1427e42243dbd2a64a1d2a1e8672256fd6b492dfdb10494ade9302270c091f10

Sharing

Copy URL Twitter E-mail

General

Target
1427e42243dbd2a64a1d2a1e8672256fd6b492dfdb10494ade9302270c091f10
Size 5.1MB
Sample260925-qt5tastsb1
SHA256 1427e42243dbd2a64a1d2a1e8672256fd6b492dfdb10494ade9302270c091f10
MD5 b8c2248f27ddd5d5350bd6b055193cab
SHA1 7662aedc4bf53995ee93456aae0d2a6db3c1bc6c
SHA512 3c12b8ce230cc9fca9cf31faa41605f8ff12937e61b277105351a6db2af5f3673801ff73fa403c2b36a3ae2d6e414230df771cc62d4431a602ec063f492b5c5e
SSDEEP 98304:8MMMRG00kxAWzc6V/GKSGmyv/ga0clMMMqadup1S9n4WJ1c27Q7CoTq3b:5G00kxZc6V/gGmyv/ga0c/adup1S9n4k
TLSH
T17E469E117900C571EBA141B6EEBDFE6A489CDA740B6855C3A3D42D2E3EB06D32F31693
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
1427e42243dbd2a64a1d2a1e8672256fd6b492dfdb10494ade9302270c091f10

File Explorer

1427e42243dbd2a64a1d2a1e8672256fd6b492dfdb10494ade9302270c091f10

.exe 5.1MB

1427e42243dbd2a64a1d2a1e8672256fd6b492dfdb10494ade9302270c091f10

IMPHASH 2ffc396d864553a113b64bef9059e612
SHA256 1427e42243dbd2a64a1d2a1e8672256fd6b492dfdb10494ade9302270c091f10
MD5 b8c2248f27ddd5d5350bd6b055193cab
SHA1 7662aedc4bf53995ee93456aae0d2a6db3c1bc6c
SHA512 3c12b8ce230cc9fca9cf31faa41605f8ff12937e61b277105351a6db2af5f3673801ff73fa403c2b36a3ae2d6e414230df771cc62d4431a602ec063f492b5c5e
SSDEEP 98304:8MMMRG00kxAWzc6V/GKSGmyv/ga0clMMMqadup1S9n4WJ1c27Q7CoTq3b:5G00kxZc6V/gGmyv/ga0c/adup1S9n4k
TLSH
T17E469E117900C571EBA141B6EEBDFE6A489CDA740B6855C3A3D42D2E3EB06D32F31693
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7c:a6:0b:40:19:a0:73:20:a1:84:b4:af:c9:d4:a4:c0:27:f0:d6:5e:d1:b2:ca:d1:58:39:ec:45:15:41:97:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dark MRT

Chains

Sep 25, 2026

CN=Dark MRT

Subject

CN=Dark MRT

Serial Number

74:63:63:eb:46:91:7c:b2:41:68:73:69:45:4b:f1:a4

Issuer

CN=Dark MRT

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 10, 2026 - Sep 10, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3136655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MHClient-Connect.pdb

soundlib

CreateSoundLib

winmm

waveOutReset waveInGetNumDevs waveInOpen waveInClose waveOutWrite waveInAddBuffer waveInStart waveInStop waveInReset waveOutPrepareHeader waveOutClose waveOutOpen waveOutGetNumDevs timeGetTime waveInPrepareHeader

ss3dgfunc

_WriteTGA@24 _SetInverseMatrix@8 _COLORtoDWORD@16 _VECTOR3Length@4 _CrossProduct@12 _Normalize@8 _SetRotationYMatrix@8 _SetRotationXMatrix@8 _TransformVector3_VPTR2@16 _RotatePositionWithPivot@24 _CalcDistance@8 _MatrixMultiply2@12 _TransformV3TOV4@16

wsock32

closesocket connect inet_ntoa getsockopt htons recv __WSAFDIsSet bind inet_addr WSAGetLastError WSACleanup WSAStartup socket setsockopt getsockname send gethostbyname sendto recvfrom ntohs ioctlsocket select

dinput8

DirectInput8Create

ws2_32

WSAIoctl inet_pton

wininet

HttpOpenRequestA InternetConnectA InternetReadFile InternetOpenUrlA InternetCloseHandle InternetOpenA HttpSendRequestA

kernel32

EnumSystemLocalesW ReadConsoleW SetFilePointerEx GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetCPInfo FatalAppExitA QueryDepthSList InterlockedFlushSList GetFileSize CloseHandle GetLocalTime OpenFile LoadLibraryA MultiByteToWideChar IsDBCSLeadByte CreateDirectoryA InterlockedExchange InterlockedCompareExchange GetProcAddress GetCurrentProcess GetCurrentProcessId CreateThread GetCurrentThread GetCurrentThreadId SuspendThread ResumeThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep WriteFile DuplicateHandle GetTickCount GetModuleFileNameA CreateFileA SetFileAttributesA GetFileAttributesA DeleteFileA TerminateThread GetExitCodeThread ReadFile WideCharToMultiByte LCMapStringA GetSystemDefaultLangID GetSystemFirmwareTable DeviceIoControl InterlockedDecrement VirtualQuery GetSystemInfo GetModuleFileNameW GetModuleHandleA GetEnvironmentVariableW GetSystemDirectoryW GetWindowsDirectoryW GetSystemWow64DirectoryW CreateFileW IsWow64Process QueryPerformanceCounter QueryPerformanceFrequency GlobalAlloc GlobalLock GlobalUnlock GlobalFree lstrlenA SetCurrentDirectoryA GetCurrentDirectoryA CreateToolhelp32Snapshot Process32First Process32Next Module32First Module32Next GetConsoleCP lstrcpyA OutputDebugStringA FreeLibrary HeapAlloc HeapFree GetProcessHeap GetLastError SystemTimeToFileTime CompareFileTime lstrcmpiA IsValidCodePage SetEvent GetTickCount64 CreateEventA HeapSize QueryFullProcessImageNameW Process32FirstW UnregisterWaitEx ExitProcess ReadProcessMemory SetThreadPriority TerminateProcess WriteProcessMemory GetThreadContext SetThreadContext IsDebuggerPresent CheckRemoteDebuggerPresent ReleaseMutex FindClose MapViewOfFile UnmapViewOfFile CreateMutexA CreateFileMappingA OpenFileMappingA RemoveDirectoryA FindFirstFileA FindNextFileA MoveFileA SetUnhandledExceptionFilter DecodePointer RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection GetPrivateProfileStringA WritePrivateProfileStringA lstrcatA GetLogicalDriveStringsA GetTempPathA QueryDosDeviceA CopyFileA IsBadReadPtr GetVersionExA GlobalMemoryStatusEx OpenMutexW GetDiskFreeSpaceExW GetFileAttributesW GetComputerNameW GetSystemTime InterlockedPushEntrySList InterlockedPopEntrySList UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx RtlCaptureStackBackTrace CreateTimerQueue CreateSemaphoreW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW SetLastError UnhandledExceptionFilter WriteConsoleW GetFileType GetStdHandle SetConsoleCtrlHandler GetCommandLineA AreFileApisANSI GetModuleHandleExW LoadLibraryExW ExitThread HeapReAlloc FileTimeToSystemTime SystemTimeToTzSpecificLocalTime IsProcessorFeaturePresent RtlUnwind GetStringTypeW EncodePointer GetSystemTimeAsFileTime GetFileAttributesExW CreateDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryW SetStdHandle WaitForMultipleObjectsEx GetModuleHandleW GetConsoleMode GetACP GetOEMCP GetTimeZoneInformation FindFirstFileExW FindNextFileW FlushFileBuffers GetVersionExW VirtualAlloc VirtualFree VirtualProtect SetProcessAffinityMask OutputDebugStringW GetThreadTimes FreeLibraryAndExitThread ReleaseSemaphore InitializeSListHead OpenProcess SetEnvironmentVariableA SetEndOfFile LocalFree lstrlenW lstrcmpA Process32NextW

user32

OffsetRect wsprintfA SetRect MessageBoxA EnumDisplaySettingsA CharNextA CharPrevA OpenClipboard CloseClipboard GetWindow GetWindowThreadProcessId GetTopWindow FindWindowExA EnumChildWindows SetClipboardData EmptyClipboard GetWindowLongA GetWindowTextW IsWindowVisible IsWindow EnumDisplayDevicesW SendMessageA GetAsyncKeyState CopyRect PostMessageA mouse_event GetClipboardData IsClipboardFormatAvailable SetCapture ReleaseCapture GetCursorPos ScreenToClient ShowWindow GetDC ReleaseDC MessageBoxW TranslateMessage DispatchMessageA PeekMessageA DefWindowProcA RegisterClassExA CreateWindowExA EndDialog GetSystemMetrics UpdateWindow ShowCursor FindWindowW LoadIconA GetClientRect LoadCursorFromFileA SetCursor UnregisterClassA GetMonitorInfoW MonitorFromWindow GetDesktopWindow

gdi32

RemoveFontResourceExA SelectObject GetTextExtentPoint32A DeleteObject CreateFontIndirectA GetStockObject BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCW DeleteDC AddFontResourceExA

advapi32

OpenTraceW EnableTrace ControlTraceW StartTraceW CheckTokenMembership RegQueryValueExA RegQueryInfoKeyA RegOpenKeyExA RegCloseKey ProcessTrace CloseTrace OpenThreadToken LookupPrivilegeValueA CloseEventLog GetNumberOfEventLogRecords OpenEventLogW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW FreeSid AllocateAndInitializeSid OpenProcessToken RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoInitializeEx CreateStreamOnHGlobal CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoFreeUnusedLibraries CoInitialize CoUninitialize

oleaut32

VariantInit VariantClear GetErrorInfo VariantChangeType SetErrorInfo SysAllocString CreateErrorInfo SysFreeString

freeimage

_FreeImage_GetBits@4 _FreeImage_Unload@4 _FreeImage_GetInfo@4 _FreeImage_ConvertTo16Bits565@4 _FreeImage_Load@12 _FreeImage_GetScanLine@8 _FreeImage_Save@16 _FreeImage_Allocate@24 _FreeImage_SaveJPEG@12

iphlpapi

GetAdaptersInfo

wintrust

WinVerifyTrust

psapi

GetModuleInformation GetMappedFileNameW GetProcessImageFileNameA GetModuleFileNameExA GetModuleFileNameExW EnumProcessModules

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash

tdh

TdhGetPropertySize TdhGetEventInformation TdhGetProperty

gdiplus

GdipAlloc GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders GdipSaveImageToStream

d3d11

D3D11CreateDevice

generic

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=225, version=20806,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=199, version=41118,

count=67, id=223, productName=VS2013 build 21005, version=21005,

count=149, id=225, productName=VS2013 build 21005, version=21005,

count=257, id=224, productName=VS2013 build 21005, version=21005,

count=132, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=2, id=25, version=9210,

count=1, id=11, version=8966,

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=423, id=1, productName=Unmarked objects,

count=2, id=28, version=9178,

count=690, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,