01082026_1627_01082026_DRT7_509405.hta.zip
- SHA256 8a7008ff0e10f3e1de4c969d02a007574e8d0ceb3bbd5712bc6477f894692b21
Password
infected
Behavioral task
behavioral1
Sample
/\t/ckL94/ RLEHEHLBVQSSIFAYQPQJJ8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
/\t/ckL94/ RLEHEHLBVQSSIFAYQPQJJ8.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
DRT7_509405.hta
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral4
Sample
DRT7_509405.hta
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
General
- Target 01082026_1627_01082026_DRT7_509405.hta.zip
- Size 1.5MB
- Sample260801-tyjneadk21
- SHA256 8a7008ff0e10f3e1de4c969d02a007574e8d0ceb3bbd5712bc6477f894692b21
- MD5 b1154cc252677641269dcb0a790a1edb
- SHA1 df4d96f1d1b8c8ed45f36b4b71d0fc8d9cdf8ed3
- SHA512 6fbb3bd6bd1bc740912d4dd640d7b7168f32174212ac60d17bc8e72b75a4a2a71396106b62a5d69a41f5690df743e212964b32ad3c238e506df619726a2ed060
- SSDEEP 49152:Ymov2Z6k3GbDjscxrR51o44yZ1rbNEcfEyBymSvC:KvS6kijv3o44ybvEJmSvC
- TLSH T1D87533B93DE327EBDFB5B3384B528A225BF17200DA1B0E2453C20DA76359B64249E45D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ /\t/ckL94/ RLEHEHLBVQSSIFAYQPQJJ8 upx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx
File Explorer
-
01082026_1627_01082026_DRT7_509405.hta.zip.zip 1.5MB
-
/\t/ckL94/ RLEHEHLBVQSSIFAYQPQJJ8.exe 1.6MB
-
out.upx.exe 4.3MB
-
DRT7_509405.hta.html 12KB
/\t/ckL94/ RLEHEHLBVQSSIFAYQPQJJ8
- SHA256 7eda1844e95b1b87c08fca3a0bcdc1a9a1dc614724d65af6f9560f5fa2c60090
- MD5 3fc811a0bfebff319395a18a4051a705
- SHA1 c448a015e558b09510dc27918695fbdd73107600
- SHA512 b047564e29468939c6cf50eb7a82780c56cf00e0fb0750cb4f9511645a71094bc67115c559c5ba186e188d95f40d2276f7d00c35cbd7e26a33a721aa72500895
- SSDEEP 24576:VcRj/LXfr6sbSvkNEOY4h1ie//IRlIUlEK9BNOtboTQkEWr0/ra282vmod3E:VcRj7hbSMNgEZcQKGSj4M2vz
- TLSH T1B475331A0520CF6ADC2F59B175378BA1A313AD5CBC8817DB2256BDAA7E327413EDD013
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
1f:29:5a:26:08:09:22:1c:02:85:e7:27:b4:50:e5:48:0e:ab:b3:8a:3e:03:3d:8f:d4:65:7e:e7:fe:be:c8:e4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat 11,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 5, 2024
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat 11,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat 11,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat 11,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:6e:32:fc:b0:e0:3a:0c:0b:2b:c0:4b:56:f2:03:8b
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 3, 2023 - Nov 4, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
5
Entry point
4679888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=31, id=259, version=29395,
count=45, id=260, version=29395,
count=219, id=261, version=29395,
count=1, id=262, version=29395,
count=20, id=260, version=31935,
count=27, id=259, version=31935,
count=417, id=261, version=31935,
count=2, productName=Unmarked objects (old),
count=3, id=206, productName=VS2012 UPD4 build 61030, version=61030,
count=21, id=257, version=29395,
count=23, id=261, version=32215,
count=899, id=1, productName=Unmarked objects,
count=60, id=265, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
out.upx
- SHA256 5b027da0179628ccf3b61fac690d0a9d87fd20b38adafe84d3c7554d3308f5a0
- MD5 6561b48996ef010a36f53913e99d68b5
- SHA1 8c12eac876aca1e9029a45aa3c09708188e7c7d6
- SHA512 deb67d53f272de6ef9400d74d0a825d8c452da22c94797f869c67e5d439e8c4a36fdeafb8a18d021deb6a3862f5dda27025994cec448615cd2355738a90170d3
- SSDEEP 98304:W98/509XjeTeg4BnbV/VjLpDyA/XrOyfTfKQRbCU:W9eTuuA/Xr
- TLSH T19F268C207592683FD6730331766AE22AB26C7A75073148CB7ADD5B1D6BF18C24132F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1904454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
_CreateProcessWithTokenW@36
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
497KB
Virtual Size
496KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
169KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=259, version=29395,
count=45, id=260, version=29395,
count=219, id=261, version=29395,
count=1, id=262, version=29395,
count=20, id=260, version=31935,
count=27, id=259, version=31935,
count=417, id=261, version=31935,
count=2, productName=Unmarked objects (old),
count=3, id=206, productName=VS2012 UPD4 build 61030, version=61030,
count=21, id=257, version=29395,
count=23, id=261, version=32215,
count=899, id=1, productName=Unmarked objects,
count=60, id=265, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
DRT7_509405.hta
- SHA256 a4386124f393a48d9d346618be287ee9a931f9de076da0bd6ad2f5ca866f9d80
- MD5 3d3aceb7bffb68429a806820d4304cb2
- SHA1 d831a848b90c7d0d1b73b55035d8fb17472d666b
- SHA512 ba12262c07d96d07b64664df110d4e130e6c3223ef8db6ead927d09707e597c84fd659c416076f7c03720b3ba574b1387605831793e2c172aeccae0a99132b16
- SSDEEP 192:23PGGRWTpBxWc1iiX2MB7GdlywfKkAlhNd0SC3ejLtvjmVK9uoWXCRSyEBX3yb:zz1f92MxwfPAlhPCOjL1mVKIaRsc
- TLSH T12F4283476381237705730152BA5C71E6E72A807CA337CA64B46D863E2BC5C3866FBADC
- MD5 SHA1 SHA512 SSDEEP TLSH