_00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
_00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc.exe
Size 3.3MB
Sample260625-p7ct1ab151
SHA256 00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc
MD5 8dca820fa28aa408d9686b79a038631d
SHA1 5b764b2e0ef983ce885b22a6019468141548e6ed
SHA512 9415204f82d9ccd3645ec7a17bc59c5d883e5279a7ea96d174507d688d494f3093b0229986345a13e91fe0dceca14f59b7a8ed9127e1b304ca07e8f3d6eb98cc
SSDEEP 49152:OUwkzEhdvPicJn8V/VZifVwPDiglJCPqOV0c1LicsKplzH8qI3vbGxD7i1xrVcD:OU9zELacJ89f427igSPB/zc1GFG9Vk
TLSH
T119F533C4459D27BCD69E8AB4E76E6FC2976F908D43016E8F73E084B02BD36D19B35608
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
_00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc.exe

File Explorer

_00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc.exe

.exe 3.3MB

_00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc.exe

IMPHASH 3641b918fa6fcd6b6754b75fd2065c00
SHA256 00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc
MD5 8dca820fa28aa408d9686b79a038631d
SHA1 5b764b2e0ef983ce885b22a6019468141548e6ed
SHA512 9415204f82d9ccd3645ec7a17bc59c5d883e5279a7ea96d174507d688d494f3093b0229986345a13e91fe0dceca14f59b7a8ed9127e1b304ca07e8f3d6eb98cc
SSDEEP 49152:OUwkzEhdvPicJn8V/VZifVwPDiglJCPqOV0c1LicsKplzH8qI3vbGxD7i1xrVcD:OU9zELacJ89f427igSPB/zc1GFG9Vk
TLSH
T119F533C4459D27BCD69E8AB4E76E6FC2976F908D43016E8F73E084B02BD36D19B35608
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

eb:85:cb:ea:b1:04:0a:95:e9:61:ee:01:b7:32:ee:1f:f6:10:3f:ac:c0:81:05:3f:31:62:28:1a:e5:17:6f:ed

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 17, 2026

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:18:41:84:19:ad:cb:ad:29:4f:00:00:00:00:05:18

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2025 - Jun 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

4416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

VVPZELMW

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

876B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

_00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc.exe

PE Signature issue

msvcrt

kernel32

generic