQQQQQQQQQQ+QQQQQQy
TLSH
T1EF256C11F2B2F039CD96D0FD8AEB537B582C9B254B94BCC7E2845D6E2B103D0B57528A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

03:bc:d9:40:30:b4:5e:bf:29:f5:e3:9c:2a:f0:42:d2:cb:fd:4e:31:88:08:89:f9:14:84:b3:64:78:55:c5:15

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 15, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

29:5b:f8:6e:85:26:53:40:33:13:83:7b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Apr 26, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

353537

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\947447\out\Release\InstSoft.pdb

kernel32

FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime FindClose PeekNamedPipe GetCurrentDirectoryA SetCurrentDirectoryA GetExitCodeProcess CreateProcessW CreateToolhelp32Snapshot Process32NextW OpenProcess ReadFile DeviceIoControl FormatMessageA ExpandEnvironmentStringsA GetSystemDirectoryA VerSetConditionMask VerifyVersionInfoA SleepEx SetEnvironmentVariableA CompareStringW CompareStringA GetTimeZoneInformation WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetConsoleMode GetConsoleCP GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA QueryPerformanceCounter GetStartupInfoA GetFileType GetCurrentProcessId GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryW GetSystemWindowsDirectoryW GetVersionExW FreeResource GlobalAlloc InterlockedCompareExchange DeleteFileW ReleaseMutex lstrcmpiW LoadLibraryExW FreeLibrary InterlockedDecrement InterlockedIncrement Sleep CreateFileW GetFullPathNameA WriteFile FlushFileBuffers DeleteCriticalSection InitializeCriticalSection SetLastError LeaveCriticalSection EnterCriticalSection GetCurrentProcess FlushInstructionCache GetCurrentThreadId InitializeCriticalSectionAndSpinCount InterlockedExchange SetConsoleCtrlHandler GetModuleFileNameA GetStdHandle IsValidCodePage GetOEMCP GetACP GetCPInfo FatalAppExitA HeapCreate GetCurrentThread GetModuleHandleA GetStartupInfoW ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlUnwind CreateThread ExitThread lstrcmpiA lstrcmpA GetSystemDirectoryW TlsFree GetModuleHandleW GetProcAddress TlsAlloc HeapWalk HeapLock OpenThread HeapUnlock TlsSetValue OutputDebugStringW TlsGetValue GetFileSizeEx SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime GetSystemTimeAsFileTime SystemTimeToFileTime CreateFileA CreateMutexW OpenMutexW GetTempPathW VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy SetFilePointer GetFileInformationByHandle lstrlenA MultiByteToWideChar GetFileAttributesA lstrlenW WideCharToMultiByte GetLastError FindResourceExW LoadResource LockResource SizeofResource FindResourceW GetTickCount GetModuleFileNameW WaitForSingleObject CloseHandle SetHandleCount RaiseException

user32

PtInRect InvalidateRect PostMessageW IsWindow SetPropW GetWindowRect ReleaseDC GetDC SetWindowLongW GetWindowLongW RemovePropW GetPropW CallWindowProcW IsWindowVisible MoveWindow UnregisterClassA SetWindowPos DefWindowProcW CreateWindowExW GetClassInfoExW GetCapture RegisterClassExW SetCursor SendMessageTimeoutW FindWindowW CreateDialogParamW PeekMessageW DestroyWindow ShowWindow CharNextW LoadImageW GetSystemMetrics GetMonitorInfoW MonitorFromWindow GetClientRect PostQuitMessage SetTimer EndPaint BeginPaint KillTimer ScreenToClient GetCursorPos CopyRect SetWindowTextW SendMessageW wsprintfW GetActiveWindow MessageBoxW SetCapture GetMessageW ReleaseCapture TranslateMessage DispatchMessageW IsDialogMessageW LoadCursorW

gdi32

CreateCompatibleDC SelectObject GetObjectW DeleteObject EnumFontsW GetDeviceCaps DeleteDC SetViewportOrgEx CreateCompatibleBitmap BitBlt ExtTextOutW SetBkColor CreateDIBSection

advapi32

RegQueryValueExW CryptHashData CryptGetHashParam CryptDestroyHash CryptAcquireContextA CryptGenRandom CryptReleaseContext GetTokenInformation RegOpenKeyExA RegEnumKeyExA RegQueryValueExA RegCloseKey CryptCreateHash RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegCreateKeyExW OpenProcessToken DuplicateTokenEx RegQueryInfoKeyW RegSetValueExW RegEnumKeyExW

shell32

ShellExecuteExW ShellExecuteW ord165

ole32

CoCreateGuid CoInitializeEx CoInitialize CoCreateInstance CoInitializeSecurity CoSetProxyBlanket CreateStreamOnHGlobal CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoUninitialize

oleaut32

VariantClear SysAllocString VarUI4FromStr SysFreeString VariantInit

shlwapi

UrlUnescapeW StrCmpIW PathFindFileNameW PathRemoveExtensionW PathAppendW SHDeleteValueW SHSetValueW SHGetValueW PathFileExistsW StrStrIA StrStrIW PathCombineW StrCmpNIW StrTrimA SHSetValueA SHGetValueA StrToIntExW PathIsDirectoryW

comctl32

_TrackMouseEvent

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

gdiplus

GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetTextRenderingHint GdipDrawString GdipCreateStringFormat GdipCreateFont GdipFree GdipAlloc GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdiplusShutdown GdipDrawImageRectRectI GdipGraphicsClear GdipSetInterpolationMode GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipGetImageHeight GdipGetImageWidth GdipDrawImageRectRect GdipDeleteGraphics GdipCreateFromHDC GdiplusStartup GdipDeleteFont GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFontFamilyFromName GdipDrawImageRect GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipDisposeImage GdipCloneImage GdipMeasureString

wininet

HttpSendRequestW HttpOpenRequestW InternetQueryOptionW InternetCanonicalizeUrlW InternetCloseHandle InternetConnectW InternetSetOptionW HttpQueryInfoW InternetCrackUrlW InternetOpenW InternetReadFile

imm32

ImmDisableIME

crypt32

CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertCloseStore CertFindCertificateInStore CertOpenStore CertAddCertificateContextToStore CryptQueryObject CertGetNameStringA CertFreeCertificateChain CryptBinaryToStringA CryptStringToBinaryA

urlmon

URLDownloadToCacheFileW

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

ws2_32

socket gethostbyname WSACleanup inet_ntoa WSASetLastError __WSAFDIsSet WSAGetLastError select recv send WSAIoctl setsockopt getsockname ntohs bind htons getsockopt getpeername closesocket connect freeaddrinfo getaddrinfo ioctlsocket WSAStartup

Sharing

General

Malware Config

Signatures

File Explorer

d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

gdiplus

wininet

imm32

crypt32

urlmon

setupapi

iphlpapi

ws2_32

generic