0d298a65db890328d0357b2fb39ea7352645a994a601f430c38450769635f957.zip
- SHA256 36a4267f1a864626e8df6a69afb6fc84536e21c192e7bb759af1e8b9935269bd
Password
infected
Behavioral task
behavioral1
Sample
0d298a65db890328d0357b2fb39ea7352645a994a601f430c38450769635f957.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d298a65db890328d0357b2fb39ea7352645a994a601f430c38450769635f957.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 0d298a65db890328d0357b2fb39ea7352645a994a601f430c38450769635f957.zip
- Size 2.1MB
- Sample260804-3fs9katalg
- SHA256 36a4267f1a864626e8df6a69afb6fc84536e21c192e7bb759af1e8b9935269bd
- MD5 0a3a835f804db39a0c7cc9c474506e73
- SHA1 c915f1c0c3cdde34786d1177b302c0eff4286ed8
- SHA512 938f5ea4650bebcf3497474b1aa5c7e78b2cc15699242e92c62ca58f9adfae9b92aa97c133d11d3a0078028260b3ee21c8ca70c6224b3074e246590c9c19e4bf
- SSDEEP 49152:syGvOCSAtSwEDfvytd+hC2AQaI2Q88B1Y/QzjSkew876:UWCzvErvyriIQa4FB1ckew/
- TLSH T1ECA533D1596CAA61CFE08BA94CD9BE086E41765D9775308681F553BEEFA42F00C823CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/0d298a65db890328d0357b2fb39ea7352645a994a601f430c38450769635f957.exe themida - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/0d298a65db890328d0357b2fb39ea7352645a994a601f430c38450769635f957.exe
File Explorer
-
0d298a65db890328d0357b2fb39ea7352645a994a601f430c38450769635f957.zip.zip 2.1MB
-
0d298a65db890328d0357b2fb39ea7352645a994a601f430c38450769635f957.exe.exe 2.1MB
0d298a65db890328d0357b2fb39ea7352645a994a601f430c38450769635f957.exe
- SHA256 0d298a65db890328d0357b2fb39ea7352645a994a601f430c38450769635f957
- MD5 4264991601686145d9e14f36c1e7b3d9
- SHA1 feb272114aba399e891d551603b195c4bce264c7
- SHA512 b4315f27de1d9384a942f7c8b70219eb3aca252c9e08db73a1f2726b4dc43a1c47d6a61eb74f506664cebf28bd8d70e1d4fdb6b46da258945975b8bc6b21f554
- SSDEEP 49152:bO+wxA1pzE9o3xJPMwSjlRyauLF1n7dgG75JUTe8dkXioeLS7/tugRs98Lb2az34:yJqzz0Cx1MNKfnh/lXLZUrCbVz3Dc
- TLSH T143A533800BC87843DC9E83F7EC9526A25768557157A96C03827752092EB773BF3B02AF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
a5:f0:74:e3:d1:26:59:99:3f:b9:00:4e:02:5d:27:ca:d4:da:14:7d:c6:b6:8d:48:c5:40:d6:c4:a6:f3:9d:e4:8f:ce:71:9f:62:65:3f:ec:d5:a6:c8:56:0e:f9:15:7c:27:a0:5e:1a:04:af:89:08:e4:e0:1a:3b:70:7e:9b:cd
Digest Algorithm
sha512
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Installer,OU=Support Engineering,O=RoseField Install Solutions OU,L=Osaka,C=JP
Chains
Aug 4, 2026
CN=Installer,OU=Support Engineering,O=RoseField Install Solutions OU,L=Osaka,C=JP
PE Signature issue
Digest
c2:08:bc:71:e1:94:4c:bc:3c:36:f0:ce:40:20:4b:5c:b4:97:f2:96
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Installer,OU=Support Engineering,O=RoseField Install Solutions OU,L=Osaka,C=JP
Chains
Aug 4, 2026
CN=Installer,OU=Support Engineering,O=RoseField Install Solutions OU,L=Osaka,C=JP
Subject
CN=Installer,OU=Support Engineering,O=RoseField Install Solutions OU,L=Osaka,C=JP
Serial Number
3b:e7:fb:cb:73:df:55:b4:40:e9:f6:7b:9f:f2:8f:85
Issuer
CN=Installer,OU=Support Engineering,O=RoseField Install Solutions OU,L=Osaka,C=JP
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 4, 2026 - Aug 4, 2028
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38
Issuer
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 18, 2025 - Nov 12, 2034
Subject
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Issuer
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 13, 2019 - Nov 12, 2034
Minor OS version
0
Major OS version
6
Entry point
4243544
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
74KB
Virtual Size
181KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
4KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
107KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ