_de79e908320bd93cfe500e4904bc39e57c01e8f84f6e23ab80fc05874145e862[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
_de79e908320bd93cfe500e4904bc39e57c01e8f84f6e23ab80fc05874145e862.exe
Size 3.3MB
Sample260625-pxmapacs4q
SHA256 de79e908320bd93cfe500e4904bc39e57c01e8f84f6e23ab80fc05874145e862
MD5 072a01e30d89dd72021e33b33f97a2df
SHA1 6641862075949a4e2d62cae17035d4525b3caaa1
SHA512 c8f5394fa3b73486a32de9bb6fd78f3af37f464546a218f2135a5a127ee79c22fd9f62bf677f43d452697ab41679cff574292411e7b307414d5a303a2d25737b
SSDEEP 49152:OVIgwa0zOPqENIBsXObwXjsW2/QukBRDJyxA1fR4Qas8b7+Cwe4fjOv0F379:OVXL0QqEeB3+Ar/QHRFyxA1x9BT2Q
TLSH
T188F53398EC5270F4CCA5CAB8E1A70F646E3D11A0526579FF2DF8B4A4180CAC654B98FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
_de79e908320bd93cfe500e4904bc39e57c01e8f84f6e23ab80fc05874145e862.exe

File Explorer

_de79e908320bd93cfe500e4904bc39e57c01e8f84f6e23ab80fc05874145e862.exe

.exe 3.3MB

_de79e908320bd93cfe500e4904bc39e57c01e8f84f6e23ab80fc05874145e862.exe

IMPHASH 3641b918fa6fcd6b6754b75fd2065c00
SHA256 de79e908320bd93cfe500e4904bc39e57c01e8f84f6e23ab80fc05874145e862
MD5 072a01e30d89dd72021e33b33f97a2df
SHA1 6641862075949a4e2d62cae17035d4525b3caaa1
SHA512 c8f5394fa3b73486a32de9bb6fd78f3af37f464546a218f2135a5a127ee79c22fd9f62bf677f43d452697ab41679cff574292411e7b307414d5a303a2d25737b
SSDEEP 49152:OVIgwa0zOPqENIBsXObwXjsW2/QukBRDJyxA1fR4Qas8b7+Cwe4fjOv0F379:OVXL0QqEeB3+Ar/QHRFyxA1x9BT2Q
TLSH
T188F53398EC5270F4CCA5CAB8E1A70F646E3D11A0526579FF2DF8B4A4180CAC654B98FC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

db:61:b8:84:71:4c:96:47:9b:28:e0:46:f2:83:74:e8:3d:2d:5e:2d:23:4b:ee:ab:19:9a:24:37:8f:43:05:9a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 17, 2026

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:18:41:84:19:ad:cb:ad:29:4f:00:00:00:00:05:18

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2025 - Jun 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

4416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

YBBJ9NWM

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

876B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

_de79e908320bd93cfe500e4904bc39e57c01e8f84f6e23ab80fc05874145e862.exe

PE Signature issue

msvcrt

kernel32

generic