5fa5d08eaac9ea0e8645ac53cd1dbd4a43f38028abf6b836c00e29b6475ea56f
- SHA256 5fa5d08eaac9ea0e8645ac53cd1dbd4a43f38028abf6b836c00e29b6475ea56f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DS_SaveEditor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
DS_SaveEditor.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 5fa5d08eaac9ea0e8645ac53cd1dbd4a43f38028abf6b836c00e29b6475ea56f
- Size 6.0MB
- Sample260809-ffhrhatycx
- SHA256 5fa5d08eaac9ea0e8645ac53cd1dbd4a43f38028abf6b836c00e29b6475ea56f
- MD5 5f85742536801684b7859989c8229357
- SHA1 29fa730d513bcda44d01b24201dc00e3415bd93d
- SHA512 9c9714d20f413a6a1105cce078f443c177a296871537461e8dde891b414b3adab2486476464f691b6b860071670126df72f2e53207422d4d4a614b4322b6eae1
- SSDEEP 98304:c6+gIRUlUnzpyr5llx6n0d/WT5vOnCAbqrz/TOCqzK5x4U8FZp+u9YhDr3b2xFhv:IgcsGLTSaR/4U8FZE7Rbb2DzJ
- TLSH T1145633097923D4178DF87EF72251C2F7A8B9CED959453236B2BD4E3873919B0A60C3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DS_SaveEditor.exe
File Explorer
-
5fa5d08eaac9ea0e8645ac53cd1dbd4a43f38028abf6b836c00e29b6475ea56f.zip 6.0MB
-
DS_SaveEditor.exe.exe 6.1MB
DS_SaveEditor.exe
- IMPHASH 069151096a7bef60765f01aef7750ef6
- SHA256 48b3c7737daf0ee371013f52a74f678a289202727b8412b294a9a6a7709c28d7
- MD5 178e7bc9072c6f14b3ce41d0b12e0bbb
- SHA1 18620a460f0e3e798d8822747ee30a824579f6ce
- SHA512 9d4eea0129ce66a7e9deb824feac675bb54ec1a7d8a80edcdb603440d0faa72414e1395105b3e119c66aba91ae4fab4272f232561352a2d99f1d164f9c264f9a
- SSDEEP 98304:5tu2ATWKGZvP9SpMr5h99uL9dR6x5rAbCWFe995T6vbdWKHriAoizDGUTcpmxtUT:582I0P9f2Ax0+yLiAoizautUTP
- TLSH T14C563304776240FECD7B6674856282E6FAF9FEA10700576F13B489396F63AE49B1C360
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
53444
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shell32
SHFileOperationW
SHGetFolderPathW
CommandLineToArgvW
kernel32
RtlUnwindEx
WriteConsoleW
HeapReAlloc
CreateDirectoryW
SetConsoleCtrlHandler
AddDllDirectory
GetCommandLineW
GetFullPathNameW
GetStdHandle
WriteFile
GetShortPathNameW
TerminateProcess
GetModuleFileNameW
SetEnvironmentVariableW
K32GetModuleFileNameExW
GetEnvironmentVariableW
GetTempPathW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetModuleHandleA
OpenProcess
Sleep
GetLastError
CloseHandle
GetProcAddress
GetCurrentProcessId
CreateProcessW
WideCharToMultiByte
GetSystemTimeAsFileTime
FormatMessageA
QueryPerformanceCounter
SetDllDirectoryW
LoadLibraryExW
GetExitCodeProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
HeapSize
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapAlloc
MultiByteToWideChar
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetFileType
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
Name
.text
Size
139KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6.0MB
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=30795,
count=145, id=261, version=30795,
count=10, id=260, version=30795,
count=2, id=253, version=34321,
count=9, id=259, version=34321,
count=16, id=260, version=34321,
count=40, id=261, version=34321,
count=5, id=257, version=30795,
count=117, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=1, id=264, version=34810,
count=1, id=258, version=34810,