Hermes-Setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Hermes-Setup.exe
Size 7.6MB
Sample260905-ahhavsshjd
SHA256 cfc818adf831a748c61a407152a03c7a426ebee78f499d20a31fae2b5ac5d827
MD5 fad75c80123cdc036cd7dbc58bbae905
SHA1 a2dc0ee474e6d7b62ede51f86a597e1145e20374
SHA512 effe6a5a67b347eb9cabdaa4463405e8100aa332f791a6c0c3f1f05a57f361e66307734477370c146b87379ad723ed0abd0e54c4af42e049b4fde43704b3f0ef
SSDEEP 98304:0oOWzjNL8JHsoaK742kpK4UJFdMpnGrREyK6MTKfn+5:MgL8cKNjMpGrl9/i
TLSH
T16D869E03F6A681ECC06EC174C35A9633EB32B88D0924B6AF5BE41B212F56F506F5D749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Hermes-Setup.exe

.exe 7.6MB

Hermes-Setup.exe

IMPHASH 4d99153e869493afd85fd40da7bf3333
SHA256 cfc818adf831a748c61a407152a03c7a426ebee78f499d20a31fae2b5ac5d827
MD5 fad75c80123cdc036cd7dbc58bbae905
SHA1 a2dc0ee474e6d7b62ede51f86a597e1145e20374
SHA512 effe6a5a67b347eb9cabdaa4463405e8100aa332f791a6c0c3f1f05a57f361e66307734477370c146b87379ad723ed0abd0e54c4af42e049b4fde43704b3f0ef
SSDEEP 98304:0oOWzjNL8JHsoaK742kpK4UJFdMpnGrREyK6MTKfn+5:MgL8cKNjMpGrl9/i
TLSH
T16D869E03F6A681ECC06EC174C35A9633EB32B88D0924B6AF5BE41B212F56F506F5D749
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

28:63:8b:11:b9:08:69:17:fc:c5:fd:c2:53:05:7f:98:8d:18:0b:b9:d0:fd:1b:b3:a9:40:dc:f0:b5:fb:76:a9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Nous Research Inc.,O=Nous Research Inc.,L=Austin,ST=Texas,C=US

Chains

Aug 10, 2026

CN=Nous Research Inc.,O=Nous Research Inc.,L=Austin,ST=Texas,C=US

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Nous Research Inc.,O=Nous Research Inc.,L=Austin,ST=Texas,C=US

Serial Number

33:00:04:21:aa:53:4b:5c:c5:1a:87:62:34:00:00:00:04:21:aa

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2026 - Aug 11, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:24:d3:95:e0:a2:e9:c9:31:00:00:00:00:00:57

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

4567064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Hermes_Setup.pdb

bcryptprimitives

ProcessPrng

ntdll

NtReadFile NtCancelIoFileEx NtWriteFile NtCreateNamedPipeFile NtOpenFile NtDeviceIoControlFile NtCreateFile RtlGetVersion RtlNtStatusToDosError

kernel32

RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer LoadLibraryA RaiseException RtlPcToFileHeader IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime ResetEvent SetEvent WriteFile PostQueuedCompletionStatus GetLastError CloseHandle GetProcAddress Sleep GetModuleHandleA ReadFile SetThreadStackGuarantee LoadLibraryW DeviceIoControl GetExitCodeProcess WaitForSingleObject RegisterWaitForSingleObject GetCurrentThread RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess WideCharToMultiByte ReleaseMutex MultiByteToWideChar HeapAlloc GetProcessHeap SleepEx FormatMessageW SetHandleInformation SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess TerminateProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetTempPathW DeleteFileW MoveFileExW SetWaitableTimer FindNextFileW HeapFree GetQueuedCompletionStatusEx FlushFileBuffers HeapReAlloc FreeLibrary CopyFileExW lstrlenW SetLastError SwitchToThread GetFinalPathNameByHandleW LoadLibraryExW GetModuleHandleW GetUserDefaultUILanguage LCIDToLocaleName OutputDebugStringW GetOverlappedResult OutputDebugStringA FindClose GetSystemTimePreciseAsFileTime GetCurrentThreadId GetProcessId GetFullPathNameW CreateIoCompletionPort LocalFree GlobalAlloc LoadLibraryExA GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext SetEnvironmentVariableW GetCurrentProcessId OpenProcess AddVectoredExceptionHandler CreateWaitableTimerExW GlobalFree GetBinaryTypeW CreateProcessW CancelIo CreateEventW CreateDirectoryW CreateSymbolicLinkW CreateThread WriteFileEx ReadFileEx WriteConsoleW SetFilePointerEx GetConsoleOutputCP GetConsoleMode GetStdHandle GetSystemInfo CreateMutexA SetNamedPipeHandleState CreateFileW CreatePipe UnregisterWaitEx CancelIoEx SetFileCompletionNotificationModes

shell32

DragFinish DragQueryFileW ILFree SHCreateItemFromParsingName SHGetKnownFolderPath ILCreateFromPathW ShellExecuteExW SHAppBarMessage SHOpenFolderAndSelectItems ShellExecuteW

ole32

CoCreateInstance CoInitialize RegisterDragDrop CoCreateFreeThreadedMarshaler OleInitialize CoTaskMemAlloc RevokeDragDrop CoInitializeEx CoTaskMemFree CoUninitialize

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

ShowWindow SendMessageW GetMenuBarInfo SetParent SetFocus GetWindow GetClientRect DestroyMenu SetWindowRgn MapWindowPoints GetWindowRect OffsetRect GetWindowDC FillRect ReleaseDC DestroyIcon GetParent SystemParametersInfoA GetActiveWindow FindWindowExW TrackMouseEvent CloseTouchInputHandle GetTouchInputInfo SetCapture ScreenToClient GetKeyState GetAsyncKeyState DrawTextW CheckMenuItem UpdateWindow InvalidateRect SetCursorPos SetCursor LoadCursorW GetForegroundWindow FlashWindowEx DestroyAcceleratorTable SendInput InsertMenuW AppendMenuW VkKeyScanW SetMenu GetDC RegisterTouchWindow IsWindow IsWindowEnabled IsIconic IsWindowVisible EnableWindow SetPropW CreateAcceleratorTableW GetKeyboardState SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity TranslateAcceleratorW GetMenuItemInfoW MonitorFromRect ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout ClipCursor GetSystemMetrics MsgWaitForMultipleObjectsEx DispatchMessageW MapVirtualKeyW GetUpdateRect PeekMessageW PostQuitMessage ValidateRect GetRawInputData GetMessageW SetWindowLongPtrW GetClipCursor ShowCursor DestroyWindow PostThreadMessageW SystemParametersInfoW SetWindowLongW GetSystemMenu EnumChildWindows GetMonitorInfoW GetWindowPlacement DispatchMessageA TranslateMessage GetMessageA SetWindowPos CreateWindowExW RegisterClassExW SetWindowPlacement ChangeDisplaySettingsExW GetWindowLongPtrW DefWindowProcW PostMessageW RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint RegisterRawInputDevices AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn ReleaseCapture RegisterWindowMessageA CreateMenu CreatePopupMenu DrawMenuBar IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem SetMenuItemInfoW DrawIconEx CreateIcon RemoveMenu

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

oleaut32

SetErrorInfo SysFreeString SysStringLen GetErrorInfo

shlwapi

SHCreateMemStream

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

gdi32

CreateRectRgn DeleteObject CombineRgn BitBlt CreateSolidBrush GetDeviceCaps DeleteDC SelectObject CreateDIBSection CreateCompatibleDC SetTextColor SetBkMode

advapi32

RegCloseKey SystemFunction036 EventSetInformation EventRegister RegGetValueW RegOpenKeyExW EventUnregister EventWriteTransfer RegQueryValueExW

ws2_32

WSASend shutdown send freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt bind getsockname connect ioctlsocket WSASocketW recv closesocket WSAIoctl getsockopt getpeername WSAGetLastError

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

wcslen wcscmp _wcsicmp wcsncmp strcpy_s

api-ms-win-crt-math-l1-1-0

__setusermatherr floor roundf trunc pow round

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_cexit __p___argv __p___argc terminate _exit _register_thread_local_exe_atexit_callback _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _c_exit _crt_atexit _set_app_type _seh_filter_exe _initialize_onexit_table abort _register_onexit_function exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode calloc

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Hermes-Setup.exe

bcryptprimitives

ntdll

kernel32

shell32

ole32

api-ms-win-core-synch-l1-2-0

user32

comctl32

oleaut32

shlwapi

dwmapi

gdi32

advapi32

ws2_32

bcrypt

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic