Arcane.zip
- SHA256 50dc354f937156d9fdf30a90201c956646528cb98364042993328bff364c1ee5
Behavioral task
behavioral1
Sample
Arcane.zip
Resource
win11-20260911-en
windows11-21h2-x64
39 signatures
900 seconds
General
- Target Arcane.zip
- Size 21.0MB
- Sample260919-1blmtaca73
- SHA256 50dc354f937156d9fdf30a90201c956646528cb98364042993328bff364c1ee5
- MD5 5be72018f6311b9e4744674ef175e28a
- SHA1 a8e112b2924947b7008fa495b1b2c002b61ef116
- SHA512 61438a37a4aca41c909e0dc5c90ea84b06d763eb58716c1b13e96c09ed14429954babb698b13c5717e0875320b08a4f92973756f67426cb19854fe32eeea5828
- SSDEEP 393216:UbJcnJBHt/0wzx21uARiNz1wu9EkMnB3Smm88qx0d+3aaJ0J3mI+tazgn:1J//0iOtRCJz6nFnmvqxOaSJcaUn
- TLSH T1992733D891EB7F4BDA346E02B4689A603740F9B724992FBC596F9D22190334D2F37127
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Arcane.exe themida - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Arcane.exe
File Explorer
-
Arcane.zip.zip 21.0MB
-
Arcane.exe.exe 2.9MB
-
Arcane.msi.msi 18.9MB
Arcane.exe
- SHA256 b57545c137ee9ea7221818855c319525dfd751bc1484d40f235ddc99c9fca5db
- MD5 40bbe64ef8eef81971f7407cc79c9d26
- SHA1 4da22748ca5bf3b6b83d5e21741ebbd805f94cc0
- SHA512 f30698e5799becc8ac3acea797012d89b85969ee38c89d5ee8be7c61c42452faecf0799bbf216911fe5de3470a56bca7a6eb071ad0cb7f58861090f2283b2dda
- SSDEEP 49152:CH0Je5xgGbXH7fC7Ua8rHh4Y1ditoUBnAC/i8q5zB8HaAdr/OIeV/PbrEqp/M:CH0+xg4LK2rBr0truv8ozB6I5PJ0
- TLSH T141E5133883BD9755EF26187183B087B7F122DEDF5B14AF2644AC19A44C7D2C299CDE88
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
8c:20:47:fd:09:df:b5:84:dd:0b:4e:a6:b1:1b:92:8f:fd:74:5c:72:16:3f:da:54:ba:2d:2a:f1:ca:d3:31:14
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Updater,O=SpringPoint Creek Software GmbH,L=Tokyo,C=JP
Chains
Sep 17, 2026
CN=Updater,O=SpringPoint Creek Software GmbH,L=Tokyo,C=JP
PE Signature issue
Digest
8d:c6:bc:a5:43:30:40:1a:95:f1:44:ce:1f:65:b1:bc:53:19:b8:64
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Updater,O=SpringPoint Creek Software GmbH,L=Tokyo,C=JP
Chains
Sep 17, 2026
CN=Updater,O=SpringPoint Creek Software GmbH,L=Tokyo,C=JP
Subject
CN=Updater,O=SpringPoint Creek Software GmbH,L=Tokyo,C=JP
Serial Number
41:f4:c5:1f:0c:3f:1d:97:4a:31:37:ee:0f:fa:66:9e
Issuer
CN=Updater,O=SpringPoint Creek Software GmbH,L=Tokyo,C=JP
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 17, 2026 - Sep 17, 2031
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Minor OS version
0
Major OS version
6
Entry point
4935768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
172KB
Virtual Size
327KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
37KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
28KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
189KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.themida
Size
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
Arcane.msi
- SHA256 ed368129a183f57d66cd6590953647ec9fcca8b916531e82550a4cbf00cf677c
- MD5 a348d050e7b0d9ad71e6607e34e99f92
- SHA1 15e8ad223f418c3f122b5e15cad0f5dc5028ae14
- SHA512 53bda30a0f52faba517623e59bcae5dfb9a993022b671ade680d477b580242f83ff77772d408a6b32ac70106334d4e82ca94850100251ae6fa2b2d859e7c3ac9
- SSDEEP 393216:MEqVwN3K6XYnqm2MjFcYJhDoQItZd01aOObBnEsLeJtKzOI9VDGv:TqW1X0qKvI3C1aOps6KOI9
- TLSH T1271733A268232C83CA6479BB63561720BF305DB07B1147592D36F86E2CFE1E91B5E347
- MD5 SHA1 SHA512 SSDEEP TLSH
File Signature issue
Digest
063c371fbecba5eed8d9507e07554fce582ea9ab7b20bb1a6ae1bfb05e684bfa
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Prehash
Signing Certificate
CN=IvyBrook Port Scanner,OU=Security Engineering,O=BlueFalls Media Tools Group,L=Helsinki,C=FI
Chains
Sep 17, 2026
CN=IvyBrook Port Scanner,OU=Security Engineering,O=BlueFalls Media Tools Group,L=Helsinki,C=FI
Subject
CN=IvyBrook Port Scanner,OU=Security Engineering,O=BlueFalls Media Tools Group,L=Helsinki,C=FI
Serial Number
73:33:46:55:a5:66:96:aa:4d:a6:5c:fc:d2:76:79:05
Issuer
CN=IvyBrook Port Scanner,OU=Security Engineering,O=BlueFalls Media Tools Group,L=Helsinki,C=FI
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 17, 2026 - Sep 17, 2030
Subject
CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE
Serial Number
84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4
Issuer
CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 15, 2025 - Jan 10, 2037
Subject
CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE
Serial Number
83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f
Issuer
CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 16, 2025 - Jul 16, 2041
Subject
CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 9, 2020 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 10, 2014 - Dec 10, 2034