msu2.7z
- SHA256 9c971a22eb2e92b75909fdc90e6d1c5e1872863a75712dcd65419df392013f63
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
msu2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
msu2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target msu2.7z
- Size 2.8MB
- Sample261001-ptefnstgrf
- SHA256 9c971a22eb2e92b75909fdc90e6d1c5e1872863a75712dcd65419df392013f63
- MD5 2b24eb8924807d61c1055f89718734d2
- SHA1 34e31bd5139e3e43e79ec38d43d1f1958a24b59f
- SHA512 0b1488f57dd6312dc07da9da44c4f3ba24a3a4436f57a7c25a3c7d36c2d344e0d6dc5225170ca0e1d90b515bd14dd0d21976c283aeb1dd27ada24dfeb8b866e7
- SSDEEP 49152:UeZ6co+QdHuTDfp4vjHmMEHjzK2puumTSV2FDY7pI/itmoMrBzmHofOAOtyrTk5O:Uefo+QtU6m627yueKtmoM8+rdT/
- TLSH T1E1D5334B39C87BC8FBE32E115B57DCAAD4A14DAE0E1E8EDC8A400DF927866851DD47D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/msu2.exe
File Explorer
-
msu2.7z.7z 2.8MB
-
msu2.exe.exe 11.4MB
msu2.exe
- IMPHASH c2d457ad8ac36fc9f18d45bffcd450c2
- SHA256 802edbc9eb8c599aee6ca87d3367a82da5405dd6ac099b81f96cb7ccd99a4857
- MD5 9915db48b70793148aa20bde4da7a66f
- SHA1 0408f94ac23c7f75ae24d7eef0c4f99cfb61ebe4
- SHA512 680452b1fa0b57e90e0a57ab23405bc8693f4fd24d698ce45d407eedc912074046db20e291d0b3858708151311e5f03229f62dcfb21e230b6da9b3b21f04ecf3
- SSDEEP 49152:Pyc2PD9g62V1Hw4d8JkKk+CUa5Gckt5vo/XIAnlFCv69cfSFrUyNzdY1j5QfYx:AhRHnQy
- TLSH T19DC6C607734810DCC94BDA7144B0597A22B13DEE2432BB5E4EE9BF942F167996FACB04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
8e:96:d5:7c:0d:1b:0b:da:70:84:5a:b1:29:93:23:c9:16:84:cf:73:e7:12:18:a1:ce:cd:ad:a8:20:7a:76:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Crimson Dynamics Industries,O=Crimson Dynamics Industries,C=US
Chains
Sep 29, 2026
CN=Crimson Dynamics Industries,O=Crimson Dynamics Industries,C=US
Subject
CN=Crimson Dynamics Industries,O=Crimson Dynamics Industries,C=US
Serial Number
d1:4f:2e:41:17:01:00:23:90:a8:71:5f:f7:f3:69:b3
Issuer
CN=Crimson Dynamics Industries,O=Crimson Dynamics Industries,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 22, 2026 - Sep 29, 2027
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Minor OS version
1
Major OS version
6
Entry point
416160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
5.1MB
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6.1MB
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
64KB
Virtual Size
619KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ