611452d6c49d83db23602b9970923fe6b9af73502ccfedfc1ab03672d2e9a103[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
611452d6c49d83db23602b9970923fe6b9af73502ccfedfc1ab03672d2e9a103.exe
Size 3.6MB
Sample260912-e6te9a1wew
SHA256 611452d6c49d83db23602b9970923fe6b9af73502ccfedfc1ab03672d2e9a103
MD5 ed923eb721e5ef99f094a64b361baabf
SHA1 c769c2e086f46ca68a6affd1bd5a05394d42f5d1
SHA512 abbdee00c0121ba0c26116a7742533723e9daea07b81e04222098dc5a390df368b2c8b1271bfb5d1b41ad978bcbad1c115fb2de115adb73f3f2e8506da7b7e7d
SSDEEP 49152:btA3ryavDDasVoBM+f1QaF7517IFR2ut/LUPYbHisXLiW1m:btCJUlQEHID2ut/YAHLix
TLSH
T17B068D07ACD159E6C09AA33089726551BB74FC441F322BDB2EA0B7782F76BC15E39748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
611452d6c49d83db23602b9970923fe6b9af73502ccfedfc1ab03672d2e9a103.exe

File Explorer

611452d6c49d83db23602b9970923fe6b9af73502ccfedfc1ab03672d2e9a103.exe

.exe 3.6MB

611452d6c49d83db23602b9970923fe6b9af73502ccfedfc1ab03672d2e9a103.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 611452d6c49d83db23602b9970923fe6b9af73502ccfedfc1ab03672d2e9a103
MD5 ed923eb721e5ef99f094a64b361baabf
SHA1 c769c2e086f46ca68a6affd1bd5a05394d42f5d1
SHA512 abbdee00c0121ba0c26116a7742533723e9daea07b81e04222098dc5a390df368b2c8b1271bfb5d1b41ad978bcbad1c115fb2de115adb73f3f2e8506da7b7e7d
SSDEEP 49152:btA3ryavDDasVoBM+f1QaF7517IFR2ut/LUPYbHisXLiW1m:btCJUlQEHID2ut/YAHLix
TLSH
T17B068D07ACD159E6C09AA33089726551BB74FC441F322BDB2EA0B7782F76BC15E39748
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

63:a8:90:eb:b5:b5:6f:3c:b1:81:ad:aa:6d:28:46:39:89:77:3f:12

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=bucks.star,O=SogroRjC,L=1dTqILRH,ST=MBleNq,C=US

Chains

Sep 10, 2026

CN=bucks.star,O=SogroRjC,L=1dTqILRH,ST=MBleNq,C=US

Minor OS version

Major OS version

Entry point

477088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

71KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

611452d6c49d83db23602b9970923fe6b9af73502ccfedfc1ab03672d2e9a103.exe

PE Signature issue

kernel32

generic