UsbTreeView_x64.zip
- SHA256 2e2e44eeed022670043967820fbea91a8f13eca6f5ba4f49b4394f5a79b91261
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
UsbTreeView.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
UsbTreeView.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target UsbTreeView_x64.zip
- Size 514KB
- Sample260722-qel3msfa87
- SHA256 2e2e44eeed022670043967820fbea91a8f13eca6f5ba4f49b4394f5a79b91261
- MD5 fecfb9e2c03e21fe0945128b3c9d6584
- SHA1 b0897c9d622c2be30cc0a080c6210a2deedaf9b0
- SHA512 ed205e40cd9fa9150cdbe10d47e8d6b168da703ca4c0ec9f96a8ad778ec31087ce8dadcc1b1765527dd1c20e6bf34036f4e8b3f93a6ff8e5cbeb4ae3a077113f
- SSDEEP 12288:kmzA11gggb3edsTsR24YpU5W+u4W+31+pm1bOq7RMMXAogP0uosiQj:kUA11Ab3YR2gnaY+ybfe6AoU0FQj
- TLSH T195B4239B08C441559AC885A6EC1ECBD014C9ED2E9BD2D6D82081377BF8C70E66DB74DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/UsbTreeView.exe
File Explorer
-
UsbTreeView_x64.zip.zip 514KB
-
UsbTreeView.exe.exe 995KB
UsbTreeView.exe
- IMPHASH 5c197f2d2f6be622d122213f71bd70b8
- SHA256 509d73111e460ed0490dfce95f1a8eed4b4a7b660f3546654b0e7c1a9671c21b
- MD5 0a7546054832e55b01fba6e704b486cb
- SHA1 20f72207abfc75fc013104d85c053a0a481bb692
- SHA512 3628a8723cb073010c293924e03ef3132cc7bf0b67fcfbceace179f66ec1b7f36f376e5fb6f422c908ec2de69b9dad45749b42a27ac889af17fe08344a53dfb0
- SSDEEP 24576:E9pZ3nBD/UuEVDnVJ8A4SkV7Zhxp0+8F9ewA2UO+SDm/nB:Op1xNEl4Se7ZN0+8PnZ+SSp
- TLSH T1A2257D656BA444F4C45FD572CD926663FAB2BC450B20836735ECBD4A2F332A06E39B07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
02:aa:eb:a0:8b:a7:81:bb:96:c4:79:e6:5d:3a:d5:71:51:b5:86:68
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Uwe Sieber,O=www.uwe-sieber.de,1.2.840.113549.1.9.1=#0c126d61696c407577652d7369656265722e6465
Chains
May 17, 2026
CN=Uwe Sieber,O=www.uwe-sieber.de,1.2.840.113549.1.9.1=#0c126d61696c407577652d7369656265722e6465
Subject
CN=Uwe Sieber,O=www.uwe-sieber.de,1.2.840.113549.1.9.1=#0c126d61696c407577652d7369656265722e6465
Serial Number
5b:16:02:a6:5c:10:8c:b5:47:a1:5f:08:9a:33:5c:5b
Issuer
CN=Uwe Sieber,O=www.uwe-sieber.de,1.2.840.113549.1.9.1=#0c126d61696c407577652d7369656265722e6465
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 8, 2011 - Dec 30, 2099
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB
Serial Number
a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 27, 2025 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
2
Major OS version
5
Entry point
399344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
u:\1Source\VC\UsbTreeView472\Release_x64\UsbTreeView.pdb
kernel32
CloseHandle
CreateFileW
GetExitCodeThread
WaitForSingleObject
GetTickCount
lstrcmpW
Sleep
HeapSize
GetProcAddress
GetModuleHandleA
lstrcpyW
FileTimeToSystemTime
lstrcmpiW
GetVolumeNameForVolumeMountPointW
SystemTimeToTzSpecificLocalTime
ExpandEnvironmentStringsW
QueryDosDeviceW
lstrcatW
lstrlenW
GetDriveTypeW
MultiByteToWideChar
GetLastError
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVolumePathNamesForVolumeNameW
lstrcpyA
GetDiskFreeSpaceW
GetVolumeInformationW
DeviceIoControl
SetLastError
CreateThread
DeleteCriticalSection
CreateEventW
GetPrivateProfileIntW
lstrcpynW
SetEvent
ResetEvent
lstrcmpA
lstrcmpiA
ExitProcess
WriteConsoleW
AllocConsole
ReadConsoleOutputCharacterW
GetConsoleScreenBufferInfo
GetStdHandle
WideCharToMultiByte
WriteFile
SetConsoleCursorPosition
WriteConsoleOutputCharacterW
SetConsoleCursorInfo
GetFileType
GetACP
lstrlenA
lstrcatA
GetCurrentProcess
GetCommandLineW
GetFileAttributesW
DeleteFileW
LocalFree
LocalAlloc
ResumeThread
GetFileTime
LoadLibraryA
GetSystemDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryW
WritePrivateProfileStringW
QueryPerformanceFrequency
QueryPerformanceCounter
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
OpenProcess
Process32NextW
ProcessIdToSessionId
Process32FirstW
CreateToolhelp32Snapshot
SetFilePointer
ReadFile
GetFileSize
GetModuleFileNameW
MulDiv
FreeLibrary
GetModuleHandleW
CreateProcessW
FindClose
FindNextFileW
FindFirstFileW
CreateDirectoryW
CopyFileW
GetPrivateProfileStringW
GetDevicePowerState
GetLocaleInfoW
GetCurrentThreadId
SetFilePointerEx
SystemTimeToFileTime
GetSystemTime
TryEnterCriticalSection
lstrcpynA
LoadLibraryExW
GetEnvironmentVariableW
GetVersionExW
GetProcessId
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetPrivateProfileStructW
WritePrivateProfileStructW
HeapFree
HeapAlloc
GlobalMemoryStatusEx
GetUserDefaultLangID
GetLocalTime
SetProcessWorkingSetSize
GetProcessTimes
GetCurrentProcessId
SetUnhandledExceptionFilter
SetErrorMode
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetProcessHeap
GetDiskFreeSpaceExW
DuplicateHandle
GetWindowsDirectoryW
GetStartupInfoW
GetTempPathW
CreateProcessA
FlushFileBuffers
OutputDebugStringA
OutputDebugStringW
RestoreLastError
CreateFileA
SuspendThread
SetFileAttributesW
VirtualFree
VirtualAlloc
RaiseException
Name
.text
Size
456KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
378KB
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
625KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
106KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=129, version=50727,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=466, id=1, productName=Unmarked objects,
count=53, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,