8bca70d25084f54e14106592db879420806b3a5a7bc0fee29ff76946c78a4d8c

Sharing

Copy URL Twitter E-mail

General

Target
8bca70d25084f54e14106592db879420806b3a5a7bc0fee29ff76946c78a4d8c
Size 352KB
Sample260604-zx53xae14x
SHA256 8bca70d25084f54e14106592db879420806b3a5a7bc0fee29ff76946c78a4d8c
MD5 552ead9265b3db05556e848c4b2ac55d
SHA1 184b028ad8e091646354ccf2547b87851bfd7a35
SHA512 503e2f12f4e3a5fd5548080b8bada7bcb11cf0f9ae1964ebd8ebbcad07319d02fab5510a5b1d6e724cd2da2acbef124eeb3d9c751f18da42e7a2119fc074fa04
SSDEEP 6144:qm+QOla8LG8cd5OsDKOAGIaoXcj90rvinHYvj3Cxam0:qm+Q0arKiosGrvkijiL0
TLSH
T16C747C2AEA9405FDE5BBA17CC8471D01E739784607E189CF139049B23E572E0AF3E7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
8bca70d25084f54e14106592db879420806b3a5a7bc0fee29ff76946c78a4d8c

File Explorer

8bca70d25084f54e14106592db879420806b3a5a7bc0fee29ff76946c78a4d8c

.exe 352KB

8bca70d25084f54e14106592db879420806b3a5a7bc0fee29ff76946c78a4d8c

IMPHASH 78617252a0c794cc327fd10ae083402e
SHA256 8bca70d25084f54e14106592db879420806b3a5a7bc0fee29ff76946c78a4d8c
MD5 552ead9265b3db05556e848c4b2ac55d
SHA1 184b028ad8e091646354ccf2547b87851bfd7a35
SHA512 503e2f12f4e3a5fd5548080b8bada7bcb11cf0f9ae1964ebd8ebbcad07319d02fab5510a5b1d6e724cd2da2acbef124eeb3d9c751f18da42e7a2119fc074fa04
SSDEEP 6144:qm+QOla8LG8cd5OsDKOAGIaoXcj90rvinHYvj3Cxam0:qm+Q0arKiosGrvkijiL0
TLSH
T16C747C2AEA9405FDE5BBA17CC8471D01E739784607E189CF139049B23E572E0AF3E7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

20:a6:62:89:5e:49:ab:cf:0a:04:9c:62:40:0a:ac:de:eb:51:8e:81:61:79:aa:86:73:07:37:2a:a3:a6:07:53

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 18, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Marketplace CA G 026,OU=EOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft MarketPlace PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:4c:bc:6e:2d:e4:b8:23:e4:40:a6:35:00:01:00:4c:bc:6e

Issuer

CN=Microsoft Marketplace CA G 026,OU=EOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2025 - Apr 21, 2025

Subject

CN=Microsoft MarketPlace PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:12:44:a2:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 28, 2011 - Mar 28, 2031

Subject

CN=Microsoft Marketplace CA G 026,OU=EOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5b:4e:9a:32:69:b8:ad:80:0d:00:00:00:00:00:5b

Issuer

CN=Microsoft MarketPlace PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 11, 2024 - Apr 11, 2029

Subject

CN=Dummy certificate

Serial Number

Issuer

CN=Unknown issuer

Key Usages

KeyUsageCertSign

Ext Key Usages

Timespan

Jan 1, 2013 - Apr 1, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ff:12:38:7c:f7:c1:65:d6:a1:00:01:00:00:01:ff

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

131616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryA GetProcAddress FreeLibrary Sleep WriteConsoleW CreateFileW HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetProcessHeap ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId CloseHandle QueryPerformanceCounter WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType GetTimeZoneInformation SetFilePointerEx HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

ws2_32

recv

gdiplus

GdipSaveImageToStream GdipCloneImage GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipFree

Sharing

General

Malware Config

Signatures

File Explorer

8bca70d25084f54e14106592db879420806b3a5a7bc0fee29ff76946c78a4d8c

PE Signature issue

kernel32

ws2_32

gdiplus

generic