ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1

Sharing

Copy URL Twitter E-mail

General

Target
ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1
Size 3.8MB
Sample260810-vlnl9stdmb
SHA256 ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1
MD5 85143917eaa42805d666a2e56cfbd8c2
SHA1 ff53fa6fb7ee5b59f49817ba6f5fe80c98b5090c
SHA512 ecf475c3879d702b3e0221defabdc8f1c6e51336395e71004f08b8ae668328c39dc684dbe7b47d2efd7c65c154ac833a28d9eaa3553ee293178b082300ecbc05
SSDEEP 24576:9zSNEWT0gd3PZj3mj1P4BRcUEaOhvXIDMWle5:9zSNEWT0AP1321P4rcU9OXIoW4
TLSH
T1FA16AD24BDBA811DD027FFB83DECF99EE9EB66191506646B001703478626AC0CF4B5BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1

File Explorer

ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1

.exe 3.8MB

ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1

IMPHASH f35ff91c4e9eac7bcbf080e9886a8bb2
SHA256 ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1
MD5 85143917eaa42805d666a2e56cfbd8c2
SHA1 ff53fa6fb7ee5b59f49817ba6f5fe80c98b5090c
SHA512 ecf475c3879d702b3e0221defabdc8f1c6e51336395e71004f08b8ae668328c39dc684dbe7b47d2efd7c65c154ac833a28d9eaa3553ee293178b082300ecbc05
SSDEEP 24576:9zSNEWT0gd3PZj3mj1P4BRcUEaOhvXIDMWle5:9zSNEWT0AP1321P4rcU9OXIoW4
TLSH
T1FA16AD24BDBA811DD027FFB83DECF99EE9EB66191506646B001703478626AC0CF4B5BD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

18:b8:76:bd:e8:fb:5d:dd:e6:d1:44:9b:2e:8b:ea:1c:1c:31:f7:00:4b:45:b2:13:51:3b:4f:cc:ed:aa:a3:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=CloudCraft Labs Co.\, Ltd.,1.2.840.113549.1.9.1=#1300

Chains

Aug 10, 2026

CN=CloudCraft Labs Co.\, Ltd.,1.2.840.113549.1.9.1=#1300

Subject

CN=CloudCraft Labs Co.\, Ltd.,1.2.840.113549.1.9.1=#1300

Serial Number

41:66:83:4d:cd:86:98:8e:4d:79:08:90:bb:95:69:31

Issuer

CN=CloudCraft Labs Co.\, Ltd.,1.2.840.113549.1.9.1=#1300

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 31, 2002 - Dec 30, 2099

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

133208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ExitProcess ReadProcessMemory GetCurrentProcessId CreateProcessW GetModuleHandleW FreeLibrary WideCharToMultiByte LocalFree CreateDirectoryW SizeofResource VirtualProtect WriteFile GetTempPathW GetFileAttributesW GetSystemDirectoryW MultiByteToWideChar LockResource LoadResource FindResourceW CopyFileW GetSystemTimeAsFileTime SetEndOfFile WriteConsoleW SetStdHandle GetWindowsDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP LoadLibraryW Process32FirstW DeleteFileW Process32NextW CreateToolhelp32Snapshot OpenProcess CreateFileW WaitForSingleObject GetModuleFileNameW DeviceIoControl FindNextFileW GetCommandLineW FindFirstFileW IsDebuggerPresent QueryPerformanceCounter GetProcessHeap DeleteCriticalSection GetProcAddress DecodePointer HeapAlloc CloseHandle HeapReAlloc GetLastError Sleep HeapSize FindClose InitializeCriticalSectionEx FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle RtlUnwind GetModuleHandleExW GetCurrentProcess SetLastError HeapFree LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException OutputDebugStringW GetCPInfo GetStringTypeW FindFirstFileExW GetCurrentThreadId EncodePointer EnterCriticalSection LeaveCriticalSection LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW

user32

SendMessageW GetWindowTextW MessageBoxW GetWindowThreadProcessId GetWindow GetWindowRect FindWindowW IsWindowVisible GetTopWindow

advapi32

RegCloseKey RegQueryValueExW QueryServiceStatusEx CreateServiceW QueryServiceStatus StartServiceW RegDeleteKeyA CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid RegCreateKeyExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA FreeSid CheckTokenMembership RegOpenKeyExW OpenServiceW

shell32

CommandLineToArgvW SHGetFolderPathW

ole32

CoInitialize CoCreateGuid CoUninitialize CoCreateInstance CoInitializeEx CoGetObject StringFromCLSID CoTaskMemFree

oleaut32

VariantClear

iphlpapi

CreateIpForwardEntry GetAdaptersInfo DeleteIpForwardEntry FlushIpNetTable GetIpForwardTable

ws2_32

setsockopt sendto htons recvfrom inet_ntoa socket WSAStartup inet_pton closesocket WSACleanup connect

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

userenv

RefreshPolicyEx

rpcrt4

UuidCreate RpcStringFreeW UuidToStringW

psapi

GetModuleFileNameExW

Name

.text

Size

288KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

ws2_32

setupapi

userenv

rpcrt4

psapi

generic