file_5440af2d1265426ea52fd0a0dd6cc989_2026-07-10_09_52_05_831000.zip
- SHA256 5bd1f9fb35888872af547e0f7ae95eb73bbe534cbaffb1ed9071b616d6def664
Behavioral task
behavioral1
Sample
entry_1_0/Comtls64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
entry_1_0/Comtls64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target file_5440af2d1265426ea52fd0a0dd6cc989_2026-07-10_09_52_05_831000.zip
- Size 3.0MB
- Sample260710-peg81sbs7q
- SHA256 5bd1f9fb35888872af547e0f7ae95eb73bbe534cbaffb1ed9071b616d6def664
- MD5 95d8ea83d1ee41226f097ec23cfed98a
- SHA1 1443a12877c7d4d7b5e6685eb675362d0e358788
- SHA512 54980cdd5a48540e6ba369aa8b7931db592e01b6c9a709f60fbd8fe1f6d1a85f89f2d8094dde81e63049b62a000b4482ec4c5dfe54e00de53e9ecb70419de201
- SSDEEP 98304:p2DfRnlyI6dvdOCaWpiIcGCumDd8Dypd/XhLT:p27XyzV3viIcnHDBJ3
- TLSH T182E5336118AACD673B1C59B6329F2ABEF8B5C20162742F0EF06E9075324D27D11E4E5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/entry_1_0/Comtls64.dll themida
File Explorer
-
file_5440af2d1265426ea52fd0a0dd6cc989_2026-07-10_09_52_05_831000.zip.zip 3.0MB
-
entry_1_0/Comtls64.dll.dll 3.0MB
-
manifest.json362B
-
script_output.txt362B
-
stdout.txt625B
entry_1_0/Comtls64.dll
- SHA256 9a5b80ec90fce963f8cbb88f1c3154785c82648dff9721362798bba816aeb287
- MD5 1f0c0810ba17e101d531c1a10d25b631
- SHA1 7c77a59039cb21d072b66570c0b35606039508fc
- SHA512 f0bca0d6a23adc91d606f510be31a5a972767dd999b905169cf326e2927ce49118338b8a943bafeeb0794992b742be242ca47ad416ff72c9a910d102819a08da
- SSDEEP 98304:agptypgPpOWh3UmNDW9Mg9m1ADCJkJjEogS:bptxB7h3UmNDW9JyAeyjEogS
- TLSH T1B4E533B176C1B9D1E60A24BBF04774A3E67B1BF44FD898ED301F60E12602759825B74B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3f:e8:87:b6:b3:fe:e2:13:ba:78:5d:a6:8e:bb:26:e3:43:6c:1f:ab:88:f3:8f:c7:0f:5a:c1:a6:7e:7a:7c:6e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=1027809233374,CN=OOO CTM,O=OOO CTM,L=Saint Petersburg,ST=Saint Petersburg,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13105361696e742050657465727362757267,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Sep 3, 2025
SERIALNUMBER=1027809233374,CN=OOO CTM,O=OOO CTM,L=Saint Petersburg,ST=Saint Petersburg,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13105361696e742050657465727362757267,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
SERIALNUMBER=1027809233374,CN=OOO CTM,O=OOO CTM,L=Saint Petersburg,ST=Saint Petersburg,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13105361696e742050657465727362757267,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
77:be:93:2c:e6:92:3f:f9:b6:7d:7d:5f
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 18, 2024 - Sep 19, 2027
Minor OS version
0
Major OS version
6
Entry point
4997208
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
RegInterface
Name
Size
130KB
Virtual Size
242KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
82KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
9KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=29395,
count=166, id=261, version=29395,
count=22, id=260, version=29395,
count=20, id=259, version=34321,
count=16, id=260, version=34321,
count=75, id=261, version=34321,
count=11, id=257, version=29395,
count=133, id=1, productName=Unmarked objects,
count=2, id=265, version=34810,
count=1, id=256, version=34810,
count=1, id=255, version=34810,
count=1, id=151,
count=1, id=258, version=34810,
manifest.json
- SHA256 fd83127be1f8e001ad616ee9f4f6f721ed4cab7f58cab023c2b22f39541079c9
- MD5 993b419c1c81aa965f5c0e4da3b31c9a
- SHA1 8440ed3d921f8bab4dab1fc779745224d53fb73a
- SHA512 84daf99521ffa5a230e67547e26b7b1653d3ef5001d5d44265d893b0898ce4dfd3abe85c9b71d22ef449d85e5d39da0801c1fb071fddb232597f008f59d5441d
- TLSH T161E0DF399BA3888B7598B6803A091CE3025294A913A69A3612CC9367C3C4A7F246A470
- MD5 SHA1 SHA512 TLSH
script_output.txt
- SHA256 fd83127be1f8e001ad616ee9f4f6f721ed4cab7f58cab023c2b22f39541079c9
- MD5 993b419c1c81aa965f5c0e4da3b31c9a
- SHA1 8440ed3d921f8bab4dab1fc779745224d53fb73a
- SHA512 84daf99521ffa5a230e67547e26b7b1653d3ef5001d5d44265d893b0898ce4dfd3abe85c9b71d22ef449d85e5d39da0801c1fb071fddb232597f008f59d5441d
- TLSH T161E0DF399BA3888B7598B6803A091CE3025294A913A69A3612CC9367C3C4A7F246A470
- MD5 SHA1 SHA512 TLSH
stdout.txt
- SHA256 89098192482f125d09568c5c4842bd1413788a0029e7b7149063384db92cff02
- MD5 41ccd1ef3800ec907aff5ac2e9cf44e5
- SHA1 ad3c52580ce4b4a28094927b6d0816eab1b07519
- SHA512 52bb0d456262b62fb1423a976ba4286144345702a05e1ac66c8d5818eca4668cd04de414a83e427f54406a34698b79650a3f806cd6902975e1d4644f68e74610
- TLSH T1FAF049250D666715570600C5067CD657D7D0E51822EDC6A8F8FD428ADD82FEEC2F8A24
- MD5 SHA1 SHA512 TLSH