2dfcd705e3f5b168661163806fe5baae579b30fec864ceb80f67b2059ac3125b

Sharing

Copy URL Twitter E-mail

General

Target
2dfcd705e3f5b168661163806fe5baae579b30fec864ceb80f67b2059ac3125b
Size 2.2MB
Sample261014-jsvtdaas8r
SHA256 2dfcd705e3f5b168661163806fe5baae579b30fec864ceb80f67b2059ac3125b
MD5 aeca7fadb0a528ec57c33d662778f8c6
SHA1 a7230349fbdd62ca0ceeba1d8f6a78437fcbdca3
SHA512 fd4333d5f30e69578abae91fcbc7c460cb43106e0fce468697023cdcde2e2e8a7e65325e16fa476a557a21791abc5f96729bfc105fc95fc1c33294ab8aadecc9
SSDEEP 24576:/HgoKx93LB4xb9mim3YHA4rIAf6i0HmF19r5BbkeZrRGumgdJjrG8XrJrWL:/m9inmim3YAsL0HDT0rJr0
TLSH
T17FA55CBF67440568D0A770B8AC563083EB71BE274270E98E0B5337475F267AF1E6A21D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2dfcd705e3f5b168661163806fe5baae579b30fec864ceb80f67b2059ac3125b

File Explorer

2dfcd705e3f5b168661163806fe5baae579b30fec864ceb80f67b2059ac3125b

.dll 2.2MB

2dfcd705e3f5b168661163806fe5baae579b30fec864ceb80f67b2059ac3125b

IMPHASH 4daa3faebe6540b054d61c5c7cb7c411
SHA256 2dfcd705e3f5b168661163806fe5baae579b30fec864ceb80f67b2059ac3125b
MD5 aeca7fadb0a528ec57c33d662778f8c6
SHA1 a7230349fbdd62ca0ceeba1d8f6a78437fcbdca3
SHA512 fd4333d5f30e69578abae91fcbc7c460cb43106e0fce468697023cdcde2e2e8a7e65325e16fa476a557a21791abc5f96729bfc105fc95fc1c33294ab8aadecc9
SSDEEP 24576:/HgoKx93LB4xb9mim3YHA4rIAf6i0HmF19r5BbkeZrRGumgdJjrG8XrJrWL:/m9inmim3YAsL0HDT0rJr0
TLSH
T17FA55CBF67440568D0A770B8AC563083EB71BE274270E98E0B5337475F267AF1E6A21D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

06:2a:ec:36:e1:8f:af:69:4e:5d:43:7a:e9:a5:17:63:11:13:8d:6b:66:ab:5e:08:e7:dd:0a:92:e7:78:ab:7c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Google LLC,1.2.840.113549.1.9.1=#1300

Chains

Oct 14, 2026

CN=Google LLC,1.2.840.113549.1.9.1=#1300

Subject

CN=Google LLC,1.2.840.113549.1.9.1=#1300

Serial Number

18:e4:41:43:64:f3:14:9c:4a:18:e1:9f:93:ba:a2:eb

Issuer

CN=Google LLC,1.2.840.113549.1.9.1=#1300

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 31, 2002 - Dec 30, 2099

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

237552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

ExitProcess ReadProcessMemory GetCurrentProcessId GetProcessHeap CreateProcessW GetModuleHandleW FreeLibrary GetConsoleWindow QueryFullProcessImageNameW GetExitCodeProcess CreateDirectoryW ReadFile SizeofResource VirtualProtect GetTempPathW CreateFileW CreateToolhelp32Snapshot MultiByteToWideChar DeleteCriticalSection Process32NextW LockResource Process32FirstW LoadResource FindResourceW WideCharToMultiByte GetSystemTimeAsFileTime FlsFree FlsAlloc SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP LocalFree GetProcAddress GetWindowsDirectoryW DecodePointer HeapAlloc FreeConsole CloseHandle HeapReAlloc LoadLibraryA GetLastError Sleep HeapSize OpenProcess ResumeThread GetFileAttributesW WaitForSingleObject FindClose InitializeCriticalSectionEx CreatePipe CreateJobObjectW GetModuleFileNameW TerminateProcess AssignProcessToJobObject WriteFile GetStdHandle GetCurrentProcess FindNextFileW GetFullPathNameW GetCommandLineW HeapFree SetHandleInformation SetInformationJobObject QueryDosDeviceW GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsSetValue FlsGetValue SetFilePointerEx GetFileSizeEx GetFileType GetModuleHandleExW RtlUnwind LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx LCMapStringEx EncodePointer IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection QueryPerformanceCounter GetStringTypeW GetCurrentThreadId GetLocaleInfoEx FindFirstFileExW

user32

FindWindowW CharLowerA SetWindowPos SendMessageW ShowWindow

advapi32

CreateServiceW QueryServiceStatus StartServiceW LookupPrivilegeValueW AdjustTokenPrivileges CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey AllocateAndInitializeSid RegSetValueExW OpenProcessToken FreeSid CheckTokenMembership RegOpenKeyExW RegCreateKeyW GetTokenInformation

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoGetObject

ntdll

RtlGetVersion

winhttp

WinHttpSendRequest WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpReceiveResponse

__pth_gpointer_locked __pthread_clock_nanosleep _pthread_cleanup_dest _pthread_get_state _pthread_invoke_cancel _pthread_key_dest _pthread_rel_time_in_ms _pthread_set_state _pthread_time_in_ms _pthread_time_in_ms_from_timespec _pthread_tryjoin clock_getres clock_gettime clock_nanosleep clock_settime nanosleep pthread_attr_destroy pthread_attr_getdetachstate pthread_attr_getinheritsched pthread_attr_getschedparam pthread_attr_getschedpolicy pthread_attr_getscope pthread_attr_getstackaddr pthread_attr_getstacksize pthread_attr_init pthread_attr_setdetachstate pthread_attr_setinheritsched pthread_attr_setschedparam pthread_attr_setschedpolicy pthread_attr_setscope pthread_attr_setstackaddr pthread_attr_setstacksize pthread_barrier_destroy pthread_barrier_init pthread_barrier_wait pthread_barrierattr_destroy pthread_barrierattr_getpshared pthread_barrierattr_init pthread_barrierattr_setpshared pthread_cancel pthread_cond_broadcast pthread_cond_destroy pthread_cond_init pthread_cond_signal pthread_cond_timedwait pthread_cond_timedwait_relative_np pthread_cond_wait pthread_condattr_destroy pthread_condattr_getclock pthread_condattr_getpshared pthread_condattr_init pthread_condattr_setclock pthread_condattr_setpshared pthread_create pthread_create_wrapper pthread_delay_np pthread_detach pthread_equal pthread_exit pthread_get_concurrency pthread_getclean pthread_getconcurrency pthread_getevent pthread_gethandle pthread_getname_np pthread_getschedparam pthread_getspecific pthread_join pthread_key_create pthread_key_delete pthread_kill pthread_mutex_destroy pthread_mutex_init pthread_mutex_lock pthread_mutex_timedlock pthread_mutex_trylock pthread_mutex_unlock pthread_mutexattr_destroy pthread_mutexattr_getprioceiling pthread_mutexattr_getprotocol pthread_mutexattr_getpshared pthread_mutexattr_gettype pthread_mutexattr_init pthread_mutexattr_setprioceiling pthread_mutexattr_setprotocol pthread_mutexattr_setpshared pthread_mutexattr_settype pthread_num_processors_np pthread_once pthread_rwlock_destroy pthread_rwlock_init pthread_rwlock_rdlock pthread_rwlock_timedrdlock pthread_rwlock_timedwrlock pthread_rwlock_tryrdlock pthread_rwlock_trywrlock pthread_rwlock_unlock pthread_rwlock_wrlock pthread_rwlockattr_destroy pthread_rwlockattr_getpshared pthread_rwlockattr_init pthread_rwlockattr_setpshared pthread_self pthread_set_concurrency pthread_set_num_processors_np pthread_setcancelstate pthread_setcanceltype pthread_setconcurrency pthread_setname_np pthread_setschedparam pthread_setspecific pthread_spin_destroy pthread_spin_init pthread_spin_lock pthread_spin_trylock pthread_spin_unlock pthread_testcancel pthread_timechange_handler_np pthread_tls_init sched_get_priority_max sched_get_priority_min sched_getscheduler sched_setscheduler sched_yield sem_close sem_destroy sem_getvalue sem_init sem_open sem_post sem_post_multiple sem_timedwait sem_trywait sem_unlink sem_wait

Name

.text

Size

410KB

Virtual Size

410KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

125KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2dfcd705e3f5b168661163806fe5baae579b30fec864ceb80f67b2059ac3125b

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

ntdll

winhttp

generic