DE_ProPlus2024_x64Bit.iso
- SHA256 cf338d9daa3989cf533de0e6912c2c70fe2f77383e63273a49cd6906c3efbc70
Static task
static1
Behavioral task
behavioral1
Sample
DE_ProPlus2024_x64Bit/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
DE_ProPlus2024_x64Bit/setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
DE_ProPlus2024_x64Bit/start.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target DE_ProPlus2024_x64Bit.iso
- Size 8.3MB
- Sample260722-apdk9agg89
- SHA256 cf338d9daa3989cf533de0e6912c2c70fe2f77383e63273a49cd6906c3efbc70
- MD5 2b1a72177faa37b1f7493be84999cb24
- SHA1 8299d550a4d57d38b4606db9d227296d3ba9ca98
- SHA512 35460b87a318508727e7275468aeb34d3324a3d17af8411bee5210a3425f91f2225811b16a7202dd53e458ef89e73bd1f6a9b9e086a669659d7db2b30e7666c7
- SSDEEP 196608:ntuzFd2Lo2ux/CwQtfSkSW1QG6pXyXC4tUzQB+/D2tzaI6HMaJTtGb:ARL2uEwefhoyZt
- TLSH T16E967B2267E78736F5F20230AE7DFB15D6BABE710931853F7388260D1B719829925723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
DE_ProPlus2024_x64Bit.iso.iso 8.3MB
-
out.iso.iso 8.3MB
-
DE_ProPlus2024_x64Bit/configuration.xml241B
-
DE_ProPlus2024_x64Bit/setup.exe.exe 7.2MB
-
DE_ProPlus2024_x64Bit/start.cmd.cmd .vbs 970B
out.iso
- SHA256 cf338d9daa3989cf533de0e6912c2c70fe2f77383e63273a49cd6906c3efbc70
- MD5 2b1a72177faa37b1f7493be84999cb24
- SHA1 8299d550a4d57d38b4606db9d227296d3ba9ca98
- SHA512 35460b87a318508727e7275468aeb34d3324a3d17af8411bee5210a3425f91f2225811b16a7202dd53e458ef89e73bd1f6a9b9e086a669659d7db2b30e7666c7
- SSDEEP 196608:ntuzFd2Lo2ux/CwQtfSkSW1QG6pXyXC4tUzQB+/D2tzaI6HMaJTtGb:ARL2uEwefhoyZt
- TLSH T16E967B2267E78736F5F20230AE7DFB15D6BABE710931853F7388260D1B719829925723
- MD5 SHA1 SHA512 SSDEEP TLSH
DE_ProPlus2024_x64Bit/configuration.xml
- SHA256 96700e497f86ecc04960af96810e7bd9cef906d350de66d096bee6462418b417
- MD5 6a9755ff0c446ff73727568e9826e0d1
- SHA1 35837b6f135e9be628238ccb02c3ef73d3c40cd1
- SHA512 d2da977ac005783395337a6e969b2dc3bf1b31e5d6a117a223126d7370489aaadb7fbd3cec9770b4cf9eeb6b75754e422aee5339697fccdf2913bfe23d96ac93
- TLSH T107D05EC622952C526136826AB6DA8E85BE31810348111D48F41E269B4F664211343213
- MD5 SHA1 SHA512 TLSH
DE_ProPlus2024_x64Bit/setup.exe
- IMPHASH 5f0b6159dbe9781ee0ca817c45ad2ef0
- SHA256 d6f6fd3fe8eba8ccee31a270ba3fc6b6a7a1de58f4c9b45f40a9f322a84f8b1f
- MD5 13199a06f646dd1e82d9a6e2dfde62e3
- SHA1 3847f7be74be45066c493b7b71c52d50649f8fa0
- SHA512 93f3da9560bdfc21256741c06974dff81b34cafda0d33a7b13c82f6339c6307a37583f7cfaeb00a592546afdcd7f021cfcb4baa9433081dfbe99c822ee0be50f
- SSDEEP 196608:AtuzFd2Lo2ux/CwQtfSkSW1QG6pXyXC4tUzQB+/D2tzaI6HMaJTtGbw:XRL2uEwefhoyZtE
- TLSH T157767B2267E78736F5F20230AE7DFB15D6BABE710931813F7388264D1B719829925723
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
39:71:97:b8:e6:63:5b:3a:8a:83:43:19:da:a8:fa:3e:e4:cd:67:48:95:4d:18:4e:84:a1:b5:e9:d8:ff:6f:e0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 7, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
39:71:97:b8:e6:63:5b:3a:8a:83:43:19:da:a8:fa:3e:e4:cd:67:48:95:4d:18:4e:84:a1:b5:e9:d8:ff:6f:e0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 7, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:56:c9:20:2b:1f:74:32:5d:2d:00:00:00:00:05:56
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:571A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fb:cb:cb:6c:37:67:e5:30:95:00:01:00:00:01:fb
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:a4:cb:e3:56:b8:cb:7f:e4:27:00:00:00:00:03:a4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fd:73:f9:68:5a:cd:0c:61:ed:00:01:00:00:01:fd
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Minor OS version
2
Major OS version
5
Entry point
4045701
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
d:\dbs\el\omr\target\x86\ship\click2run\en-us\SetupODT.pdb
advapi32
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CreateWellKnownSid
CheckTokenMembership
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteTreeW
RegDeleteKeyW
RegGetValueW
RegDeleteValueW
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
RegNotifyChangeKeyValue
RevertToSelf
OpenThreadToken
GetLengthSid
CopySid
InitializeAcl
AddAccessAllowedAce
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
EqualSid
RegEnumValueA
RegDeleteValueA
RegGetValueA
EventWrite
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
CloseServiceHandle
OpenServiceW
QueryServiceStatusEx
QueryServiceConfigW
StartServiceW
ControlService
EnumDependentServicesW
ChangeServiceConfigW
ole32
CoInitialize
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoSetProxyBlanket
CoCreateGuid
StringFromGUID2
CoCreateFreeThreadedMarshaler
IIDFromString
CoInitializeSecurity
CoInitializeEx
CoEnableCallCancellation
CoDisableCallCancellation
CoCancelCall
CoUninitialize
oleaut32
GetErrorInfo
SysFreeString
VariantInit
VariantClear
SetErrorInfo
SysAllocString
SysStringLen
gdi32
CreateFontW
SetBkColor
SetTextColor
DeleteObject
Rectangle
SetDCPenColor
CreatePen
GetTextExtentPoint32W
SelectObject
CreateSolidBrush
SetDCBrushColor
GetTextMetricsW
GetStockObject
GetDeviceCaps
kernel32
RtlUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
EncodePointer
CreateTimerQueueTimer
ExitProcess
GetOEMCP
CloseHandle
GetLastError
GetModuleHandleW
GetProcAddress
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
CompareStringEx
LocalFree
HeapFree
GetProcessHeap
GetCurrentProcess
GetCurrentProcessId
FreeLibrary
CreateThread
GetCurrentThreadId
GetExitCodeThread
SetProcessMitigationPolicy
GetFileAttributesExW
CreateEventExW
WriteFile
DeleteFileW
WideCharToMultiByte
IsWow64Process
GetModuleHandleExW
ExpandEnvironmentStringsW
GlobalFree
MultiByteToWideChar
InitializeCriticalSectionEx
DeleteCriticalSection
DecodePointer
CreateMutexW
GetNativeSystemInfo
VerSetConditionMask
VerifyVersionInfoW
GetUserDefaultLocaleName
FlsFree
FlsAlloc
AttachConsole
AllocConsole
GetStdHandle
WriteConsoleW
FreeConsole
LocaleNameToLCID
FindClose
UnmapViewOfFile
CreateFileA
GetFileSize
CreateFileMappingW
MapViewOfFile
Sleep
GetStringTypeExW
GetUserDefaultLCID
LoadLibraryA
LCMapStringW
FormatMessageA
RaiseException
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
OpenProcess
GetExitCodeProcess
GetProcessTimes
GetTickCount64
GetSystemTimeAsFileTime
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
K32GetModuleFileNameExW
CreateProcessW
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
GlobalMemoryStatusEx
GetVersionExW
IsValidCodePage
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetCPInfoExW
GetDiskFreeSpaceExW
CreateFileW
DeviceIoControl
SetErrorMode
GetComputerNameW
MulDiv
FormatMessageW
GetLogicalProcessorInformation
GetSystemDirectoryW
HeapAlloc
CreateEventW
SetEvent
WaitForSingleObject
EnumSystemLocalesW
WaitForSingleObjectEx
WaitForMultipleObjectsEx
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
QueryDepthSList
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
RtlCaptureStackBackTrace
TzSpecificLocalTimeToSystemTime
QueryUnbiasedInterruptTime
OpenEventW
ReleaseMutex
CreateMutexExW
OpenMutexW
GetTempPathW
GetLongPathNameW
GetFinalPathNameByHandleW
TlsAlloc
TlsFree
FlsGetValue
TlsGetValue
FlsSetValue
TlsSetValue
ResetEvent
IsDebuggerPresent
FindFirstFileExW
MoveFileExW
FindNextFileW
CreateDirectoryW
SetFileAttributesW
ReadFile
SetFilePointerEx
SetEndOfFile
GetFileSizeEx
FlushFileBuffers
LockFileEx
UnlockFileEx
GetFileInformationByHandleEx
GetCurrentDirectoryW
GetTempFileNameW
CopyFileExW
GetVolumePathNamesForVolumeNameW
SetFileInformationByHandle
WaitForMultipleObjects
K32EnumProcessModulesEx
OpenThread
GetFileType
SetFilePointer
GetOverlappedResult
GetFileAttributesW
GetFileTime
CopyFileW
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalAlloc
SetFileTime
CancelIoEx
GetProcessAffinityMask
CreateWaitableTimerW
SetWaitableTimerEx
CancelWaitableTimer
GetTickCount
InitOnceExecuteOnce
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
QueryFullProcessImageNameW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetThreadIOPendingFlag
GetCurrentThread
GetQueuedCompletionStatus
GetStartupInfoW
CreateMemoryResourceNotification
GetSystemPowerStatus
IsSystemResumeAutomatic
OutputDebugStringW
OpenEventA
CreateEventA
OpenMutexA
CreateMutexA
OpenSemaphoreA
CreateSemaphoreA
OpenFileMappingA
CreateFileMappingA
LocalAlloc
GetLocaleInfoEx
LCIDToLocaleName
LCMapStringEx
IsValidLocale
GetSystemDefaultLCID
ResolveLocaleName
EnumSystemLocalesEx
GetSystemDefaultLocaleName
GetFileAttributesA
LoadLibraryExA
LockResource
GetUserGeoID
GetLocaleInfoW
GetUserPreferredUILanguages
GetACP
GetTimeZoneInformation
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
InitializeCriticalSection
GetFullPathNameA
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
FlushViewOfFile
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
K32GetProcessMemoryInfo
GetPhysicallyInstalledSystemMemory
GetProductInfo
SwitchToThread
InitializeCriticalSectionAndSpinCount
FindFirstFileW
GetThreadLocale
lstrcmpW
ProcessIdToSessionId
GetCommandLineW
SetEnvironmentVariableW
GetPriorityClass
K32EnumProcesses
IsProcessorFeaturePresent
InitOnceComplete
InitOnceBeginInitialize
CreateSymbolicLinkW
DeleteTimerQueueTimer
GetThreadTimes
FreeLibraryAndExitThread
ExitThread
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
RemoveDirectoryW
GetFileInformationByHandle
GetStringTypeW
TryAcquireSRWLockExclusive
CompareStringW
SetStdHandle
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
VirtualQuery
GetLocalTime
ReleaseSemaphore
GetSystemPreferredUILanguages
K32GetProcessImageFileNameW
GetDateFormatW
GetTimeFormatW
GetDriveTypeW
setupapi
SetupIterateCabinetW
gdiplus
GdipDeleteGraphics
GdiplusStartup
GdipCreateFromHDC
GdipDrawImageRectI
GdipLoadImageFromStream
GdipFree
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipCloneImage
GdipAlloc
Name
.text
Size
4.3MB
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
181KB
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
342KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
371KB
Virtual Size
370KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=259, version=30795,
count=216, id=261, version=30795,
count=20, id=260, version=33030,
count=28, id=259, version=33030,
count=7, id=109, version=41204,
count=2, id=125, version=41204,
count=21, id=257, version=30795,
count=47, id=260, version=30795,
count=2, id=262, version=30795,
count=993, id=1, productName=Unmarked objects,
count=151, id=261, version=33030,
count=2404, id=265, version=33141,
count=1, id=255, version=33141,
count=1, id=151,
count=1, id=258, version=33141,
DE_ProPlus2024_x64Bit/start.cmd
- SHA256 34f750db3431233b4e08645bd21b5889450715c4f3d1d408a25c229af00e2e0e
- MD5 31c3041df1b8f5e2a71b47b5558e1ac8
- SHA1 d8664e550afc23d126bf404c8386eaa6182623a3
- SHA512 4685e9d5b36d3289dee6b51de6843798d89b35b068ca3a19df98bf0e94108a416b56f12570025d17c253c77f5714c4b755d5678147da73b0089237806398f24d
- TLSH T1BF1190061C8E8E2322F2D5B0D7122514F66BF3477918C8A4F1A270945DED285DEFFAD8
- MD5 SHA1 SHA512 TLSH