fbd1bdfdd65b64f774ec75fd56d3362b6b97c1517e2b7a90e69eac7012256930
- SHA256 fbd1bdfdd65b64f774ec75fd56d3362b6b97c1517e2b7a90e69eac7012256930
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
bin/IF-FrameV4.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
bin/IF-FrameV4.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
bin/IF-FrameV4.vshost.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
bin/IF-FrameV4.vshost.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
bin/InterFaceV4.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
bin/InterFaceV4.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target fbd1bdfdd65b64f774ec75fd56d3362b6b97c1517e2b7a90e69eac7012256930
- Size 1.4MB
- Sample260820-eexctsel3y
- SHA256 fbd1bdfdd65b64f774ec75fd56d3362b6b97c1517e2b7a90e69eac7012256930
- MD5 c28c63132aeee73b0e255f70c60ac6ab
- SHA1 bafb8a0a155825df8bfeee88ea49761dd7b3295b
- SHA512 3c33f12670035deff0bd687c6ea598f9b9f71469e559de41f9d2c1057238c59613f8223446b1efe2ab7f1a2a6ab55b34a4f904596f29d9c5687dcc9ca534d798
- SSDEEP 24576:fnj3xe4ECvmtP4WDsMarcA2sqIzlUJszs90cWgyyhp0FaOKTUb/VQVvVX1z1HUw7:vj39E+4dsNcAYclzs9xLyyhp0PhsNlBX
- TLSH T1BE6533D5AA148E910F81DC728A934ADE9C611B539FFC9F442A3E62C645F0730EECF5A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/bin/IF-FrameV4.exe unpack001/bin/InterFaceV4.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/bin/IF-FrameV4.vshost.exe
File Explorer
-
fbd1bdfdd65b64f774ec75fd56d3362b6b97c1517e2b7a90e69eac7012256930.zip 1.4MB
-
bin/IF-FrameV4.exe.exe 1.5MB
-
bin/IF-FrameV4.pdb91KB
-
bin/IF-FrameV4.vshost.exe.exe 11KB
-
bin/IF-FrameV4.vshost.exe.manifest490B
-
bin/InterFaceV4.dll.dll 187KB
-
bin/InterFaceV4.dll.config910B
-
bin/InterFaceV4.pdb393KB
-
bin/MDEP.ini480B
bin/IF-FrameV4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 35443ffff59a51e6d2adb476d93617813eb4bc5884a73ce8bb4efb988ea5c67c
- MD5 4f7f874ab09a2aed5e03c7f098890db7
- SHA1 0afa15af51d7118f7c99935324dc39da03d08da1
- SHA512 22fef9c3d12d674b5b8c85d07c954e3eff0dfe5a17163df6aeb2bae55ab09e5affff69548d6e32498865a0db7dc321a0e008456d79f08b8e9e08344dd81eb88b
- SSDEEP 24576:Ni/wLAez2ScE11UqBCcWDbL/Xbd+g1YsM74Ywe/zVhZr5amAjcZz3R3E0Xbd+g1:N2Z6cq1UqB42sPYwe/BhZrcVYea
- TLSH T1EA65011368144F82F81D97F4BE531D881BE91A09B552FAAE1CD92CC73FD9B018D8992F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1550774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Project\MDSD\ICUSM\上海市中西医结合医院v4.0.0.29\NET-DLL-V4\InterFaceTestForm\obj\Debug\IF-FrameV4.pdb
mscoree
_CorExeMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/IF-FrameV4.pdb
- SHA256 2d959429b82d4aef7e1ec742b8497a6683c684a7950d26ee17f028c095e0c3e3
- MD5 89094c64648ce602e578715a26ee8b65
- SHA1 805882e507d4ad99fe6945a46b293f31d06755c9
- SHA512 7971de0a9d9bc145016c4fe9f32a437dc1cd84e2f71497cc11b63334ef095041b0b7ffea82fcb78fdb88c4ec544af56092b67b3d7afa12aedc7e5546c9b5740a
- SSDEEP 768:iHxGmbq+rHtggkLoAM7MWyZNM2PYYoAFlPXXcVKa+LqwrdN6vD0+SIIIINvmZ+bV:aZAM71yZu2PoAZXsVMdrA+bJUzFIe5O
- TLSH T1D2937E1BBB84C932C46581F4879B0F3D6338DE981B469BDB23A9B57C2EF175A1E85700
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/IF-FrameV4.vshost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dedf37e612010e49ad9fefaffb1f0713c135a4ba97d7f55d66181bdcf1c8ac18
- MD5 3e75b56c3b756c1e37100011f490c941
- SHA1 a469c9ea57c5d401e37c53e56cfc5614a1355849
- SHA512 2ce7564299867b6d1662d89001763c36dac1052ecdc6819bc1218610e0cf0a02a1f6c5b93377427f5ab60c2883b9b097c38c93a1e770d51a52679465e1cda451
- SSDEEP 192:/qhLnxBf3WenW1QKPnEtObMacxc8hjXHUz1TrmbDcC:exhWenW1LXci2jXHUsYC
- TLSH T139322B918B6CC213FD6A4D7166F6EA937C78D7C34D22D62F00DAE6880C477D09A35E15
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
ac:1d:f0:9a:91:24:21:60:e8:28:54:3d:01:48:53:39:6b:34:27:09
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 21, 2009
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:a2:30:00:00:00:00:00:08
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
0
Major OS version
4
Entry point
10846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\dd\vsproject\vshost\vshost32\objr\i386\vshost32.pdb
mscoree
_CorExeMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/IF-FrameV4.vshost.exe.manifest
- SHA256 c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f
- MD5 a19a2658ba69030c6ac9d11fd7d7e3c1
- SHA1 879dcf690e5bf1941b27cf13c8bcf72f8356c650
- SHA512 fa583ba012a80d44e599285eb6a013baf41ffbe72ee8561fc89af0ec5543003ba4165bfe7b1ba79252a1b3b6e5626bf52dc712eacd107c0b093a5a2757284d73
- TLSH T1F1F0DCC1D188CA6AD73042A13A66E420A2AD435B19DD49EC74DC2ABB6F0BBC680C30F1
- MD5 SHA1 SHA512 TLSH
bin/InterFaceV4.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8f95ffb9a66a79c761f1141b9e7ef1c036c6f1e7b9ac6e3ae0e35dfe88621499
- MD5 0af4061ef33fc13cfd68959f1ca877f9
- SHA1 abf9b98b4e5ebfeaa1c503641b0ed00c7ac72b33
- SHA512 b87dc4efc67a70b86949d99735118ca944460c53bd39ee039bc96a2d3d3e1b9d48d105ad0c61fb6d3f405f829e76855df7eabe69b7a20e73717ac447ec691219
- SSDEEP 3072:VZrqPrr8tdwxu0Q56f7yc3ofXpEbtBMe2qcuWP1u:VZrX2f7yc3vWT
- TLSH T1E6149398B7DD286DE17F66B98FF1C11542FA7885161BDE0E0FE060CA1C35B928B13A74
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
197382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Project\MDSD\ICUSM\上海市中西医结合医院v4.0.0.29\NET-DLL-V4\InterFaceDLLv4\obj\Debug\InterFaceV4.pdb
mscoree
_CorDllMain
Name
.text
Size
185KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/InterFaceV4.dll.config
- SHA256 93c728794143a801771e0bb385163d030edcc2c31f6cec8fda3e326b06e6d4b2
- MD5 cfc42c2b0bdd24d7bceb269c4a217db2
- SHA1 bb6d0dacc7a8ec7362f676df0c5ab4c9e504461d
- SHA512 6b24df73b5270016540ec98bcea23c1d8a0251f431e1d59083cc5d58e9ecec5eb4b2f1f9ee5ae916d52e12f5f8654de95290b64736d4e154f8875359f21b3819
- TLSH T174116F54218ABE9A07632A32DD22C640CEB242DB15773428707E127E5F758CF03833BE
- MD5 SHA1 SHA512 TLSH
bin/InterFaceV4.pdb
- SHA256 864b0c1e08469aa003fb5fe686835985aeb43591de14212e89c66d269e271480
- MD5 6c59b152f9701c6d3456927f8da51f00
- SHA1 9d826ee5dc0850b450e1bc9cb3ffe70b18e7fa16
- SHA512 a5c2f72edcf91d6995a917b6e5ba66e42b46874cceb34fdf6df467c8f705db744d56c89e6b02c61137e5ec65833a287d6b46652c81597d700393d07bcfe9bf3d
- SSDEEP 6144:lZ4eZREwZ9ki9kE9kPWd46iyKMyay2kZe:JZRi
- TLSH T1FE8451A37B80C933C415883566EB2F1F937CE1980F0BAB9F8B55A56D3D9137A2D46390
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/MDEP.ini
- SHA256 06c9599226c0db49d015d7b32302a66925de4a16efc29be87e20007f39c668b3
- MD5 889a78412155654e0ef7334f1c82f7d6
- SHA1 413501509138259e6d464366d3ec72916709377a
- SHA512 ea1b2f1f8912f7f499fa3690d74a948c02e854ac4276c74315d7ff6c80d398e802e7eb74da677e7e6ffe4217b9de127b8eb8e93f97cfe5bb3ada37420c4bfc19
- TLSH T127F0D45944CF7545C84990E893FC541D16C2BE5144C005647C198719B9FBC8E31C6B1E
- MD5 SHA1 SHA512 TLSH