BundleCitrixWorkSpace.zip
- SHA256 660f7dcf6cd804cfaf77e8a262a18a7a4c0c2cc6ebae1200b1579594e5baa9d2
Overview
overview
7Static
static
1BundleCitr...ll.bat
windows10-2004-x64
7BundleCitr...ll.bat
windows11-ltsc_2024-x64
7BundleCitr...er.exe
windows10-2004-x64
6BundleCitr...er.exe
windows11-ltsc_2024-x64
6BundleCitr...pt.ps1
windows10-2004-x64
7BundleCitr...pt.ps1
windows11-ltsc_2024-x64
7BundleCitr...ll.bat
windows10-2004-x64
7BundleCitr...ll.bat
windows11-ltsc_2024-x64
7Static task
static1
Behavioral task
behavioral1
Sample
BundleCitrixWorkspace2026/install.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
BundleCitrixWorkspace2026/install.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
BundleCitrixWorkspace2026/setup-files/CitrixWorkspaceFullInstaller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral4
Sample
BundleCitrixWorkspace2026/setup-files/CitrixWorkspaceFullInstaller.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral5
Sample
BundleCitrixWorkspace2026/setup-files/install-script.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral6
Sample
BundleCitrixWorkspace2026/setup-files/install-script.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
Behavioral task
behavioral7
Sample
BundleCitrixWorkspace2026/uninstall.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target BundleCitrixWorkSpace.zip
- Size 819.5MB
- Sample260910-r299esdn2t
- SHA256 660f7dcf6cd804cfaf77e8a262a18a7a4c0c2cc6ebae1200b1579594e5baa9d2
- MD5 605238907573d49e46ae8c6d10bddf35
- SHA1 902187a81bf57d4acf877f6b0e20723e65a63476
- SHA512 584936fc1cc04c0856411329d6ed55bcc5be2c8ae351923a42280ba03050d59a628317f90c7cd83c721bfa154b02242a75e6d8b11f04f1a9ce776be66090e137
- SSDEEP 12582912:pezhn2B+Fe+JyLHW1qX93QekJtxU+f7Jlm8+0FRUzNEYhs0NA4jLKhq:pC+ce+JyLHW8ObJtxUlERGNEYx/Laq
- TLSH T1CA9933C28648AB51F588A23FFB016E30866D95E3D29697DF6233FF20BD133D2455924E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
BundleCitrixWorkSpace.zip.zip 819.5MB
-
BundleCitrixWorkspace2026/Leggimi.txt1KB
-
BundleCitrixWorkspace2026/install.bat511B
-
BundleCitrixWorkspace2026/setup-files/CitrixWorkspaceFullInstaller.exe.exe 819.7MB
-
BundleCitrixWorkspace2026/setup-files/Installa_Citrix_WorkSpaceApp_v25.7.2000.2020.txt119B
-
BundleCitrixWorkspace2026/setup-files/install-script.ps1.ps1 2KB
-
BundleCitrixWorkspace2026/uninstall.bat247B
BundleCitrixWorkspace2026/Leggimi.txt
- SHA256 f85aa3f29aaa2479c3a0154bf888089a0618ed2c06d40b8b0b0034a96e128492
- MD5 73663a4f2b74a93c7276cc7950ba1362
- SHA1 308246b1ec04a7d4b35649bd2f4cd233f18114ed
- SHA512 83aaf905a75dc0c788275ba0f051a251d2ddcc627753e31dd923fabb245b83a1b1fd5e10e508dcc1905fbe611249e54a31e5ef42f6ae3a28a1a77868600ae811
- TLSH T17011127E24F756BD6841239DEA833204F79E74D19D0D600068BB970CC3CA80253BE1D6
- MD5 SHA1 SHA512 TLSH
BundleCitrixWorkspace2026/install.bat
- SHA256 ceb435b083fa9fde19a267be7c7a0f1de41f949d5b6bbaf17714c76e7eea7c40
- MD5 6448c038e39f0a2774af05db99069621
- SHA1 d028b52f46c11556a4edb25e2a423eaf7650e370
- SHA512 069ad7083e08cd5f973ad456af88b306d2200c9d03fec095921948d38e8dc8369f356318de4fb579895dfb82b2c3b416b18e58236dd204f2111fa568aef87fb7
- TLSH T142F0C0173A262F6E170FF5F794E2C620386F21422010CDC371788219740C708DF5068F
- MD5 SHA1 SHA512 TLSH
BundleCitrixWorkspace2026/setup-files/CitrixWorkspaceFullInstaller.exe
- IMPHASH 51ddc098ee48d2440bd63081517b06c2
- SHA256 58e8d6af96f31bc4ba18dda6b327a3c175757031c6b4cd8d5c9eb0bcfae3ba6e
- MD5 a94da55804c62e54a86e3899d86f0e70
- SHA1 26d47e9418e21b3ce0183096e5132b48a9678a37
- SHA512 e8d7c74808edb2ea5b215f78ec1111a2fd9c8239608b90a97e79c8f67a48de45336d70fcf51b5a96eb05dd14f10644588102072f9531bb35285161e1eecfd97a
- SSDEEP 12582912:OUmFqxhRXvptCtVn6w0G7vKoeXjZI6JO4fhzlpeHuCjaAvwCRi+xNILV:OzW/ptCtVn6imPXjZIi4HDjaAtNNWV
- TLSH T12F9933C277B49111F5CBE23EEA425E308E289D93819E559B2E3EFC6C39333D15528E49
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
19:08:5f:fc:7e:a2:32:b4:84:05:4a:c1:5d:e9:76:32:cc:db:64:92:36:1e:09:2b:67:69:67:ea:e3:46:8d:ea
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Citrix Systems\, Inc.,OU=Citrix,O=Citrix Systems\, Inc.,L=Fort Lauderdale,ST=Florida,C=US
Chains
Mar 29, 2026
CN=Citrix Systems\, Inc.,OU=Citrix,O=Citrix Systems\, Inc.,L=Fort Lauderdale,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Citrix Systems\, Inc.,OU=Citrix,O=Citrix Systems\, Inc.,L=Fort Lauderdale,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=Citrix Systems\, Inc.,OU=Citrix,O=Citrix Systems\, Inc.,L=Fort Lauderdale,ST=Florida,C=US
Serial Number
07:cd:97:e7:02:c0:c8:b7:42:9a:a0:db:87:fb:7b:96
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 2, 2025 - Jul 1, 2026
Minor OS version
0
Major OS version
6
Entry point
33000
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\jenkins\workspace\CWA_CWAPackage_release-2507-cu2\CWAMetaInstaller\CWAInstaller\src\Layout\bootstrapper\OfflineInstaller\Release\CitrixWorkspaceFullInstaller.pdb
kernel32
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
ProcessIdToSessionId
OpenProcess
GetVersionExW
FindResourceExW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
MoveFileExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
HeapAlloc
InitializeCriticalSectionEx
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetFileSizeEx
GetFileType
HeapDestroy
GetLastError
CloseHandle
DecodePointer
OutputDebugStringW
WriteFile
RemoveDirectoryW
GetShortPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
CreateDirectoryW
GetCommandLineW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
WriteConsoleW
LCMapStringW
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
TerminateProcess
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCPInfo
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
EncodePointer
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ImpersonateLoggedOnUser
GetTokenInformation
DuplicateToken
CreateWellKnownSid
CheckTokenMembership
OpenProcessToken
shell32
SHGetSpecialFolderPathW
SHCreateDirectoryExW
ShellExecuteExW
CommandLineToArgvW
ole32
CoCreateGuid
StringFromGUID2
CoInitializeEx
CoUninitialize
shlwapi
PathCombineW
PathFileExistsW
PathRemoveFileSpecW
PathMatchSpecW
PathIsDirectoryW
setupapi
SetupIterateCabinetW
Name
.text
Size
109KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
819.5MB
Virtual Size
819.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=29395,
count=186, id=261, version=29395,
count=1, id=253, version=35207,
count=23, id=259, version=35207,
count=20, id=260, version=35207,
count=85, id=261, version=35207,
count=25, id=260, version=29395,
count=1, id=262, version=29395,
count=23, id=257, version=29395,
count=205, id=1, productName=Unmarked objects,
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=261, version=33821,
count=2, id=261, version=35213,
count=1, id=255, version=35213,
count=1, id=151,
count=1, id=258, version=35213,
BundleCitrixWorkspace2026/setup-files/Installa_Citrix_WorkSpaceApp_v25.7.2000.2020.txt
- SHA256 8c1252c10375bc702b81abbd5ae6b45494ce99562e8bbda9b4252e8d17368e43
- MD5 cbfafde50f45dadbea66e1dc164f30dd
- SHA1 295e6d3867c5607bad313c073c2caa5c14217c22
- SHA512 de4dd4f2f7e9a2adf2c693b5216b71aa7222a76b07eb05deda6f739e5d64185cfc58e14dca822b935ef9b345c3dbafc31819fd41eb5586629d665823eb3794c0
- TLSH T1EDB092561BA3827DB761D2AE9C12342233B837850815E828B5A65C21426A82B923A406
- MD5 SHA1 SHA512 TLSH
BundleCitrixWorkspace2026/setup-files/install-script.ps1
- SHA256 2b106fcda88f8d011a73ffb7434e882355ebf94f18da15ec74231b7da93a3049
- MD5 44f8d7d7b63ef5c7de85b474a0b8e50a
- SHA1 74e65f932625a4fcb934e5130940f03d2778e6cc
- SHA512 f545b56cdff1d97927adcebfa69d1f908b7c5b3e6344ecb372c06cfb6fe27166233d69aa7bb482ce9ea7aad2d57dbc1f194cb706a4b40b6d0d0e0cda8bfa0122
- TLSH T153419C2D111A29583AB7029FD052900AEEDE70EE981D1AB43CDF85192FD703E89F5F76
- MD5 SHA1 SHA512 TLSH
BundleCitrixWorkspace2026/uninstall.bat
- SHA256 0fa4003800217d29dd9175f600657b8c29346a591dde367f7ffb8126c46e0724
- MD5 82d347190a0c4ddf3f10c9fb5cc2fafe
- SHA1 520d64999d96728db38e022851d4eb6d3fb969f4
- SHA512 4b0c40ecbfc190f3f0b6e860ef6a20efe4133a7612b436b6271a643abfb9d493eb48f5cc2163e89f165ccf2cec9781ebf1545a822d9e53e4e54bf6e6a915db8b
- TLSH T174D02B0F3A4B3E693B50B6D2B8B2D10269AD518110145DD121FE1426B540B485A2058E
- MD5 SHA1 SHA512 TLSH