OktaVerifySetup-7[.]1[.]0[.]0-831181d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
OktaVerifySetup-7.1.0.0-831181d.exe
Size 29.5MB
Sample261017-vsblaaay6v
SHA256 6e09b1c12998336d7743290765bfbce8ba11b21b96c90355ad9fdf76b1f6897e
MD5 52f77f966a7126a93c043378bf5425df
SHA1 5faf3c504617554463938a04ccb7aa97da7ac558
SHA512 f93e3754693b744c258a0d56139d7a803737d24d44eb9b312f343c8afd5d97c0faa0345842c44dd86db0786eff926de4994648005bd827768f930e5f1bf2d695
SSDEEP 786432:xHn4UoOatWse/0IIFBoDb+aTZA0bYu5y7rj1brx:xHnmOatWsyyFUb+alA0U4cjFx
TLSH
T16E67337122AC24E9C4BB46BEE5B58E31FE707D393321006A8964F62C2F3A975657F341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

OktaVerifySetup-7.1.0.0-831181d.exe

.exe 29.5MB

OktaVerifySetup-7.1.0.0-831181d.exe

IMPHASH e583f115cad25699bca7cb64affd0cd6
SHA256 6e09b1c12998336d7743290765bfbce8ba11b21b96c90355ad9fdf76b1f6897e
MD5 52f77f966a7126a93c043378bf5425df
SHA1 5faf3c504617554463938a04ccb7aa97da7ac558
SHA512 f93e3754693b744c258a0d56139d7a803737d24d44eb9b312f343c8afd5d97c0faa0345842c44dd86db0786eff926de4994648005bd827768f930e5f1bf2d695
SSDEEP 786432:xHn4UoOatWse/0IIFBoDb+aTZA0bYu5y7rj1brx:xHnmOatWsyyFUb+alA0U4cjFx
TLSH
T16E67337122AC24E9C4BB46BEE5B58E31FE707D393321006A8964F62C2F3A975657F341
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a8:6b:66:70:2b:45:d9:08:2c:28:7b:7a:95:d9:88:28:d5:91:e3:d0:57:d8:fc:75:ae:9e:e4:a3:eb:8d:ae:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Okta\, Inc.,O=Okta\, Inc.,L=San Francisco,ST=California,C=US

Chains

Sep 4, 2026

CN=Okta\, Inc.,O=Okta\, Inc.,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Okta\, Inc.,O=Okta\, Inc.,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Okta\, Inc.,O=Okta\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

02:3f:57:26:b5:9b:65:44:35:87:dd:e8:93:7e:d2:c1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 20, 2025 - Feb 22, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

398272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

D:\a\wix\wix\build\burn\Release\x64\burn.pdb

kernel32

InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseMutex CreateEventW GetCurrentProcess CreateThread GetNativeSystemInfo VerSetConditionMask GetSystemTime GetComputerNameW VerifyVersionInfoW GetDateFormatW CompareStringW GetUserDefaultUILanguage GetUserDefaultLangID GetSystemDefaultLangID GetStringTypeW CreateProcessW DuplicateHandle GetExitCodeProcess CompareStringOrdinal ProcessIdToSessionId OpenProcess GetProcessId SetProcessShutdownParameters CreateSemaphoreW LocalFileTimeToFileTime GetExitCodeThread DosDateTimeToFileTime CompareStringA SetThreadExecutionState ReleaseSemaphore CreateMutexW CreateFileMappingW MapViewOfFile UnmapViewOfFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx LoadLibraryExA TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RtlPcToFileHeader GetStdHandle GetModuleHandleExW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW FreeLibrary VirtualQuery VirtualProtect GetSystemInfo RaiseException ExpandEnvironmentStringsW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc GetModuleFileNameW GetSystemWow64DirectoryW GetSystemDirectoryW GetLocalTime SetLastError GetTempPathW GetVolumePathNameW GetTempFileNameW GetFullPathNameW CopyFileW GlobalFree GlobalAlloc Sleep SetFileTime SetFilePointerEx SetEndOfFile ReadFile SetEnvironmentVariableW GetFileSizeEx LCMapStringW WideCharToMultiByte MultiByteToWideChar lstrlenW FormatMessageW LocalFree MoveFileExW SetFileAttributesW RemoveDirectoryW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateDirectoryW GetCurrentDirectoryW LoadLibraryExW GetProcAddress GetModuleHandleW WaitForMultipleObjects WaitForSingleObject HeapSetInformation GetLastError lstrlenA GetCurrentProcessId GetModuleHandleA MulDiv GetSystemWindowsDirectoryW ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW LoadResource LockResource SizeofResource FindResourceExA VirtualAlloc VirtualFree SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetTimeZoneInformation WriteFile SetFilePointer CreateFileA ExitProcess CloseHandle InitializeCriticalSectionAndSpinCount CreateFileW

user32

GetDC ReleaseDC MonitorFromPoint MonitorFromWindow ShowWindow IsDialogMessageW LoadCursorW GetMonitorInfoW SetWindowLongPtrW GetWindowLongPtrW GetCursorPos MessageBoxW SetWindowPos CreateWindowExW UnregisterClassW RegisterClassW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetMessageW WaitForInputIdle IsWindow PostMessageW LoadBitmapW

gdi32

DeleteObject SelectObject StretchBlt SetStretchBltMode GetObjectW DeleteDC CreateCompatibleDC CreateDCW GetDeviceCaps

advapi32

InitiateSystemShutdownExW CryptAcquireContextW CryptReleaseContext QueryServiceConfigW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash OpenProcessToken AllocateAndInitializeSid CheckTokenMembership GetTokenInformation AdjustTokenPrivileges IsWellKnownSid LookupPrivilegeValueW RegCreateKeyExW QueryServiceStatus OpenServiceW OpenSCManagerW ControlService CloseServiceHandle ChangeServiceConfigW SetEntriesInAclW DecryptFileW InitializeAcl CreateWellKnownSid ConvertStringSecurityDescriptorToSecurityDescriptorW ReportEventW OpenEventLogW CloseEventLog RegQueryInfoKeyW RegDeleteValueW RegQueryValueExW GetUserNameW RegOpenKeyExW RegCloseKey SetNamedSecurityInfoW RegDeleteKeyW RegEnumKeyExW RegEnumValueW RegSetValueExW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetEntriesInAclA

ole32

CoInitializeEx CoInitialize CoInitializeSecurity CoUninitialize CLSIDFromProgID CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

SysFreeString VariantInit SysAllocString VariantClear

shell32

ShellExecuteExW CommandLineToArgvW SHGetFolderPathW

Name

.text

Size

557KB

Virtual Size

556KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

268KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

OktaVerifySetup-7.1.0.0-831181d.exe

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shell32

generic