07d85675b7dc901920980806ee15ba749d649fa202ba9756ec9f33cd87b3fb15

Sharing

Copy URL Twitter E-mail

General

Target
07d85675b7dc901920980806ee15ba749d649fa202ba9756ec9f33cd87b3fb15
Size 4.8MB
Sample260825-svbmysvbpc
SHA256 07d85675b7dc901920980806ee15ba749d649fa202ba9756ec9f33cd87b3fb15
MD5 e1260804c2cd628f25a3c7ec1c544f98
SHA1 5571263c58ff69001dabff1b8f459112a0e6a899
SHA512 0c22809e9e84d77f2447b87d155a1b4902f8ea57b88bf9d1fda2279a809e3f5cb6eefea62b95e3f9c1b598665c0d58a39220e6a2e965c0a9853085d210858efd
SSDEEP 49152:HINwjuZDjeAqU+WZ+nNaFbunDt1m2TE10A3gO0:H9jWcnn
TLSH
T18036A50CC25E183BD3BE7FF3E33B5734BB55CD562282074B7228A912D9E099019F6A95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

07d85675b7dc901920980806ee15ba749d649fa202ba9756ec9f33cd87b3fb15

.dll 4.8MB

07d85675b7dc901920980806ee15ba749d649fa202ba9756ec9f33cd87b3fb15

IMPHASH 5a08df8706dcd1c9872cec43bbccf8e6
SHA256 07d85675b7dc901920980806ee15ba749d649fa202ba9756ec9f33cd87b3fb15
MD5 e1260804c2cd628f25a3c7ec1c544f98
SHA1 5571263c58ff69001dabff1b8f459112a0e6a899
SHA512 0c22809e9e84d77f2447b87d155a1b4902f8ea57b88bf9d1fda2279a809e3f5cb6eefea62b95e3f9c1b598665c0d58a39220e6a2e965c0a9853085d210858efd
SSDEEP 49152:HINwjuZDjeAqU+WZ+nNaFbunDt1m2TE10A3gO0:H9jWcnn
TLSH
T18036A50CC25E183BD3BE7FF3E33B5734BB55CD562282074B7228A912D9E099019F6A95
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Digest

d3:64:05:d0:dc:af:c0:7a:b0:5c:6b:67:50:32:f9:00:25:09:ed:e2:18:7a:b3:3e:84:df:f5:99:b8:9f:23:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOLL Data Systems\, Inc,O=ZOLL Data Systems\, Inc,L=Broomfield,ST=Colorado,C=US

Chains

Oct 22, 2025

CN=ZOLL Data Systems\, Inc,O=ZOLL Data Systems\, Inc,L=Broomfield,ST=Colorado,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=ZOLL Data Systems\, Inc,O=ZOLL Data Systems\, Inc,L=Broomfield,ST=Colorado,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=ZOLL Data Systems\, Inc,O=ZOLL Data Systems\, Inc,L=Broomfield,ST=Colorado,C=US

Serial Number

08:7d:6c:01:59:29:28:60:02:d8:45:3a:38:5b:ff:f2

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 10, 2023 - Jun 30, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3204591

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\BuildAgent\work\4d1580f233c1c1e9\VisualForms\Modules\PPFormsDataStandard\Release\PPVFModuleDataStandard.pdb

mfc140

ord4580 ord6323 ord3844 ord5894 ord12182 ord12190 ord8180 ord10383 ord12194 ord12162 ord12869 ord5742 ord10202 ord6831 ord993 ord7618 ord4227 ord3250 ord9092 ord6806 ord10963 ord6097 ord6822 ord2751 ord14487 ord3866 ord2989 ord8704 ord4215 ord3184 ord9088 ord6562 ord12725 ord5496 ord5491 ord6741 ord7475 ord5960 ord4216 ord9089 ord6563 ord7619 ord3864 ord2988 ord8703 ord4213 ord3142 ord9085 ord6471 ord7420 ord7413 ord7452 ord7459 ord12074 ord8997 ord11343 ord4084 ord3396 ord3395 ord3159 ord6193 ord13677 ord2758 ord12115 ord9167 ord6505 ord1044 ord310 ord4656 ord8679 ord9096 ord1529 ord316 ord12475 ord2200 ord1468 ord8429 ord8347 ord12806 ord8285 ord5336 ord2484 ord12484 ord6523 ord4210 ord12485 ord14509 ord3140 ord7886 ord6195 ord14507 ord3841 ord1510 ord325 ord1051 ord2359 ord13681 ord324 ord1050 ord2406 ord2409 ord2372 ord2408 ord485 ord2263 ord2370 ord2178 ord2294 ord2397 ord486 ord3298 ord3295 ord8173 ord2759 ord14699 ord10237 ord10239 ord10238 ord10236 ord10240 ord5631 ord11671 ord7352 ord934 ord1416 ord12848 ord2378 ord300 ord1526 ord1661 ord2986 ord2992 ord824 ord1353 ord2381 ord1999 ord5898 ord305 ord5861 ord14238 ord3005 ord12551 ord4807 ord8717 ord6936 ord8322 ord8146 ord1692 ord1000 ord1472 ord458 ord1064 ord1131 ord1109 ord3689 ord14421 ord7783 ord4468 ord10421 ord14054 ord7040 ord363 ord4351 ord2303 ord1067 ord2319 ord1460 ord4575 ord2438 ord1696 ord862 ord1380 ord12854 ord2383 ord2387 ord1650 ord1068 ord4315 ord8713 ord3808 ord3688 ord9353 ord12841 ord12836 ord975 ord1448 ord2003 ord2389 ord5059 ord1693 ord8224 ord5553 ord449 ord5554 ord1105 ord301 ord1527 ord2558 ord12528 ord8718 ord12863 ord2298 ord12865 ord2946 ord1178 ord13574 ord8031 ord5401 ord8026 ord13582 ord5826 ord5792 ord13475 ord974 ord13883 ord13584 ord1447 ord14334 ord12706 ord3289 ord3669 ord14328 ord4655 ord13193 ord8426 ord5102 ord12503 ord494 ord12512 ord846 ord844 ord8158 ord3309 ord1528 ord443 ord973 ord11917 ord12372 ord2894 ord1446 ord1880 ord12619 ord12684 ord8020 ord8001 ord7998 ord4713 ord265 ord5095 ord4733 ord1177 ord448 ord4662 ord6996 ord12555 ord3839 ord8036 ord13576 ord5795 ord3796 ord5406 ord13407 ord1443 ord8732 ord8672 ord1695 ord2212 ord12581 ord14571 ord12348 ord14518 ord12291 ord2376 ord1100 ord5858 ord4841 ord3230 ord2195 ord2194 ord14449 ord7407 ord6333 ord13783 ord8088 ord8087 ord13459 ord1530 ord12826 ord12842 ord4865 ord13198 ord14322 ord12705 ord2278 ord2237 ord11672 ord9083 ord12032 ord3830 ord11881 ord14502 ord8922 ord12163 ord6947 ord10950 ord9213 ord3259 ord13798 ord12205 ord12201 ord1717 ord1739 ord1765 ord1751 ord1772 ord4920 ord4987 ord4932 ord4950 ord4944 ord4938 ord4997 ord4981 ord4926 ord5003 ord4958 ord4896 ord4911 ord4972 ord4493 ord9647 ord4485 ord3050 ord14510 ord7887 ord14508 ord6848 ord11663 ord13628 ord5911 ord2680 ord12067 ord3933 ord3364 ord3363 ord3258 ord12111 ord5228 ord5528 ord5739 ord9305 ord5504 ord5769 ord5231 ord5390 ord5210 ord6104 ord7687 ord7688 ord7677 ord5388 ord8182 ord10207 ord9166 ord6464 ord13090 ord6725 ord6724 ord5857 ord5855 ord12035 ord13844 ord2754 ord4002 ord11411 ord11375 ord12747 ord4143 ord4082 ord12888 ord7905 ord2027 ord11927 ord3843 ord14393 ord11928 ord14380 ord12474 ord7964 ord14581 ord4307 ord1916 ord2780 ord13846 ord6322 ord14583 ord8748 ord6324 ord14149 ord14582 ord2890 ord2241 ord11913

kernel32

HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess OutputDebugStringW EnterCriticalSection LeaveCriticalSection CloseHandle SetEvent ResetEvent HeapFree CreateEventW GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LocalFree lstrcmpA GetPrivateProfileStringA GetLocalTime lstrcpyA FormatMessageA lstrlenA GetComputerNameExA DeleteFileA GetComputerNameA InitializeCriticalSection QueryPerformanceFrequency GetSystemTime SystemTimeToTzSpecificLocalTime MultiByteToWideChar WideCharToMultiByte HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException OutputDebugStringA DecodePointer InitializeCriticalSectionEx GetModuleFileNameA WaitForSingleObjectEx GetUserDefaultLangID GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryW LocalAlloc Sleep WriteFile ReadFile SetFilePointer CreateFileA GetFileSize MoveFileA

user32

MessageBoxA GetDC EnableWindow SendMessageTimeoutA ReleaseDC SendMessageA UnregisterClassA

ole32

CoInitialize CoUninitialize CoCreateInstance OleRun

oleaut32

SetErrorInfo VariantChangeType GetErrorInfo SysFreeString SysAllocStringByteLen SysStringByteLen VariantClear SysAllocString CreateErrorInfo VarUdateFromDate VariantTimeToSystemTime SystemTimeToVariantTime VariantCopy VariantInit

msvcp140

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?__ExceptionPtrDestroy@@YAXPAX@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?_Xlength_error@std@@YAXPBD@Z ?setf@ios_base@std@@QAEHHH@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Xbad_alloc@std@@YAXXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z ?fail@ios_base@std@@QBE_NXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z

vcruntime140

__current_exception_context __current_exception _except_handler4_common __std_type_info_destroy_list _CxxThrowException __std_exception_destroy __FrameUnwindFilter strchr __CxxUnregisterExceptionObject __CxxDetectRethrow __CxxRegisterExceptionObject __CxxExceptionFilter __std_exception_copy __std_terminate memset __CxxQueryExceptionSize memmove __CxxFrameHandler3

api-ms-win-crt-stdio-l1-1-0

fclose __stdio_common_vsnprintf_s __stdio_common_vfprintf_s __stdio_common_vfprintf __stdio_common_vsprintf_s fopen_s

api-ms-win-crt-heap-l1-1-0

_callnewh free _recalloc malloc

api-ms-win-crt-runtime-l1-1-0

_errno abort _crt_atexit _crt_at_quick_exit _cexit terminate _initterm _invalid_parameter_noinfo _register_onexit_function _initterm_e _seh_filter_dll _configure_narrow_argv __threadid _invalid_parameter_noinfo_noreturn _initialize_narrow_environment _initialize_onexit_table _execute_onexit_table

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

gdi32

GetTextExtentPoint32A

advapi32

RegDeleteValueA GetUserNameA RegOpenKeyExA RegQueryValueExA RegCloseKey RegDeleteKeyA RegCreateKeyExA RegSetValueExA RegEnumKeyExA

api-ms-win-crt-string-l1-1-0

strcpy_s tolower isdigit strcat_s strncpy_s toupper

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime _time64

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-filesystem-l1-1-0

_access

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcmp _mbsnbicmp _mbscmp _mbsstr _mbschr

mscoree

_CorDllMain

??0CZDSLog@@QAE@AAV0@@Z ??0CZDSLog@@QAE@PBD00K@Z ??0CZDSLog@@QAE@PBD@Z ??0CZDSLogEnterFunction@@QAE@ABV0@@Z ??0CZDSLogEnterFunction@@QAE@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0PADHPAVCZDSLog@@JPBDJ3_N@Z ??1CZDSLog@@QAE@XZ ??1CZDSLogEnterFunction@@UAE@XZ ??4CZDSLog@@QAEAAV0@AAV0@@Z ??4CZDSLogEnterFunction@@QAEAAV0@ABV0@@Z ??4ZDSLogFilter@@QAEAAU0@$$QAU0@@Z ??4ZDSLogFilter@@QAEAAU0@ABU0@@Z ??_7CZDSLogEnterFunction@@6B@ ?AddConnection@CZDSLog@@IAEHXZ ?AddDataItem@CZDSLog@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0@Z ?AddDataItem@CZDSLogEnterFunction@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0@Z ?AddFlags@CZDSLog@@QAE?BKK@Z ?ConnectionAdded@CZDSLog@@IAEXH@Z ?ConnectionAdded@CZDSLog@@IBE?BHXZ ?CreateServerStatus@CZDSLog@@IAEXW4SSLogCreationStatus@@@Z ?CreateServerStatus@CZDSLog@@IBE?BW4SSLogCreationStatus@@XZ ?DefaultFlags@CZDSLog@@QAE?BKK@Z ?DefaultFlags@CZDSLog@@QBE?BKXZ ?DestinationName@CZDSLog@@IAEXPBD@Z ?DestinationName@CZDSLog@@IBEPBDXZ ?EraseLog@CZDSLog@@QAEHXZ ?FileHandle@CZDSLog@@IAEPAXXZ ?FileHandle@CZDSLog@@IAEXQAX@Z ?GenerateDataListStr@CZDSLog@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ ?GetFlags@CZDSLog@@QAE?BKXZ ?GetLastError@CZDSLog@@QBEHXZ ?GetMachineName@CZDSLog@@IAEXXZ ?GetRegistryFilters@CZDSLog@@QAEKXZ ?GetUser@CZDSLog@@IAEXXZ ?InitObject@CZDSLog@@IAEXXZ ?InstanceHandle@CZDSLog@@QAEPAUHINSTANCE__@@XZ ?InstanceHandle@CZDSLog@@QAEXPAUHINSTANCE__@@@Z ?LimitOutputSize@CZDSLog@@QAEHK@Z ?LogCount@CZDSLog@@IAEXH@Z ?LogCount@CZDSLog@@IBEHXZ ?LoggingDisabled@CZDSLog@@IAEHXZ ?LoggingDisabled@CZDSLog@@IAEXH@Z ?MaxFileSizeKb@CZDSLog@@IAEKXZ ?MaxFileSizeKb@CZDSLog@@IAEXK@Z ?ReadRegDefaultSettings@CZDSLog@@IAEHXZ ?RegistryKey@CZDSLog@@IAEXPBD@Z ?RegistryKey@CZDSLog@@IBEPBDXZ ?ReleaseConnection@CZDSLog@@IAEHXZ ?RemoveDataItems@CZDSLog@@QAEHXZ ?RemoveFlags@CZDSLog@@QAE?BKK@Z ?SecsFromTicks@CZDSLogEnterFunction@@AAEN_J@Z ?ServerName@CZDSLog@@IAEXPBD@Z ?ServerName@CZDSLog@@IBEPBDXZ ?SetDestinationName@CZDSLog@@QAEHPBD@Z ?SetFlags@CZDSLog@@QAE?BKK@Z ?SetFlagsInternal@CZDSLog@@IAEXPAK@Z ?SetLastError@CZDSLog@@QAEXH@Z ?SetRegistryFilters@CZDSLog@@QAEHK@Z ?SetRegistryKey@CZDSLog@@QAEHPBD@Z ?Succeeded@CZDSLog@@QAEHXZ ?WriteLog@CZDSLog@@QAEHPBDW4ZDSLogMessageType@@PADHKJ0J0N0H0PAPAD@Z ?WriteLogNotTimer@CZDSLog@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDW4ZDSLogMessageType@@KJ11JJJPAVCDatabase@@@Z ?m_nIDCount@CZDSLogEnterFunction@@2HA DllCanUnloadNow DllGetClassObject DllRegisterServer

Sharing

General

Malware Config

Signatures

File Explorer

07d85675b7dc901920980806ee15ba749d649fa202ba9756ec9f33cd87b3fb15

mfc140

kernel32

user32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

version

gdi32

advapi32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

mscoree

generic