EssentialUI_v6.88.108.zip
- SHA256 09e6b6f4e30ae2e476590197ac1252cfb6e55d0a47bf65bb4bd806f95d18c397
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
EssentialUI_v6.88.108.zip
Resource
win11-20260911-en
windows11-21h2-x64
5 signatures
600 seconds
General
- Target EssentialUI_v6.88.108.zip
- Size 89.6MB
- Sample260916-kkc42axflh
- SHA256 09e6b6f4e30ae2e476590197ac1252cfb6e55d0a47bf65bb4bd806f95d18c397
- MD5 aa63a4c5b0a9f424140c7ecf8af5cee6
- SHA1 5071d917308c06f312352edf837245e4803d1376
- SHA512 80b02b4ec36ddd8626d3c99eb8ba8bba77cc5b254f23661696fc44ec5f5b1d43e9f8304d69b6c97e40faadf7764b25832ad49edd0fa1adac92d6389a740a8532
- SSDEEP 1572864:1PRpRKse27f7Gqc21tvJJ7L92L7A+YOaiS2kDLdKMKvgzhV/ImpcnrsC0aHjpvhO:ZRKse27qWBJ7AL7PYOvpkDLd7hV/lung
- TLSH T132283364079ACEC2CD60EBF3434E5877859E06C62B98CD9E365970921412CA5ACF7ECF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/EssentialUI_v6.88.108.exe
File Explorer
-
EssentialUI_v6.88.108.zip.zip 89.6MB
-
EssentialUI_v6.88.108.exe.exe 94.3MB
EssentialUI_v6.88.108.exe
- IMPHASH c2d457ad8ac36fc9f18d45bffcd450c2
- SHA256 52509694fbbcfa8245b5a5dfe51836b71881370f7ad78c7a3def49cd234d44d2
- MD5 324297321d099a84cf3fa7abe32d6617
- SHA1 d7162bfaf83c5c3f45961ac7c6c6ac6de48ff48d
- SHA512 78c255cbba2d736e75f09b95c1900734d79d3b99b7143f330249a770fcf577222ad99e8a37605558ec5895bef0300c811550f16deb29d5ce537b72ab0e202210
- SSDEEP 1572864:uh9Lpo+QQdhLO06gr1ZhHRfbYxpA2iMae8MGzblGEIturT9PGMjA3BuCK4VFTrFR:uhJpo+QQdkK7HR8xp7iM95Gzbl7T9PdY
- TLSH T1E9283303ABA0499DC4DAEB38D57A52527A64BC8D8B3533EB3E44B5B05F217D06DB6F00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
90:d9:9a:12:b9:37:0e:02:ab:b0:a8:2e:69:f9:a8:12:d3:54:4d:13:dc:c0:15:71:d7:7f:e1:97:91:fa:d9:d9
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Falcon Nexus Group,O=Falcon Nexus Group,C=US
Chains
Sep 16, 2026
CN=Falcon Nexus Group,O=Falcon Nexus Group,C=US
Subject
CN=Falcon Nexus Group,O=Falcon Nexus Group,C=US
Serial Number
0b:ee:f5:eb:79:a4:27:6d:ba:1d:68:c6:9b:16:24:d4
Issuer
CN=Falcon Nexus Group,O=Falcon Nexus Group,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 9, 2026 - Sep 16, 2027
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Minor OS version
1
Major OS version
6
Entry point
426304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
59KB
Virtual Size
617KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ