suspend-3[.]2[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
suspend-3.2.1.exe
Size 1.8MB
Sample260801-n246mathmc
SHA256 14ac0a5d6368ef22334696e7f1479442db29c9ee81498d291e8728ad9340a55b
MD5 82b7bed3173a249d84355790a10c6013
SHA1 205efbe2440e05217dad4e64bfb65f0a98f1fddb
SHA512 b0a57281ee7af6c8fc9a8c415682f5a83aa89bfca117d9ee4630dd7d6b8875493f14ee1b3f27769a09eda09bef67d3ce9207c33d8436666f2861c016d6ed33b8
SSDEEP 24576:0D6a2XT+cXjEDrK5aQOQXJmA3hvQfJUjTGlEUHiVn7Rk6vfXUIxn0906OtNzjtMH:0oX1k8aEJmzEVn7RkQG903zjta
TLSH
T13F95AE57B2D401F8D0B6E234D946A907E772B8440F7096DF1BE04A9A2FF37E05A7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

suspend-3.2.1.exe

.exe 1.8MB

suspend-3.2.1.exe

IMPHASH 8d8aa109a99b0fbee9e8e2921ed30b0b
SHA256 14ac0a5d6368ef22334696e7f1479442db29c9ee81498d291e8728ad9340a55b
MD5 82b7bed3173a249d84355790a10c6013
SHA1 205efbe2440e05217dad4e64bfb65f0a98f1fddb
SHA512 b0a57281ee7af6c8fc9a8c415682f5a83aa89bfca117d9ee4630dd7d6b8875493f14ee1b3f27769a09eda09bef67d3ce9207c33d8436666f2861c016d6ed33b8
SSDEEP 24576:0D6a2XT+cXjEDrK5aQOQXJmA3hvQfJUjTGlEUHiVn7Rk6vfXUIxn0906OtNzjtMH:0oX1k8aEJmzEVn7RkQG903zjta
TLSH
T13F95AE57B2D401F8D0B6E234D946A907E772B8440F7096DF1BE04A9A2FF37E05A7A712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

69:9d:8e:52:9a:0b:f9:4a:c5:11:67:ef:a8:3e:c4:a1:22:2c:9a:47:3a:e4:ca:74:54:b3:ab:f4:02:29:87:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Chains

Jan 30, 2026

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Serial Number

09:52:82:50:0e:6d:27:ae:07:63:1b:a1

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 11, 2025 - Sep 7, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

848856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Spencer-Macro-Utilities\Spencer-Macro-Utilities\visual studio\x64\Release\suspend.pdb

kernel32

CreateProcessW GetProcessId OpenProcess SetProcessInformation GetModuleFileNameA GetModuleFileNameW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW AllocConsole SetConsoleTitleW GetFileAttributesA GetFileAttributesExA GetLastError FindResourceA GetStdHandle CreateFileA ReadFile GetTempPathA SetHandleInformation CreatePipe CreateProcessA MapViewOfFile UnmapViewOfFile CreateFileMappingA CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW HeapSize SetEndOfFile GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetEnvironmentVariableW SetStdHandle GetTimeZoneInformation HeapReAlloc GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW SetThreadPriority IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess TerminateProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer GetCurrentThreadId GetCurrentThread GetExitCodeProcess GetCurrentProcess GetProcessTimes Sleep WaitForSingleObject CloseHandle GetTempPathW WriteFile DeleteFileW CreateFileW SetCurrentDirectoryW GetEnvironmentVariableA GetLocaleInfoA GetModuleHandleA QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA GetProcAddress FreeLibrary WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalAlloc GlobalLock GlobalUnlock GetUserDefaultLCID DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeConditionVariable GetFileInformationByHandleEx MoveFileExW CopyFileW AreFileApisANSI SetFileInformationByHandle ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead LocalFree FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive GetTickCount64 GetStringTypeW GetCurrentDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle RtlUnwind

user32

TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetKeyboardLayout MapVirtualKeyA VkKeyScanA GetAsyncKeyState FillRect UpdateLayeredWindow wsprintfW RegisterRawInputDevices GetRawInputData SetProcessDpiAwarenessContext GetDpiForWindow LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow GetWindowThreadProcessId FindWindowExW SetWindowLongPtrW GetWindowLongPtrW MessageBoxW GetForegroundWindow SetForegroundWindow UpdateWindow GetSystemMetrics MapVirtualKeyW SendInput VkKeyScanExW GetKeyNameTextA IsWindowVisible SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW AttachThreadInput PostThreadMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetWindowRect

gdi32

DeleteObject SetBkMode ChoosePixelFormat RemoveFontMemResourceEx TextOutA CreateDIBSection SetTextColor SelectObject AddFontMemResourceEx GetTextExtentPoint32A DeleteDC CreateSolidBrush CreateFontA CreateCompatibleDC SwapBuffers SetPixelFormat

advapi32

RegOpenKeyExA CheckTokenMembership FreeSid RegCloseKey AllocateAndInitializeSid

shell32

SHGetFolderPathA ShellExecuteExA ShellExecuteW ShellExecuteA

winmm

timeBeginPeriod timeEndPeriod

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

dwmapi

DwmSetWindowAttribute

wininet

InternetCloseHandle InternetSetOptionW InternetReadFile InternetOpenUrlW InternetOpenW

shlwapi

PathStripPathW PathFindFileNameW PathRemoveFileSpecW

opengl32

glClear wglMakeCurrent wglDeleteContext wglCreateContext glClearColor glViewport

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

276KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

285KB

Virtual Size

285KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

suspend-3.2.1.exe

kernel32

user32

gdi32

advapi32

shell32

winmm

imm32

dwmapi

wininet

shlwapi

opengl32

generic