4b756fd1f6ffd4977f367333e83fb001876fe37730ee44c6810945f881cbd81d

Sharing

Copy URL Twitter E-mail

General

Target
4b756fd1f6ffd4977f367333e83fb001876fe37730ee44c6810945f881cbd81d
Size 169KB
Sample260924-c2e1yscc62
SHA256 4b756fd1f6ffd4977f367333e83fb001876fe37730ee44c6810945f881cbd81d
MD5 0c7077bd87875253907e5d4bc1750893
SHA1 6d1e310217abe984f5ddcc0100036a13cc558c73
SHA512 ebedfe3d19633b01200c8210901a8d49b347ff9cf4e76d6b0835ed77ed95816920bb205ab85a9b4af444148462112ba8c0323d834c74df6a8e6e77ecbc68826c
SSDEEP 3072:ax/+kRGutVcyzra9gKGWmKjG+UJb7c80zQzRwhPTpdtm4/:ax/+ksyVcyzra9gKsKjGb7c/7Jmc
TLSH
T1D604E61AB29370BCD347C5305E9E9D70B1B1B8C585B06CBFE2D4DB322E65A106B28D79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
4b756fd1f6ffd4977f367333e83fb001876fe37730ee44c6810945f881cbd81d

File Explorer

4b756fd1f6ffd4977f367333e83fb001876fe37730ee44c6810945f881cbd81d

.exe 169KB

4b756fd1f6ffd4977f367333e83fb001876fe37730ee44c6810945f881cbd81d

IMPHASH b805aecfd9b5b67d6679e2251aedec49
SHA256 4b756fd1f6ffd4977f367333e83fb001876fe37730ee44c6810945f881cbd81d
MD5 0c7077bd87875253907e5d4bc1750893
SHA1 6d1e310217abe984f5ddcc0100036a13cc558c73
SHA512 ebedfe3d19633b01200c8210901a8d49b347ff9cf4e76d6b0835ed77ed95816920bb205ab85a9b4af444148462112ba8c0323d834c74df6a8e6e77ecbc68826c
SSDEEP 3072:ax/+kRGutVcyzra9gKGWmKjG+UJb7c80zQzRwhPTpdtm4/:ax/+ksyVcyzra9gKsKjGb7c/7Jmc
TLSH
T1D604E61AB29370BCD347C5305E9E9D70B1B1B8C585B06CBFE2D4DB322E65A106B28D79
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f0:71:5f:38:e1:0e:e8:db:85:86:fb:85:8a:11:18:64:74:2b:d8:e7:57:00:47:11:34:ee:89:75:7f:d6:19:9e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 23, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

comdlg32

GetOpenFileNameA GetSaveFileNameA

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileA DeleteCriticalSection EnterCriticalSection GetLastError GetModuleHandleA GetProcAddress InitializeCriticalSection LeaveCriticalSection LoadLibraryA SetUnhandledExceptionFilter Sleep TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WriteFile __C_specific_handler

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _exit _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf fflush fwrite

api-ms-win-crt-string-l1-1-0

strlen strncmp

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

shell32

ShellExecuteA

user32

CreateWindowExA DefWindowProcA DispatchMessageA GetMessageA LoadCursorA LoadIconA MessageBoxA RegisterClassExA ShowWindow TranslateMessage UpdateWindow

Name

.text

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

900B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4b756fd1f6ffd4977f367333e83fb001876fe37730ee44c6810945f881cbd81d

PE Signature issue

comdlg32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

shell32

user32

generic