Open_to_view_3613.iso
- SHA256 1f6466a3d23b93a21970a3b8964b353aab420eaccaacf2e8b1c210e431a92309
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Open_to_view.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
900 seconds
Behavioral task
behavioral2
Sample
Open_to_view.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
900 seconds
Behavioral task
behavioral3
Sample
winhttp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
900 seconds
Behavioral task
behavioral4
Sample
winhttp.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
900 seconds
General
- Target Open_to_view_3613.iso
- Size 284KB
- Sample261020-getcaavy9l
- SHA256 1f6466a3d23b93a21970a3b8964b353aab420eaccaacf2e8b1c210e431a92309
- MD5 84877387a57417b858a688250430e843
- SHA1 1dacbdae3ed74f740cbef6458c344dfae9182676
- SHA512 561b73379986c0bfe24f6c38d5e9d69d8321fee769a1f78833d4ba54ca776519c6ecf5e49a8da3ef88358c71e358b42254c39f05bb7fea318ffb27c82b743fe1
- SSDEEP 6144:Dk/XCxuuG0J8J4iCIPea0rqWv/iFVB6I3dpe2x3AWG5bDF3bMK7sD4Z0eLKj5UJ3:w/aRJZ4Pea/vFf6I3dpe2x3AWG5bDF3b
- TLSH T16B54F143C7A728C0DD3BE17096A2F727993478054785DD4E728D8B2A9F46BC07B39D2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/winhttp.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/winhttp.dll
File Explorer
-
Open_to_view_3613.iso.iso 284KB
-
out.iso.iso 284KB
-
Open_to_view.exe.exe 25KB
-
winhttp.dll.dll 208KB
out.iso
- SHA256 1f6466a3d23b93a21970a3b8964b353aab420eaccaacf2e8b1c210e431a92309
- MD5 84877387a57417b858a688250430e843
- SHA1 1dacbdae3ed74f740cbef6458c344dfae9182676
- SHA512 561b73379986c0bfe24f6c38d5e9d69d8321fee769a1f78833d4ba54ca776519c6ecf5e49a8da3ef88358c71e358b42254c39f05bb7fea318ffb27c82b743fe1
- SSDEEP 6144:Dk/XCxuuG0J8J4iCIPea0rqWv/iFVB6I3dpe2x3AWG5bDF3bMK7sD4Z0eLKj5UJ3:w/aRJZ4Pea/vFf6I3dpe2x3AWG5bDF3b
- TLSH T16B54F143C7A728C0DD3BE17096A2F727993478054785DD4E728D8B2A9F46BC07B39D2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Open_to_view.exe
- IMPHASH efbc5d32d2077e678dc0b30693365b4b
- SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
- MD5 e6363b8ec386338ce08f159a739f0e97
- SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
- SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
- SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
- TLSH T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
28:b5:61:e5:83:23:1a:d6:93:68:f0:42:ed:02:d7:01:f6:cb:0f:f2:5d:76:04:26:a4:89:a7:8e:67:0e:95:2d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 22, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:03:bd:d5:95:5d:0f:3b:18:ad:00:00:00:00:04:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ff:12:38:7c:f7:c1:65:d6:a1:00:01:00:00:01:ff
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
4336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\b\amd64\tls12-download.pdb
winhttp
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpOpen
wintrust
WinVerifyTrust
shell32
CommandLineToArgvW
kernel32
CloseHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
WriteConsoleW
WideCharToMultiByte
FormatMessageW
GlobalFree
GetModuleHandleW
GetStdHandle
GetCommandLineW
GetEnvironmentVariableW
CreateFileW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointer
WriteFile
IsProcessorFeaturePresent
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
TerminateProcess
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=259, version=34321,
count=1, id=261, version=34321,
count=5, id=260, version=34321,
count=9, id=257, version=33140,
count=42, id=1, productName=Unmarked objects,
count=1, id=260, version=34438,
count=1, id=255, version=34438,
count=1, id=258, version=34438,
winhttp.dll
- IMPHASH 865e9a28ae5592612df978af42d38149
- SHA256 14e261553c4dba16c53a50b6f1409858f7a897d1c2314e94d222273527452e34
- MD5 4c04e19fccf02a49cb1eeadbbd5a7511
- SHA1 a3a16f96f5c1771aed7445d12d07d7a8ca74196b
- SHA512 5a8792e8433af2f2832196a8b55e75e3ea7aec6b18c19b2b7fb16b58615460d7e71ef9813474b19dc90de5bb97266db6470637d877494404e6bf569b49ba349e
- SSDEEP 6144:0XCxuuG0J8J4iCIPea0rqWv/iFVB6I3dpe2x3AWG5bDF3bMK7sD4Z0eLKj5UJPX/:0aRJZ4Pea/vFf6I3dpe2x3AWG5bDF3bP
- TLSH T118240243C7A73DC4DD3BF2705AA3B73B96307805864ADC4947814F6AAD4AAC03779C6A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcessHeap
HeapAlloc
HeapFree
GetModuleHandleA
GetProcAddress
LoadLibraryExW
CreateMutexW
CloseHandle
GetSystemInfo
GetLocalTime
GlobalMemoryStatusEx
GetTickCount
LoadLibraryA
FreeLibrary
DebugCreate
DllCanUnloadNow
DllGetClassObject
Private1
SvchostPushServiceGlobals
WinHttpAddRequestHeaders
WinHttpAddRequestHeadersEx
WinHttpAutoProxySvcMain
WinHttpCheckPlatform
WinHttpCloseHandle
WinHttpConnect
WinHttpConnectionDeletePolicyEntries
WinHttpConnectionDeleteProxyInfo
WinHttpConnectionFreeNameList
WinHttpConnectionFreeProxyInfo
WinHttpConnectionFreeProxyList
WinHttpConnectionGetNameList
WinHttpConnectionGetProxyInfo
WinHttpConnectionGetProxyList
WinHttpConnectionSetPolicyEntries
WinHttpConnectionSetProxyInfo
WinHttpConnectionUpdateIfIndexTable
WinHttpCrackUrl
WinHttpCreateProxyResolver
WinHttpCreateUrl
WinHttpDetectAutoProxyConfigUrl
WinHttpFreeProxyResult
WinHttpFreeProxyResultEx
WinHttpFreeProxySettings
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpGetProxyForUrlEx
WinHttpGetProxyForUrlEx2
WinHttpGetProxyForUrlHvsi
WinHttpGetProxyResult
WinHttpGetProxyResultEx
WinHttpGetProxySettingsVersion
WinHttpGetTunnelSocket
WinHttpOpen
WinHttpOpenRequest
WinHttpPacJsWorkerMain
WinHttpProbeConnectivity
WinHttpQueryAuthSchemes
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpQueryOption
WinHttpReadData
WinHttpReadProxySettings
WinHttpReadProxySettingsHvsi
WinHttpReceiveResponse
WinHttpResetAutoProxy
WinHttpSaveProxyCredentials
WinHttpSendRequest
WinHttpSetCredentials
WinHttpSetDefaultProxyConfiguration
WinHttpSetOption
WinHttpSetProxySettingsPerUser
WinHttpSetSecureLegacyServersAppCompat
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpTimeFromSystemTime
WinHttpTimeToSystemTime
WinHttpWebSocketClose
WinHttpWebSocketCompleteUpgrade
WinHttpWebSocketQueryCloseStatus
WinHttpWebSocketReceive
WinHttpWebSocketSend
WinHttpWebSocketShutdown
WinHttpWriteData
WinHttpWriteProxySettings
Name
.code
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.cdata
Size
177KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rodata
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ