0f08c77cf2c728fe7bd7848d7adc102798653635219fb670e56748bbe25a27c3

General

Target
0f08c77cf2c728fe7bd7848d7adc102798653635219fb670e56748bbe25a27c3
Size 12.7MB
Sample260722-r211rafh42
SHA256 0f08c77cf2c728fe7bd7848d7adc102798653635219fb670e56748bbe25a27c3
MD5 6b4e8ea3697c04e44a34e922dfc02dae
SHA1 8c7815e2ea92c46aa2368af2394f05da01c62943
SHA512 40d34ce2e18cddc3b90415ab83640461e3e69da3166fffd1ccdb04eef56ae25b00970492cd5b2f21ac87c623004be5a37c21563801a9e8346b6e83bc973f7942
SSDEEP 196608:Boxk9Ae3B/zWmUoXQeKDAGJYyk6KZttAtYn/ZGyvfF:epex/zWmUbL/dJctt6Yn/ZGyXF
TLSH
T184D69CE621D692FDC423C47A8603EA6BCAAF703A0736C6D3509096175E27CD17E3AF15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
0f08c77cf2c728fe7bd7848d7adc102798653635219fb670e56748bbe25a27c3

File Explorer

0f08c77cf2c728fe7bd7848d7adc102798653635219fb670e56748bbe25a27c3

.exe 12.7MB

0f08c77cf2c728fe7bd7848d7adc102798653635219fb670e56748bbe25a27c3

IMPHASH baa93d47220682c04d92f7797d9224ce
SHA256 0f08c77cf2c728fe7bd7848d7adc102798653635219fb670e56748bbe25a27c3
MD5 6b4e8ea3697c04e44a34e922dfc02dae
SHA1 8c7815e2ea92c46aa2368af2394f05da01c62943
SHA512 40d34ce2e18cddc3b90415ab83640461e3e69da3166fffd1ccdb04eef56ae25b00970492cd5b2f21ac87c623004be5a37c21563801a9e8346b6e83bc973f7942
SSDEEP 196608:Boxk9Ae3B/zWmUoXQeKDAGJYyk6KZttAtYn/ZGyvfF:epex/zWmUbL/dJctt6Yn/ZGyXF
TLSH
T184D69CE621D692FDC423C47A8603EA6BCAAF703A0736C6D3509096175E27CD17E3AF15
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

13:89:f1:a5:50:d7:0c:f9:a7:f0:2f:4b:13:8b:6e:02:15:c1:6d:e1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=3D SYSTEMS\, INC.,O=3D SYSTEMS\, INC.,L=Rock Hill,ST=South Carolina,C=US

Chains

Jul 17, 2026

CN=3D SYSTEMS\, INC.,O=3D SYSTEMS\, INC.,L=Rock Hill,ST=South Carolina,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Minor OS version

0

Major OS version

6

Entry point

13205504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

atqkzide

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

tyrmfgzm

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

120KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=21, id=241, version=40116,

count=214, id=243, version=40116,

count=32, id=242, version=40116,

count=11, id=206, version=65501,

count=1, id=207, version=65501,

count=5, id=199, version=41118,

count=36, id=260, version=26706,

count=10, id=259, version=26706,

count=442, id=261, version=26706,

count=1, id=259, version=27034,

count=1, id=110, productName=VS2005 build 50727, version=50727,

count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=55, id=109, productName=VS2005 build 50727, version=50727,

count=2, id=257, productName=VS2017 v15.9.5 build 27026, version=27026,

count=49, id=261, version=27034,

count=44, id=203, version=65501,

count=1030, id=1, productName=Unmarked objects,

count=3, id=208, version=65501,

count=23, id=265, version=27034,

count=1, id=255, version=27034,

count=1, id=151,

count=1, id=258, version=27034,

0f08c77cf2c728fe7bd7848d7adc102798653635219fb670e56748bbe25a27c3

PE Signature issue

kernel32

comctl32

generic

Sharing

General

Malware Config

Signatures

File Explorer

0f08c77cf2c728fe7bd7848d7adc102798653635219fb670e56748bbe25a27c3

PE Signature issue

kernel32

comctl32

generic