9c5de4772ea707d609e2b403c5d21673a33d1ee973a54c1f0bfc649eb4c9c03e

Sharing

Copy URL Twitter E-mail

General

Target
9c5de4772ea707d609e2b403c5d21673a33d1ee973a54c1f0bfc649eb4c9c03e
Size 2.4MB
Sample260703-eeqv2sbs2w
SHA256 9c5de4772ea707d609e2b403c5d21673a33d1ee973a54c1f0bfc649eb4c9c03e
MD5 82e727389bfdd3419e65318177d445c1
SHA1 cdedfaa3b4ba6d9c1274eba1fc014db41324b7f5
SHA512 20c8218b7f39e8f80f32fd13130487c1254c6a7dcf46a964d66f63570ad39400819e5ca49d63014dafe537e68179936de6306c3c7c0bdf0357c814860c5037f8
SSDEEP 24576:G+GU+3O7w8HJJWBYS+j5jy0w1ntuZbqbaFS5aSVQY5OCaJo+xOiNdZ78ZysUVknN:G+GVO7CBY35xwYui31W5
TLSH
T173B57C07FCF218A6D0AAA230987255927B71BC443F3123D7AAA0B7782FB37D059B5754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
9c5de4772ea707d609e2b403c5d21673a33d1ee973a54c1f0bfc649eb4c9c03e

File Explorer

9c5de4772ea707d609e2b403c5d21673a33d1ee973a54c1f0bfc649eb4c9c03e

.dll 2.4MB

9c5de4772ea707d609e2b403c5d21673a33d1ee973a54c1f0bfc649eb4c9c03e

IMPHASH d203f9672085bd7924a65988545977e0
SHA256 9c5de4772ea707d609e2b403c5d21673a33d1ee973a54c1f0bfc649eb4c9c03e
MD5 82e727389bfdd3419e65318177d445c1
SHA1 cdedfaa3b4ba6d9c1274eba1fc014db41324b7f5
SHA512 20c8218b7f39e8f80f32fd13130487c1254c6a7dcf46a964d66f63570ad39400819e5ca49d63014dafe537e68179936de6306c3c7c0bdf0357c814860c5037f8
SSDEEP 24576:G+GU+3O7w8HJJWBYS+j5jy0w1ntuZbqbaFS5aSVQY5OCaJo+xOiNdZ78ZysUVknN:G+GVO7CBY35xwYui31W5
TLSH
T173B57C07FCF218A6D0AAA230987255927B71BC443F3123D7AAA0B7782FB37D059B5754
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1c:a7:e5:ff:a7:10:c3:18:80:d3:1b:81:40:44:ee:dc:13:e4:45:89:43:33:a3:e2:2e:c7:bf:98:87:1c:2a:ec

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Audio Endpoint Task View,OU=Software Publishing,O=RedGate Code Studio GmbH,L=Portland,ST=OR,C=US

Chains

Jun 16, 2026

CN=Audio Endpoint Task View,OU=Software Publishing,O=RedGate Code Studio GmbH,L=Portland,ST=OR,C=US

PE Signature issue

Digest

7b:2b:51:31:3b:37:2a:26:72:c1:19:dc:b8:aa:a3:3e:96:f7:50:0f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Audio Endpoint Task View,OU=Software Publishing,O=RedGate Code Studio GmbH,L=Portland,ST=OR,C=US

Chains

Jun 16, 2026

CN=Audio Endpoint Task View,OU=Software Publishing,O=RedGate Code Studio GmbH,L=Portland,ST=OR,C=US

Subject

CN=Audio Endpoint Task View,OU=Software Publishing,O=RedGate Code Studio GmbH,L=Portland,ST=OR,C=US

Serial Number

12:07:2b:b4:67:18:20:9a:42:9d:e6:38:a8:2c:4b:43

Issuer

CN=Audio Endpoint Task View,OU=Software Publishing,O=RedGate Code Studio GmbH,L=Portland,ST=OR,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 16, 2026 - Jun 16, 2029

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

4847

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

GetTokenInformation GetUserNameA OpenProcessToken RegCloseKey RegOpenKeyExA

comctl32

InitCommonControlsEx

crypt32

CertCloseStore CertOpenSystemStoreA

dwmapi

DwmIsCompositionEnabled

gdi32

CreateCompatibleDC DeleteDC GetDeviceCaps GetStockObject

imm32

ImmGetDefaultIMEWnd

iphlpapi

GetAdaptersInfo

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CloseHandle CreateEventA CreateIoCompletionPort CreateThread CreateWaitableTimerExW DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsA FreeEnvironmentStringsW FreeLibrary GetComputerNameA GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDriveTypeA GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetErrorMode GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimes GetTempPathA GetThreadContext GetTickCount GlobalMemoryStatus InitializeCriticalSection IsWow64Process K32GetProcessMemoryInfo LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW PostQueuedCompletionStatus QueryPerformanceCounter RaiseFailFastException ResumeThread RtlLookupFunctionEntry RtlVirtualUnwind SearchPathA SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadContext SetWaitableTimer Sleep SuspendThread SwitchToThread TlsAlloc TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WriteConsoleW WriteFile

api-ms-win-crt-heap-l1-1-0

calloc free malloc

api-ms-win-crt-private-l1-1-0

memcpy

api-ms-win-crt-runtime-l1-1-0

_beginthread _errno _execute_onexit_table _exit _initialize_onexit_table _initterm _initterm_e _register_onexit_function abort

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf fwrite

api-ms-win-crt-string-l1-1-0

_stricmp strcmp strlen strncmp

ole32

CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString SysStringLen

powrprof

GetActivePwrScheme

shell32

SHGetFolderPathA

shlwapi

PathFindFileNameA PathIsDirectoryA

user32

GetAsyncKeyState GetCursorPos GetDC GetDesktopWindow GetKeyboardType GetSystemMetrics GetWindowRect MonitorFromPoint ReleaseDC

uxtheme

GetThemeAppProperties IsAppThemed

version

GetFileVersionInfoSizeA

wininet

InternetCloseHandle InternetOpenA

winmm

timeGetTime waveOutGetNumDevs

winspool.drv

EnumPrintersA

ws2_32

WSACleanup WSAStartup

Name

.text

Size

889KB

Virtual Size

889KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9c5de4772ea707d609e2b403c5d21673a33d1ee973a54c1f0bfc649eb4c9c03e

PE Signature issue

PE Signature issue

advapi32

comctl32

crypt32

dwmapi

gdi32

imm32

iphlpapi

kernel32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ole32

oleaut32

powrprof

shell32

shlwapi

user32

uxtheme

version

wininet

winmm

winspool.drv

ws2_32

generic