isaac-save-installer.exe.zip
- SHA256 0a2b9f6c83661d28e1344b83c2c0fc25d5fd87682a693d922991a758b7bccd1e
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
isaac-save-installer.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
300 seconds
Behavioral task
behavioral2
Sample
isaac-save-installer.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral3
Sample
isaac-save-installer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target isaac-save-installer.exe.zip
- Size 260KB
- Sample260910-vt25maen2t
- SHA256 0a2b9f6c83661d28e1344b83c2c0fc25d5fd87682a693d922991a758b7bccd1e
- MD5 e547ea609c6b40bb885ebbaa6df6d24c
- SHA1 65e6dd019ce069c0bc4b3201bf0cbf7598d10424
- SHA512 d0ca7bfd81e617d7d6bf5ba7f69c7e2408b0f2650cfce9117dadb41d679abd23fedd9ce24ac79d4c22108aaabdab230b7d1cfbbd5a24d1c735969fea91aa0bc8
- SSDEEP 6144:bjzptcJxZh1xXn424KOfgmnpGuOlrQEN9NliQ:Hz7cvZRn4TKIRYuOl0EWQ
- TLSH T1C24423628471E7533A38360B018BE174A8F5200F27AC3DE966692DF4C6D636E07DC6DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/isaac-save-installer.exe
File Explorer
-
isaac-save-installer.exe.zip.zip 260KB
-
isaac-save-installer.exe.exe 648KB
isaac-save-installer.exe
- IMPHASH 1ea00a8166cc11456af693e495a133be
- SHA256 9b96b9389efe05a6ced59239e349b2e71a3eb41d6a9ab93cda7fa17b9a6f5639
- MD5 d86669475dfa5f1fb70972080d670560
- SHA1 3a12130084266309055112dcb3b1f3a32c232f78
- SHA512 d8198b8938f2b0df957e244b7653a5a0a25a6e3409e92340dfe0b0e77df8d4029939c496a2de11e23b4953e2c86ed96c6a953826cdf995e85ac0584e8848378d
- SSDEEP 12288:lzRiUx0GRHoDa6muE3Wvo6a2MIk27DyyqPd5/8ld:lzRxx0+HoDahVfYMqHyyqVKld
- TLSH T15DE42B25BB5599ADC45AC07483864A727B71B0CA0F32AAFF01844139FE6EAF51F3C758
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
388596
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
isaac_save_installer.pdb
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcryptprimitives
ProcessPrng
secur32
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions
advapi32
GetUserNameW
GetTokenInformation
OpenProcessToken
LookupAccountSidW
CopySid
GetLengthSid
IsValidSid
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
kernel32
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetConsoleOutputCP
CloseHandle
GetProcAddress
lstrlenW
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
GetDiskFreeSpaceExW
GetProcessTimes
CreateFileW
GetLastError
LocalFree
GetSystemInfo
VirtualQueryEx
GetCurrentProcessId
GetProcessHeap
HeapAlloc
HeapFree
OpenProcess
GetSystemTimes
GetProcessIoCounters
ReadProcessMemory
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
GetStdHandle
GetConsoleMode
SetConsoleMode
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
SetFileInformationByHandle
GetCurrentProcess
WaitForSingleObject
GetSystemTimePreciseAsFileTime
FindFirstFileExW
FindClose
CopyFileExW
HeapReAlloc
ReleaseMutex
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
CreateThread
GetFullPathNameW
GetModuleHandleA
GetFileInformationByHandle
GetFileInformationByHandleEx
DeleteFileW
GetFileType
IsProcessorFeaturePresent
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
shell32
CommandLineToArgvW
SHGetKnownFolderPath
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemFree
pdh
PdhCloseQuery
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhCollectQueryData
PdhOpenQueryA
PdhRemoveCounter
powrprof
CallNtPowerInformation
psapi
GetPerformanceInfo
GetModuleFileNameExW
ntdll
RtlNtStatusToDosError
NtReadFile
NtQueryInformationProcess
NtQuerySystemInformation
NtWriteFile
RtlGetVersion
oleaut32
SysAllocString
VariantClear
SysFreeString
netapi32
NetApiBufferFree
NetUserGetInfo
NetUserEnum
NetUserGetLocalGroups
iphlpapi
FreeMibTable
GetIfTable2
GetAdaptersAddresses
GetIfEntry2
vcruntime140
memcmp
memcpy
memset
__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memmove
__CxxFrameHandler3
api-ms-win-crt-heap-l1-1-0
free
realloc
_set_new_mode
api-ms-win-crt-string-l1-1-0
wcslen
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_set_app_type
_seh_filter_exe
_get_initial_narrow_environment
_initterm
_initterm_e
_register_thread_local_exe_atexit_callback
exit
_cexit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_exit
terminate
__p___argc
__p___argv
_c_exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
405KB
Virtual Size
405KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
215KB
Virtual Size
215KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=3, id=259, version=35207,
count=9, id=260, version=35207,
count=23, id=261, version=35207,
count=22, id=257, version=30151,
count=7, id=257, version=33140,
count=257, id=1, productName=Unmarked objects,
count=95, productName=Unmarked objects (old),
count=1, id=258, version=35213,