02102026_0603_01102026_1.vhd.zip
- SHA256 708fe9eebd428e2d144b9121821a0a7b844394c79fc7430d19ba2ee87b3ff6e9
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Check.5242224048.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
Check.5242224048.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
300 seconds
Behavioral task
behavioral3
Sample
libcef.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
libcef.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target 02102026_0603_01102026_1.vhd.zip
- Size 2.6MB
- Sample261002-gr1bcstsgz
- SHA256 708fe9eebd428e2d144b9121821a0a7b844394c79fc7430d19ba2ee87b3ff6e9
- MD5 d591b43ca785005ff9d4e4ff85c0b772
- SHA1 7008161c50c755356a00a7ed1fdbc89f70beb110
- SHA512 a8e3ad8b285a7d08a97e7a2a1db0deb307f9508d703480ecf24951e0dc6b7bb9143bcf91898eefc4a4c993841f526eec825b09ec93c1e63b8a85e41bb2b071f7
- SSDEEP 49152:9aIfOGrsstpLxFAdVR/4bSsi2ggMf4JyEAtOpYKzAFAJyyPNSpy0AlugfgMpyZq:9tGa9AaW3dfoyrOpYKcM3NSk0AlugoXI
- TLSH T1C4C533AC4B90B252E27D64FB998D6209C7ACF111D21B0F931F461A6360B63DD72BC46B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack002/Check.5242224048.exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/libcef.dll
File Explorer
-
02102026_0603_01102026_1.vhd.zip.zip 2.6MB
-
1.vhd.vhd 10.0MB
-
11.png 3KB
-
Check.5242224048.exe.exe 253KB
-
System Volume Information/WPSettings.dat12B
-
libcef.dll.dll 6.1MB
1.vhd
- SHA256 1b223d05ad0da96c6801cb5b7f6982b9287ebeceb96db27d05c07747153aaf32
- MD5 09c4f3e779aba4ecf32f015c172de469
- SHA1 2debbec3f0b34798f11830e8ca446f40044df452
- SHA512 f474fd2e310d53a73cf8b7ab87c18d8a394c41f9960d0bcecc0c4267394ce8bffc451f4fa9eccc6a58cc8179531e046793caf6aa61b238a2c1e5f2ae4c44517d
- SSDEEP 196608:VwZAn2OhFXDW7+lKWrZZwrOcTE2uxUA6nj:5nVW7+lfZZWOcTYx
- TLSH T15AB67D12A6804059F6EB143E738EF21A6222DC78D0DAE9C7F7D63A259E753C911B1337
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
11
- SHA256 e62cdffba860532e486c3705ef7f479671f25c717b2c474480e0354a6f712515
- MD5 d9354285a9622f66d3c27e65cd07eb96
- SHA1 796ff153a2e3112e0c03ae85bbeb98f5bab97307
- SHA512 278eb19ede82a64434269caa2345f931bd73da6d21a72db12d5b7033dd8cd9aa71665d5875bf8ebb0a91e890b178648953ee7dc9f911cfa9171204d7fde74a8b
- TLSH T1A5616E202D8F5DC863564113B3FB1624EE80804C6A0770BF77A5E3720491D9BD8D89A7
- MD5 SHA1 SHA512 TLSH
Password
infected
Check.5242224048.exe
- IMPHASH 3c1a1e46c213c13c9c3610f40a6f30b0
- SHA256 78fc25ed9a673f26eadf03dd5472dc112155138410cd5c81f8b89ccef5bf0736
- MD5 c663ac03855f3e7ff9fde06bd6e24aec
- SHA1 2375e27170527ab4af65919b51079d1953fa4ef4
- SHA512 59102fd9051694953b1935b353e8a5e15b578fe3196d8a30447c7eba1bdf312a2b3ae195d7a11c46ca70365e406a44d1b630bed7a4973a46a434cfef5351ea9f
- SSDEEP 6144:RPLlFC0kFH9n1C75Ej+3CoEeVXoNKz/56XYKJ:RPLldJz/QIKJ
- TLSH T180444B716E8944BEEA93E033CAFD3ABDB2689513573040C77668162C8D105E32F35A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Password
infected
Digest
42:79:aa:17:65:49:ab:61:a1:ba:6b:06:86:b8:a6:94:25:70:94:74
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Beijing Effective Biz Info Tech Co.\, Ltd.,O=Beijing Effective Biz Info Tech Co.\, Ltd.,ST=Beijing,C=CN
Chains
Oct 22, 2020
CN=Beijing Effective Biz Info Tech Co.\, Ltd.,O=Beijing Effective Biz Info Tech Co.\, Ltd.,ST=Beijing,C=CN
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Beijing Effective Biz Info Tech Co.\, Ltd.,O=Beijing Effective Biz Info Tech Co.\, Ltd.,ST=Beijing,C=CN
Serial Number
02:7c:4e:2a:97:a2:81:7b:a8:9d:5d:99:7a:2a:a0:db
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 16, 2020 - Oct 24, 2021
Minor OS version
1
Major OS version
5
Entry point
139393
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\sc\win-client\bin\Release\JGExternal.pdb
user32
MessageBoxA
MessageBoxW
libcef
cef_string_utf16_cmp
cef_string_utf16_clear
cef_string_utf8_to_utf16
cef_string_utf16_set
cef_v8context_get_current_context
cef_string_userfree_utf16_free
cef_process_message_create
cef_string_list_free
cef_string_list_alloc
cef_v8value_create_bool
cef_v8value_create_int
cef_v8value_create_string
cef_execute_process
cef_api_hash
cef_register_extension
cef_string_map_free
cef_string_map_alloc
cef_string_list_append
cef_string_map_append
cef_string_multimap_append
cef_string_list_value
cef_string_list_size
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_free
cef_string_multimap_alloc
cef_string_list_copy
kernel32
CloseHandle
GetProcAddress
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
SetLastError
DecodePointer
EncodePointer
HeapSetInformation
GetStartupInfoW
RaiseException
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapAlloc
IsProcessorFeaturePresent
Sleep
HeapSize
ExitProcess
FreeEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
WideCharToMultiByte
RtlUnwind
HeapReAlloc
InterlockedExchange
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetStdHandle
WriteConsoleW
CreateFileW
FlushFileBuffers
GetCommandLineW
GetProcessHeap
InitializeCriticalSection
GetEnvironmentStringsW
Name
.text
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=97, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=221, productName=VS2013 UPD5 build 40629, version=40629,
count=51, id=171, productName=VS2010 build 30319, version=30319,
count=116, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=230, id=1, productName=Unmarked objects,
count=14, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
System Volume Information/WPSettings.dat
- SHA256 c1929235c62f8d88cdf4529890219a49427c88baa1757197539eba8aaa68f52f
- MD5 e8a8ec4042d9c763c8819c7225dbd985
- SHA1 4aad58139c81615d295a19fcc85c5c4953488180
- SHA512 d4238d9a44f1b30a72b0fd41f5c8e93e4938657ea21443615c3699997513ca6d394b5f52f325549cb3cdcacbd51754b28436449f39c08fdd359845671e8162a8
- MD5 SHA1 SHA512
libcef.dll
- IMPHASH 51990dbed1c9446c24d7b3baf6d49800
- SHA256 ad65a562fd29c2553f659c721d9ac3e3fd4f8a014eb37347e01952e1481f38fb
- MD5 cbf2e7f0ff27e9d892d8044cdcbef8dd
- SHA1 9591cfc8124c970b6a411f548bb0491fee53ba73
- SHA512 4d5c4fa0a31664ed589ccd8f04685790f6c6f61ed84403583e9cbe388f0e37d3f5e7ef1abba54df2322f0af9d00fae772a8a214078775a035f1b73733d6bf134
- SSDEEP 196608:AwZAn2OhFXilKWrZZwrOcTE2uxUA6njeW7X:+nYlfZZWOcTYxLW7X
- TLSH T1E4568D12A6814055FAEB143E338EF21A6262DC78D0EDE987F7D63A259E7538910F1337
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
demo.pdb
gdiplus
GdipBitmapGetPixel
GdipDisposeImage
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromFile
GdiplusShutdown
GdiplusStartup
kernel32
CreateProcessW
GetModuleFileNameW
VirtualAlloc
ntdll
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrLoadDll
LdrRegisterDllNotification
LdrUnloadDll
NtAlertThread
NtAlertThreadByThreadId
NtAllocateVirtualMemory
NtCancelIoFileEx
NtCancelSynchronousIoFile
NtClose
NtCreateFile
NtCreateNamedPipeFile
NtCreateSection
NtCreateThreadEx
NtDelayExecution
NtDeviceIoControlFile
NtFlushBuffersFile
NtFreeVirtualMemory
NtFsControlFile
NtLockFile
NtMapViewOfSection
NtOpenFile
NtOpenThread
NtQueryAttributesFile
NtQueryDirectoryFile
NtQueryInformationFile
NtQueryInformationProcess
NtQueryInformationThread
NtQueryObject
NtQuerySystemInformation
NtQueryVolumeInformationFile
NtReadFile
NtResumeThread
NtSetInformationFile
NtTerminateProcess
NtUnlockFile
NtUnmapViewOfSection
NtWaitForAlertByThreadId
NtWaitForSingleObject
NtWriteFile
RtlActivateActivationContextEx
RtlAllocateHeap
RtlEnterCriticalSection
RtlEqualUnicodeString
RtlExitUserProcess
RtlFreeHeap
RtlGetActiveActivationContext
RtlGetCurrentDirectory_U
RtlGetFullPathName_U
RtlGetSystemTimePrecise
RtlLeaveCriticalSection
RtlQueryPerformanceCounter
RtlQueryPerformanceFrequency
RtlReleaseActivationContext
RtlRemoveVectoredExceptionHandler
RtlReportSilentProcessExit
RtlSetCurrentDirectory_U
RtlUpcaseUnicodeChar
ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
CrashForException
DllMain@12
DllMainCRTStartup@12
DumpProcess
DumpProcessWithoutCrash
GetHandleVerifier
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
IsSandboxedProcess
SetCrashKeyValueImpl
TerminateProcessWithoutDump
__xl_a
__xl_z
_tls_end
_tls_index
_tls_start
_tls_used
cef_add_cross_origin_whitelist_entry
cef_add_web_plugin_directory
cef_add_web_plugin_path
cef_api_hash
cef_base64decode
cef_base64encode
cef_begin_tracing
cef_binary_value_create
cef_browser_host_create_browser
cef_browser_host_create_browser_sync
cef_clear_cross_origin_whitelist
cef_clear_scheme_handler_factories
cef_command_line_create
cef_command_line_get_global
cef_cookie_manager_create_manager
cef_cookie_manager_get_global_manager
cef_create_url
cef_currently_on
cef_dictionary_value_create
cef_do_message_loop_work
cef_drag_data_create
cef_enable_highdpi_support
cef_end_tracing
cef_execute_process
cef_force_web_plugin_shutdown
cef_format_url_for_security_display
cef_get_current_platform_thread_handle
cef_get_current_platform_thread_id
cef_get_extensions_for_mime_type
cef_get_geolocation
cef_get_mime_type
cef_get_min_log_level
cef_get_path
cef_get_vlog_level
cef_initialize
cef_is_web_plugin_unstable
cef_launch_process
cef_list_value_create
cef_log
cef_now_from_system_trace_time
cef_parse_csscolor
cef_parse_json
cef_parse_jsonand_return_error
cef_parse_url
cef_post_data_create
cef_post_data_element_create
cef_post_delayed_task
cef_post_task
cef_print_settings_create
cef_process_message_create
cef_quit_message_loop
cef_refresh_web_plugins
cef_register_extension
cef_register_scheme_handler_factory
cef_register_web_plugin_crash
cef_remove_cross_origin_whitelist_entry
cef_remove_web_plugin_path
cef_request_context_create_context
cef_request_context_get_global_context
cef_request_create
cef_resource_bundle_get_global
cef_response_create
cef_run_message_loop
cef_set_osmodal_loop
cef_shutdown
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_stream_reader_create_for_handler
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_string_ascii_to_utf16
cef_string_ascii_to_wide
cef_string_list_alloc
cef_string_list_append
cef_string_list_clear
cef_string_list_copy
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_clear
cef_string_map_find
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_clear
cef_string_multimap_enumerate
cef_string_multimap_find_count
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_alloc
cef_string_userfree_utf16_free
cef_string_userfree_utf8_alloc
cef_string_userfree_utf8_free
cef_string_userfree_wide_alloc
cef_string_userfree_wide_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf16_to_wide
cef_string_utf8_clear
cef_string_utf8_cmp
cef_string_utf8_set
cef_string_utf8_to_utf16
cef_string_utf8_to_wide
cef_string_wide_clear
cef_string_wide_cmp
cef_string_wide_set
cef_string_wide_to_utf16
cef_string_wide_to_utf8
cef_task_runner_get_for_current_thread
cef_task_runner_get_for_thread
cef_time_delta
cef_time_from_doublet
cef_time_from_timet
cef_time_now
cef_time_to_doublet
cef_time_to_timet
cef_trace_counter
cef_trace_counter_id
cef_trace_event_async_begin
cef_trace_event_async_end
cef_trace_event_async_step_into
cef_trace_event_async_step_past
cef_trace_event_begin
cef_trace_event_end
cef_trace_event_instant
cef_translator_test_create
cef_translator_test_object_child_child_create
cef_translator_test_object_child_create
cef_translator_test_object_create
cef_unregister_internal_web_plugin
cef_uridecode
cef_uriencode
cef_urlrequest_create
cef_v8context_get_current_context
cef_v8context_get_entered_context
cef_v8context_in_context
cef_v8stack_trace_get_current
cef_v8value_create_array
cef_v8value_create_bool
cef_v8value_create_date
cef_v8value_create_double
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_uint
cef_v8value_create_undefined
cef_value_create
cef_version_info
cef_visit_web_plugin_info
cef_write_json
cef_xml_reader_create
cef_zip_reader_create
create_conrgaf
create_context_shared
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
361KB
Virtual Size
360KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.buildid
Size
512B
Virtual Size
61B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
35KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
473KB
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ