10092026_1531_10092026_202609102101r[.]exe[.]iso

Sharing

Copy URL Twitter E-mail

General

Target
10092026_1531_10092026_202609102101r.exe.iso
Size 4.5MB
Sample260910-syjsqstya1
SHA256 281259d8efb23274496f554bd33791af4d791982a4f74a816b870d997b9538fb
MD5 17e793e304c47a2b08321f478d688510
SHA1 140fb376f3485bf913e34bc8a6440f4b2d3f168c
SHA512 8b6dbca68c270f25c739b52045d6cfff3708b2a4c11c3686fe6209f4104cfcac47990f192542abe46aa0084de82f63e9eeff04b720cf93031208c81aa5767aa8
SSDEEP 49152:mgOVcOlxvdFSIjoXp06Ozec0lkr+Xj2ds/VIBLiQGZ6VyCf0Hf3q8crYa2yt3SXw:8+SrbulAA1mf0fMKyfb1a
TLSH
T128267C07A2E801E8D86ED17C87578226EAB17C150B31A7DF0660B75A2F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

DLL Hijacking vulnerability 1 IoCs

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

resource
unpack002/dbghelp.dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/dbghelp.dll

File Explorer

10092026_1531_10092026_202609102101r.exe.iso

.iso 4.5MB
out.iso

.iso 4.5MB
202609102101r.exe

.exe 2.7MB
dbghelp.dll

.dll 1.8MB

10092026_1531_10092026_202609102101r.exe.iso

SHA256 281259d8efb23274496f554bd33791af4d791982a4f74a816b870d997b9538fb
MD5 17e793e304c47a2b08321f478d688510
SHA1 140fb376f3485bf913e34bc8a6440f4b2d3f168c
SHA512 8b6dbca68c270f25c739b52045d6cfff3708b2a4c11c3686fe6209f4104cfcac47990f192542abe46aa0084de82f63e9eeff04b720cf93031208c81aa5767aa8
SSDEEP 49152:mgOVcOlxvdFSIjoXp06Ozec0lkr+Xj2ds/VIBLiQGZ6VyCf0Hf3q8crYa2yt3SXw:8+SrbulAA1mf0fMKyfb1a
TLSH
T128267C07A2E801E8D86ED17C87578226EAB17C150B31A7DF0660B75A2F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

202609102101r.exe

IMPHASH 20d87a853c0f65a6272519485b70f112
SHA256 fbf8a622965b5c879d8333dbf8141e46f8066a993a2bc78f233f18358e27476b
MD5 d7c5bd3f38f9980675a05b4b7a121112
SHA1 d9ebbcfa243ed923a44e32807a8dcccaf5fd6d9a
SHA512 c5a2534b7841e76bbfc0a6e5b2055f03de4ea31b6862055e1ab35f4a48cf0f05dc331794b0e03deb15aa513f4d1252c36798cf317bf8d1479f8f04ce041b49c4
SSDEEP 49152:bgOVcOlxvdFSIjoXp06Ozec0lkr+Xj2ds/VIBLiQGZ6VyC:N+SrbulAA1m
TLSH
T178D57C13F29901E8D05ED2B987568222FAB1BC460B35B6DF0A50B7161F7AFE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Digest

89:9e:90:7d:45:80:3c:6a:17:44:85:b5:96:17:50:b5:a8:e1:82:5f:89:2a:1c:4f:d2:b6:b0:96:45:85:1f:7c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 13, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

984336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

notification_helper.exe.pdb

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetModuleInfo64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CloseHandle CompareStringW CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateNamedPipeW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetThreadPriorityBoost GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapLock HeapSetInformation HeapUnlock HeapWalk InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFileEx MapViewOfFile MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW RemoveVectoredExceptionHandler ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetInformationJobObject SetLastError SetNamedPipeHandleState SetStdHandle SetThreadInformation SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpW lstrcmpiW

ntdll

NtClose NtOpenKeyEx NtQueryValueKey RtlFormatCurrentUserKeyPath RtlFreeUnicodeString RtlInitUnicodeString

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

378KB

Virtual Size

377KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

689B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

219B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dbghelp.dll

IMPHASH ce4ad83a987bb290f3a8ebd351252f29
SHA256 41f74b43af6a7dcf5245c315009671b0e0b75e3142d0ce8bf164ea2de942f39c
MD5 a9c73dba8d64e40833a40b35ee8af94a
SHA1 273331350d5760aefb06e89d55177744677ae7d5
SHA512 0dec1911d9d752430f73169176c0d5c61d70bc5eab426eff6e421aa228c6c74fabe1bf95253c26494294639ba918ae10e23429a790f116957dbacac2bb2acc67
SSDEEP 24576:70Hf3q8crKAwMlGhIHWTyrZ3SzD/mvpIqbe75OMLElrwUPQPH4Sy:70Hf3q8crYa2yt3SX/qfbOSlrl4PY
TLSH
T124855B5797EC01A8ECBAE13CD657820AE7B238245721D7CB12A0876E6F73EE1593D350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

111008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

dbghelp.pdb

api-ms-win-crt-string-l1-1-0

strncmp memset strlen strcspn wcsnlen strcmp wcscmp wcsncmp

api-ms-win-crt-time-l1-1-0

_ctime64 _time64

api-ms-win-crt-locale-l1-1-0

_unlock_locales _lock_locales

api-ms-win-crt-runtime-l1-1-0

_initterm __doserrno _initterm_e

api-ms-win-crt-private-l1-1-0

_o__errno _o__execute_onexit_table _o__filelengthi64 _o__fullpath _o__initialize_narrow_environment _o__initialize_onexit_table _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__itoa_s _o__lseeki64 _o__ltoa _o__mbscmp _o__memicmp _o__open_osfhandle _o__purecall _o__read _o__register_onexit_function _o__seh_filter_dll _o__splitpath_s _o__stricmp _o__strlwr _o__strnicmp _o__wcsdup _o__wcsicmp _o__wcslwr _o__wcsnicmp _o__wctime64 _o__wdupenv_s _o__wfsopen _o__wfullpath _o__wgetenv _o__wmakepath_s _o__wsplitpath_s _o__wtoi _o_abort _o_atoi _o_atol _o_bsearch _o_calloc _o_fclose _o_fflush _o_fread _o_free _o_frexp _o_fseek _o_ftell _o_isspace _o_iswprint _o_iswspace _o_iswxdigit _o_localeconv _o_malloc _o_qsort _o_realloc _o_setlocale _o_strcat_s _o_strcpy_s _o_strncat_s _o_strncpy_s _o_terminate _o_tolower _o_towlower _o_wcscat_s _o_wcscpy_s _o_wcsncat_s _o_wcsncpy_s _o_wcstoul _o_wmemcpy_s __uncaught_exception _CxxThrowException _o__crt_atexit _o__configure_narrow_argv _o__close _o__cexit _o__calloc_base _o__callnewh _o___stdio_common_vswprintf_s _o___stdio_common_vsscanf _o___stdio_common_vsprintf_s _o___stdio_common_vsnwprintf_s _o___stdio_common_vsnprintf_s _o___stdio_common_vfprintf _o___std_type_info_destroy_list _o___std_exception_destroy _o___std_exception_copy _o___pctype_func _o___acrt_iob_func _o____mb_cur_max_func _o____lc_locale_name_func _o____lc_codepage_func wcsrchr strstr __std_terminate wcsstr wcschr memmove memcmp __unDNameEx strrchr strchr __unDName __C_specific_handler __CxxFrameHandler3 memcpy

api-ms-win-core-file-l1-1-0

FindNextFileW WriteFile SetFileAttributesW SetFileTime GetFileType SetEndOfFile GetFileAttributesA SetFilePointer FindClose SetFilePointerEx DeleteFileW GetFullPathNameW ReadFile CreateDirectoryW CreateFileA FindFirstFileW GetFileAttributesW CreateFileW GetFileSizeEx GetFileSize RemoveDirectoryW CreateDirectoryA

api-ms-win-core-errorhandling-l1-1-0

SetLastError GetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter SetErrorMode

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx DeleteCriticalSection AcquireSRWLockExclusive OpenProcess ReleaseSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSection InitializeCriticalSectionAndSpinCount

api-ms-win-core-misc-l1-1-0

LocalAlloc FormatMessageW Sleep

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess OpenThreadToken TlsSetValue GetCurrentProcessId TlsFree GetCurrentThreadId TlsGetValue GetCurrentThread TerminateProcess TlsAlloc

api-ms-win-core-heap-l1-1-0

HeapFree HeapReAlloc HeapAlloc GetProcessHeap

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime GetSystemInfo GetTickCount GetSystemTimeAsFileTime GetVersionExW GetSystemDirectoryW GetVersionExA SystemTimeToFileTime

api-ms-win-core-libraryloader-l1-1-0

GetModuleFileNameW LoadLibraryExW FreeLibrary GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryExA

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW SetEnvironmentVariableA ExpandEnvironmentStringsW

api-ms-win-security-base-l1-1-0

RevertToSelf AccessCheck ImpersonateSelf GetFileSecurityW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar GetStringTypeW

api-ms-win-core-memory-l1-1-0

VirtualAlloc VirtualProtect UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualFree MapViewOfFileEx ReadProcessMemory

api-ms-win-core-debug-l1-1-0

OutputDebugStringA OutputDebugStringW DebugBreak IsDebuggerPresent

api-ms-win-core-localregistry-l1-1-0

RegOpenKeyExW RegEnumKeyExW RegCloseKey RegQueryValueExW RegQueryInfoKeyW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-localization-l1-1-0

LCMapStringEx LCMapStringW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer EventRegister EventActivityIdControl EventUnregister

ntdll

RtlCreateQueryDebugBuffer NtQueryInformationProcess RtlDestroyQueryDebugBuffer RtlRunOnceExecuteOnce RtlEqualUnicodeString NtQueryObject RtlQueryProcessDebugInformation RtlUTF8ToUnicodeN

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileMappingA

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-downlevel-kernel32-l2-1-0

LocalFree

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

DbgHelpCreateUserDump DbgHelpCreateUserDumpW EnumDirTree EnumDirTreeW EnumerateLoadedModules EnumerateLoadedModules64 EnumerateLoadedModulesEx EnumerateLoadedModulesExW EnumerateLoadedModulesW64 ExtensionApiVersion FindDebugInfoFile FindDebugInfoFileEx FindDebugInfoFileExW FindExecutableImage FindExecutableImageEx FindExecutableImageExW FindFileInPath FindFileInSearchPath GetSymLoadError GetTimestampForLoadedLibrary ImageDirectoryEntryToData ImageDirectoryEntryToDataEx ImageNtHeader ImageRvaToSection ImageRvaToVa ImagehlpApiVersion ImagehlpApiVersionEx MakeSureDirectoryPathExists MiniDumpReadDumpStream MiniDumpWriteDump RangeMapAddPeImageSections RangeMapCreate RangeMapFree RangeMapRead RangeMapRemove RangeMapWrite RemoveInvalidModuleList ReportSymbolLoadSummary SearchTreeForFile SearchTreeForFileW SetCheckUserInterruptShared SetSymLoadError StackWalk StackWalk64 StackWalkEx SymAddSourceStream SymAddSourceStreamA SymAddSourceStreamW SymAddSymbol SymAddSymbolW SymAddrIncludeInlineTrace SymAllocDiaString SymCleanup SymCompareInlineTrace SymDeleteSymbol SymDeleteSymbolW SymEnumLines SymEnumLinesW SymEnumProcesses SymEnumSourceFileTokens SymEnumSourceFiles SymEnumSourceFilesW SymEnumSourceLines SymEnumSourceLinesW SymEnumSym SymEnumSymbols SymEnumSymbolsEx SymEnumSymbolsExW SymEnumSymbolsForAddr SymEnumSymbolsForAddrW SymEnumSymbolsW SymEnumTypes SymEnumTypesByName SymEnumTypesByNameW SymEnumTypesW SymEnumerateModules SymEnumerateModules64 SymEnumerateModulesW64 SymEnumerateSymbols SymEnumerateSymbols64 SymEnumerateSymbolsW SymEnumerateSymbolsW64 SymFindDebugInfoFile SymFindDebugInfoFileW SymFindExecutableImage SymFindExecutableImageW SymFindFileInPath SymFindFileInPathW SymFreeDiaString SymFromAddr SymFromAddrW SymFromIndex SymFromIndexW SymFromInlineContext SymFromInlineContextW SymFromName SymFromNameW SymFromToken SymFromTokenW SymFunctionTableAccess SymFunctionTableAccess64 SymFunctionTableAccess64AccessRoutines SymGetDiaSession SymGetExtendedOption SymGetFileLineOffsets64 SymGetHomeDirectory SymGetHomeDirectoryW SymGetLineFromAddr SymGetLineFromAddr64 SymGetLineFromAddrEx SymGetLineFromAddrW64 SymGetLineFromInlineContext SymGetLineFromInlineContextW SymGetLineFromName SymGetLineFromName64 SymGetLineFromNameEx SymGetLineFromNameW64 SymGetLineNext SymGetLineNext64 SymGetLineNextEx SymGetLineNextW64 SymGetLinePrev SymGetLinePrev64 SymGetLinePrevEx SymGetLinePrevW64 SymGetModuleBase SymGetModuleBase64 SymGetModuleInfo SymGetModuleInfo64 SymGetModuleInfoW SymGetModuleInfoW64 SymGetOmapBlockBase SymGetOmaps SymGetOptions SymGetScope SymGetScopeW SymGetSearchPath SymGetSearchPathW SymGetSourceFile SymGetSourceFileChecksum SymGetSourceFileChecksumW SymGetSourceFileFromToken SymGetSourceFileFromTokenW SymGetSourceFileToken SymGetSourceFileTokenW SymGetSourceFileW SymGetSourceVarFromToken SymGetSourceVarFromTokenW SymGetSymFromAddr SymGetSymFromAddr64 SymGetSymFromName SymGetSymFromName64 SymGetSymNext SymGetSymNext64 SymGetSymPrev SymGetSymPrev64 SymGetSymbolFile SymGetSymbolFileW SymGetTypeFromName SymGetTypeFromNameW SymGetTypeInfo SymGetTypeInfoEx SymGetUnwindInfo SymInitialize SymInitializeW SymLoadModule SymLoadModule64 SymLoadModuleEx SymLoadModuleExW SymMatchFileName SymMatchFileNameW SymMatchString SymMatchStringA SymMatchStringW SymNext SymNextW SymPrev SymPrevW SymQueryInlineTrace SymRefreshModuleList SymRegisterCallback SymRegisterCallback64 SymRegisterCallbackW64 SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64 SymSearch SymSearchW SymSetContext SymSetDiaSession SymSetExtendedOption SymSetHomeDirectory SymSetHomeDirectoryW SymSetOptions SymSetParentWindow SymSetScopeFromAddr SymSetScopeFromIndex SymSetScopeFromInlineContext SymSetSearchPath SymSetSearchPathW SymSrvDeltaName SymSrvDeltaNameW SymSrvGetFileIndexInfo SymSrvGetFileIndexInfoW SymSrvGetFileIndexString SymSrvGetFileIndexStringW SymSrvGetFileIndexes SymSrvGetFileIndexesW SymSrvGetSupplement SymSrvGetSupplementW SymSrvIsStore SymSrvIsStoreW SymSrvStoreFile SymSrvStoreFileW SymSrvStoreSupplement SymSrvStoreSupplementW SymUnDName SymUnDName64 SymUnloadModule SymUnloadModule64 UnDecorateSymbolName UnDecorateSymbolNameW WinDbgExtensionDllInit _EFN_DumpImage block chksym dbghelp dh fptr homedir inlinedbg itoldyouso lmi lminfo omap optdbgdump optdbgdumpaddr srcfiles stack_force_ebp stackdbg sym symsrv vc7fpo

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

301KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mrdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

10092026_1531_10092026_202609102101r.exe.iso

out.iso

202609102101r.exe

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-l1-1-0

dbghelp

kernel32

ntdll

generic

dbghelp.dll

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-eventing-provider-l1-1-0

ntdll

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-downlevel-kernel32-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-delayload-l1-1-0

generic