Docpac[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Docpac.exe
Size 4.2MB
Sample260508-phtffsct3m
SHA256 ce175cd1e1c2513fd569cc0a49b5097d1a8e2b0b5f6cf8d48ec70af3f36ae4a4
MD5 24154831adcedb3f0620c154fa9ef177
SHA1 d5422ebb107bcf3190eb3ee3e038755220fda65e
SHA512 2e7a166e484c7e395d890d5515cdeae0584277e05674055f204d9c036494258c0fc5a5346cd0c32f814098addf6bd6689c279f347af79179944fb26939a4cd22
SSDEEP 98304:iLAxlASG6OHPzNnwyle6JMUjVjl8CfN34gDmBUrgFMkFTdT8:GCU1Ls6DjX34gSVNK
TLSH
T1B326333338ACCCB2F96025305DA8536166FD6B181E34505F73BC4B2E9B2B7C5458E79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Docpac.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

Docpac.exe

.exe 4.2MB

Docpac.exe

IMPHASH 0c40996f6e1e5f2a82b51e9950881bf1
SHA256 ce175cd1e1c2513fd569cc0a49b5097d1a8e2b0b5f6cf8d48ec70af3f36ae4a4
MD5 24154831adcedb3f0620c154fa9ef177
SHA1 d5422ebb107bcf3190eb3ee3e038755220fda65e
SHA512 2e7a166e484c7e395d890d5515cdeae0584277e05674055f204d9c036494258c0fc5a5346cd0c32f814098addf6bd6689c279f347af79179944fb26939a4cd22
SSDEEP 98304:iLAxlASG6OHPzNnwyle6JMUjVjl8CfN34gDmBUrgFMkFTdT8:GCU1Ls6DjX34gSVNK
TLSH
T1B326333338ACCCB2F96025305DA8536166FD6B181E34505F73BC4B2E9B2B7C5458E79A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

PE Signature issue

Digest

da:76:34:1a:a4:48:96:ff:f2:36:61:a5:8a:9c:41:a3:42:97:ef:b9:77:f6:a4:a6:8e:dc:b5:ab:a2:ad:8c:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=SC252676,CN=N-able Technologies Ltd,O=N-able Technologies Ltd,STREET=4th Floor 115 George Street,L=Edinburgh,ST=Scotland,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 7, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

76:53:08:2d:a3:ba:f2:23:58:3d:82:46

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jun 9, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

73190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep MultiByteToWideChar WideCharToMultiByte CompareFileTime FindClose FindFirstFileW GetFileAttributesW GetLastError CreateDirectoryW ExpandEnvironmentStringsW lstrlenA WriteFile GetStdHandle lstrcmpW GetSystemTimeAsFileTime lstrlenW RemoveDirectoryW FindNextFileW DeleteFileW VirtualAlloc VirtualFree GetACP GetOEMCP GetUserDefaultUILanguage GetUserDefaultLCID GetTempPathW SetEnvironmentVariableW SetCurrentDirectoryW CloseHandle lstrcmpiW GetModuleFileNameW CreateThread GetVersionExW CreateFileW GetDriveTypeW GetModuleHandleW GetProcAddress LoadLibraryA MulDiv GetSystemDirectoryW TerminateThread ResumeThread SuspendThread LocalFree lstrcpyW FormatMessageW DeleteCriticalSection GetFileSize SetFilePointer ReadFile SetFileTime SetEndOfFile LeaveCriticalSection EnterCriticalSection WaitForMultipleObjects CreateEventW SetEvent ResetEvent InitializeCriticalSection GetModuleHandleA WaitForSingleObject GetExitCodeThread GetLocalTime SystemTimeToFileTime GetCommandLineW SetFileAttributesW GetStartupInfoA

user32

CharUpperW GetWindowLongW wsprintfW wsprintfA MessageBoxA GetKeyState SendMessageW wvsprintfW KillTimer GetSystemMenu EnableMenuItem SetTimer GetWindowTextW DefWindowProcW CallWindowProcW GetWindowDC DrawIconEx MessageBeep DialogBoxIndirectParamW GetWindow GetParent GetClientRect ClientToScreen GetWindowTextLengthW SetWindowPos GetDC DrawTextW ReleaseDC ShowWindow GetWindowRect ScreenToClient LoadIconW LoadImageW SetWindowLongW SetDlgItemTextW SystemParametersInfoW GetSystemMetrics GetDlgItem SetFocus EndDialog SetWindowTextW

gdi32

DeleteObject SelectObject GetDeviceCaps GetObjectW CreateFontIndirectW

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc ShellExecuteW ShellExecuteExW SHGetSpecialFolderPathW SHGetFileInfoW

ole32

CoCreateInstance CoInitialize

oleaut32

SysAllocString VariantClear

msvcrt

__set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ??1type_info@@UAE@XZ _onexit __dllonexit _except_handler3 _beginthreadex _CxxThrowException _purecall memset _wcsnicmp malloc free _wtol memcpy memmove memcmp __CxxFrameHandler ??3@YAXPAX@Z ??2@YAPAXI@Z _controlfp

Sharing

General

Malware Config

Signatures

File Explorer

Docpac.exe

PE Signature issue

kernel32

user32

gdi32

shell32

ole32

oleaut32

msvcrt

generic