Diversion-v0.zip
- SHA256 ea57bb9e136ef02f1f0c3ba9b9ecc870906ebaf978dee496f2b90b5dccf83737
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Diversion.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
60 seconds
Behavioral task
behavioral2
Sample
Diversion.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
2 signatures
60 seconds
General
- Target Diversion-v0.zip
- Size 7.8MB
- Sample260629-dyr2sab18w
- SHA256 ea57bb9e136ef02f1f0c3ba9b9ecc870906ebaf978dee496f2b90b5dccf83737
- MD5 8804317833be84bb433b5bf598f3cfd1
- SHA1 297e8f614bdec4ab771d07f60819ce7b7b2d51f2
- SHA512 3bfe50c27bb6ddbdc4f547c9f697f6e9a96350cf422abef2592ea84f7ddc3c49ac4776b13d00749cd205d41f03daa88d6bd8f6712c0f9350a046de3b5182abe6
- SSDEEP 196608:lg4wxH3fvO29bLt9w344HUgYxfAuKe9UK9qQsQZ4VnB50JKRpwe:l03O4E344HU7aCUCQQZ4B50kie
- TLSH T1818633A12D42FC70BB55FAB46E172368112F798E7502F8D901C74AC6BCF40792A399B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Diversion.exe
File Explorer
-
Diversion-v0.zip.zip 7.8MB
-
Diversion.exe.exe 7.9MB
-
main.pyc4KB
-
LICENSE1KB
-
config.json41B
-
info.txt4KB
Diversion.exe
- IMPHASH 351592d5ead6df0859b0cc0056827c95
- SHA256 bc7d4f75ef30b824795d4a559f1181eb2ba0cf2619a09755f383c26a12eaa15e
- MD5 e3efc6a3a82a75c7b2c4749954e1aa25
- SHA1 8107047a7eeedb6d242018f931b8a0c4c6bf2d97
- SHA512 229ab23d3777e371bcf2758581ec209546d03965a33516cb319b2dcb1dc3e7129bf9f23767c3b4375d88922831a47c75cc907b663856aa5db3ab5d08f1007b24
- SSDEEP 196608:sr2eBNTwhLhPnurHSuhHToAUPNfGU5vXvPk0ax8lLjdIdZ+1N:ssLtnuXhHTodRGkXNaxIfSA3
- TLSH T13E8633B666D15CF4FEBBE6388A234218A37638861721C5D703D447923E376B42E39727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
6b:cf:ef:04:8a:10:5e:09:d9:42:d6:73:cb:79:fa:46:be:76:16:03:ef:59:75:7f:ca:ed:8c:3b:a9:ee:36:f0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=imgui.cc
Chains
May 7, 2026
CN=imgui.cc
Subject
CN=imgui.cc
Serial Number
38:c1:a1:7d:ca:47:81:84:41:a8:f8:a6:72:e0:35:36
Issuer
CN=imgui.cc
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 7, 2026 - May 7, 2027
Subject
CN=QuoVadis Root CA 1 G3,O=QuoVadis Limited,C=BM
Serial Number
78:58:5f:2e:ad:2c:19:4b:e3:37:07:35:34:13:28:b5:96:d4:65:93
Issuer
CN=QuoVadis Root CA 1 G3,O=QuoVadis Limited,C=BM
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 12, 2012 - Jan 12, 2042
Subject
CN=tsaeursa3.digicert.eu,O=QuoVadis Trustlink B.V.,C=NL,2.5.4.97=#130e4e54524e4c2d3330323337343539
Serial Number
06:80:b0:3b:4d:0a:7f:06:4b:54:59:72:6d:d1:60:9e
Issuer
CN=DigiCert QuoVadis G3 TS Europe RSA4096 SHA256 2023 CA1,O=QuoVadis Trustlink B.V.,C=NL,2.5.4.97=#130e4e54524e4c2d3330323337343539
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 17, 2023 - Aug 17, 2026
Subject
CN=DigiCert QuoVadis G3 TS Europe RSA4096 SHA256 2023 CA1,O=QuoVadis Trustlink B.V.,C=NL,2.5.4.97=#130e4e54524e4c2d3330323337343539
Serial Number
22:17:35:a7:6a:da:b5:0a:2a:b8:51:96:d0:c7:0f:00:be:cc:cd:cf
Issuer
CN=QuoVadis Root CA 1 G3,O=QuoVadis Limited,C=BM
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 14, 2023 - Mar 11, 2032
Minor OS version
0
Major OS version
6
Entry point
54464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
TranslateMessage
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
GetMessageW
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
HeapSize
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesExW
HeapReAlloc
WriteConsoleW
SetEndOfFile
FindFirstFileW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
FlushFileBuffers
SetEnvironmentVariableW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
182KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=7, id=257, version=33145,
count=141, id=1, productName=Unmarked objects,
count=27, id=260, version=35225,
count=1, id=258, version=35225,
main.pyc
- SHA256 7013c083435ee1e6e1274441d33953cedb51fc296f48e341eec039fc2aa3e495
- MD5 d9a0c88de117bd6ebd83b46a2cf68c64
- SHA1 3a8f599f15d4c8c85e244825f6d6eea8e9fa8fef
- SHA512 273ac21b92712d89bd05513e3fe07d31698ed6e95d182215f0c11fe8a6340ff502d5ae37e16212433deffea0d977205e0ad371a8c0abea8e06c7bd82945780df
- SSDEEP 96:a93hFSQngRVrrA8JdIFB59/0vItjscRTFi:IG2EvJdIFB3/0vYjsV
- TLSH T14E8182407F83D032EC85B13E80B2239EB260D5B0B109E717B4EF25495F0B4A1AD649DD
- MD5 SHA1 SHA512 SSDEEP TLSH
LICENSE
- SHA256 ef84355ec6fd0ed1c92452b3db587bf10bd14fbad47117e74243536b5be00cd5
- MD5 ca57a706d373c853b368e84dd3c818b5
- SHA1 98ab34a931812a0fb5cf55e58fe5cc9c9be6e8c5
- SHA512 671f8c45b0a077ad53bf880816e86728ec3a86302dd9bba26f35eae80a5260eac61b825f99fb8a7b224e411d719bc46f3ef066055d78202402d09230f7ddcc55
- TLSH T1DE11861E725503A3189257605569ECC5F12BB14A7FAB1584346EF2091326058C9FFC64
- MD5 SHA1 SHA512 TLSH
config.json
- SHA256 a35a730f544b6b2f51b9460fb12adefad59589785893806d36cc1a2db2c24139
- MD5 41fbb5a2895a110925dda93de0a8d7b4
- SHA1 519b74bafea5b1fe278751faf07e4ff1a62d7ec8
- SHA512 bb5071b45bb4bf5962db4328c8bb67c0401616fe6b78fa3b81cfee89f02863fcc0c7017ca181770088fb6d71e5933a748292c9f2ddd269a01f5650d2345e5072
- MD5 SHA1 SHA512
info.txt
- SHA256 a9cfa6c28973e8d3b48df151c03e759a7533daf4cf182967ef31eb175881608d
- MD5 e2d8e0f727575f08e34ed421235d3830
- SHA1 bbe75ebf344874958b68375c34a5a6655f4324ce
- SHA512 3f504ed13ebede9d428057678897dd96976988e925082a3b0b01257e97576fa69223a27e1b1cdfeed922fb4e972d4269cae93ed602236f22fa2ea84d26faadd9
- SSDEEP 96:KYLRNvSpELoIpy5XukAcsLZeTykXZrCZhmIe3H7rs3y3MUzUrN7M0Tfj:KYLRNvSpELoIpy5XukAcsLZeTykJMmL0
- TLSH T196A1C47135D923626EA983070C59C3ADB38A66E39C71508EFDDD021CE391D7137411F9
- MD5 SHA1 SHA512 SSDEEP TLSH