f3c1508784a8783d81099ed498d527c0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
f3c1508784a8783d81099ed498d527c0.exe
Size 1.6MB
Sample260709-hmfa3aex3y
SHA256 f51361ec07e2cc4833c58d706b6da8d4d4982ce8dd60ac89a78ca56c9e553680
MD5 f3c1508784a8783d81099ed498d527c0
SHA1 e3c1a54775ec27c4fcd66c047dc06573f9ec9d38
SHA512 6a0adb8bcddf85d01f5644caf7b4aaf766daa3b22a97eb1977ce11af9375f5df84bde31fc1afeb8dd0dabc47f25d8a876aafc9f31e004bc370e2ad1a54368abb
SSDEEP 24576:OJywYd9ywNiYG/LRjH3h4O9Mv0BeV+PJf7gY0cOAEINAlrkSuGVqubD/IahliVl1:OXYd1fOaO6uhf7NNu2
TLSH
T12E752393E905ED94D93D86BCA0278E5157B6BE3040584E5EB7A8F03B3F767423123E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
f3c1508784a8783d81099ed498d527c0.exe

File Explorer

f3c1508784a8783d81099ed498d527c0.exe

.exe 1.6MB

f3c1508784a8783d81099ed498d527c0.exe

IMPHASH 66f1d669875f10b3526b656a280f3f56
SHA256 f51361ec07e2cc4833c58d706b6da8d4d4982ce8dd60ac89a78ca56c9e553680
MD5 f3c1508784a8783d81099ed498d527c0
SHA1 e3c1a54775ec27c4fcd66c047dc06573f9ec9d38
SHA512 6a0adb8bcddf85d01f5644caf7b4aaf766daa3b22a97eb1977ce11af9375f5df84bde31fc1afeb8dd0dabc47f25d8a876aafc9f31e004bc370e2ad1a54368abb
SSDEEP 24576:OJywYd9ywNiYG/LRjH3h4O9Mv0BeV+PJf7gY0cOAEINAlrkSuGVqubD/IahliVl1:OXYd1fOaO6uhf7NNu2
TLSH
T12E752393E905ED94D93D86BCA0278E5157B6BE3040584E5EB7A8F03B3F767423123E1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

49:ff:14:da:79:4e:ac:ff:91:ee:bf:ee:cf:51:c5:b7:14:de:26:ed:0c:fa:fc:f8:28:64:08:cf:f9:14:21:9d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=NOTEPAD\+\+,O=NOTEPAD\+\+,L=Paris,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

Chains

Oct 20, 2025

CN=NOTEPAD\+\+,O=NOTEPAD\+\+,L=Paris,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

cc:ad:b3:98:1a:e7:60:8e:ff:fc:be:68:4a:62:9a:b5:05:4d:b9:eb:f0:83:49:a6:24:8f:b7:66:65:ff:6a:24:be:15:b9:b8:0b:31:d1:93:59:53:92:14:5e:96:c7:d7:27:96:04:7e:12:29:7f:83:2c:d7:d4:75:97:b9:e4:f2

Digest Algorithm

sha512

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

Chains

Oct 20, 2025

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

Subject

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

Serial Number

38:d0:77:32:d5:e4:a2:62:8a:30:3d:47:90:35:c1:d1

Issuer

CN=Notepad\+\+ Root Certificate,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 8, 2025 - Jul 8, 2028

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:491A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4e:a3:c6:0e:3e:31:c3:74:27:00:00:00:00:00:4e

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 27, 2025 - Feb 26, 2026

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=NOTEPAD\+\+,O=NOTEPAD\+\+,L=Paris,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

Serial Number

05:f0:d8:13:d6:a6:f0:04:57:5a:20:99

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2025 - Oct 9, 2028

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:00:0b:20:05:b3:94:07:62:db:3e:36:79:94:9b:a9

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 11, 2025 - Dec 10, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

7056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CheckRemoteDebuggerPresent CloseHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject CreateMutexW Sleep GetCurrentProcess VirtualAlloc VirtualFree GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryA lstrcatW lstrlenW MoveFileExW MultiByteToWideChar GetEnvironmentVariableW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetTempPathW HeapFree GetProcessHeap GlobalMemoryStatusEx GetSystemInfo GetTickCount64 FreeLibrary GetModuleHandleW LoadLibraryW lstrcmpiW GetComputerNameW CreateDirectoryW GetFileAttributesW lstrcpyW GetSystemDirectoryW GetVolumeInformationW GetCurrentProcessId GetCurrentThreadId GetWindowsDirectoryW GetVersionExW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext IsDebuggerPresent ReadFile WriteFile GetTempFileNameW GetFileSize DeleteFileW CreateFileW ExpandEnvironmentStringsW HeapAlloc SetStdHandle IsProcessorFeaturePresent

user32

GetClassNameW GetDesktopWindow GetCaretBlinkTime GetWindowRect SystemParametersInfoW GetDoubleClickTime GetSystemMetrics GetCursorPos MessageBoxW GetAsyncKeyState wsprintfW GetForegroundWindow

shell32

SHGetFolderPathW

advapi32

RegCloseKey GetUserNameW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegOpenKeyExW

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

f3c1508784a8783d81099ed498d527c0.exe

PE Signature issue

PE Signature issue

kernel32

user32

shell32

advapi32

comctl32

generic