Active Sky FS B9694.rar
- SHA256 62c7e89bf42b263e16abb6d88f04b197859143b31241c3149c520e435c310056
Behavioral task
behavioral1
Sample
AS_FS_Install.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
AS_FS_Install.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Active Sky FS.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Active Sky FS.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Common.Configuration.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Common.Configuration.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Active Sky FS B9694.rar
- Size 184.8MB
- Sample261003-xmt7jswt5r
- SHA256 62c7e89bf42b263e16abb6d88f04b197859143b31241c3149c520e435c310056
- MD5 5ef0c0aaedbaede9763614b07df5439e
- SHA1 10352d2d35f271932b640cacf4c702eb62743a49
- SHA512 6c14e34902253952aee94f30952504d4f9be11b106b86d2ee1ae178ccde0197dd3bd902cf95fa808b8527fde4a26eab652ab02c59115298208029dfd0def19dc
- SSDEEP 3145728:me9ppif4mcErF3TMUNiL/A21SBPTrnfb57lxPmMSp2A3BS7xyKKaz7C3J10y:3bEpjdN+2rnfb57lFmnp2A3OdCD0y
- TLSH T1D298333B98D999597BAC0E26D00EE32F5F93DC12817CA8F95357D8F89F8D808A5C41B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Active Sky FS.exe unpack001/Common.Configuration.dll - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/AS_FS_Install.exe innosetup
File Explorer
-
Active Sky FS B9694.rar.rar 184.8MB
-
AS_FS.exe.config.xml 130B
-
AS_FS_Install.exe.exe 180.7MB
-
Active Sky FS.exe.exe 134KB
-
Common.Configuration.dll.dll 4.3MB
AS_FS.exe.config
- SHA256 cc6b8ac19a48fcfc21898f7c1b9a82906ff16015bb6dbc78e03d1cf6edc97934
- MD5 67b4e6fa636f6aa5f93dc45de4a8fa92
- SHA1 3dade2f94d368f11b08d4474aa1e87da7569a9a0
- SHA512 d3a9963a073ede08743215ccf8df17b347b5779a965445593c7cc35f7c16ef98d507ae9924d89e85514bf2694b627b22a7aaf2e8c5dacb06c91509829fd5258c
- TLSH T185C09B41ED58DC738542478746A001525FFBE3C955551049FC5F5EB401051844347351
- MD5 SHA1 SHA512 TLSH
AS_FS_Install.exe
- IMPHASH e569e6f445d32ba23766ad67d1e3787f
- SHA256 171f4af1c9cb80972b46b732c3e8985e3a2a7d88f52d1ce6f25d9f5f0a881f88
- MD5 b3c758a001d549cc74384336225ee33a
- SHA1 50911c1e65546b9208b5dec88646a25ab38d2308
- SHA512 96665278259010f7d38272050a2fe1af0f0e82785e70001b0939fa28bc8202add56fe738b1e8aee2c6970e877014881c6fb5f678d3c433c021bab8542a324937
- SSDEEP 3145728:8657aOL2omYTFK0E2PzhF0FI9Y3xtVZA2Qvvn1vUb3GR:r7Jb00E2b0FII/VZA2QX1MDk
- TLSH T1F498337BB379F82EC4A707730936C344563BB662DE26980A1BF4046EDF60A605E37947
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Digest
38:71:18:df:e3:c2:f7:7c:ad:ee:49:44:ba:ec:85:8a:48:63:d9:b9:8e:a9:ba:01:bf:b9:34:52:d2:91:61:34
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=HiFi Technologies\, Inc.,O=HiFi Technologies\, Inc.,ST=California,C=US
Chains
Jul 17, 2026
CN=HiFi Technologies\, Inc.,O=HiFi Technologies\, Inc.,ST=California,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=HiFi Technologies\, Inc.,O=HiFi Technologies\, Inc.,ST=California,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Digest
6a:2c:a7:a6:4f:0a:02:08:1b:74:4b:27:3f:c1:b1:9a:7c:9a:d0:ca
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=HiFi Technologies\, Inc.,O=HiFi Technologies\, Inc.,ST=California,C=US
Chains
Jul 17, 2026
CN=HiFi Technologies\, Inc.,O=HiFi Technologies\, Inc.,ST=California,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=HiFi Technologies\, Inc.,O=HiFi Technologies\, Inc.,ST=California,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=HiFi Technologies\, Inc.,O=HiFi Technologies\, Inc.,ST=California,C=US
Serial Number
01:79:17:b7:ab:24:57:7b:f6:09:46:77:52:ae:f0:44
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 7, 2024 - Oct 7, 2027
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Subject
CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB
Serial Number
90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 25, 2026 - Mar 24, 2041
Subject
CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB
Serial Number
e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15
Issuer
CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 25, 2026 - Jun 24, 2037
Minor OS version
1
Major OS version
6
Entry point
745196
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale
comctl32
InitCommonControls
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
user32
CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW
oleaut32
SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate
netapi32
NetWkstaGetInfo
NetApiBufferFree
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
AdjustTokenPrivileges
GetTokenInformation
ConvertSidToStringSidW
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
718KB
Virtual Size
718KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
27KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
154B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Active Sky FS.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7a232bc813b5cc3344c668019fabe839e649e5d4f155f4c65711e177696c1767
- MD5 5b0b087cafe6fb78c6f14acabbb8ba4d
- SHA1 0fda911d9d89fd52e788136d023e5ba8d965f97e
- SHA512 3fe4f22c03fef9383a90264068686ad8698569e99891ebeb54d87a5b222ed65f44efcca9a5749f75cf2a7c51457ed5d2b710e42f16bbe3252c6e8725bebdff38
- SSDEEP 1536:HkNtYJPez43dTXTGIrsyH2CHNV04DtN/EPJAUavHP7sLoOfVKLsIGrB+io4mo2Jr:l3ZiIrsJCH04XEwY0Onzjo43E
- TLSH T1F2D33A4677828204C0684336C99BCCA813A9BF4A6B73D74F39643BAE1F72366CD51F49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Active Sky FS.pdb
mscoree
_CorExeMain
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Common.Configuration.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d51ae32a609f580f19952360fa6e590074274da8f39ca5ca55a98fef6d477d8e
- MD5 871e26211d5846038dd65645dece5f1d
- SHA1 f45a00d4c967f3b9cb3eec0b2bf6eb000807342e
- SHA512 be6e5ea2139e08deb82605340165b40bb28f76747b4ec9f4b50a2107a883b97ea8dc2e8003b469c027596a0a2c63edd7c346283c268dbaae08b95e49ed266fd3
- SSDEEP 98304:uNuNItxjD4b/f3dHG0Z/gGuOCx7H6Ar9eZZijji0w2I8DdbllPBLMdHk/:uENSxjD4b/fBfd2OCxuAr98IjGl2IUd7
- TLSH T1F4263301E74B8D15D4485636D4EBC822C6AEA70BB327CA347E4D53259E036EB9CECB17
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4501694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Common.Configuration.pdb
mscoree
_CorDllMain
Name
.text
Size
4.3MB
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
996B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ