Archive.zip
- SHA256 975aab31c1a25d998ddf5480d20a47ce11d2a1703f323d68a55e723e2c45c167
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
libsll.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
updater.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target Archive.zip
- Size 77.9MB
- Sample260730-c21bwsxflc
- SHA256 975aab31c1a25d998ddf5480d20a47ce11d2a1703f323d68a55e723e2c45c167
- MD5 b1711bc33fc2ccb3e0add66a4ca24e5f
- SHA1 df20780dacd456f824eab2e134217abd5bff7793
- SHA512 fe29d5f8aa017efa65bfbd6ea12b404bd991dfff00bc9d5f06050e7b8008155edf297e1729767597f16b10290c629404663027af7102e1415494972e13aa999e
- SSDEEP 1572864:oND+5fmYA98M33onk3vSms0ikvV2EShT4wVFIg+UTViV0CQBTt+jLV6lBXR8:o05fBxtEqSvEh4wzF+ygSDBYjWh8
- TLSH T117083314F3D61F09158AA7A9E71ADF654249462E4E783060EF87287F0EB7D2E3C0D867
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/libsll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/updater.exe
File Explorer
-
Archive.zip.zip 77.9MB
-
libsll.dll 78.8MB
-
updater.exe.exe 549KB
libsll
- IMPHASH c2d02fc98f1d75d7b9457468ec75da0e
- SHA256 64113cb9154b54da8c9b8344f231a831eeef4aea4434c2fa6b3335def5f171d5
- MD5 86a8846c2e7867df1891c3cd709def4e
- SHA1 44ff782ff4b9579b15fca0a77102cf5319d61fc5
- SHA512 7bc79c172763faca81cc191d985da26c48992e429f89b0644dab4b2a59591f47f0b9767bc1b6a7ced4292fa49168d39e06df8838edc86a65df520c4744cff960
- SSDEEP 1572864:/Qfu9ay664JuSUbH61O7rSkcKoOZxK2ct7QOhzsKIoDtYTseStN7q7vt6H:IfmNtIhfiumZUzQOlfIoOYNtc7
- TLSH T13A083349F3FC061CD4A6D13C97278727C5B5B01B2770A2DB5A9209390F63EEA2E3DA54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13489
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\MO2\build\openssl-3.2.0\libssl-3-x64.pdb
kernel32
VirtualProtect
cef_api_hash
cef_command_line_create
cef_execute_process
cef_log
cef_parse_json
cef_process_message_create
cef_string_list_alloc
cef_string_list_append
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf8_clear
cef_string_utf8_to_utf16
cef_v8context_get_current_context
cef_v8value_create_array
cef_v8value_create_bool
cef_v8value_create_double
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_object
cef_v8value_create_string
Name
.text
Size
838KB
Virtual Size
838KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
207KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rcdata
Size
77.6MB
Virtual Size
77.6MB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33030,
count=13, id=261, version=33030,
count=8, id=260, version=33030,
count=4, id=259, version=33030,
count=4, id=257, version=30795,
count=3, id=257, version=33130,
count=589, id=1, productName=Unmarked objects,
count=89, id=260, version=33130,
count=1, id=256, version=33130,
count=1, id=255, version=33130,
count=1, id=258, version=33130,
updater.exe
- IMPHASH 88a95680951ef6b2e8a8635fff8be619
- SHA256 f808420fc809454563d574df4ea86910b733b0ca696ad78a7faadebbcb10d348
- MD5 81695d367b46f7b40064d69439052e31
- SHA1 19b83f11a252ca751edb021c0e7fe508c41205de
- SHA512 9e4a99deb44f62dbea280c7f15cc5c1b8171a253e9997defe1f5222473daf5be6f01b3d1b6cf1d46c82933714fa24d2ec35078ee443c63b41cb8bfb84235a8ef
- SSDEEP 6144:1u0azWFoCQhibmR0q7Op6ia56q3maD+BcnF500iCf1R96OKU:U0azWF8hiq76W6qT+BciCfbAU
- TLSH T120C4399AA26817E5E2BAC53C8752C94AF3713C4643A1A7CF1364439A5F67FE09D3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
d1:c6:59:7f:8c:45:ff:7d:42:76:e3:29:59:89:c1:75:38:48:fa:e6:8c:b3:a6:18:40:9a:ae:e5:7f:02:bb:9d:18:22:3a:32:9b:d0:58:49:90:ab:0d:0c:f1:62:d7:83
Digest Algorithm
sha384
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=2023-001272252,CN=OBS Project\, LLC,O=OBS Project\, LLC,L=Sheridan,ST=Wyoming,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130757796f6d696e67,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jan 1, 0001
Subject
CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29
Issuer
CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
May 15, 2026
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=2023-001272252,CN=OBS Project\, LLC,O=OBS Project\, LLC,L=Sheridan,ST=Wyoming,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130757796f6d696e67,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0d:41:6a:06:83:b8:c1:91:de:e8:de:ee:c5:4d:ab:37
Issuer
CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 28, 2024 - Jan 27, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
290784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\obs-studio\obs-studio\build_x64\plugins\obs-browser\Release\obs-browser-page.pdb
libcef
cef_v8value_create_null
cef_string_multimap_free
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_map_append
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_list_append
cef_string_list_value
cef_string_list_size
cef_command_line_create
cef_string_map_free
cef_string_map_alloc
cef_process_message_create
cef_v8context_get_current_context
cef_v8value_create_function
cef_v8value_create_array
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_double
cef_v8value_create_int
cef_v8value_create_bool
cef_string_utf16_cmp
cef_log
cef_api_hash
cef_parse_json
cef_execute_process
cef_string_list_free
cef_string_list_alloc
cef_string_userfree_utf16_free
cef_string_utf8_clear
cef_string_utf8_to_utf16
cef_string_utf16_to_utf8
cef_string_utf16_clear
cef_string_utf16_set
kernel32
GetCurrentThreadId
WriteConsoleW
CreateFileW
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
SetFilePointerEx
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
HeapAlloc
HeapFree
WriteFile
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
GetProcAddress
GetModuleHandleW
GetSystemTimeAsFileTime
MultiByteToWideChar
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
WakeAllConditionVariable
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WideCharToMultiByte
GetExitCodeThread
WaitForSingleObjectEx
SetLastError
GetLastError
CloseHandle
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
SetProcessInformation
TerminateProcess
WaitForMultipleObjects
WaitForSingleObject
OpenProcess
CreateEventW
SetEvent
user32
PostThreadMessageW
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
Name
.text
Size
386KB
Virtual Size
385KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
119KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=162, id=261, version=30795,
count=16, id=260, version=30795,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=89, id=261, version=35207,
count=4, id=257, version=30795,
count=3, productName=Unmarked objects (old),
count=261, id=1, productName=Unmarked objects,
count=124, id=261, version=34438,
count=2, id=265, version=35221,
count=1, id=256, version=35221,
count=1, id=255, version=35221,
count=1, id=258, version=35221,