Full_Unboxing_Process_Inspection_Record_2026_391231.zip
- SHA256 bdd6753d00e4142e3955be014213b0c077fd48accdaf400703e8aa5a76459933
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AppVIsvSubsystems64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
AppVIsvSubsystems64.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
Full_Unboxing_Process_Inspection_Record_2026_391231.pdf.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target Full_Unboxing_Process_Inspection_Record_2026_391231.zip
- Size 72.3MB
- Sample260709-klvepsft9j
- SHA256 bdd6753d00e4142e3955be014213b0c077fd48accdaf400703e8aa5a76459933
- MD5 d11d8912bb9b21dbaec4c7b415ab0c6b
- SHA1 4b88896dd6f564fcee65733b1c085972591c2a3d
- SHA512 8e65247e90d00d36b16a2b2fc04995944356edf09b8827317fa3bcddac9bd9a107bef986c443bb1c662dca8139ee1e9ec2106b830f248c90678424282fb1c0ab
- SSDEEP 1572864:1rLYHdb0/T5BzZrtXcuJdBjYFyTTzwgBlpB8/MmLngTBeK9YT:eF0/99cyFTvwgBe/MOgpiT
- TLSH T1B1F733B2FE8A151BA489AC565B5D5FB706FC42C621FE70F062F64C8CEF9018E146076B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AppVIsvSubsystems64.dll
File Explorer
-
Full_Unboxing_Process_Inspection_Record_2026_391231.zip.zip 72.3MB
-
AppVIsvSubsystems64.dll.dll 101.2MB
-
Full_Unboxing_Process_Inspection_Record_2026_391231.pdf.exe.exe 71.3MB
AppVIsvSubsystems64.dll
- IMPHASH 1ee6ec7d20ae8245a473c76f5e2b8fc5
- SHA256 85a5a329104262896fa9305876b5a2c5f87fd27bc5ea585e46314718989063fc
- MD5 1667ebb6bef9a26d983f9504ae6774a3
- SHA1 ac0ad965289ddeaf1810a50791290b082158ca86
- SHA512 286f5512d39d5b207b8c2b54311e886fa595fa988878ce75209588caeb8195bd2554f62537708b6330a7c7480f5a52a820b9bd2ccae0b58c993a2154fe92bbbc
- SSDEEP 393216:TqO785P5xXgzflI+8hIVIkFEd5JC0FPr4Ap1GWbzS6UlivEZgrA5wpWPFfyqsQS4:G9QPIIOTrU+4icmrAPPFfyzzQipbAOw
- TLSH T1F53819D37FF68547E5B256B49AF3E6444B7AF96025BDB38A0061211F8C61E43ADC0B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
54032
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowsProject549_5B73CBE9.pdb
kernel32
FindFirstFileW
FindNextFileW
GetFileAttributesW
CloseHandle
GetLastError
QueryPerformanceCounter
WaitForSingleObject
Sleep
GetCurrentProcessId
ExitProcess
SwitchToThread
CreateThread
GetCurrentThreadId
SetThreadPriority
ResumeThread
GetLocalTime
FindClose
GetTickCount64
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
DisableThreadLibraryCalls
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
FindResourceW
CopyFileW
WideCharToMultiByte
WriteConsoleW
CreateFileW
CreateDirectoryW
ExpandEnvironmentStringsW
GetTickCount
GetEnvironmentVariableW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
HeapReAlloc
HeapSize
SetStdHandle
SetFilePointerEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
GetStringTypeW
user32
wsprintfW
GetSystemMetrics
LoadStringW
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
shell32
SHGetFolderPathW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
shlwapi
PathIsRelativeW
PathFindExtensionW
APIExportForDetours
CurrentThreadIsVirtualized
DirectFactoryPoint
DynamicPublisherSZbZ
FetchEntryrIRGdo
FetchModuleFuncCnJR
GetContentAccumulatorlBys
IsProcessHooked
LoadPointerArchitecturefZJ
MatchListenerZXj
MigrateTokenInspector
ReadUrlUURmmK
RequestUnhookedFunctionList
RetrievePathContainerVital
StackGdPbdh
UnqueuedFloatAhG
VirtualizeCurrentProcess
VirtualizeCurrentThread
Name
.text
Size
137KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=139, id=261, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=40, id=261, version=35207,
count=13, id=260, version=33145,
count=1, id=262, version=33145,
count=13, id=257, version=33145,
count=127, id=1, productName=Unmarked objects,
count=1, id=261, version=35225,
count=1, id=259, version=35225,
count=1, id=256, version=35225,
count=1, id=255, version=35225,
count=1, id=151,
count=1, id=258, version=35225,
Full_Unboxing_Process_Inspection_Record_2026_391231.pdf.exe
- SHA256 2e05d97ed7bfabea8f7370ba627e0705ec2c0fbf3974b39437e9d95d45d1a76d
- MD5 1fdea279cb8c9217487ac4c86ae9316c
- SHA1 f58f4bc7e421bb2e1117c22a8acf120de388d442
- SHA512 d7cde8a8319bc3d733073b1fe4b87b463bb10b3019cd10dbc18376f364c7c47d6a727be1c1ccc62eb64a7ba06555bd5a72cae06538a25e3c3f8fd441bde05623
- SSDEEP 786432:ZUQ3Mg3mz/GymuUwCVOWNmTkQLHFoZA0ApfQApjE/:n3l3e/1mnwRWNkHLHFoZlApjq
- TLSH T14BF77C4273F941DAE0EAD275866B8237EAB07C95153057BB12A1FB6E2F332509D3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
50:e0:78:70:42:9b:8e:47:34:6b:9c:51:b0:e1:90:b1:bc:18:1e:96:8c:24:bb:51:41:8f:6b:bb:b6:85:38:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 30, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
50:e0:78:70:42:9b:8e:47:34:6b:9c:51:b0:e1:90:b1:bc:18:1e:96:8c:24:bb:51:41:8f:6b:bb:b6:85:38:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 30, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c3:33:ab:2c:1a:f5:42:f2:c8:00:00:00:00:00:c3
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 19, 2025 - Jun 18, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0f:57:9a:47:14:40:e6:46:e6:00:01:00:00:02:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 13, 2025 - Nov 10, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:04:d8:e0:0e:07:97:32:58:98:00:01:00:00:02:04
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Minor OS version
1
Major OS version
6
Entry point
2736336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\dbs\el\omr\Target\x64\ship\postc2r\x-none\excel.pdb
BeginUpgradeASPPModel
DllGetLCID
GetDMCLRRuntime
GetDMCLRRuntimeInAppDomain
LinkASPPModelTable
MdCallBack
MdCallBack12
UpgradeASPPModel
_LPenHelper
Name
.text
Size
53.6MB
Virtual Size
53.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8.5MB
Virtual Size
8.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.8MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
sdmprc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.c2r
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5.3MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
432KB
Virtual Size
431KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35207,
count=6, id=259, version=35207,
count=10, id=260, version=35207,
count=46, id=261, version=35207,
count=2, id=261, version=33136,
count=24, id=260, version=33136,
count=3, id=257, version=33136,
count=8293, id=1, productName=Unmarked objects,
count=5, id=259, version=35214,
count=8462, id=265, version=35214,
count=1, id=256, version=35214,
count=1, id=255, version=35214,
count=2, id=151,
count=1, id=258, version=35214,