70501aef24e2b4abfc86aad0e285bf33fa6a06e9341cb7a01f38fe3effa1f7e0
- SHA256 70501aef24e2b4abfc86aad0e285bf33fa6a06e9341cb7a01f38fe3effa1f7e0
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2 0 2 5 年 第 二 季 度 违 规 内 职 人 员 名 单 信 息.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2 0 2 5 年 第 二 季 度 违 规 内 职 人 员 名 单 信 息.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 70501aef24e2b4abfc86aad0e285bf33fa6a06e9341cb7a01f38fe3effa1f7e0
- Size 60KB
- Sample260812-dd3b1shm21
- SHA256 70501aef24e2b4abfc86aad0e285bf33fa6a06e9341cb7a01f38fe3effa1f7e0
- MD5 e8e32feaa3235e2c9bf2e66426c0b87d
- SHA1 e8872c4ea920984fc7a5251a05ec87ff6574f232
- SHA512 953a75ab81c7c2582345c4528261e91aaf22b9a386eea54971d9c22c633f3c97e0dc3171d22ae384409922fc1797df0a221384c028e8c2a8dac6d02d5701ef23
- SSDEEP 1536:XNFfe+Plsk7nRbwJqqOv/1IgAX5bZapr6GxE:dxn7RbwcvChX5bZSrtW
- TLSH T1A9530226CE23B4C8FA7533789F0F11729FBB8142969595E0DB9377E8D602E89481E067
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/2 0 2 5 年 第 二 季 度 违 规 内 职 人 员 名 单 信 息.exe
File Explorer
-
70501aef24e2b4abfc86aad0e285bf33fa6a06e9341cb7a01f38fe3effa1f7e0.zip 60KB
-
2 0 2 5 年 第 二 季 度 违 规 内 职 人 员 名 单 信 息.exe.exe 118KB
2 0 2 5 年 第 二 季 度 违 规 内 职 人 员 名 单 信 息.exe
- IMPHASH 5d3c0b627d0f2032f4e6d13576e621b5
- SHA256 868095da96e3507a9411899ce4477b54be68ddcc98ce048d0cd2d3e461feadd3
- MD5 ee856ccb222109ba6d4a0251830cfa06
- SHA1 1db01384cd5f958227c79b551d66b418119a7d91
- SHA512 268c16ff22d3d629fb81145dbd85a22f22d36093cef88843730074e1acf7e9a04ec985d743ce11fad6832066002e31a4a084ca497c95831d4e51ec8bbb9a7798
- SSDEEP 3072:p75GNDUaunHmshiTBiuJqJnuLLPWpfLTsIih+jhnKIsQkTPz8N+W9:po+ILPwDTBih+jUCkP
- TLSH T1D7C32906A67961F9C87AC1388AA25F52FB313C584B3C438F87A546651FA3BD0EF39314
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
95:50:cc:70:27:a6:8e:98:8e:bb:85:10:03:d6:2e:a0:13:1d:c1:13:ff:f5:2a:a7:2a:3d:26:4a:0b:d7:5d:3d
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 1, 2024
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:51:99:0a:2a:60:f6:35:67:60:00:00:00:00:04:51
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 8, 2023 - Aug 7, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d2:21:24:31:4a:58:bf:2d:11:00:01:00:00:01:d2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
2
Major OS version
5
Entry point
44556
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Build\Server\Server2010\x64\Release\UServer.pdb
kernel32
lstrcpyW
GetStringTypeW
MultiByteToWideChar
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
WideCharToMultiByte
lstrcmpiW
GetCurrentProcess
GetProcAddress
GetModuleHandleA
lstrcmpiA
DuplicateHandle
GetProcessId
GetLastError
WriteProcessMemory
VirtualAllocEx
CloseHandle
ExitProcess
GetModuleFileNameA
HeapFree
Process32NextW
Process32FirstW
HeapAlloc
GetProcessHeap
CreateToolhelp32Snapshot
Sleep
GetModuleFileNameW
LoadLibraryW
LoadLibraryA
GetModuleHandleW
DecodePointer
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
EncodePointer
GetCommandLineW
GetStartupInfoW
HeapReAlloc
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
TerminateProcess
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
WriteFile
GetStdHandle
HeapSetInformation
GetVersion
HeapCreate
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
user32
GetMessageW
TranslateMessage
DispatchMessageW
CreateWindowExW
ShowWindow
UpdateWindow
RegisterClassExW
DefWindowProcW
BeginPaint
EndPaint
PostQuitMessage
wsprintfA
Name
.text
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=65, id=170, productName=VS2010 build 30319, version=30319,
count=10, id=158, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=94, id=1, productName=Unmarked objects,
count=33, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,