04082026_1547_30072026_Open to view.exe.iso
- SHA256 0b38c7019201b0144b1be8eec0203e1939e2221ebc88e7acb4fcf87ca9ac11f1
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Open to view.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
Open to view.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
300 seconds
Behavioral task
behavioral3
Sample
libcef.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
libcef.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target 04082026_1547_30072026_Open to view.exe.iso
- Size 654KB
- Sample260804-s8k4jsteph
- SHA256 0b38c7019201b0144b1be8eec0203e1939e2221ebc88e7acb4fcf87ca9ac11f1
- MD5 5c87ba3318e9dac3c298e4cf30b49e6e
- SHA1 4d0a2ed5d2e39d662e12dd3f0e157d525703f1e0
- SHA512 14858fdf115e8162d2d2b7224abedbc40ee7b81fa1a7754bdcf8e424ae9720845d6c18b3760b3f9808601c996f018eaba1c63efbba1c052e1ce200a7717d075f
- SSDEEP 12288:NPLldJz/QIKmQlMoYdAMVjyosCsOq1hYthWgh:TQIKmQlfiyjCV37h
- TLSH T130E4B011B980807AD9676036DAFDBBB9596DE8211B3040CBB7EC057D8F205D26B35B2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack002/Open to view.exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/libcef.dll
File Explorer
-
04082026_1547_30072026_Open to view.exe.iso.iso 654KB
-
out.iso.iso 654KB
-
Open to view.exe.exe 253KB
-
libcef.dll.dll 337KB
-
ssl_ciphers.cache1KB
out.iso
- SHA256 0b38c7019201b0144b1be8eec0203e1939e2221ebc88e7acb4fcf87ca9ac11f1
- MD5 5c87ba3318e9dac3c298e4cf30b49e6e
- SHA1 4d0a2ed5d2e39d662e12dd3f0e157d525703f1e0
- SHA512 14858fdf115e8162d2d2b7224abedbc40ee7b81fa1a7754bdcf8e424ae9720845d6c18b3760b3f9808601c996f018eaba1c63efbba1c052e1ce200a7717d075f
- SSDEEP 12288:NPLldJz/QIKmQlMoYdAMVjyosCsOq1hYthWgh:TQIKmQlfiyjCV37h
- TLSH T130E4B011B980807AD9676036DAFDBBB9596DE8211B3040CBB7EC057D8F205D26B35B2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Open to view.exe
- IMPHASH 3c1a1e46c213c13c9c3610f40a6f30b0
- SHA256 78fc25ed9a673f26eadf03dd5472dc112155138410cd5c81f8b89ccef5bf0736
- MD5 c663ac03855f3e7ff9fde06bd6e24aec
- SHA1 2375e27170527ab4af65919b51079d1953fa4ef4
- SHA512 59102fd9051694953b1935b353e8a5e15b578fe3196d8a30447c7eba1bdf312a2b3ae195d7a11c46ca70365e406a44d1b630bed7a4973a46a434cfef5351ea9f
- SSDEEP 6144:RPLlFC0kFH9n1C75Ej+3CoEeVXoNKz/56XYKJ:RPLldJz/QIKJ
- TLSH T180444B716E8944BEEA93E033CAFD3ABDB2689513573040C77668162C8D105E32F35A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Password
infected
Digest
42:79:aa:17:65:49:ab:61:a1:ba:6b:06:86:b8:a6:94:25:70:94:74
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Beijing Effective Biz Info Tech Co.\, Ltd.,O=Beijing Effective Biz Info Tech Co.\, Ltd.,ST=Beijing,C=CN
Chains
Oct 22, 2020
CN=Beijing Effective Biz Info Tech Co.\, Ltd.,O=Beijing Effective Biz Info Tech Co.\, Ltd.,ST=Beijing,C=CN
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Beijing Effective Biz Info Tech Co.\, Ltd.,O=Beijing Effective Biz Info Tech Co.\, Ltd.,ST=Beijing,C=CN
Serial Number
02:7c:4e:2a:97:a2:81:7b:a8:9d:5d:99:7a:2a:a0:db
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 16, 2020 - Oct 24, 2021
Minor OS version
1
Major OS version
5
Entry point
139393
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\sc\win-client\bin\Release\JGExternal.pdb
user32
MessageBoxA
MessageBoxW
libcef
cef_string_utf16_cmp
cef_string_utf16_clear
cef_string_utf8_to_utf16
cef_string_utf16_set
cef_v8context_get_current_context
cef_string_userfree_utf16_free
cef_process_message_create
cef_string_list_free
cef_string_list_alloc
cef_v8value_create_bool
cef_v8value_create_int
cef_v8value_create_string
cef_execute_process
cef_api_hash
cef_register_extension
cef_string_map_free
cef_string_map_alloc
cef_string_list_append
cef_string_map_append
cef_string_multimap_append
cef_string_list_value
cef_string_list_size
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_free
cef_string_multimap_alloc
cef_string_list_copy
kernel32
CloseHandle
GetProcAddress
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
SetLastError
DecodePointer
EncodePointer
HeapSetInformation
GetStartupInfoW
RaiseException
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapAlloc
IsProcessorFeaturePresent
Sleep
HeapSize
ExitProcess
FreeEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
WideCharToMultiByte
RtlUnwind
HeapReAlloc
InterlockedExchange
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetStdHandle
WriteConsoleW
CreateFileW
FlushFileBuffers
GetCommandLineW
GetProcessHeap
InitializeCriticalSection
GetEnvironmentStringsW
Name
.text
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=97, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=221, productName=VS2013 UPD5 build 40629, version=40629,
count=51, id=171, productName=VS2010 build 30319, version=30319,
count=116, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=230, id=1, productName=Unmarked objects,
count=14, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
libcef.dll
- IMPHASH 0da2469596093a54e0671e7719018e5b
- SHA256 13cdeea780707dca638d01a687a76b234c39a994ed7dc412cc104048bd251cce
- MD5 c32fcef08cc00e0778944892dc7f9260
- SHA1 a346fde7a82db404be61fd3faa7c85514e7fe52f
- SHA512 ef8c385a77275bd1db6aeafe3e30e5191dd484d238284a44e487b04921ff5c8b2cb7919cd828012169f39457cca8a47342494f5e8fe6371630f1cdd74ba25334
- SSDEEP 6144:4QweCToJyeKATOvjhvjnxKBuP5HNyqNNA450CVuWOYq1hYtysW/PAh:4QlMoYdAMVjyosCsOq1hYthWgh
- TLSH T120749D01F480C132D87A24387A79EBB64D6EA8301B2495DFD7E844FAAF245C1D775B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
35782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
FindFirstFileW
FindNextFileW
GetFileSize
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
HeapFree
GetProcessHeap
Sleep
GetCurrentProcessId
ExitProcess
GetCurrentThreadId
CreateProcessW
FindClose
GetSystemInfo
VirtualFree
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertThreadToFiber
CopyFileW
WriteConsoleW
OutputDebugStringW
ReadConsoleW
ReadFile
CreateFileW
CreateDirectoryW
GlobalMemoryStatusEx
GetEnvironmentVariableW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
GetModuleHandleExW
GetCurrentThread
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsThreadAFiber
InitializeCriticalSectionEx
VirtualProtect
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
SetConsoleCtrlHandler
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
DecodePointer
user32
wsprintfW
GetDesktopWindow
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
CrashForException
DumpProcess
DumpProcessWithoutCrash
GetHandleVerifier
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
IsSandboxedProcess
SetCrashKeyValueImpl
TerminateProcessWithoutDump
cef_add_cross_origin_whitelist_entry
cef_add_web_plugin_directory
cef_add_web_plugin_path
cef_api_hash
cef_base64decode
cef_base64encode
cef_begin_tracing
cef_binary_value_create
cef_browser_host_create_browser
cef_browser_host_create_browser_sync
cef_clear_cross_origin_whitelist
cef_clear_scheme_handler_factories
cef_command_line_create
cef_command_line_get_global
cef_cookie_manager_create_manager
cef_cookie_manager_get_global_manager
cef_create_url
cef_currently_on
cef_dictionary_value_create
cef_do_message_loop_work
cef_drag_data_create
cef_enable_highdpi_support
cef_end_tracing
cef_execute_process
cef_force_web_plugin_shutdown
cef_format_url_for_security_display
cef_get_current_platform_thread_handle
cef_get_current_platform_thread_id
cef_get_extensions_for_mime_type
cef_get_geolocation
cef_get_mime_type
cef_get_min_log_level
cef_get_path
cef_get_vlog_level
cef_initialize
cef_is_web_plugin_unstable
cef_launch_process
cef_list_value_create
cef_log
cef_now_from_system_trace_time
cef_parse_csscolor
cef_parse_json
cef_parse_jsonand_return_error
cef_parse_url
cef_post_data_create
cef_post_data_element_create
cef_post_delayed_task
cef_post_task
cef_print_settings_create
cef_process_message_create
cef_quit_message_loop
cef_refresh_web_plugins
cef_register_extension
cef_register_scheme_handler_factory
cef_register_web_plugin_crash
cef_remove_cross_origin_whitelist_entry
cef_remove_web_plugin_path
cef_request_context_create_context
cef_request_context_get_global_context
cef_request_create
cef_resource_bundle_get_global
cef_response_create
cef_run_message_loop
cef_set_osmodal_loop
cef_shutdown
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_stream_reader_create_for_handler
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_string_ascii_to_utf16
cef_string_ascii_to_wide
cef_string_list_alloc
cef_string_list_append
cef_string_list_clear
cef_string_list_copy
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_clear
cef_string_map_find
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_clear
cef_string_multimap_enumerate
cef_string_multimap_find_count
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_alloc
cef_string_userfree_utf16_free
cef_string_userfree_utf8_alloc
cef_string_userfree_utf8_free
cef_string_userfree_wide_alloc
cef_string_userfree_wide_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf16_to_wide
cef_string_utf8_clear
cef_string_utf8_cmp
cef_string_utf8_set
cef_string_utf8_to_utf16
cef_string_utf8_to_wide
cef_string_wide_clear
cef_string_wide_cmp
cef_string_wide_set
cef_string_wide_to_utf16
cef_string_wide_to_utf8
cef_task_runner_get_for_current_thread
cef_task_runner_get_for_thread
cef_time_delta
cef_time_from_doublet
cef_time_from_timet
cef_time_now
cef_time_to_doublet
cef_time_to_timet
cef_trace_counter
cef_trace_counter_id
cef_trace_event_async_begin
cef_trace_event_async_end
cef_trace_event_async_step_into
cef_trace_event_async_step_past
cef_trace_event_begin
cef_trace_event_end
cef_trace_event_instant
cef_translator_test_create
cef_translator_test_object_child_child_create
cef_translator_test_object_child_create
cef_translator_test_object_create
cef_unregister_internal_web_plugin
cef_uridecode
cef_uriencode
cef_urlrequest_create
cef_v8context_get_current_context
cef_v8context_get_entered_context
cef_v8context_in_context
cef_v8stack_trace_get_current
cef_v8value_create_array
cef_v8value_create_bool
cef_v8value_create_date
cef_v8value_create_double
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_uint
cef_v8value_create_undefined
cef_value_create
cef_version_info
cef_visit_web_plugin_info
cef_write_json
cef_xml_reader_create
cef_zip_reader_create
create_context_shared
Name
.text
Size
272KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33145,
count=137, id=261, version=33145,
count=19, id=260, version=33145,
count=21, id=259, version=35207,
count=16, id=260, version=35207,
count=30, id=261, version=35207,
count=7, id=257, version=33145,
count=111, id=1, productName=Unmarked objects,
count=1, id=261, version=35226,
count=1, id=256, version=35226,
count=1, id=255, version=35226,
count=1, id=258, version=35226,
ssl_ciphers.cache
- SHA256 be60cbe82963c129085c67a7fe11a40387cb14d3dbf9af0415b1892c21a82e1c
- MD5 4379186485c737e6ee17869fce659f22
- SHA1 cb4f66424e14e42b6f57fe0bc7e956f2e9ebff54
- SHA512 ac36ec545de4701811e95df6e7f192808dfd238a258383e7bf0b37cb8b3d43808f805840b703a2d4471f4f4b3b615bbf89a8579feb86e4440af899db35afeede
- TLSH T17A21B6AF639E40D5402E464B7F3B625A2FD3A60008DC16FCF7E5411A7918BEA451A817
- MD5 SHA1 SHA512 TLSH