08a7ddd0bb5b63987d81401e90d5d7e190b1ed8cbe22edbf89eeeda16944598c

Sharing

Copy URL Twitter E-mail

General

Target
08a7ddd0bb5b63987d81401e90d5d7e190b1ed8cbe22edbf89eeeda16944598c
Size 1.3MB
Sample260809-eg6z2sgf34
SHA256 08a7ddd0bb5b63987d81401e90d5d7e190b1ed8cbe22edbf89eeeda16944598c
MD5 6d64f751a0147da292b14834c8f50bbc
SHA1 1c78b60bdef1bd51f57cc2db36c724d70b6bd828
SHA512 7984191a6c841d5f005a7816fd273f15dd8e351ced6dd47c0248a0cbf2b90ceb1d3f7a6de1638684f35b48e8d2c885e3e77736ec375dc5eed805e59a0af8c9d0
SSDEEP 24576:KBAMLGG/LeIG38VB+TtayJVJEWv72xKSfW:kGG23PNJ7EySxq
TLSH
T11F55E552B7F9C95CF0B26A316BB653C4697AFC20BE30CA5F2550B64E15B1A90CD34B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
08a7ddd0bb5b63987d81401e90d5d7e190b1ed8cbe22edbf89eeeda16944598c

File Explorer

08a7ddd0bb5b63987d81401e90d5d7e190b1ed8cbe22edbf89eeeda16944598c

.exe 1.3MB

08a7ddd0bb5b63987d81401e90d5d7e190b1ed8cbe22edbf89eeeda16944598c

IMPHASH 617946879ebfcc9c6f6c14ce5622b3b2
SHA256 08a7ddd0bb5b63987d81401e90d5d7e190b1ed8cbe22edbf89eeeda16944598c
MD5 6d64f751a0147da292b14834c8f50bbc
SHA1 1c78b60bdef1bd51f57cc2db36c724d70b6bd828
SHA512 7984191a6c841d5f005a7816fd273f15dd8e351ced6dd47c0248a0cbf2b90ceb1d3f7a6de1638684f35b48e8d2c885e3e77736ec375dc5eed805e59a0af8c9d0
SSDEEP 24576:KBAMLGG/LeIG38VB+TtayJVJEWv72xKSfW:kGG23PNJ7EySxq
TLSH
T11F55E552B7F9C95CF0B26A316BB653C4697AFC20BE30CA5F2550B64E15B1A90CD34B23
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

62:aa:a3:cb:f7:e8:af:5a:5b:4b:b6:79:1c:93:1e:c4:84:f7:e7:44:eb:f3:b9:98:80:58:8a:b1:f0:04:33:35

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 19, 2026

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Oct 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

261936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\user\Desktop\winfile\src\x64\Release\Winfile.pdb

kernel32

GetEnvironmentVariableW GetSystemDirectoryW GlobalAlloc GlobalFree SetCurrentDirectoryW GetProcAddress GlobalLock FreeLibrary GlobalUnlock GetShortPathNameW SetFileAttributesW DeleteFileW CreateThread IsDBCSLeadByte GetModuleHandleW WideCharToMultiByte MoveFileW GetUserDefaultLCID FileTimeToSystemTime GetNumberFormatW FileTimeToLocalFileTime GetTimeFormatW GetDateFormatW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent DeleteCriticalSection GetVolumeInformationW GetCompressedFileSizeW LocalFileTimeToFileTime VerLanguageNameW ExpandEnvironmentStringsW ExitThread CloseHandle WriteFile GetTempPathW GetFileInformationByHandle CreateDirectoryExW SetThreadPriority GetCurrentThreadId Sleep SwitchToThread SetErrorMode GetCurrentThread ResetEvent ExitProcess GetDriveTypeW SizeofResource SetThreadLocale GetPrivateProfileIntW GetThreadLocale SetThreadUILanguage GetLocaleInfoW GetVersionExW FreeResource LoadLibraryW LoadResource FindResourceW GetCurrentDirectoryW MulDiv LocalUnlock LocalSize CompareFileTime GetTickCount GetCommandLineW GetLastError FindNextChangeNotification FindCloseChangeNotification FindFirstChangeNotificationW LocalReAlloc GetProfileStringW WriteProfileStringW lstrcmpW lstrcatW CompareStringW lstrcmpiW GetPrivateProfileStringW MultiByteToWideChar GetModuleFileNameW WritePrivateProfileStringW FormatMessageW GetProcessHeap HeapAlloc HeapFree CopyFileExW lstrcpyW CopyFileW SystemTimeToFileTime LocalFree GetFileAttributesW CreateFileW LocalAlloc QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter FindClose CreateHardLinkW RemoveDirectoryW DeviceIoControl lstrlenW FindNextFileW GetFullPathNameW SetLastError FindFirstFileExW FindFirstFileW GetDiskFreeSpaceExW GetStartupInfoW CreateDirectoryW

gdi32

GetStockObject GetLayout SetLayout CreateCompatibleDC CreateDIBitmap CreateFontW GetDeviceCaps DeleteDC SetBkMode GetObjectW CreateFontIndirectW TextOutW PatBlt GetTextExtentPoint32W ExtTextOutW BitBlt SelectObject GetTextMetricsW SetTextColor SetBkColor DeleteObject CreateSolidBrush

user32

DestroyWindow GetFocus GetMenu GetMenuState EnableWindow IsIconic ReleaseCapture PtInRect SetRect CharUpperBuffW SetCursor SetCapture TranslateMessage TranslateAcceleratorW IntersectRect FrameRect DragObject PeekMessageW ClientToScreen TranslateMDISysAccel DispatchMessageW GetCapture MessageBeep InflateRect PostMessageW CharLowerW GetKeyState GetMessageW GetWindowTextW DialogBoxParamW CharNextW SendDlgItemMessageW GetDlgItemTextW SetDlgItemTextW SetWindowTextW MessageBoxW CharUpperW GetWindowTextLengthW MsgWaitForMultipleObjects ShowCursor KillTimer CheckMenuItem SetClipboardData InsertMenuW LoadCursorW WinHelpW EmptyClipboard CloseClipboard SetTimer OpenClipboard SetActiveWindow RegisterClipboardFormatW CreateDialogParamW DrawIconEx IsWindow GetDC GetDesktopWindow SystemParametersInfoW CheckDlgButton DestroyMenu IsDlgButtonChecked TrackPopupMenu GetWindowPlacement LoadMenuW OffsetRect SetWindowPos GetDoubleClickTime DrawMenuBar DeleteMenu SetForegroundWindow IsDialogMessageW RedrawWindow CallWindowProcW DestroyIcon RegisterWindowMessageW LoadIconW SetWindowsHookW LoadAcceleratorsW GetMenuItemCount InsertMenuA GetMenuItemID GetLastActivePopup DefMDIChildProcW GetActiveWindow SetCursorPos SetWindowLongW DrawIcon GetScrollPos InternalGetWindowText wvsprintfW PostQuitMessage DefFrameProcW CallNextHookEx GetSystemMenu GetSystemMetrics GetClassNameA GetWindowLongPtrW BeginDeferWindowPos RegisterClassW MapWindowPoints MoveWindow RegisterClassA GetUpdateRect GetClassNameW EndDeferWindowPos GetClientRect FillRect CreateWindowExW GetSubMenu IsWindowUnicode GetParent DrawFrameControl InvalidateRect BeginPaint ShowWindow DrawFocusRect GetSysColor SetFocus GetMenuStringW GetDlgItem DrawTextW EnableMenuItem UpdateWindow ReleaseDC GetWindowLongW DeferWindowPos DefWindowProcW GetWindow EndDialog EnumChildWindows SetWindowLongPtrW ScreenToClient GetCursorPos EndPaint LoadStringW wsprintfW SendMessageW GetWindowRect

advapi32

RegSetValueW RegQueryValueExW RegOpenKeyW RegOpenKeyExW RegEnumKeyExW RegFlushKey RegQueryValueW RegDeleteKeyW RegEnumKeyW RegCloseKey

oleaut32

VarDateFromStr VariantTimeToSystemTime

ole32

RegisterDragDrop OleGetClipboard ReleaseStgMedium CoLockObjectExternal RevokeDragDrop OleInitialize OleUninitialize

shell32

ShellExecuteExW ord42 ShellExecuteW ExtractIconExW DragQueryFileW ord66 SHFormatDrive

shlwapi

PathFileExistsW PathAppendW PathFindExtensionW StrCpyNW PathIsDirectoryW StrChrW StrRChrW

comctl32

CreateToolbarEx CreateStatusWindowW ord4 ord2

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

__current_exception_context memmove __current_exception memset wcsrchr __std_exception_destroy __std_exception_copy wcsstr __C_specific_handler _CxxThrowException memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vswprintf_s __p__commode __stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcsncpy_s wcscpy_s _wcsicmp wcsncat_s tolower wcslen wcstok_s _wcslwr_s wcsncmp strcmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc _callnewh malloc free

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit terminate _seh_filter_exe _set_app_type _initialize_onexit_table _configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _register_thread_local_exe_atexit_callback _cexit _c_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

08a7ddd0bb5b63987d81401e90d5d7e190b1ed8cbe22edbf89eeeda16944598c

PE Signature issue

kernel32

gdi32

user32

advapi32

oleaut32

ole32

shell32

shlwapi

comctl32

version

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic