AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe
Size 1.2MB
Sample260813-eshrlazves
SHA256 c02af472c5308391e518d96ef9bd144a83ef33b35c27613bfec67ab4c8b01100
MD5 18257e5fd13e4ed60c6392bf846b5a6c
SHA1 ef5d82322f45af03d2009223236bb775d0f88218
SHA512 fb8b1481d83bcbaf9d80c0b2d1a1188ef9be90ee65a0e312680379bb89b0fa81c1f0f02e986ce55b88c4723e0d7104fc52ef66cf0b53d749d3a7aecac5b94cc1
SSDEEP 24576:P2+XQGb0WKBwDJ0YzZBWz/VLMy46Y/+cbQc:PzWwDJpPWzNLwR
TLSH
T1C4454B1657D8027CF0F7D2F8DEA69C42DB76780A07B19AEF06C055664E27BA08E39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe

File Explorer

AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe

.exe 1.2MB

AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe

IMPHASH 0bf5343f8db2f2ecede5134a6a982f99
SHA256 c02af472c5308391e518d96ef9bd144a83ef33b35c27613bfec67ab4c8b01100
MD5 18257e5fd13e4ed60c6392bf846b5a6c
SHA1 ef5d82322f45af03d2009223236bb775d0f88218
SHA512 fb8b1481d83bcbaf9d80c0b2d1a1188ef9be90ee65a0e312680379bb89b0fa81c1f0f02e986ce55b88c4723e0d7104fc52ef66cf0b53d749d3a7aecac5b94cc1
SSDEEP 24576:P2+XQGb0WKBwDJ0YzZBWz/VLMy46Y/+cbQc:PzWwDJpPWzNLwR
TLSH
T1C4454B1657D8027CF0F7D2F8DEA69C42DB76780A07B19AEF06C055664E27BA08E39713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8b:bf:45:39:4c:01:f6:d6:d5:22:42:c6:d4:2c:c5:7d:51:3a:0d:f2:18:22:ff:4d:d9:03:76:fe:66:bd:62:c6

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=AimCore Native Public Signing 2026

Chains

Aug 6, 2026

CN=AimCore Native Public Signing 2026

Minor OS version

Major OS version

Entry point

705264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpQueryOption WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable

crypt32

CryptUnprotectData CertFindCertificateInStore CryptImportPublicKeyInfoEx2 CryptHashCertificate2 CryptEncodeObjectEx CryptMsgGetParam CryptQueryObject CryptBinaryToStringA CryptStringToBinaryA CertFreeCertificateContext CryptMsgClose CryptDecodeObjectEx CryptProtectData CertCloseStore

wintrust

WinVerifyTrust

shell32

ShellExecuteExW CommandLineToArgvW SHGetKnownFolderPath

ole32

CreateStreamOnHGlobal CoTaskMemFree

advapi32

OpenProcessToken CreateRestrictedToken FreeSid RegOpenKeyExW RegGetValueW CreateProcessAsUserW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegCloseKey SetFileSecurityW CryptAcquireContextW EqualSid SetTokenInformation GetSidSubAuthorityCount CryptReleaseContext GetTokenInformation CryptDestroyHash IsValidSid CryptHashData CryptCreateHash CryptGetHashParam CreateProcessWithTokenW ConvertStringSidToSidW LookupPrivilegeNameW GetSidSubAuthority AllocateAndInitializeSid GetLengthSid

kernel32

GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetFileInformationByHandleEx FormatMessageA EnumSystemLocalesW ReadConsoleW HeapReAlloc GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA CreateDirectoryW GetSystemFirmwareTable ReadFile SizeofResource GetVolumeInformationW SetLastError SetDefaultDllDirectories GetCommandLineW GetCurrentProcess WriteFile DeviceIoControl TerminateProcess RemoveDirectoryW GetFinalPathNameByHandleW GetModuleFileNameW CreateNamedPipeW SetEnvironmentVariableW GetProcessId GetNamedPipeClientProcessId CreatePipe SetErrorMode GetEnvironmentVariableW GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW ResumeThread DisconnectNamedPipe OpenProcess SetProcessMitigationPolicy CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar Sleep FormatMessageW GetTickCount64 GetLastError GetEnvironmentStringsW Process32NextW OutputDebugStringW SetEvent GetDiskFreeSpaceExW LockResource GlobalAlloc DeleteFileW Process32FirstW GlobalFree CloseHandle GetNativeSystemInfo HeapSetInformation ResetEvent LoadResource FindResourceW GetLocalTime GetCurrentDirectoryW GetNamedPipeServerProcessId GetWindowsDirectoryW GetProcAddress GlobalLock LocalFree MoveFileExW ExitProcess GetCurrentProcessId SystemTimeToFileTime GlobalMemoryStatusEx CreateProcessW GetModuleHandleW FreeLibrary CopyFileW WideCharToMultiByte QueryFullProcessImageNameW WaitNamedPipeW GlobalUnlock IsWow64Process LoadLibraryExW ConnectNamedPipe SetUnhandledExceptionFilter FlushFileBuffers GetExitCodeProcess AreFileApisANSI SetFileInformationByHandle GetLocaleInfoEx GetFullPathNameW GetFileInformationByHandle FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW LCMapStringW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetFileAttributesExW RtlUnwind CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP HeapFree HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead

user32

GetWindowTextW GetWindowThreadProcessId GetMessageW DefWindowProcW GetKeyState PostMessageW GetWindowRect DestroyWindow IsWindowVisible MessageBoxW MonitorFromWindow SetWindowLongPtrW SetWindowRgn CreateWindowExW ScreenToClient SendMessageW SetWindowTextW GetWindowLongPtrW ShowWindow IsWindow OpenClipboard DispatchMessageW SetTimer GetMonitorInfoW RegisterHotKey EmptyClipboard PeekMessageW RegisterClassW GetForegroundWindow EnumWindows TranslateMessage LoadIconW EnumDisplayDevicesW LoadCursorW GetClassNameW SetClipboardData SetCursor GetClientRect DrawIconEx KillTimer PostQuitMessage SystemParametersInfoW PtInRect UpdateWindow SetForegroundWindow GetAncestor GetCursorPos BeginPaint EndPaint GetRawInputData RegisterRawInputDevices RegisterClassExW CloseClipboard UnregisterHotKey InvalidateRect

gdi32

CreateCompatibleBitmap DeleteObject DeleteDC CreateRoundRectRgn CreateCompatibleDC SelectObject BitBlt

ncrypt

NCryptSignHash BCryptVerifySignature NCryptExportKey NCryptFinalizeKey BCryptDestroyKey NCryptOpenKey BCryptCreateHash BCryptHashData BCryptSignHash BCryptGenRandom NCryptCreatePersistedKey NCryptFreeObject NCryptSetProperty BCryptGetProperty BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptOpenAlgorithmProvider BCryptExportKey BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash NCryptOpenStorageProvider

gdiplus

GdipSetSmoothingMode GdipSetClipPath GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipSetInterpolationMode GdipCreateSolidFill GdipSetStringFormatTrimming GdipFillPath GdipGraphicsClear GdipDrawLine GdipSetPixelOffsetMode GdipClosePathFigure GdipGetGenericFontFamilySansSerif GdipFree GdipDeletePath GdipDrawString GdipCreateFromHDC GdipFillEllipse GdipSetPenEndCap GdipDrawEllipse GdipCreateLineBrushFromRect GdipAddPathArc GdipDeleteGraphics GdipDrawArc GdipDeleteStringFormat GdipDeleteFont GdipDeletePen GdipCreatePen1 GdipSetStringFormatAlign GdipSetStringFormatFlags GdipAlloc GdipCreateBitmapFromStream GdipDeleteBrush GdipSetPenStartCap GdipCloneImage GdipDrawImageRectRect GdipCreateFontFamilyFromName GdipResetClip GdipSetCompositingQuality GdipDeleteFontFamily GdipCreateStringFormat GdiplusShutdown GdiplusStartup GdipDisposeImage GdipCloneBrush GdipDrawPath

Name

.text

Size

883KB

Virtual Size

883KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

259KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe

PE Signature issue

winhttp

crypt32

wintrust

shell32

ole32

advapi32

kernel32

user32

gdi32

ncrypt

gdiplus

generic