6d5ef549d60d9ecf629bacae480c186acf5faa81023070c8225cf2fe0590573b[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6d5ef549d60d9ecf629bacae480c186acf5faa81023070c8225cf2fe0590573b.exe
Size 11.0MB
Sample261027-bah3vscd28
SHA256 6d5ef549d60d9ecf629bacae480c186acf5faa81023070c8225cf2fe0590573b
MD5 05a6b90cd6e20961665549f75cd6340c
SHA1 309134619dbf318fc1770777c31b3f8b3834db47
SHA512 de055b82f94a1c96ea289eb5cdeaf7b772a18d8ba3b2b8ccc43f084204ccd76f79698d368c31e804016b60ae9558cb4062ffeb393c150398ce03c14968c9a7a9
SSDEEP 196608:mhBbREjRKiizQYhKp1HQ0BoO6Bem+Xp1d63lH587:mfbREAiizQ5XBoO6k2E7
TLSH
T168C6BE07ECA515E9C0ADE231866A9153BB717C485B2523D32FA0F7382F76BE06E79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
6d5ef549d60d9ecf629bacae480c186acf5faa81023070c8225cf2fe0590573b.exe

File Explorer

6d5ef549d60d9ecf629bacae480c186acf5faa81023070c8225cf2fe0590573b.exe

.exe 11.0MB

6d5ef549d60d9ecf629bacae480c186acf5faa81023070c8225cf2fe0590573b.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 6d5ef549d60d9ecf629bacae480c186acf5faa81023070c8225cf2fe0590573b
MD5 05a6b90cd6e20961665549f75cd6340c
SHA1 309134619dbf318fc1770777c31b3f8b3834db47
SHA512 de055b82f94a1c96ea289eb5cdeaf7b772a18d8ba3b2b8ccc43f084204ccd76f79698d368c31e804016b60ae9558cb4062ffeb393c150398ce03c14968c9a7a9
SSDEEP 196608:mhBbREjRKiizQYhKp1HQ0BoO6Bem+Xp1d63lH587:mfbREAiizQ5XBoO6k2E7
TLSH
T168C6BE07ECA515E9C0ADE231866A9153BB717C485B2523D32FA0F7382F76BE06E79740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d0:1e:3e:21:5b:e0:18:93:9e:be:bd:71:19:c5:f7:a3:d1:30:44:4d:51:ae:7a:17:d3:be:c7:cc:b0:02:cd:2d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 25, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:32:4e:ae:a6:30:09:6a:5e:7a:00:00:00:00:02:32

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

507968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.2MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

6d5ef549d60d9ecf629bacae480c186acf5faa81023070c8225cf2fe0590573b.exe

PE Signature issue

kernel32

generic