Cyberduck-Installer-9[.]5[.]4[.]45528[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Cyberduck-Installer-9.5.4.45528.exe
Size 89.8MB
Sample261018-vtzz9ssvb1
SHA256 b432b6d683ec2495a9042b668218522d3bac9aef0bd613ccd17b57b983092049
MD5 8ccb59877992ef76b3374b08924c4c4f
SHA1 a56e3c13b1d22a49697a414996be583d21c344a5
SHA512 cb1b081508df914104ab623deb18dc3fe50603c4a36157cb4cd95c4c09b88a48e9ca502aaf6deb4a959cb840c8c79773fe3250352d79d21c64d03bfeea60987c
SSDEEP 1572864:iGeJsAmzAel8M5hPRLOdtLyhilD0JfBmjskPd7Io7aPEJ3F7dk9/z9UgKK7HEgFB:F37PLclYXkPG/sxF7dk1xhhFo2
TLSH
T1E028337523B014BAE5FE42B3D5A1E6B0FF34B55D7302216AA164C22C2F2BA5535BF306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Cyberduck-Installer-9.5.4.45528.exe

.exe 89.8MB

Cyberduck-Installer-9.5.4.45528.exe

IMPHASH a4f9a8cc2c50637fc36c9d1fb0cbe186
SHA256 b432b6d683ec2495a9042b668218522d3bac9aef0bd613ccd17b57b983092049
MD5 8ccb59877992ef76b3374b08924c4c4f
SHA1 a56e3c13b1d22a49697a414996be583d21c344a5
SHA512 cb1b081508df914104ab623deb18dc3fe50603c4a36157cb4cd95c4c09b88a48e9ca502aaf6deb4a959cb840c8c79773fe3250352d79d21c64d03bfeea60987c
SSDEEP 1572864:iGeJsAmzAel8M5hPRLOdtLyhilD0JfBmjskPd7Io7aPEJ3F7dk9/z9UgKK7HEgFB:F37PLclYXkPG/sxF7dk1xhhFo2
TLSH
T1E028337523B014BAE5FE42B3D5A1E6B0FF34B55D7302216AA164C22C2F2BA5535BF306
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

1c:d1:77:c0:9e:1b:8f:3d:98:cf:b6:00:fd:89:dd:4b:11:81:68:ee:cc:e6:6b:e5:45:68:d1:42:51:b2:43:a5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=iterate GmbH,O=iterate GmbH,ST=Bern,C=CH

Chains

Aug 25, 2026

CN=iterate GmbH,O=iterate GmbH,ST=Bern,C=CH

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=iterate GmbH,O=iterate GmbH,ST=Bern,C=CH

Serial Number

69:99:7e:6c:91:a1:f8:dc:95:42:05:7a:31:cd:44:ba

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 5, 2025 - Nov 5, 2026

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5b:4a:b5:8d:41:32:6d:dc:74:00:00:00:00:00:5b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

391632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

D:\a\wix\wix\build\burn\Release\x64\burn.pdb

kernel32

InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseMutex CreateEventW GetCurrentProcess CreateThread GetNativeSystemInfo VerSetConditionMask GetSystemTime GetComputerNameW VerifyVersionInfoW GetDateFormatW CompareStringW GetUserDefaultUILanguage GetUserDefaultLangID GetSystemDefaultLangID GetStringTypeW CreateProcessW DuplicateHandle GetExitCodeProcess CompareStringOrdinal ProcessIdToSessionId OpenProcess GetProcessId SetProcessShutdownParameters CreateSemaphoreW LocalFileTimeToFileTime GetExitCodeThread DosDateTimeToFileTime CompareStringA SetThreadExecutionState ReleaseSemaphore CreateMutexW CreateFileMappingW MapViewOfFile UnmapViewOfFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx FreeLibrary TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RtlPcToFileHeader GetStdHandle GetModuleHandleExW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW VirtualQuery VirtualProtect GetSystemInfo RaiseException ExpandEnvironmentStringsW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc GetModuleFileNameW GetSystemWow64DirectoryW GetSystemDirectoryW GetLocalTime SetLastError GetTempPathW GetVolumePathNameW GetTempFileNameW GetFullPathNameW CopyFileW GlobalFree GlobalAlloc Sleep SetFileTime SetFilePointerEx SetEndOfFile ReadFile LoadLibraryExA GetFileSizeEx LCMapStringW WideCharToMultiByte MultiByteToWideChar lstrlenW FormatMessageW LocalFree MoveFileExW SetFileAttributesW RemoveDirectoryW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateDirectoryW GetCurrentDirectoryW LoadLibraryExW GetProcAddress GetModuleHandleW WaitForMultipleObjects WaitForSingleObject HeapSetInformation GetLastError lstrlenA GetCurrentProcessId GetModuleHandleA MulDiv GetSystemWindowsDirectoryW ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW LoadResource LockResource SizeofResource FindResourceExA VirtualAlloc VirtualFree SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetTimeZoneInformation WriteFile SetFilePointer CreateFileA ExitProcess CloseHandle InitializeCriticalSectionAndSpinCount CreateFileW

user32

GetDC ReleaseDC MonitorFromPoint MonitorFromWindow ShowWindow IsDialogMessageW LoadCursorW GetMonitorInfoW SetWindowLongPtrW GetWindowLongPtrW GetCursorPos MessageBoxW SetWindowPos CreateWindowExW UnregisterClassW RegisterClassW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetMessageW WaitForInputIdle IsWindow PostMessageW LoadBitmapW

gdi32

DeleteObject SelectObject StretchBlt GetObjectW DeleteDC CreateDCW CreateCompatibleDC GetDeviceCaps

advapi32

GetUserNameW CryptAcquireContextW CryptReleaseContext QueryServiceConfigW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash OpenProcessToken AllocateAndInitializeSid CheckTokenMembership GetTokenInformation AdjustTokenPrivileges IsWellKnownSid LookupPrivilegeValueW RegCreateKeyExW QueryServiceStatus OpenServiceW OpenSCManagerW ControlService CloseServiceHandle ChangeServiceConfigW SetEntriesInAclW DecryptFileW InitializeAcl CreateWellKnownSid ConvertStringSecurityDescriptorToSecurityDescriptorW ReportEventW OpenEventLogW CloseEventLog RegQueryInfoKeyW RegDeleteValueW RegQueryValueExW InitiateSystemShutdownExW RegOpenKeyExW RegCloseKey SetNamedSecurityInfoW RegDeleteKeyW RegEnumKeyExW RegEnumValueW RegSetValueExW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetEntriesInAclA

ole32

CoInitializeEx CoInitialize CoInitializeSecurity CoUninitialize CLSIDFromProgID CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

SysFreeString VariantInit SysAllocString VariantClear

shell32

ShellExecuteExW CommandLineToArgvW SHGetFolderPathW

Name

.text

Size

548KB

Virtual Size

548KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

266KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Cyberduck-Installer-9.5.4.45528.exe

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shell32

generic