ed31c3fbe8b164eb0525f78c8e4453654f6350bb5fb4581adddaeb671bea2cc4.bin
- SHA256 ed31c3fbe8b164eb0525f78c8e4453654f6350bb5fb4581adddaeb671bea2cc4
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecurityHealth.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecurityHealth.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target ed31c3fbe8b164eb0525f78c8e4453654f6350bb5fb4581adddaeb671bea2cc4.bin
- Size 8KB
- Sample260629-mtkxcaa15v
- SHA256 ed31c3fbe8b164eb0525f78c8e4453654f6350bb5fb4581adddaeb671bea2cc4
- MD5 44beefed3dd50f7072ea20018f3869fd
- SHA1 fbc4396655c9ed9c277776b2874e584627a933ce
- SHA512 f02271725e62f07c514dc516fae738ad7f8fb09b9d95d8f7a47260403b54eca89582f56579f17963ad71ecea65f0d07b14d220d064717e485778e201b26250e5
- SSDEEP 192:yrF0JQRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+kf:K0QRm/wksuQJ/g6dI+kf
- TLSH T193129E0EC7C84CC2D1EFF1755AA0C155C967EAC446D700091AFC63D9BB82EFB9625670
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/SecurityHealth.exe
File Explorer
-
ed31c3fbe8b164eb0525f78c8e4453654f6350bb5fb4581adddaeb671bea2cc4.bin.zip 8KB
-
Client32.ini768B
-
NSM.LIC251B
-
SecurityHealth.exe.exe 33KB
Client32.ini
- SHA256 fa197b46ab75041251eebf63f2fc37294fb9598ea0c7c6d7e58eb6e277f97af2
- MD5 be68ff6f01b7f9cf112d917404aca616
- SHA1 f6a69e5a85c12905f9ab0c4f495159eca14cf8d3
- SHA512 39781a05d3baa3b00d6be91f9cf074eaee59b1aa41e5706828b6e8dbea38a3fdc23db0a46f081227a5c5faf537cf3a26bc32c9e6e8c44cffad427729658fe83e
- TLSH T18F0120036B4AAC4F108BF155E6F402C03FC34441D10EBD2257252D0F5E328A984AF8DC
- MD5 SHA1 SHA512 TLSH
NSM.LIC
- SHA256 53b4a9603905e7838842694a90549362d9ec25b6d22e1c4f3d6c14e040c7a76c
- MD5 2ca7ac695c6b75bc547caad20bc74fea
- SHA1 bcfef09ce64cfa2085598cf897e362ff4f57dd6c
- SHA512 6ac3b8b7ad351c44270e6192dac1edeb585d75abab2ad4800b3920c41bb71482e43a0dab2bb8a9f6df45088acb0c690c12a1eab3b759de0792d4ed93ce600ed2
- TLSH T18ED02BC981236237478201617BA0445E828891658218299CB59D126718B55341E8D06C
- MD5 SHA1 SHA512 TLSH
SecurityHealth.exe
- IMPHASH 78ed70ebeb178ed1bae5921d2ed514bc
- SHA256 275e5b085534f64313b50cbdcb08ecd59c57d21c96bb937f140ee92a3d27f792
- MD5 5a24676210bd317520fe30d048c9a106
- SHA1 067ddd3fdd5451c2f5bf43b4b316f2165c6c4470
- SHA512 28118405fa8446fd9d8ac37bc5ba26a8696732fa7c19e41aef3da4d049d23b21da1cc0def0a2fb66e2e4fbb0c0147f042ef5492bb537aba7376ba46ebc8f7648
- SSDEEP 192:JXvg84ZVe9LQTsZ98A2QakMnCaJbZToyowJL/8Qpkqs1I1jw+ebCfaFagU:FvwamdkjgZMYJLu1SmbCSRU
- TLSH T1FAF2D503A254A4A1D8954B30F4D3D2F2DE35FE01EF95468731E97EAB3F5B7A11B2110A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
4c:d8:d4:7e:9b:a2:e2:f7:c4:0a:31:16:fe:7b:94:44
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NetSupport Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=NetSupport,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Chains
Jan 1, 0001
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
CN=NetSupport Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=NetSupport,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB
Serial Number
2e:6f:9f:ff:bb:2a:f5:b9:cb:05:59:84:7d:5e:59:74
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 8, 2009 - Aug 21, 2011
Minor OS version
0
Major OS version
4
Entry point
4128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
pcicl32
_NSMClient32@8
kernel32
GetCommandLineA
ExitProcess
GetModuleHandleA
GetStartupInfoA
Name
.text
Size
4KB
Virtual Size
182B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
230B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=93, version=2179,
count=5, id=1, productName=Unmarked objects,
count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
count=1, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,