StatementofAccoun_a468.img
- SHA256 046a8387a8c897fafba0fcb3b736f2d8a0e02c73b518d7c72db6c4eec59fc87b
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
StatementofAccoun.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
StatementofAccoun.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
VSPMsg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral4
Sample
VSPMsg.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target StatementofAccoun_a468.img
- Size 806KB
- Sample260823-frq71sshlf
- SHA256 046a8387a8c897fafba0fcb3b736f2d8a0e02c73b518d7c72db6c4eec59fc87b
- MD5 5900dc2a88aea62b7e58d0113203a5a5
- SHA1 28f8e2562c854046f8f8f6201025ef05e8b2d751
- SHA512 6d1d5f1d35f64d12b3ffd924911701908055db5c5af6f2b6657ad5beaf2551cf0ae5ce9789e8c2c09fff1fdebb6e85610d13ef2822b9d9b4ab911c4663ff7dbf
- SSDEEP 12288:ck5G8N847bS8v5rMOMT/rl2SZls33OHn0Mn1vE7TfoT:x847bS8lMVHnZlsEE7Tf4
- TLSH T170056A46F6540CA7F1D68F3989724B06EE6A78FE0365DACB32BC42563F172905F2B211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/VSPMsg.dll
File Explorer
-
StatementofAccoun_a468.img.iso 806KB
-
out.iso.iso 806KB
-
StatementofAccoun.exe.exe 382KB
-
VSPMsg.dll.dll 371KB
out.iso
- SHA256 046a8387a8c897fafba0fcb3b736f2d8a0e02c73b518d7c72db6c4eec59fc87b
- MD5 5900dc2a88aea62b7e58d0113203a5a5
- SHA1 28f8e2562c854046f8f8f6201025ef05e8b2d751
- SHA512 6d1d5f1d35f64d12b3ffd924911701908055db5c5af6f2b6657ad5beaf2551cf0ae5ce9789e8c2c09fff1fdebb6e85610d13ef2822b9d9b4ab911c4663ff7dbf
- SSDEEP 12288:ck5G8N847bS8v5rMOMT/rl2SZls33OHn0Mn1vE7TfoT:x847bS8lMVHnZlsEE7Tf4
- TLSH T170056A46F6540CA7F1D68F3989724B06EE6A78FE0365DACB32BC42563F172905F2B211
- MD5 SHA1 SHA512 SSDEEP TLSH
StatementofAccoun.exe
- IMPHASH 75419444292be768f1cb27ca00682e8f
- SHA256 ffeaef9bc1ce54c3fac9b9517804ca1b73b905c6c0b10ab6fd1dd5615c15bc47
- MD5 32b03da03c2fec73d028114276a897da
- SHA1 2473216fee29bcc660694c32f0a6378295b1e896
- SHA512 5539b28f8d0679b992d744c70872d933fc11caa069b6d8388734487de43bf5464505e2c11f2281c53394c76ed1fdb4e09c4462a4e6e25d534c1ecc3a43853c00
- SSDEEP 6144:IfGoU5G8+K848hEBbS81wfDM5rMOMT+pcBrk:ek5G8N847bS8v5rMOMT/rk
- TLSH T1DB847C5AF7A404F5D0AB8239C9638506E7727C9A0770DB8F23A4476B2F272E05D3E761
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9c:a8:7a:f8:4f:5d:0a:9e:bf:8a:e1:4f:c8:81:d2:69:f3:be:7f:f9:0f:01:ca:c5:ad:a7:c9:94:fe:1e:a6:a7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 15, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:04:6c:74:06:ff:57:2b:27:72:00:00:00:00:04:04
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:03:bb:1e:5c:00:38:6c:74:ca:00:01:00:00:02:03
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
133680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\dbs\el\ddvsm\out\binaries\amd64ret\bin\amd64\VSPerfMon.pdb
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
ReportEventW
RegisterEventSourceW
ReportEventA
DeregisterEventSource
RegisterTraceGuidsA
GetTraceEnableLevel
GetTraceEnableFlags
IsTextUnicode
EnableTrace
StartTraceW
ControlTraceW
RegOpenKeyExW
RegQueryValueExW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerA
DeleteService
ControlService
StartServiceA
QueryServiceConfigW
OpenServiceW
SetEntriesInAclA
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityInfo
TraceEvent
GetTraceLoggerHandle
GetTokenInformation
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSecurityInfo
LookupAccountNameW
kernel32
OpenEventA
GetFileSize
FindFirstFileW
DeviceIoControl
InitializeCriticalSection
SetThreadAffinityMask
OpenMutexA
GetVersionExW
GetLocalTime
GetComputerNameW
GlobalMemoryStatusEx
ExitThread
FreeLibraryAndExitThread
ReleaseSemaphore
OpenSemaphoreA
SetUnhandledExceptionFilter
GetProcessHeap
DeleteCriticalSection
LocalFree
HeapDestroy
HeapAlloc
HeapSetInformation
CloseHandle
HeapReAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetLastError
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
LCMapStringW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetCurrentThread
OutputDebugStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
SetFilePointerEx
ReadFile
ReadConsoleW
GetFileSizeEx
CreateFileW
WriteConsoleW
GetEnvironmentVariableW
GetModuleFileNameA
FindFirstFileA
GetUserDefaultUILanguage
GetModuleHandleA
LoadLibraryA
FormatMessageA
SizeofResource
LockResource
FindResourceExW
LoadResource
FindResourceW
GetVersionExA
GetSystemInfo
GetConsoleScreenBufferInfo
WriteConsoleA
FormatMessageW
GetConsoleWindow
VirtualAlloc
VirtualUnlock
UnmapViewOfFile
VirtualLock
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
GetFileAttributesW
OpenProcess
QueryPerformanceFrequency
LoadLibraryW
GetDriveTypeW
WaitForMultipleObjects
WaitForSingleObject
CreateProcessW
GetTickCount
WaitNamedPipeA
CreateFileA
SetNamedPipeHandleState
ExpandEnvironmentStringsW
CreateMutexW
ReleaseMutex
DuplicateHandle
GetVersion
CreateEventW
SetEvent
CreateFileMappingW
MapViewOfFileEx
VerSetConditionMask
VerifyVersionInfoW
GetExitCodeProcess
GetFullPathNameW
GetExitCodeThread
ProcessIdToSessionId
CreateThread
SwitchToThread
CreateEventA
GetProcessWorkingSetSize
SetProcessWorkingSetSize
lstrlenW
SetFilePointer
DeleteFileW
ReplaceFileW
SetThreadPriority
ResetEvent
GetOverlappedResult
WriteFileGather
VirtualFree
Sleep
HeapSize
CreateMutexA
InitializeCriticalSectionEx
HeapFree
CompareStringW
SetConsoleCtrlHandler
GetStdHandle
CreateSemaphoreA
vspmsg
GetErrorMessageModule
SetErrorMessageModule
user32
IsWindowVisible
ole32
CoCreateGuid
CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitialize
pdh
PdhGetFormattedCounterValue
PdhAddCounterW
PdhCloseQuery
PdhOpenQueryW
PdhCollectQueryData
shlwapi
PathAddBackslashW
PathAppendW
PathRenameExtensionW
PathRemoveFileSpecW
Name
.text
Size
260KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=262, version=27412,
count=2, id=257, version=34440,
count=2, id=259, version=34440,
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=158, id=261, version=27412,
count=9, id=259, version=34321,
count=17, id=260, version=34321,
count=52, id=261, version=34321,
count=15, id=257, version=27412,
count=271, id=1, productName=Unmarked objects,
count=68, id=265, version=34440,
count=1, id=255, version=34440,
count=1, id=258, version=34440,
VSPMsg.dll
- IMPHASH 30b9be7c12cf36a4122c6f56c26e52aa
- SHA256 7233fabbcdc39286fbc600fb29281ce86c350bcbba81a54764e54d26e28b3d87
- MD5 0985ef5e034304738bbcb95f87cd7bd5
- SHA1 c255b5d7f0250293ab901fa07e8e7728e3a734a9
- SHA512 c85f8a8fb38b531d7968de1f5f54f2bdfe7ff1a20564c380d176b103fc83f0e2c6bad6e8ee6a69bff5e67ab3dea73d9c9a134f6786a2ecc792e0e8399473a7a1
- SSDEEP 6144:mnKLlYlj9Y4smsLDZYK/OHn0Mf/QqpqqGx7R30ifoTY:m2SZls33OHn0Mn1vE7TfoTY
- TLSH T1ED84CF4A75400CABFAD38F3984B35F42DE1D3AFC431AD6EA707C5092BE966606FA7111
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapFree
GetProcessHeap
GetModuleHandleA
GetProcAddress
LoadLibraryA
HeapAlloc
GetErrorMessageModule
SetErrorMessageModule
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33145,
count=6, id=1, productName=Unmarked objects,
count=3, id=260, version=35228,
count=1, id=259, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,