patch_16[.]10[.]0[.]6093_16[.]10[.]0[.]6125[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
patch_16.10.0.6093_16.10.0.6125.exe
Size 7.6MB
Sample261113-w2awsaez61
SHA256 25b7e99cf8c74799d813d0b1e2de6d146fcc12ddb03372711b2097a7e80cf004
MD5 2c8a14d231b8e835e5147185aad320c2
SHA1 bda08991e23e4b45dfce1d95c42c4ced9f04d44a
SHA512 3ca13d9be74af970cfa5c39b60fda9e72b2eb2fe42c0d6e76c85a0096a235264fdea6f16cb8cb42eb0e93f841c4ae350faf251cfd748e21e2b58958fb23bd5a7
SSDEEP 196608:7woJrDSxMI/HBIz+bbgomkqT63bGvDwTzEpPeZu+Kd:7KrhIz6VbSv46GI+Kd
TLSH
T169863381E2369194F1574FB294B2D0B04213BF561B39EA7F056CBB0D1A375EB81A3D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

File Explorer

patch_16.10.0.6093_16.10.0.6125.exe

.exe 7.6MB
$PLUGINSDIR/7z.dll

.dll 1.2MB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/courgette.exe

.exe 255KB
$PLUGINSDIR/nsExec.dll

.dll 6KB
$PLUGINSDIR/patchupdater.exe

.exe 3.0MB
$PLUGINSDIR/update.patch

15.8MB

patch_16.10.0.6093_16.10.0.6125.exe

IMPHASH 6ce82fb43c0ac7da4ba1e230e17b0851
SHA256 25b7e99cf8c74799d813d0b1e2de6d146fcc12ddb03372711b2097a7e80cf004
MD5 2c8a14d231b8e835e5147185aad320c2
SHA1 bda08991e23e4b45dfce1d95c42c4ced9f04d44a
SHA512 3ca13d9be74af970cfa5c39b60fda9e72b2eb2fe42c0d6e76c85a0096a235264fdea6f16cb8cb42eb0e93f841c4ae350faf251cfd748e21e2b58958fb23bd5a7
SSDEEP 196608:7woJrDSxMI/HBIz+bbgomkqT63bGvDwTzEpPeZu+Kd:7KrhIz6VbSv46GI+Kd
TLSH
T169863381E2369194F1574FB294B2D0B04213BF561B39EA7F056CBB0D1A375EB81A3D3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

1f:86:9a:14:b9:b4:19:10:3b:ac:51:11:e5:8e:a9:00:da:6e:44:87:de:b1:d6:e6:9e:ef:ed:9f:4f:af:e6:eb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Chains

Nov 10, 2026

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 17, 2024 - Jun 19, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

14901

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress GetModuleHandleA GetSystemDirectoryW OpenProcess lstrcpyW LoadLibraryA GetVersionExW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/7z.dll

IMPHASH 106b1a9fde5dbf1b0fd0bd9aa0c6a1e5
SHA256 a2fa67ab7fb997ce8e8eea4ad31b358737e71a96fce4da6b3ca6d0780b121d5a
MD5 ebfff615a5f6ae2c40adfd576034d8bf
SHA1 91765fa71eb329dd9fc9b35de60fadf0b242cf6b
SHA512 b7354bf79b95999ddb55340aee3a172b1eba20e754e33a618258b9676017d9ea3d02b4ff79448a0b8ed08e90d3196ed729236925ee74f890837a1f2c8a3be9d6
SSDEEP 24576:4RpEUlWvbXqUQS6bRg+PlG6M50T+BXrlGyzx43H9OFfsgM:MATq6wolbjx43kFfsgM
TLSH
T1C0457C16E7F1C5B4C98D11304B34BB6612ADF7188712A9DBB3883E6E1F32CD1D636989
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

fe:08:22:03:95:e5:f6:56:3f:6c:d1:0f:81:49:c9:43:8e:9c:3d:d2:e8:e2:23:10:06:3f:78:52:37:79:a3:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Chains

Jan 22, 2026

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 17, 2024 - Jun 19, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

868396

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

SysAllocString SysAllocStringLen VariantClear VariantCopy SysFreeString SysAllocStringByteLen SysStringLen

user32

CharPrevExA CharUpperW

kernel32

InitializeCriticalSection WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle HeapSize GetLastError MultiByteToWideChar WideCharToMultiByte CreateDirectoryW CreateFileW DeleteFileW SetFileAttributesW SetFileTime GetTempPathW CloseHandle SetLastError GetCurrentProcessId GetCurrentThreadId GetTickCount GetModuleHandleW GetProcAddress FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileInformationByHandle GetModuleHandleA ReadFile WriteFile CompareFileTime FileTimeToLocalFileTime FileTimeToSystemTime GetCurrentProcess GetSystemInfo GlobalMemoryStatus GetProcessAffinityMask GetSystemTimeAsFileTime FileTimeToDosDateTime DosDateTimeToFileTime EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects LocalFileTimeToFileTime GetVersionExW DeleteCriticalSection GetOEMCP QueryPerformanceCounter FreeLibrary LoadLibraryW VirtualAlloc VirtualFree IsProcessorFeaturePresent GetVersion DecodePointer SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW ResumeThread SetThreadAffinityMask IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead TerminateProcess GetStringTypeW RaiseException RtlUnwind InterlockedFlushSList EncodePointer VirtualQuery InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleFileNameW HeapFree HeapAlloc HeapReAlloc LCMapStringW FindFirstFileExW IsValidCodePage GetACP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetStdHandle GetFileType

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 93a8e95708882e56250ae55aef93417333b2dbe7ea99590abed34cdca2227e61
MD5 c51fc979c1c3e17bece7bd194aeb6ea2
SHA1 9a5d000d6393f2980062b4cc6e8f543493b1be8f
SHA512 716cdeb890307ff42901464dd24aa94e29415ef20d4e975c2733e34330fdf85edfd4ad9e00878edbe98921deebe44153279cb95acb309c5e1812026716dcdc4e
SSDEEP 192:sfer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4SyYXe:sw7Xws4FVWig86/5eCBqSyYXe
TLSH
T1B9322A3657A0D2F2D6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10085

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/courgette.exe

IMPHASH 83454ce380018164e9bfdc61fbd440d6
SHA256 470c494e1d92fd49b73631ffb652e734fed65cd3c9f6c025c56c95c86d972834
MD5 4fc409cca4215f7c8825050b15998362
SHA1 a9181477bdfcb6c0750f26cee45c8ddef5ba4cd8
SHA512 d2a863d4cbea2ee96a2037a6a4bb5ff6a2fba973291e2f8f070de90403c0aab43a8a398f28e6007d076ac6195e8a73c46da493c7ad9b761010b8bc71e816683e
SSDEEP 6144:gLMo6XqRdkQOfeGz0v1YgpYXsABx7YrVddmL:gLMo6aRdkBWGzte1oGrrwL
TLSH
T113447D30EF1BC1B7D64604B5181ADB6FA6346A158F11D5C3F3C02FAAD9B43D32A3664A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

9c:94:6e:e1:e6:c4:ed:cf:eb:57:73:6d:38:ce:42:ef:0c:af:69:48:38:36:a6:30:19:9d:ac:45:6e:14:90:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Chains

Nov 6, 2026

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 17, 2024 - Jun 19, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

183648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle MapViewOfFile UnmapViewOfFile CreateFileMappingA OutputDebugStringA CreateFileW DeleteFileW FlushFileBuffers GetFileSizeEx SetEndOfFile SetFilePointerEx WriteFile GetTempPathW CreateFileMappingW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleHandleW

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QBE_NXZ ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBE_JXZ ?width@ios_base@std@@QAE_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ _Query_perf_counter _Query_perf_frequency ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z ?_Random_device@std@@YAIXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Xlength_error@std@@YAXPBD@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ

vcruntime140

_except_handler4_common __current_exception memset memmove memcpy __CxxFrameHandler3 __std_exception_destroy __std_exception_copy __std_terminate _purecall _CxxThrowException __current_exception_context

api-ms-win-crt-runtime-l1-1-0

_cexit _c_exit _initialize_narrow_environment __p___argc _configure_narrow_argv _errno _exit terminate _initialize_onexit_table _register_onexit_function _crt_atexit _controlfp_s _set_app_type _initterm_e _seh_filter_exe _initterm __p___argv exit _get_initial_narrow_environment _register_thread_local_exe_atexit_callback abort

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free

api-ms-win-crt-convert-l1-1-0

strtoull atoi strtoll

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __p__commode __stdio_common_vfprintf __acrt_iob_func _set_fmode __stdio_common_vswprintf fflush fclose _wfopen

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 74e2c4b7905e3daa30a6d10d9e4de6b56316b965b4be068c4ed9017febd4613b
MD5 d7d0c9d3b5e38be79ce8765a9b492787
SHA1 27873370f5f3e88365612e0606247173a43eae60
SHA512 ed10326f8cf747b173c707fa3b4d0ef6c46492bda2eb712cf32a10544de0dd35a13a8cf1948e335df08fad418545be12a2d782fea5cefae453dafd578b53d36b
SSDEEP 96:/sspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIqf2:/2rjOELhySv5f2vvBjiAflaB1nIq
TLSH
T15CC108F656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AB6FD68751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/patchupdater.exe

IMPHASH 9ab84d246af3e36b20b559ebdbdc371d
SHA256 f2674f32026d0c39baa682493d9d4d0ba52884892ec6dc10653cf80a946489a9
MD5 8ce13a6140de9c71916453ea3472d802
SHA1 fc85dd4f3c4f7663f6c4a613b2fce9e8349cd223
SHA512 f200b7acce99f1dd4d02e892700af1c45f3337fc2c480a95172fd9ab6f76beb82161bd2d17128a9028cf069e5d819cd3aa1b4a291f46dba0e8effbfbca835473
SSDEEP 49152:yXp2ANrLAeWGWOMaGo6UD0H6iyJLwTB+7JdnTK+tPy4KDTCHr5bKTGp:yXpFNc7OMvs5iyJLwIT3A4KY
TLSH
T13AE5AF13F7425536F8B70279A9FE573E8C3CAA211328D4D3E3C4196E45A19E17A3B386
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

d1:b5:71:ae:2d:1d:13:75:94:8d:3f:39:14:59:1c:29:55:5a:09:0a:bb:c5:f5:13:ab:74:52:ff:87:15:d6:18

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Chains

Nov 9, 2026

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 17, 2024 - Jun 19, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

760217

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\code\SogouInput\work4\bin\Release_Win32\patchupdater.pdb

kernel32

GetTickCount ReadFile GetFileSizeEx GetCurrentProcess SetEndOfFile DuplicateHandle GetFileInformationByHandle SetFilePointerEx FlushFileBuffers GetProcAddress GetModuleHandleW ReleaseSRWLockExclusive TerminateProcess WaitForSingleObject GetExitCodeProcess CreateDirectoryW RemoveDirectoryW GetTempPathW GetFileAttributesW UnmapViewOfFile SetFileAttributesW SetCurrentDirectoryW MoveFileExW CreateFileMappingW MapViewOfFile SetHandleInformation GetStdHandle AssignProcessToJobObject GetProcessId ResumeThread CreateProcessW GetCommandLineW LocalFree GetUserDefaultLangID MultiByteToWideChar WideCharToMultiByte IsDebuggerPresent GetCurrentThreadId Sleep RaiseException CreateThread FileTimeToSystemTime QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime QueryPerformanceCounter GetSystemDirectoryW GetWindowsDirectoryW TryAcquireSRWLockExclusive AcquireSRWLockExclusive GetLocalTime FreeLibrary LoadLibraryExW FindFirstFileExW FindNextFileW FindClose GetVersionExW GetNativeSystemInfo TlsGetValue OpenFileMappingW SetEnvironmentVariableW GetEnvironmentVariableW CreateEventW TlsSetValue TlsAlloc TlsFree RtlCaptureStackBackTrace GetCurrentProcessId SetEvent WakeAllConditionVariable SleepConditionVariableSRW FindFirstFileW GlobalAlloc GlobalFree GetFileTime SetFilePointer ExitThread FormatMessageW GetFileSize OpenMutexW GetFullPathNameW LocalAlloc CreateMutexW ReleaseMutex GetTickCount64 EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EncodePointer LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind GetConsoleOutputCP GetConsoleMode SetStdHandle GetFileType ExitProcess GetModuleHandleExW FreeLibraryAndExitThread GetCommandLineA ReadConsoleW GetDriveTypeW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP SetConsoleCtrlHandler GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW DeleteFiber ConvertFiberToThread LoadLibraryA SetConsoleMode ReadConsoleA CloseHandle DeleteFileW OutputDebugStringW CreateFileW GetModuleFileNameW WriteFile SetLastError FormatMessageA SetUnhandledExceptionFilter PeekNamedPipe GetProcessHeap GetCurrentDirectoryW HeapAlloc HeapReAlloc HeapSize HeapFree DeleteCriticalSection DecodePointer GetLastError LoadLibraryW InitializeCriticalSectionEx

user32

GetClassNameW MessageBoxW GetProcessWindowStation DispatchMessageW PeekMessageW MsgWaitForMultipleObjectsEx TranslateMessage GetWindowThreadProcessId IsWindowVisible GetUserObjectInformationW wsprintfW SetRectEmpty

ole32

PropVariantClear CoTaskMemFree

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

imm32

ImmDisableIME

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty CertFreeCertificateContext

ws2_32

closesocket WSAGetLastError recv send WSASetLastError WSACleanup

winmm

timeGetTime

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

shlwapi

PathMatchSpecW

gdi32

CreateDIBSection CreateCompatibleDC StretchBlt DeleteDC BitBlt SelectObject DeleteObject

advapi32

RegCloseKey RegDeleteKeyW RegCreateKeyExW OpenProcessToken CreateProcessAsUserW InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorDacl RegQueryValueExW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey RegOpenKeyExW CryptGetUserKey CryptGetProvParam RegSetValueExW LookupAccountNameW CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource LookupAccountSidW LookupPrivilegeValueW GetSecurityDescriptorSacl AdjustTokenPrivileges GetSecurityDescriptorDacl SetFileSecurityW GetAclInformation GetAce EqualSid BuildExplicitAccessWithNameW AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW SetSecurityDescriptorSacl AddAce FreeSid GetFileSecurityW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW AddAccessAllowedAceEx GetLengthSid GetUserNameW AddAccessAllowedAce GetTokenInformation

shell32

SHGetFolderPathW CommandLineToArgvW SHGetKnownFolderPath ShellExecuteW SHFileOperationW ShellExecuteExW

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

patch_16.10.0.6093_16.10.0.6125.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/7z.dll

oleaut32

user32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/courgette.exe

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/patchupdater.exe

kernel32

user32

ole32

version

imm32

crypt32

ws2_32

winmm

userenv

shlwapi

gdi32

advapi32

shell32

bcrypt

generic

$PLUGINSDIR/update.patch