Full_Unboxing_Process_Inspection_Record_71307_2026.zip
- SHA256 3e9c711566a8e0d8dbebcb4fbaab1c395ce519f58efc3d81d58e431966807c72
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AppVIsvSubsystems64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
AppVIsvSubsystems64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Full_Unboxing_Process_Inspection_Record_9862_2026.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target Full_Unboxing_Process_Inspection_Record_71307_2026.zip
- Size 20.1MB
- Sample260808-gy5jnavvhw
- SHA256 3e9c711566a8e0d8dbebcb4fbaab1c395ce519f58efc3d81d58e431966807c72
- MD5 a8fabb0ec0b8636297006c0a06bc5a35
- SHA1 6a5fa9b1e3582d14e6efe9f81b20e53025e25ae5
- SHA512 d4178c288257936901f2ee26b063b2be2bf8151f6c24f94d09c5135f1a7a78ac5c7bab56e1f8c5296057653ddb9a8ef79a7df33c528c13757937bd0d9ff04276
- SSDEEP 393216:+fi756wa9CLDqEdQQxkH8HNHSQu8CdvfILDtt6kowpoMH5mM7q7FABWhMbQw4QEN:+aYwDL3doHuZS4CJfILDWd2Hb7dBGuQJ
- TLSH T14F2733A08FEA30DF4BFC9265DF054F85D949EB1CB357F51A31E9CED5352A01A22C6A80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AppVIsvSubsystems64.dll
File Explorer
-
Full_Unboxing_Process_Inspection_Record_71307_2026.zip.zip 20.1MB
-
AppVIsvSubsystems64.dll.dll 224KB
-
Full_Unboxing_Process_Inspection_Record_9862_2026.exe.exe 1.5MB
-
d3d11_1247e730.bin19.8MB
AppVIsvSubsystems64.dll
- IMPHASH ed24aa1144ce84692defdc546a2b50c2
- SHA256 5e1042421ba29d16c34d686c701cb77cee14ff6c08984c7fa2a9860eea480259
- MD5 ed82975e464d69cd57ded15c354b1024
- SHA1 843fbfb5349e578878a08b68e9cb4b759d26b3e8
- SHA512 9cfd3958dca128def08acd4c77916f6d8a34642cb974f922526e85d5a81bc17d1073d83c33f064ed48259c76f2792ee9b091ee9d2a1136bf510fdf70c2403dbc
- SSDEEP 3072:J+wLCL131+uSoBqFOsrz5tJp2YDNBqNMVrERd0cB+usXy1Y5nudyDC:J+wLCL137kRrf9rJJwd1Y1W
- TLSH T19A247D4477E508B9FD739239C9A34606E6727C120770CADF13A04669AF3B7E0953EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
35328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
EnterCriticalSection
LeaveCriticalSection
GetLocalTime
GetModuleHandleW
GetProcAddress
LoadLibraryW
Sleep
DeleteFileW
SetFileAttributesW
CloseHandle
WaitForSingleObject
CreateEventW
CreateProcessW
VirtualProtect
AddVectoredExceptionHandler
GetCurrentProcessId
GetCurrentThread
OpenThread
GetThreadContext
SetThreadContext
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetModuleHandleExW
CreateFileW
ReadFile
WriteFile
GetLastError
ConnectNamedPipe
CreateNamedPipeW
CreateThread
GetModuleFileNameW
HeapAlloc
InitializeCriticalSection
GetProcessHeap
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
OpenProcess
GetSystemDirectoryW
Process32FirstW
Process32NextW
CreateDirectoryW
GetFileAttributesW
GetFileSizeEx
GetExitCodeProcess
IsDebuggerPresent
CheckRemoteDebuggerPresent
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcess
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
GetTickCount64
GetComputerNameW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
VirtualFree
WriteConsoleW
SetEndOfFile
ReadConsoleW
HeapReAlloc
HeapSize
FlushFileBuffers
HeapFree
GetTempPathW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
InterlockedFlushSList
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
DeleteCriticalSection
ExitProcess
TerminateProcess
FreeLibrary
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetFilePointerEx
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExW
LCMapStringW
SetStdHandle
GetConsoleOutputCP
GetConsoleMode
GetStringTypeW
user32
GetWindowTextW
IsWindowVisible
GetWindowThreadProcessId
GetShellWindow
FindWindowW
EnumWindows
advapi32
GetUserNameW
APIExportForDetours
CurrentThreadIsVirtualized
DllRegisterServer
GetPhysicalPath
IsProcessHooked
RequestUnhookedFunctionList
VirtualizeCurrentProcess
VirtualizeCurrentThread
Name
.text
Size
136KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.labcrc
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=147, id=261, version=33145,
count=12, id=260, version=33145,
count=6, id=259, version=33145,
count=9, id=259, version=35721,
count=16, id=260, version=35721,
count=35, id=261, version=35721,
count=7, id=257, version=33145,
count=135, id=1, productName=Unmarked objects,
count=1, id=259, version=36252,
count=30, id=261, version=36252,
count=1, id=256, version=36252,
count=1, id=258, version=36252,
Full_Unboxing_Process_Inspection_Record_9862_2026.exe
- SHA256 afdb4a8384812e907a73b59df0fb303af2ba94994b5f4bbb66a51ce2b04e7c32
- MD5 11e550124454f08d2c9572d518380644
- SHA1 140500ac9e396e89507e376f4bf1802da832b1bd
- SHA512 bbb5e96c228be5e9ce572697df39a3a066e45c595517635f7d27f5f73fd474431504cc44fe01f56ad7ad2fc6cc03c8fdfc74f551dbd547129aa5c40ef30bc70a
- SSDEEP 6144:JMQK6Gi1ti6FzyDW1T3yDW1TjkAzkAZqrEdrEAZUCwFjNNaY9Sb:JMz6Gi1gk6kfNPqrEdrEqb
- TLSH T17A751E03F63AFCAAF96D3CF1D888DE902C0F3C5A8A8779613976FA5ED5331916600255
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
be:6a:9a:c1:83:05:ec:23:4b:87:a3:6f:6f:c7:68:a2:66:b0:5c:86:88:39:59:59:4d:35:df:6f:d2:9f:79:13
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 13, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
be:6a:9a:c1:83:05:ec:23:4b:87:a3:6f:6f:c7:68:a2:66:b0:5c:86:88:39:59:59:4d:35:df:6f:d2:9f:79:13
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 13, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 23, 2026 - Apr 21, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 13, 2025 - Nov 10, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Minor OS version
1
Major OS version
6
Entry point
6288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\dbs\el\omr\Target\x64\ship\postc2r\x-none\winword.pdb
DllGetLCID
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.c2r
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=257, version=35207,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=28, id=261, version=35207,
count=3, id=257, version=33145,
count=119, id=1, productName=Unmarked objects,
count=19, id=270, version=35214,
count=1, id=256, version=35214,
count=1, id=255, version=35214,
count=2, id=151,
count=1, id=258, version=35214,
d3d11_1247e730.bin
- SHA256 c488c4d6cc1e87c37f51bebc3aa183182048c9ae0fc85d1cbf932649b25cba7c
- MD5 ec56262a3d77f02c1e9e39705a827203
- SHA1 de715598a826f5f184266ad62800226059e3974a
- SHA512 d220d89e17693e3b54690f9e50addc554c9e8285208426c9285e7c2bb95c29ca804d23e02510add078b0b22f06e843f75d79dc9c2ba09ea92acc5e1e9cc49cc7
- SSDEEP 393216:E+I40GvlvL3y0NYYXAdcjtTUuiy254/sh+1c+II0GvlvLry0NYYXAdcjtTUuiy0Z:EnGFLBNKdsFU62csg1c/GFLFNKdsFU6Y
- TLSH T1872733A8AF9A21CD1FB84366DF034EC5EAC7EB1AB25BA51631E5CDD3253B00573C5680
- MD5 SHA1 SHA512 SSDEEP TLSH