touchskins[.]exe | Triage™

Resubmissions

10/09/2026, 18:17

260910-ww48fatdqg3

10/09/2026, 18:16

260910-wwemsaer8w3

10/09/2026, 18:13

260910-wt5q7atdnd3

Sharing

Copy URL Twitter E-mail

General

Target
touchskins.exe
Size 5.7MB
Sample260910-wt5q7atdnd
SHA256 f62f800fec56211c903c0ee0d71acab2a7709bd8228b71174a89b7ddd85fadbc
MD5 9628f865c8ee46cb3bf07b880d24e06c
SHA1 f23667f8cee8dad0afc624e1d0b6ff2347f0e649
SHA512 fbd257f4ad8cd0d0aa1e56103c11e6366ec1b709fb85cefde020039bfb42d9d1bf88999e6d29009bb0ad69b22db99945fa00da3e8eadec5a636cabbd09d5dd77
SSDEEP 98304:O4qX9Ejp3r+3AQSJBJHQ6mZ4VIPexp7g5hjFuZA:O4O90aNwXlGhYC
TLSH
T16C568D03F2E654FDC957C134930BA733E93578490221ADAB46D4EB303EB69A05F2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

touchskins.exe

.exe 5.7MB

touchskins.exe

IMPHASH 7c087a47350a0fc6943ca63cc6a62368
SHA256 f62f800fec56211c903c0ee0d71acab2a7709bd8228b71174a89b7ddd85fadbc
MD5 9628f865c8ee46cb3bf07b880d24e06c
SHA1 f23667f8cee8dad0afc624e1d0b6ff2347f0e649
SHA512 fbd257f4ad8cd0d0aa1e56103c11e6366ec1b709fb85cefde020039bfb42d9d1bf88999e6d29009bb0ad69b22db99945fa00da3e8eadec5a636cabbd09d5dd77
SSDEEP 98304:O4qX9Ejp3r+3AQSJBJHQ6mZ4VIPexp7g5hjFuZA:O4O90aNwXlGhYC
TLSH
T16C568D03F2E654FDC957C134930BA733E93578490221ADAB46D4EB303EB69A05F2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

d0:e6:e1:77:9f:6d:76:53:a1:bf:56:c3:b7:3b:fa:7f:d5:65:d4:ac:0d:e1:f3:eb:d0:fc:72:1b:5c:9f:1d:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=IP Davydov Egor Denisovich,O=IP Davydov Egor Denisovich,L=Penza,ST=Penza Oblast,C=RU,1.2.840.113549.1.9.1=#0c15706f7263686573313333374070726f746f6e2e6d65

Chains

Sep 8, 2026

CN=IP Davydov Egor Denisovich,O=IP Davydov Egor Denisovich,L=Penza,ST=Penza Oblast,C=RU,1.2.840.113549.1.9.1=#0c15706f7263686573313333374070726f746f6e2e6d65

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=IP Davydov Egor Denisovich,O=IP Davydov Egor Denisovich,L=Penza,ST=Penza Oblast,C=RU,1.2.840.113549.1.9.1=#0c15706f7263686573313333374070726f746f6e2e6d65

Serial Number

22:a3:64:90:5c:11:f8:26:73:bc:a4:dd

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 23, 2026 - Mar 24, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

4220720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CloseServiceHandle ControlService CreateProcessWithTokenW CryptAcquireContextA CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptEncrypt CryptGenRandom CryptGetHashParam CryptHashData CryptImportKey CryptReleaseContext EnumServicesStatusExA EventRegister EventSetInformation EventUnregister EventWriteTransfer GetTokenInformation GetUserNameW OpenProcessToken OpenSCManagerA OpenServiceA RegCloseKey RegCreateKeyExW RegDeleteTreeA RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

NtClose NtCreateFile NtCreateThreadEx NtDeviceIoControlFile NtQuerySystemInformation RtlCaptureContext RtlInitUnicodeString RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind VerSetConditionMask

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetEvent WSASetLastError WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname gethostname getpeername getsockname getsockopt htonl htons inet_ntop inet_pton ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt socket

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringEx CompareStringW CopyFileW CreateDirectoryW CreateEventA CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateMutexA CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemDirectoryW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultUILanguage GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32EnumProcessModulesEx K32GetModuleBaseNameA LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SystemTimeToTzSpecificLocalTime TerminateProcess TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrlenA

user32

ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EmptyClipboard EnumDisplayDevicesW EnumDisplaySettingsW GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetDesktopWindow GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetWindowRect IsWindowUnicode LoadCursorA LoadIconA MessageBoxA MonitorFromWindow OpenClipboard PeekMessageA PostQuitMessage RegisterClassExA ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClassLongPtrA SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetProcessDPIAware SetWindowPos ShowWindow TrackMouseEvent TranslateMessage UnregisterClassA UpdateWindow WaitForInputIdle

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteA ShellExecuteExA ShellExecuteW

ole32

CoInitializeEx CoTaskMemFree CoUninitialize StringFromGUID2

shlwapi

PathCanonicalizeW

dbghelp

SymCleanup SymFromAddr SymFromName SymGetLineFromAddr64 SymGetOptions SymInitialize SymInitializeW SymLoadModuleExW SymSetOptions

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetNameStringW CertOpenStore CertOpenSystemStoreA CryptDecodeObjectEx CryptQueryObject CryptStringToBinaryW PFXImportCertStore

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

bcrypt

BCryptGenRandom

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

50B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

touchskins.exe

advapi32

d3d11

ntdll

ws2_32

kernel32

user32

shell32

ole32

shlwapi

dbghelp

gdi32

crypt32

imm32

d3dcompiler_47

dwmapi

bcrypt

generic