iexplore[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
iexplore.exe
Size 817KB
Sample261022-tyslbaf16q
SHA256 254f32e153f83e5f32060d270402ecfbdd5ee0d9088276d81abd24c2e13ba7ea
MD5 fc4ce1e98125e7e30af6bc2d4a10250d
SHA1 cc7e3f18771a3944cb08eca03ae7d5062b911ffd
SHA512 22f9eed7ed428b143cee4b798ad63d56880e2aba8454d62e56045afc9c2e86e64534a9431440ded5db0292626efe5f7891ef79bca629e93df9b8b699ce4cd525
SSDEEP 24576:b5P4lGLbMMHMMMvMMZMMMKzb6XmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMUMMVd:bHMMHMMMvMMZMMMlmMMMiMMMYJMMHMML
TLSH
T199056C42F7C8D495E0B706318933CB654672FC659E20866F3199771E2E723C36AB2E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

iexplore.exe

.exe 817KB

iexplore.exe

IMPHASH 7534c642bdcb1528e25e71d0ce72d8bb
SHA256 254f32e153f83e5f32060d270402ecfbdd5ee0d9088276d81abd24c2e13ba7ea
MD5 fc4ce1e98125e7e30af6bc2d4a10250d
SHA1 cc7e3f18771a3944cb08eca03ae7d5062b911ffd
SHA512 22f9eed7ed428b143cee4b798ad63d56880e2aba8454d62e56045afc9c2e86e64534a9431440ded5db0292626efe5f7891ef79bca629e93df9b8b699ce4cd525
SSDEEP 24576:b5P4lGLbMMHMMMvMMZMMMKzb6XmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMUMMVd:bHMMHMMMvMMZMMMlmMMMiMMMYJMMHMML
TLSH
T199056C42F7C8D495E0B706318933CB654672FC659E20866F3199771E2E723C36AB2E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

bc:05:d9:54:b9:17:9d:6d:2c:d8:87:a2:bc:41:05:2a:57:33:22:4e:7e:97:83:b6:0b:33:b0:ec:1d:b7:53:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 8, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:a6:58:10:67:4b:3d:6c:7c:f6:00:00:00:00:05:a6

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2024 - Jul 5, 2025

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f9:1f:67:8d:75:ab:a4:f1:b1:00:01:00:00:01:f9

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

10352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

iexplore.pdb

user32

GetWindowThreadProcessId AllowSetForegroundWindow FindWindowExW SendMessageTimeoutW IsWindowVisible SetUserObjectInformationW IsWindowEnabled

msvcrt

_onexit __dllonexit _unlock _lock memset _commode __C_specific_handler _vsnwprintf memcpy_s iswspace ?terminate@@YAXXZ _purecall memmove_s _fmode _wcmdln _initterm __setusermatherr _cexit _exit exit __set_app_type wcsncmp free _XcptFilter _amsg_exit __wgetmainargs memcmp

kernel32

CreateThreadpoolTimer ReleaseSRWLockShared SetThreadpoolTimer CloseHandle HeapSetInformation WaitForSingleObjectEx DelayLoadFailureHook ResolveDelayLoadedAPI GetProcAddress HeapAlloc OpenSemaphoreW IsDebuggerPresent AcquireSRWLockExclusive GetTickCount GetSystemTimeAsFileTime QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStartupInfoW Sleep CloseThreadpoolTimer SetDllDirectoryW DebugBreak GetModuleHandleW GetProcessHeap GetCurrentProcessId DeleteCriticalSection AcquireSRWLockShared LocalFree GetModuleFileNameA CreateSemaphoreExW HeapFree SetLastError EnterCriticalSection GetCommandLineW GetCurrentProcess ReleaseSemaphore GetModuleHandleExW TerminateProcess LeaveCriticalSection InitializeCriticalSection SetErrorMode InitializeCriticalSectionEx WaitForThreadpoolTimerCallbacks WaitForSingleObject LocalAlloc GetCurrentThreadId ReleaseMutex FormatMessageW GetLastError ReleaseSRWLockExclusive OutputDebugStringW CreateMutexExW

api-ms-win-downlevel-advapi32-l1-1-0

RegGetValueW EventRegister EventWriteTransfer EventWriteEx EventUnregister

api-ms-win-downlevel-shell32-l1-1-0

SetCurrentProcessExplicitAppUserModelID

advapi32

EventSetInformation

iertutil

ord650 ord791 ord797 ord798 ord701 ord597 ord796 ord793 ord594 ord398

api-ms-win-downlevel-shlwapi-l1-1-0

StrStrIW

api-ms-win-downlevel-ole32-l1-1-0

CoCreateGuid

Name

.text

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

757KB

Virtual Size

757KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

iexplore.exe

user32

msvcrt

kernel32

api-ms-win-downlevel-advapi32-l1-1-0

api-ms-win-downlevel-shell32-l1-1-0

advapi32

iertutil

api-ms-win-downlevel-shlwapi-l1-1-0

api-ms-win-downlevel-ole32-l1-1-0

generic