XPFix[.]exe | Triage™

Resubmissions

23/10/2026, 23:26

261023-3ez1qav12k8

23/10/2026, 23:16

261023-288paaev7s5

Sharing

Copy URL Twitter E-mail

General

Target
XPFix.exe
Size 286KB
Sample261023-288paaev7s
SHA256 5ec174af8a18a5516b8a6e11d8a27481d70df14d1edb67c48b5458ff44df9146
MD5 810d42177538ad5ca18d4dd597c00658
SHA1 7374bbe63c44de9536c22cdc111894c6d4929eb3
SHA512 233cdbaa1658719e9e44869930aef8ed09a17bd1e227c43785ce1b4298fd9f767818b75888db9cb5184a134a0babedd32cc0788059c251a1dff3f6aa27ebd30d
SSDEEP 6144:WEDFuBN6zANskE9qgfyMEvt93L2kx3W71+KL:WiuB4fyzvtFt3WFL
TLSH
T164547E00B651C136F5F318768AFE9B79993DBD312B1551C363C40EAEBE22BE1793121A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
XPFix.exe

File Explorer

XPFix.exe

.exe 286KB

XPFix.exe

IMPHASH 5a058b4df04da1108ea582b3a3965f02
SHA256 5ec174af8a18a5516b8a6e11d8a27481d70df14d1edb67c48b5458ff44df9146
MD5 810d42177538ad5ca18d4dd597c00658
SHA1 7374bbe63c44de9536c22cdc111894c6d4929eb3
SHA512 233cdbaa1658719e9e44869930aef8ed09a17bd1e227c43785ce1b4298fd9f767818b75888db9cb5184a134a0babedd32cc0788059c251a1dff3f6aa27ebd30d
SSDEEP 6144:WEDFuBN6zANskE9qgfyMEvt93L2kx3W71+KL:WiuB4fyzvtFt3WFL
TLSH
T164547E00B651C136F5F318768AFE9B79993DBD312B1551C363C40EAEBE22BE1793121A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

dd:0c:40:33:1a:f5:52:90:34:96:49:b4:dc:02:6a:15:e9:d7:38:9e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Chains

Jan 21, 2015

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Serial Number

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 11, 2013 - Mar 10, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

133250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\34654\out\Release\360XPFix.pdb

kernel32

GetCurrentProcess InterlockedIncrement InterlockedDecrement LoadLibraryW GetModuleHandleW LeaveCriticalSection EnterCriticalSection FindResourceW SizeofResource LockResource LoadResource FindResourceExW lstrlenW InitializeCriticalSection MultiByteToWideChar LoadLibraryExW lstrcmpiW CloseHandle DeviceIoControl CreateFileW GetCurrentProcessId CreateProcessW GlobalFree GlobalAlloc ExitProcess TerminateProcess OpenProcess lstrlenA OutputDebugStringW GetFileSizeEx ReadFile GetCurrentThreadId SetLastError SetEnvironmentVariableA CompareStringW CompareStringA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetFilePointer FlushFileBuffers RaiseException GetModuleHandleA GetTickCount QueryPerformanceCounter FlushInstructionCache GetFileType SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation IsValidCodePage FindFirstFileW GetLastError FindNextFileW FindClose GetTempPathW GetTempFileNameW DeleteFileW FreeLibrary GetModuleFileNameW GetOEMCP GetACP GetCPInfo InitializeCriticalSectionAndSpinCount GetModuleFileNameA GetStdHandle GetConsoleMode GetConsoleCP WriteFile SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime GetSystemTimeAsFileTime SystemTimeToFileTime CreateFileA WideCharToMultiByte HeapSize HeapReAlloc HeapDestroy HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW CreateThread VirtualAlloc ExitThread SetCurrentDirectoryW GetProcAddress RtlUnwind Sleep TlsFree DeleteAtom FindAtomW TlsAlloc ReleaseMutex AddAtomW OpenThread GetStartupInfoA DeleteCriticalSection GetAtomNameW TlsSetValue WaitForSingleObject CreateMutexW SetStdHandle TlsGetValue GetSystemTime LocalFree InterlockedCompareExchange HeapFree GetProcessHeap HeapAlloc LoadLibraryA IsProcessorFeaturePresent VirtualFree FormatMessageW

user32

SetWindowLongW MessageBoxW GetActiveWindow GetClassInfoExW PeekMessageW GetMessageW TranslateMessage DispatchMessageW UnregisterClassA CreateWindowExW DefWindowProcW LoadCursorW RegisterClassExW CharNextW LoadIconW DestroyCursor DestroyIcon DisableProcessWindowsGhosting GetCursorPos FindWindowW ShowWindow SetForegroundWindow DestroyWindow CopyRect IsDialogMessageW SendMessageW SetActiveWindow KillTimer SetTimer GetClientRect SetWindowPos SetWindowTextW GetWindowLongW CallWindowProcW RegisterWindowMessageW PostMessageW

advapi32

RegDeleteValueW RegQueryValueExA RegDeleteKeyW RegCloseKey RegQueryInfoKeyW RegSetValueExW RegEnumKeyExW RegOpenKeyExW RegCreateKeyExW RegQueryValueExW

shell32

SHGetSpecialFolderPathW ShellExecuteExW ShellExecuteW

ole32

CreateStreamOnHGlobal CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize

oleaut32

VariantCopy DispCallFunc VarUI4FromStr VariantClear SysStringByteLen SysAllocStringByteLen VariantInit SysFreeString SysStringLen SysAllocString

shlwapi

PathCombineW PathRemoveFileSpecW SHGetValueW PathFileExistsW PathIsRelativeW PathAppendW SHSetValueW

comctl32

InitCommonControlsEx

gdiplus

GdipAlloc GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdipFree GdipDisposeImage GdipCloneImage GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM

imm32

ImmDisableIME

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueA

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

XPFix.exe

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

imm32

wintrust

crypt32

version

generic