365.zip
- SHA256 965dccc55ce9bdf67f4a18a3d54e9bc044eab29755776c73e76f3dedc532779f
Behavioral task
behavioral1
Sample
2026/Es0986544622442525584.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 365.zip
- Size 4.1MB
- Sample260622-phlevabz5q
- SHA256 965dccc55ce9bdf67f4a18a3d54e9bc044eab29755776c73e76f3dedc532779f
- MD5 061d6f9fafbdec10ae8e6067b6bbe9cf
- SHA1 a53e5cd183d31ab53994ea7c9ceccd8239f32a0e
- SHA512 afc05d9df263f3becf5be574f56d721799a357054c9f1daf95eaede087db1ece184aa5633c7f7a63160534186f1a2416a064b1554abbb51dbdd2c50f1f4c5217
- SSDEEP 98304:DA02h9ZTZtAgreyPYiF7hpMwfnvqGqm9+vsXq2/zTn:y3V6yDXJvqGVbhv
- TLSH T17E1633722C1D4CF6FFA8261055F547163ADD1E0CEB29B0AAB3F547B683479C909CE988
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/2026/Es0986544622442525584.EXE innosetup
File Explorer
-
365.zip.zip 4.1MB
-
2026/Es0986544622442525584.EXE.exe 4.2MB
2026/Es0986544622442525584.EXE
- IMPHASH 0c40996f6e1e5f2a82b51e9950881bf1
- SHA256 921849539fe7317e7453895f0eb3d02cce6c5b5cbaaefe45dc430ca3387c9601
- MD5 1ca670e3e324f27793e05fdb94e42292
- SHA1 9875469b4cfb7b76586bc67a3a4e3a8eccb26485
- SHA512 2b32778aec48ef984a2f8f9171ce0c67d0a81c1b484ed61579261c218482e8a135bb952059810a540148b9aa6c08e0e6ba2a19535c351e731da820d3e7763b1e
- SSDEEP 98304:5LAGlASG6OHPzNnwyle6JMUjVjl8CfN34gDmBUrgFMkFTdr:ZpU1Ls6DjX34gSVNx
- TLSH T14926333338ACCCB2F96026305DA8536166FD6B181E34505F73BC4B2E9B2B7C5458E79A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Digest
3d:c6:91:6b:ff:34:fd:aa:f5:d9:83:06:9a:d7:cc:27:15:54:8a:47:52:c3:bf:cc:bc:e0:5f:3b:0f:29:7c:bb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=SC252676,CN=N-able Technologies Ltd,O=N-able Technologies Ltd,STREET=4th Floor 115 George Street,L=Edinburgh,ST=Scotland,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jun 17, 2026
SERIALNUMBER=SC252676,CN=N-able Technologies Ltd,O=N-able Technologies Ltd,STREET=4th Floor 115 George Street,L=Edinburgh,ST=Scotland,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2020 - Mar 18, 2045
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=SC252676,CN=N-able Technologies Ltd,O=N-able Technologies Ltd,STREET=4th Floor 115 George Street,L=Edinburgh,ST=Scotland,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
76:53:08:2d:a3:ba:f2:23:58:3d:82:46
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jun 9, 2028
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
73190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Sleep
MultiByteToWideChar
WideCharToMultiByte
CompareFileTime
FindClose
FindFirstFileW
GetFileAttributesW
GetLastError
CreateDirectoryW
ExpandEnvironmentStringsW
lstrlenA
WriteFile
GetStdHandle
lstrcmpW
GetSystemTimeAsFileTime
lstrlenW
RemoveDirectoryW
FindNextFileW
DeleteFileW
VirtualAlloc
VirtualFree
GetACP
GetOEMCP
GetUserDefaultUILanguage
GetUserDefaultLCID
GetTempPathW
SetEnvironmentVariableW
SetCurrentDirectoryW
CloseHandle
lstrcmpiW
GetModuleFileNameW
CreateThread
GetVersionExW
CreateFileW
GetDriveTypeW
GetModuleHandleW
GetProcAddress
LoadLibraryA
MulDiv
GetSystemDirectoryW
TerminateThread
ResumeThread
SuspendThread
LocalFree
lstrcpyW
FormatMessageW
DeleteCriticalSection
GetFileSize
SetFilePointer
ReadFile
SetFileTime
SetEndOfFile
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
GetModuleHandleA
WaitForSingleObject
GetExitCodeThread
GetLocalTime
SystemTimeToFileTime
GetCommandLineW
SetFileAttributesW
GetStartupInfoA
user32
CharUpperW
GetWindowLongW
wsprintfW
wsprintfA
MessageBoxA
GetKeyState
SendMessageW
wvsprintfW
KillTimer
GetSystemMenu
EnableMenuItem
SetTimer
GetWindowTextW
DefWindowProcW
CallWindowProcW
GetWindowDC
DrawIconEx
MessageBeep
DialogBoxIndirectParamW
GetWindow
GetParent
GetClientRect
ClientToScreen
GetWindowTextLengthW
SetWindowPos
GetDC
DrawTextW
ReleaseDC
ShowWindow
GetWindowRect
ScreenToClient
LoadIconW
LoadImageW
SetWindowLongW
SetDlgItemTextW
SystemParametersInfoW
GetSystemMetrics
GetDlgItem
SetFocus
EndDialog
SetWindowTextW
gdi32
DeleteObject
SelectObject
GetDeviceCaps
GetObjectW
CreateFontIndirectW
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFileInfoW
ole32
CoCreateInstance
CoInitialize
oleaut32
SysAllocString
VariantClear
msvcrt
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_except_handler3
_beginthreadex
_CxxThrowException
_purecall
memset
_wcsnicmp
malloc
free
_wtol
memcpy
memmove
memcmp
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
_controlfp
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=11, version=8047,
count=6, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=28, version=9037,
count=5, id=19, version=8022,
count=1, productName=Unmarked objects (old),
count=11, id=19, version=9049,
count=156, id=1, productName=Unmarked objects,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=42, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,