5f11b2f7585b1622a4a6cf9474397e8d62d367269c56419f8729df88a5845f54

Sharing

Copy URL Twitter E-mail

General

Target
5f11b2f7585b1622a4a6cf9474397e8d62d367269c56419f8729df88a5845f54
Size 232KB
Sample260905-bcwfzatera
SHA256 5f11b2f7585b1622a4a6cf9474397e8d62d367269c56419f8729df88a5845f54
MD5 dc9dadebe6962217a4f662b8e955246e
SHA1 b3e8618cdc548653afed756bc25eab02e186834d
SHA512 e6badbe4d60582f224487ce6f329e3365c07ba05a83bc5a5ca8258722c2383aba19ffd7ec5296559bbaf918c79206f6680a37b14feffa0a1c55530144fd161e6
SSDEEP 6144:EJ7YjJn7pxGMY2KZ1x+YGTRGzBV+UdvrEFp7hK0V11f:EJ27iM6TRGVGzBjvrEH77j1f
TLSH
T138346A01329043E9E2F7063C35B93B1546BBBD3C4B6D86CB8B21454A1DAC7D2AE35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
5f11b2f7585b1622a4a6cf9474397e8d62d367269c56419f8729df88a5845f54

File Explorer

5f11b2f7585b1622a4a6cf9474397e8d62d367269c56419f8729df88a5845f54

.dll 232KB

5f11b2f7585b1622a4a6cf9474397e8d62d367269c56419f8729df88a5845f54

IMPHASH 43a2e8c2151b35fc09d553b2e4dac597
SHA256 5f11b2f7585b1622a4a6cf9474397e8d62d367269c56419f8729df88a5845f54
MD5 dc9dadebe6962217a4f662b8e955246e
SHA1 b3e8618cdc548653afed756bc25eab02e186834d
SHA512 e6badbe4d60582f224487ce6f329e3365c07ba05a83bc5a5ca8258722c2383aba19ffd7ec5296559bbaf918c79206f6680a37b14feffa0a1c55530144fd161e6
SSDEEP 6144:EJ7YjJn7pxGMY2KZ1x+YGTRGzBV+UdvrEFp7hK0V11f:EJ27iM6TRGVGzBjvrEH77j1f
TLSH
T138346A01329043E9E2F7063C35B93B1546BBBD3C4B6D86CB8B21454A1DAC7D2AE35B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d0:e4:e4:2f:fa:38:85:e8:84:2f:65:c1:4b:04:fa:65:a9:17:03:e5:c3:a2:30:3b:6d:d3:76:43:4b:c9:bf:2a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=IP Zinukhov Stanislav Igorevich,O=IP Zinukhov Stanislav Igorevich,L=Moscow,ST=Moscow,C=RU

Chains

Aug 24, 2026

CN=IP Zinukhov Stanislav Igorevich,O=IP Zinukhov Stanislav Igorevich,L=Moscow,ST=Moscow,C=RU

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=IP Zinukhov Stanislav Igorevich,O=IP Zinukhov Stanislav Igorevich,L=Moscow,ST=Moscow,C=RU

Serial Number

7b:31:a2:f5:bf:ea:8e:58:3e:b8:18:8c

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 15, 2025 - Mar 10, 2027

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7B1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:59:7c:da:71:e9:8d:5e:f5:c0:00:00:00:00:00:59

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

88176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\StartAllBack\StartIsBack11\Release\DarkMagicX86.pdb

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpA lstrcmpiA lstrlenW lstrcmpiW lstrcmpW

api-ms-win-core-atoms-l1-1-0

DeleteAtom GlobalFindAtomW AddAtomW FindAtomW

api-ms-win-core-libraryloader-l1-2-0

SizeofResource GetProcAddress GetModuleHandleW GetModuleHandleA LoadStringW FreeLibrary LoadLibraryExW GetModuleHandleExW DisableThreadLibraryCalls GetModuleFileNameW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority GetCurrentThreadId GetCurrentThread GetCurrentProcess ResumeThread GetThreadId CreateThread GetProcessIdOfThread GetCurrentProcessId OpenProcessToken TerminateProcess

api-ms-win-core-synch-l1-1-0

OpenEventW WaitForSingleObject SleepEx WaitForSingleObjectEx AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateEventW SetEvent

api-ms-win-core-errorhandling-l1-1-0

SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-security-base-l1-1-0

GetTokenInformation CreateWellKnownSid

api-ms-win-core-memory-l1-1-0

VirtualProtect MapViewOfFile OpenFileMappingW CreateFileMappingW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW WakeAllConditionVariable InitOnceExecuteOnce

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-sidebyside-l1-1-0

ActivateActCtx GetCurrentActCtx DeactivateActCtx FindActCtxSectionStringW

api-ms-win-mm-time-l1-1-0

timeEndPeriod timeBeginPeriod timeGetTime

api-ms-win-core-registry-l1-1-0

RegCloseKey RegGetValueW RegNotifyChangeKeyValue RegOpenKeyExW RegCreateKeyExW RegSetValueExW

api-ms-win-core-com-l1-1-0

PropVariantClear CoTaskMemFree CoCreateInstance

api-ms-win-core-psapi-l1-1-0

K32GetMappedFileNameW QueryFullProcessImageNameW

api-ms-win-core-registry-l2-1-0

RegOpenKeyW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW PathFileExistsW PathRemoveBackslashW PathRemoveExtensionW PathRemoveFileSpecW PathAddBackslashW PathAppendW

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy IsProcessorFeaturePresent OpenProcess

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-file-l1-1-0

SetFilePointer ReadFile FindFirstFileW FindNextFileW CreateDirectoryW FindClose CreateFileW

api-ms-win-core-wow64-l1-1-1

IsWow64Process2

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

user32

DeregisterShellHookWindow IsImmersiveProcess GetDpiForWindow SystemParametersInfoForDpi SendNotifyMessageW IsMenu GetSystemMenu SetTimer KillTimer GetGUIThreadInfo GetSubMenu GetMenu MonitorFromWindow GetCurrentInputMessageSource RegisterShellHookWindow InternalGetWindowText SetWindowCompositionAttribute RegisterClassExW LoadImageA GetSystemMetrics GetIconInfo SetMenuItemInfoW GetDpiForMonitorInternal SendMessageW EnableWindow SystemParametersInfoA SendMessageCallbackW CreateIconIndirect FillRect GetCIMSSM WindowFromPoint GetCursorPos GetClassNameW GetParent SetWindowRgn DrawEdge GetWindow IsWindow FindWindowW DrawTextW SetMessageExtraInfo GetUpdateRect FindWindowExW DefWindowProcW PtInRect GetClassLongW InvalidateRect SetMenuInfo GetMenuItemRect SetLayeredWindowAttributes UnhookWindowsHookEx SetWindowsHookExW PrintWindow CallNextHookEx GetClientRect IsWindowVisible EndPaint GetDesktopWindow GetKeyState PostMessageW RegisterClassW EqualRect GetMenuInfo MapWindowPoints GetWindowTextW SetClassLongW RegisterWindowMessageW GetClassWord GetAncestor GetPropW GetSysColor SetWindowLongW UnhookWinEvent GetMenuItemInfoW GetMenuItemCount InflateRect EnumChildWindows GetClassInfoW WindowFromDC EnumThreadWindows SetWinEventHook ShowWindow GetSystemMetricsForDpi DrawIconEx UpdateWindow GetWindowRect GetDpiForSystem LoadIconW CopyImage DestroyIcon BeginPaint SystemParametersInfoW GetWindowInfo OffsetRect GetDlgItem SetPropW DestroyWindow CreateWindowExW GetDC GetWindowThreadProcessId ReleaseDC GetWindowLongW IsIconic UpdateLayeredWindow SetWindowPos GetMessageExtraInfo RemovePropW GetMenuBarInfo

gdi32

SetLayout ExcludeClipRect DeleteDC StretchDIBits GdiAlphaBlend CreateCompatibleDC GetObjectW GetObjectType DeleteObject GetLayout SelectObject RestoreDC SaveDC CreateFontW CreateFontIndirectW GetCurrentObject GetBitmapBits GetTextColor GetStockObject SetTextColor SetBkMode SetBkColor ExtTextOutW CreateBitmap GdiFlush CreateRectRgn GetDCBrushColor BitBlt GetBitmapDimensionEx SetBitmapDimensionEx SetBitmapBits StretchBlt CreateDIBSection GetTextExtentExPointW GetDCDpiScaleValue GdiDrawStream CreateDPIScaledDIBSection CreateCompatibleBitmap

kernel32

GetCurrentApplicationUserModelId GetApplicationUserModelId

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __stdio_common_vsprintf_s

api-ms-win-crt-runtime-l1-1-0

abort _initterm _initterm_e

api-ms-win-crt-heap-l1-1-0

malloc calloc free

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsicmp wcsncpy_s memset

api-ms-win-crt-private-l1-1-0

_o___std_exception_copy _o___std_exception_destroy _o___std_type_info_destroy_list _o__callnewh _o__cexit _o__configure_narrow_argv _o__crt_atexit _o__execute_onexit_table _o__initialize_narrow_environment _o__initialize_onexit_table _o__libm_sse2_acos_precise _o__libm_sse2_cos_precise _o__libm_sse2_sin_precise _o__libm_sse2_sqrt_precise _o__purecall _o__register_onexit_function _o__seh_filter_dll _o__wcsnicmp _o_bsearch _o_wcscat_s _o_wcscpy_s wcschr _except_handler4_common __CxxFrameHandler3 _CxxThrowException memcpy

ntdll

NtAlpcSendWaitReceivePort RtlInitUnicodeString RtlAdjustPrivilege NtResumeThread

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetSystemWindowsDirectoryW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW

api-ms-win-core-file-l2-1-0

MoveFileExW

Name

.text

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

360B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5f11b2f7585b1622a4a6cf9474397e8d62d367269c56419f8729df88a5845f54

PE Signature issue

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-mm-time-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

user32

gdi32

kernel32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-private-l1-1-0

ntdll

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-file-l2-1-0

generic