6b1452a683b2b6e1bbab7a436e7a8db71ff4a8d32d6fc5a85b57b6ca5f5b1d8f
- SHA256 6b1452a683b2b6e1bbab7a436e7a8db71ff4a8d32d6fc5a85b57b6ca5f5b1d8f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
msInstall.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 6b1452a683b2b6e1bbab7a436e7a8db71ff4a8d32d6fc5a85b57b6ca5f5b1d8f
- Size 6.5MB
- Sample260925-mn2mxazvgv
- SHA256 6b1452a683b2b6e1bbab7a436e7a8db71ff4a8d32d6fc5a85b57b6ca5f5b1d8f
- MD5 714cccd759884d2c02a0a46b298890e3
- SHA1 dc1bcf3a8db2f0acdba558098c37b7418647f598
- SHA512 0c4618e50d24846a94b683e919f385ae71bd907b3767aa8904feec78a68637edb149b9133ada3adba0cd13af6707cbe06aa84d32ac0b616a5ca6d7d9360fe84e
- SSDEEP 196608:BIq1DLJgRPxZ4OPYoL69kYT0X++VRXF1IvqADov:1XJoYs6p0X+wRIvB8v
- TLSH T13166334BE1A7D82C3DB3AB3F0FA372345A67781E5C04897C743BA782A951F4DE6A5005
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/msInstall.exe
File Explorer
-
6b1452a683b2b6e1bbab7a436e7a8db71ff4a8d32d6fc5a85b57b6ca5f5b1d8f.zip 6.5MB
-
msInstall.exe.exe 6.6MB
msInstall.exe
- IMPHASH 4df47bd79d7fe79953651a03293f0e8f
- SHA256 5f8e17be2e73138c40cea6a8f018f1a79e1c14958893568b3497a38f358332d4
- MD5 dbba5809bcda10c42a12995001cfc4bb
- SHA1 2260d0bf3c0120aab50c7cfd32d3ef716a82ba68
- SHA512 eaaa798ddbe322595963adbbea11d4d2b70e2533365a8e8213dfa24be9ff2069f7d3414f30949aaa8282b1ea9a0b64eb705529e142e7cb5a6b3d160027f26eed
- SSDEEP 196608:qbuCCCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazj:huN/HYOSIT/EVF9X
- TLSH T1C5663341B092CC7AE8F3253606B7D1346D7EFD130B1049BB62AC4A537E61B92B77921D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
2c:58:a5:84:88:f6:bd:81:9e:e2:db:f5:35:0a:15:7a:3b:bf:5f:fa
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Shenzhen Smartspace Software technology Co.\,Limited,OU=研发部,O=Shenzhen Smartspace Software technology Co.\,Limited,L=Shenzhen,ST=Guangdong,C=CN
Chains
Sep 23, 2026
CN=Shenzhen Smartspace Software technology Co.\,Limited,OU=研发部,O=Shenzhen Smartspace Software technology Co.\,Limited,L=Shenzhen,ST=Guangdong,C=CN
Subject
CN=Shenzhen Smartspace Software technology Co.\,Limited,OU=研发部,O=Shenzhen Smartspace Software technology Co.\,Limited,L=Shenzhen,ST=Guangdong,C=CN
Serial Number
55:9c:b9:0f:d1:6e:9d:1a:d3:75:f0:50:ab:6a:66:16
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 21, 2015 - Apr 19, 2017
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
5
Entry point
30618
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
GetShortPathNameW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
CreateDirectoryW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
HeapReAlloc
SetEndOfFile
RaiseException
ws2_32
ntohl
Name
.text
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=170, id=243, version=40116,
count=24, id=242, version=40116,
count=18, id=259, version=24123,
count=29, id=261, version=24123,
count=18, id=260, version=24123,
count=5, id=203, version=65501,
count=113, id=1, productName=Unmarked objects,
count=17, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,