85db0f556ab9320da176a189fc346ee04097cff54a061fa03d062af7cd91cf8e

Sharing

Copy URL Twitter E-mail

General

Target
85db0f556ab9320da176a189fc346ee04097cff54a061fa03d062af7cd91cf8e
Size 3.4MB
Sample260910-31e8faxflf
SHA256 85db0f556ab9320da176a189fc346ee04097cff54a061fa03d062af7cd91cf8e
MD5 03e8e87a1df94b3bc62f7bdc2bf41b44
SHA1 e88cfe94f1f39c69025445444b5dd527d5058972
SHA512 84417a95ec9e7cb01b30cf60fc5f4d10ac87e48bfaa61672a090c5bf987870df45080b4644dc6e723f4f8299909811acabc0c7a2ceb6294d5d41545ae1086fea
SSDEEP 49152:aOn5BNuCi07Ll30CF4N8MAQUJ3BTZJPryv0Z6:aO7t4N8MAQUJ3BT/Pr9Z6
TLSH
T1BAF56C03AC50046AF05AB2B9DAA25342BA3D7C4607B533CB1B9276353FB27F07979719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
85db0f556ab9320da176a189fc346ee04097cff54a061fa03d062af7cd91cf8e

File Explorer

85db0f556ab9320da176a189fc346ee04097cff54a061fa03d062af7cd91cf8e

.exe 3.4MB

85db0f556ab9320da176a189fc346ee04097cff54a061fa03d062af7cd91cf8e

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 85db0f556ab9320da176a189fc346ee04097cff54a061fa03d062af7cd91cf8e
MD5 03e8e87a1df94b3bc62f7bdc2bf41b44
SHA1 e88cfe94f1f39c69025445444b5dd527d5058972
SHA512 84417a95ec9e7cb01b30cf60fc5f4d10ac87e48bfaa61672a090c5bf987870df45080b4644dc6e723f4f8299909811acabc0c7a2ceb6294d5d41545ae1086fea
SSDEEP 49152:aOn5BNuCi07Ll30CF4N8MAQUJ3BTZJPryv0Z6:aO7t4N8MAQUJ3BT/Pr9Z6
TLSH
T1BAF56C03AC50046AF05AB2B9DAA25342BA3D7C4607B533CB1B9276353FB27F07979719
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b6:fc:b6:3a:ae:3e:65:b1:4f:1f:94:f0:82:23:21:21:bf:27:35:16:e9:7d:14:de:35:ef:af:ff:3d:dd:ac:c8:32:19:3c:61:2e:a7:2f:be:70:c4:77:ce:71:b3:99:59

Digest Algorithm

sha384

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=HRB 104617,CN=DeepL SE,O=DeepL SE,STREET=Maarweg 165,L=Koeln,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c14657269632e6b7275736540646565706c2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#13054b6f656c6e,1.3.6.1.4.1.311.60.2.1.2=#13134e6f7264726865696e2d5765737466616c656e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 1, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

4f:95:1a:1c:51:29:96:bd:e5:e9:01:fd

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 18, 2025 - Mar 18, 2028

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:491A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4e:a3:c6:0e:3e:31:c3:74:27:00:00:00:00:00:4e

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 27, 2025 - Feb 26, 2026

Minor OS version

Major OS version

Entry point

464032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

54KB

Virtual Size

346KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

206KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

85db0f556ab9320da176a189fc346ee04097cff54a061fa03d062af7cd91cf8e

PE Signature issue

kernel32

generic