feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7

Sharing

Copy URL Twitter E-mail

General

Target
feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7
Size 967KB
Sample260809-ehexyszcph
SHA256 feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7
MD5 e279d0e2e144eea7f96f5e23a0ad3765
SHA1 41f96f830bed9ac9c4d40ea692afeacc5f76d29d
SHA512 a90f4327c62409a1c4648219d998682e5d686ff9c7ae9df3d2cee1cb6f31c74b9e63ff08329d5e7bfda356b0f0fc8b95c35b9248cef7799a44c5d30f9c4baaf6
SSDEEP 12288:GBAMi8GG/LeIgv3LFGVOJYVBgB3DmOBvtX9W/3:GBAMLGG/LeIG38VB+Tta3
TLSH
T126255251F3F88A5CF0F36A746DB642D56A72FC20BE34CA4F6610B64E1A71950DA34B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7

File Explorer

feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7

.exe 967KB

feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7

IMPHASH 617946879ebfcc9c6f6c14ce5622b3b2
SHA256 feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7
MD5 e279d0e2e144eea7f96f5e23a0ad3765
SHA1 41f96f830bed9ac9c4d40ea692afeacc5f76d29d
SHA512 a90f4327c62409a1c4648219d998682e5d686ff9c7ae9df3d2cee1cb6f31c74b9e63ff08329d5e7bfda356b0f0fc8b95c35b9248cef7799a44c5d30f9c4baaf6
SSDEEP 12288:GBAMi8GG/LeIgv3LFGVOJYVBgB3DmOBvtX9W/3:GBAMLGG/LeIG38VB+Tta3
TLSH
T126255251F3F88A5CF0F36A746DB642D56A72FC20BE34CA4F6610B64E1A71950DA34B23
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ad:8e:16:54:ed:58:0f:7d:02:1f:e5:bd:85:c9:f5:43:f7:49:9e:e8:72:e0:d3:ff:e3:62:96:f8:9a:90:f5:03

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 19, 2026

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Oct 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

261936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\user\Desktop\winfile\src\x64\Release\Winfile.pdb

kernel32

GetEnvironmentVariableW GetSystemDirectoryW GlobalAlloc GlobalFree SetCurrentDirectoryW GetProcAddress GlobalLock FreeLibrary GlobalUnlock GetShortPathNameW SetFileAttributesW DeleteFileW CreateThread IsDBCSLeadByte GetModuleHandleW WideCharToMultiByte MoveFileW GetUserDefaultLCID FileTimeToSystemTime GetNumberFormatW FileTimeToLocalFileTime GetTimeFormatW GetDateFormatW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent DeleteCriticalSection GetVolumeInformationW GetCompressedFileSizeW LocalFileTimeToFileTime VerLanguageNameW ExpandEnvironmentStringsW ExitThread CloseHandle WriteFile GetTempPathW GetFileInformationByHandle CreateDirectoryExW SetThreadPriority GetCurrentThreadId Sleep SwitchToThread SetErrorMode GetCurrentThread ResetEvent ExitProcess GetDriveTypeW SizeofResource SetThreadLocale GetPrivateProfileIntW GetThreadLocale SetThreadUILanguage GetLocaleInfoW GetVersionExW FreeResource LoadLibraryW LoadResource FindResourceW GetCurrentDirectoryW MulDiv LocalUnlock LocalSize CompareFileTime GetTickCount GetCommandLineW GetLastError FindNextChangeNotification FindCloseChangeNotification FindFirstChangeNotificationW LocalReAlloc GetProfileStringW WriteProfileStringW lstrcmpW lstrcatW CompareStringW lstrcmpiW GetPrivateProfileStringW MultiByteToWideChar GetModuleFileNameW WritePrivateProfileStringW FormatMessageW GetProcessHeap HeapAlloc HeapFree CopyFileExW lstrcpyW CopyFileW SystemTimeToFileTime LocalFree GetFileAttributesW CreateFileW LocalAlloc QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter FindClose CreateHardLinkW RemoveDirectoryW DeviceIoControl lstrlenW FindNextFileW GetFullPathNameW SetLastError FindFirstFileExW FindFirstFileW GetDiskFreeSpaceExW GetStartupInfoW CreateDirectoryW

gdi32

GetStockObject GetLayout SetLayout CreateCompatibleDC CreateDIBitmap CreateFontW GetDeviceCaps DeleteDC SetBkMode GetObjectW CreateFontIndirectW TextOutW PatBlt GetTextExtentPoint32W ExtTextOutW BitBlt SelectObject GetTextMetricsW SetTextColor SetBkColor DeleteObject CreateSolidBrush

user32

DestroyWindow GetFocus GetMenu GetMenuState EnableWindow IsIconic ReleaseCapture PtInRect SetRect CharUpperBuffW SetCursor SetCapture TranslateMessage TranslateAcceleratorW IntersectRect FrameRect DragObject PeekMessageW ClientToScreen TranslateMDISysAccel DispatchMessageW GetCapture MessageBeep InflateRect PostMessageW CharLowerW GetKeyState GetMessageW GetWindowTextW DialogBoxParamW CharNextW SendDlgItemMessageW GetDlgItemTextW SetDlgItemTextW SetWindowTextW MessageBoxW CharUpperW GetWindowTextLengthW MsgWaitForMultipleObjects ShowCursor KillTimer CheckMenuItem SetClipboardData InsertMenuW LoadCursorW WinHelpW EmptyClipboard CloseClipboard SetTimer OpenClipboard SetActiveWindow RegisterClipboardFormatW CreateDialogParamW DrawIconEx IsWindow GetDC GetDesktopWindow SystemParametersInfoW CheckDlgButton DestroyMenu IsDlgButtonChecked TrackPopupMenu GetWindowPlacement LoadMenuW OffsetRect SetWindowPos GetDoubleClickTime DrawMenuBar DeleteMenu SetForegroundWindow IsDialogMessageW RedrawWindow CallWindowProcW DestroyIcon RegisterWindowMessageW LoadIconW SetWindowsHookW LoadAcceleratorsW GetMenuItemCount InsertMenuA GetMenuItemID GetLastActivePopup DefMDIChildProcW GetActiveWindow SetCursorPos SetWindowLongW DrawIcon GetScrollPos InternalGetWindowText wvsprintfW PostQuitMessage DefFrameProcW CallNextHookEx GetSystemMenu GetSystemMetrics GetClassNameA GetWindowLongPtrW BeginDeferWindowPos RegisterClassW MapWindowPoints MoveWindow RegisterClassA GetUpdateRect GetClassNameW EndDeferWindowPos GetClientRect FillRect CreateWindowExW GetSubMenu IsWindowUnicode GetParent DrawFrameControl InvalidateRect BeginPaint ShowWindow DrawFocusRect GetSysColor SetFocus GetMenuStringW GetDlgItem DrawTextW EnableMenuItem UpdateWindow ReleaseDC GetWindowLongW DeferWindowPos DefWindowProcW GetWindow EndDialog EnumChildWindows SetWindowLongPtrW ScreenToClient GetCursorPos EndPaint LoadStringW wsprintfW SendMessageW GetWindowRect

advapi32

RegSetValueW RegQueryValueExW RegOpenKeyW RegOpenKeyExW RegEnumKeyExW RegFlushKey RegQueryValueW RegDeleteKeyW RegEnumKeyW RegCloseKey

oleaut32

VarDateFromStr VariantTimeToSystemTime

ole32

RegisterDragDrop OleGetClipboard ReleaseStgMedium CoLockObjectExternal RevokeDragDrop OleInitialize OleUninitialize

shell32

ShellExecuteExW ord42 ShellExecuteW ExtractIconExW DragQueryFileW ord66 SHFormatDrive

shlwapi

PathFileExistsW PathAppendW PathFindExtensionW StrCpyNW PathIsDirectoryW StrChrW StrRChrW

comctl32

CreateToolbarEx CreateStatusWindowW ord4 ord2

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

__current_exception_context memmove __current_exception memset wcsrchr __std_exception_destroy __std_exception_copy wcsstr __C_specific_handler _CxxThrowException memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vswprintf_s __p__commode __stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcsncpy_s wcscpy_s _wcsicmp wcsncat_s tolower wcslen wcstok_s _wcslwr_s wcsncmp strcmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc _callnewh malloc free

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit terminate _seh_filter_exe _set_app_type _initialize_onexit_table _configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _register_thread_local_exe_atexit_callback _cexit _c_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7

PE Signature issue

kernel32

gdi32

user32

advapi32

oleaut32

ole32

shell32

shlwapi

comctl32

version

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic