8211b9fb5eeb6be44053be3dbde699b589a98bf67433dc8b73d6cac680dfc61b

Sharing

Copy URL Twitter E-mail

General

Target
8211b9fb5eeb6be44053be3dbde699b589a98bf67433dc8b73d6cac680dfc61b
Size 3.9MB
Sample260802-tpem4asvbw
SHA256 8211b9fb5eeb6be44053be3dbde699b589a98bf67433dc8b73d6cac680dfc61b
MD5 e3cb36fa88ff9d9b5a06d9eb2a5ccaec
SHA1 308c52e740d0eeed70082a4f825f2687330a61ea
SHA512 c42112cbea44157d0276c2f61258a9d6addcda874327dda04543ccbf9f48c65833b663b6190c29de144925279485cb0310ff9fb55ed8100e1ba573651ad5e34d
SSDEEP 49152:XvTXN0ig8ZVh/b2U4A7SVWtrl/VhnpRE0AAw1t6/A8N4ZPPo3p/6+JNUiY0qd:XbXbg8thSCPpVEX6/qtINu0y
TLSH
T16C16AE01F6938071E9E617B0D87E7EAB8A3C3D14033884DB63C85D99AA716E336B5717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
8211b9fb5eeb6be44053be3dbde699b589a98bf67433dc8b73d6cac680dfc61b

File Explorer

8211b9fb5eeb6be44053be3dbde699b589a98bf67433dc8b73d6cac680dfc61b

.dll 3.9MB

8211b9fb5eeb6be44053be3dbde699b589a98bf67433dc8b73d6cac680dfc61b

IMPHASH ca660662530170110ff6e0e7ca39ee92
SHA256 8211b9fb5eeb6be44053be3dbde699b589a98bf67433dc8b73d6cac680dfc61b
MD5 e3cb36fa88ff9d9b5a06d9eb2a5ccaec
SHA1 308c52e740d0eeed70082a4f825f2687330a61ea
SHA512 c42112cbea44157d0276c2f61258a9d6addcda874327dda04543ccbf9f48c65833b663b6190c29de144925279485cb0310ff9fb55ed8100e1ba573651ad5e34d
SSDEEP 49152:XvTXN0ig8ZVh/b2U4A7SVWtrl/VhnpRE0AAw1t6/A8N4ZPPo3p/6+JNUiY0qd:XbXbg8thSCPpVEX6/qtINu0y
TLSH
T16C16AE01F6938071E9E617B0D87E7EAB8A3C3D14033884DB63C85D99AA716E336B5717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a7:4b:8e:5e:5a:e5:bb:0d:de:b2:aa:13:65:5f:2b:45:99:45:0f:bf

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=ReShade,1.2.840.113549.1.9.1=#0c0f696e666f40726573686164652e6d65

Chains

Aug 2, 2026

CN=ReShade,1.2.840.113549.1.9.1=#0c0f696e666f40726573686164652e6d65

Subject

CN=ReShade,1.2.840.113549.1.9.1=#0c0f696e666f40726573686164652e6d65

Serial Number

77:82:d6:29:97:92:5a:a1:46:ab:3b:81:72:65:ab:ca

Issuer

CN=ReShade,1.2.840.113549.1.9.1=#0c0f696e666f40726573686164652e6d65

Timespan

Mar 16, 2019 - Dec 31, 2039

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

2793056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

version

VerQueryValueW GetFileVersionInfoSizeW VerQueryValueA GetFileVersionInfoW

wininet

InternetOpenW InternetOpenUrlW InternetCloseHandle InternetSetOptionW InternetReadFile

kernel32

Sleep GetModuleHandleW GetModuleHandleExW GetProcAddress WriteFile CreateFileW GetCurrentThreadId GetLastError CloseHandle GetLocalTime GetCurrentProcess GetModuleFileNameW GetEnvironmentVariableW GetSystemDirectoryW CreateEventW SetEvent LoadLibraryW VerSetConditionMask VerifyVersionInfoW K32EnumProcessModules SizeofResource SetLastError GetThreadPreferredUILanguages EnumResourceNamesW LCIDToLocaleName LockResource EnumResourceLanguagesW LoadResource FindResourceW SetThreadPreferredUILanguages VirtualProtect LoadLibraryExA LoadLibraryA FreeLibrary GetProcessHeap GetCurrentProcessId GetTickCount OpenProcess GetWindowsDirectoryW CreateProcessW WaitForSingleObject GetStringTypeW HeapQueryInformation HeapSize LCMapStringW CompareStringW GetTimeZoneInformation ReadConsoleW GetFileSizeEx GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetStdHandle UnhandledExceptionFilter IsDebuggerPresent DecodePointer TerminateProcess SetEnvironmentVariableW SetStdHandle FlushFileBuffers WriteConsoleW SetEndOfFile IsValidCodePage GetACP GetOEMCP GetCommandLineA LoadLibraryExW Thread32Next ExitProcess GetCPInfo FreeEnvironmentStringsW GetEnvironmentStringsW RaiseException GetSystemInfo VirtualQuery GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache CreateToolhelp32Snapshot Thread32First FreeLibraryAndExitThread VirtualAlloc VirtualFree FormatMessageA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive SleepConditionVariableSRW LocalFree GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileInformationByHandle GetTempPathW CreateFile2 AreFileApisANSI CopyFile2 GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetLogicalProcessorInformationEx WakeAllConditionVariable IsProcessorFeaturePresent SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlUnwind InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReadFile CreateThread ExitThread GetCommandLineW

user32

DestroyWindow GetDC CreateWindowExW WindowFromDC EnumDisplayDevicesA GetDesktopWindow GetShellWindow GetWindowThreadProcessId GetKeyState EnumChildWindows GetClassLongW CallNextHookEx MsgWaitForMultipleObjects GetAsyncKeyState PeekMessageW GetRawInputData GetKeyboardLayout TranslateMessage ClipCursor ToUnicode GetClientRect PeekMessageA GetParent LoadStringW ScreenToClient OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard

gdi32

GetPixelFormat SetPixelFormat DescribePixelFormat

advapi32

AdjustTokenPrivileges CreateProcessWithTokenW OpenProcessToken DuplicateTokenEx GetTokenInformation LookupPrivilegeValueW

shell32

ShellExecuteW

ole32

StringFromGUID2

ClipCursor CompatString CompatValue CreateDXGIFactory CreateDXGIFactory1 CreateDXGIFactory2 D2D1CreateDevice D2D1CreateFactory D3D10CompileEffectFromMemory D3D10CompileShader D3D10CreateBlob D3D10CreateDevice D3D10CreateDevice1 D3D10CreateDeviceAndSwapChain D3D10CreateDeviceAndSwapChain1 D3D10CreateEffectFromMemory D3D10CreateEffectPoolFromMemory D3D10DisassembleEffect D3D10DisassembleShader D3D10GetGeometryShaderProfile D3D10GetInputAndOutputSignatureBlob D3D10GetInputSignatureBlob D3D10GetOutputSignatureBlob D3D10GetPixelShaderProfile D3D10GetShaderDebugInfo D3D10GetVertexShaderProfile D3D10PreprocessShader D3D10ReflectShader D3D11CreateDevice D3D11CreateDeviceAndSwapChain D3D11On12CreateDevice D3D12CreateDevice D3D12CreateRootSignatureDeserializer D3D12CreateVersionedRootSignatureDeserializer D3D12EnableExperimentalFeatures D3D12GetDebugInterface D3D12GetInterface D3D12PIXEventsReplaceBlock D3D12PIXGetThreadInfo D3D12PIXNotifyWakeFromFenceSignal D3D12PIXReportCounter D3D12SerializeRootSignature D3D12SerializeVersionedRootSignature D3DPERF_BeginEvent D3DPERF_EndEvent D3DPERF_GetStatus D3DPERF_QueryRepeatFrame D3DPERF_SetMarker D3DPERF_SetOptions D3DPERF_SetRegion DXGID3D10CreateDevice DXGID3D10CreateLayeredDevice DXGID3D10ETWRundown DXGID3D10GetLayeredDeviceSize DXGID3D10RegisterLayers DXGIDeclareAdapterRemovalSupport DXGIDisableVBlankVirtualization DXGIDumpJournal DXGIGetDebugInterface1 DXGIReportAdapterConfiguration Direct3D9EnableMaximizedWindowedModeShim Direct3DCreate9 Direct3DCreate9Ex Direct3DCreate9On12 Direct3DCreate9On12Ex DirectDrawCreate DirectDrawCreateEx DirectInput8Create DirectInputCreateA DirectInputCreateEx DirectInputCreateW GetAsyncKeyState GetCursorPos GetKeyState GetKeyboardState GetMessageA GetMessageW GetRawInputBuffer GetdfDIJoystick PeekMessageA PeekMessageW PostMessageA PostMessageW ReShadeCreateEffectRuntime ReShadeDestroyEffectRuntime ReShadeGetBasePath ReShadeGetConfigValue ReShadeGetImGuiFunctionTable ReShadeLogMessage ReShadeRegisterAddon ReShadeRegisterEvent ReShadeRegisterEventForAddon ReShadeRegisterOverlay ReShadeRegisterOverlayForAddon ReShadeSetConfigArray ReShadeSetConfigValue ReShadeUnregisterAddon ReShadeUnregisterEvent ReShadeUnregisterEventForAddon ReShadeUnregisterOverlay ReShadeUnregisterOverlayForAddon ReShadeUpdateAndPresentEffectRuntime ReShadeVersion RegisterClassA RegisterClassExA RegisterClassExW RegisterClassW RegisterRawInputDevices SetCursorPos SetWindowsHookExA SetWindowsHookExW UnhookWindowsHookEx VR_GetGenericInterface VR_GetInitToken VR_Init VR_InitInternal VR_InitInternal2 VR_Shutdown VR_ShutdownInternal WSARecv WSARecvFrom WSASend WSASendTo glAccum glAlphaFunc glAreTexturesResident glArrayElement glBegin glBindTexture glBitmap glBlendFunc glCallList glCallLists glClear glClearAccum glClearColor glClearDepth glClearIndex glClearStencil glClipPlane glColor3b glColor3bv glColor3d glColor3dv glColor3f glColor3fv glColor3i glColor3iv glColor3s glColor3sv glColor3ub glColor3ubv glColor3ui glColor3uiv glColor3us glColor3usv glColor4b glColor4bv glColor4d glColor4dv glColor4f glColor4fv glColor4i glColor4iv glColor4s glColor4sv glColor4ub glColor4ubv glColor4ui glColor4uiv glColor4us glColor4usv glColorMask glColorMaterial glColorPointer glCopyPixels glCopyTexImage1D glCopyTexImage2D glCopyTexSubImage1D glCopyTexSubImage2D glCullFace glDeleteLists glDeleteTextures glDepthFunc glDepthMask glDepthRange glDisable glDisableClientState glDrawArrays glDrawBuffer glDrawElements glDrawPixels glEdgeFlag glEdgeFlagPointer glEdgeFlagv glEnable glEnableClientState glEnd glEndList glEvalCoord1d glEvalCoord1dv glEvalCoord1f glEvalCoord1fv glEvalCoord2d glEvalCoord2dv glEvalCoord2f glEvalCoord2fv glEvalMesh1 glEvalMesh2 glEvalPoint1 glEvalPoint2 glFeedbackBuffer glFinish glFlush glFogf glFogfv glFogi glFogiv glFrontFace glFrustum glGenLists glGenTextures glGetBooleanv glGetClipPlane glGetDoublev glGetError glGetFloatv glGetIntegerv glGetLightfv glGetLightiv glGetMapdv glGetMapfv glGetMapiv glGetMaterialfv glGetMaterialiv glGetPixelMapfv glGetPixelMapuiv glGetPixelMapusv glGetPointerv glGetPolygonStipple glGetString glGetTexEnvfv glGetTexEnviv glGetTexGendv glGetTexGenfv glGetTexGeniv glGetTexImage glGetTexLevelParameterfv glGetTexLevelParameteriv glGetTexParameterfv glGetTexParameteriv glHint glIndexMask glIndexPointer glIndexd glIndexdv glIndexf glIndexfv glIndexi glIndexiv glIndexs glIndexsv glIndexub glIndexubv glInitNames glInterleavedArrays glIsEnabled glIsList glIsTexture glLightModelf glLightModelfv glLightModeli glLightModeliv glLightf glLightfv glLighti glLightiv glLineStipple glLineWidth glListBase glLoadIdentity glLoadMatrixd glLoadMatrixf glLoadName glLogicOp glMap1d glMap1f glMap2d glMap2f glMapGrid1d glMapGrid1f glMapGrid2d glMapGrid2f glMaterialf glMaterialfv glMateriali glMaterialiv glMatrixMode glMultMatrixd glMultMatrixf glNewList glNormal3b glNormal3bv glNormal3d glNormal3dv glNormal3f glNormal3fv glNormal3i glNormal3iv glNormal3s glNormal3sv glNormalPointer glOrtho glPassThrough glPixelMapfv glPixelMapuiv glPixelMapusv glPixelStoref glPixelStorei glPixelTransferf glPixelTransferi glPixelZoom glPointSize glPolygonMode glPolygonOffset glPolygonStipple glPopAttrib glPopClientAttrib glPopMatrix glPopName glPrioritizeTextures glPushAttrib glPushClientAttrib glPushMatrix glPushName glRasterPos2d glRasterPos2dv glRasterPos2f glRasterPos2fv glRasterPos2i glRasterPos2iv glRasterPos2s glRasterPos2sv glRasterPos3d glRasterPos3dv glRasterPos3f glRasterPos3fv glRasterPos3i glRasterPos3iv glRasterPos3s glRasterPos3sv glRasterPos4d glRasterPos4dv glRasterPos4f glRasterPos4fv glRasterPos4i glRasterPos4iv glRasterPos4s glRasterPos4sv glReadBuffer glReadPixels glRectd glRectdv glRectf glRectfv glRecti glRectiv glRects glRectsv glRenderMode glRotated glRotatef glScaled glScalef glScissor glSelectBuffer glShadeModel glStencilFunc glStencilMask glStencilOp glTexCoord1d glTexCoord1dv glTexCoord1f glTexCoord1fv glTexCoord1i glTexCoord1iv glTexCoord1s glTexCoord1sv glTexCoord2d glTexCoord2dv glTexCoord2f glTexCoord2fv glTexCoord2i glTexCoord2iv glTexCoord2s glTexCoord2sv glTexCoord3d glTexCoord3dv glTexCoord3f glTexCoord3fv glTexCoord3i glTexCoord3iv glTexCoord3s glTexCoord3sv glTexCoord4d glTexCoord4dv glTexCoord4f glTexCoord4fv glTexCoord4i glTexCoord4iv glTexCoord4s glTexCoord4sv glTexCoordPointer glTexEnvf glTexEnvfv glTexEnvi glTexEnviv glTexGend glTexGendv glTexGenf glTexGenfv glTexGeni glTexGeniv glTexImage1D glTexImage2D glTexParameterf glTexParameterfv glTexParameteri glTexParameteriv glTexSubImage1D glTexSubImage2D glTranslated glTranslatef glVertex2d glVertex2dv glVertex2f glVertex2fv glVertex2i glVertex2iv glVertex2s glVertex2sv glVertex3d glVertex3dv glVertex3f glVertex3fv glVertex3i glVertex3iv glVertex3s glVertex3sv glVertex4d glVertex4dv glVertex4f glVertex4fv glVertex4i glVertex4iv glVertex4s glVertex4sv glVertexPointer glViewport recv recvfrom send sendto vkCreateDevice vkCreateInstance vkGetDeviceProcAddr vkGetInstanceProcAddr vkGetPhysicalDeviceToolPropertiesEXT vkNegotiateLoaderLayerInterfaceVersion wglChoosePixelFormat wglCopyContext wglCreateContext wglCreateLayerContext wglDeleteContext wglDescribeLayerPlane wglDescribePixelFormat wglGetCurrentContext wglGetCurrentDC wglGetLayerPaletteEntries wglGetPixelFormat wglGetProcAddress wglMakeCurrent wglRealizeLayerPalette wglSetLayerPaletteEntries wglSetPixelFormat wglShareLists wglSwapBuffers wglSwapLayerBuffers wglSwapMultipleBuffers wglUseFontBitmapsA wglUseFontBitmapsW wglUseFontOutlinesA wglUseFontOutlinesW xrNegotiateLoaderApiLayerInterface

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

448KB

Virtual Size

447KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

511KB

Virtual Size

510KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8211b9fb5eeb6be44053be3dbde699b589a98bf67433dc8b73d6cac680dfc61b

PE Signature issue

version

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

generic