SPAM.zip
- SHA256 0bee1bc1fbaff816f79e78a31389680fdb23c79bff30168b26e042f793c2a849
Static task
static1
Behavioral task
behavioral1
Sample
client32.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
client32.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target SPAM.zip
- Size 21KB
- Sample260731-hhs2cswerh
- SHA256 0bee1bc1fbaff816f79e78a31389680fdb23c79bff30168b26e042f793c2a849
- MD5 725cca0ed6d921e979761aa1dc3543b5
- SHA1 5c60e0bd09d869384b7c18739804f3209bb2b902
- SHA512 39b006c6e0fd2d92ebc31eea495fd4458bd717cf2bf968cc9445ddf8e0f1479731340d7d5617a1fa956e299d3282c4a0a92a457bba0fc1748869f65b5a14c409
- SSDEEP 384:KhM0gCF9kDwhLG9Xj0z4nyCGA5B+zEPyGN1imr0JZILhMB4FPQCt:VRnDkLUjNyCDazElP9IJZItA4FPQCt
- TLSH T148A2D012769D1E70CFA94B3D3A0B8E18A210547F2AE6C393E8AD6B5E5953D735D03043
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
SPAM.zip.zip 21KB
-
NSM.LIC262B
-
client32.exe.exe 117KB
-
client32.ini793B
NSM.LIC
- SHA256 88448fa440aeaff2b4c43f9daca92f9948e32d1e42e822695902a870a23173bc
- MD5 35b4ea845eb5d44743a5e68ad8f24c91
- SHA1 4109e52c70a3d3749207d7b48d632f044bbc090d
- SHA512 b47f8bc0dcb99de187f09cfd79a15f0c3ed59b36df088c0ffb36b6970759511ef93cd868693f727c2a9ac043b3721c127f1b494c45a246c90c1fc038409b96fa
- TLSH T190D02BC59212101783D15151BF9AA8AE92C8B014C2E86854FAF91B662EA54201ACD45C
- MD5 SHA1 SHA512 TLSH
client32.exe
- IMPHASH a9d50692e95b79723f3e76fcf70d023e
- SHA256 8000ffd1f8b32b4b85be9c3e730874865d949f9359c9a91c4386f4ff32deb180
- MD5 5f35710f5128ddf6eb2c89e724b83d11
- SHA1 94e8d9a259ddff360e0ea5b03580f672c66712c4
- SHA512 768e384346b83372e4e04dd6030c3404258d40ee63ea50dacdfea7e4746d65a3316fc572febe1995619c128e3bd08441c4b58de8a25b388b6e003552d949af09
- SSDEEP 768:hEVZl6FhWr80/FK0r2bhuvtAKzCKZikGr2bhu2RPAKzCKZikZ:hG0hGNKU2huv+vv2huyYva
- TLSH T166C3C50F4699E173EA42E97DC8849B010C64BEC9B5F458FB105EF63E3E3178E2B6415A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
70:66:64:33:1c:a4:3b:b2:6c:a5:e5:e0:4f:37:6f:dc:2c:a2:28:c8:42:e0:40:fa:fb:fc:dc:a3:28:15:94:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping\,,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 19, 2026
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping\,,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping\,,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Digest
5a:e9:0c:69:20:29:37:78:68:30:9f:bf:21:d5:7d:21:e4:94:0f:5d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping\,,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 19, 2026
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping\,,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping\,,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping\,,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
21:e3:17:fd:88:8c:97:04:e6:1d:e9:b0
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 29, 2025 - Jul 17, 2028
Subject
CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE
Serial Number
01:00:0b:20:05:b3:94:07:62:db:3e:36:79:94:9b:a9
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 11, 2025 - Dec 10, 2034
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 10, 2014 - Dec 10, 2034
Minor OS version
1
Major OS version
5
Entry point
4128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\nsmsrc\nsm\1412\1412\client32\release_unicode\client32.pdb
pcicl32
_NSMClient32@8
kernel32
GetCommandLineW
ExitProcess
GetModuleHandleW
GetStartupInfoW
Name
.text
Size
512B
Virtual Size
194B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
350B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
91KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=5, id=1, productName=Unmarked objects,
count=1, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
client32.ini
- SHA256 bf4899a45fb4aec3b5d96a0a06246af299acae99bb277f34266357b908f2e3a5
- MD5 e0cb52382589169dbb5321815f1ea1ab
- SHA1 f95cb80ca385f9067e41123ed1309b4efba90b71
- SHA512 ef066648b3bcaacf93ac521d775c30545908134bf187f7b26aab34cc96586ba03215f06b1f84c4144c774a59561dbd9738d7efbd0304d6233549dca4ed34f226
- TLSH T1F901F1111506FC9C156BB2C67A7400E02BD78440F45D39525B445D0F8F718AE0EEF494
- MD5 SHA1 SHA512 TLSH