02102026_0605_01102026_Click here to view9.30.vhd.zip
- SHA256 568f800720af8fccb4ee608a8733d829071f10d0828c2951703e2b83a3bfde26
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Check.20260903065992.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
Check.20260903065992.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral3
Sample
libcef.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
libcef.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target 02102026_0605_01102026_Click here to view9.30.vhd.zip
- Size 2.1MB
- Sample261002-gtpbwatvbv
- SHA256 568f800720af8fccb4ee608a8733d829071f10d0828c2951703e2b83a3bfde26
- MD5 4d06038005d5b2a59371f8c39071e61e
- SHA1 db43792b732085ba14bc3497e0a3c75d28cd1b3e
- SHA512 5612d3bd8af39a9295f59fb371d57ac6d86ff7247e6d7fe15b0a16387850632862930aa58312fcb3d44c7dcb9e93fa56e578bb953d585bf8e27b68087fc39c43
- SSDEEP 49152:k8QXUAe1qKQ2wm+AoOOrdm4wSqM6Kc66ldqT/e30WgD:HZWK9R+AoVRm4wRZnQWgD
- TLSH T1B8A53328CB05066EEC6000F055FFB7BDE8ECB44ACBE5119488DBD271769A59AC67303E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack002/Check.20260903065992.exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/libcef.dll
File Explorer
-
02102026_0605_01102026_Click here to view9.30.vhd.zip.zip 2.1MB
-
Click here to view9.30.vhd.vhd 6.0MB
-
$RECYCLE.BIN/desktop.ini129B
-
Check.20260903065992.exe.exe 253KB
-
System Volume Information/WPSettings.dat12B
-
UA.png 3KB
-
libcef.dll.dll 4.8MB
Click here to view9.30.vhd
- SHA256 e588db07080129c53a1cc99b1158dc6c79790c33c72abca2d73be8bfe7a23188
- MD5 d9a00e3f038cfe1e55d29ef76560cf18
- SHA1 bbdf0186010ae8ac6d49dd5cf61941e92f2d8606
- SHA512 840a44b03e57327304960f1a43c015e67167ffa19f4ddd22ba7819a241f433dc8fa6e0ee452b29b90fece82bb68e5c52232b1b7d14814aca1d7f9665145c8954
- SSDEEP 98304:P8H6jOMnG+FXwdTFw0Vwt62ST23ZVUI4/i:UH6jOMnHFXwd5w9NSTKZVUq
- TLSH T1F7569F245602A3B9E4B54139224FF72669384C34C4EACB87E7D42F98653AFD2ED75332
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
$RECYCLE.BIN/desktop.ini
- SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
- MD5 a526b9e7c716b3489d8cc062fbce4005
- SHA1 2df502a944ff721241be20a9e449d2acd07e0312
- SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
- TLSH T169B09B0A41476664B05ED15DAC60E147117D547A4D14A2008EF0B345D1A33550778D69
- MD5 SHA1 SHA512 TLSH
Check.20260903065992.exe
- IMPHASH 3c1a1e46c213c13c9c3610f40a6f30b0
- SHA256 78fc25ed9a673f26eadf03dd5472dc112155138410cd5c81f8b89ccef5bf0736
- MD5 c663ac03855f3e7ff9fde06bd6e24aec
- SHA1 2375e27170527ab4af65919b51079d1953fa4ef4
- SHA512 59102fd9051694953b1935b353e8a5e15b578fe3196d8a30447c7eba1bdf312a2b3ae195d7a11c46ca70365e406a44d1b630bed7a4973a46a434cfef5351ea9f
- SSDEEP 6144:RPLlFC0kFH9n1C75Ej+3CoEeVXoNKz/56XYKJ:RPLldJz/QIKJ
- TLSH T180444B716E8944BEEA93E033CAFD3ABDB2689513573040C77668162C8D105E32F35A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Password
infected
Digest
42:79:aa:17:65:49:ab:61:a1:ba:6b:06:86:b8:a6:94:25:70:94:74
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Beijing Effective Biz Info Tech Co.\, Ltd.,O=Beijing Effective Biz Info Tech Co.\, Ltd.,ST=Beijing,C=CN
Chains
Oct 22, 2020
CN=Beijing Effective Biz Info Tech Co.\, Ltd.,O=Beijing Effective Biz Info Tech Co.\, Ltd.,ST=Beijing,C=CN
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Beijing Effective Biz Info Tech Co.\, Ltd.,O=Beijing Effective Biz Info Tech Co.\, Ltd.,ST=Beijing,C=CN
Serial Number
02:7c:4e:2a:97:a2:81:7b:a8:9d:5d:99:7a:2a:a0:db
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 16, 2020 - Oct 24, 2021
Minor OS version
1
Major OS version
5
Entry point
139393
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\sc\win-client\bin\Release\JGExternal.pdb
user32
MessageBoxA
MessageBoxW
libcef
cef_string_utf16_cmp
cef_string_utf16_clear
cef_string_utf8_to_utf16
cef_string_utf16_set
cef_v8context_get_current_context
cef_string_userfree_utf16_free
cef_process_message_create
cef_string_list_free
cef_string_list_alloc
cef_v8value_create_bool
cef_v8value_create_int
cef_v8value_create_string
cef_execute_process
cef_api_hash
cef_register_extension
cef_string_map_free
cef_string_map_alloc
cef_string_list_append
cef_string_map_append
cef_string_multimap_append
cef_string_list_value
cef_string_list_size
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_free
cef_string_multimap_alloc
cef_string_list_copy
kernel32
CloseHandle
GetProcAddress
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
SetLastError
DecodePointer
EncodePointer
HeapSetInformation
GetStartupInfoW
RaiseException
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapAlloc
IsProcessorFeaturePresent
Sleep
HeapSize
ExitProcess
FreeEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
WideCharToMultiByte
RtlUnwind
HeapReAlloc
InterlockedExchange
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetStdHandle
WriteConsoleW
CreateFileW
FlushFileBuffers
GetCommandLineW
GetProcessHeap
InitializeCriticalSection
GetEnvironmentStringsW
Name
.text
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=97, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=221, productName=VS2013 UPD5 build 40629, version=40629,
count=51, id=171, productName=VS2010 build 30319, version=30319,
count=116, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=230, id=1, productName=Unmarked objects,
count=14, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
System Volume Information/WPSettings.dat
- SHA256 15bac9596f0199fd767b39bb604470d067d3841fc76ba2a3a7551746e7c1bf1b
- MD5 74b8cbad40dfc15e7d41fb6bc2881872
- SHA1 8faf4535bfb7b8836f66e16db10ea94e25698e9c
- SHA512 aac416e562b1b31acfef53ec9d1a104ad0c2baa7068a2f7bf5dfd3cd622070f37e40451a9e7cf4104b53cb5130123f3d078391bf53b3d8b2ee02b51f3a48feb2
- MD5 SHA1 SHA512
UA
- SHA256 59e995a813c4031947a6c906b2a99f6d01bbcfd43ae179f539bc456c391b512b
- MD5 0ed7fc72691166ed9d92b016cc8d0788
- SHA1 85787e1aedffb14e9e7ac979f4126e0873537a66
- SHA512 6d7612313b1f22c8b284eba77ae93ba8b7be576a90d16f3ed40793d0fa2fe918d0d7a13c5f493860ebcca97ad6ad07e29ea3ebbc399c48cca1fba004a9d9eac5
- TLSH T12D613D1C74CCC4DBFCB9613617803120AC5F9DA748F41A53FE8824B4D1AE54656A9E35
- MD5 SHA1 SHA512 TLSH
Password
infected
libcef.dll
- IMPHASH 51990dbed1c9446c24d7b3baf6d49800
- SHA256 6742b56d76f3c1257a4965017b46decf29fb678284e0272805d95174e6f98401
- MD5 d466be462ce9fd8d24672b52dcd03cb1
- SHA1 e391585278c0ca85f6f068f641982765fb9d4da1
- SHA512 4ded92c089c6d8c53a041027f6672842fe8bafaf6853ae24b59f4bb1a2307476ba3cd15e071434f384140eb0c45affbdb5130092ac39e025b29887a84c8411fc
- SSDEEP 98304:W8H6jOMnG+FXwdTFw0Vwt62ST23ZVUI4/ih:zH6jOMnHFXwd5w9NSTKZVUqh
- TLSH T10E368E289602B3B9E4B54139224FF72669384834C4EACB47E7D41F98653AFD2ED75332
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
libcef.pdb
gdiplus
GdipBitmapGetPixel
GdipDisposeImage
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromFile
GdiplusShutdown
GdiplusStartup
kernel32
CreateProcessW
GetModuleFileNameW
VirtualAlloc
ntdll
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrLoadDll
LdrRegisterDllNotification
LdrUnloadDll
NtAlertThread
NtAlertThreadByThreadId
NtAllocateVirtualMemory
NtCancelIoFileEx
NtCancelSynchronousIoFile
NtClose
NtCreateFile
NtCreateNamedPipeFile
NtCreateSection
NtCreateThreadEx
NtDelayExecution
NtDeviceIoControlFile
NtFlushBuffersFile
NtFreeVirtualMemory
NtFsControlFile
NtLockFile
NtMapViewOfSection
NtOpenFile
NtOpenThread
NtQueryAttributesFile
NtQueryDirectoryFile
NtQueryInformationFile
NtQueryInformationProcess
NtQueryInformationThread
NtQueryObject
NtQuerySystemInformation
NtQueryVolumeInformationFile
NtReadFile
NtResumeThread
NtSetInformationFile
NtTerminateProcess
NtUnlockFile
NtUnmapViewOfSection
NtWaitForAlertByThreadId
NtWaitForSingleObject
NtWriteFile
RtlActivateActivationContextEx
RtlAllocateHeap
RtlEnterCriticalSection
RtlEqualUnicodeString
RtlExitUserProcess
RtlFreeHeap
RtlGetActiveActivationContext
RtlGetCurrentDirectory_U
RtlGetFullPathName_U
RtlGetSystemTimePrecise
RtlLeaveCriticalSection
RtlQueryPerformanceCounter
RtlQueryPerformanceFrequency
RtlReleaseActivationContext
RtlRemoveVectoredExceptionHandler
RtlReportSilentProcessExit
RtlSetCurrentDirectory_U
RtlUpcaseUnicodeChar
ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
CrashForException
DllMain@12
DllMainCRTStartup@12
DumpProcess
DumpProcessWithoutCrash
GetHandleVerifier
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
IsSandboxedProcess
SetCrashKeyValueImpl
TerminateProcessWithoutDump
__xl_a
__xl_z
_tls_end
_tls_index
_tls_start
_tls_used
cef_add_cross_origin_whitelist_entry
cef_add_web_plugin_directory
cef_add_web_plugin_path
cef_api_hash
cef_base64decode
cef_base64encode
cef_begin_tracing
cef_binary_value_create
cef_browser_host_create_browser
cef_browser_host_create_browser_sync
cef_clear_cross_origin_whitelist
cef_clear_scheme_handler_factories
cef_command_line_create
cef_command_line_get_global
cef_cookie_manager_create_manager
cef_cookie_manager_get_global_manager
cef_create_url
cef_currently_on
cef_dictionary_value_create
cef_do_message_loop_work
cef_drag_data_create
cef_enable_highdpi_support
cef_end_tracing
cef_execute_process
cef_force_web_plugin_shutdown
cef_format_url_for_security_display
cef_get_current_platform_thread_handle
cef_get_current_platform_thread_id
cef_get_extensions_for_mime_type
cef_get_geolocation
cef_get_mime_type
cef_get_min_log_level
cef_get_path
cef_get_vlog_level
cef_initialize
cef_is_web_plugin_unstable
cef_launch_process
cef_list_value_create
cef_log
cef_now_from_system_trace_time
cef_parse_csscolor
cef_parse_json
cef_parse_jsonand_return_error
cef_parse_url
cef_post_data_create
cef_post_data_element_create
cef_post_delayed_task
cef_post_task
cef_print_settings_create
cef_process_message_create
cef_quit_message_loop
cef_refresh_web_plugins
cef_register_extension
cef_register_scheme_handler_factory
cef_register_web_plugin_crash
cef_remove_cross_origin_whitelist_entry
cef_remove_web_plugin_path
cef_request_context_create_context
cef_request_context_get_global_context
cef_request_create
cef_resource_bundle_get_global
cef_response_create
cef_run_message_loop
cef_set_osmodal_loop
cef_shutdown
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_stream_reader_create_for_handler
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_string_ascii_to_utf16
cef_string_ascii_to_wide
cef_string_list_alloc
cef_string_list_append
cef_string_list_clear
cef_string_list_copy
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_clear
cef_string_map_find
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_clear
cef_string_multimap_enumerate
cef_string_multimap_find_count
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_alloc
cef_string_userfree_utf16_free
cef_string_userfree_utf8_alloc
cef_string_userfree_utf8_free
cef_string_userfree_wide_alloc
cef_string_userfree_wide_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf16_to_wide
cef_string_utf8_clear
cef_string_utf8_cmp
cef_string_utf8_set
cef_string_utf8_to_utf16
cef_string_utf8_to_wide
cef_string_wide_clear
cef_string_wide_cmp
cef_string_wide_set
cef_string_wide_to_utf16
cef_string_wide_to_utf8
cef_task_runner_get_for_current_thread
cef_task_runner_get_for_thread
cef_time_delta
cef_time_from_doublet
cef_time_from_timet
cef_time_now
cef_time_to_doublet
cef_time_to_timet
cef_trace_counter
cef_trace_counter_id
cef_trace_event_async_begin
cef_trace_event_async_end
cef_trace_event_async_step_into
cef_trace_event_async_step_past
cef_trace_event_begin
cef_trace_event_end
cef_trace_event_instant
cef_translator_test_create
cef_translator_test_object_child_child_create
cef_translator_test_object_child_create
cef_translator_test_object_create
cef_unregister_internal_web_plugin
cef_uridecode
cef_uriencode
cef_urlrequest_create
cef_v8context_get_current_context
cef_v8context_get_entered_context
cef_v8context_in_context
cef_v8stack_trace_get_current
cef_v8value_create_array
cef_v8value_create_bool
cef_v8value_create_date
cef_v8value_create_double
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_uint
cef_v8value_create_undefined
cef_value_create
cef_version_info
cef_visit_web_plugin_info
cef_write_json
cef_xml_reader_create
cef_zip_reader_create
create_context_shared
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
361KB
Virtual Size
360KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.buildid
Size
512B
Virtual Size
63B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
35KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ