pw_infected.zip
- SHA256 5a4228d0e9e01c2b90bd3fe64a84a40f0c20baf734f6373dd84a4dcbe653805a
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
edputil.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
edputil.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target pw_infected.zip
- Size 1.8MB
- Sample260602-a7149sh15y
- SHA256 5a4228d0e9e01c2b90bd3fe64a84a40f0c20baf734f6373dd84a4dcbe653805a
- MD5 ed46e7239563cddfb73417b3f124d93a
- SHA1 2e36a683da9f50812ea50831b25cd543712365e1
- SHA512 35b26c3220123a797e9a415966792f17cba7f92fd9b9c3d24f7dbed1a7df1b990a875d894914e249d54d27b13ac883da364cebddc24afcf1d486270795d505aa
- SSDEEP 49152:9YPiJinmow2NF1Nns2wQZCLJxmI+M1V15:9jQuobs25ZGh+Mz
- TLSH T190953374C1927F2A1FCA973F92434A5F18CE604621DBA9A9040CEE95C8B95C0D5FE377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/edputil.dll
File Explorer
-
pw_infected.zip.zip 1.8MB
-
edputil.dll.dll 3.7MB
edputil.dll
- IMPHASH 17bd594239b23059ab44b380f06ba2b3
- SHA256 83f1acece0f52dd36c2b4becaab81d2934426cde2bef64444bca152d2ba3f161
- MD5 e1a3d8643369c674222150ccc0f913d5
- SHA1 a0c7c842ccd03bc99d67acfa2e591a2e91407b44
- SHA512 1258736427f299b1545efc6288039bc6ffba0a3082346d2c696fc59f2732b208803e91a13cb985c31895935b23f4e952c9c6f2f4c3387db08e2233a729421403
- SSDEEP 49152:QAn7grScU0e/LCJ7LQzppOfCQdufBm/cBqlUtz9HHrXk9+irhnAts5aqTZyiy6/u:xM6wSppOBy00z9HHrXk9+iekQAR0
- TLSH T12C068D85AA6C01B8C43AC338890B5E17FA7C7C881371A7EB46914D5A1F777F04A3A75B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
PE Signature issue
Digest
ae:f3:ac:d7:03:fc:7e:1f:91:45:fa:46:62:20:be:6e:6e:b7:b1:59:9d:2a:ee:63:43:92:a9:99:9f:c4:4b:e8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=DXP Software Solutions Code Signing,O=DXP Software Solutions,L=San Jose,ST=California,C=US
Chains
May 21, 2026
CN=DXP Software Solutions Code Signing,O=DXP Software Solutions,L=San Jose,ST=California,C=US
Subject
CN=DXP Software Solutions Code Signing,O=DXP Software Solutions,L=San Jose,ST=California,C=US
Serial Number
63:47:ad:e7:e7:0d:24:8d:48:fa:62:71:09:c0:98:19
Issuer
CN=DXP Software Solutions Code Signing,O=DXP Software Solutions,L=San Jose,ST=California,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 21, 2026 - May 21, 2031
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
0
Major OS version
6
Entry point
2792048
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntdll
RtlLookupFunctionEntry
RtlUnwindEx
RtlCaptureContext
VerSetConditionMask
RtlPcToFileHeader
RtlVirtualUnwind
NtQuerySystemInformation
RtlInitAnsiString
RtlUnwind
RtlInitUnicodeString
NtLoadDriver
NtUnloadDriver
RtlAdjustPrivilege
RtlAnsiStringToUnicodeString
advapi32
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
GetTokenInformation
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
InitializeSecurityDescriptor
OpenProcessToken
RegSetValueExW
RegisterServiceCtrlHandlerW
RegCreateKeyExW
GetUserNameA
SetServiceStatus
RegQueryValueExA
PrivilegeCheck
RegCloseKey
AdjustTokenPrivileges
SetSecurityDescriptorDacl
LookupPrivilegeValueW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
StartServiceW
CloseServiceHandle
LookupPrivilegeValueA
ConvertSidToStringSidA
OpenThreadToken
OpenSCManagerA
RegOpenKeyW
RegCreateKeyW
RegDeleteTreeW
RegSetKeyValueW
CryptImportKey
kernel32
GetCurrentThreadId
GetSystemDirectoryW
GetModuleHandleA
GetLocaleInfoA
SetFileAttributesW
CreateToolhelp32Snapshot
CreateEventW
Sleep
GetTimeZoneInformation
GetTickCount64
GetLastError
CreateFileA
SetEvent
DisableThreadLibraryCalls
GetCurrentThread
QueryPerformanceFrequency
Process32Next
CloseHandle
CreateThread
GetProcAddress
MoveFileExW
GetFileSize
ExitProcess
GetCurrentProcessId
GlobalMemoryStatusEx
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetComputerNameA
GetModuleHandleW
Process32FirstW
Process32NextW
WriteFile
FlushFileBuffers
GetSystemTime
SystemTimeToFileTime
LoadLibraryA
LoadLibraryExA
LocalFree
Module32FirstW
Module32NextW
GetExitCodeProcess
GetFileSizeEx
GetFileAttributesW
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
GetExitCodeThread
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindClose
GetCommandLineA
GetOEMCP
VirtualAlloc
IsValidCodePage
SetEndOfFile
SetStdHandle
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
HeapFree
HeapAlloc
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
IsProcessorFeaturePresent
SetFilePointerEx
GetConsoleOutputCP
DeviceIoControl
GetStdHandle
GetCurrentProcess
VirtualFree
SetConsoleTextAttribute
FindFirstFileA
GetTempPathW
ReadConsoleW
GetConsoleMode
CreateFileW
WaitForSingleObject
SetLastError
CreateMutexA
WakeAllConditionVariable
SleepConditionVariableSRW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
DeleteFileW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
InterlockedFlushSList
ExpandEnvironmentStringsA
FindNextFileA
WaitForMultipleObjects
GetCommandLineW
GetModuleFileNameW
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
GetStringTypeW
GetCPInfo
Process32First
ReadFile
CompareStringEx
DecodePointer
EncodePointer
LCMapStringEx
WriteConsoleW
HeapSize
GetACP
GetSystemFirmwareTable
MapViewOfFile
UnmapViewOfFile
OpenEventW
CreateFileMappingA
OutputDebugStringA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
IsDBCSLeadByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetFullPathNameW
SleepEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetEnvironmentVariableA
VerifyVersionInfoW
GetFileType
PeekNamedPipe
WaitForSingleObjectEx
FormatMessageA
GetLocaleInfoEx
GetCurrentDirectoryW
FindFirstFileExW
FindNextFileW
GetFileInformationByHandle
SetFileInformationByHandle
CreateFile2
AreFileApisANSI
GetFileInformationByHandleEx
GetLogicalProcessorInformationEx
user32
TrackMouseEvent
GetMessageExtraInfo
DefWindowProcW
GetKeyState
GetCapture
SetCapture
ReleaseCapture
IsWindowUnicode
GetForegroundWindow
GetClientRect
SetCursorPos
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
ScreenToClient
ReleaseDC
SetThreadDpiAwarenessContext
MessageBoxA
GetSystemMetrics
GetDC
GetKeyboardLayout
SetCursor
ClientToScreen
EnumDisplayDevicesA
GetWindowRect
GetCursorPos
GetWindowDisplayAffinity
SetWindowPos
UnregisterHotKey
IsIconic
IsWindowVisible
DispatchMessageA
TranslateMessage
PeekMessageA
RegisterHotKey
SetForegroundWindow
CreateWindowExA
GetMonitorInfoA
MonitorFromPoint
RegisterClassExA
LoadCursorA
DefWindowProcA
ShowWindow
RedrawWindow
UpdateWindow
InvalidateRect
SetWindowDisplayAffinity
IsWindow
EmptyClipboard
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject
ole32
CreateStreamOnHGlobal
iphlpapi
SendARP
GetAdaptersInfo
if_nametoindex
setupapi
SetupDiOpenDevRegKey
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
winhttp
WinHttpCrackUrl
WinHttpConnect
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpSetOption
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
d3dcompiler_43
D3DCompile
ServiceMain
Name
.text
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=198, id=261, version=33145,
count=2, id=156, version=21202,
count=4, id=253, version=35721,
count=17, id=260, version=35721,
count=12, id=259, version=35721,
count=30, id=261, version=36241,
count=214, id=260, version=36241,
count=26, id=259, version=33145,
count=40, id=260, version=33145,
count=99, id=261, version=35721,
count=1, id=263, version=33145,
count=23, id=257, version=33145,
count=401, id=1, productName=Unmarked objects,
count=20, id=265, version=36244,
count=1, id=256, version=36244,
count=1, id=255, version=36244,
count=1, id=151,
count=1, id=258, version=36244,