53b2086b2a19a75567a73a3f8516a624bb0af3047917ad5f62dfde4f4fb95e67
- SHA256 53b2086b2a19a75567a73a3f8516a624bb0af3047917ad5f62dfde4f4fb95e67
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_v3.0.02.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_v3.0.02.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 53b2086b2a19a75567a73a3f8516a624bb0af3047917ad5f62dfde4f4fb95e67
- Size 3.0MB
- Sample260822-tk8elswekf
- SHA256 53b2086b2a19a75567a73a3f8516a624bb0af3047917ad5f62dfde4f4fb95e67
- MD5 1e1b5a2d85255000b35384f2055e4854
- SHA1 6cc863ec69223332c5efa41f81e569d24745186b
- SHA512 82d7ced5335aff75b23450bd9f4cca04a52bcf55cac4873506556affef48d9c14d40f712ce5ee5bfe5a6bad573c2c183d0029707e54e446909fbf21d9e65daa1
- SSDEEP 98304:3e8+OQpXBQ1r1tZpppBfEZvU0QjNXEi86f8LfLzXCpXHG4TmX//:3KxBur1tZpwAUi86kLSpKH
- TLSH T17EE533A9D601FE59F300023EEE855E1DD823D8EB35D6AE82F2A57B54240F879CFD1454
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/install_v3.0.02.exe
File Explorer
-
53b2086b2a19a75567a73a3f8516a624bb0af3047917ad5f62dfde4f4fb95e67.zip 3.0MB
-
install_v3.0.02.exe.exe 31.6MB
install_v3.0.02.exe
- IMPHASH 461926f212e0446fd2ef1c1bca2468e6
- SHA256 192b9aa8c6be0d2585a8a4360e6c8f6b0042e60156be7bb48f1a60c56bb9b9de
- MD5 a25090a07abb8f6d357b84dfed5a2059
- SHA1 2ccd0c85a917111ac92f1b39ace117d3d9c47aae
- SHA512 121817fb8fda0aec9e7fe2a4a53440c30a13ecdc12253bfb75c1a5909920a0df99904d13c37a9b731d1746c3e7d817e49cb66977e0440af67ec5e32ceab9d582
- SSDEEP 98304:xvHhs8mSgPrs3ihngA0hFI6qqAF3EJnVXhkg/9EDo6I7f:Zmb43Ogvh3ACrRk+uD+7f
- TLSH T1BF77F6A2F601D9EEED5444FC848DC6A36322ECA48551471F33887B29BFBBD4C4D98DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
94:d4:82:e4:f8:23:a7:24:6e:a2:c1:30:af:92:fe:2b:40:70:14:24
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Auerswald GmbH & Co. KG,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=Auerswald GmbH & Co. KG,L=Cremlingen/OT Schandelah,ST=Niedersachsen,C=DE
Chains
Oct 13, 2009
CN=Auerswald GmbH & Co. KG,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=Auerswald GmbH & Co. KG,L=Cremlingen/OT Schandelah,ST=Niedersachsen,C=DE
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Timespan
Jan 29, 1996 - Aug 1, 2028
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
CN=Auerswald GmbH & Co. KG,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=Auerswald GmbH & Co. KG,L=Cremlingen/OT Schandelah,ST=Niedersachsen,C=DE
Serial Number
20:74:8a:0a:a8:ae:03:d0:3a:50:b2:56:b3:4f:da:40
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 22, 2008 - Jun 6, 2010
Minor OS version
2
Major OS version
5
Entry point
37096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
setupapi
SetupDiDestroyDeviceInfoList
CM_Get_Device_ID_ExA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInfoListDetailA
SetupDiGetClassDevsExA
SetupDiGetDeviceInstallParamsA
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA
SetupDiGetDeviceRegistryPropertyA
comctl32
PropertySheetA
CreatePropertySheetPageA
gdi32
GetDeviceCaps
CreateFontIndirectA
difxapi
DriverPackageUninstallA
kernel32
HeapSize
FormatMessageA
GetLastError
GetSystemInfo
GetProcAddress
GetModuleHandleA
GetVersionExA
CloseHandle
CreateFileA
LocalAlloc
LocalFree
WideCharToMultiByte
LockResource
LoadResource
FindResourceExA
DeleteFileA
SetFileAttributesA
GetFileAttributesA
GetFullPathNameA
FindClose
FindFirstFileA
lstrcpyA
lstrcatA
GetSystemDirectoryA
CopyFileA
GetCurrentProcess
WinExec
GetWindowsDirectoryA
GetModuleFileNameA
CreateThread
ReadFile
HeapReAlloc
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RtlUnwindEx
LCMapStringW
MultiByteToWideChar
LCMapStringA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
Sleep
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
HeapCreate
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
VirtualAlloc
FlsAlloc
user32
GetWindowLongPtrA
SetWindowLongPtrA
GetDlgItem
SendMessageA
SendDlgItemMessageA
GetParent
GetWindowRect
SetWindowPos
DialogBoxParamA
GetMessageA
TranslateMessage
EnableWindow
LoadIconA
LoadCursorA
RegisterClassA
DefWindowProcA
PostMessageA
PostQuitMessage
GetSystemMetrics
CreateWindowExA
ShowWindow
UpdateWindow
ExitWindowsEx
MessageBoxA
CheckDlgButton
IsDlgButtonChecked
CheckRadioButton
SetWindowTextA
EndDialog
SetClassLongPtrA
ReleaseDC
GetDC
SystemParametersInfoA
DispatchMessageA
advapi32
RegCloseKey
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenSCManagerA
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
31.3MB
Virtual Size
31.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
227KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=132, productName=VS2008 build 21022, version=21022,
count=9, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=166, id=1, productName=Unmarked objects,
count=102, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,