ae1c8e8172b81c1708186d69bb5f4be914fb6a192eb6c2c5afb7b7bf68a1f8b8

Sharing

Copy URL Twitter E-mail

General

Target
ae1c8e8172b81c1708186d69bb5f4be914fb6a192eb6c2c5afb7b7bf68a1f8b8
Size 3.4MB
Sample260824-rnjvbavvex
SHA256 ae1c8e8172b81c1708186d69bb5f4be914fb6a192eb6c2c5afb7b7bf68a1f8b8
MD5 ee2177287ad0af39c49694ddd3a0deb3
SHA1 5193ba55547468fbd8641f8646a11a98fad7e583
SHA512 9414d05d17cd85fba003d70c098b9382846b3abdea32ef2f7af4fc3319b8639d53740856fe1c13cc554d6dd7ed0d33085628e4550ae92a7ada771842b7ef62d9
SSDEEP 49152:PTQaGv4Fo33DYHEz514J4bHXTHUpHgOeoWZyZnQ8VskwuYIU6iBpm6Wix/a:HQY4nUW+n+/W
TLSH
T18EF539026E8B58E9D1D9CCB4C34B8A630E1134DB1A36F9BF45C611253FADBB59B2D309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ae1c8e8172b81c1708186d69bb5f4be914fb6a192eb6c2c5afb7b7bf68a1f8b8

File Explorer

ae1c8e8172b81c1708186d69bb5f4be914fb6a192eb6c2c5afb7b7bf68a1f8b8

.exe 3.4MB

ae1c8e8172b81c1708186d69bb5f4be914fb6a192eb6c2c5afb7b7bf68a1f8b8

IMPHASH 5d1ed70b6017ea2bdf8f796ff067d41c
SHA256 ae1c8e8172b81c1708186d69bb5f4be914fb6a192eb6c2c5afb7b7bf68a1f8b8
MD5 ee2177287ad0af39c49694ddd3a0deb3
SHA1 5193ba55547468fbd8641f8646a11a98fad7e583
SHA512 9414d05d17cd85fba003d70c098b9382846b3abdea32ef2f7af4fc3319b8639d53740856fe1c13cc554d6dd7ed0d33085628e4550ae92a7ada771842b7ef62d9
SSDEEP 49152:PTQaGv4Fo33DYHEz514J4bHXTHUpHgOeoWZyZnQ8VskwuYIU6iBpm6Wix/a:HQY4nUW+n+/W
TLSH
T18EF539026E8B58E9D1D9CCB4C34B8A630E1134DB1A36F9BF45C611253FADBB59B2D309
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

39:e2:1e:24:15:b2:c7:97:ec:43:5d:66:74:46:75:7d:57:a4:c3:b3:37:71:75:bd:88:2e:d6:a4:23:9a:8a:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Alderline Systems

Chains

Aug 21, 2026

CN=Alderline Systems

Minor OS version

Major OS version

Entry point

2381536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winmanager_agent.pdb

kernel32

WriteConsoleW MultiByteToWideChar CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx WaitForSingleObject GetSystemTimePreciseAsFileTime CreateDirectoryW ExitProcess CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW GetCurrentThread GetFileAttributesW GetModuleFileNameW DuplicateHandle GetConsoleOutputCP GetTempPathW RemoveDirectoryW DeleteFileW GetFinalPathNameByHandleW CopyFileExW CreateSymbolicLinkW CreateWaitableTimerExW SetWaitableTimer Sleep GetConsoleMode GetStdHandle GetCurrentDirectoryW SetLastError RtlVirtualUnwind WideCharToMultiByte SetFilePointerEx FindNextFileW SwitchToThread LoadLibraryW GetCommandLineW GetSystemInfo HeapAlloc GetTickCount64 ReleaseMutex CloseHandle CreateMutexA GetNativeSystemInfo GetUserDefaultLocaleName GetDynamicTimeZoneInformation GetComputerNameExW GetCurrentProcessId LoadLibraryA TerminateProcess GetExitCodeProcess GetEnvironmentVariableW SetHandleInformation WriteFileEx MoveFileExW GetProcessId CreatePipe GetLogicalDrives GetDriveTypeW GetVolumeInformationW GetDiskFreeSpaceExW GetCompressedFileSizeW WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess LocalFree CreateHardLinkW SetFileAttributesW DeviceIoControl RtlCaptureContext GetCurrentThreadId SleepEx TlsFree ReadFileEx GetProcessTimes QueryPerformanceFrequency IsDebuggerPresent CheckRemoteDebuggerPresent IsWow64Process2 GetModuleHandleW GetSystemDefaultUILanguage GetACP VirtualFree FormatMessageW VirtualQuery FreeLibrary RtlDeleteFunctionTable TlsAlloc RtlAddFunctionTable LoadLibraryExW VirtualAlloc GetLastError TlsSetValue TlsGetValue VirtualProtect GlobalMemoryStatusEx GetProcAddress lstrlenW SetThreadStackGuarantee AddVectoredExceptionHandler GetSystemTimeAsFileTime InitializeSListHead HeapReAlloc HeapFree QueryPerformanceCounter GetProcessHeap SetUnhandledExceptionFilter CreateProcessW GetTimeZoneInformationForYear

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

bcrypt

BCryptGenRandom

advapi32

GetUserNameW LookupAccountSidW GetAce CreateWellKnownSid CheckTokenMembership GetSecurityDescriptorDacl GetNamedSecurityInfoW SystemFunction036 GetTokenInformation OpenProcessToken ConvertSidToStringSidW

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile NtOpenFile RtlGetVersion

ws2_32

bind WSASend send WSADuplicateSocketW shutdown setsockopt getsockopt getaddrinfo WSACleanup WSAStartup closesocket select connect ioctlsocket WSAGetLastError getsockname freeaddrinfo getpeername WSASocketW WSARecv recv

iphlpapi

GetExtendedUdpTable GetExtendedTcpTable GetIpNetTable GetAdaptersAddresses GetIpForwardTable IcmpCloseHandle IcmpSendEcho IcmpCreateFile

netapi32

NetLocalGroupEnum NetUserEnum NetLocalGroupGetMembers NetApiBufferFree

vcruntime140

__current_exception_context __current_exception __C_specific_handler _CxxThrowException memmove memcmp memset memcpy __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

round __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment exit _configure_narrow_argv _initialize_narrow_environment _exit _initterm _seh_filter_exe terminate __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _set_app_type _initterm_e _crt_atexit _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

ae1c8e8172b81c1708186d69bb5f4be914fb6a192eb6c2c5afb7b7bf68a1f8b8

PE Signature issue

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

shell32

ole32

bcrypt

advapi32

ntdll

ws2_32

iphlpapi

netapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic