Install Resolve 21[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Install Resolve 21.1.exe
Size 3.9MB
Sample260929-pghmkaha45
SHA256 7fecca0cbbf750e77676335a9c4352763a2cb679d2805ae16ff442c692a77ff3
MD5 00e1a529db75504020ac1c4c142be1fb
SHA1 737f1543f75f6024295a3541230585df573220bc
SHA512 4ddeb932ac9089d22eb6d391326c201c56c990f23f10b678d1adbd7113243b2f298038b902ce5ddc2fb278d4301cbc1fc95f4a11a0c79dd2eef8a40c61aa82d2
SSDEEP 49152:VGtlq/aVwASOLsIU6icloNfYHnLirECDK/NLLOU63UpOOq4o44z8hoNpbCqC37uF:uD+c8fYHnmw8C6WhcIqbFowTpD64
TLSH
T19A16AEB9B57C00E5E86A41BAC2866337D731B91503F057CB6A649AFA0F63AD01F7B740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

File Explorer

Install Resolve 21.1.exe

.exe 3.9MB

Install Resolve 21.1.exe

IMPHASH 1eb32d626ff70c5bd6fa07258626547b
SHA256 7fecca0cbbf750e77676335a9c4352763a2cb679d2805ae16ff442c692a77ff3
MD5 00e1a529db75504020ac1c4c142be1fb
SHA1 737f1543f75f6024295a3541230585df573220bc
SHA512 4ddeb932ac9089d22eb6d391326c201c56c990f23f10b678d1adbd7113243b2f298038b902ce5ddc2fb278d4301cbc1fc95f4a11a0c79dd2eef8a40c61aa82d2
SSDEEP 49152:VGtlq/aVwASOLsIU6icloNfYHnLirECDK/NLLOU63UpOOq4o44z8hoNpbCqC37uF:uD+c8fYHnmw8C6WhcIqbFowTpD64
TLSH
T19A16AEB9B57C00E5E86A41BAC2866337D731B91503F057CB6A649AFA0F63AD01F7B740
MD5 SHA1 SHA512 SSDEEP TLSH

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.

Digest

2c:cd:26:3a:bc:c2:c6:26:d6:a6:66:46:9e:a0:09:89:b9:71:55:03:85:16:fb:cd:a0:a9:c6:0a:c9:cb:3a:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Blackmagic Design Pty Ltd,O=Blackmagic Design Pty Ltd,L=South Melbourne,ST=Victoria,C=AU

Chains

Sep 7, 2026

CN=Blackmagic Design Pty Ltd,O=Blackmagic Design Pty Ltd,L=South Melbourne,ST=Victoria,C=AU

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Blackmagic Design Pty Ltd,O=Blackmagic Design Pty Ltd,L=South Melbourne,ST=Victoria,C=AU

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Blackmagic Design Pty Ltd,O=Blackmagic Design Pty Ltd,L=South Melbourne,ST=Victoria,C=AU

Serial Number

06:47:ed:f8:cc:94:b8:29:c0:6c:c6:bb:68:d4:90:27

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 30, 2025 - Nov 1, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2866540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oleaut32

SysAllocStringLen VariantClear SysStringLen

user32

SetForegroundWindow AllowSetForegroundWindow MessageBoxW EnumWindows GetWindowThreadProcessId PostMessageW DestroyWindow ShowWindow EndDialog GetProcessWindowStation CharUpperW LoadStringW DialogBoxParamW GetDlgItem GetWindowLongPtrW SetWindowLongPtrW SetActiveWindow SetWindowTextW LoadIconW KillTimer SetTimer SendMessageW GetUserObjectInformationW

shell32

ShellExecuteExW

crypt32

CertOpenSystemStoreW CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

ws2_32

getsockname getsockopt ntohs select gethostbyname WSAStartup WSACleanup WSAGetLastError htonl htons inet_addr inet_ntoa gethostbyaddr getservbyport ioctlsocket WSASetLastError recv send closesocket connect setsockopt socket shutdown getpeername recvfrom sendto getservbyname

kernel32

CompareStringW InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapReAlloc HeapFree FileTimeToSystemTime GetConsoleOutputCP GetFileSizeEx SetFilePointerEx FlushFileBuffers LCMapStringW SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW SetConsoleCtrlHandler ExitProcess FreeLibraryAndExitThread ExitThread CreateThread InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx SetStdHandle GetTimeZoneInformation GetFullPathNameW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetProcessHeap HeapSize GetCommandLineW CloseHandle GetLastError WaitForSingleObject CreateProcessW GetProcessId EnterCriticalSection LeaveCriticalSection DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte FreeLibrary GetModuleFileNameW LoadLibraryExW LoadLibraryW LocalFree WriteConsoleW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW RemoveDirectoryW SetFileAttributesW SetFileTime GetTempPathW SetLastError GetCurrentProcessId GetCurrentThreadId GetTickCount GetSystemDirectoryW GetModuleHandleW GetProcAddress FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetModuleHandleA GetFileSize ReadFile SetEndOfFile SetFilePointer WriteFile GetCurrentProcess GlobalMemoryStatusEx GetSystemInfo GetProcessAffinityMask GetStdHandle WaitForMultipleObjects Sleep VirtualAlloc VirtualFree GetVersionExW lstrcatW lstrlenW InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore CreateEventW GetFileType GetEnvironmentVariableW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW VirtualProtect GetACP RtlVirtualUnwind GetExitCodeThread CreateSemaphoreA GetSystemDirectoryA LoadLibraryA FormatMessageA GetSystemTimeAsFileTime GetSystemTime SystemTimeToFileTime GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW FormatMessageW GetFileInformationByHandle

advapi32

DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW CryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

Install Resolve 21.1.exe

oleaut32

user32

shell32

crypt32

ws2_32

kernel32

advapi32

generic