Audit_Report_FY2026-27.zip
- SHA256 5b4ce53126efb3f63c3463df55665558fcb8b6a4de573fe451828c2604fe74ec
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Audit_Report_FY2026-27.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
tedutil.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
tedutil.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target Audit_Report_FY2026-27.zip
- Size 119KB
- Sample261001-pm2ydsxtf1
- SHA256 5b4ce53126efb3f63c3463df55665558fcb8b6a4de573fe451828c2604fe74ec
- MD5 7c79d34e26e01a6e9c8f6033d431af9e
- SHA1 fece1dd173cb492241637fce08585df581dff6bd
- SHA512 33e297b9ddc61ffca2bb3d98e793aca653b03d533c36af199461c7fa8462689efde229e252e8fc0de63557ed6e426831789088a0db6e5e2afe54213de016c410
- SSDEEP 3072:SaZEpWASft5BwcnDqKc9G8zbXiewdZ/hzMQglUR4:r0WASBDqdLzbkdNhP4
- TLSH T17AC312785C9A4379A9D11EA320E57CF32B26269D4D7B6A86EBFCC4E8520427CC31477C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/tedutil.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/tedutil.dll
File Explorer
-
Audit_Report_FY2026-27.zip.zip 119KB
-
Audit_Report_FY2026-27.exe.exe 222KB
-
tedutil.dll.dll 104KB
Audit_Report_FY2026-27.exe
- IMPHASH fcd89eebe7a883ae62c53452b4abddf8
- SHA256 1688fe4698c45680851f5d90aff71fffdccb19c1b283a8c10cbc729c8efca7d8
- MD5 0b631263c1d1584a0e8fc21bf3ee3093
- SHA1 2ca980a55e99bcae8927e65a13b22e927b9f8620
- SHA512 4059af60b446ff26ca1b7a70ce0a0567a323d3c037faf9d0f849bb1dcf30dea95813abc46435e0308f6c0cbe5098c1f82d87f114217eb6cdd33d17b14fdf98f9
- SSDEEP 3072:5jZ8yFFYIzNBapJw/pV2JdqLVZjHAhQ+IgNo36J3BJicSyt:bEESJdqJZjHCO36ZRt
- TLSH T14A24F95272E440D0E3A963398522DA99EAB17C26976193CF8350767A1F33BD39C3B31D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
11:4f:b5:d4:7a:3f:27:88:10:da:86:17:aa:78:3e:77:b5:91:bf:5e:96:15:26:d0:e2:bf:dc:ed:f3:dd:31:f4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:86:e7:71:94:b9:4d:ff:09:fb:00:00:00:00:00:86
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0f:57:9a:47:14:40:e6:46:e6:00:01:00:00:02:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
104000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
TopoEdit.pdb
kernel32
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
CreateThread
GetCurrentThreadId
FindResourceExW
FreeLibrary
LeaveCriticalSection
LoadLibraryExW
LoadResource
LockResource
SizeofResource
LocalFree
FormatMessageW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
DelayLoadFailureHook
EnterCriticalSection
HeapSetInformation
SetLastError
GetLastError
RaiseException
CloseHandle
GetFileTime
GetModuleFileNameW
CreateFileW
ResolveDelayLoadedAPI
gdi32
MoveToEx
SelectObject
LineTo
CreateSolidBrush
CreatePen
DeleteObject
CreateFontIndirectW
Rectangle
user32
UpdateWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
GetWindowRect
MessageBoxW
GetWindowLongPtrW
SetWindowLongPtrW
LoadCursorW
DestroyAcceleratorTable
GetParent
GetFocus
SetCapture
EnableMenuItem
BeginPaint
EndPaint
GetSysColor
FillRect
SetClassLongPtrW
LockWindowUpdate
LoadAcceleratorsW
KillTimer
LoadStringW
SetTimer
GetActiveWindow
LoadMenuW
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItem
EndDialog
ReleaseCapture
TranslateAcceleratorW
DialogBoxParamW
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
PostMessageW
SendMessageW
DispatchMessageW
LoadIconW
TranslateMessage
GetMessageW
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-private-l1-1-0
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_new_mode
_o__wcsicmp
_o__wtoi
_o__wtol
_o_calloc
_o_exit
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstoul
_o_wmemcpy_s
__C_specific_handler
__current_exception
__current_exception_context
memmove
memcpy
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___p__commode
_o___stdio_common_vswprintf
wcschr
_o__set_fmode
tedutil
TEDGetAttributeType
TEDCreateMediaTypeViewer
TEDCreateDataLoader
TEDCreateTopoViewer
TEDMTStringFromGUID
TEDGetAttributeTypeFromGUID
TEDGetMTKnownAttributes
TEDGetMTKnownGUIDStrings
TEDGetAttributeListLength
TEDGetAttributeName
TEDGetAttributeCategory
api-ms-win-core-com-l1-1-0
PropVariantClear
CoInitializeEx
CoCreateInstance
IIDFromString
StringFromGUID2
CoTaskMemFree
CoUninitialize
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapSize
HeapDestroy
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetStartupInfoW
TerminateProcess
GetCurrentProcessId
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExA
GetModuleHandleW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
FlushInstructionCache
api-ms-win-core-interlocked-l1-1-0
InterlockedPopEntrySList
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
mf
MFCreateTopology
MFCreateMediaSession
MFEnumDeviceSources
MFTranscodeGetAudioOutputAvailableTypes
MFCreateTranscodeTopology
MFCreateTranscodeProfile
MFCreateTopoLoader
MFCreateVideoRendererActivate
MFCreateAudioRendererActivate
MFRequireProtectedEnvironment
MFGetService
MFCreateTopologyNode
MFCreatePMPMediaSession
mfplat
MFCreateSourceResolver
MFTEnumEx
MFCreateMediaType
MFCreateAttributes
MFStartup
MFShutdown
MFInvokeCallback
MFCreateAsyncResult
wmvcore
WMCreateReader
Name
.text
Size
104KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
664B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=15, id=257, version=33145,
count=1253, id=1, productName=Unmarked objects,
count=5, id=265, version=33145,
count=39, id=261, version=33145,
count=1, id=253, version=33145,
count=15, id=260, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
tedutil.dll
- IMPHASH 5a69511242a262e608f3ccc1b35757bf
- SHA256 e2ab6240861ea9e1f148bb8a38eea4a5f17f4a9271ca67f272bae16859457f1d
- MD5 46f3499302ddf5ac322954f32ac256c2
- SHA1 79902bce03bd8cc029d2d78c4921a90537c01193
- SHA512 bfcd477370f412e89668a6be1747c1d6c4a7169d635eafa9393a2033373811ab5447219b58ea1a055495688207ef6fbf2de5e1033631d2702f3d869e69f5508a
- SSDEEP 3072:GZAJH296DzRUQo+plGF9fEF0xf7CR4XO81i74x+4bSds/H4Byb8FW8TK5zzh9HIm:GKod8F017CR4XO81i74x+4bSds/H4Byt
- TLSH T111A3544565B4BCB8C526803D9213632293B23C4DC3326667BAE9DD643F97F606B1E7E0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateThread
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetFileAttributesA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
MultiByteToWideChar
RemoveVectoredExceptionHandler
SetThreadPriority
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
lstrcatA
lstrcpyA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
api-ms-win-crt-private-l1-1-0
__intrinsic_setjmpex
longjmp
memcpy
strrchr
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_exit
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
abort
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
calloc
free
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TEDCreateDataLoader
TEDCreateDataSaver
TEDCreateMediaTypeViewer
TEDCreateTopoViewer
TEDCreateTopoViewerWindow
TEDGetAttributeCategory
TEDGetAttributeGUID
TEDGetAttributeListLength
TEDGetAttributeName
TEDGetAttributeType
TEDGetAttributeTypeFromGUID
TEDGetMTKnownAttributes
TEDGetMTKnownGUIDStrings
TEDMTStringFromGUID
Name
.text
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=262, version=33952,
count=3, id=271, version=33952,
count=10, id=270, version=33952,
count=1, id=259, version=33952,
count=1, id=257, version=33952,
count=2, id=260, version=33952,
count=14, id=1, productName=Unmarked objects,