e24f02320e7993d3a06ede68424d082e03fe11e98f26cba220664daf4aab73fa

General

Target
e24f02320e7993d3a06ede68424d082e03fe11e98f26cba220664daf4aab73fa
Size 282KB
Sample260722-srcqvatybv
SHA256 e24f02320e7993d3a06ede68424d082e03fe11e98f26cba220664daf4aab73fa
MD5 0e7f48c5e6165c8d689b65d81d39759f
SHA1 b4580adbeeb9a815c19f465acb9b51923cef87c8
SHA512 674b70a86e8b00607a5f01870de6c0230f73d2ac3b08b8f61bbd2f0450f99d8b89cf9a5b4e15ea9f80b13a095f7b8fbb9906c50342d7a966b5c54c50ada7bf1d
SSDEEP 3072:xXKht/WeExQ08VHjlBycxEvD/fzvTMGfM9a5dQws6lO7i/tHxqisRKGxwKhUl5K1:JKht/WeHjovTbvAG0977idF1cr5v
TLSH
T101548C15B7A50CF9ED67853DC9424906EA72BC5647A0EACF03A04AA71F237E05F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

e24f02320e7993d3a06ede68424d082e03fe11e98f26cba220664daf4aab73fa

.exe 282KB

e24f02320e7993d3a06ede68424d082e03fe11e98f26cba220664daf4aab73fa

IMPHASH fdb2bdedc1c29150916dd23e80dd17eb
SHA256 e24f02320e7993d3a06ede68424d082e03fe11e98f26cba220664daf4aab73fa
MD5 0e7f48c5e6165c8d689b65d81d39759f
SHA1 b4580adbeeb9a815c19f465acb9b51923cef87c8
SHA512 674b70a86e8b00607a5f01870de6c0230f73d2ac3b08b8f61bbd2f0450f99d8b89cf9a5b4e15ea9f80b13a095f7b8fbb9906c50342d7a966b5c54c50ada7bf1d
SSDEEP 3072:xXKht/WeExQ08VHjlBycxEvD/fzvTMGfM9a5dQws6lO7i/tHxqisRKGxwKhUl5K1:JKht/WeHjovTbvAG0977idF1cr5v
TLSH
T101548C15B7A50CF9ED67853DC9424906EA72BC5647A0EACF03A04AA71F237E05F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

d3:12:01:2a:74:44:72:6a:d0:3c:64:a9:b6:ba:bb:ef:02:79:3b:0d:12:ea:1f:e6:48:7f:ab:35:a0:f3:b6:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

Chains

Mar 12, 2026

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

Serial Number

08:03:79:a0:e2:f7:b4:2e:b7:04:5f:d0:e0:94:bb:a4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2024 - May 19, 2026

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:55:d9:dd:69:26:28:f9:f8:e2:00:00:00:00:00:55

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

0

Major OS version

6

Entry point

46312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\agent\_work\1\s\apps\HPX\windows\ExtensionLauncher\bin\x64\Release\ExtensionLauncher.pdb

kernel32

CreateDirectoryW GetCurrentProcess GetPackageFamilyName GetModuleFileNameW Sleep FormatMessageW GetLastError CloseHandle GetLocalTime LocalFree CreateProcessW SetEndOfFile WriteConsoleW HeapSize CreateFileW ReadConsoleW MultiByteToWideChar GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree GetFileSizeEx SetFilePointerEx GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap RtlUnwind

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

Name

.text

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e24f02320e7993d3a06ede68424d082e03fe11e98f26cba220664daf4aab73fa

kernel32

shell32

shlwapi

generic