f19503e54d5fa06dd2a9f72be440d208d40a7f92b5c8b0b25a9477ed811e37e3

Sharing

Copy URL Twitter E-mail

General

Target
f19503e54d5fa06dd2a9f72be440d208d40a7f92b5c8b0b25a9477ed811e37e3
Size 407KB
Sample260922-v5mjbabe99
SHA256 f19503e54d5fa06dd2a9f72be440d208d40a7f92b5c8b0b25a9477ed811e37e3
MD5 a620f8e215de3cc2e0685cbcb14e090f
SHA1 b5b6da4b5571ace46866120403344f6f60017f8c
SHA512 d4eb1ec3fb9c04aa806b739733bdb154195bdda1d2f94b006dd32701ddd20924fb4feaec611fc7e8a2818bb3f9e8ef54cdf7a9461546e94725a72fc6c244b0a6
SSDEEP 6144:iJnxgAv6zgh3q3dX1nX4S1fzhaYSoHfn1xqY7LrnG6vUJH:OkWuzhaYSo/bqY7/G6Q
TLSH
T1149439847BD60423F96F47356CFE5936D33AB9226FB287CF121052980AE33D16879762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
f19503e54d5fa06dd2a9f72be440d208d40a7f92b5c8b0b25a9477ed811e37e3

File Explorer

f19503e54d5fa06dd2a9f72be440d208d40a7f92b5c8b0b25a9477ed811e37e3

.dll 407KB

f19503e54d5fa06dd2a9f72be440d208d40a7f92b5c8b0b25a9477ed811e37e3

IMPHASH df94e7c8995a1db2b713368622cf2c1f
SHA256 f19503e54d5fa06dd2a9f72be440d208d40a7f92b5c8b0b25a9477ed811e37e3
MD5 a620f8e215de3cc2e0685cbcb14e090f
SHA1 b5b6da4b5571ace46866120403344f6f60017f8c
SHA512 d4eb1ec3fb9c04aa806b739733bdb154195bdda1d2f94b006dd32701ddd20924fb4feaec611fc7e8a2818bb3f9e8ef54cdf7a9461546e94725a72fc6c244b0a6
SSDEEP 6144:iJnxgAv6zgh3q3dX1nX4S1fzhaYSoHfn1xqY7LrnG6vUJH:OkWuzhaYSo/bqY7/G6Q
TLSH
T1149439847BD60423F96F47356CFE5936D33AB9226FB287CF121052980AE33D16879762
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ad:bd:dd:d8:ad:6c:f1:b7:12:a2:a6:20:60:4b:cc:c7:7e:9a:fb:b3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dawn Winery Code Signing Certificate,O=The Dawn Winery,ST=Ontario,C=CA

Chains

Mar 10, 2026

CN=Dawn Winery Code Signing Certificate,O=The Dawn Winery,ST=Ontario,C=CA

CN=Dawn Winery CA1,OU=Dawn Winery Certificate Authority,O=The Dawn Winery,ST=Ontario,C=CA

CN=Dawn Winery Root CA,OU=Dawn Winery Certificate Authority,O=The Dawn Winery,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c14746561706f743431393540676d61696c2e636f6d

Subject

CN=Dawn Winery Code Signing Certificate,O=The Dawn Winery,ST=Ontario,C=CA

Serial Number

10:00

Issuer

CN=Dawn Winery CA1,OU=Dawn Winery Certificate Authority,O=The Dawn Winery,ST=Ontario,C=CA

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2025 - Dec 8, 2026

Subject

CN=Dawn Winery CA1,OU=Dawn Winery Certificate Authority,O=The Dawn Winery,ST=Ontario,C=CA

Serial Number

10:00

Issuer

CN=Dawn Winery Root CA,OU=Dawn Winery Certificate Authority,O=The Dawn Winery,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c14746561706f743431393540676d61696c2e636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 12, 2025 - Aug 10, 2035

Subject

CN=Dawn Winery Root CA,OU=Dawn Winery Certificate Authority,O=The Dawn Winery,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c14746561706f743431393540676d61696c2e636f6d

Serial Number

21:a1:a0:0e:65:dc:bd:a7:6e:56:29:ae:80:c2:b2:0a:90:85:57:96

Issuer

CN=Dawn Winery Root CA,OU=Dawn Winery Certificate Authority,O=The Dawn Winery,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c14746561706f743431393540676d61696c2e636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 12, 2025 - Jul 19, 2125

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

50912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

spoolss

EnumPortsW

user32

LoadStringW wsprintfW

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetKeyValueW RegSetValueExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp _wcsnicmp calloc free fwrite getenv isalpha malloc memcpy memmove strchr strcmp strcpy strcspn strlen wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcstoul

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls EnterCriticalSection FreeLibrary GetComputerNameW GetDefaultCommConfigW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetTickCount GetUserDefaultLangID GetVersion HeapAlloc HeapReAlloc InitializeCriticalSection IsBadStringPtrW LeaveCriticalSection LoadLibraryW RaiseException ReadFile SetDefaultCommConfigW SetFilePointerEx WideCharToMultiByte WriteFile lstrcmpW lstrcmpiW

ntdll

LdrGetDllHandle NtQueryVirtualMemory RtlFindExportedRoutineByName _chkstk _vsnprintf

Name

.text

Size

48KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

656B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/43

Size

76KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

32KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

28KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/32

Size

32KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f19503e54d5fa06dd2a9f72be440d208d40a7f92b5c8b0b25a9477ed811e37e3

PE Signature issue

spoolss

user32

advapi32

ucrtbase

kernel32

ntdll

generic