72k4bv5pr4bk2yp4288ebrun[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
72k4bv5pr4bk2yp4288ebrun.exe
Size 1.8MB
Sample260809-mfcntay1es
SHA256 4c4131a328ba5b32abfbc46968257728c4e4a71752d4dc9273e6549769d5cedd
MD5 a2d7c13bacc7279aad2dba92e1529d9c
SHA1 4d11b3ec535725bcf26e4d5641650886e5745335
SHA512 77824a747a24b5ac53d6fad179f3ac68cbf3fce1dd4dcdca191bd8e3df5f42a80daf29d0318a8de99cdde3c0ecd576f5ba71211968b282c406917f9ed0b786d8
SSDEEP 49152:uxA4RbaLYwHLDjQ1Q5a3zLnaLE2XDZP8D:EDaJHl5a3KLJXVPG
TLSH
T13195CF46B3A502E8C56BC13CC656971BEB727C0503609BDF23E45B2A2F63BE15E7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

72k4bv5pr4bk2yp4288ebrun.exe

.exe 1.8MB

72k4bv5pr4bk2yp4288ebrun.exe

IMPHASH b5d6798525874ffb1c309fdf614dcd25
SHA256 4c4131a328ba5b32abfbc46968257728c4e4a71752d4dc9273e6549769d5cedd
MD5 a2d7c13bacc7279aad2dba92e1529d9c
SHA1 4d11b3ec535725bcf26e4d5641650886e5745335
SHA512 77824a747a24b5ac53d6fad179f3ac68cbf3fce1dd4dcdca191bd8e3df5f42a80daf29d0318a8de99cdde3c0ecd576f5ba71211968b282c406917f9ed0b786d8
SSDEEP 49152:uxA4RbaLYwHLDjQ1Q5a3zLnaLE2XDZP8D:EDaJHl5a3KLJXVPG
TLSH
T13195CF46B3A502E8C56BC13CC656971BEB727C0503609BDF23E45B2A2F63BE15E7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

dd:c7:58:20:64:54:ff:d5:a0:8f:21:bf:6b:c7:92:22:c2:e8:ba:df:63:91:18:50:22:a0:15:fa:3e:5b:b6:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=GRM Tymon Nowak,O=GRM Tymon Nowak,L=Warszawa,ST=mazowieckie,C=PL

Chains

Jun 12, 2026

CN=GRM Tymon Nowak,O=GRM Tymon Nowak,L=Warszawa,ST=mazowieckie,C=PL

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=GRM Tymon Nowak,O=GRM Tymon Nowak,L=Warszawa,ST=mazowieckie,C=PL

Serial Number

58:ec:be:43:a6:d8:e1:b0:5b:ca:a7:03:94:22:9c:f4

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 7, 2025 - Jul 7, 2026

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

810408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleFileNameA SizeofResource FindResourceA GetModuleHandleExA GetLastError GetFileAttributesA LockResource DeleteFileA LoadResource SetFileAttributesA CreateDirectoryA SetLastError GetStringTypeW SetEndOfFile WriteConsoleW CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetModuleHandleA IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapSize GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx WriteFile GetStdHandle GetModuleFileNameW GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess RtlCaptureContext GetModuleHandleW LoadLibraryExW GlobalAlloc MultiByteToWideChar GetCPInfo GetACP GetProcessHeap TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind RaiseException RtlPcToFileHeader InterlockedPushEntrySList RtlUnwindEx GetCurrentProcessId GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry CreateFileA GetFileSizeEx ReadFile CloseHandle HeapAlloc HeapReAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime

user32

GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo GetKeyState UpdateWindow PostQuitMessage PeekMessageA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos RegisterClassExW SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor LoadIconA DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW TranslateMessage ShowWindow SetWindowLongA GetWindowLongA MoveWindow SetLayeredWindowAttributes SetCapture

ole32

CoInitializeSecurity CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse

Sharing

General

Malware Config

Signatures

File Explorer

72k4bv5pr4bk2yp4288ebrun.exe

d3d11

d3dcompiler_43

kernel32

user32

ole32

oleaut32

imm32

d3dx11_43

dwmapi

winhttp

generic