StatementofAccoun_0812.img
- SHA256 c5287073ea224385a4a835f1540cbfd5794e0daf844496a99f96905efee7ac6d
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
StatementofAccoun.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
wmicodegen.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
wmicodegen.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target StatementofAccoun_0812.img
- Size 604KB
- Sample260827-xt4dssyyay
- SHA256 c5287073ea224385a4a835f1540cbfd5794e0daf844496a99f96905efee7ac6d
- MD5 c49e0773138ad03fd8f2b2006ab4e99d
- SHA1 bd3fcbcab213edf101d7ec6d04390a79cc15cbb4
- SHA512 a9ce0e71843ac73b27729d4e84004a370dfe266dfc2e1b4a32f30fc50b62d69ce591f25cdb49e6e247f40073e20d6d3e8fa906dce4d17c40180cae376929f7cb
- SSDEEP 12288:tP48zmzxYVxiYOenk+7xxqqARFF/DMHG5hTayMkQbP:tP4OeYVUYpk0xMRrLqeVMkQr
- TLSH T156D4015A73A824F9D4B38538CA516616E771B42A133182EF725CC6790F33BE26F3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/wmicodegen.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/wmicodegen.dll
File Explorer
-
StatementofAccoun_0812.img.iso 604KB
-
out.iso.iso 604KB
-
StatementofAccoun.exe.exe 174KB
-
wmicodegen.dll.dll 377KB
out.iso
- SHA256 c5287073ea224385a4a835f1540cbfd5794e0daf844496a99f96905efee7ac6d
- MD5 c49e0773138ad03fd8f2b2006ab4e99d
- SHA1 bd3fcbcab213edf101d7ec6d04390a79cc15cbb4
- SHA512 a9ce0e71843ac73b27729d4e84004a370dfe266dfc2e1b4a32f30fc50b62d69ce591f25cdb49e6e247f40073e20d6d3e8fa906dce4d17c40180cae376929f7cb
- SSDEEP 12288:tP48zmzxYVxiYOenk+7xxqqARFF/DMHG5hTayMkQbP:tP4OeYVUYpk0xMRrLqeVMkQr
- TLSH T156D4015A73A824F9D4B38538CA516616E771B42A133182EF725CC6790F33BE26F3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
StatementofAccoun.exe
- IMPHASH 2aa2b758b667e9bc3668dd7e59073362
- SHA256 41d9c8f7662e76d62da7aac907d6419be76f60259241e16e7d8025ed4aa34d12
- MD5 bb97150614bcb7fba7040f6674037605
- SHA1 d3a6234a854886088eb29b21b26125b811a87768
- SHA512 32d77ccc2aec0cda4ef0eadb39a787221d25d7e0f01dcfa2dd23e94b8843037f70bccc6ffa33537acd01c1a04c03a3b0d108a7799abd4d73420d8ff26e8d62c4
- SSDEEP 3072:chlUYCVlFF4smO1RWUdESZhMiPx4DPmCJvo1aJBl0Zbln8D:chOY4tmOymfZJxAPj+sJsA
- TLSH T1C4048C5673A824F6D4728178CA959A56F772B42B033183DF035486791F33BEA6E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cd:46:40:28:ab:a6:65:ca:88:cf:55:48:8f:eb:18:9e:00:9a:b4:91:13:f6:fa:b4:79:c0:fc:7f:fb:6c:f4:c7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:87:bc:82:6e:85:a1:ae:53:a8:00:00:00:00:00:87
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Convert-MofToProvider.pdb
kernel32
CompareStringA
HeapSetInformation
SetThreadPreferredUILanguages
GetModuleHandleA
CreateFileW
WriteConsoleW
GetCommandLineA
GetVersionExW
RtlLookupFunctionEntry
RtlUnwindEx
ExitProcess
GetModuleHandleExW
GetProcAddress
GetLastError
MultiByteToWideChar
CreateDirectoryA
HeapAlloc
RtlPcToFileHeader
RaiseException
SetUnhandledExceptionFilter
EncodePointer
DecodePointer
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
GetStdHandle
WriteFile
GetModuleFileNameA
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
RtlUnwind
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
CloseHandle
HeapFree
GetLocaleInfoA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesA
GetStringTypeW
Sleep
LoadLibraryExW
IsProcessorFeaturePresent
CreateFileA
LCMapStringW
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
ReadConsoleW
GetLocaleInfoW
SetEndOfFile
GetProcessHeap
SetFilePointer
SetThreadStackGuarantee
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
wmicodegen
GeneratorMain
err
ValidIdent
GeneratorAdapterCode
user32
LoadStringW
Name
.text
Size
104KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=259, version=33145,
count=2, productName=Unmarked objects (old),
count=128, id=260, version=33145,
count=56, id=261, version=33145,
count=7, id=257, version=33145,
count=102, id=1, productName=Unmarked objects,
count=4, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wmicodegen.dll
- IMPHASH 30b9be7c12cf36a4122c6f56c26e52aa
- SHA256 3fb86b9f8d2751a061ad6afb9e9e28362d67473d60214ebf82a3c3806ced0f55
- MD5 87e45663cc6589260948053483e7a72c
- SHA1 cdb714f4fa73a4d761f275f33a33a16ed119923b
- SHA512 9a3d634ce166659f42ef5580664904c5634d9c3b5b5fa423c109c057ac5bf843742954de60e4e976c1d73349a4a975d4005eebdb25dd69e5731e653375d7c952
- SSDEEP 6144:FlkGiJqIWCohnlm+TM4xxiN4BQBGqxXSD2NNlpomMHG5hTayk/k70HGcPL:FiYOenk+7xxqqARFF/DMHG5hTayMkQbj
- TLSH T1F48422E972A925FCE5F7C9348B223037C7243524A319D8AFD4D4E9971F2B932BB52502
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapFree
GetProcessHeap
GetModuleHandleA
GetProcAddress
LoadLibraryA
HeapAlloc
GeneratorAdapterCode
GeneratorMain
LookupString
ValidIdent
err
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33145,
count=6, id=1, productName=Unmarked objects,
count=3, id=260, version=35228,
count=1, id=259, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,