XAPOFX1_4_x64.7z
- SHA256 fab75b5791a8958ebaa386e42a470ec06811dcf5565963f3327f92364416690c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
XAPOFX1_4.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
XAPOFX1_4.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target XAPOFX1_4_x64.7z
- Size 32KB
- Sample260722-sml4qagd74
- SHA256 fab75b5791a8958ebaa386e42a470ec06811dcf5565963f3327f92364416690c
- MD5 12855e023e4822f9d0856da6d25add63
- SHA1 e9154dfdf3eee48988fa07d6ec6bba9bd78e2ac7
- SHA512 b4941839b96439d182cad79c96cd16a685a15ac75c81c8b1dded1cccf1a840e6590592976e1a955862d983f15e8cd3d9233063653500d96a847c57e4c419b86f
- SSDEEP 384:tLQaGALkQI+qhmZz4X44su/JnZEXxUxY1Yq8f+slyJSMy5Bn/Nl//oh35CSVtwWY:yapYBdhUu5Zsxr/UMy5B/Net5povLyh6
- TLSH T154E2E1B1BA887785403604B6EDF0A3C13A502BE6BF94E3FDEE65A2DCD57090D7970185
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/XAPOFX1_4.dll
File Explorer
-
XAPOFX1_4_x64.7z.7z 32KB
-
XAPOFX1_4.dll.dll 76KB
XAPOFX1_4.dll
- IMPHASH dae43bcd13a7d4666efa357462bb9496
- SHA256 d42e7e91eafce25550f08a63240e23fbe3ddd278b852e36e4eab05bc42f5ec7d
- MD5 a9724eb3d6cc032d0c4ecaff4ad8c17f
- SHA1 3f951a9eb2d50cdd7a0d2210391e14ce9acacc63
- SHA512 ab7cb86abb44e0989047de945f723fb0c42e7a527d19851dd52847b019b13028280a71b7581b2600d942a0576ca4b33029f589bc08934208d4250c2cab3cbe25
- SSDEEP 1536:XZGrYBQSbWXBjyc2gYb06wgNqrYJZFgiC9514e2:XKYyjyHo6vNqrYPgiC95qX
- TLSH T1D2735A4264FAC6BAF02D3479B5C8B51BE632B5114B2585D703B44665AAA3BC04EFF332
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
d2:45:4c:23:18:9d:70:4c:ae:01:4f:93:26:f3:87:52:ce:66:44:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 4, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:94:2d:00:00:00:00:00:09
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
0
Major OS version
6
Entry point
60484
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XAPOFX1_4.pdb
msvcrt
_amsg_exit
__C_specific_handler
free
_initterm
malloc
_XcptFilter
sqrtf
memset
memcpy
_aligned_free
memcmp
_aligned_malloc
pow
powf
floorf
cos
_vsnprintf
sin
tanf
kernel32
HeapAlloc
GetProcessHeap
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
HeapFree
ole32
CoTaskMemFree
CoTaskMemAlloc
CreateFX
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
426B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=15, id=110, productName=VS2005 build 50727, version=50727,
count=93, id=1, productName=Unmarked objects,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=58, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=18, id=114, version=50727,
count=1, id=126, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,