15082026_1607_14082026_20260813085418[.]exe[.]iso

Sharing

Copy URL Twitter E-mail

General

Target
15082026_1607_14082026_20260813085418.exe.iso
Size 6.7MB
Sample260815-tk1prszbrg
SHA256 e417f9ca60ca104c5080a0ceff81f8b30326ca146687d01726bce8214af4ad32
MD5 cd05a364449f9e7ac8480b7f2d847bb0
SHA1 22b959cea554d0e41f890b0d9bbaddae95a7f4b3
SHA512 02f12d967c4ab59ff99e8a223fdf5e7fbd6ee456826fb7d4461ca9f5aa45840d8af2f2bcc82ba9e2bc02472769fb1ee250cbc22760375ab75fcc75cc649ad62f
SSDEEP 196608:7t5NpPUCCJ5qZ1H7ZuJPGciZ4O7NADtV6v+zZR3ro2K:J2CZEfiN7kbV
TLSH
T11F66BF113E4C4CA7F06623338B5D62B8E66EADE63BA19E8715807FCDB9313414A7471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Pdfcore8.dLL

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack002/20260813085418.exe

File Explorer

15082026_1607_14082026_20260813085418.exe.iso

.iso 6.7MB
out.iso

.iso 6.7MB
20260813085418.exe

.exe 1.1MB
INV-No.880C4B7B55A3CAB3D72.doc.LNK

.lnk 419B
Pdfcore8.dLL

.dll 5.5MB

15082026_1607_14082026_20260813085418.exe.iso

SHA256 e417f9ca60ca104c5080a0ceff81f8b30326ca146687d01726bce8214af4ad32
MD5 cd05a364449f9e7ac8480b7f2d847bb0
SHA1 22b959cea554d0e41f890b0d9bbaddae95a7f4b3
SHA512 02f12d967c4ab59ff99e8a223fdf5e7fbd6ee456826fb7d4461ca9f5aa45840d8af2f2bcc82ba9e2bc02472769fb1ee250cbc22760375ab75fcc75cc649ad62f
SSDEEP 196608:7t5NpPUCCJ5qZ1H7ZuJPGciZ4O7NADtV6v+zZR3ro2K:J2CZEfiN7kbV
TLSH
T11F66BF113E4C4CA7F06623338B5D62B8E66EADE63BA19E8715807FCDB9313414A7471B
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

20260813085418.exe

IMPHASH c004104c4c322eff3c5df1dac0b72b0b
SHA256 1180c0180e9e175ec90378f68c1cf0eb177beb9b66d202eda966fe8a8ef9d1f6
MD5 13412cd73870016f6f59125e47e076a9
SHA1 1060f66f1ab91b99144f45cbe97abca77cd9e2cc
SHA512 d7431b3214cf3e8f03bfb14e714b11b468d1e3411f4f0f824cc6aa20254c5e3a70dd5a823c24e19c4cd464701103a67cbaa2efc50724e7a024a79be226bda163
SSDEEP 12288:h0sTavoBAocQGtg7JZ+RyDETRfMjyItHyxPwZAbjvRhgSqq16:qm4JNtg7yFlMjttOwZAbjvRw
TLSH
T130456D8296404D23F852BBB14B4E46398F2E8EE77690FF8258907DCD7A3519E19F2317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

infected

PE Signature issue

Digest

6c:d3:73:c0:f5:4e:84:58:ad:6b:31:38:9f:89:2d:51:c5:57:c2:51

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Zeon Corporation,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Zeon Corporation,L=Taipei,ST=Taiwan,C=TW

Chains

Oct 30, 2013

CN=Zeon Corporation,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Zeon Corporation,L=Taipei,ST=Taiwan,C=TW

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Zeon Corporation,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Zeon Corporation,L=Taipei,ST=Taiwan,C=TW

Serial Number

32:a1:88:ef:e4:09:9d:9d:72:93:a5:30:2a:bd:43:9d

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 10, 2012 - Feb 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 7, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

236573

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

i:\build\hudson\jobs\GaaihoPDFDriver\workspace\GaaihoPDF\Accessory\release\suite\GPDFDirect.pdb

kernel32

SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTimeZoneInformation GetCPInfo GetOEMCP IsValidCodePage GetTimeFormatA GetDateFormatA GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetCurrentDirectoryA GetDriveTypeA CreateFileA SetEnvironmentVariableA CloseHandle GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStdHandle VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect HeapSize HeapReAlloc RaiseException RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime GetStartupInfoW GetFileTime SetErrorMode GetFullPathNameW GetVolumeInformationW DuplicateHandle SetEndOfFile UnlockFile DeviceIoControl GetVolumeInformationA GetComputerNameW OpenMutexW OpenFileMappingW UnmapViewOfFile CreateFileMappingW MapViewOfFile SleepEx SetFilePointer WriteFile CreateFileW GetFileSize LockFile FlushFileBuffers ReadFile lstrcmpiW GlobalFlags GetThreadLocale MoveFileW OutputDebugStringW GetLocalTime GetLastError lstrcpyW GetTempPathW DeleteFileW lstrcpyA GetSystemDirectoryA lstrcatA SizeofResource LockResource LoadResource FindResourceW GetProcAddress SetLastError LoadLibraryW GetModuleHandleW CreateMutexW lstrlenW HeapFree GetProcessHeap ExitProcess ReleaseMutex HeapAlloc FreeLibrary GetFileAttributesW IsBadWritePtr CompareFileTime GetFileInformationByHandle FileTimeToLocalFileTime CreateDirectoryW FileTimeToSystemTime GetDateFormatW GetTimeFormatW GetPrivateProfileIntW FormatMessageW LocalFree CopyFileW GetPrivateProfileStringW WritePrivateProfileStringW TlsFree DeleteCriticalSection Sleep GetTickCount CreateThread WaitForSingleObject GetModuleFileNameW GetVersion GetVersionExW GetWindowsDirectoryW FindFirstFileW FindClose GetTempFileNameW LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GetCurrentProcessId InterlockedIncrement lstrlenA GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange GetModuleHandleA InterlockedDecrement FreeResource GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA FindNextFileW lstrcmpW GetVersionExA GlobalFree GlobalAlloc GlobalLock GlobalUnlock MulDiv MultiByteToWideChar GetACP WideCharToMultiByte GetCurrentProcess

user32

RegisterClipboardFormatW CharUpperW MessageBeep GetNextDlgGroupItem InvalidateRgn IsRectEmpty CopyAcceleratorTableW CharNextW UnregisterClassW GetWindowThreadProcessId GetSysColorBrush ValidateRect SetWindowContextHelpId EndPaint BeginPaint GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW DestroyMenu SetMenuItemBitmaps GetMenuCheckMarkDimensions MoveWindow SetWindowTextW IsDialogMessageW wvsprintfW EnableWindow SendMessageW LoadIconW wsprintfW GetSubMenu EnableMenuItem SetDlgItemTextW GetDesktopWindow CreateDialogIndirectParamW IsWindowEnabled EndDialog RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetLastActivePopup SetActiveWindow PostThreadMessageW PostMessageW GetParent ModifyMenuW GetCursorPos ScreenToClient PtInRect InvalidateRect LoadMenuW RegisterClassExW CreateWindowExW ShowWindow UpdateWindow DestroyWindow SetWindowLongW GetWindowLongW DefWindowProcW GetDC OffsetRect ReleaseDC GetSysColor DrawFocusRect LoadBitmapW IsWindow CopyRect DrawFrameControl ClientToScreen WindowFromPoint UnregisterClassA wsprintfA LoadStringA GetActiveWindow SetForegroundWindow GetDlgItem GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints TrackPopupMenu GetKeyState GetMenu GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect GetDlgCtrlID CallWindowProcW IntersectRect SystemParametersInfoA GetWindowPlacement GetWindow GetMenuState GetMenuStringW GetMenuItemID GetMenuItemCount LoadStringW MessageBoxW DispatchMessageW TranslateMessage GetMessageW ReleaseCapture FindWindowW GetWindowRect CheckMenuItem SetMenuDefaultItem LoadImageW SetRect DestroyIcon IsIconic PostQuitMessage GetSystemMetrics DrawIcon SetWindowPos SetTimer GetFocus KillTimer GetNextDlgTabItem IsWindowVisible SetCapture GetClientRect LoadCursorW SetCursor MapDialogRect

gdi32

SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC GetStockObject GetWindowExtEx GetRgnBox GetViewportExtEx DeleteObject GetTextExtentPoint32W GetTextMetricsW CreateCompatibleDC GetTextColor GetBkColor CreatePen ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape TextOutW RectVisible PtVisible GetMapMode GetObjectW CreateFontIndirectW GetDeviceCaps GetClipBox SetTextColor SetBkColor CreateBitmap CreateRectRgnIndirect ExtTextOutW SaveDC RestoreDC SetBkMode SetMapMode LineTo MoveToEx

msimg32

TransparentBlt

comdlg32

GetOpenFileNameW GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

GetFileSecurityW ImpersonateSelf OpenThreadToken RevertToSelf MapGenericMask AccessCheck ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorSacl OpenSCManagerA OpenServiceW QueryServiceStatus ControlService StartServiceA CloseServiceHandle RegSetValueExW RegCreateKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation DragAcceptFiles SHGetMalloc SHGetFileInfoW Shell_NotifyIconW ShellExecuteW DragQueryFileW

comctl32

_TrackMouseEvent InitCommonControlsEx

shlwapi

PathStripToRootW PathFindExtensionW PathIsUNCW PathFileExistsW PathFindFileNameW

oledlg

OleUIBusyW

ole32

OleInitialize CoFreeUnusedLibraries OleUninitialize OleFlushClipboard StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CoCreateInstance CLSIDFromString CoRevokeClassObject CoTaskMemAlloc CoTaskMemFree CoUninitialize CoInitialize CLSIDFromProgID CoRegisterMessageFilter OleIsCurrentClipboard CreateILockBytesOnHGlobal

oleaut32

SysAllocString OleCreateFontIndirect SysStringLen SysFreeString SysAllocStringLen VariantClear VariantChangeType VariantInit VariantCopy SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime

wininet

HttpEndRequestA InternetWriteFile HttpSendRequestExA InternetErrorDlg HttpQueryInfoA InternetCloseHandle InternetOpenA InternetConnectA InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetReadFile

pdfcore8

CoreLibInit CoreLibFin GetCoreHFT

Pdfcore8.dLL

IMPHASH 0d64066d57a5fb141cda9115fa72319a
SHA256 cc9dd67664c7aeace554d70bdf08ba06005dc48a32f44245e7a0a4feb7ca4b25
MD5 14afbe985c622f7252a5e4fce70975d8
SHA1 5b678160511ca1201fc7e484a02b904acadd8841
SHA512 334cc223aa2c3663506ddd4fc65bc7f858339a86e1a0b6a9d183c1fd8beb652084bc6659039e71138377fe875c3220da75a03700d0e43ca301ebd6414876f4b7
SSDEEP 98304:xPGFGY4xkSDQU+7JZGBqBz5qZ1Ia7ZIJYyP26hCF21ZOZ4OiZrq1DfPHNADtV6vd:xPUCCJ5qZ1H7ZuJPGciZ4O7NADtV6v+Y
TLSH
T16046CF113D9C80D6F07A1233CEA9B6ACF26EAD643F7601972680B79DFD327414B1856B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

1582017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\iProject\NvPluginWatchdog\Release\NvPluginWatchdog.pdb

kernel32

GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW IsValidLocale LCMapStringW GetStdHandle GetFileType FreeEnvironmentStringsW GetSystemTimeAsFileTime GetCommandLineW GetCommandLineA QueryPerformanceFrequency VirtualQuery GetSystemInfo FreeLibraryAndExitThread ExitThread InterlockedFlushSList RtlUnwind GetCPInfo GetStringTypeW LCMapStringEx RaiseException OutputDebugStringW GetEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW SetStdHandle QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FindResourceExW SystemTimeToTzSpecificLocalTime LocalFileTimeToFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime GetStringTypeExW MoveFileW DuplicateHandle UnlockFile SetEndOfFile ReadFile LockFile GetVolumeInformationW GetShortPathNameW FlushFileBuffers InitializeSListHead FindFirstFileW FindClose SearchPathW GetProfileIntW SetFilePointer GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW LocalReAlloc LocalAlloc GlobalHandle TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetThreadLocale WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetTickCount64 CompareStringA GetVersionExW GetCurrentThread GlobalGetAtomNameW lstrcmpA lstrcmpiW GetWindowsDirectoryW GetUserDefaultLCID ReplaceFileW SetFileTime GetTempFileNameW GetFullPathNameW GetFileTime GetDiskFreeSpaceW GetCurrentDirectoryW ResumeThread SetThreadPriority GlobalReAlloc VerifyVersionInfoW VerSetConditionMask SystemTimeToFileTime FileTimeToSystemTime CompareStringW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryA LoadLibraryExW GetModuleHandleA FreeLibrary EncodePointer OutputDebugStringA MulDiv LocalFree GlobalFree GlobalLock GlobalUnlock GlobalSize GlobalAlloc GetProcessHeap DecodePointer HeapReAlloc HeapSize InitializeCriticalSectionEx GetLocalTime GetTempPathW CreateMutexW CreateThread GetCurrentProcessId DeviceIoControl Process32NextW Process32FirstW CreateToolhelp32Snapshot ExitProcess CreateDirectoryW GetFileAttributesW GetTickCount FlushInstructionCache VirtualProtect GetSystemDirectoryW GetCurrentProcess GetModuleHandleW WriteProcessMemory lstrcpyW CreateProcessW MultiByteToWideChar CopyFileW GetModuleFileNameW lstrcatW DeleteFileW WriteFile UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSize CreateFileW GetModuleHandleExW FindResourceW LoadResource LockResource SizeofResource TryEnterCriticalSection GetProcAddress LoadLibraryW SetWaitableTimer CreateWaitableTimerW lstrlenW WideCharToMultiByte ResetEvent VirtualFree CancelIo CreateEventW SetLastError SwitchToThread GetCurrentThreadId GetLastError FormatMessageW SetEvent Sleep WaitForSingleObject CloseHandle CreateEventA HeapDestroy HeapCreate LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapFree HeapAlloc VirtualAlloc HeapQueryInformation

user32

GetCursorPos SetCursor MessageBeep DeleteMenu GetSystemMenu ReleaseCapture SetCapture GetAsyncKeyState CharUpperW IsZoomed TrackMouseEvent IntersectRect DrawIconEx IsRectEmpty OffsetRect DrawFocusRect SetWindowRgn DrawStateW DrawFrameControl DrawEdge EnumDisplayMonitors SystemParametersInfoW LoadCursorW GetSysColorBrush SetLayeredWindowAttributes GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW ReleaseDC GetDC MapVirtualKeyW GetKeyNameTextW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageW SetWindowTextW IsWindowEnabled CheckDlgButton SetDlgItemTextW MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW WindowFromPoint GetLastActivePopup GetTopWindow GetClassNameW GetClassLongW PtInRect EqualRect CopyRect MapWindowPoints MessageBoxW AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SendNotifyMessageW GetScrollPos SetScrollPos ScrollWindow ValidateRect MonitorFromPoint CopyAcceleratorTableW InSendMessage IsClipboardFormatAvailable SetCursorPos DestroyCursor PeekMessageW TranslateMessage DispatchMessageW BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow TrackPopupMenu SetMenu GetMenu GetCapture GetKeyState SetFocus GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement DestroyWindow IsMenu GetClassInfoExW GetClassInfoW CallWindowProcW GetMessageTime GetMessagePos RegisterWindowMessageW NotifyWinEvent CreatePopupMenu DestroyMenu GetMenuDefaultItem SetMenuDefaultItem OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DestroyIcon CopyImage BringWindowToTop GetUpdateRect LockWindowUpdate SetRect RemoveMenu AppendMenuW InsertMenuW GetMenuItemCount UnionRect GetDesktopWindow GetMenuItemInfoW RegisterClipboardFormatW SetClassLongW GetActiveWindow DestroyAcceleratorTable SetParent UpdateLayeredWindow GetWindow MsgWaitForMultipleObjects EnableWindow LoadBitmapW GetClientRect FillRect InflateRect GetParent SetRectEmpty LoadMenuW GetSubMenu SendMessageW ScreenToClient InvalidateRect UpdateWindow GetWindowRect ToUnicodeEx GetSysColor IsChild GetFocus LoadImageW GetSystemMetrics RedrawWindow CharUpperBuffW PostMessageW SetTimer KillTimer PostQuitMessage DefWindowProcW RegisterClassW CreateWindowExW UnregisterClassW GetMessageW GetWindowThreadProcessId IsWindowVisible GetWindowLongW EnumWindows SetWindowPos SetWindowLongW IsWindow ClientToScreen GetMenuStringW GetMenuState GetMenuItemID GetIconInfo ModifyMenuW LoadAcceleratorsW TranslateAcceleratorW EnableScrollBar EndPaint CreateMenu InsertMenuItemW UnpackDDElParam ReuseDDElParam WaitMessage SetWindowContextHelpId MapDialogRect CreateDialogIndirectParamW EndDialog GetNextDlgTabItem PostThreadMessageW ShowOwnedPopups FrameRect HideCaret InvertRect SendDlgItemMessageA RealChildWindowFromPoint GetWindowRgn MapVirtualKeyExW IsCharLowerW InvalidateRgn CharNextW GetNextDlgGroupItem GetComboBoxInfo DrawIcon EnumChildWindows TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar SubtractRect CopyIcon GetDoubleClickTime CreateAcceleratorTableW GetKeyboardState GetKeyboardLayout SetScrollRange

gdi32

LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectObject SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign StartDocW MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetTextMetricsW CombineRgn IntersectClipRect Ellipse GetBkColor GetTextColor CreatePolygonRgn Polygon Polyline GetMapMode SetRectRgn DPtoLP CreateRoundRectRgn GetDIBits RealizePalette SetPixel StretchBlt CreateDIBSection SetDIBColorTable GetWindowOrgEx Rectangle RoundRect EndDoc StartPage EndPage AbortDoc SetAbortProc GetRgnBox OffsetRgn LPtoDP CreatePalette GetPaletteEntries ExtFloodFill SetPaletteEntries EnumFontFamiliesExW FillRgn FrameRgn GetBoundsRect PtInRegion GetViewportOrgEx GetNearestPaletteIndex GetSystemPaletteEntries GetTextFaceW SetPixelV GetWindowExtEx GetViewportExtEx GetPixel GetObjectType GetClipBox ExcludeClipRect Escape CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC BitBlt PatBlt CreateRectRgnIndirect CreateBitmap SetTextColor SetBkColor GetDeviceCaps CreateDCW CopyMetaFileW DeleteDC CreateFontIndirectW DeleteObject GetTextExtentPoint32W GetStockObject CreateEllipticRgn GetObjectW

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW GetJobW

advapi32

StartServiceW RegDeleteValueW RegSetValueExW RegCloseKey RegEnumValueW RegEnumKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegCreateKeyExW SetFileSecurityW GetFileSecurityW RegSetValueW DeleteService ControlService RegOpenKeyExW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW RegDeleteTreeW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCreateKeyW RegQueryValueExW

shell32

ShellExecuteExW ExtractIconW SHGetFileInfoW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetDesktopFolder SHAppBarMessage DragQueryFileW DragFinish ShellExecuteW SHAddToRecentDocs SHBrowseForFolderW SHGetMalloc SHGetFolderPathW

comctl32

ImageList_Draw InitCommonControlsEx ImageList_AddMasked

shlwapi

PathFileExistsW PathFindExtensionW PathFindFileNameW PathStripPathW PathIsUNCW PathStripToRootW StrFormatKBSizeW PathRemoveFileSpecW

uxtheme

GetThemeColor GetCurrentThemeName GetThemeSysColor GetWindowTheme DrawThemeText IsAppThemed GetThemePartSize IsThemeBackgroundPartiallyTransparent OpenThemeData DrawThemeParentBackground DrawThemeBackground CloseThemeData

ole32

StgCreateDocfile StgOpenStorage StgIsStorageFile StringFromCLSID CreateFileMoniker CoUninitialize CoFreeUnusedLibraries OleInitialize OleUninitialize CLSIDFromString CLSIDFromProgID CoCreateInstance CoInitialize GetClassFile CoDisconnectObject OleFlushClipboard OleIsCurrentClipboard DoDragDrop OleGetClipboard CoGetClassObject CoRegisterMessageFilter CoInitializeEx OleCreateMenuDescriptor OleSetMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleGetIconOfClass OleLockRunning OleSetContainedObject OleSaveToStream OleSave OleLoad OleCreateFromFile OleCreateLinkToFile OleCreateStaticFromData OleCreate CreateItemMoniker CreateGenericComposite CreateILockBytesOnHGlobal GetHGlobalFromILockBytes WriteClassStm StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateStreamOnHGlobal SetConvertStg OleRegGetUserType ReleaseStgMedium OleDuplicateData ReadFmtUserTypeStg WriteFmtUserTypeStg CreateBindCtx CoTreatAsClass WriteClassStg ReadClassStg CoTaskMemFree CoTaskMemAlloc StringFromGUID2 CoCreateGuid CoLockObjectExternal RegisterDragDrop RevokeDragDrop CoRevokeClassObject

oleaut32

SysFreeString SysStringLen SafeArrayDestroy VariantCopy VarBstrFromDate LoadTypeLi OleCreateFontIndirect VariantTimeToSystemTime SystemTimeToVariantTime VariantChangeType SysAllocStringLen SysAllocString VariantInit VariantClear

oledlg

OleUIBusyW OleUIConvertW OleUIEditLinksW OleUIInsertObjectW OleUIAddVerbMenuW

gdiplus

GdiplusStartup GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdipFree GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics GdipDrawImageI GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdiplusShutdown GdipAlloc

ws2_32

WSASetLastError shutdown WSAResetEvent WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAEventSelect send recv select WSAIoctl connect gethostbyname socket closesocket setsockopt WSACleanup WSAGetLastError WSACreateEvent WSACloseEvent WSAStartup htons

winmm

timeGetTime PlaySoundW

psapi

GetModuleInformation

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.NVI2UI

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.NVI2

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

418KB

Virtual Size

417KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.NvAI0

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

15082026_1607_14082026_20260813085418.exe.iso

out.iso

20260813085418.exe

PE Signature issue

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wininet

pdfcore8

generic

INV-No.880C4B7B55A3CAB3D72.doc.LNK

Pdfcore8.dLL

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ws2_32

winmm

psapi

oleacc

imm32

generic