754551a01047cc702250e2393e7fbbdffd59287ea9caea7d7f8074ce6b1e5f18

Sharing

Copy URL Twitter E-mail

General

Target
754551a01047cc702250e2393e7fbbdffd59287ea9caea7d7f8074ce6b1e5f18
Size 640KB
Sample261024-aae6jav18l
SHA256 754551a01047cc702250e2393e7fbbdffd59287ea9caea7d7f8074ce6b1e5f18
MD5 e21ec97e7db5d83bdf5e69f6e70ac26f
SHA1 c0a4335b83da94886a4918b39df98589b4876fc6
SHA512 ee3b6e51d41caedba22032db346e97fdbafd95143777eddf619bd217cf86febf5305cf5785f3516d1b75fe6a18931a0cd8d8c16fe3c828f8ebb98ae24fb25cdd
SSDEEP 12288:WjC0aFhywb1QD8Lh6j/NotLXHSOPfSyd/CH5kCAbcV4V6BjvrEH7uW:WjC00hywhQD8Lwj/ilXHSOPay4ZYi4VD
TLSH
T139D44B01B3D50295F5F31A70AABA2B9A45797D3A6F3CD0CFC740795D28702E29A39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
754551a01047cc702250e2393e7fbbdffd59287ea9caea7d7f8074ce6b1e5f18

File Explorer

754551a01047cc702250e2393e7fbbdffd59287ea9caea7d7f8074ce6b1e5f18

.dll 640KB

754551a01047cc702250e2393e7fbbdffd59287ea9caea7d7f8074ce6b1e5f18

IMPHASH b1bd95c4c60a3347381b657bf19224ea
SHA256 754551a01047cc702250e2393e7fbbdffd59287ea9caea7d7f8074ce6b1e5f18
MD5 e21ec97e7db5d83bdf5e69f6e70ac26f
SHA1 c0a4335b83da94886a4918b39df98589b4876fc6
SHA512 ee3b6e51d41caedba22032db346e97fdbafd95143777eddf619bd217cf86febf5305cf5785f3516d1b75fe6a18931a0cd8d8c16fe3c828f8ebb98ae24fb25cdd
SSDEEP 12288:WjC0aFhywb1QD8Lh6j/NotLXHSOPfSyd/CH5kCAbcV4V6BjvrEH7uW:WjC00hywhQD8Lwj/ilXHSOPay4ZYi4VD
TLSH
T139D44B01B3D50295F5F31A70AABA2B9A45797D3A6F3CD0CFC740795D28702E29A39713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

78:23:8a:87:8d:06:10:8e:a5:45:87:7e:5f:e3:47:95:c0:0c:ab:92:e3:1f:ac:c8:8b:af:22:5e:86:f0:fb:14

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=IP Zinukhov Stanislav Igorevich,O=IP Zinukhov Stanislav Igorevich,L=Moscow,ST=Moscow,C=RU

Chains

Dec 10, 2025

CN=IP Zinukhov Stanislav Igorevich,O=IP Zinukhov Stanislav Igorevich,L=Moscow,ST=Moscow,C=RU

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=IP Zinukhov Stanislav Igorevich,O=IP Zinukhov Stanislav Igorevich,L=Moscow,ST=Moscow,C=RU

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=IP Zinukhov Stanislav Igorevich,O=IP Zinukhov Stanislav Igorevich,L=Moscow,ST=Moscow,C=RU

Serial Number

7b:31:a2:f5:bf:ea:8e:58:3e:b8:18:8c

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 15, 2025 - Mar 10, 2027

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

5562

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\DEVEL\StartIsBackPlusPlus\Release\StartIsBack32.pdb

shlwapi

ord487 StrCmpNIW StrCpyNW StrNCatW PathParseIconLocationW PathAddBackslashW StrStrIW UrlIsW PathCreateFromUrlW PathFindExtensionW StrCmpNW SHOpenRegStream2W ord12 PathRemoveBlanksW SHGetValueW StrCmpW SHCreateStreamOnFileW PathFindFileNameW PathFileExistsW PathRemoveBackslashW StrToIntW ord16 PathRemoveFileSpecW PathAppendW SHRegGetValueW SHSetValueW StrStrW PathIsRelativeW ord172 PathIsDirectoryW PathIsUNCW ord174 ord256 PathIsFileSpecW PathStripToRootW PathIsRootW ord168 StrCmpIW PathIsNetworkPathW ord388 ord184 ord512 ord212 ord513 ord176 ord215 ord158 StrStrIA StrCSpnA SHStrDupW

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute DwmExtendFrameIntoClientArea

uxtheme

SetWindowTheme BeginBufferedPaint EndBufferedPaint OpenThemeData GetThemeInt DrawThemeTextEx CloseThemeData GetThemeColor DrawThemeBackground DrawThemeParentBackground BufferedPaintSetAlpha GetThemeBackgroundContentRect ord47 GetThemePartSize GetBufferedPaintTargetDC GetThemeEnumValue GetThemeFont GetThemeBool GetThemeRect GetThemeTextExtent GetThemeMargins GetCurrentThemeName IsThemeBackgroundPartiallyTransparent GetThemeBackgroundRegion GetThemePropertyOrigin IsThemePartDefined GetWindowTheme GetThemeMetric GetThemeBackgroundExtent

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-core-winrt-l1-1-0

RoActivateInstance RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference WindowsGetStringRawBuffer WindowsDuplicateString WindowsDeleteString

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

msvcrt

wcscpy_s wcscat_s malloc free _vsnwprintf isspace _wcsnicmp isprint wcstok_s abort wcsstr vswprintf_s _wcsicmp ??3@YAXPAX@Z atoi _unlock __dllonexit _lock _onexit __CxxFrameHandler3 _XcptFilter _initterm _amsg_exit memmove _except_handler4_common wcsncmp vsprintf_s ??2@YAPAXI@Z tolower wcschr memcpy memcmp memset

kernel32

ExitThread SleepEx TerminateProcess IsBadReadPtr GetUserDefaultLangID FindResourceW GlobalLock GetPrivateProfileStringW MapViewOfFile UnmapViewOfFile ReleaseMutex CreateMutexW lstrcatW lstrcpynW GetApplicationUserModelId OpenProcess GetWindowsDirectoryW LoadLibraryW DeleteFileW MoveFileExW LocalAlloc LocalFree TlsAlloc TlsGetValue TlsSetValue QueueUserWorkItem CompareStringOrdinal CompareFileTime GetTempPathW SetFileAttributesW GetFileAttributesW CreateDirectoryW RemoveDirectoryW lstrcmpiA SetUnhandledExceptionFilter GetCurrentProcessId ProcessIdToSessionId FindPackagesByPackageFamily PackageFamilyNameFromFullName GetModuleFileNameW OpenMutexW GetVersionExW GlobalUnlock DisableThreadLibraryCalls GetModuleHandleExW RtlCaptureContext GetUserDefaultUILanguage GetComputerNameExW OpenEventW LoadResource SizeofResource DebugBreak lstrcpynA InterlockedExchange InterlockedCompareExchange QueryPerformanceCounter UnhandledExceptionFilter GetLastError LoadLibraryA GetPrivateProfileIntW GlobalAddAtomW OutputDebugStringA GetSystemWindowsDirectoryW GetVolumeNameForVolumeMountPointW lstrlenW CreateFileW DeviceIoControl CloseHandle lstrcpyA lstrlenA lstrcatA GetSystemTimeAsFileTime FileTimeToSystemTime lstrcpyW lstrcmpiW GetUserPreferredUILanguages MulDiv VirtualProtect GetFileAttributesExW WaitForSingleObject CreateThread SetThreadPriority Sleep GetTickCount GetModuleHandleW GetCurrentThreadId GetAtomNameW lstrcmpW CreateThreadpoolWork InitializeCriticalSection WaitForThreadpoolWorkCallbacks CloseThreadpoolWork EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetCurrentThread SubmitThreadpoolWork ExpandEnvironmentStringsW GetCurrentProcess CreateProcessW CreateFileA GetSystemFirmwareTable GlobalAlloc GlobalFree GetProcAddress LoadLibraryExW FreeLibrary QueueUserAPC SetEvent RaiseException CreateEventW ParseApplicationUserModelId GetPackagesByPackageFamily FindFirstFileW FindNextFileW FindClose MoveFileW InitOnceExecuteOnce RegisterWaitForSingleObject UnregisterWaitEx FindNextChangeNotification FindFirstChangeNotificationW FindCloseChangeNotification DeleteTimerQueueTimer CreateTimerQueueTimer

user32

EndDeferWindowPos IsWindowVisible GetWindow MapWindowPoints LockSetForegroundWindow GetFocus IsWindow SetFocus SetLayeredWindowAttributes PeekMessageW SystemParametersInfoW NotifyWinEvent ShowWindow GetParent DispatchMessageW GetMessagePos WindowFromPoint ScreenToClient ClientToScreen TrackMouseEvent GetCapture GetNextDlgGroupItem CreatePopupMenu InsertMenuW LoadMenuW GetMenuStringW GetSubMenu DestroyMenu CheckMenuItem RegisterWindowMessageW GetClassWord GetSystemMetrics BeginDeferWindowPos PrintWindow GetAsyncKeyState SendNotifyMessageW CallNextHookEx SetWinEventHook UnhookWinEvent SetWindowsHookExW TrackPopupMenuEx IsCharAlphaNumericA RegisterClassExW DestroyIcon PostQuitMessage GetCursorPos MonitorFromPoint GetWindowTextW SetWindowTextW MsgWaitForMultipleObjectsEx SetCursor SetMenuDefaultItem CreateDialogParamW GetDlgItemTextW SetDlgItemTextW IntersectRect SendDlgItemMessageW DrawFocusRect EndDialog GetSysColorBrush GetActiveWindow SetMenuInfo GetMenuItemCount GetMenuItemInfoW DeleteMenu SetMenuItemInfoW TrackPopupMenu TranslateMessage GetMenuItemID GetMenuDefaultItem GetDC PtInRect InvalidateRect GetMenuState ExitWindowsEx GetDoubleClickTime EnableWindow WindowFromDC CallWindowProcW CharLowerW SetCapture ReleaseCapture DrawTextW FillRect IsRectEmpty EqualRect ModifyMenuW EnumDisplayMonitors DrawEdge DrawTextExW LoadImageW GetRawInputDeviceInfoW GetRawInputData RegisterRawInputDevices GetMessageW GetRawInputDeviceList EnumThreadWindows DrawIconEx UnionRect UnregisterClassW MonitorFromRect SetForegroundWindow GetWindowRgnBox GetLayeredWindowAttributes IsIconic GetForegroundWindow SetRectEmpty EnumWindows CheckDlgButton IsDlgButtonChecked OpenClipboard EmptyClipboard SetClipboardData CloseClipboard SetCursorPos UnhookWindowsHookEx UnregisterHotKey RegisterHotKey AllowSetForegroundWindow SwitchToThisWindow SetActiveWindow RegisterClipboardFormatW GetMessageExtraInfo ChildWindowFromPointEx LookupIconIdFromDirectoryEx PostThreadMessageW SetRect GetMonitorInfoW RegisterClassW LoadCursorW DestroyWindow SetWindowLongW GetWindowRgn UpdateLayeredWindow GetWindowDC MonitorFromWindow IsChild GetGUIThreadInfo GetAncestor DefWindowProcW RemovePropW GetWindowLongW SetWindowPos SetTimer FindWindowW KillTimer GetShellWindow CreateWindowExW GetWindowThreadProcessId FindWindowExW DialogBoxParamW EndPaint OffsetRect GetWindowRect GetWindowInfo BeginPaint SetPropW GetPropW GetDlgItem GetComboBoxInfo GetClassNameW ReleaseDC GetDCEx PostMessageW SendMessageW RedrawWindow EnumChildWindows GetClientRect SetWindowRgn GetSysColor CreateIconIndirect GetKeyState wsprintfW LoadStringW wsprintfA DeferWindowPos InflateRect

gdi32

GetLayout GetCharWidth32W CreateFontW RestoreDC ExcludeClipRect SaveDC GdiFlush GetRgnBox CombineRgn CreateRectRgnIndirect GetStockObject ExtTextOutW CreateSolidBrush SetBkColor SetTextColor BitBlt SetLayout CreateRectRgn DeleteObject CreateBitmap DeleteDC GdiAlphaBlend GetObjectW SelectObject CreateCompatibleDC CreateDIBSection GetTextExtentExPointW OffsetClipRgn SelectClipRgn StretchBlt GetDeviceCaps StretchDIBits OffsetRgn GetBoundsRect SetBoundsRect GetClipBox GetCurrentObject GetBkMode SetBkMode GetBkColor GetTextColor TextOutW GetTextExtentPointW SetWindowOrgEx CreateFontIndirectW

advapi32

RegSetValueExA RegCloseKey RegQueryValueA RegOpenKeyExA RegCreateKeyExA RegQueryInfoKeyW RegCreateKeyW RegSetKeyValueW RegGetValueW RegDeleteKeyValueW RegOpenKeyExW RegEnumKeyW RegNotifyChangeKeyValue RegOpenKeyW RegSetValueExW RegDeleteValueW RegCreateKeyExW RegQueryValueExW RegDeleteKeyW InitiateShutdownW GetUserNameW RegQueryValueExA RegDeleteValueA

shell32

ord155 ord152 ord16 ord18 ord25 ord190 ord256 SHCreateDataObject SHCreateDefaultContextMenu AssocCreateForClasses SHCreateShellItemArrayFromIDLists SHCreateItemFromParsingName ord6 SHCreateShellItemArrayFromDataObject SHAssocEnumHandlers SHGetKnownFolderPath ord100 SHBindToObject ord846 ord27 ord21 ord68 SHGetKnownFolderIDList Shell_NotifyIconGetRect ShellExecuteW SHCreateItemInKnownFolder SHGetPropertyStoreForWindow SHGetIDListFromObject SHCreateItemFromIDList SHCreateDefaultExtractIcon SHGetFolderPathW SHChangeNotify SHGetNameFromIDList ord162 SHGetFileInfoW Shell_GetCachedImageIndexW SHOpenFolderAndSelectItems SHGetSpecialFolderPathW ord193 SHBindToParent ord22 ord134 ord132 ord23 ord727 ord17 SHGetFolderLocation SHGetDesktopFolder ord98 SHParseDisplayName ord88 ord644 ord645 ord4 ord2 SHGetStockIconInfo ord62 SHFileOperationW SHCreateItemWithParent

ole32

CoInitialize CoUninitialize CoWaitForMultipleHandles CoCreateFreeThreadedMarshaler CoGetInterfaceAndReleaseStream CoCreateInstance RegisterDragDrop RevokeDragDrop StringFromGUID2 ReleaseStgMedium CoInitializeEx CoMarshalInterThreadInterfaceInStream CoTaskMemAlloc CoTaskMemFree PropVariantClear

Sharing

General

Malware Config

Signatures

File Explorer

754551a01047cc702250e2393e7fbbdffd59287ea9caea7d7f8074ce6b1e5f18

PE Signature issue

shlwapi

dwmapi

uxtheme

api-ms-win-shcore-scaling-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

generic