dae56eed89e6af9c4e18ed8ccdce08256646bffa58989ef1def040d10c9ffff4.bin
- SHA256 dae56eed89e6af9c4e18ed8ccdce08256646bffa58989ef1def040d10c9ffff4
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
618e2488d0f7b7c25544adb1ae491348080357bb2017124fd4c21a2c79441f38.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
618e2488d0f7b7c25544adb1ae491348080357bb2017124fd4c21a2c79441f38.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target dae56eed89e6af9c4e18ed8ccdce08256646bffa58989ef1def040d10c9ffff4.bin
- Size 3.1MB
- Sample261003-2pt2sazs2k
- SHA256 dae56eed89e6af9c4e18ed8ccdce08256646bffa58989ef1def040d10c9ffff4
- MD5 cab6c307d1cecd475e6be106b007b941
- SHA1 35511e6cc1533ea72b0d5cc5402e12adfb56e874
- SHA512 0dc6f54d0521f2315fe735a8bccceb14a28e599fb94d2a4fca7de472e47e2968d731172e6e930b7a27b3e818bca6579e1f65581a74ba2854039111ff4df7b823
- SSDEEP 49152:fH1ASbcwZlmY7BfviIZtviZs89hWbxSKfN9MbMNXoxjvsm3/VbJ:fH1Amm83iUcnKSKfkbMNXo5XvVbJ
- TLSH T1C4E56229878BE5F6C19D4170225F4BAF7AB185DA52A0830AC7268C6E3CC3FC47F61E55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/618e2488d0f7b7c25544adb1ae491348080357bb2017124fd4c21a2c79441f38.exe
File Explorer
-
dae56eed89e6af9c4e18ed8ccdce08256646bffa58989ef1def040d10c9ffff4.bin.zip 3.1MB
-
618e2488d0f7b7c25544adb1ae491348080357bb2017124fd4c21a2c79441f38.exe.exe 807.7MB
618e2488d0f7b7c25544adb1ae491348080357bb2017124fd4c21a2c79441f38.exe
- IMPHASH c2d457ad8ac36fc9f18d45bffcd450c2
- SHA256 618e2488d0f7b7c25544adb1ae491348080357bb2017124fd4c21a2c79441f38
- MD5 c38d492d3298ceb24dba87cd506c1836
- SHA1 7cf7bbc3163423420ef14f0188604db87eaf94e6
- SHA512 db42e8bbab2d8d474c755532698032354edb3206fa968247e50ec589f70c7a218d9b5ebd4c6d75fe28341d7cd6b34005718684a439f3c0f553e74c4031eeed92
- SSDEEP 49152:wh517DFYLfhiSJJv2L5A2sJ5ccW9Jn46WuA35ELX6a7W69MddiUD2pCxV6+gamRZ:DHOr
- TLSH T1A1995E037B4800D8C867EEB080B54A7951B03DDD9631BA5B8DE97EA41F1A3996FEDF01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
29:b4:72:50:7f:19:72:38:a2:7b:74:59:80:4e:66:a0:0f:8a:90:b4:64:c4:11:ca:6a:fb:4d:c0:f0:bc:04:9c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Northern Forge Partners,O=Northern Forge Partners,C=US
Chains
Oct 3, 2026
CN=Northern Forge Partners,O=Northern Forge Partners,C=US
Subject
CN=Northern Forge Partners,O=Northern Forge Partners,C=US
Serial Number
b4:9a:2a:47:c7:10:82:04:db:5a:45:19:1e:ce:ef:22
Issuer
CN=Northern Forge Partners,O=Northern Forge Partners,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 26, 2026 - Oct 3, 2027
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Minor OS version
1
Major OS version
6
Entry point
411872
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
5.4MB
Virtual Size
5.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
50KB
Virtual Size
605KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ