8b662df56103f26c10e270a910b65c0b08b5d8a6a0502c5995faf04e059f3a99

General

Target
8b662df56103f26c10e270a910b65c0b08b5d8a6a0502c5995faf04e059f3a99
Size 1.0MB
Sample260827-ksvdaasbmd
SHA256 8b662df56103f26c10e270a910b65c0b08b5d8a6a0502c5995faf04e059f3a99
MD5 fb1b1bd6265e7448d9a1b7bdc7c14ef7
SHA1 480391c03c7cebaa81116e1c76e37447a0cdd057
SHA512 496223f23a80ddaac23333002fdb3e5fada2014eb370397396b77d8b05692adb8bb9d78605b8a61bc9935d3dc26095fbb6b3d26c49d79ccc2fe40318fdf29afd
SSDEEP 24576:CHTj5IjB4SWCy5BlkBeChV1UMh5fg8A0NlF5lkTur:AT9OB4SWNDCBeChV2CjLlpr
TLSH
T1C135E0A1A117F0FFCF430634529858B2B1392E703E208DB79BD5EEB92A71ED18555E23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
8b662df56103f26c10e270a910b65c0b08b5d8a6a0502c5995faf04e059f3a99

File Explorer

8b662df56103f26c10e270a910b65c0b08b5d8a6a0502c5995faf04e059f3a99

.exe 1.0MB

8b662df56103f26c10e270a910b65c0b08b5d8a6a0502c5995faf04e059f3a99

IMPHASH 8d0e187c08a5b6a70e8449d72fee1694
SHA256 8b662df56103f26c10e270a910b65c0b08b5d8a6a0502c5995faf04e059f3a99
MD5 fb1b1bd6265e7448d9a1b7bdc7c14ef7
SHA1 480391c03c7cebaa81116e1c76e37447a0cdd057
SHA512 496223f23a80ddaac23333002fdb3e5fada2014eb370397396b77d8b05692adb8bb9d78605b8a61bc9935d3dc26095fbb6b3d26c49d79ccc2fe40318fdf29afd
SSDEEP 24576:CHTj5IjB4SWCy5BlkBeChV1UMh5fg8A0NlF5lkTur:AT9OB4SWNDCBeChV2CjLlpr
TLSH
T1C135E0A1A117F0FFCF430634529858B2B1392E703E208DB79BD5EEB92A71ED18555E23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5e:5a:11:00:4f:8d:5f:b4:9b:18:87:7d:b4:14:d8:5f:e7:7c:95:1f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Stepan Rybin,O=Stepan Rybin,C=UA,1.2.840.113549.1.9.1=#0c14727962696e2e737465704079616e6465782e7275

Chains

Aug 26, 2026

CN=Stepan Rybin,O=Stepan Rybin,C=UA,1.2.840.113549.1.9.1=#0c14727962696e2e737465704079616e6465782e7275

Minor OS version

1

Major OS version

5

Entry point

130220

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsBadReadPtr GetModuleHandleA LoadLibraryA GetCurrentProcessId GetModuleFileNameW InitializeCriticalSection GetCurrentThreadId ExitProcess WaitForSingleObject CloseHandle CreateThread DeleteCriticalSection FreeLibrary GetCurrentProcess GetCommandLineW CreateEventW GetLastError SetEvent GetFullPathNameW CopyFileW DeleteFileW CreateEventA Sleep VirtualAlloc GetProcAddress HeapFree GetCommandLineA GetSystemTimeAsFileTime HeapAlloc IsProcessorFeaturePresent GetProcessHeap IsDebuggerPresent EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode SetLastError InterlockedIncrement InterlockedDecrement GetModuleHandleExW AreFileApisANSI MultiByteToWideChar GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo SetFilePointerEx SetStdHandle WriteConsoleW FlushFileBuffers LoadLibraryExW OutputDebugStringW LoadLibraryW GetStringTypeW LCMapStringW HeapReAlloc CreateFileW HeapSize SetEndOfFile ReadFile ReadConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

8b662df56103f26c10e270a910b65c0b08b5d8a6a0502c5995faf04e059f3a99

PE Signature issue

kernel32

generic