15082026_1628_13082026_Purchase List.PDF .exe.iso
- SHA256 5e79ed9a3a764f9d76de68c9be7fec5a40f57d19c5e749e4ea379e97b77755fc
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Purchase List.PDF .exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
Purchase List.PDF .exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
300 seconds
General
- Target 15082026_1628_13082026_Purchase List.PDF .exe.iso
- Size 7.2MB
- Sample260815-typveszdld
- SHA256 5e79ed9a3a764f9d76de68c9be7fec5a40f57d19c5e749e4ea379e97b77755fc
- MD5 d29596b4dd6cdfe8294fff9e53b552aa
- SHA1 f31da9b4458bd99da0ce302718b69b3fdc943f8f
- SHA512 81ed4870d8d87932a86517f4558edd4da0ab5154f3c8623cf23df4f77479420ed1887b40b80c7a6206386caa64014675541b4b1f1c055aa72c10b8e0eadf6b63
- SSDEEP 98304:azknz/NQTrHcsTDB1tEog3lc2Il95rRs:a+LNHs/n+r3PIl9
- TLSH T18B767D07EC6914E9D1AED13089769163BB717C881B2123D72B50F6387FB6BE0ADB9350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack002/Purchase List.PDF .exe
File Explorer
-
15082026_1628_13082026_Purchase List.PDF .exe.iso.iso 7.2MB
-
out.iso.iso 7.2MB
-
Purchase List.PDF .exe.exe 7.1MB
out.iso
- SHA256 5e79ed9a3a764f9d76de68c9be7fec5a40f57d19c5e749e4ea379e97b77755fc
- MD5 d29596b4dd6cdfe8294fff9e53b552aa
- SHA1 f31da9b4458bd99da0ce302718b69b3fdc943f8f
- SHA512 81ed4870d8d87932a86517f4558edd4da0ab5154f3c8623cf23df4f77479420ed1887b40b80c7a6206386caa64014675541b4b1f1c055aa72c10b8e0eadf6b63
- SSDEEP 98304:azknz/NQTrHcsTDB1tEog3lc2Il95rRs:a+LNHs/n+r3PIl9
- TLSH T18B767D07EC6914E9D1AED13089769163BB717C881B2123D72B50F6387FB6BE0ADB9350
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Purchase List.PDF .exe
- IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
- SHA256 a847ee67c51c1ad0921d5a7d72fd012e95df5bfc020fa542d39e0ca1a6cac442
- MD5 15c58dd596391fcb96c6fb6674b0d4eb
- SHA1 438b2bf5b0c6a0020e09cd4e0a2d165176c6fd08
- SHA512 67208d6183382efd44f0524891228bbd7edce8c83694f84cec15251f3d93a15d6ef9f44e6108828c4d92981c30f13b1431d35ed51e93dd94b9ab18b95f07902e
- SSDEEP 98304:Yzknz/NQTrHcsTDB1tEog3lc2Il95rRsm:Y+LNHs/n+r3PIl9f
- TLSH T13E767D07EC6914E9D1AED13089769163BB717C881B2123D72B50F6387FB6BE0ADB9350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
Password
infected
PE Signature issue
Digest
5e:03:67:17:a9:66:99:f8:03:22:ab:d1:1b:da:82:5c:e0:40:5c:1c:25:02:b6:2c:d7:d5:c6:b7:f6:12:93:f4
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=D03752763,CN=Epic Games Inc.,O=Epic Games Inc.,L=Cary,ST=North Carolina,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6172796c616e64,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jul 17, 2026
SERIALNUMBER=D03752763,CN=Epic Games Inc.,O=Epic Games Inc.,L=Cary,ST=North Carolina,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6172796c616e64,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=D03752763,CN=Epic Games Inc.,O=Epic Games Inc.,L=Cary,ST=North Carolina,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6172796c616e64,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
5e:03:67:17:a9:66:99:f8:03:22:ab:d1:1b:da:82:5c:e0:40:5c:1c:25:02:b6:2c:d7:d5:c6:b7:f6:12:93:f4
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=D03752763,CN=Epic Games Inc.,OU=Epic Games Inc.,O=Epic Games Inc.,L=Cary,ST=North Carolina,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6172796c616e64,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jan 29, 2026
SERIALNUMBER=D03752763,CN=Epic Games Inc.,OU=Epic Games Inc.,O=Epic Games Inc.,L=Cary,ST=North Carolina,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6172796c616e64,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=D03752763,CN=Epic Games Inc.,OU=Epic Games Inc.,O=Epic Games Inc.,L=Cary,ST=North Carolina,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6172796c616e64,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=D03752763,CN=Epic Games Inc.,OU=Epic Games Inc.,O=Epic Games Inc.,L=Cary,ST=North Carolina,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6172796c616e64,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0f:d2:6b:28:f0:6e:7b:82:0c:6f:99:2f:37:08:a9:a3
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 15, 2025 - Feb 15, 2026
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
SERIALNUMBER=D03752763,CN=Epic Games Inc.,O=Epic Games Inc.,L=Cary,ST=North Carolina,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6172796c616e64,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
09:8c:93:39:b5:1a:60:b6:d5:2f:36:b7:0b:5f:aa:a7
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 2, 2026 - Feb 1, 2029
Minor OS version
1
Major OS version
6
Entry point
548064
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
GetProcAddress
LoadLibraryExW
Name
.text
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
308KB
Virtual Size
32.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ