SysTools.Pen.Drive.Recovery.15.0.0.0.x86.zip
- SHA256 ae6b1e2550de096fdd6dc5f0abfd805dc1cc45d1c64761b3f14acbf3b87ab3fc
Behavioral task
behavioral1
Sample
SysTools.Pen.Drive.Recovery.15.0.0.0.x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target SysTools.Pen.Drive.Recovery.15.0.0.0.x86.zip
- Size 27.9MB
- Sample260710-pcfbmsa17p
- SHA256 ae6b1e2550de096fdd6dc5f0abfd805dc1cc45d1c64761b3f14acbf3b87ab3fc
- MD5 9da772ee06e6b1027b4a37b240f997c0
- SHA1 063a84e5bf71de0ac40ec938787c4e7e51b426e3
- SHA512 613c589d857a584e66dd1fe75ee49b6bbd6cc7a38a0c43f8564c5ddb6cf6c8b6c12e5c1e9fa17c6010d4060ee3a675bdc4aa3af669faaffec0b018c23fa6b4c8
- SSDEEP 393216:HlUOjbOcsSyzxE9WcmQP5icZJPvdhk457jv1fC+7nDsW/VeoP2PzyFziyQo:GOjbbsSIxE0cJL1deC9aCdX4zWiho
- TLSH T162573380703C8B7FEC19D931BD76DD4522B98BB2DCC896A34DB827A2DEA4C947117631
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/SysTools.Pen.Drive.Recovery.15.0.0.0.x86.exe - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/SysTools.Pen.Drive.Recovery.15.0.0.0.x86.exe innosetup
File Explorer
-
SysTools.Pen.Drive.Recovery.15.0.0.0.x86.zip.zip 27.9MB
-
SysTools.Pen.Drive.Recovery.15.0.0.0.x86.exe.exe 27.9MB
SysTools.Pen.Drive.Recovery.15.0.0.0.x86.exe
- SHA256 9f93f25e629c484098f3405499a876776ec72ae6238239f7ede47ebae8d63538
- MD5 89ad21ac5a89602a45abd4afedb8e17a
- SHA1 9f7475f6de4f2b2f39360ad7a35f35e49d51e428
- SHA512 6140dafd5ed2b2580c24e66cbeb6d5e21ea6e47c3ae4851ef5dc53ebccf76615610e62eaf9d2ea8741b9ea1098f876fdd3a1f987a1bc0c3e958c756d878f3b31
- SSDEEP 393216:Itw+ntYwE6UJD2Zecmm1jwaxhT93rA0VxZBTJKwfNvWuVfmcvU7vCPX0cI:l+ntFE6+D2gcFTj38CNwcVjuvg0N
- TLSH T163573340717C8B7FEC29DA30BD76D945267A9BB2DCC852A34DAC27A2DFA4C847107631
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Digest
5e:f9:8f:17:be:d9:df:1f:cf:bf:84:3f:24:a2:9d:f7:5b:ed:37:48
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=140327,CN=SysTools Software Pvt. Ltd.,OU=Delhi,O=SysTools Software Pvt. Ltd.,L=New Delhi,ST=Delhi,C=IN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494e
Chains
May 23, 2022
SERIALNUMBER=140327,CN=SysTools Software Pvt. Ltd.,OU=Delhi,O=SysTools Software Pvt. Ltd.,L=New Delhi,ST=Delhi,C=IN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
SERIALNUMBER=140327,CN=SysTools Software Pvt. Ltd.,OU=Delhi,O=SysTools Software Pvt. Ltd.,L=New Delhi,ST=Delhi,C=IN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494e
Serial Number
0a:a0:cb:32:09:19:a3:24:a4:76:d4:54:3a:a7:fd:88
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 5, 2022 - Apr 3, 2025
Minor OS version
0
Major OS version
1
Entry point
40000
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ