IMG_7482322142[.]scr

Sharing

Copy URL Twitter E-mail

General

Target
IMG_7482322142.scr
Size 259KB
Sample260819-w16basfp31
SHA256 9911a3452701797899b1ea65a6f1c85ad34f7f672abc3f0e43f87dae9e74ce82
MD5 fa56e66a54812e38750cd3181abd492a
SHA1 47c0040672ebb1fa080c50eb5848b6fc3e907e99
SHA512 dfc806d93c340e8d1df2609fc4ae9f36dbd59e7dc0e527f0302f5ae2bc1216974e0c668c4a6d45f850669f19c42220695b95bb87ffb965b2a773e8d9c6d9e8d5
SSDEEP 3072:jrHxyxHejYioFGs0JW8xjburmtJ90iHtxgSu9RI8s8fqBQIM8L8:jrxyxHepU8MeP0kxgh968s8fqBlL8
TLSH
T129449E13B66A61EBD36AB634C4914601FF727C721B516ADF179839A70E336D08F3A702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

IMG_7482322142.scr

.exe 259KB

IMG_7482322142.scr

IMPHASH 75cc7bda7cbbe6c4a6363db521248564
SHA256 9911a3452701797899b1ea65a6f1c85ad34f7f672abc3f0e43f87dae9e74ce82
MD5 fa56e66a54812e38750cd3181abd492a
SHA1 47c0040672ebb1fa080c50eb5848b6fc3e907e99
SHA512 dfc806d93c340e8d1df2609fc4ae9f36dbd59e7dc0e527f0302f5ae2bc1216974e0c668c4a6d45f850669f19c42220695b95bb87ffb965b2a773e8d9c6d9e8d5
SSDEEP 3072:jrHxyxHejYioFGs0JW8xjburmtJ90iHtxgSu9RI8s8fqBQIM8L8:jrxyxHepU8MeP0kxgh968s8fqBlL8
TLSH
T129449E13B66A61EBD36AB634C4914601FF727C721B516ADF179839A70E336D08F3A702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

5b:99:bb:c5:27:3a:c7:a9:ff:ec:5c:cc:68:fe:3f:e3:a4:29:64:5f:f1:68:26:f2:3e:cd:be:f6:71:0a:b3:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Rha Soft Limited,O=Rha Soft Limited,L=Luton,ST=Bedford,C=GB

Chains

May 6, 2026

CN=Rha Soft Limited,O=Rha Soft Limited,L=Luton,ST=Bedford,C=GB

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Rha Soft Limited,O=Rha Soft Limited,L=Luton,ST=Bedford,C=GB

Serial Number

33:00:00:c9:05:29:c4:aa:31:d6:81:8e:ea:00:00:00:00:c9:05

Issuer

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 5, 2026 - May 8, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:17:27:45:09:0b:8b:87:af:c6:00:00:00:00:00:17

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:491A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5a:f6:0d:67:8c:85:ed:dd:08:00:00:00:00:00:5a

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

11656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\stevie\Desktop\AInstaller\AdvIns\x64\Release\AdvIns.pdb

kernel32

CloseHandle CreateProcessW SizeofResource WriteFile CreateFileW LockResource DeleteFileW LoadResource FindResourceW GetTempFileNameW WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetProcessHeap LCMapStringW VirtualProtect InitializeCriticalSectionEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

bcrypt

BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGetProperty BCryptDestroyKey

msi

ord141 ord88

Name

.text

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

IMG_7482322142.scr

kernel32

shell32

ole32

bcrypt

msi

generic