4fc548d4267d30ac.bin
- SHA256 4b4828dd8d2fb20fb18a072971af48abbdcd693bc8da1935739d1fbdf2c50c30
Password
infected
Overview
overview
7Static
static
388.lnk
windows10-2004-x64
788.lnk
windows11-ltsc_2024-x64
7CGP_Зап...26.pdf
windows10-2004-x64
3CGP_Зап...26.pdf
windows11-ltsc_2024-x64
3calibre-launcher.dll
windows10-2004-x64
3calibre-launcher.dll
windows11-ltsc_2024-x64
3calibre.exe
windows10-2004-x64
3calibre.exe
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
88.lnk
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
CGP_Заполненный_опросный_лист_по_внедрению_CommuniGate_Pro_Деловые_Линии_2026.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
CGP_Заполненный_опросный_лист_по_внедрению_CommuniGate_Pro_Деловые_Линии_2026.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
calibre-launcher.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
calibre-launcher.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
calibre.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
calibre.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 4fc548d4267d30ac.bin
- Size 157KB
- Sample260801-2pjaaayerc
- SHA256 4b4828dd8d2fb20fb18a072971af48abbdcd693bc8da1935739d1fbdf2c50c30
- MD5 4d8515f8d307b189577b55cd4aeb177a
- SHA1 f28dc9c4293cc34b22d868187580e96c173fcb85
- SHA512 5844cf65a590970773384e553326082f6c37a97be62291ff518f2977f881352ca0d6cd4ed70469f2ffab05e406a39ff85eb266ff6dd8a31d5adff479da03437f
- SSDEEP 3072:SCP+B8BgPbMSaN9zQkVNsx1z6w0c4eKl9XpSaCWLuujxpW/gSEKI/5OtA:f+BgkzaNtQkNsL6NcVAXpSox0EKgiA
- TLSH T1BAF312632FF02F01ACA0DEF94A5B817705386E5AD45314328B58E78CCBCB6F6E54C9A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack004/calibre-launcher.dll
File Explorer
-
4fc548d4267d30ac.bin.zip 157KB
-
4fc548d4267d30acd658a3a43e30b4924dade9371cf6448cb1ae9e374f7dd69a.tar.tar 284KB
-
88.lnk.lnk 1005B
-
CGP_Заполненный_опросный_лист_по_внедрению_CommuniGate_Pro_Деловые_Линии_2026.pdf.pdf 99KB
-
treesn.tar 180KB
-
calibre-launcher.dll.dll 113KB
-
calibre.exe.exe 63KB
4fc548d4267d30acd658a3a43e30b4924dade9371cf6448cb1ae9e374f7dd69a.tar
- SHA256 4fc548d4267d30acd658a3a43e30b4924dade9371cf6448cb1ae9e374f7dd69a
- MD5 561b4d321e756c05752571b54bce8a65
- SHA1 d9f554eb2d81ab6293235c42e19d4113f91b7725
- SHA512 62942f25f0eb8f3b239852641d7c59e0bcb648d2ab842888860f7b033a8d28ba2d9044ab508693f0d1dcb3383d074ae745059314c9e4af21b42b9ebc12f74d2e
- SSDEEP 6144:oNJX3NAbLf8KTloA8rEQ4FLyj2Un161ajwC+57v5:oN28KlFLM16
- TLSH T1E2542B71B0C4589DE8C9C97C44E9760A0B3D7D1F8AE928AB371CEE25A7043C1BF15A67
- MD5 SHA1 SHA512 SSDEEP TLSH
88.lnk
- SHA256 9f30f57c0fb56f08adc8fb72ceee5053becaad9d54cfdb09be08bb37b60f2a2b
- MD5 c2a6feac7dac61a2afc794d373636a04
- SHA1 7e127356c8339a439ee3e94024076db563c24008
- SHA512 a48a3189a4c821370fb519d0216dd21b9d4c9b1e8f11ae216737ae1a882d87d33314c7a2f9b480a9690d5fa0e982cc212e4895f0444803749b885f199957626a
- TLSH T1401123163FCAA638D5724A708C3267B4465BBC84DD3583CF004C589818D6B107D34F25
- MD5 SHA1 SHA512 TLSH
CGP_Заполненный_опросный_лист_по_внедрению_CommuniGate_Pro_Деловые_Линии_2026.pdf
- SHA256 1267af291173042a790da71024c76ae917235b273598ba8716a6a2e9e371581c
- MD5 111961c168d77f5eae2de5c86d96ae04
- SHA1 da10705ab560dfec4bf1a8e3de0f5997d02b6280
- SHA512 53935888fc3cf75a0cc643fa67c6d5d3c0d0f329d0ee6318a878adab8ceffcbec48d5806a1890ae992261acaa935be369d0a9e6785884bb5312c6a32179fe289
- SSDEEP 1536:RXwC+i0v+tUteiVHfwx5oUaZXhDvtNRX+:RXwC+rvJXHIIZR5Nk
- TLSH T1F4A37670E4D85CCCF886CE8D84F934094E7CF61756CE3886711ECE16A3056D6EB9A29B
- MD5 SHA1 SHA512 SSDEEP TLSH
treesn
- SHA256 c73b421c0d32816e23f49a60cba708b8c113126b54af74e140af8cdb62acd3d7
- MD5 25fd80bb2eddcb882cbd7d790df8d0e1
- SHA1 cdca0ca1a65d0263d29ccd8907800d8707290946
- SHA512 834215c8b2929db3fe993c7ad439d5d7ea5009e818f79ce38070dbbf809a3b641c2595559920f6102798634cf23f189612aa3595910f573dfa8df246a8b69b70
- SSDEEP 3072:+Ez/yJii3Y4hgnbLSKUk0zK0vmlomx/WdCmNOnTskwoUpmFL+7j2Ju2QCoz5PSd:+NJX3NAbLf8KTloA8rEQ4FLyj2Un161a
- TLSH T124043B8271C0607BD4D9447C08E9575A473A2C9E8B7859FF7B60BD79BB283D07E20E26
- MD5 SHA1 SHA512 SSDEEP TLSH
calibre-launcher.dll
- IMPHASH 49cda150336d3404538f27927201a926
- SHA256 ac8428684424dbae254570f757ac2b79eb5bf78e6dfbb0d4247fd814bb1e95cb
- MD5 ff25b675d13f530762e15f265e846f01
- SHA1 c156faea83012ae8f2497c171d4ccc8c70207926
- SHA512 afc23e0970bc12c426af03b0f977e81d08b8a1f104eff73ff4e6a7d2e8c163d77ceefa3f4a458c1d6e9f3975e91a814ce0a87b753a4a926d8550bc49d705bd64
- SSDEEP 3072:sEz/yJii3Y4hgnbLSKUk0zK0vmlomx/WdCmNOnTskwoUpmFL:sNJX3NAbLf8KTloA8rEQ4FL
- TLSH T18AB36C11B181A0B2E4AE187904A5D7A54B3F3920CFA49DEBB7442AAD5F306E19F31F17
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
30637
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ntdll
RtlUnwind
RtlRandomEx
RtlExitUserProcess
RtlGetVersion
iphlpapi
GetAdaptersInfo
shlwapi
PathFileExistsW
winhttp
WinHttpSendRequest
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpConnect
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpQueryHeaders
ws2_32
inet_addr
kernel32
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
CreateDirectoryW
ExpandEnvironmentStringsW
CreateFileW
GetLastError
WaitForSingleObjectEx
GetLocalTime
IsWow64Process
GetOEMCP
GetModuleFileNameW
CreateMutexW
GetComputerNameExW
GetACP
FreeConsole
SetCurrentDirectoryW
GetModuleHandleW
CreateThread
WriteFile
MultiByteToWideChar
GlobalFree
CloseHandle
SetFilePointerEx
WriteConsoleW
LCMapStringW
VirtualProtect
CreateProcessW
GetCurrentThreadId
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
WideCharToMultiByte
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
DecodePointer
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RaiseException
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
advapi32
GetUserNameW
RegSetKeyValueW
RegCloseKey
RegOpenKeyW
bcrypt
BCryptEncrypt
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptImportKeyPair
crypt32
CryptBinaryToStringW
execute_python_entrypoint
simple_print
Name
.text
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33145,
count=137, id=261, version=33145,
count=19, id=260, version=33145,
count=20, id=259, version=35207,
count=15, id=260, version=35207,
count=35, id=261, version=35207,
count=19, id=257, version=33145,
count=130, id=1, productName=Unmarked objects,
count=20, id=265, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
calibre.exe
- IMPHASH cc2e304a3bf8db839fc664ec7e711431
- SHA256 64bdde10cfff243a25b021296773816057db1620df56ebd4db9178dcb88d2eaa
- MD5 853d888553d002a04484c098a3d7045f
- SHA1 d275ab06cc89db7293f9575d24dd83dcb41f56ca
- SHA512 ff3f4c48eeda7379ed6ce4a4c6456342ebcdc6751fcc15225d85066c19ee33effa52a9fa6298f8462ae5a6964e27e7d490ab31b6e3db8df3d8aa1dce967c6ddc
- SSDEEP 1536:Kp7+J62CmRRs2RGyUYoz5TjSGC1psqyl3ht0:07j2Ju2QCoz5PSd1CdJ0
- TLSH T19E53D2D372C4682EE8C186BC58EA470B58A12DCF09B8567F3B74FD66FB697403405A39
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
37:e6:20:b6:f8:ec:1b:83:f8:1c:36:90:74:81:65:70:a7:af:7a:a8:d6:a2:22:05:ca:60:4c:64:f0:46:89:ec
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Kovid Goyal,O=Kovid Goyal,L=Mumbai,ST=Maharashtra,C=IN
Chains
Nov 12, 2021
CN=Kovid Goyal,O=Kovid Goyal,L=Mumbai,ST=Maharashtra,C=IN
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=Kovid Goyal,O=Kovid Goyal,L=Mumbai,ST=Maharashtra,C=IN
Serial Number
04:5d:a1:8e:f2:c9:73:29:8f:f1:c8:2e:03:68:c3:d1
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 10, 2020 - Sep 29, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
6
Entry point
4716
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBeep
MessageBoxW
wsprintfW
kernel32
GetModuleFileNameW
SetDllDirectoryW
FormatMessageW
LocalFree
GetLastError
ExitProcess
FreeLibrary
LoadLibraryW
GetProcAddress
LocalAlloc
Name
.text
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=257, version=26715,
count=13, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=255, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.7.1 build 29111, version=29111,