23102026_0352_22102026_DocumentViewer.exe.iso
- SHA256 7235294aed6da36aadf88f42c43c8df540fb1737f1406c3e6dc1c470a3f5996a
Password
infected
Overview
overview
7Static
static
3DocumentViewer.exe
windows10-2004-x64
1DocumentViewer.exe
windows11-ltsc_2024-x64
1Invoice.pdf.lnk
windows10-2004-x64
7Invoice.pdf.lnk
windows11-ltsc_2024-x64
3Invoice_details.pdf
windows10-2004-x64
3Invoice_details.pdf
windows11-ltsc_2024-x64
3d440f.cmd
windows10-2004-x64
7d440f.cmd
windows11-ltsc_2024-x64
7Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DocumentViewer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
DocumentViewer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
Invoice.pdf.lnk
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral4
Sample
Invoice.pdf.lnk
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
Invoice_details.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral6
Sample
Invoice_details.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
300 seconds
Behavioral task
behavioral7
Sample
d440f.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral8
Sample
d440f.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
300 seconds
General
- Target 23102026_0352_22102026_DocumentViewer.exe.iso
- Size 120KB
- Sample261023-efdbcahv6x
- SHA256 7235294aed6da36aadf88f42c43c8df540fb1737f1406c3e6dc1c470a3f5996a
- MD5 7e1fc46d92ed9d16c469cee63ef22431
- SHA1 a01482569302d2f287dd3d0551da603a9bad5d74
- SHA512 2bb960e399d2f41c87c47749a6d56e6f69582e1b071c3e69287f07114d34148bde35cbf0b54e2a37f1c70a063d278122a2311accc86734bf6ce7a751c72b1076
- SSDEEP 768:ViZUk87FL48sgkdLQiK+t3SJttrNF5b7Ps2iV2+:Vg45SgkaS3WTs2iV
- TLSH T15AC364E17ED84CC7E960623855EAD2223A3EF9D08AA34707B52C16311F13FC16ED9796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/DocumentViewer.exe
File Explorer
-
23102026_0352_22102026_DocumentViewer.exe.iso.iso 120KB
-
out.iso.iso 120KB
-
DocumentViewer.exe.exe 60KB
-
Invoice.pdf.lnk.lnk 2KB
-
Invoice_details.pdf.pdf 721B
-
d440f.cmd.cmd .bat 295B
out.iso
- SHA256 7235294aed6da36aadf88f42c43c8df540fb1737f1406c3e6dc1c470a3f5996a
- MD5 7e1fc46d92ed9d16c469cee63ef22431
- SHA1 a01482569302d2f287dd3d0551da603a9bad5d74
- SHA512 2bb960e399d2f41c87c47749a6d56e6f69582e1b071c3e69287f07114d34148bde35cbf0b54e2a37f1c70a063d278122a2311accc86734bf6ce7a751c72b1076
- SSDEEP 768:ViZUk87FL48sgkdLQiK+t3SJttrNF5b7Ps2iV2+:Vg45SgkaS3WTs2iV
- TLSH T15AC364E17ED84CC7E960623855EAD2223A3EF9D08AA34707B52C16311F13FC16ED9796
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
DocumentViewer.exe
- IMPHASH 24dab01e284fca937f9ea068ede60a40
- SHA256 ff6d46571ab235df9b818b07b08057da61f3e4769b14f666dcf2b026665948da
- MD5 bf0cd26158a2799089a4bbc97129528e
- SHA1 af1f6b16d344842aa5f1323ba2aff367a8210c10
- SHA512 301cbf32f1a92a1cb329c4efa2e97cf3c006fbbcca82cf7ce9e2f1588570dbb9a479bd11d1b4c6a73d116672bdad4f4568473cc799f050f625ea0394b22cf431
- SSDEEP 768:787FL48sgkdLQiK+t3SJttrNF5b7Ps2iV2+8:A5SgkaS3WTs2iV8
- TLSH T16D5372E57ED95CC6ED20633C66EAC221373DFAE08A434B47E52026311B13FD16ED9296
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
4191
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CloseHandle
CreateFileA
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GetTempPathA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WriteFile
api-ms-win-crt-environment-l1-1-0
__p__environ
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-private-l1-1-0
__C_specific_handler
memcpy
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_initialize_narrow_environment
_set_app_type
_initterm
_initterm_e
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
fflush
setvbuf
api-ms-win-crt-string-l1-1-0
strlen
strncmp
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/14
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
512B
Virtual Size
202B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/80
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/91
Size
512B
Virtual Size
330B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Invoice.pdf.lnk
- SHA256 2b4daeb6c406fbc7e5227e4e400a5816b9773493257449ed0a650949fd88d747
- MD5 06672bbeba0b61924a7274aa9ee72d29
- SHA1 925bdd2847ffbdfae0800eab660053de8316fc09
- SHA512 01a0d54a4beedd15f2dac5f7e2597776be6b897062602a95cdd83dcc301b9ce4b5b8104b87fd1e191266fb1ff020e6c4bb373e95dd66ddb2ead9420fc99b02e6
- TLSH T12251B3704AAD8B97D3F35973ECEA621B4E7F684AE8B1571A264047CADD01F04AE25F04
- MD5 SHA1 SHA512 TLSH
Invoice_details.pdf
- SHA256 1737588654762a7a722c3120223757bea6527dff207ea8e21ff2fba030d98000
- MD5 c6632e835b6250f94f52684f10014290
- SHA1 692c4c1b4561d9aa323fbf434e3a9e7c22188299
- SHA512 3732894da73ebeb77d37c025d3ff08d8c6cf6b06748a9f47902957eedaf6f66fef7f80be68333c0d6163d4d244930c7cccd248b62335fa2bbc4a25e193d7608e
- TLSH T11101C019F99D5C5CFDC3C951B92F76DA1469710206DC34D2041E2B09A0C5DE9BA837F7
- MD5 SHA1 SHA512 TLSH
Password
infected
d440f.cmd
- SHA256 953304fef02d0386e6379b0262f4b5d02c36c23fdfc02dbe0eb0e5fc578a5e59
- MD5 51eadc27475cf54054a875725c8246e2
- SHA1 5663f9952898ea2c822850d7dcfd3f0b96b91a48
- SHA512 d613cac0c02d1d3ae1f58e53072eed4933b1c789e5be4e5f20ed53e1e0c00b850f93653688508237898687e1ba8f3f48f75327de0a6448c7838ffe97a0b4f8f2
- TLSH T1BCE012CA258F203DD8F805897616B6D6B68A92A7B3C9F7D8314D0566448FE15C5C9F02
- MD5 SHA1 SHA512 TLSH