sp165907[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
sp165907.exe
Size 8.5MB
Sample261009-plcbcaf19v
SHA256 c1700e34409aba7ef39256f584e5c9044f76c2c51fdbe593bec8f4c87e28de86
MD5 0b1fef8eea5eb332b956c9b7d4179eee
SHA1 6addc12954454ac4cc3e3934337fcf7830098a69
SHA512 4ac4b65ce5872f310751c500b107855d419040d15d2a59ec03314b15f0ce99d7654e58241279397a041f44e91fcc71f29255366e9f03487ea1d425555b3d4e34
SSDEEP 196608:NBLyVAClNVSPOJCGKx1Rcp7PEZ6UPBXItMQ7sQCU8Zq7f+s9:6amNVSOJCGKx1C78EqBSMQoXs19
TLSH
T1FD963396BBA857F4D157C07889629716F7767446177097CB22A0832F2F23AE61F3B320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

sp165907.exe

.exe 8.5MB

sp165907.exe

IMPHASH de508382fed10b0dc9f2a52a1f11d555
SHA256 c1700e34409aba7ef39256f584e5c9044f76c2c51fdbe593bec8f4c87e28de86
MD5 0b1fef8eea5eb332b956c9b7d4179eee
SHA1 6addc12954454ac4cc3e3934337fcf7830098a69
SHA512 4ac4b65ce5872f310751c500b107855d419040d15d2a59ec03314b15f0ce99d7654e58241279397a041f44e91fcc71f29255366e9f03487ea1d425555b3d4e34
SSDEEP 196608:NBLyVAClNVSPOJCGKx1Rcp7PEZ6UPBXItMQ7sQCU8Zq7f+s9:6amNVSOJCGKx1C78EqBSMQoXs19
TLSH
T1FD963396BBA857F4D157C07889629716F7767446177097CB22A0832F2F23AE61F3B320
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

8d:c5:6e:da:8f:7c:32:87:66:e3:b3:74:8b:a0:ec:d8:5e:75:85:e9:d7:f8:ce:c9:e6:45:ac:3a:60:18:21:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

Chains

Dec 11, 2025

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

Serial Number

0b:31:b1:72:d0:f1:10:73:0d:45:b8:81:3d:50:56:70

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 7, 2025 - Feb 6, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

296948

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\LU\PRJ\smr.softpaqwrapper\Release\hpsoftpaqwrapper.pdb

kernel32

WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceW FindResourceExW CreateFileW SetFilePointer OutputDebugStringW GetEnvironmentVariableW GetFileSizeEx CreateFileMappingW MapViewOfFile UnmapViewOfFile LocalFree ExpandEnvironmentStringsW DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime SetFileAttributesW CreateDirectoryW GetFileAttributesW FreeLibrary LoadLibraryW TlsSetValue TlsGetValue GetTickCount GetCurrentProcess GetExitCodeThread ResumeThread TlsAlloc GlobalAlloc GlobalFree SetLastError RemoveDirectoryW GetTempPathW GetSystemDirectoryW DeleteFileW GetCurrentDirectoryW GetCurrentProcessId FindFirstFileW FindNextFileW FindClose GetModuleHandleA SetEndOfFile GetFileSize GetDiskFreeSpaceW GetDriveTypeW GetProcessAffinityMask MultiByteToWideChar GlobalMemoryStatusEx MulDiv FreeResource GlobalLock GlobalUnlock lstrcmpiW LoadLibraryExW GetModuleFileNameW EncodePointer CreateProcessW GetExitCodeProcess VirtualAlloc SetSearchPathMode GetShortPathNameW GetCommandLineW AttachConsole AllocConsole FreeConsole lstrlenW FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW GetACP ExitProcess GetCPInfo GetFileType SetFilePointerEx GetConsoleCP ReadConsoleW GetConsoleMode FreeLibraryAndExitThread ExitThread CreateThread RtlPcToFileHeader RtlUnwindEx QueryPerformanceCounter GetStartupInfoW ResetEvent CloseHandle SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection WaitForMultipleObjects GetFileInformationByHandle WriteFile GetStdHandle GetSystemInfo ReadFile VirtualFree LeaveCriticalSection EnterCriticalSection GetModuleHandleW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError FormatMessageW HeapSize GetCurrentThreadId IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx GetSystemTimeAsFileTime TlsFree SwitchToThread InitializeCriticalSectionAndSpinCount GetFullPathNameW GetFileAttributesExW FindFirstFileExW FlushInstructionCache InterlockedPushEntrySList InitializeCriticalSectionEx GetModuleHandleExW HeapFree SearchPathW InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent LoadLibraryExA VirtualQuery VirtualProtect

user32

SetWindowLongW GetWindowLongW SetDlgItemTextW SetWindowPos MapWindowPoints LoadCursorW SetCursor SendMessageW EnableWindow PostMessageW GetParent GetWindowRect GetDlgItem CharUpperW GetWindowTextLengthW GetWindowTextW GetActiveWindow SetFocus IsWindowVisible SetRectEmpty RegisterWindowMessageW GetDC ReleaseDC SetWindowTextW UnregisterClassW MessageBoxW GetWindowLongPtrW BeginPaint CharNextW SetWindowLongPtrW GetWindow MonitorFromWindow GetMonitorInfoW DefWindowProcW DestroyWindow CallWindowProcW GetSysColor GetClientRect EndPaint

gdi32

CreateFontIndirectW SetStretchBltMode ExtTextOutW SetBkColor SetDIBColorTable SelectObject StretchBlt CreateDIBSection CreateCompatibleDC DeleteDC GetDeviceCaps GetObjectW DeleteObject

advapi32

RegQueryInfoKeyW OpenProcessToken SetNamedSecurityInfoW LookupPrivilegeValueW AdjustTokenPrivileges RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW AllocateAndInitializeSid RegCloseKey RegDeleteKeyW FreeSid GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetPathFromIDListW

ole32

OleUninitialize OleInitialize CoCreateInstance CoInitialize CoTaskMemRealloc CreateStreamOnHGlobal CoTaskMemFree CoTaskMemAlloc

oleaut32

VariantClear VarUI4FromStr SysFreeString SysAllocString SysAllocStringLen VariantCopy

shlwapi

StrStrIW

comctl32

DestroyPropertySheetPage InitCommonControlsEx PropertySheetW CreatePropertySheetPageW

gdiplus

GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePaletteSize GdipGetImagePalette GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipFree GdipAlloc GdipDisposeImage GdipGetImageGraphicsContext GdipDeleteGraphics GdipDrawImageI GdipBitmapUnlockBits GdiplusShutdown GdiplusStartup GdipCloneImage

Sharing

General

Malware Config

Signatures

File Explorer

sp165907.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

generic