kedadecoder.zip
- SHA256 d1a7dda0997f2cda0f449f1c40fa852fc5ce3b50d7443e63e4c00b6aae3ea6a3
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
kedadecoder/kedadecodersetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
kedadecoder/kedadecodersetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
kedadecoder/wm814127.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
kedadecoder/wm814127.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target kedadecoder.zip
- Size 2.8MB
- Sample260824-ag6basbf36
- SHA256 d1a7dda0997f2cda0f449f1c40fa852fc5ce3b50d7443e63e4c00b6aae3ea6a3
- MD5 ddee1a2ed1977306485e92b088f39b3e
- SHA1 2f913dd7c1ebe7d4ebc6ede8cc0c41b5ee58f544
- SHA512 3f92b22f019aa3441c24d1f569c9ca78a9c7991fe7a5d13dfaf84a3351352d84f01e3c59afc7e3ea1d08cad1fb54eb21f8d27043c9309f23c69d743c90356d27
- SSDEEP 49152:W8Q1gTJtYUC2wyQc9RxLMZ/a15f5jBnETfsCCfL9OWAMrmnOqAHOZu:FQaFOJyQcZMFKJ5jBcfyfL53ovlu
- TLSH T1AAD533D306B81C90D34AB401B3D35EA69D8872C792DF9A2671A61EF7C6E8FD93941033
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/kedadecoder/kedadecodersetup.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/kedadecoder/wm814127.exe
File Explorer
-
kedadecoder.zip.zip 2.8MB
-
kedadecoder/Kedacomװ˵.txt180B
-
kedadecoder/kedadecodersetup.exe.exe 2.1MB
-
kedadecoder/wm814127.exe.exe 859KB
kedadecoder/Kedacomװ˵.txt
- SHA256 87767ff11a728c6d7223b31174dc69c4bd61f8f78071af4fd035af7c51ae3d00
- MD5 aca54a27a767de5efe64fbb6b5489cea
- SHA1 a47d0462b91a12c7ff125d399d723d1a34d502af
- SHA512 80726c035f97e39df0b04f5b080db5bde0c0f8c1bbc4b89dbe551d40906c80e1601c66720bd751649492552b07fdd59e9a238112847f0303e0d28a46e3da5e02
- TLSH T1D3C08CE8F0CE70C2522A21994B1F8B61004A69C4AAF777523C4DE60CA7E6277CC08096
- MD5 SHA1 SHA512 TLSH
kedadecoder/kedadecodersetup.exe
- IMPHASH 4cfda23baf1e2e983ddfeca47a5c755a
- SHA256 bfcc8f71ddedb7f0b555a1492c8b1699c95aa892d69424595e07d5b3d4689783
- MD5 1a0c1cd73a8dc9e56dcc26eea49b729d
- SHA1 cbff351748a8ad3fe4f53f8d7508b533bdf4b52f
- SHA512 48da91de68f6c0ec2f736d93c83d8c4f197718564f53595b02b5741c3f150d4ebe808668c1ced7032201c65a8932756b4ffbf8e7e8cbcff75e557dc5d48031c8
- SSDEEP 49152:8F9d4FsSJnZz4sIWnDcy0c951Ly5/g6ATk6BVBnE9ff6cgPlFjMWc:8F9aFseM+cy0cdyl+3TBmfYPztc
- TLSH T130A5332236D1C0B2C8038431EADE9B72F669F66157E6594AFF500FBF1B547B28212B53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
120779
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
comctl32
InitCommonControlsEx
shlwapi
SHAutoComplete
kernel32
FindClose
FindNextFileW
FindFirstFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
GetModuleFileNameW
FindResourceW
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcessId
GetLocaleInfoW
GetNumberFormatW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
WaitForSingleObject
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetExitCodeProcess
GetTempPathW
MoveFileExW
UnmapViewOfFile
Sleep
MapViewOfFile
GetCommandLineW
CreateFileMappingW
GetTickCount
OpenFileMappingW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateThread
GetProcessAffinityMask
CreateEventW
CreateSemaphoreW
ReleaseSemaphore
ResetEvent
SetEvent
SetThreadPriority
SystemTimeToFileTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
LocalFileTimeToFileTime
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
IsDBCSLeadByte
SetFileTime
SetFileAttributesW
SetCurrentDirectoryW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleHandleA
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
ExitProcess
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualAlloc
VirtualFree
HeapCreate
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetCommandLineA
RaiseException
GetFileAttributesW
FlushFileBuffers
ReadFile
GetFileType
SetEndOfFile
SetFilePointer
WriteFile
GetStdHandle
GetLongPathNameW
GetShortPathNameW
GlobalAlloc
MoveFileW
CreateFileW
CreateDirectoryW
DeviceIoControl
RemoveDirectoryW
DeleteFileW
CreateHardLinkW
GetCurrentProcess
CloseHandle
SetLastError
GetLastError
CreateFileA
GetCPInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
HeapFree
RtlUnwind
user32
EnableWindow
GetDlgItem
ShowWindow
SetWindowLongW
GetDC
ReleaseDC
FindWindowExW
GetParent
MapWindowPoints
CreateWindowExW
UpdateWindow
LoadCursorW
RegisterClassExW
DefWindowProcW
DestroyWindow
CopyRect
IsWindow
CharUpperW
OemToCharBuffA
LoadIconW
LoadBitmapW
PostMessageW
GetSysColor
SetForegroundWindow
MessageBoxW
WaitForInputIdle
IsWindowVisible
DialogBoxParamW
DestroyIcon
SetFocus
GetClassNameW
SendDlgItemMessageW
EndDialog
GetDlgItemTextW
SetDlgItemTextW
wvsprintfW
SendMessageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW
GetWindowRect
GetClientRect
SetWindowPos
GetWindowTextW
SetWindowTextW
GetSystemMetrics
GetWindow
GetWindowLongW
gdi32
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
StretchBlt
DeleteDC
GetObjectW
DeleteObject
CreateDIBSection
comdlg32
GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
shell32
SHBrowseForFolderW
ShellExecuteExW
SHGetSpecialFolderLocation
SHFileOperationW
SHGetPathFromIDListW
SHGetMalloc
SHChangeNotify
SHGetFileInfoW
ole32
CLSIDFromString
CoCreateInstance
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
oleaut32
VariantInit
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=27, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=143, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=240, id=1, productName=Unmarked objects,
count=103, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
kedadecoder/wm814127.exe
- IMPHASH 1494de9b53e05fc1f40cb92afbdd6ce4
- SHA256 80c60613602386929cc88566ae18f7ef5e477594f5ce00d2f6330eb035992048
- MD5 d81fc765e89e3a49eaee71206bb65004
- SHA1 1c648678a07b218f2aff8a08cc5be2ab0eb633c7
- SHA512 301838ddfdc19aefe06104514650bdd91cbae40e0e3fd3d921f133bd9355a6263e031a14bdee8149ea92c33f0f58468b39316ea0d2ada767d093f997aa1581a1
- SSDEEP 12288:kQ0YRSbq92qWUVvpqdu4cF5gQv6Y6BcpaLRCMwcu0cmUPVcxb0h1c/yeBtiVxQ7O:aFu8qNvpqJcsQ6Y6BuqDk0waQktOxQi
- TLSH T16015239326D584B2F0E6173006F755932BB8B1EB7EF6E31DA1A6944C0871ACD533A327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
90:41:19:91:09:1d:f8:96:6c:11:cf:c4:5b:9b:ba:f8
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 1, 0001
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Jan 7, 2004
Subject
CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.
Serial Number
08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 28, 2001 - Jan 6, 2004
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 10, 2000 - Nov 12, 2005
Subject
CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:11:43:00:00:00:00:00:34
Issuer
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2002 - Nov 25, 2003
Minor OS version
1
Major OS version
5
Entry point
23134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA
kernel32
LocalFree
LocalAlloc
GetLastError
GetCurrentProcess
GetModuleFileNameA
lstrlenA
GetSystemDirectoryA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
lstrcatA
lstrcpyA
_lclose
_llseek
_lopen
WritePrivateProfileStringA
GetWindowsDirectoryA
CreateDirectoryA
GetFileAttributesA
ExpandEnvironmentStringsA
IsDBCSLeadByte
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpiA
GetProcAddress
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
CloseHandle
LoadResource
SizeofResource
FindResourceA
ReadFile
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetCurrentDirectoryA
GetTempFileNameA
ExitProcess
CreateFileA
LoadLibraryExA
lstrcpynA
GetVolumeInformationA
FormatMessageA
GetCurrentDirectoryA
GetVersionExA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
GetSystemInfo
CreateMutexA
SetEvent
CreateEventA
CreateThread
ResetEvent
TerminateThread
GetDriveTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
LockResource
LoadLibraryA
GetDiskFreeSpaceA
MulDiv
EnumResourceLanguagesA
FreeLibrary
GlobalFree
gdi32
GetDeviceCaps
user32
ExitWindowsEx
wsprintfA
CharNextA
CharUpperA
CharPrevA
SetWindowLongA
GetWindowLongA
CallWindowProcA
DispatchMessageA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
SendDlgItemMessageA
GetDlgItem
SetForegroundWindow
SetWindowTextA
MessageBoxA
DialogBoxIndirectParamA
ShowWindow
EnableWindow
GetDlgItemTextA
EndDialog
GetDesktopWindow
MessageBeep
SetDlgItemTextA
LoadStringA
GetSystemMetrics
comctl32
ord17
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
816KB
Virtual Size
820KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=13, id=25, version=9210,
count=126, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=24, id=28, version=9178,
count=1, id=61, version=9210,