standalone_compact_extract_2.0.0.zip
- SHA256 66f22df1d4173e95c658f0123e093c335758c916935c1d90e868a4fd8e218934
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OxyPlot.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
OxyPlot.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
UpdateScheduler.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
UpdateScheduler.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target standalone_compact_extract_2.0.0.zip
- Size 9.1MB
- Sample260704-pgdnlsa15m
- SHA256 66f22df1d4173e95c658f0123e093c335758c916935c1d90e868a4fd8e218934
- MD5 f1faeb051f3462549b1744e076174553
- SHA1 e22cf53aeec8296f51f59a1d89e1b74e5afb638c
- SHA512 723acf1109e74cebc161079e27955f1b53187af98b2065cf38b231c7de781a8a9d2fbe8a049ec81f3501874164f1aba628f35a3400fa525113f60599216b7eaf
- SSDEEP 196608:cSkykgUXY+GoVSz8EJ9/+D1ZgqYpBKpTgJkOxv/O/LGFF+Alo5Wn9:cSdkgUXY+GiYXJ9mJZc/gTWNvIaFYAld
- TLSH T1C1A633A16FD8F70822CCD9EC67B259F842259095CFE6DEFB620409DA4C3E9E13D960D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/OxyPlot.dll
File Explorer
-
standalone_compact_extract_2.0.0.zip.zip 9.1MB
-
OxyPlot.dll.dll 12.0MB
-
UpdateScheduler.csproj.xml 468B
-
UpdateScheduler.exe.exe 252KB
OxyPlot.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cd1e80b51ded29054de68c37d950d19d75250bc1e855699fccf1639706c4982d
- MD5 dfe6262701548383a45285a52eb9dee1
- SHA1 2f001327f7a81041f50de8a455112358d2f003c6
- SHA512 f60bd95a34512a628717265ae1a6b50115ca73df791a1ae1c1d777bfed3810190ba5d3cdc1bd408d29bdcf590a5b446a311a6117ef592a52c224df89111abcfb
- SSDEEP 393216:LPD6hr1nNa51oCc+AqhEx2xvZQ29gDPH/:LPDSc51AaEx2xO29g7
- TLSH T164C6CD32721D2EF683ABB1BBF09244168359CC35AB5FC3453B4A9F7B6CEA5008D46356
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12603566
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12.0MB
Virtual Size
12.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UpdateScheduler.csproj
- SHA256 7d148d609ba351810f09ca68b8083455d1d4b1a82030f76cef8f025c533deb9d
- MD5 3e68438e03d5e928dc74e322118f5b81
- SHA1 78cb6e1e34fee3a009724c90d1ec8f80bd397088
- SHA512 55bd632a7e473f263f8866601da8a8e63124ed36b1371450e6bdda3e706e72edf1aa824034dcec07a2f84d85a9ca364b4a3f6fa00d1a4cc9fe3fdb62fa3a1d50
- TLSH T124F0271020C1BD91B3704B327BB15A81A7AAD29310A14C9CFA55793B43330D800277B6
- MD5 SHA1 SHA512 TLSH
UpdateScheduler.exe
- SHA256 b25346ac48099606de4bd7f72a4e76876587aadf5734eaa83b81b9e79437acab
- MD5 3aeea43956ff3f7ecf57adf4c9524241
- SHA1 ee70d325fc52480b278d37a10c13156b325f8285
- SHA512 ba30e86d28dea8ad5be47455ca35582e8ced5f305db56718b906202feddd9aa3f31775ec0e9f433265942af6ee0d343ed6fbc5dff87b0e0781767b56d9808c9f
- SSDEEP 3072:ca0t0yH5wC7TwqPNi/X77NLpj/Wnqv7w2XpFU4rwOeVubZSpf02RFi3hrnL:L0ny8cKw/X7Rpqn+RXf2p02bi3xL
- TLSH T1DF446A0163ED0615F6FF1AB4B8B059158B76F957E822D75E388CA1AC0F73B40EA60763
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2c:57:5f:8c:1e:be:de:91:ec:39:1c:cc:e3:10:8f:92:ca:89:22:fc:4c:80:c4:68:94:db:93:8c:b6:21:78:f2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 3, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
02:8d:75:cb:5b:57:61:ea:38:3b:98:1f:6f:01:08:a3:de:df:a5:50
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 3, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3E7A-E359-A25D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:46:32:e2:e1:e5:ca:2c:4e:1f:00:00:00:00:01:46
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 13, 2019 - Feb 11, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:08:7d:ff:45:59:70:45:fa:84:00:00:00:00:01:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\amd64\MSBuild.pdb
Name
.text
Size
222KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ