Real Executor_39936735[.]exe

Resubmissions

25/06/2026, 15:00

260625-sdapbscx4s8

25/06/2026, 14:56

260625-sba73sc14n8

Sharing

Copy URL Twitter E-mail

General

Target
Real Executor_39936735.exe
Size 583KB
Sample260625-sdapbscx4s
SHA256 ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684
MD5 7392e839c67ba537093c55353be265ba
SHA1 7c9bce283d6eb9b49dcdcc850e66e0148dc30d71
SHA512 07ccf85180c1d63cc03f9d0ff986d0c704f1ac7719e6f7bec56d32f397eb4400a623a19954914b1d391270ce0b08226ee48f92462c7ec2b6ee29500a36ca0617
SSDEEP 12288:w7yjhihTaVWs+OfaOp0XWgWasfMJo7WLrc7SrnTGf0TRz4hTB2eLsHjlsGk8y:yyjz99asfnyNrnTe0TShhLijlsGJy
TLSH
T132D49E123592C036C5B111B01929EFA690BEBD344F7245DBA7D41B2EDB346F26F31A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
Real Executor_39936735.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Real Executor_39936735.exe

File Explorer

Real Executor_39936735.exe

.exe 583KB

Real Executor_39936735.exe

IMPHASH 74e1653b030292297ee93b8588161740
SHA256 ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684
MD5 7392e839c67ba537093c55353be265ba
SHA1 7c9bce283d6eb9b49dcdcc850e66e0148dc30d71
SHA512 07ccf85180c1d63cc03f9d0ff986d0c704f1ac7719e6f7bec56d32f397eb4400a623a19954914b1d391270ce0b08226ee48f92462c7ec2b6ee29500a36ca0617
SSDEEP 12288:w7yjhihTaVWs+OfaOp0XWgWasfMJo7WLrc7SrnTGf0TRz4hTB2eLsHjlsGk8y:yyjz99asfnyNrnTe0TShhLijlsGJy
TLSH
T132D49E123592C036C5B111B01929EFA690BEBD344F7245DBA7D41B2EDB346F26F31A3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

78:8e:77:ab:e2:8f:a4:01:fe:03:23:28:6d:5c:9f:71:9e:f2:ab:99:40:a2:bb:3f:b2:50:3e:67:ae:6c:bd:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=61185515,CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Sep 16, 2025

SERIALNUMBER=61185515,CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#130f427573696e65737320456e74697479

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

SERIALNUMBER=61185515,CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#130f427573696e65737320456e74697479

Serial Number

38:98:a2:22:2c:f3:17:4e:ae:18:3d:21:53:56:5b:96

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Sep 30, 2025

Timespan

Sep 16, 2025 - Sep 16, 2026

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

280120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Samim\Desktop\Installer\Release\Installer.pdb

comctl32

ord410 ord413 InitCommonControlsEx

kernel32

SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetFileAttributesW HeapReAlloc ReadConsoleW ReadFile GetFileAttributesExW GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetFileType SetFilePointerEx GetFileSizeEx HeapFree GetConsoleMode GetConsoleCP FlushFileBuffers GetModuleHandleW GetTempPathW CreateProcessW CreateThread CloseHandle GetLastError Sleep GetTimeZoneInformation WaitForSingleObject GetModuleFileNameW CreateDirectoryW MultiByteToWideChar FindClose HeapAlloc WriteFile GetStdHandle ExitProcess GetModuleHandleExW ExitThread RaiseException RtlUnwind LoadLibraryExW FreeLibraryAndExitThread FreeLibrary GetThreadTimes GetCurrentThread QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte GetStringTypeW GetCurrentThreadId SwitchToThread SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead SetEvent

user32

InvalidateRect UpdateWindow PostQuitMessage DrawTextW GetClientRect SetWindowLongW LoadCursorW TranslateMessage TrackMouseEvent DispatchMessageW SetClassLongW EndPaint RegisterClassExW SetWindowTextW GetSystemMetrics SendMessageW CreateWindowExW FillRect MessageBoxW SetWindowPos DestroyWindow PostMessageW DefWindowProcW GetMessageW GetWindowLongW BeginPaint EnableWindow GetWindowTextW ShowWindow ReleaseDC GetWindowTextLengthW GetWindow GetDC RegisterClassW

gdi32

GetTextExtentPoint32W SelectObject CreateFontW GetStockObject SetTextColor SetBkMode LineTo CreatePen MoveToEx SetBkColor DeleteObject CreateSolidBrush RoundRect

advapi32

RegGetValueW RegSetValueExW RegCloseKey RegCreateKeyExW

shell32

SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

ole32

CoTaskMemFree

urlmon

URLDownloadToFileW URLOpenBlockingStreamA

gdiplus

GdipDisposeImage GdipDrawImageRectI GdipAlloc GdipFree GdipGetImageHeight GdiplusShutdown GdiplusStartup GdipLoadImageFromStream GdipCreateFromHDC GdipDeleteGraphics GdipGetImageWidth GdipCloneImage

wininet

InternetOpenW InternetOpenUrlW InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetOpenUrlA InternetCrackUrlA HttpOpenRequestA

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Real Executor_39936735.exe

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

urlmon

gdiplus

wininet

generic