IESv2025_windows[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
IESv2025_windows.exe
Size 19.5MB
Sample261009-sknvjayth1
SHA256 98352312e6e3f853cc9e3bd6898bac3b3582bdca27ab9553ac7dac6fd9d482a2
MD5 e68f15db2567053a8a865d9b11bd4932
SHA1 01789d53454e00de89f27b2221bb9d4f7edfa0f3
SHA512 3a11a228177883a7ec0a3345b30f054f99a48d5a0b15cd8926a83aead80d56185a73465d95be61f323f2b1881c2edc0fc1892061e4421b7d9b529eca45aa71ae
SSDEEP 393216:1quMuQaapUgGtsnIs8JM1btPxPOhrqKEHQi1tjUGmTaTC4ZYfFNyc1ozBO:sZvA9suAbt9OhO/9UxTafZENyUoA
TLSH
T1072733A837E28565FC6D8934CF77A50385F310B0C6A56CCB9BFA029F7793B801D89A54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
IESv2025_windows.exe

File Explorer

IESv2025_windows.exe

.exe 19.5MB

IESv2025_windows.exe

IMPHASH ca92f3a1c81019ba65abe468b2f05f55
SHA256 98352312e6e3f853cc9e3bd6898bac3b3582bdca27ab9553ac7dac6fd9d482a2
MD5 e68f15db2567053a8a865d9b11bd4932
SHA1 01789d53454e00de89f27b2221bb9d4f7edfa0f3
SHA512 3a11a228177883a7ec0a3345b30f054f99a48d5a0b15cd8926a83aead80d56185a73465d95be61f323f2b1881c2edc0fc1892061e4421b7d9b529eca45aa71ae
SSDEEP 393216:1quMuQaapUgGtsnIs8JM1btPxPOhrqKEHQi1tjUGmTaTC4ZYfFNyc1ozBO:sZvA9suAbt9OhO/9UxTafZENyUoA
TLSH
T1072733A837E28565FC6D8934CF77A50385F310B0C6A56CCB9BFA029F7793B801D89A54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

03:7e:48:df:92:8f:8c:ae:2e:47:8c:6d:c0:1d:4b:42:48:6d:5b:cf

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Autoridade Tributária e Aduaneira,O=Autoridade Tributária e Aduaneira,L=Lisboa,C=PT

Chains

Sep 23, 2026

CN=Autoridade Tributária e Aduaneira,O=Autoridade Tributária e Aduaneira,L=Lisboa,C=PT

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Autoridade Tributária e Aduaneira,O=Autoridade Tributária e Aduaneira,L=Lisboa,C=PT

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=Autoridade Tributária e Aduaneira,O=Autoridade Tributária e Aduaneira,L=Lisboa,C=PT

Serial Number

02:41:42:39:4c:6a:a6:d9:77:fd:68:76:1b:88:18:78

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 23, 2026 - Sep 27, 2027

Minor OS version

Major OS version

Entry point

112004

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

SetDlgItemTextA SetWindowTextA DialogBoxParamA EndDialog GetDlgItem DefDlgProcA LoadIconA LoadCursorA RegisterClassA SendDlgItemMessageA ExitWindowsEx EnumWindows IsIconic ShowWindow SetForegroundWindow GetLastActivePopup IsWindowVisible GetWindowThreadProcessId FindWindowA GetParent GetDesktopWindow GetWindowRect CopyRect OffsetRect SetWindowPos MessageBoxA MessageBoxW

advapi32

AdjustTokenPrivileges RegSetValueExA RegCreateKeyExA RegDeleteValueA OpenProcessToken LookupPrivilegeValueA RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA

comctl32

ord17

comdlg32

GetOpenFileNameA

kernel32

QueryPerformanceCounter InitializeCriticalSectionAndSpinCount GetDriveTypeA GetFileAttributesW WriteConsoleA SetEnvironmentVariableW LoadLibraryW LCMapStringW IsValidCodePage GetOEMCP GetACP SetStdHandle LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA CompareStringA CompareStringW SetEndOfFile GetTimeZoneInformation SearchPathA CreateFileW SetFilePointer GetLastError WriteFile ReadFile GetProcAddress LoadLibraryA GetUserDefaultLCID CloseHandle CreateFileA CreateDirectoryA GetLongPathNameW ExitProcess RemoveDirectoryA FindClose FindNextFileA DeleteFileA FindFirstFileA WideCharToMultiByte MultiByteToWideChar AreFileApisANSI FindFirstFileW GetShortPathNameA GetModuleFileNameA GetShortPathNameW GetModuleFileNameW GetWindowsDirectoryA GetLongPathNameA GetEnvironmentVariableA GetTempPathA GetWindowsDirectoryW GetEnvironmentVariableW GetTempPathW GetTempFileNameA GetFullPathNameW GetFullPathNameA FreeEnvironmentStringsW GetEnvironmentStringsW FreeEnvironmentStringsA GetEnvironmentStrings GetConsoleOutputCP DuplicateHandle GetCurrentProcess TerminateProcess GetExitCodeProcess WaitForSingleObject CreateProcessA SetEnvironmentVariableA GetProcessHeap DeleteFileW EnterCriticalSection InitializeCriticalSection LeaveCriticalSection GetCurrentProcessId Sleep GetMailslotInfo CreateThread CreateMailslotA GetCommandLineW CreateSemaphoreA SizeofResource LockResource LoadResource FindResourceA SetConsoleTitleA GetTickCount GetConsoleTitleA AllocConsole GetModuleHandleA CreateProcessW SetCurrentDirectoryW SetThreadPriority SetCurrentDirectoryA GetCurrentDirectoryA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind GetSystemTimeAsFileTime CreateDirectoryW RemoveDirectoryW HeapAlloc HeapFree WriteConsoleW GetFileType GetStdHandle GetModuleHandleW GetCommandLineA GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapSize GetConsoleCP GetConsoleMode FlushFileBuffers DeleteCriticalSection SetHandleCount VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetCPInfo

Sharing

General

Malware Config

Signatures

File Explorer

IESv2025_windows.exe

user32

advapi32

comctl32

comdlg32

kernel32

generic