933e60031a663557ae30ab6d993ed09e44afd8168f4e671e3ad42aff636b71bd
- SHA256 933e60031a663557ae30ab6d993ed09e44afd8168f4e671e3ad42aff636b71bd
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SmartCardLogonsetupX32(General).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
SmartCardLogonsetupX32(General).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
SmartCardLogonsetupX64(General).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
SmartCardLogonsetupX64(General).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 933e60031a663557ae30ab6d993ed09e44afd8168f4e671e3ad42aff636b71bd
- Size 12.3MB
- Sample260712-szns3set3w
- SHA256 933e60031a663557ae30ab6d993ed09e44afd8168f4e671e3ad42aff636b71bd
- MD5 29b1b49851228f9cc72a2576b6a87007
- SHA1 1e99af3401bd3ca58c2f035b228b04c82038e179
- SHA512 1373f9ccc0a4c44b9934f085b60dcf4a3588b324c705ac8d7c50d222ac69e04eaab119e64e85f6fcfbb68695161ac0899e98095d0750eb76831cbfab932a7d2d
- SSDEEP 393216:Z8il8YNyuuKqCf2OuGw6nWLJlKvLydUDce6dk4OjXvu/kGi54AjZNQ:Z8il8YruVCf2Oux619p2kZm/Ji54AzQ
- TLSH T1E8D63380BB2E9BF6785FBECCEF7A148656DF3C2A125D03670D674B10620929CD31257A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SmartCardLogonsetupX32(General).exe unpack001/SmartCardLogonsetupX64(General).exe
File Explorer
-
933e60031a663557ae30ab6d993ed09e44afd8168f4e671e3ad42aff636b71bd.zip 12.3MB
-
SmartCardLogonsetupX32(General).exe.exe 5.6MB
-
SmartCardLogonsetupX64(General).exe.exe 9.9MB
SmartCardLogonsetupX32(General).exe
- IMPHASH 1ff847646487d56f85778df99ff3728a
- SHA256 371096654bf9e8515ad9d33ee3bd00c425c7b62f1300969c792e45e308f3b95a
- MD5 f05c84aa644b9c65dafd6f40b419fa15
- SHA1 ea4c48c798b7d42788d19d7445259e4b8f60330b
- SHA512 06cd46f05e6e7c2340e6e4aecc8360ea24524e1a3710b51196a48fd6917b5f792da25c5ffa73766389d27df0cecfbc89ec6c11f597a41de0c54e12fad8134f15
- SSDEEP 98304:O06FOznLo0+Dd6uxczWy/JrHMhdpLCx8xewuOCCwLwXTtigLnEWy/JrHMhdRFXVs:O3F6n80W6uG6y/5stLc8NucwEi8y/5su
- TLSH T1AF563351F392C0F1E4AA14F84A354AB64FBB7C31477AC1E35FE169298E243E0973265A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10721
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
_lclose
GetModuleFileNameA
_lread
_llseek
_lopen
_lwrite
_lcreat
CreateDirectoryA
SetCurrentDirectoryA
lstrcatA
FreeLibrary
GetProcAddress
LoadLibraryA
GetDiskFreeSpaceA
GetFileAttributesA
RemoveDirectoryA
DeleteFileA
lstrlenA
GetCurrentDirectoryA
CloseHandle
GetExitCodeProcess
GetLastError
LocalFree
GetCurrentProcess
MoveFileExA
Sleep
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapReAlloc
RtlUnwind
HeapSize
lstrcpyA
GetTempPathA
CompareStringA
IsValidCodePage
GetOEMCP
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
HeapCreate
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
user32
TranslateMessage
DispatchMessageA
PeekMessageA
wsprintfA
LoadCursorA
SetCursor
MessageBoxA
MsgWaitForMultipleObjects
advapi32
GetTokenInformation
OpenProcessToken
shell32
ShellExecuteExA
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=67, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=100, id=1, productName=Unmarked objects,
count=25, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
SmartCardLogonsetupX64(General).exe
- IMPHASH 357b59ff56f808887438b8bd8ad0eaa6
- SHA256 3049f6091d85ea05abc3bc875de1a5ad7fc66bdea6710bc61a674eede06e6e69
- MD5 f3e2b4cfd193ab2623c8ac0c73c1edf3
- SHA1 cd9698759e0c8dea5e92d5cd270e8e39951903b0
- SHA512 73db2567034b0e6175bbec61c30400a60ff3393c950976a7c5557a899addd897dd13d15df280c5c8128be2292cd677eea83bdd19ed15807acd3f67cce88bea9f
- SSDEEP 196608:dxMe4cxhAuE0kncuHatLY8NucwEi8y/5s1zV/w+:decq0kncQaVJNucwEi8Es//d
- TLSH T153A6CF5576F840E9D0BAC139C9928A4BD2F278450B35C7CF40A05AAE1F377E24D2EF66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
11548
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
_lclose
GetModuleFileNameA
_lread
_llseek
_lopen
_lwrite
_lcreat
CreateDirectoryA
SetCurrentDirectoryA
lstrcatA
FreeLibrary
GetProcAddress
LoadLibraryA
GetDiskFreeSpaceA
GetFileAttributesA
RemoveDirectoryA
DeleteFileA
lstrlenA
GetCurrentDirectoryA
CloseHandle
GetExitCodeProcess
GetLastError
LocalFree
GetCurrentProcess
MoveFileExA
Sleep
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapReAlloc
HeapSize
IsValidCodePage
lstrcpyA
GetTempPathA
CompareStringA
GetOEMCP
GetACP
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
RtlUnwindEx
WriteFile
GetStdHandle
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
user32
TranslateMessage
DispatchMessageA
PeekMessageA
wsprintfA
LoadCursorA
SetCursor
MessageBoxA
MsgWaitForMultipleObjects
advapi32
GetTokenInformation
OpenProcessToken
shell32
ShellExecuteExA
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
990B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=63, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=100, id=1, productName=Unmarked objects,
count=25, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,