cea292e0e6bea388c992cc6d3e6306454c35b01a6e0546e1ccd64962126eb723
- SHA256 cea292e0e6bea388c992cc6d3e6306454c35b01a6e0546e1ccd64962126eb723
Password
infected
Behavioral task
behavioral1
Sample
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target cea292e0e6bea388c992cc6d3e6306454c35b01a6e0546e1ccd64962126eb723
- Size 534KB
- Sample261020-jdl8paaz3k
- SHA256 cea292e0e6bea388c992cc6d3e6306454c35b01a6e0546e1ccd64962126eb723
- MD5 4b7f7f4b5511024dce7853ee161aabbf
- SHA1 9e1db1c904e094585e5bfec6257303893754a984
- SHA512 3047ca1a16f2529087da108b2cbbf2f012c78565e5369c2fe312ef2df7700520e99c5fca30385bab4eeaa17b0b254f96908b10517bf7a4f4f630e12304defc20
- SSDEEP 12288:JyUxSA+TZN/+ZY06ZRfbUuBSeC6cvlwOIMlIJ3Y7MfL:JrOPWWNZRPSel0ZlIxYQz
- TLSH T1F2C43339AFCA9A3CD04689ABD543B032AD90F49036B7D4740DFEA805EB885C34D96C93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Revoked Certificate in Chain 1 IoCs
One or more certificates in the signing chain have been revoked, indicating potential compromise.
resource unpack001/1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
File Explorer
-
cea292e0e6bea388c992cc6d3e6306454c35b01a6e0546e1ccd64962126eb723.zip 534KB
-
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe.exe 910KB
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
- IMPHASH 1179c043cd6766729406d435a48c9499
- SHA256 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e
- MD5 18786bfac1be0ddf23ff94c029ca4d63
- SHA1 3c2b0dcdb2a46fc1ec0a12a54309e35621caa925
- SHA512 49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f
- SSDEEP 24576:VRjxskD1HtqZ+p53DVJ3Bpv256HDtMTeWDqQE:Jd2+Pf28SR3E
- TLSH T17F15BF03FAC184B2F5DF053921B3977A8D3AAE109728DAD39B9078658D312D06B3F795
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
PE Signature issue
Digest
ef:20:55:78:b4:76:d8:c8:cd:d7:09:96:f1:a8:fc:03:1e:22:11:9a:f6:ff:95:3d:2d:d8:db:c9:44:7f:ae:cb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=OOO Dibies,O=OOO Dibies,L=St. Petersburg,C=RU
Chains
Oct 15, 2026
CN=OOO Dibies,O=OOO Dibies,L=St. Petersburg,C=RU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=OOO Dibies,O=OOO Dibies,L=St. Petersburg,C=RU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=OOO Dibies,O=OOO Dibies,L=St. Petersburg,C=RU
Serial Number
08:d4:dc:90:04:7b:84:70:cc:af:39:24:df:bd:8b:5f
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Apr 23, 2021
Timespan
Apr 23, 2021 - Apr 23, 2022
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 12, 2019 - Dec 31, 2028
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 2, 2018 - Dec 31, 2030
Minor OS version
1
Major OS version
5
Entry point
5189
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WriteFile
lstrcatA
GetTempPathA
CreateFileA
LockResource
CloseHandle
LoadResource
FindResourceW
CreateProcessA
CreateFileW
DecodePointer
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetFileType
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
RaiseException
user32
wsprintfA
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
835KB
Virtual Size
835KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=121, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=17, id=260, version=24237,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=92, id=1, productName=Unmarked objects,
count=2, id=264, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,