0Tramxygit_pqygaj.523677ZJSPJ.iso
- SHA256 9cff99340825973883bfebb79264a463470d84d8e7fb13db85fa9b6808f2b98c
Overview
overview
9Static
static
3_Serie-719...hk.vbs
windows10-2004-x64
9_Serie-719...hk.vbs
windows11-ltsc_2024-x64
9~/abftq2.dll
windows10-2004-x64
3~/abftq2.dll
windows11-ltsc_2024-x64
3~/necg1.dll
windows10-2004-x64
1~/necg1.dll
windows11-ltsc_2024-x64
1~/sbvsd/cb...k2.pdf
windows10-2004-x64
3~/sbvsd/cb...k2.pdf
windows11-ltsc_2024-x64
3~/sbvsd/cb...z1.pdf
windows10-2004-x64
3~/sbvsd/cb...z1.pdf
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
_Serie-71963-CMBKJScktoqe.FFIOMProcpxlhk.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
_Serie-71963-CMBKJScktoqe.FFIOMProcpxlhk.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
~/abftq2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
~/abftq2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
~/necg1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
~/necg1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
~/sbvsd/cbgyxj/lnrdl/picmsk/isdok2.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
~/sbvsd/cbgyxj/lnrdl/picmsk/isdok2.pdf
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
~/sbvsd/cbgyxj/lnrdl/picmsk/pahabz1.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 0Tramxygit_pqygaj.523677ZJSPJ.iso
- Size 5.3MB
- Sample260808-plndls1shw
- SHA256 9cff99340825973883bfebb79264a463470d84d8e7fb13db85fa9b6808f2b98c
- MD5 fee5c4ce1be82752265349da9b2e03d4
- SHA1 b16b0950051f5a6314d5fc843d1377e8edce26de
- SHA512 e035d2ee5d4d2e8715d6656c0442cd03f19ca44272b1643568a87f04c1c7a1ec8bef2835ad3f9127fab098e73b5c5165850b34e0736ff438a6ac2e8036d422a7
- SSDEEP 49152:rf06GFmqF5yMCYk8pMsv1ekppfcYvQySutQ/cELEOpIVzvpix6yL3l/txM0bSSJF:P
- TLSH T1914623336F65196FC970533AB02F29327F7E541B424CDAE6AD5CA1013F8B1C5863B4AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
File Explorer
-
0Tramxygit_pqygaj.523677ZJSPJ.iso.iso 5.3MB
-
out.iso.iso 5.3MB
-
_Serie-71963-CMBKJScktoqe.FFIOMProcpxlhk.vbs4.8MB
-
~/abftq2.xml.dll 13KB
-
~/necg1.xml.dll 21KB
-
~/sbvsd/cbgyxj/lnrdl/picmsk/isdok2.pdf.pdf 24KB
-
~/sbvsd/cbgyxj/lnrdl/picmsk/pahabz1.pdf.pdf 37KB
out.iso
- SHA256 9cff99340825973883bfebb79264a463470d84d8e7fb13db85fa9b6808f2b98c
- MD5 fee5c4ce1be82752265349da9b2e03d4
- SHA1 b16b0950051f5a6314d5fc843d1377e8edce26de
- SHA512 e035d2ee5d4d2e8715d6656c0442cd03f19ca44272b1643568a87f04c1c7a1ec8bef2835ad3f9127fab098e73b5c5165850b34e0736ff438a6ac2e8036d422a7
- SSDEEP 49152:rf06GFmqF5yMCYk8pMsv1ekppfcYvQySutQ/cELEOpIVzvpix6yL3l/txM0bSSJF:P
- TLSH T1914623336F65196FC970533AB02F29327F7E541B424CDAE6AD5CA1013F8B1C5863B4AA
- MD5 SHA1 SHA512 SSDEEP TLSH
_Serie-71963-CMBKJScktoqe.FFIOMProcpxlhk.vbs
- SHA256 c011a552081dead8ee59da97d6c7004c179a58fcfe2fdfa11967b6502bc295b9
- MD5 24a867144db4f4f1718624294c9d3021
- SHA1 61ccb5e79d06ceee00c73ab988800b82b38fb58a
- SHA512 cc518898cf525cfc3d706912c65aae61c77f46ea79ae4eacce0eaa3efb7ffb10eadbb09dd14630665cac76ec64603c6f8e35cf1aa2a73a5d1f5ca5da184a0758
- SSDEEP 49152:cf06GFmqF5yMCYk8pMsv1ekppfcYvQySutQ/cELEOpIVzvpix6yL3l/txM0bSSJZ:8
- TLSH T10F3623336E79196F0970532EB02F2D727F7E440B820CDAA6CD89A115399B1D5873F4EA
- MD5 SHA1 SHA512 SSDEEP TLSH
~/abftq2.xml
- IMPHASH ee7cb4a1dbc04570233ef522c5ab5b76
- SHA256 028c2b444ec7abddb13448c13317d1e26d7a644c65e2371d9115e1b9eff96daa
- MD5 3db8784dfca11580984cf02855fb7841
- SHA1 55060b31427329fe742e51bbda6016feb068e489
- SHA512 81e592ada2da41e0191d599a526dfaba16a8ff3a8fdcbad21782fac953b0389a8e611337c36286f40bb745698330ab5be7b177ea1f047ad388a216c644dade74
- SSDEEP 192:8tvlddaSH5orWy3XLPVlD6zb1EmAnyowJL/Zrwmg+vMXNkr9ZCspE+TMUrnoG:8dP4We7PVlOFMYJL+mcXfeMsoG
- TLSH T14752094B2F145422DEC85FB084E6D22E8E7AB3921FC950F720B585C96EDABF1272454F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
72:ce:8b:58:a8:cb:21:ec:2f:c9:15:0b:21:d2:a4:e8:bb:55:1d:07
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Chains
Mar 30, 2012
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Serial Number
15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 15, 2010 - Dec 14, 2012
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
5
Entry point
5635
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\ai\cs6\dev\symbols\32\win\release\SPBasic\SPBasic.pdb
msvcr100
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
kernel32
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
EncodePointer
SPBasicAcquireSuite
SPBasicAllocateBlock
SPBasicFreeBlock
SPBasicIsEqual
SPBasicReallocateBlock
SPBasicReleaseSuite
SPBasicUndefined
SPSubAllocateBlock
SPSubFreeBlock
SPSubReallocateBlock
SetUpBasicFuncs
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=30, id=1, productName=Unmarked objects,
count=3, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
~/necg1.xml
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1d1636ff8d193f883b181efac6d7d5404d8dc1a51027f318f82e1437699d68db
- MD5 9c6571a544b026eda6bfd3d76d91949b
- SHA1 af4a8df59d302ad80e18b044aeed80162ba1019d
- SHA512 eab0211d2ce863babaddd568f09c15b1c564a2df4d98b3925a1a72238cb40e17538f9b2b70adb6021414ac7514a567539a80c99940dccbb18eded5bd80141c03
- SSDEEP 384:HMjVatFafETT5bw/HcqS8QTAm+d6NSIYisgTty8RbmL4nNyBxd:A0db/2FMN/YiJB5ALNd
- TLSH T1BBA27E694BA86537CDAB0F3078D1D2124BBA77893EA2D1C7700CC4465F833965AD73EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
66:eb:9c:96:6f:7e:77:13:ed:39:5b:05:38:4f:59:c5:ea:62:b5:65:df:6e:30:83:3e:0d:a1:06:aa:93:c7:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=5280394,CN=Dell Technologies Inc.,OU=Client Software,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Apr 25, 2026
SERIALNUMBER=5280394,CN=Dell Technologies Inc.,OU=Client Software,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=5280394,CN=Dell Technologies Inc.,OU=Client Software,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=5280394,CN=Dell Technologies Inc.,OU=Client Software,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
03:31:fb:55:cf:5c:96:35:fa:e0:fc:8c:76:60:fa:be
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 5, 2025 - Nov 4, 2026
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
17138
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\home\runner\_work\asimov\asimov\Source\Execution\Execution\obj\Release\Execution.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
~/sbvsd/cbgyxj/lnrdl/picmsk/isdok2.pdf
- SHA256 dcd115f95c3bd1ae2ee4479c9dcaf96391f900845d21844e546bc2e3b1c469f5
- MD5 172e9ca72d015f8da1fe7ec3acb0b3e5
- SHA1 7a7df7c38364e6f006256b9432def2d04325cfa1
- SHA512 9782ccdf04706c30a10cc8acf9f72435f5a1a2040dd794e3296f814bb0cc8dee5bdab11b274877602978ee234068e437e75b23c4ebac30fe3a52e95eed8a3c61
- SSDEEP 384:Lcr1BdEQDCpLjmlx8eUBgUntKKc82JFThmp9rd5XD06lgmUHKzba9xLRf:Lcr17DCpPm38e6jcTJF4p946lPk
- TLSH T1DDB2B0834C494D67E4F18790BF13EF0E5B6A7E84714B7BE720A398C57B249C25C1925E
- MD5 SHA1 SHA512 SSDEEP TLSH
~/sbvsd/cbgyxj/lnrdl/picmsk/pahabz1.pdf
- SHA256 cd815bfbc4c8d41909268c43d76b4a47cf041004faac32fc2d8de24edceb0685
- MD5 73697ef5f26f094fa1e86c7f7b61f933
- SHA1 749045ba2138dc277f3b7c45d41697b0efaf48f1
- SHA512 28edeebbfeccbacaf9e353a99b77b688e0fddd2abf9be0e48641063545434a6047dce827fbf1dfbd2bca7791225c0c472dcc1c7ee9b6994300f18fe0793d50d8
- SSDEEP 768:JRRTo0irYoFD/2i3BjdqCP2tFi5M17e8uh9VN2ZWJ4325hCYs9:TKHNd3Bj5P2tGCe8aOj9
- TLSH T18C03AD174E02958DD49595D2BEAF786C8B0EB73A79C878CA3C2C0D839F40898EC5F563
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
file http://bardahl.com.ar