voicemail[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
voicemail.exe
Size 14.1MB
Sample260806-g2dkcavdmc
SHA256 2eb291bcf22a1e0bb5c2b7814a71f958979b2f48b014ea7ab19623a62e8ef39f
MD5 441b9eb8edfc18185e2d6a0ad4da6c60
SHA1 506e006dfdc6ebd2c764cad40f5ad671a00b2f60
SHA512 2be6c0ec81645c825341da1d2b17f6267d502be4dfcb1b1645c3f50bdb022e7034d5cef2782d3aa260d2af1a1f857317e62467312a855530c9a68717fa06c523
SSDEEP 393216:/IF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1m:crRxvoC/7a0jUxX7h1m
TLSH
T131E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

installer

Malware Config

Signatures

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

voicemail.exe

.exe 14.1MB

voicemail.exe

IMPHASH 0c40996f6e1e5f2a82b51e9950881bf1
SHA256 2eb291bcf22a1e0bb5c2b7814a71f958979b2f48b014ea7ab19623a62e8ef39f
MD5 441b9eb8edfc18185e2d6a0ad4da6c60
SHA1 506e006dfdc6ebd2c764cad40f5ad671a00b2f60
SHA512 2be6c0ec81645c825341da1d2b17f6267d502be4dfcb1b1645c3f50bdb022e7034d5cef2782d3aa260d2af1a1f857317e62467312a855530c9a68717fa06c523
SSDEEP 393216:/IF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1m:crRxvoC/7a0jUxX7h1m
TLSH
T131E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

Digest

8a:0f:f6:16:f4:3f:98:66:27:cc:66:d4:df:bc:1d:cd:f1:22:de:91:a3:ff:5d:17:d8:fe:a2:27:c9:aa:84:a9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB

Chains

Feb 9, 2026

CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB

Serial Number

06:bb:42:3e:09:9e:ad:00:d3:d5:5b:f1:d3:72:c7:73

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 6, 2024 - Apr 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

73190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep MultiByteToWideChar WideCharToMultiByte CompareFileTime FindClose FindFirstFileW GetFileAttributesW GetLastError CreateDirectoryW ExpandEnvironmentStringsW lstrlenA WriteFile GetStdHandle lstrcmpW GetSystemTimeAsFileTime lstrlenW RemoveDirectoryW FindNextFileW DeleteFileW VirtualAlloc VirtualFree GetACP GetOEMCP GetUserDefaultUILanguage GetUserDefaultLCID GetTempPathW SetEnvironmentVariableW SetCurrentDirectoryW CloseHandle lstrcmpiW GetModuleFileNameW CreateThread GetVersionExW CreateFileW GetDriveTypeW GetModuleHandleW GetProcAddress LoadLibraryA MulDiv GetSystemDirectoryW TerminateThread ResumeThread SuspendThread LocalFree lstrcpyW FormatMessageW DeleteCriticalSection GetFileSize SetFilePointer ReadFile SetFileTime SetEndOfFile LeaveCriticalSection EnterCriticalSection WaitForMultipleObjects CreateEventW SetEvent ResetEvent InitializeCriticalSection GetModuleHandleA WaitForSingleObject GetExitCodeThread GetLocalTime SystemTimeToFileTime GetCommandLineW SetFileAttributesW GetStartupInfoA

user32

CharUpperW GetWindowLongW wsprintfW wsprintfA MessageBoxA GetKeyState SendMessageW wvsprintfW KillTimer GetSystemMenu EnableMenuItem SetTimer GetWindowTextW DefWindowProcW CallWindowProcW GetWindowDC DrawIconEx MessageBeep DialogBoxIndirectParamW GetWindow GetParent GetClientRect ClientToScreen GetWindowTextLengthW SetWindowPos GetDC DrawTextW ReleaseDC ShowWindow GetWindowRect ScreenToClient LoadIconW LoadImageW SetWindowLongW SetDlgItemTextW SystemParametersInfoW GetSystemMetrics GetDlgItem SetFocus EndDialog SetWindowTextW

gdi32

DeleteObject SelectObject GetDeviceCaps GetObjectW CreateFontIndirectW

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc ShellExecuteW ShellExecuteExW SHGetSpecialFolderPathW SHGetFileInfoW

ole32

CoCreateInstance CoInitialize

oleaut32

SysAllocString VariantClear

msvcrt

__set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ??1type_info@@UAE@XZ _onexit __dllonexit _except_handler3 _beginthreadex _CxxThrowException _purecall memset _wcsnicmp malloc free _wtol memcpy memmove memcmp __CxxFrameHandler ??3@YAXPAX@Z ??2@YAPAXI@Z _controlfp

Sharing

General

Malware Config

Signatures

File Explorer

voicemail.exe

kernel32

user32

gdi32

shell32

ole32

oleaut32

msvcrt

generic