05270a44c96bf8966c842b55cfa2dfed31ff13169836ec8064370ced6427a3bd

Sharing

Copy URL Twitter E-mail

General

Target
05270a44c96bf8966c842b55cfa2dfed31ff13169836ec8064370ced6427a3bd
Size 588KB
Sample260712-hhxpjsdw9l
SHA256 05270a44c96bf8966c842b55cfa2dfed31ff13169836ec8064370ced6427a3bd
MD5 63e444673dd07a97db130068cc19a1c1
SHA1 65860c81f8f6ca28a2b506095d5fbc4f8012302f
SHA512 a18ba0ed7387df6e6da32dd4183f8310b3c6fa60873b344401420cab98c52bea79f401f77cd567880af9a61f192b30cd794376fac61533324b1e3cedde037caf
SSDEEP 12288:p7MuV8PscSDJmHa6evVDl7ag/Lw7EuxpOipltr4y:pwuV8Etia6evVDJQYCltEy
TLSH
T18ED47C0B66949E07EBE90BB4E999FF7183367FED3B1B96B32070798A75345C05813422
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
05270a44c96bf8966c842b55cfa2dfed31ff13169836ec8064370ced6427a3bd

File Explorer

05270a44c96bf8966c842b55cfa2dfed31ff13169836ec8064370ced6427a3bd

.exe 588KB

05270a44c96bf8966c842b55cfa2dfed31ff13169836ec8064370ced6427a3bd

IMPHASH a610a51f8c953b29fbf245268fe9a654
SHA256 05270a44c96bf8966c842b55cfa2dfed31ff13169836ec8064370ced6427a3bd
MD5 63e444673dd07a97db130068cc19a1c1
SHA1 65860c81f8f6ca28a2b506095d5fbc4f8012302f
SHA512 a18ba0ed7387df6e6da32dd4183f8310b3c6fa60873b344401420cab98c52bea79f401f77cd567880af9a61f192b30cd794376fac61533324b1e3cedde037caf
SSDEEP 12288:p7MuV8PscSDJmHa6evVDl7ag/Lw7EuxpOipltr4y:pwuV8Etia6evVDJQYCltEy
TLSH
T18ED47C0B66949E07EBE90BB4E999FF7183367FED3B1B96B32070798A75345C05813422
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

6e:ae:2b:dc:1c:1c:96:fc:d1:1f:2c:49:6e:ce:c3:b9:5a:b3:35:b2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=camtocdo.vn,O=2sgamer,L=HN,ST=HN,C=VN

Chains

Jun 23, 2026

CN=camtocdo.vn,O=2sgamer,L=HN,ST=HN,C=VN

Subject

CN=camtocdo.vn,O=2sgamer,L=HN,ST=HN,C=VN

Serial Number

5d:b4:f0:fc:0a:a5:37:10:51:e9:6b:56:d2:06:1b:ae:bb:38:2b:7f

Issuer

CN=camtocdo.vn,O=2sgamer,L=HN,ST=HN,C=VN

Revocation Status

Not revoked

Timespan

Jun 23, 2026 - Jun 20, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

15807

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WideCharToMultiByte CreateFileMappingW MapViewOfFile CreateToolhelp32Snapshot GetPrivateProfileStringW Process32NextW lstrcatW Process32FirstW GetModuleHandleW lstrcpyW WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapSize GetStringTypeW SetStdHandle GetCurrentProcessId GetFileType GetProcessHeap LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo CloseHandle lstrcpyA SetEvent MultiByteToWideChar CreateEventW UnmapViewOfFile TerminateProcess GetCommandLineW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapAlloc HeapFree HeapReAlloc WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess LoadLibraryExW GetProcAddress DecodePointer FreeLibrary TlsFree UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue

user32

SystemParametersInfoW LoadIconW TranslateMessage wsprintfW UpdateWindow InvalidateRect PostQuitMessage LoadImageW BeginPaint EndPaint LoadCursorW TranslateAcceleratorW EndDialog MapWindowPoints LoadBitmapW GetClientRect DialogBoxParamW GetMessageW DefWindowProcW DestroyWindow MessageBoxW CreateWindowExW SendMessageW RegisterClassExW LoadAcceleratorsW LoadStringW wsprintfA ShowWindow DispatchMessageW MessageBoxA DrawTextExW

gdi32

SetBkMode BitBlt SelectObject CreateCompatibleDC GetStockObject DeleteDC SetTextColor SetBkColor DeleteObject

shell32

CommandLineToArgvW ShellExecuteExW SHGetSpecialFolderPathA

shlwapi

StrChrW PathFileExistsW

ws2_32

htonl ntohl htons recv connect ntohs socket send WSAStartup WSAAsyncSelect WSACleanup closesocket

Sharing

General

Malware Config

Signatures

File Explorer

05270a44c96bf8966c842b55cfa2dfed31ff13169836ec8064370ced6427a3bd

PE Signature issue

kernel32

user32

gdi32

shell32

shlwapi

ws2_32

generic