asd.rar
- SHA256 9a48515e1007ad59b72c4207094d8e56745c4d9ce4952724d6b60d538aef2b9d
Behavioral task
behavioral1
Sample
asd.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
asd.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target asd.rar
- Size 7.9MB
- Sample261002-x6w59axepe
- SHA256 9a48515e1007ad59b72c4207094d8e56745c4d9ce4952724d6b60d538aef2b9d
- MD5 94f00ac5840c15c0e1269b98c7d4deea
- SHA1 32747f9de13d6b3f77fc7f9f3b75cabe7c1de225
- SHA512 54c60b9b8dfe7a85c9ebfccc9a633591b9173d9a4195e50b0d9e68c7601aeb047b1af7d4180dd8c1b65b160b4a017a821454370237ae5d8abb548aa3b5f877d8
- SSDEEP 196608:PeldwSB+Jh/8lGoflU/Az2cNQU6/BHokAPQTJnm:PecSB+J9OlUEKdtm
- TLSH T11886334B7993519FB8664DCD28AF7D0693EE4FE65C3C0EB31474006F5308A98293A79E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/asd/CheatEngine77.exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/asd/ClaudeCode.dll - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/asd/CheatEngine77.exe innosetup
File Explorer
-
asd.rar.rar 7.9MB
-
asd/CheatEngine77.exe.exe 6.6MB
-
asd/ClaudeCode.dll.dll 4.5MB
asd/CheatEngine77.exe
- IMPHASH 88016fcdef7f227c62171d0afad9aae4
- SHA256 f77700d8e3fc4bc420cfd4c90dcf5b9b0228755ebceb28799ddb14af340db417
- MD5 3f9d72b52c9efb8949c97d5bb453673e
- SHA1 a29c5978bc52d7c72466f099996fb842bfcf304d
- SHA512 20caec2a01a2d40dfb8513ccbe62fec92ec9f154dad710e22450a85555fc9e9de1ff0cd93fea83c5a7537c53060b5fc1b6ff3cbf15750331f990443c68a21224
- SSDEEP 196608:YY92TlYbckURXNYKzogqQtAwKLD2ZyxaQF1uujtx:YtTKckqYKMghyLqZEBFUuj
- TLSH T1DC66123FF28B613EE46A1A353972A210593B7A6165178C4296FCF48CCF691B01D3E787
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Digest
17:e3:bd:3f:23:41:0f:99:78:aa:68:aa:ba:eb:97:da:25:ac:8a:1c:19:9c:c2:f6:64:4a:11:14:2a:96:b1:ff:da:30:93:43:a1:2b:81:08:27:b6:2b:c9:e7:4f:ab:c2
Digest Algorithm
sha384
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=5738119,CN=Plooto Inc,O=Plooto Inc,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 30, 2026
SERIALNUMBER=5738119,CN=Plooto Inc,O=Plooto Inc,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
SERIALNUMBER=5738119,CN=Plooto Inc,O=Plooto Inc,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
SERIALNUMBER=5738119,CN=Plooto Inc,O=Plooto Inc,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
e3:95:aa:29:1d:e6:a8:ab:1f:c1:65:41:07:38:38:a0
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 14, 2026 - Jan 14, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Minor OS version
1
Major OS version
6
Entry point
728672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetACP
GetExitCodeProcess
CloseHandle
LocalFree
SizeofResource
VirtualProtect
QueryPerformanceFrequency
VirtualFree
GetFullPathNameW
GetProcessHeap
ExitProcess
HeapAlloc
GetCPInfoExW
CompareStringOrdinal
RtlUnwind
SetFilePointerEx
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
GetFileSizeEx
LoadLibraryA
ResetEvent
GetVolumeInformationW
GetVersion
GetDriveTypeW
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
LoadResource
SuspendThread
GetTickCount
GetStartupInfoW
GetFileAttributesW
GetCurrentDirectoryW
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetCommandLineW
GetSystemInfo
GetTempPathW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
LCMapStringW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
SetEndOfFile
QueryPerformanceCounter
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale
comctl32
InitCommonControls
user32
CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW
oleaut32
SafeArrayPutElement
VariantInit
VariantClear
SysFreeString
SafeArrayAccessData
SysReAllocStringLen
SafeArrayCreate
SafeArrayGetElement
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetUBound
SafeArrayGetLBound
VariantChangeType
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyExW
OpenProcessToken
FreeSid
AllocateAndInitializeSid
EqualSid
RegQueryValueExW
GetTokenInformation
ConvertSidToStringSidW
RegCloseKey
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
702KB
Virtual Size
702KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
113B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
asd/ClaudeCode.dll
- IMPHASH 9800b16f15cdbabf5aa7044e3b9fe20b
- SHA256 c9947fcd84b2efa0acd71819e359898bbc906169c3e63182c1b3af70986539b1
- MD5 b70ff5bfc12ecc0371053349dc347e55
- SHA1 2d0f87be0ae36be809c02c495b2fd07e90e8fcf4
- SHA512 ea82d716fe5f44c1627802f4baf983164f3edbb2a51b899b7d7668ba2ba238e5d85115b5fbe72ec772d5d635e6cbff6077d87edc06bb383367abe4786f5e554f
- SSDEEP 98304:Bf4yLFx7jIxb6sRYH8FxhkWP1/Ww5rXNuuJTZZ2fAa:Bf4yLFx7jIxb6sRYH8Fxh9lW+NBTafA
- TLSH T12726C032F798244AD026E134CE97DE16F236B05547209B9B3B480D6A4FA7B605F2FBD1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1248340
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-synch-l1-2-0
WaitOnAddress
kernel32
GetTickCount64
GetCurrentThread
GetModuleHandleW
CreateDirectoryW
LoadLibraryW
GetProcAddress
WideCharToMultiByte
ReadFile
WriteFile
PeekNamedPipe
CreateFileW
GetModuleHandleA
CloseHandle
GetCurrentProcessId
Sleep
GetCurrentThreadId
QueryPerformanceFrequency
GetModuleFileNameW
QueryPerformanceCounter
FlushFileBuffers
GetEnvironmentVariableW
GetWindowsDirectoryW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
VirtualQuery
GetModuleFileNameA
GetModuleHandleExA
GetLastError
DisableThreadLibraryCalls
CreateThread
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
GetCurrentProcess
WaitForSingleObject
SetThreadPriority
GetLocalTime
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
GetTimeZoneInformation
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
CreateEventW
SetEvent
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
GetSystemTimePreciseAsFileTime
WakeConditionVariable
WakeAllConditionVariable
LocalFree
FormatMessageA
GetLocaleInfoEx
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
CreateFile2
AreFileApisANSI
GetDateFormatW
GetFileInformationByHandleEx
GetLogicalProcessorInformationEx
InitOnceComplete
InitOnceBeginInitialize
SetLastError
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
ExitThread
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
ExitProcess
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
GetConsoleOutputCP
GetConsoleMode
HeapFree
HeapAlloc
VirtualProtect
RtlUnwind
user32
CreateWindowExA
UnregisterClassA
RegisterClassExA
DefWindowProcA
DestroyWindow
MessageBoxA
GetSystemMetrics
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetWindowLongPtrW
LoadCursorW
SetCursor
GetAsyncKeyState
MapVirtualKeyW
shell32
SHGetFolderPathW
ShellExecuteW
ole32
CoCreateInstance
CoUninitialize
CoCreateFreeThreadedMarshaler
CoInitializeEx
d3d11
D3D11CreateDeviceAndSwapChain
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
oleaut32
GetErrorInfo
SysStringLen
SysFreeString
SetErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
474KB
Virtual Size
640KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=27, id=259, version=33145,
count=15, id=260, version=35721,
count=12, id=259, version=35721,
count=91, id=261, version=35721,
count=57, id=260, version=33145,
count=14, id=257, version=33145,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=197, id=1, productName=Unmarked objects,
count=95, id=265, version=36257,
count=1, id=255, version=36257,
count=1, id=258, version=36257,