touchskins[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
touchskins.exe
Size 5.7MB
Sample260830-1zffpsan4v
SHA256 0010281897fbf8f8742e70e5219abeeeac1b7702e3f709de1590e4cd969d3de7
MD5 b5a2cb4f2d7d72f9cd1d5388d56b5e1d
SHA1 bdbb2815739bbac2434ce1b8bcb425db41595bfe
SHA512 53bbb02cd351e36b61421b5a6ceaa448fbd7ca466ee28af24877f3a2f94e83b50f587d88b9783d5365eaea307cdb71dae340b01e420d5c945c417dd35f25a417
SSDEEP 98304:d4qX9Ejp3r+3AQSJBJHQ6mZ4VIPexp7g5hjFuZN:d4O90aNwXlGhY3
TLSH
T101568D03F2E654FDC957C134930BA733E93578490221ADAB46D4EB303EB69A05F2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

touchskins.exe

.exe 5.7MB

touchskins.exe

IMPHASH 7c087a47350a0fc6943ca63cc6a62368
SHA256 0010281897fbf8f8742e70e5219abeeeac1b7702e3f709de1590e4cd969d3de7
MD5 b5a2cb4f2d7d72f9cd1d5388d56b5e1d
SHA1 bdbb2815739bbac2434ce1b8bcb425db41595bfe
SHA512 53bbb02cd351e36b61421b5a6ceaa448fbd7ca466ee28af24877f3a2f94e83b50f587d88b9783d5365eaea307cdb71dae340b01e420d5c945c417dd35f25a417
SSDEEP 98304:d4qX9Ejp3r+3AQSJBJHQ6mZ4VIPexp7g5hjFuZN:d4O90aNwXlGhY3
TLSH
T101568D03F2E654FDC957C134930BA733E93578490221ADAB46D4EB303EB69A05F2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Password

infected

Digest

d0:e6:e1:77:9f:6d:76:53:a1:bf:56:c3:b7:3b:fa:7f:d5:65:d4:ac:0d:e1:f3:eb:d0:fc:72:1b:5c:9f:1d:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=IP Davydov Egor Denisovich,O=IP Davydov Egor Denisovich,L=Penza,ST=Penza Oblast,C=RU,1.2.840.113549.1.9.1=#0c15706f7263686573313333374070726f746f6e2e6d65

Chains

Aug 12, 2026

CN=IP Davydov Egor Denisovich,O=IP Davydov Egor Denisovich,L=Penza,ST=Penza Oblast,C=RU,1.2.840.113549.1.9.1=#0c15706f7263686573313333374070726f746f6e2e6d65

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=IP Davydov Egor Denisovich,O=IP Davydov Egor Denisovich,L=Penza,ST=Penza Oblast,C=RU,1.2.840.113549.1.9.1=#0c15706f7263686573313333374070726f746f6e2e6d65

Serial Number

22:a3:64:90:5c:11:f8:26:73:bc:a4:dd

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 23, 2026 - Mar 24, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

4220720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CloseServiceHandle ControlService CreateProcessWithTokenW CryptAcquireContextA CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptEncrypt CryptGenRandom CryptGetHashParam CryptHashData CryptImportKey CryptReleaseContext EnumServicesStatusExA EventRegister EventSetInformation EventUnregister EventWriteTransfer GetTokenInformation GetUserNameW OpenProcessToken OpenSCManagerA OpenServiceA RegCloseKey RegCreateKeyExW RegDeleteTreeA RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

NtClose NtCreateFile NtCreateThreadEx NtDeviceIoControlFile NtQuerySystemInformation RtlCaptureContext RtlInitUnicodeString RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind VerSetConditionMask

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetEvent WSASetLastError WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname gethostname getpeername getsockname getsockopt htonl htons inet_ntop inet_pton ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt socket

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringEx CompareStringW CopyFileW CreateDirectoryW CreateEventA CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateMutexA CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemDirectoryW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultUILanguage GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32EnumProcessModulesEx K32GetModuleBaseNameA LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SystemTimeToTzSpecificLocalTime TerminateProcess TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrlenA

user32

ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EmptyClipboard EnumDisplayDevicesW EnumDisplaySettingsW GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetDesktopWindow GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetWindowRect IsWindowUnicode LoadCursorA LoadIconA MessageBoxA MonitorFromWindow OpenClipboard PeekMessageA PostQuitMessage RegisterClassExA ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClassLongPtrA SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetProcessDPIAware SetWindowPos ShowWindow TrackMouseEvent TranslateMessage UnregisterClassA UpdateWindow WaitForInputIdle

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteA ShellExecuteExA ShellExecuteW

ole32

CoInitializeEx CoTaskMemFree CoUninitialize StringFromGUID2

shlwapi

PathCanonicalizeW

dbghelp

SymCleanup SymFromAddr SymFromName SymGetLineFromAddr64 SymGetOptions SymInitialize SymInitializeW SymLoadModuleExW SymSetOptions

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetNameStringW CertOpenStore CertOpenSystemStoreA CryptDecodeObjectEx CryptQueryObject CryptStringToBinaryW PFXImportCertStore

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

bcrypt

BCryptGenRandom

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

50B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

touchskins.exe

advapi32

d3d11

ntdll

ws2_32

kernel32

user32

shell32

ole32

shlwapi

dbghelp

gdi32

crypt32

imm32

d3dcompiler_47

dwmapi

bcrypt

generic