MS_FS_2026-10-06_12_50_07.246.zip
- SHA256 a5a91227aa5650e71d3baa2c1f29be556805310ce076fca4b471e033acc348de
Password
Applebottomjeans!1
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
300 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
300 seconds
General
- Target MS_FS_2026-10-06_12_50_07.246.zip
- Size 4.0MB
- Sample261006-p4n3vsbv7k
- SHA256 a5a91227aa5650e71d3baa2c1f29be556805310ce076fca4b471e033acc348de
- MD5 7b5e238da9c6e05b01164d82ca2962d9
- SHA1 f5f4765705b8d68986dd90125adbf07f9ba79469
- SHA512 3a5abc1b8417aebb17b270350f5d9a162026730faf7d4dd7f07e110ec75f14efbed732d5f0bb19242db6390317f7565510c0d3c4ece76b4e7aaadfeecf5696ca
- SSDEEP 98304:GOi1UWpaq5GNx7hid/92qc9CT1VAhLqhxmDX77iIOXe0l:GG85OE/9pMymN3yIOZl
- TLSH T1071633942078606FFF776566A1529A0F793372F08C42C6F68E0F644CEC9EE2C49596EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setup.exe
File Explorer
-
MS_FS_2026-10-06_12_50_07.246.zip.zip 4.0MB
-
Setup.exe.exe 4.7MB
-
manifest.json244B
Setup.exe
- IMPHASH e5031fdb4e895bb4eb4bf1922fd8047c
- SHA256 67705ebef1a7df037eefa8ddaae86b08d3e1536823b7ba4dbc817ecad5c33795
- MD5 90d73de2a9592373e8f243bb0af85120
- SHA1 e02977f55051ef6bd75962d4fe42a16d9c08b0a0
- SHA512 7b7ebbcf1b1cfec0304079b003557208b6cefb6a60d37fde7c52e1eff7d4c0128f49c91270483ca8c7848f899f622f20d24fc19aa09b963ffaa3856a03b6a6da
- SSDEEP 98304:H/0GX8q+2mfmRGAkdauNmzROt9oGCRh+ihqybgS1P61L1Aui:H/0Gsq+IdzROPCRwQ1nui
- TLSH T162360209E6E701F9CCA6C1BD8FD65417DB7278514338DAE702D14B160FABAE18E3E621
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Applebottomjeans!1
Minor OS version
0
Major OS version
6
Entry point
611932
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Build\Build_2050g_D20260924T094733\fa_rss\x64\Release\Setup.pdb
advapi32
QueryServiceObjectSecurity
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenServiceW
RegOpenKeyExW
StartServiceW
RegSetValueExW
ControlService
SetServiceObjectSecurity
DeleteService
RegCreateKeyExW
ConvertSecurityDescriptorToStringSecurityDescriptorW
ChangeServiceConfig2W
OpenSCManagerW
CloseServiceHandle
RegCloseKey
CreateServiceW
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegQueryValueExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteTreeW
RegDeleteKeyExW
MapGenericMask
DuplicateToken
CheckTokenMembership
FreeSid
OpenProcessToken
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
AllocateAndInitializeSid
AccessCheck
GetSecurityInfo
winhttp
WinHttpReceiveResponse
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCloseHandle
wininet
InternetCloseHandle
InternetConnectW
InternetReadFile
HttpQueryInfoW
InternetOpenW
InternetOpenUrlW
HttpOpenRequestW
HttpSendRequestW
comctl32
InitCommonControlsEx
ord412
ord410
ord413
PropertySheetW
ole32
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
CoInitializeEx
CoInitializeSecurity
CoInitialize
shell32
CommandLineToArgvW
SHGetKnownFolderPath
ShellExecuteW
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
kernel32
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
RaiseException
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleFileNameW
GetTempPathW
GetLastError
CloseHandle
LocalFree
CreateProcessW
MultiByteToWideChar
ExpandEnvironmentStringsA
GetUserDefaultUILanguage
LCIDToLocaleName
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetCurrentProcessId
WideCharToMultiByte
QueryFullProcessImageNameW
GetCurrentThreadId
GetCommandLineW
CreateMutexW
OpenEventW
Sleep
SetEvent
ExitProcess
GetTempFileNameW
MoveFileW
SizeofResource
LockResource
LoadResource
FindResourceW
ReadFile
FindFirstFileExW
FindNextFileW
GetCurrentProcess
WriteFile
TerminateProcess
RemoveDirectoryW
CreateNamedPipeW
InitializeProcThreadAttributeList
FindClose
WaitForSingleObject
CreateFileW
ReadConsoleW
DisconnectNamedPipe
GetTickCount64
UpdateProcThreadAttribute
DeleteFileW
DeleteProcThreadAttributeList
WaitNamedPipeW
ConnectNamedPipe
FlushFileBuffers
GetSystemFirmwareTable
GetModuleHandleW
MulDiv
LoadLibraryW
MoveFileExW
GetFileAttributesExW
SetFileAttributesW
GetFileType
GetTickCount
GetFileSizeEx
GetFileTime
SetFilePointerEx
GetSystemTimeAsFileTime
GetCPInfo
CompareStringEx
SleepConditionVariableSRW
WakeAllConditionVariable
QueryPerformanceCounter
LCMapStringEx
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetExitCodeThread
TlsAlloc
WaitForSingleObjectEx
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStringTypeW
GetLocaleInfoEx
FormatMessageA
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
CopyFileW
GetProcAddress
DeviceIoControl
AreFileApisANSI
SetFileInformationByHandle
GetFinalPathNameByHandleW
GetFileInformationByHandle
FindFirstFileW
CreateDirectoryW
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
GetConsoleOutputCP
GetConsoleMode
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
WriteConsoleW
SetEndOfFile
SetLastError
InitializeCriticalSectionAndSpinCount
GetFileAttributesW
user32
EnableMenuItem
OffsetRect
RedrawWindow
SetDlgItemTextW
FrameRect
GetWindowDC
UpdateWindow
EnableWindow
GetKeyState
InflateRect
MonitorFromWindow
GetSystemMetrics
GetCapture
DestroyIcon
GetDlgCtrlID
TrackMouseEvent
IsWindowEnabled
DrawIconEx
PtInRect
LoadImageW
BeginPaint
EndPaint
GetWindowLongW
PostMessageW
GetWindowRect
GetDC
SetWindowPos
UnregisterClassW
FillRect
CreateWindowExW
SendMessageW
KillTimer
SetTimer
MapWindowPoints
LoadCursorW
SetCursor
SetWindowLongW
GetDlgItem
DrawTextW
GetSysColorBrush
GetParent
InvalidateRect
ReleaseDC
GetWindowTextW
GetWindowThreadProcessId
GetShellWindow
MessageBoxExW
ShowWindow
SetFocus
SetForegroundWindow
GetMessageW
ScreenToClient
CallNextHookEx
WindowFromPoint
IsWindow
DispatchMessageW
IsChild
GetForegroundWindow
UnhookWindowsHookEx
TranslateMessage
SetWindowsHookExW
PostThreadMessageW
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
EnumDisplaySettingsW
DefWindowProcW
DestroyWindow
GetSystemMenu
IsWindowVisible
GetSysColor
GetWindowLongPtrW
RegisterClassW
SetWindowTextW
SetWindowLongPtrW
GetClientRect
gdi32
CreateCompatibleDC
DeleteDC
CreatePen
SetBkColor
CreateSolidBrush
RoundRect
CreateCompatibleBitmap
GetStockObject
GetDeviceCaps
SetTextColor
SetBkMode
DeleteObject
CreateFontIndirectW
BitBlt
GetObjectW
GetNearestColor
CreateDIBSection
SelectObject
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
shlwapi
PathFindFileNameW
iphlpapi
GetAdaptersInfo
uxtheme
SetWindowTheme
bcrypt
BCryptDestroyHash
BCryptHashData
BCryptDeriveKeyPBKDF2
BCryptCreateHash
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptSetProperty
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptGenRandom
ntdll
RtlCaptureContext
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlUnwind
Name
.text
Size
844KB
Virtual Size
843KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
250KB
Virtual Size
249KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
30KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=33145,
count=191, id=261, version=33145,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=105, id=261, version=35207,
count=1, id=262, version=33145,
count=33, id=257, version=33145,
count=383, id=1, productName=Unmarked objects,
count=23, id=260, version=33145,
count=92, id=260, version=35228,
count=1, id=261, version=35228,
count=32, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,
manifest.json
- SHA256 9f9dd02dc651f78fe7285500aba59a387b4ab2b2f9fe6165ab2d39962ed2b945
- MD5 48ea11da08e21352f8b5d90d7b4b558f
- SHA1 59e46561792c01fa641879949c11b50eaff4be11
- SHA512 e7ad029eadead6ff67d2b9e6d7b0e4c9aace070936cd0719f324a65563886dd76c78deec4f78245bad3bfda11c2cf4a48c0e146f4bfbb7ea4b4164482ce8553a
- TLSH T17DD097A2703398A6F86002C003B84F03DDAC4C332230210268FC66C2C0230B68D38503
- MD5 SHA1 SHA512 TLSH