15082026_0255_14082026_INV_No[.]20260813132356[.]EXE[.]iso

Sharing

Copy URL Twitter E-mail

General

Target
15082026_0255_14082026_INV_No.20260813132356.EXE.iso
Size 6.7MB
Sample260815-denv1sysfs
SHA256 d36150ce7d854e5a386dba4e461c36ae011598295a2ddfafbc9c988b94cfcbae
MD5 f04b2808fd7f61842ef71695fed20efe
SHA1 ba8c8f10bca21fc3e385da2b55cd1ba3836125e1
SHA512 ce93e53b012c479fa91c813c165929ee828215a95fcf4ed3b06cc799a12c7931a90cff40da2e5cce8e2ef308df0d24b530742c3b97f61e618dbc4b2a4ecba7bf
SSDEEP 196608:st5NsaT8iRzPTq0+QBFt7Z4O7NADtV6v+zZR3ro2U:EpTcQBFVN7kbVU
TLSH
T1AE66CF123E4C0C67E05622338B5D66B8EA6EEDE63BB19E871590BF4DF931341893171B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/pdfcore8.dLL

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack002/INV_No.20260813132356.EXE

File Explorer

15082026_0255_14082026_INV_No.20260813132356.EXE.iso

.iso 6.7MB
out.iso

.iso 6.7MB
INV_No.20260813132356.EXE

.exe 1.1MB
pdfcore8.dLL

.dll 5.5MB

15082026_0255_14082026_INV_No.20260813132356.EXE.iso

SHA256 d36150ce7d854e5a386dba4e461c36ae011598295a2ddfafbc9c988b94cfcbae
MD5 f04b2808fd7f61842ef71695fed20efe
SHA1 ba8c8f10bca21fc3e385da2b55cd1ba3836125e1
SHA512 ce93e53b012c479fa91c813c165929ee828215a95fcf4ed3b06cc799a12c7931a90cff40da2e5cce8e2ef308df0d24b530742c3b97f61e618dbc4b2a4ecba7bf
SSDEEP 196608:st5NsaT8iRzPTq0+QBFt7Z4O7NADtV6v+zZR3ro2U:EpTcQBFVN7kbVU
TLSH
T1AE66CF123E4C0C67E05622338B5D66B8EA6EEDE63BB19E871590BF4DF931341893171B
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

INV_No.20260813132356.EXE

IMPHASH c004104c4c322eff3c5df1dac0b72b0b
SHA256 1180c0180e9e175ec90378f68c1cf0eb177beb9b66d202eda966fe8a8ef9d1f6
MD5 13412cd73870016f6f59125e47e076a9
SHA1 1060f66f1ab91b99144f45cbe97abca77cd9e2cc
SHA512 d7431b3214cf3e8f03bfb14e714b11b468d1e3411f4f0f824cc6aa20254c5e3a70dd5a823c24e19c4cd464701103a67cbaa2efc50724e7a024a79be226bda163
SSDEEP 12288:h0sTavoBAocQGtg7JZ+RyDETRfMjyItHyxPwZAbjvRhgSqq16:qm4JNtg7yFlMjttOwZAbjvRw
TLSH
T130456D8296404D23F852BBB14B4E46398F2E8EE77690FF8258907DCD7A3519E19F2317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

infected

PE Signature issue

Digest

6c:d3:73:c0:f5:4e:84:58:ad:6b:31:38:9f:89:2d:51:c5:57:c2:51

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Zeon Corporation,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Zeon Corporation,L=Taipei,ST=Taiwan,C=TW

Chains

Oct 30, 2013

CN=Zeon Corporation,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Zeon Corporation,L=Taipei,ST=Taiwan,C=TW

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Zeon Corporation,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Zeon Corporation,L=Taipei,ST=Taiwan,C=TW

Serial Number

32:a1:88:ef:e4:09:9d:9d:72:93:a5:30:2a:bd:43:9d

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 10, 2012 - Feb 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 7, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

236573

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

i:\build\hudson\jobs\GaaihoPDFDriver\workspace\GaaihoPDF\Accessory\release\suite\GPDFDirect.pdb

kernel32

SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTimeZoneInformation GetCPInfo GetOEMCP IsValidCodePage GetTimeFormatA GetDateFormatA GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetCurrentDirectoryA GetDriveTypeA CreateFileA SetEnvironmentVariableA CloseHandle GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStdHandle VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect HeapSize HeapReAlloc RaiseException RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime GetStartupInfoW GetFileTime SetErrorMode GetFullPathNameW GetVolumeInformationW DuplicateHandle SetEndOfFile UnlockFile DeviceIoControl GetVolumeInformationA GetComputerNameW OpenMutexW OpenFileMappingW UnmapViewOfFile CreateFileMappingW MapViewOfFile SleepEx SetFilePointer WriteFile CreateFileW GetFileSize LockFile FlushFileBuffers ReadFile lstrcmpiW GlobalFlags GetThreadLocale MoveFileW OutputDebugStringW GetLocalTime GetLastError lstrcpyW GetTempPathW DeleteFileW lstrcpyA GetSystemDirectoryA lstrcatA SizeofResource LockResource LoadResource FindResourceW GetProcAddress SetLastError LoadLibraryW GetModuleHandleW CreateMutexW lstrlenW HeapFree GetProcessHeap ExitProcess ReleaseMutex HeapAlloc FreeLibrary GetFileAttributesW IsBadWritePtr CompareFileTime GetFileInformationByHandle FileTimeToLocalFileTime CreateDirectoryW FileTimeToSystemTime GetDateFormatW GetTimeFormatW GetPrivateProfileIntW FormatMessageW LocalFree CopyFileW GetPrivateProfileStringW WritePrivateProfileStringW TlsFree DeleteCriticalSection Sleep GetTickCount CreateThread WaitForSingleObject GetModuleFileNameW GetVersion GetVersionExW GetWindowsDirectoryW FindFirstFileW FindClose GetTempFileNameW LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GetCurrentProcessId InterlockedIncrement lstrlenA GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange GetModuleHandleA InterlockedDecrement FreeResource GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA FindNextFileW lstrcmpW GetVersionExA GlobalFree GlobalAlloc GlobalLock GlobalUnlock MulDiv MultiByteToWideChar GetACP WideCharToMultiByte GetCurrentProcess

user32

RegisterClipboardFormatW CharUpperW MessageBeep GetNextDlgGroupItem InvalidateRgn IsRectEmpty CopyAcceleratorTableW CharNextW UnregisterClassW GetWindowThreadProcessId GetSysColorBrush ValidateRect SetWindowContextHelpId EndPaint BeginPaint GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW DestroyMenu SetMenuItemBitmaps GetMenuCheckMarkDimensions MoveWindow SetWindowTextW IsDialogMessageW wvsprintfW EnableWindow SendMessageW LoadIconW wsprintfW GetSubMenu EnableMenuItem SetDlgItemTextW GetDesktopWindow CreateDialogIndirectParamW IsWindowEnabled EndDialog RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetLastActivePopup SetActiveWindow PostThreadMessageW PostMessageW GetParent ModifyMenuW GetCursorPos ScreenToClient PtInRect InvalidateRect LoadMenuW RegisterClassExW CreateWindowExW ShowWindow UpdateWindow DestroyWindow SetWindowLongW GetWindowLongW DefWindowProcW GetDC OffsetRect ReleaseDC GetSysColor DrawFocusRect LoadBitmapW IsWindow CopyRect DrawFrameControl ClientToScreen WindowFromPoint UnregisterClassA wsprintfA LoadStringA GetActiveWindow SetForegroundWindow GetDlgItem GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints TrackPopupMenu GetKeyState GetMenu GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect GetDlgCtrlID CallWindowProcW IntersectRect SystemParametersInfoA GetWindowPlacement GetWindow GetMenuState GetMenuStringW GetMenuItemID GetMenuItemCount LoadStringW MessageBoxW DispatchMessageW TranslateMessage GetMessageW ReleaseCapture FindWindowW GetWindowRect CheckMenuItem SetMenuDefaultItem LoadImageW SetRect DestroyIcon IsIconic PostQuitMessage GetSystemMetrics DrawIcon SetWindowPos SetTimer GetFocus KillTimer GetNextDlgTabItem IsWindowVisible SetCapture GetClientRect LoadCursorW SetCursor MapDialogRect

gdi32

SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC GetStockObject GetWindowExtEx GetRgnBox GetViewportExtEx DeleteObject GetTextExtentPoint32W GetTextMetricsW CreateCompatibleDC GetTextColor GetBkColor CreatePen ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape TextOutW RectVisible PtVisible GetMapMode GetObjectW CreateFontIndirectW GetDeviceCaps GetClipBox SetTextColor SetBkColor CreateBitmap CreateRectRgnIndirect ExtTextOutW SaveDC RestoreDC SetBkMode SetMapMode LineTo MoveToEx

msimg32

TransparentBlt

comdlg32

GetOpenFileNameW GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

GetFileSecurityW ImpersonateSelf OpenThreadToken RevertToSelf MapGenericMask AccessCheck ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorSacl OpenSCManagerA OpenServiceW QueryServiceStatus ControlService StartServiceA CloseServiceHandle RegSetValueExW RegCreateKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation DragAcceptFiles SHGetMalloc SHGetFileInfoW Shell_NotifyIconW ShellExecuteW DragQueryFileW

comctl32

_TrackMouseEvent InitCommonControlsEx

shlwapi

PathStripToRootW PathFindExtensionW PathIsUNCW PathFileExistsW PathFindFileNameW

oledlg

OleUIBusyW

ole32

OleInitialize CoFreeUnusedLibraries OleUninitialize OleFlushClipboard StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CoCreateInstance CLSIDFromString CoRevokeClassObject CoTaskMemAlloc CoTaskMemFree CoUninitialize CoInitialize CLSIDFromProgID CoRegisterMessageFilter OleIsCurrentClipboard CreateILockBytesOnHGlobal

oleaut32

SysAllocString OleCreateFontIndirect SysStringLen SysFreeString SysAllocStringLen VariantClear VariantChangeType VariantInit VariantCopy SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime

wininet

HttpEndRequestA InternetWriteFile HttpSendRequestExA InternetErrorDlg HttpQueryInfoA InternetCloseHandle InternetOpenA InternetConnectA InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetReadFile

pdfcore8

CoreLibInit CoreLibFin GetCoreHFT

pdfcore8.dLL

IMPHASH 9c1a3d1392ff6b5a61535bbe27c17d32
SHA256 84cb61ac98670cc49f919940bc54461c00223ac74fc5b01581b450d89cfe5ab1
MD5 f168e1a06b5f8a380bd11edc5ecfc2b1
SHA1 fe4209bef744b93ac05d0b9d7e377e62dd6a1e5f
SHA512 3ed7b91952d04d9d117ce9ad14cd8b082412f10cdc41d83f8ca7e17a04955e9243ada87d3e02049f9b3d98e7cc55ed3b51b7062d3610707fe710c7a05be2f1f4
SSDEEP 98304:HZ450y5i1sSv66fjpSBRzPTq0+LToBoa+A7Z4OiZrq1DfPHNADtV6v+zM+rwroDH:HaT8iRzPTq0+QBFt7Z4O7NADtV6v+zZE
TLSH
T18146CF173E5C00A6E05A1133CEA9B6E8F1AEBDF83B76019715A0BB1DFD32741CA1456B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

1582649

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\iProject\NvPluginWatchdog\Release\NvPluginWatchdog.pdb

kernel32

FindNextFileW FindFirstFileExW GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW IsValidLocale LCMapStringW GetStdHandle GetFileType SetStdHandle HeapQueryInformation GetACP GetCommandLineA QueryPerformanceFrequency VirtualQuery GetSystemInfo FreeLibraryAndExitThread ExitThread InterlockedFlushSList RtlUnwind GetCPInfo GetStringTypeW LCMapStringEx RaiseException OutputDebugStringW IsValidCodePage GetOEMCP GetEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FindResourceExW SystemTimeToTzSpecificLocalTime LocalFileTimeToFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime GetStringTypeExW MoveFileW DuplicateHandle UnlockFile SetEndOfFile ReadFile LockFile GetVolumeInformationW GetShortPathNameW FlushFileBuffers FreeEnvironmentStringsW FindFirstFileW FindClose SearchPathW GetProfileIntW SetFilePointer GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW LocalReAlloc LocalAlloc GlobalHandle TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetThreadLocale WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetTickCount64 CompareStringA GetVersionExW GetCurrentThread GlobalGetAtomNameW lstrcmpA lstrcmpiW GetWindowsDirectoryW GetUserDefaultLCID ReplaceFileW SetFileTime GetTempFileNameW GetFullPathNameW GetFileTime GetDiskFreeSpaceW GetCurrentDirectoryW ResumeThread SetThreadPriority GlobalReAlloc VerifyVersionInfoW VerSetConditionMask SystemTimeToFileTime FileTimeToSystemTime CompareStringW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryA LoadLibraryExW GetModuleHandleA FreeLibrary EncodePointer OutputDebugStringA MulDiv LocalFree GlobalFree GlobalLock GlobalUnlock GlobalSize GlobalAlloc GetProcessHeap DecodePointer HeapReAlloc HeapSize InitializeCriticalSectionEx GetLocalTime GetTempPathW CreateMutexW CreateThread GetCurrentProcessId DeviceIoControl Process32NextW Process32FirstW CreateToolhelp32Snapshot ExitProcess CreateDirectoryW GetTickCount FlushInstructionCache VirtualProtect GetSystemDirectoryW GetCurrentProcess GetModuleHandleW WriteProcessMemory lstrcpyW CreateProcessW MultiByteToWideChar CopyFileW GetModuleFileNameW GetFileAttributesW lstrcatW DeleteFileW WriteFile UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSize CreateFileW GetModuleHandleExW FindResourceW LoadResource LockResource SizeofResource TryEnterCriticalSection GetProcAddress LoadLibraryW SetWaitableTimer CreateWaitableTimerW lstrlenW WideCharToMultiByte VirtualFree ResetEvent CancelIo CreateEventW SetLastError SwitchToThread GetCurrentThreadId GetLastError FormatMessageW SetEvent Sleep WaitForSingleObject CloseHandle CreateEventA HeapDestroy HeapCreate LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapFree HeapAlloc VirtualAlloc GetCommandLineW

user32

GetCursorPos SetCursor MessageBeep DeleteMenu GetSystemMenu ReleaseCapture SetCapture GetAsyncKeyState CharUpperW IsZoomed TrackMouseEvent IntersectRect DrawIconEx IsRectEmpty OffsetRect DrawFocusRect SetWindowRgn DrawStateW DrawFrameControl DrawEdge EnumDisplayMonitors SystemParametersInfoW LoadCursorW GetSysColorBrush SetLayeredWindowAttributes GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW ReleaseDC GetDC MapVirtualKeyW GetKeyNameTextW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageW SetWindowTextW IsWindowEnabled CheckDlgButton SetDlgItemTextW MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW WindowFromPoint GetLastActivePopup GetTopWindow GetClassNameW GetClassLongW PtInRect EqualRect CopyRect MapWindowPoints MessageBoxW AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SendNotifyMessageW GetScrollPos SetScrollPos CopyAcceleratorTableW InSendMessage MonitorFromPoint SetCursorPos DestroyCursor PeekMessageW TranslateMessage DispatchMessageW ScrollWindow ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow TrackPopupMenu SetMenu GetMenu GetCapture GetKeyState SetFocus GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement DestroyWindow IsMenu GetClassInfoExW GetClassInfoW CallWindowProcW GetMessageTime GetMessagePos RegisterWindowMessageW NotifyWinEvent CreatePopupMenu DestroyMenu GetMenuDefaultItem SetMenuDefaultItem OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DestroyIcon CopyImage BringWindowToTop GetUpdateRect LockWindowUpdate SetRect RemoveMenu AppendMenuW InsertMenuW GetMenuItemCount UnionRect GetDesktopWindow GetMenuItemInfoW RegisterClipboardFormatW SetClassLongW GetActiveWindow DestroyAcceleratorTable SetParent UpdateLayeredWindow GetWindow MsgWaitForMultipleObjects EnableWindow LoadBitmapW GetClientRect FillRect InflateRect GetParent SetRectEmpty LoadMenuW GetSubMenu SendMessageW ScreenToClient InvalidateRect UpdateWindow GetWindowRect CreateAcceleratorTableW GetSysColor IsChild GetFocus LoadImageW GetSystemMetrics RedrawWindow CharUpperBuffW PostMessageW SetTimer KillTimer PostQuitMessage DefWindowProcW RegisterClassW CreateWindowExW UnregisterClassW GetMessageW GetWindowThreadProcessId IsWindowVisible GetWindowLongW EnumWindows SetWindowPos SetWindowLongW IsWindow ClientToScreen GetMenuStringW GetMenuState GetMenuItemID GetIconInfo ModifyMenuW LoadAcceleratorsW TranslateAcceleratorW EnableScrollBar IsClipboardFormatAvailable CreateMenu InsertMenuItemW UnpackDDElParam ReuseDDElParam WaitMessage SetWindowContextHelpId MapDialogRect CreateDialogIndirectParamW EndDialog GetNextDlgTabItem PostThreadMessageW ShowOwnedPopups FrameRect HideCaret InvertRect SendDlgItemMessageA RealChildWindowFromPoint ToUnicodeEx GetKeyboardLayout GetKeyboardState GetWindowRgn MapVirtualKeyExW IsCharLowerW InvalidateRgn CharNextW GetNextDlgGroupItem GetComboBoxInfo DrawIcon EnumChildWindows TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar SubtractRect CopyIcon GetDoubleClickTime SetScrollRange

gdi32

PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectObject SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign StartDocW MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetTextMetricsW CombineRgn CreateEllipticRgn Ellipse GetTextColor CreatePolygonRgn Polygon Polyline GetMapMode SetRectRgn DPtoLP CreateRoundRectRgn GetDIBits RealizePalette SetPixel StretchBlt CreateDIBSection SetDIBColorTable GetWindowOrgEx Rectangle RoundRect EndDoc StartPage EndPage AbortDoc SetAbortProc GetRgnBox OffsetRgn LPtoDP CreatePalette GetPaletteEntries ExtFloodFill SetPaletteEntries EnumFontFamiliesExW FillRgn FrameRgn GetBoundsRect PtInRegion GetViewportOrgEx GetNearestPaletteIndex GetSystemPaletteEntries GetTextFaceW SetPixelV LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel GetObjectType GetClipBox ExcludeClipRect Escape CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC BitBlt PatBlt CreateRectRgnIndirect CreateBitmap SetTextColor SetBkColor GetDeviceCaps CreateDCW CopyMetaFileW DeleteDC CreateFontIndirectW DeleteObject GetTextExtentPoint32W GetStockObject GetBkColor GetObjectW

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW GetJobW

advapi32

OpenServiceW RegDeleteValueW RegSetValueExW RegCloseKey RegEnumValueW RegEnumKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegCreateKeyExW SetFileSecurityW GetFileSecurityW RegSetValueW DeleteService ControlService StartServiceW RegOpenKeyExW CloseServiceHandle CreateServiceW OpenSCManagerW RegDeleteTreeW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken FreeSid CheckTokenMembership AllocateAndInitializeSid RegCreateKeyW RegQueryValueExW

shell32

ShellExecuteExW ExtractIconW SHGetFileInfoW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetDesktopFolder SHAppBarMessage DragQueryFileW DragFinish ShellExecuteW SHAddToRecentDocs SHBrowseForFolderW SHGetMalloc SHGetFolderPathW

comctl32

ImageList_Draw InitCommonControlsEx ImageList_AddMasked

shlwapi

PathFileExistsW PathFindExtensionW PathFindFileNameW PathStripPathW PathIsUNCW PathStripToRootW StrFormatKBSizeW PathRemoveFileSpecW

uxtheme

GetThemeColor GetCurrentThemeName GetThemeSysColor GetWindowTheme DrawThemeText IsAppThemed GetThemePartSize IsThemeBackgroundPartiallyTransparent OpenThemeData DrawThemeParentBackground DrawThemeBackground CloseThemeData

ole32

StgCreateDocfile StgOpenStorage StgIsStorageFile StringFromCLSID CreateFileMoniker CoUninitialize CoFreeUnusedLibraries OleInitialize OleUninitialize CLSIDFromString CLSIDFromProgID CoCreateInstance CoInitialize GetClassFile CoDisconnectObject OleFlushClipboard OleIsCurrentClipboard DoDragDrop OleGetClipboard CoGetClassObject CoRegisterMessageFilter CoInitializeEx OleCreateMenuDescriptor OleSetMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleGetIconOfClass OleLockRunning OleSetContainedObject OleSaveToStream OleSave OleLoad OleCreateFromFile OleCreateLinkToFile OleCreateStaticFromData OleCreate CreateItemMoniker CreateGenericComposite CreateILockBytesOnHGlobal GetHGlobalFromILockBytes WriteClassStm StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateStreamOnHGlobal SetConvertStg OleRegGetUserType ReleaseStgMedium OleDuplicateData ReadFmtUserTypeStg WriteFmtUserTypeStg CreateBindCtx CoTreatAsClass WriteClassStg ReadClassStg CoTaskMemFree CoTaskMemAlloc StringFromGUID2 CoCreateGuid CoLockObjectExternal RegisterDragDrop RevokeDragDrop CoRevokeClassObject

oleaut32

SysFreeString SysStringLen SafeArrayDestroy VariantCopy VarBstrFromDate LoadTypeLi OleCreateFontIndirect VariantTimeToSystemTime SystemTimeToVariantTime VariantChangeType SysAllocStringLen SysAllocString VariantInit VariantClear

oledlg

OleUIBusyW OleUIConvertW OleUIEditLinksW OleUIInsertObjectW OleUIAddVerbMenuW

gdiplus

GdiplusStartup GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdipFree GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics GdipDrawImageI GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdiplusShutdown GdipAlloc

ws2_32

WSASetLastError shutdown WSAResetEvent WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAEventSelect send recv select WSAIoctl connect gethostbyname socket closesocket setsockopt WSACleanup WSAGetLastError WSACreateEvent WSACloseEvent WSAStartup htons

winmm

timeGetTime PlaySoundW

psapi

GetModuleInformation

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.NVI2UI

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.NVI2

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

418KB

Virtual Size

417KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.NvStrea

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

166KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

15082026_0255_14082026_INV_No.20260813132356.EXE.iso

out.iso

INV_No.20260813132356.EXE

PE Signature issue

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wininet

pdfcore8

generic

pdfcore8.dLL

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ws2_32

winmm

psapi

oleacc

imm32

generic