Install Resolve 20[.]0b[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Install Resolve 20.0b.exe
Size 2.2MB
Sample260703-chntrah15w
SHA256 5e8404ea21002e6b1690742eb5d31fc7850653c7ad0a2458d111b9ddb5b69fcd
MD5 e1c5c6800591326ee5af8d2e59a22a86
SHA1 13d5c7a4c8437f97cc41280c030f8837b74ed6e5
SHA512 1378c942f03d26367c2f63348ab0d1925e0a896c31ed0e375967acce1e6cbefd75be7d68217f508588c204f61662527cbc6512e7c41a0c7ca3583f6e5ba70485
SSDEEP 49152:sGtlqD2VwASOPxIU6ieBohrYHnB1TeWXhsJ80XHTaigqaLcrudPWlQjl:BG+/rYHndsX/gBL+uwlil
TLSH
T1D8B59D56E3A804F4E8F6C138C856513BEBF1B45A27B09BDB06A4C6650F13BE16E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Install Resolve 20.0b.exe

.exe 2.2MB

Install Resolve 20.0b.exe

IMPHASH f4a4792d62f654b54486ae404c2121ea
SHA256 5e8404ea21002e6b1690742eb5d31fc7850653c7ad0a2458d111b9ddb5b69fcd
MD5 e1c5c6800591326ee5af8d2e59a22a86
SHA1 13d5c7a4c8437f97cc41280c030f8837b74ed6e5
SHA512 1378c942f03d26367c2f63348ab0d1925e0a896c31ed0e375967acce1e6cbefd75be7d68217f508588c204f61662527cbc6512e7c41a0c7ca3583f6e5ba70485
SSDEEP 49152:sGtlqD2VwASOPxIU6ieBohrYHnB1TeWXhsJ80XHTaigqaLcrudPWlQjl:BG+/rYHndsX/gBL+uwlil
TLSH
T1D8B59D56E3A804F4E8F6C138C856513BEBF1B45A27B09BDB06A4C6650F13BE16E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

98:4d:ad:a9:82:11:0d:cc:a4:6b:23:e3:5d:4f:03:5b:5f:86:a3:8d:ef:a9:2c:a1:12:e1:b9:23:ed:41:c8:8e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=098 098 287,CN=Blackmagic Design Pty Ltd.,OU=Blackmagic Design,O=Blackmagic Design Pty Ltd.,L=Port Melbourne,ST=Victoria,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Chains

May 2, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

08:5d:b9:17:cb:ec:1b:a9:51:c7:85:50:42:b9:08:62

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 14, 2024 - Nov 21, 2027

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1456116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oleaut32

SysAllocStringLen VariantClear SysStringLen

user32

SetForegroundWindow AllowSetForegroundWindow MessageBoxW EnumWindows GetWindowThreadProcessId GetProcessWindowStation DestroyWindow ShowWindow EndDialog SetWindowTextW CharUpperW LoadStringW DialogBoxParamW GetDlgItem SetActiveWindow PostMessageW LoadIconW KillTimer SetTimer SendMessageW SetWindowLongPtrW GetWindowLongPtrW GetUserObjectInformationW

shell32

ShellExecuteExW

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

ws2_32

WSACleanup WSAGetLastError recv WSASetLastError closesocket send

bcrypt

BCryptGenRandom

kernel32

LCMapStringW CompareStringW FlsFree FlsGetValue FlsAlloc HeapAlloc HeapReAlloc HeapFree FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetConsoleOutputCP GetFileSizeEx SetFilePointerEx FlushFileBuffers SetStdHandle GetFullPathNameW FlsSetValue PeekNamedPipe GetDriveTypeW SetConsoleCtrlHandler ExitProcess FreeLibraryAndExitThread ExitThread CreateThread EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCommandLineW CloseHandle GetLastError WaitForSingleObject CreateProcessW GetProcessId EnterCriticalSection LeaveCriticalSection DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte FreeLibrary GetModuleFileNameW LoadLibraryExW LoadLibraryW GetStringTypeW FormatMessageW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW RemoveDirectoryW SetFileAttributesW SetFileTime GetTempPathW SetLastError GetCurrentProcessId GetCurrentThreadId GetTickCount GetSystemDirectoryW GetModuleHandleW GetProcAddress FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetModuleHandleA GetFileSize ReadFile SetEndOfFile SetFilePointer WriteFile GlobalMemoryStatusEx GetSystemInfo GetProcessAffinityMask GetStdHandle GetFileInformationByHandle WaitForMultipleObjects Sleep VirtualAlloc VirtualFree GetVersionExW lstrcatW lstrlenW InitializeCriticalSection SetEvent ResetEvent CreateEventW GetEnvironmentVariableW GetFileType InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW RtlVirtualUnwind DeleteFiber QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread LoadLibraryA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetProcessHeap GetTimeZoneInformation HeapSize WriteConsoleW LocalFree GetCurrentProcess

advapi32

ReportEventW DeregisterEventSource CryptAcquireContextW CryptReleaseContext CryptDestroyKey RegisterEventSourceW CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW

Sharing

General

Malware Config

Signatures

File Explorer

Install Resolve 20.0b.exe

oleaut32

user32

shell32

crypt32

ws2_32

bcrypt

kernel32

advapi32

generic