Stardock Windowblinds.zip
- SHA256 f5ae3ad5c1b5a6f83dca0a7f8409d80dd3a0c16a50cbee89f4554ce7d9296d3e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Stardock Windowblinds.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Stardock Windowblinds.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Stardock Windowblinds.zip
- Size 53.8MB
- Sample260727-2atsgade94
- SHA256 f5ae3ad5c1b5a6f83dca0a7f8409d80dd3a0c16a50cbee89f4554ce7d9296d3e
- MD5 58b0fbc6098e2cccac056df3b2bc5529
- SHA1 3c58f3952a5ec52527861dd7006162f4198ca640
- SHA512 1f7dcc01e02338ef761e6edcd80dce841efb6109007687ab890fb6e4aff2df45504b70615ded00162678b4e5a1b618d347fce8aea0aa31b7671fe83a9f65eb52
- SSDEEP 1572864:HH+Te0eDaRMecCB1+c4EWQgwrL71kXjvp8T1fTqq:HH+SDKMecCPx4rQnH16xI3
- TLSH T1B5C73312EDF922D4F7332A3C8071133D352E7A0D892F5E6D9EDA708369E644BEC85865
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/patch.exe
File Explorer
-
Stardock Windowblinds.zip.zip 53.8MB
-
WindowBlinds_10.8.2-sd-setup.exe.exe 54.3MB
-
patch.exe.exe 239KB
WindowBlinds_10.8.2-sd-setup.exe
- IMPHASH d619eda1a774da262071361b928bb2e4
- SHA256 d9c74a329e4a720190ed107a8d23d8226efd35dcc7aef3beebd3d256e0efc2b0
- MD5 0c87f37e85e0ea259f90c321d7701eb4
- SHA1 2879c09bd12f2622bd5cd954392b3382b0df5de4
- SHA512 dfd1ca76c39468a237594a34211710c9ffcbfa337eedde3d99501f38bf52b0f6bfca3075a5eebc61eca0e7e4e6f77bf8cb4cf9fe9e9616fb718e8aa3473343eb
- SSDEEP 1572864:UG/eiU3enr8Go+oYk0qQIr5ZEXLtxgsrr/aJ9:UGS3ir8Go1YZqbLuT9af
- TLSH T1B8C73303DDA6D5FCF1260639C02343293A2A3E1C466759EB4FC9B897BEF52C2AD12535
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
63:19:2d:f5:5d:1e:ef:66:b5:99:54:c6:45:96:82:0b:b2:cd:74:c4:06:24:dd:25:ef:68:21:34:dd:8e:8b:b0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=STARDOCK SYSTEMS\, INC.,O=STARDOCK SYSTEMS\, INC.,L=Plymouth,ST=Michigan,C=US
Chains
Jun 25, 2019
CN=STARDOCK SYSTEMS\, INC.,O=STARDOCK SYSTEMS\, INC.,L=Plymouth,ST=Michigan,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=STARDOCK SYSTEMS\, INC.,O=STARDOCK SYSTEMS\, INC.,L=Plymouth,ST=Michigan,C=US
Serial Number
0c:16:3c:4a:24:38:b0:3a:43:e1:70:f4:83:b7:b8:c8
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 8, 2019 - Apr 20, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
1
Major OS version
5
Entry point
11489
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
lstrcpyA
lstrcatA
lstrlenA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
_lclose
GetModuleFileNameA
_lread
_llseek
_lopen
_lwrite
_lcreat
CreateDirectoryA
SetCurrentDirectoryA
GetDiskFreeSpaceA
GetFileAttributesA
CompareStringA
DeleteFileA
GetTempPathA
GetCurrentDirectoryA
CloseHandle
GetExitCodeProcess
GetLastError
LocalFree
GetCurrentProcess
MoveFileExA
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapReAlloc
RtlUnwind
HeapSize
Sleep
RemoveDirectoryA
FreeLibrary
IsValidCodePage
GetOEMCP
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
HeapCreate
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
user32
TranslateMessage
DispatchMessageA
PeekMessageA
wsprintfA
LoadCursorA
SetCursor
MessageBoxA
MsgWaitForMultipleObjects
advapi32
GetTokenInformation
OpenProcessToken
shell32
ShellExecuteExA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
94KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=67, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=102, id=1, productName=Unmarked objects,
count=25, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
patch.exe
- IMPHASH dc73a9bd8de0fd640549c85ac4089b87
- SHA256 a526b245ba2e5c72ee0a6f34dec44bd8c282efe1d6e8c03bb45eacdb8db0766c
- MD5 6516b21815eae243574c8172c2b0694b
- SHA1 1fe04166b44304818ea7b1930200f2065abf149b
- SHA512 7b2a2bd8a8ab945e68d5cfe3b4d677cd8aa16bfcdd62659cb6d48329c567ebbd7a6ec6fc93e9fe36408a566e388e0e1ee9a2091f429b6f05597b8f9aab78a0df
- SSDEEP 6144:8Y4ruK3TJ8akgaVg6IgW45QCefr/eODJOzxjuT6nRs:NEHqtgh5gbQCkxMpR
- TLSH T1BE34138D2D819C88C431A8F2F6ABC1B3D81C84572482B766BFD2513773672A553DE4BE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4139
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile
Name
.text
Size
512B
Virtual Size
502B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
236KB
Virtual Size
235KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
82B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=18, version=8444,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=17, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,