20260930.iso
- SHA256 8a81f723625b02d2710ee049ac828293bb17667d40ca04611632d0ff95236d6b
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
202609PDF.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
202609PDF.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
Behavioral task
behavioral3
Sample
g2m.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
g2m.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 20260930.iso
- Size 1.2MB
- Sample260930-pjy3bsfa69
- SHA256 8a81f723625b02d2710ee049ac828293bb17667d40ca04611632d0ff95236d6b
- MD5 e0729c8a430101cb4cc5f08dc8ce0df4
- SHA1 73ff6f752e05303bcfce7d1bedd5ab27481fdd8c
- SHA512 b587c1e325fd7b92f21cd272b481d0936b3a47cdbd26da4953e81fb73654b5b11ce455b27a49c858c06df2c3b7b8ec7a715dcc695efeec94382ad39062fccfc1
- SSDEEP 12288:pPBBRJQKjJONrs2iW/bWgK69NucRkfwq4Ni:pJlQIWTK69SwJg
- TLSH T1CF454960E4B080FEF57E2D3C4534D5634BAEBB6109E4C68FA7D834798F212D295216EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/g2m.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/g2m.dll
File Explorer
-
20260930.iso.iso 1.2MB
-
out.iso.iso 1.2MB
-
202609PDF.exe.exe 31KB
-
g2m.dll.dll 1.1MB
out.iso
- SHA256 8a81f723625b02d2710ee049ac828293bb17667d40ca04611632d0ff95236d6b
- MD5 e0729c8a430101cb4cc5f08dc8ce0df4
- SHA1 73ff6f752e05303bcfce7d1bedd5ab27481fdd8c
- SHA512 b587c1e325fd7b92f21cd272b481d0936b3a47cdbd26da4953e81fb73654b5b11ce455b27a49c858c06df2c3b7b8ec7a715dcc695efeec94382ad39062fccfc1
- SSDEEP 12288:pPBBRJQKjJONrs2iW/bWgK69NucRkfwq4Ni:pJlQIWTK69SwJg
- TLSH T1CF454960E4B080FEF57E2D3C4534D5634BAEBB6109E4C68FA7D834798F212D295216EB
- MD5 SHA1 SHA512 SSDEEP TLSH
202609PDF.exe
- IMPHASH 5419c6d0b7a37c6f48c0d961a0d909db
- SHA256 4dc4c0bdce7d711bd4160beebbfe67d64a65a5c083429cb222926d7bd095b353
- MD5 aa6abf41a80d736c27c168e834baf3c7
- SHA1 67a0d3fd95af5ad86d978054008c9f3c9e65c335
- SHA512 9e223027f21df20bbc2b4a5953beaf4059946e288579ea55280f4d0b69282eb9179864c7a5c696d759f06d5cf1ce5c59707a459a3542ca2afb4f3345ad2abd37
- SSDEEP 384:o8Kk/M8uEryzqEt7a9Oey+IFdP64VYaEwDtiBgxoxlnLr2Sf1R+CxXBhgBx4eMDP:oD4Jr+VWOV+csoHViBBnXRbIqeMDGe
- TLSH T1ECE24A97EFC86852D07646397966EAB20B37FF67260C0567B49D6202AF71383243351F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7c:96:60:84:77:ee:a2:55:a6:d8:b3:70:3b:0c:89:d6:2b:8e:d5:c9:34:a4:bc:23:5a:1c:4f:a2:d8:0e:a1:5c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US
Chains
Feb 27, 2020
CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 27, 2011 - May 30, 2020
Subject
CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Issuer
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - May 30, 2020
Subject
CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US
Serial Number
07:77:dd:21:cf:5d:c9:dc:78:5a:cb:ae:2a:02:bb:26
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 26, 2018 - Nov 3, 2021
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Minor OS version
0
Major OS version
6
Entry point
4111
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\jenkins\workspace\Communication_Cloud\G2MWTEndpoint\Production\build-g2mwt-endpoint\output\G2M_Exe.pdb
kernel32
GetStartupInfoW
GetModuleFileNameA
GetCommandLineW
GetModuleHandleA
GetProcAddress
ExitProcess
GetModuleHandleW
user32
MessageBoxA
g2m
g2mcomm_winmain
Name
.text
Size
1024B
Virtual Size
973B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=257, productName=VS2017 v15.9.7 build 27027, version=27027,
count=5, id=257, version=25711,
count=9, id=1, productName=Unmarked objects,
count=1, id=265, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
g2m.dll
- IMPHASH f6f43f2cf051778e8538f48788209b2b
- SHA256 e10998437dc03dbddfd9a4b4ea132ffee57eecc1e509f3a520e0cf6153605df7
- MD5 e16831c26a9c1e39fff53ad35aaf4677
- SHA1 a36c25d5134b57890d9c0eb3ded7dc8d793f0447
- SHA512 16d1e269f87c824f1b7749dbcd641b7f6959e6df6f6fa1ccb4cbf8b4211d9b76e160764b2b426078b921dbaf679c6857a9c66bc908199f71e19916d3ccd0dd4f
- SSDEEP 12288:5RJQKjJONrs2iW/bWgK69NucRkfwq4Ni:dQIWTK69SwJg
- TLSH T100456960E4B080FEF57E2D3C4534D5638BAD7B7009E0DA8F97D438798E206D19625AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Cyberdyne\Desktop\Sideloading source\_DLL\Release\g2m.pdb
kernel32
lstrlenA
Sleep
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetCurrentThread
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
GetStdHandle
GetFileType
SetConsoleCtrlHandler
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadFile
ReadConsoleW
OutputDebugStringW
CreateFileW
CloseHandle
DecodePointer
g2mcomm_winmain
Name
.text
Size
209KB
Virtual Size
209KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
896KB
Virtual Size
900KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=29, id=261, version=30034,
count=15, id=260, version=30034,
count=18, id=259, version=30034,
count=3, id=257, version=27412,
count=82, id=1, productName=Unmarked objects,
count=1, id=265, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,