WindowBlinds11_setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
WindowBlinds11_setup.exe
Size 106.5MB
Sample261027-2nbh2sg19n
SHA256 588a7ba474f775147f4c7490f7829c39f5e87b70022139001b1d60992fa93410
MD5 3e56f40ba6eb63e83683c50f872819a8
SHA1 ca8e979beaac9f2251d5a038343edff0ee31d2d2
SHA512 5bd446b38c4f385fdbb92c85e39315ec67fa6c7c2a4c32ba5ee6cbfbd2b574eef9371b917668187d6cb5e3cd538073d8e7bbe09da196b5ec7d142f89b82b7e0f
SSDEEP 3145728:k4AiMmhTcBCc4kU8WJcS4cUE71YZqbLwaa:k4AiMAAZ4yWOMl1YOMaa
TLSH
T10C383351DD6849FAC1BBF73C44A70BA2D29E075483B0819F5B6099D81B334E90B3BB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

WindowBlinds11_setup.exe

.exe 106.5MB

WindowBlinds11_setup.exe

IMPHASH d619eda1a774da262071361b928bb2e4
SHA256 588a7ba474f775147f4c7490f7829c39f5e87b70022139001b1d60992fa93410
MD5 3e56f40ba6eb63e83683c50f872819a8
SHA1 ca8e979beaac9f2251d5a038343edff0ee31d2d2
SHA512 5bd446b38c4f385fdbb92c85e39315ec67fa6c7c2a4c32ba5ee6cbfbd2b574eef9371b917668187d6cb5e3cd538073d8e7bbe09da196b5ec7d142f89b82b7e0f
SSDEEP 3145728:k4AiMmhTcBCc4kU8WJcS4cUE71YZqbLwaa:k4AiMAAZ4yWOMl1YOMaa
TLSH
T10C383351DD6849FAC1BBF73C44A70BA2D29E075483B0819F5B6099D81B334E90B3BB5E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

69:5e:e6:98:b6:7f:35:a1:d0:bb:75:3e:3a:69:f8:88:dc:6f:84:b9:9f:da:c2:62:1e:31:6b:a5:5d:06:5d:d8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=STARDOCK SYSTEMS\, INC.,O=STARDOCK SYSTEMS\, INC.,L=Plymouth,ST=Michigan,C=US

Chains

Jan 16, 2025

CN=STARDOCK SYSTEMS\, INC.,O=STARDOCK SYSTEMS\, INC.,L=Plymouth,ST=Michigan,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=STARDOCK SYSTEMS\, INC.,O=STARDOCK SYSTEMS\, INC.,L=Plymouth,ST=Michigan,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=STARDOCK SYSTEMS\, INC.,O=STARDOCK SYSTEMS\, INC.,L=Plymouth,ST=Michigan,C=US

Serial Number

02:92:61:fa:48:6b:16:10:71:3a:4c:b9:ec:7e:6c:42

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 1, 2022 - Apr 23, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

11489

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA lstrcpyA lstrcatA lstrlenA GetSystemDirectoryA GetProcAddress GetModuleHandleA _lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA GetDiskFreeSpaceA GetFileAttributesA CompareStringA DeleteFileA GetTempPathA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc RtlUnwind HeapSize Sleep RemoveDirectoryA FreeLibrary IsValidCodePage GetOEMCP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

WindowBlinds11_setup.exe

kernel32

user32

advapi32

shell32

generic