15082026_0332_14082026_8-13 Statement of Account.exe.iso
- SHA256 225d88272bc669195418b49cf4eb11585b9eb6b40213f503ae77ec44b4a9fb71
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
8-13 Statement of Account.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
wmicodegen.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral3
Sample
wmicodegen.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
300 seconds
General
- Target 15082026_0332_14082026_8-13 Statement of Account.exe.iso
- Size 606KB
- Sample260815-d3lessywfs
- SHA256 225d88272bc669195418b49cf4eb11585b9eb6b40213f503ae77ec44b4a9fb71
- MD5 de36d4a020e9726bb6ed3d05b1d0fc32
- SHA1 a52d80031ef9aa2a85be1677f58b57571bb16e5a
- SHA512 5513ac51e9e1db0f192925fc758a4eeb9c009ea125d92a9ceabab83c85ee50907c558a084641bc9b42a345b12f4aacd47a814f1f64674445c617cce613129bd6
- SSDEEP 12288:5P48zmzxYV9RMvU0obQt2lCfY84YGZBerCQPupmWDw:5P4OeYVgxV74YserRPLW
- TLSH T183D4F146726524F6E4669178C9928655E772B41A033086EF335CC2782F37BE97E3E312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/wmicodegen.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/wmicodegen.dll
File Explorer
-
15082026_0332_14082026_8-13 Statement of Account.exe.iso.iso 606KB
-
out.iso.iso 606KB
-
8-13 Statement of Account.exe.exe 174KB
-
wmicodegen.dll.dll 379KB
out.iso
- SHA256 225d88272bc669195418b49cf4eb11585b9eb6b40213f503ae77ec44b4a9fb71
- MD5 de36d4a020e9726bb6ed3d05b1d0fc32
- SHA1 a52d80031ef9aa2a85be1677f58b57571bb16e5a
- SHA512 5513ac51e9e1db0f192925fc758a4eeb9c009ea125d92a9ceabab83c85ee50907c558a084641bc9b42a345b12f4aacd47a814f1f64674445c617cce613129bd6
- SSDEEP 12288:5P48zmzxYV9RMvU0obQt2lCfY84YGZBerCQPupmWDw:5P4OeYVgxV74YserRPLW
- TLSH T183D4F146726524F6E4669178C9928655E772B41A033086EF335CC2782F37BE97E3E312
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
8-13 Statement of Account.exe
- IMPHASH 2aa2b758b667e9bc3668dd7e59073362
- SHA256 41d9c8f7662e76d62da7aac907d6419be76f60259241e16e7d8025ed4aa34d12
- MD5 bb97150614bcb7fba7040f6674037605
- SHA1 d3a6234a854886088eb29b21b26125b811a87768
- SHA512 32d77ccc2aec0cda4ef0eadb39a787221d25d7e0f01dcfa2dd23e94b8843037f70bccc6ffa33537acd01c1a04c03a3b0d108a7799abd4d73420d8ff26e8d62c4
- SSDEEP 3072:chlUYCVlFF4smO1RWUdESZhMiPx4DPmCJvo1aJBl0Zbln8D:chOY4tmOymfZJxAPj+sJsA
- TLSH T1C4048C5673A824F6D4728178CA959A56F772B42B033183DF035486791F33BEA6E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
cd:46:40:28:ab:a6:65:ca:88:cf:55:48:8f:eb:18:9e:00:9a:b4:91:13:f6:fa:b4:79:c0:fc:7f:fb:6c:f4:c7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:87:bc:82:6e:85:a1:ae:53:a8:00:00:00:00:00:87
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Convert-MofToProvider.pdb
kernel32
CompareStringA
HeapSetInformation
SetThreadPreferredUILanguages
GetModuleHandleA
CreateFileW
WriteConsoleW
GetCommandLineA
GetVersionExW
RtlLookupFunctionEntry
RtlUnwindEx
ExitProcess
GetModuleHandleExW
GetProcAddress
GetLastError
MultiByteToWideChar
CreateDirectoryA
HeapAlloc
RtlPcToFileHeader
RaiseException
SetUnhandledExceptionFilter
EncodePointer
DecodePointer
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
GetStdHandle
WriteFile
GetModuleFileNameA
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
RtlUnwind
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
CloseHandle
HeapFree
GetLocaleInfoA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesA
GetStringTypeW
Sleep
LoadLibraryExW
IsProcessorFeaturePresent
CreateFileA
LCMapStringW
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
ReadConsoleW
GetLocaleInfoW
SetEndOfFile
GetProcessHeap
SetFilePointer
SetThreadStackGuarantee
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
wmicodegen
GeneratorMain
err
ValidIdent
GeneratorAdapterCode
user32
LoadStringW
Name
.text
Size
104KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=259, version=33145,
count=2, productName=Unmarked objects (old),
count=128, id=260, version=33145,
count=56, id=261, version=33145,
count=7, id=257, version=33145,
count=102, id=1, productName=Unmarked objects,
count=4, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wmicodegen.dll
- IMPHASH 30b9be7c12cf36a4122c6f56c26e52aa
- SHA256 263a2d7cfa475fc51b7932928293268e9bb0fa3fadd746cf4192c31234c77ed5
- MD5 7aa5f86f80c2a6c9493470dd365f2a43
- SHA1 5938c874a19db18b0b246d26075de46b193a22d2
- SHA512 5d3e3418395c973e2d19ec314c4ef2773f4e5946dac702259ae613ec984b81e14a695a9220745f2cd6a14c9fdff80cfcf98428996c814b7123d57ea768a5da9a
- SSDEEP 6144:5ajaMInUvUHUoJtnh+hD1AlCfAppX83h6tCd4ZBerjrSfMLP9+ijiA0BM2q8pnKI:5RMvU0obQt2lCfY84YGZBerCQPupmWDh
- TLSH T1F6841242B13B28F5E099D67DD8928858DB3278045324C97FB31AF0A83B7B979714E74B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
4288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapFree
GetProcessHeap
GetModuleHandleA
GetProcAddress
LoadLibraryA
HeapAlloc
GeneratorAdapterCode
GeneratorMain
LookupString
ValidIdent
err
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33145,
count=6, id=1, productName=Unmarked objects,
count=3, id=260, version=35228,
count=2, id=259, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,