0DocuFM79O_FFOXK_yrxgccORQGC.iso
- SHA256 6d459830f69a25b4647288e35eaad9d494ddca369ed776592c171c105bd17d4f
Overview
overview
9Static
static
3_Vrfc17074...rv.vbs
windows10-2004-x64
9_Vrfc17074...rv.vbs
windows11-ltsc_2024-x64
9~/arexn2.exe
windows10-2004-x64
3~/arexn2.exe
windows11-ltsc_2024-x64
3~/gmibpo1.dll
windows10-2004-x64
3~/gmibpo1.dll
windows11-ltsc_2024-x64
3~/kgeap/io...p2.pdf
windows10-2004-x64
3~/kgeap/io...p2.pdf
windows11-ltsc_2024-x64
3~/kgeap/io...l1.pdf
windows10-2004-x64
3~/kgeap/io...l1.pdf
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
_Vrfc170749TTSEQ_7105-bbjtb.Serv.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
_Vrfc170749TTSEQ_7105-bbjtb.Serv.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
~/arexn2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
~/arexn2.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
~/gmibpo1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
~/gmibpo1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
~/kgeap/iodrsi/ynrp/ahhah/ryylp2.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
~/kgeap/iodrsi/ynrp/ahhah/ryylp2.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
~/kgeap/iodrsi/ynrp/ahhah/ytucl1.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 0DocuFM79O_FFOXK_yrxgccORQGC.iso
- Size 9.3MB
- Sample260808-ake9aaag24
- SHA256 6d459830f69a25b4647288e35eaad9d494ddca369ed776592c171c105bd17d4f
- MD5 2b42b3a1492b5a2120729aa9270040d3
- SHA1 a73cf2f6ca0459b298b0afef912b17faebe637a1
- SHA512 f7caafcb9fa71dabc4c322577315403754c0137d7b992c5a36f7820f812ea16fd2c194d9a6360485f42453afc669b4c47db7bdf0f83b3875b41842b6b839eade
- SSDEEP 49152:vuVsuDDngy/dvHw3tvpGpWzxwymSt7pgVdY72XyKO/TrP8S+5kHXi/NoqPGJYTz5:
- TLSH T19AA63331AE955C2BC564B336F02F2B362F3F5907458CB356659CA17233BB786422E86C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
File Explorer
-
0DocuFM79O_FFOXK_yrxgccORQGC.iso.iso 9.3MB
-
out.iso.iso 9.3MB
-
_Vrfc170749TTSEQ_7105-bbjtb.Serv.vbs8.8MB
-
~/arexn2.xml.exe 37KB
-
~/gmibpo1.xml.dll 40KB
-
~/kgeap/iodrsi/ynrp/ahhah/ryylp2.pdf.pdf 66KB
-
~/kgeap/iodrsi/ynrp/ahhah/ytucl1.pdf.pdf 30KB
out.iso
- SHA256 6d459830f69a25b4647288e35eaad9d494ddca369ed776592c171c105bd17d4f
- MD5 2b42b3a1492b5a2120729aa9270040d3
- SHA1 a73cf2f6ca0459b298b0afef912b17faebe637a1
- SHA512 f7caafcb9fa71dabc4c322577315403754c0137d7b992c5a36f7820f812ea16fd2c194d9a6360485f42453afc669b4c47db7bdf0f83b3875b41842b6b839eade
- SSDEEP 49152:vuVsuDDngy/dvHw3tvpGpWzxwymSt7pgVdY72XyKO/TrP8S+5kHXi/NoqPGJYTz5:
- TLSH T19AA63331AE955C2BC564B336F02F2B362F3F5907458CB356659CA17233BB786422E86C
- MD5 SHA1 SHA512 SSDEEP TLSH
_Vrfc170749TTSEQ_7105-bbjtb.Serv.vbs
- SHA256 1debdf6c9ad90caca19643b53030e347cff8ac4e02cfbda8d39cc4d409bd83cc
- MD5 66579ecdb13c85a7cfcf2b787e349165
- SHA1 795958df0d757e5d111e3a4c50ef65db600dbff3
- SHA512 17923d8aa6215853d6668f4e099b6459d77f2fb9769f044493c24a48577f7500989e0bbf509e514982e5b6606d4c5825fa5f78364f3da7e2032e057bec9ff43e
- SSDEEP 49152:2uVsuDDngy/dvHw3tvpGpWzxwymSt7pgVdY72XyKO/TrP8S+5kHXi/NoqPGJYTzs:q
- TLSH T1E5963331AEA95D3F0674C33AF02F2F362F7D5D07854DD36685D4B152329B686822F8A8
- MD5 SHA1 SHA512 SSDEEP TLSH
~/arexn2.xml
- IMPHASH c7c9f5923fc7322ad9f471dc1289d09f
- SHA256 e4792f1204c8c7d91988a4664fac0cb8dedbdd5f92f704dd3562c57f20c8fecc
- MD5 58b1e6b6e1ce8bdd8258ac4130f02cdf
- SHA1 da683c1693a634ff31729ed39a3789f6157db50a
- SHA512 a380d6474c20ba65a8ff45865d8ce681b8a35936f917ea2e9e49c8c58b02ef89a87ada78b467fb231d60c6471faac5dad154e1c0d1bf0a1cb5270c21648e2fcc
- SSDEEP 384:LD5yB+ftE/KWZdUt7tNmeYCMhou+2vO4T2erZIEAl9B9N/EDHZub0nuw9jas1mP/:LthNqRhpO4T2eyXED5uAnl9meNTLJM
- TLSH T1E6034A0376919036E8960B3064B4D5725E3B75816EF4808F276882BE6FB27D05FBC39B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
d0:88:5e:97:5e:93:6b:79:8f:42:00:37:ab:5a:7a:b4:c3:83:7c:1e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Chains
Mar 13, 2012
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Serial Number
15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 15, 2010 - Dec 14, 2012
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
5
Entry point
5413
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CopyFileA
DeleteFileA
SetFileAttributesA
GetFileAttributesA
Wow64DisableWow64FsRedirection
GetLastError
MoveFileA
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapFree
Sleep
RtlUnwind
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapAlloc
HeapReAlloc
IsProcessorFeaturePresent
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=158, productName=VS2010 build 30319, version=30319,
count=57, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=68, id=1, productName=Unmarked objects,
count=11, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
~/gmibpo1.xml
- IMPHASH 6c8408bb5d7d5a5b75b9314f94e68763
- SHA256 329d2ae45f5f617899f366e6fe3a5ed649242415ca5ad47d9b641ec9831a7d2b
- MD5 8fe7411ec894be1cfd91b165155ff72a
- SHA1 55453dbe13d91f55e1a40fa25663d1f16ecc6d48
- SHA512 7fd0abcae5f0cddecd8a17625b9e80787c26e60c2414b3448603a953e32e2d7537d910b0e66f7e45b45525457e5d113a5f44136532e6543f3df266a17b4fd6bd
- SSDEEP 384:yixv7hdVexaDywGfJssxNyEIYi2mL4/y8RLVHLXbZmt/:R9NM1uYiDLk5/fm/
- TLSH T15F134F714A50CDDCEB22FE32A24E0D3E5663E6C055E473532098A470AAB9352DB5EF7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
72:be:74:ec:c8:43:32:b1:9d:bd:a0:8f:bc:70:4c:98:a6:25:68:35:08:74:ae:61:0a:d9:03:71:bc:6e:d9:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US
Chains
Jul 17, 2026
CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
0e:98:2f:dd:f0:6e:93:e9:11:06:5d:03:7d:4d:d4:82
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 28, 2024 - Aug 6, 2027
Minor OS version
1
Major OS version
5
Entry point
4820
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
goopdateres_unsigned_iw.pdb
kernel32
DisableThreadLibraryCalls
Name
.text
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
106B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=260, version=33808,
count=3, id=257, version=30795,
count=6, id=1, productName=Unmarked objects,
count=1, id=265, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=258, version=34123,
~/kgeap/iodrsi/ynrp/ahhah/ryylp2.pdf
- SHA256 936d01473a6c7f311e785caa002eb3ae7ad762209b75ccfbcb48d93bf3d3a3db
- MD5 64071ca7bad7e1347c14b86c820b69c9
- SHA1 dcfc9411e189c16f9c62af3453d156a6b35b3934
- SHA512 6220a8dc812c46115da42408854655bcc0d7096233bdc0427c2876a4e2b6c746dd4a774d70505d5520a6248f4c632effa95b18c611889c98a604a180c6944d06
- SSDEEP 1536:eyUqg6i8nMs7vDTyqQTplW7JAyTFOw/9+/xgVF0pn8XeHKS7H:j+Ls8lWNd/wxqmpnLHLT
- TLSH T14263F1507E2DFB70D194DBF90BA62D53A65E386706DCBB82056C800BAA11F4DB489B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
file http://gmail.com
~/kgeap/iodrsi/ynrp/ahhah/ytucl1.pdf
- SHA256 ff72cd03e0c3d3bec32f3d9d417d9df229e050e136b2361356b55426599ce25e
- MD5 b24fe88ff3e2360ffdfa0363b3b596a9
- SHA1 8fd4b04043d1a73b7440c78d9076cb0cbef31f5b
- SHA512 456ff104101567efc9b7d6befc9b77f8e0f638a943b7b938b237c629e60f3db432bc5cdced5482df6daed757b8cea9db7b087d31d7ae54b27d4a09c0e1967434
- SSDEEP 384:zHkou43a4Byyu5f0bW6EIy4jrG70ClGNNGmuGkvJ9dmUWMNv5itbFoIdcV8fXoQZ:kqm14jq70RNkGwJI
- TLSH T1FBD2820DF245B9A0D41147E15F383679657F73286CCA6A905DA3C72BEA018EB3B7CC82
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
file http://bardahl.com.ar