9a8ee12f874e254932ba9c6c3ba726e5b083409e9874efd21c6534c5f40a624a

Sharing

Copy URL Twitter E-mail

General

Target
9a8ee12f874e254932ba9c6c3ba726e5b083409e9874efd21c6534c5f40a624a
Size 2.0MB
Sample260910-31zbbazvcv
SHA256 9a8ee12f874e254932ba9c6c3ba726e5b083409e9874efd21c6534c5f40a624a
MD5 265037f8052878826fc04f862e182552
SHA1 fc183451199c7eb141b0b8f2c9c91162c664af1e
SHA512 54f59e43d4cedb8e8043934e115d21bc85a1fbf59d3a94d2a33495c994984f7b9a0b58b8171042b07ebe8fdc6bc5da98313a3c3155883daf23c6fbb5a29895d0
SSDEEP 24576:EXNrSLScusMmOkKIhzvLKjc7RTVqP+GGDu+uZ2w6OqCu5+EmcB9535T0we6CRwH5:ruI5hSS9kP+bDuB63Cu8E9Bvd0/Nrbza
TLSH
T1ECA5D03FB28B753EE06E5A367A72E210593B7661A4124C1697F4C84CCF254B02E3E797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign installer

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
9a8ee12f874e254932ba9c6c3ba726e5b083409e9874efd21c6534c5f40a624a

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
9a8ee12f874e254932ba9c6c3ba726e5b083409e9874efd21c6534c5f40a624a

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

9a8ee12f874e254932ba9c6c3ba726e5b083409e9874efd21c6534c5f40a624a

.exe 2.0MB

9a8ee12f874e254932ba9c6c3ba726e5b083409e9874efd21c6534c5f40a624a

IMPHASH 88016fcdef7f227c62171d0afad9aae4
SHA256 9a8ee12f874e254932ba9c6c3ba726e5b083409e9874efd21c6534c5f40a624a
MD5 265037f8052878826fc04f862e182552
SHA1 fc183451199c7eb141b0b8f2c9c91162c664af1e
SHA512 54f59e43d4cedb8e8043934e115d21bc85a1fbf59d3a94d2a33495c994984f7b9a0b58b8171042b07ebe8fdc6bc5da98313a3c3155883daf23c6fbb5a29895d0
SSDEEP 24576:EXNrSLScusMmOkKIhzvLKjc7RTVqP+GGDu+uZ2w6OqCu5+EmcB9535T0we6CRwH5:ruI5hSS9kP+bDuB63Cu8E9Bvd0/Nrbza
TLSH
T1ECA5D03FB28B753EE06E5A367A72E210593B7661A4124C1697F4C84CCF254B02E3E797
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

PE Signature issue

Digest

97:a1:9d:fc:a2:70:0f:9c:81:e9:97:ca:d4:f8:a8:01:4b:c6:c5:31:c2:f1:94:7f:76:9f:f8:4d:b9:3f:86:5e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=0000936459,CN=TRUST & SIGN POLAND SP Z O O,O=TRUST & SIGN POLAND SP Z O O,L=Łódź,ST=Łódź Voivodeship,C=PL,1.3.6.1.4.1.311.60.2.1.3=#1302504c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 5, 2026

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

56:b6:29:cd:34:bc:78:f6

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2017 - May 30, 2042

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

Serial Number

08:4d:f0:3c:c7:d8:ca:f3:4c:5c:2c:fe:ec:44:8b:27

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Mar 4, 2026

Timespan

Mar 4, 2026 - Aug 22, 2026

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

728672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetACP GetExitCodeProcess CloseHandle LocalFree SizeofResource VirtualProtect QueryPerformanceFrequency VirtualFree GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW CompareStringOrdinal RtlUnwind SetFilePointerEx GetCPInfo GetStdHandle GetModuleHandleW FreeLibrary HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW GetFileSizeEx LoadLibraryA ResetEvent GetVolumeInformationW GetVersion GetDriveTypeW RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection LoadResource SuspendThread GetTickCount GetStartupInfoW GetFileAttributesW GetCurrentDirectoryW InitializeCriticalSection GetSystemWindowsDirectoryW GetThreadPriority SetThreadPriority GetCurrentProcess VirtualAlloc GetCommandLineW GetSystemInfo GetTempPathW LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage lstrlenW SetEndOfFile QueryPerformanceCounter HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW GetSystemDirectoryW DeleteFileW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection TlsGetValue GetDateFormatW IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetUserDefaultLangID RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale

comctl32

InitCommonControls

user32

CreateWindowExW TranslateMessage CharLowerBuffW CallWindowProcW CharUpperW PeekMessageW GetSystemMetrics SetWindowLongW MessageBoxW DestroyWindow CharUpperBuffW CharNextW MsgWaitForMultipleObjects LoadStringW ExitWindowsEx DispatchMessageW

oleaut32

SafeArrayPutElement VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantChangeType

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExW OpenProcessToken FreeSid AllocateAndInitializeSid EqualSid RegQueryValueExW GetTokenInformation ConvertSidToStringSidW RegCloseKey

Name

.text

Size

702KB

Virtual Size

701KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

28KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

113B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

24B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9a8ee12f874e254932ba9c6c3ba726e5b083409e9874efd21c6534c5f40a624a

PE Signature issue

kernel32

comctl32

user32

oleaut32

advapi32

generic