26102026_1245_21102026_pdf_20261030261877000259_UEMG_2695200072295_installer.vhd.zip
- SHA256 1caf83cce32435d5536640cb5a57edd439c6d78f9bdcbafaa405fe4c8a400e30
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
pdf_20261030261877000259_UEMG_2695200072295_installer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral2
Sample
pdf_20261030261877000259_UEMG_2695200072295_installer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target 26102026_1245_21102026_pdf_20261030261877000259_UEMG_2695200072295_installer.vhd.zip
- Size 326KB
- Sample261026-py5tesdz2z
- SHA256 1caf83cce32435d5536640cb5a57edd439c6d78f9bdcbafaa405fe4c8a400e30
- MD5 7948d7c214255d76a4956e28822f525f
- SHA1 f3bd32246d57af5bce170fc2148c4021f8e2079b
- SHA512 a29c2182df562ca95d754d03e21b9e8e026223e7d396face916f66e33df68cc432ef5934640db413b8fa2b400d31a5b5b3bcd194fe5a34a3d9aaafb5ca8839ed
- SSDEEP 6144:ckZ6YuJRwqSf28z2PpltDyitvt9UuLNnCBlTpYkmi:/gYuLwHfTiPpltei6uLZYVEi
- TLSH T11E64E05571E1B62AFFCF933285D20E65CF0D092458BEF2E89A42F118B1EB0E9E749135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
26102026_1245_21102026_pdf_20261030261877000259_UEMG_2695200072295_installer.vhd.zip.zip 326KB
-
pdf_20261030261877000259_UEMG_2695200072295_installer.vhd.vhd 15.0MB
-
System Volume Information/WPSettings.dat12B
-
pdf_20261030261877000259_UEMG_2695200072295_installer.exe.exe 409KB
-
pdf_20261030261877000259_UEMG_2695200072295_installer.exe:Zone.Identifier27B
pdf_20261030261877000259_UEMG_2695200072295_installer.vhd
- SHA256 c6001389f70ac67a8ca27bc90b02738917ab2106d9c2039e11b3235cada4c111
- MD5 54e62cbbdbd1c87390a54898353e40ec
- SHA1 880ce3afa6eb2d3777adf61b004d9eec9f9b5515
- SHA512 7cd41552da87673aae72679e4cbc980f9a8fb23dfc7a9ad006ac1498556d277cb47d855cc512d185353eba4c5bab85bc68909fb6ee1cb349a34087d38c258d79
- SSDEEP 6144:KrZn7y/EGuH/cpiSWSS6oFSQIWrD/s2vNCu8pfozBM6+0YIeOMSmWbOh:yUDuH/c8PrD/s21L8azmV0YIeOMSmf
- TLSH T17FF65B22F7904967D16EA734C5EA4716B776FC090712838BA718B3A52F737E40E39B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
System Volume Information/WPSettings.dat
- SHA256 9df238b4033295c9203485322692b2670d689cf915e08c931d77f855d3ff33ca
- MD5 37e8ca86f61e7ecffed3b048bc56269b
- SHA1 7556a7b223cbcbf78fa3646ee2d4f4d6e987cad6
- SHA512 a12a055d43745445667f491cb2721d520a3925a43257ad76a4607c1d48da73ea8457562a9a24e60c7c1369c400f192da7ab0e215e02c3ed1a655293ba7f17b8c
- MD5 SHA1 SHA512
pdf_20261030261877000259_UEMG_2695200072295_installer.exe
- IMPHASH 6d3915dd68cef7e92148629bee793faf
- SHA256 4611af15cd184ddde36d5cb1dbcef1e20cd8768f333e282f042962126ffde33e
- MD5 7c961248a9baf6e10a07a21e1a8345de
- SHA1 d08086543119d03dc8ce8f4b0213c10ba65966c4
- SHA512 e8f5c83778260e554a142f6fc4faccba406a1520277082d63f5406777f48c7a47e6a12c245b5c80076658b7e50c03e159f4dd25f91c3012724404084c2ff3b58
- SSDEEP 6144:0SS6oFSQIWrD/s2vNCu8pfozBM6+0YIeOMSmWbOh:arD/s21L8azmV0YIeOMSmf
- TLSH T1D894AF5AEAA405F9D17B9234C9A64607FB723C590360DACF43A84AE22F237D05F3DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
1f:99:2b:f7:e5:b4:db:e7:37:ca:ad:54:68:9c:28:d4:80:4e:29:93:73:ad:a7:0e:50:ad:da:af:1a:b9:30:03
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Changwen Li,O=Changwen Li,L=Qinhuangdao,ST=Hebei,C=CN
Chains
Oct 22, 2026
CN=Changwen Li,O=Changwen Li,L=Qinhuangdao,ST=Hebei,C=CN
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Changwen Li,O=Changwen Li,L=Qinhuangdao,ST=Hebei,C=CN
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Digest
b8:c8:85:e5:08:c5:15:30:f5:69:80:fe:c4:76:10:7a:ef:8e:7b:5d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Changwen Li,O=Changwen Li,L=Qinhuangdao,ST=Hebei,C=CN
Chains
Oct 22, 2026
CN=Changwen Li,O=Changwen Li,L=Qinhuangdao,ST=Hebei,C=CN
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Changwen Li,O=Changwen Li,L=Qinhuangdao,ST=Hebei,C=CN
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
61:3b:c7:91:00:00:00:00:00:34
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 31, 2021 - Sep 17, 2029
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=Changwen Li,O=Changwen Li,L=Qinhuangdao,ST=Hebei,C=CN
Serial Number
75:86:7f:08:ae:09:87:f7:b1:7c:ba:1f:40:83:df:ad
Issuer
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 1, 2026 - Apr 1, 2027
Subject
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Subject
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
72:94:04:10:1f:3e:0c:a3:47:83:7f:ca:17:5a:84:38
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 1, 2005 - Nov 1, 2025
Minor OS version
0
Major OS version
6
Entry point
160528
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
winhttp
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpConnect
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpOpen
shell32
SHFileOperationW
bcrypt
BCryptOpenAlgorithmProvider
BCryptEncrypt
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptImportKey
BCryptDestroyKey
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDuplicateHash
BCryptDestroyHash
BCryptGenRandom
BCryptGetProperty
kernel32
IsProcessorFeaturePresent
WriteConsoleW
ReadConsoleW
SetEndOfFile
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetProcessHeap
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
SetStdHandle
GetEnvironmentVariableW
CreateDirectoryW
GetFileAttributesW
GetTempPathW
GetLastError
QueryPerformanceCounter
GetCurrentProcessId
GetLocalTime
GetTickCount64
GetWindowsDirectoryW
MoveFileExW
CreateFileW
DeleteFileW
GetFileSizeEx
WriteFile
CloseHandle
Sleep
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
CreateProcessW
ReadFile
GetSystemTimeAsFileTime
GetFileTime
RemoveDirectoryW
SetFileAttributesW
SetFileTime
CreateFile2
DeviceIoControl
GetSystemTime
VirtualQuery
GetProcAddress
SystemTimeToFileTime
MultiByteToWideChar
SetFilePointerEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
GetFileType
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
HeapReAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
Name
.gcmp7uk
Size
264KB
Virtual Size
263KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.c03nt30
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ihybfhv
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sblftom
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.jeewutx
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tum422a
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.czunpqi
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=166, id=261, version=33145,
count=12, id=260, version=33145,
count=10, id=259, version=33145,
count=1, id=253, version=35207,
count=10, id=259, version=35207,
count=17, id=260, version=35207,
count=44, id=261, version=35207,
count=9, id=257, version=33145,
count=151, id=1, productName=Unmarked objects,
count=55, id=260, version=35229,
count=5, id=261, version=35229,
count=1, id=255, version=35229,
count=1, id=151,
count=1, id=258, version=35229,
pdf_20261030261877000259_UEMG_2695200072295_installer.exe:Zone.Identifier
- SHA256 d07777e0dc36ebecce3fa9644f0f44dc4a0b7ede0cbc1f5d33e8d6cb07af5b5c
- MD5 c785c55d5fa3443a11b8417209c4b524
- SHA1 924de7b5f4fe5c2ce16a8263600dad559a3cfedb
- SHA512 cae7738d2bd2b157fb4eaf99954aabcf90008fc0602a1a482de9b0df4c82903991e3a9cd7d85dcd6916307f972965d58192b4557c210ef579fbb23a5860f570c
- MD5 SHA1 SHA512