tmply67_gzm
- SHA256 1a0b22ac116b93336f3ab6a82f1625ef74520cb2553c7d12afb809e8d4b8612d
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmply67_gzm.cab
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmply67_gzm.cab
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmply67_gzm.cab
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target tmply67_gzm
- Size 9.2MB
- Sample260602-cmsnhacy9j
- SHA256 1a0b22ac116b93336f3ab6a82f1625ef74520cb2553c7d12afb809e8d4b8612d
- MD5 81894c444250dec609919bf8869286a6
- SHA1 bffd0e1ee5792ecdce410c7247533a1da2a8d9ba
- SHA512 a353048e39731247ba2fde30343015faa1687f9f3c49271c291d667f66b6747fae88c19f9292ecdf025a13a76cf54939e45348464eec75082edab09272ab3cbb
- SSDEEP 196608:xKhpGIqbo0qpUd5lxbN9QZc1GmbL8bdeIlntj/8/Vy5XgLFEfmR2Qc:x+RGdb0ckmcb8IltzvxgImu
- TLSH T11BA6336E37B8E60B073E75949DE22280808B60E352C8F986F15DD7E8337DB55AD64327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FILE_InstallMeExe
File Explorer
-
tmply67_gzm.cab 9.2MB
-
FILE_InstallMeAny.msi 8.0MB
-
FILE_InstallMeExe.dll 2.1MB
FILE_InstallMeAny
- SHA256 0506126bcbc4641d41c138e88d9ea9f10fb65f1eeab3bff90ad25330108b324c
- MD5 10610e3e81158e7f2a0c48e2b2f26d99
- SHA1 8bc692cb4478b317bbc74ee60771b1f723d85649
- SHA512 922b549abab60cae3a61941841c5da97297f84d9e76003364f19eaef2aae173ee91859e14cb2a0ad31ea153aee76228f432ebab4cbcbd473bd6b9e92a78a2abc
- SSDEEP 196608:/E8GMQtdn/62RNOIGIcTvuOjkbV44GB1Shbo7OhnqM9ASZCHI:/EWWR62RNOdIcTLjkbV4HBEhgOZqM6Y
- TLSH T1AD86239C25078332D3B623F16877F2885C27FC2035A198967399F97D077AA90B375E62
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
63e45078c09a29454b48e0972678a3b05e2d6cd37db2916505b64e33024330c3
Digest Algorithm
sha256
Digest Matches
Trusted
Prehash
Signing Certificate
CN=Dell Inc.,OU=Live Optics,O=Dell Inc.,L=Round Rock,ST=Texas,C=US
Chains
Oct 3, 2024
CN=Dell Inc.,OU=Live Optics,O=Dell Inc.,L=Round Rock,ST=Texas,C=US
CN=Entrust Code Signing CA - OVCS2,O=Entrust\, Inc.,C=US
CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Subject
CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US
Serial Number
4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Issuer
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2021 - Nov 7, 2030
Subject
CN=Dell Inc.,OU=Live Optics,O=Dell Inc.,L=Round Rock,ST=Texas,C=US
Serial Number
4a:e1:ca:97:c4:2b:61:b0:8d:fb:3a:61:1b:8f:00:f9
Issuer
CN=Entrust Code Signing CA - OVCS2,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 17, 2024 - May 25, 2025
Subject
CN=Entrust Code Signing CA - OVCS2,O=Entrust\, Inc.,C=US
Serial Number
71:ef:55:74:af:35:54:c3:5a:2c:69:f6:6f:4b:6b:cd
Issuer
CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 7, 2021 - Dec 29, 2040
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 19, 2024 - Jun 1, 2029
FILE_InstallMeExe
- IMPHASH 1a7a6a87f6098051972100536aacabf0
- SHA256 fb51b8123a5f6f9e886af8f9455f7992ba58bebe905c4fd74cd8568eee60eef2
- MD5 9aa24fb8c7dabb6c5120b9d7adcc1dfb
- SHA1 ffc419abc8a93c671ecf0ffa87b483c0b8cbfe7b
- SHA512 14dbbcf36a8050df64cf1c77942451d46b2e5b799c1f7c5ac19e968cd749bf4136b478d2a3bde05bf0593ee85e6b2bb10c97f46adccbf5a04a0da1a3c20b38d9
- SSDEEP 49152:xQW1vx+wfJHk5x0YBQj4a40X0cOk+YJ6ARcGydWw0eizwLJMO:mAvnHix0YBQj4a40XHncGydWwriA
- TLSH T1B3A501D8C48911CFF3A80B3C26395B96FEC4A44DFCD8AD8DCA564BCE0AF956812557C2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2193600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLastError
GetModuleHandleA
GetProcAddress
ExitProcess
LoadLibraryA
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
418KB
Virtual Size
418KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
87KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=14, id=241, version=40116,
count=161, id=243, version=40116,
count=26, id=242, version=40116,
count=30, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=8, id=259, version=24123,
count=57, id=261, version=24123,
count=37, id=260, version=24123,
count=1, id=206, version=65501,
count=3, id=208, version=65501,
count=1, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=2, productName=Unmarked objects (old),
count=33, id=203, version=65501,
count=325, id=1, productName=Unmarked objects,
count=70, id=265, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,