Software.zip
- SHA256 f9618484e5636abf21bd9a74b0f4fb5581a7ef61803d7192e90857e37f3285f5
Password
2026
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target Software.zip
- Size 27.4MB
- Sample261027-fd3c5aaw3x
- SHA256 f9618484e5636abf21bd9a74b0f4fb5581a7ef61803d7192e90857e37f3285f5
- MD5 f285c786a2fa5a241507fec94bada24c
- SHA1 e54c1c69214e2bc5afc17936b300ac5d175f7bd6
- SHA512 8f29a0391c30f99b323df399905243c32f26d884315011a51b396f869cbce3a3e035ae481405c960273b37a3111dbb2b04c9d9942a6a4cc83dd425962270fb00
- SSDEEP 786432:z8RNSpKNl82EtWwZMIl5dUWACYX2NF/u5:z82pa8ptWZIl5OX0/u5
- TLSH T1CF57333F9B659A31CE7E933B4FEA5893BE3814F172D44C4FA4250D56223E096295E30B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Setup.exe
File Explorer
-
Software.zip.zip 27.4MB
-
README.txt292B
-
Setup.exe.exe 3.1MB
-
cmd/deployforge/main.go1KB
-
docs/architecture.md1KB
-
docs/ci-integration.md928B
-
internal/engine/engine.go2KB
-
internal/manifest/manifest.go1KB
-
internal/manifest/theme_belt1.wav13.8MB
-
internal/manifest/theme_belt2.wav13.8MB
-
internal/platform/platform.go848B
-
internal/rollback/rollback.go616B
-
scripts/install.sh.sh 259B
README.txt
- SHA256 c85a425539c2eacef75172ace5ddabeb7d3fb0841d80920d93cb3a185430b572
- MD5 d862249f31d841a0e5fb5e8462bfbe19
- SHA1 e639fda705002825a3a9ae15dbf50c50bbf67079
- SHA512 f1aa3fa9481a5556dd2fe1c63fb0954035d9a2c57b106ca57a28b22d14099fac21fa215fc1f221b05a08c46162015ae847f1e7fd98fc2d464cc328b2fe96d570
- TLSH T112E07D99111FC337286693CC660A4651EB11F48D22112818344FB83D02348425BFD0AB
- MD5 SHA1 SHA512 TLSH
Setup.exe
- IMPHASH 4f2f006e2ecf7172ad368f8289dc96c1
- SHA256 fbd334d2e14c2b59984285fb22bda8afd41efc032318b68ae6c513fd521e36c0
- MD5 c91fd230e3087af92c65820ad526493e
- SHA1 a4a594649c821c319965c25633a1b1842976cc81
- SHA512 e554c73c8a6259418fd2b5d4813f0284523d992ff8988aecc541634f375231533bc396a35f957a4e21327be6a8202083306f76e94aaa727a37866d2149b77ff1
- SSDEEP 24576:uP/4JrGcFIzepuxjV8J2Bn8h792oon0YO84ucY3YkhhiW882lPoAlRh3:BwcFI+6x8oBn8h7IF0YO84ioJ5R3
- TLSH T1FEE55A57BE9089B9C0E7E739C4A61252B9357C5C473523D72FA0AA782F31BC2193AF14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
2026
PE Signature issue
Digest
98:f7:55:84:d8:8d:ec:d0:58:8e:b0:dc:f5:9b:d2:03:e2:eb:3c:5b:ff:0e:b8:cb:43:74:6a:47:c0:0a:d7:35
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Apex Works,O=Apex Works,C=US
Chains
Oct 26, 2026
CN=Apex Works,O=Apex Works,C=US
Subject
CN=Apex Works,O=Apex Works,C=US
Serial Number
94:27:05:41:d2:e6:10:cd:9a:f3:6e:1e:48:0e:e7:55
Issuer
CN=Apex Works,O=Apex Works,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2026 - Oct 26, 2027
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Minor OS version
1
Major OS version
6
Entry point
405152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
61KB
Virtual Size
421KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
cmd/deployforge/main.go
- SHA256 3ee643153487fc6c92a680edc17399f2a55d391fb754327df39ece082d358c90
- MD5 1ec62eb95b65a14493bdc5b97b602106
- SHA1 0905366d17781b42f8886c06f241b78841715392
- SHA512 d39b08cff6d07cb18976ad81c957fd4735333146b8f670514ae116b38672b4f77bb15af41892ac30f31c5a5586245ada6c22938028effe61f65d9e0ffc313a78
- TLSH T1DB3151814BAE69C90E04527DD8026DC33B76D83766FA94D3F8CCD28497C857B635C484
- MD5 SHA1 SHA512 TLSH
docs/architecture.md
- SHA256 c8056e05e8469945859582e9a7760b9571f27eead940b2cc4ae784559f5898f8
- MD5 e50dec666d7fbb41d5abd169a31b5240
- SHA1 a584b190cb865e90a740465bd46c3c9090d87e89
- SHA512 9f0260636bcc95286e3ba89b6ccdf792156094e19d841d048c0563966b890d285701df971ba17b1751a63c6ec6310ed6687c25b4eb8d2da6b5af088d391e2bf3
- TLSH T1782152E326AE3BFE0E670166BE9FA3A577168831100210D8809A055C37A61688337672
- MD5 SHA1 SHA512 TLSH
docs/ci-integration.md
- SHA256 1b12b6e68db23c418f09d66bb6ea0390ee28bd85c82eac7e46045a168a879a84
- MD5 5b66b9d763e4e134632a721d49e0357a
- SHA1 9ee93a9cc1a2ae874d11bf08ebb2d4d7035c8faa
- SHA512 9f8c27fb98c218da49ed25440bf9ddfd1ae2426e2a376d60caebdb3d995d5ee460f299abe0acf8cf5dda7e7b03a9712d6794ccaf6875161193fec40486d55def
- TLSH T1B911C0C9477269A56643006AC4DF90D532BAE807C7627C7070ED40A49F9322B729EB0D
- MD5 SHA1 SHA512 TLSH
internal/engine/engine.go
- SHA256 2e1c599f3ccf98775f16d0d9d552959c25e8e7f59f9139f107d8dad4beaa5a73
- MD5 32e4772348cca498b230884e7e44cb39
- SHA1 bf09b11c062cd99abfb9f504ddb39e833791e864
- SHA512 0cc418e86ea47fb1bade7fd04de4dfbaa4a025ac412f03ea5faf3d7e36050b6aabed79824314387e182a2d347934cb6df0c16ed29da64fe7d8b2a97721ea152f
- TLSH T15E4120CEAF9E573D392610058C45D29A7B7FC4274971D0FAE9EC71A0314886F822E7A6
- MD5 SHA1 SHA512 TLSH
internal/manifest/manifest.go
- SHA256 9b9f2850e5e7399ce4093618800227e8b3fb88ca56ab611fd28964d6381c54cf
- MD5 a700c8da3f69a310ad56d0f3556ce876
- SHA1 1cd163b8ac1e3058ccf2eb494e5fbade10aaad49
- SHA512 e223c42a0d4799366274d8829bce4a8baede3258806b0ea07fc8b33d2f8f122838c53b09722edc9dc7010b7f8c8c2f1ec9c8291e7ff70c7c2cee4f600561cc8c
- TLSH T1C131FF092DFF87F625801350C991A84377A49D51A73E15A5FBDEB070335A62C853A0B9
- MD5 SHA1 SHA512 TLSH
internal/manifest/theme_belt1.wav
- SHA256 171b47ac273bb478aebd6eea207847c07ab7e62cd2e8bb26884ff6ef6419950e
- MD5 5e2a71d849510e07df5fdbf71cb5374e
- SHA1 5c904abb81e5571c33be6abd870f13836065e3c8
- SHA512 dbcba06bb2f827df40c9bdbaab4bc03b93ad7ef536ed335ccab40e04a4d892d06265c4ce202643b5fee4b8c706c91c6719699c4bd48a63639915530862856647
- SSDEEP 393216:yuYMYYs3LZEuMeWcSUrmbJcp2arJiQIhDXCpS2cxu4JN/Ph0:y+YzLBM4SXbJBakQI5CwxDN/C
- TLSH T11BE623EB86A134D53A5DC2145BD0CF0C731437EB15219E7DA66EC99A20C3B963188FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
internal/manifest/theme_belt2.wav
- SHA256 171b47ac273bb478aebd6eea207847c07ab7e62cd2e8bb26884ff6ef6419950e
- MD5 5e2a71d849510e07df5fdbf71cb5374e
- SHA1 5c904abb81e5571c33be6abd870f13836065e3c8
- SHA512 dbcba06bb2f827df40c9bdbaab4bc03b93ad7ef536ed335ccab40e04a4d892d06265c4ce202643b5fee4b8c706c91c6719699c4bd48a63639915530862856647
- SSDEEP 393216:yuYMYYs3LZEuMeWcSUrmbJcp2arJiQIhDXCpS2cxu4JN/Ph0:y+YzLBM4SXbJBakQI5CwxDN/C
- TLSH T11BE623EB86A134D53A5DC2145BD0CF0C731437EB15219E7DA66EC99A20C3B963188FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
internal/platform/platform.go
- SHA256 cd2b6e55d6063fc18f2f1e2b3604b987dd6e75b6c0277b258bbadbeb5a40f2d5
- MD5 5fe7c364001aa8586776172bc86b537e
- SHA1 ec69f5e334da3ea5ba7851f45743e50ced1e3f93
- SHA512 8128425370bf8ab8ef86b575389ed9257554a192e7cf2064d9e81045dcd9e759f75cd4856ce8ce9405a8f846c0990e26ad6d1659afb13acdcb7951f40c73b54b
- TLSH T1E701EFC23AE2E23AED1B42424C920076A3A6EB29F154D3D5DDCC80B6728B4A9C136025
- MD5 SHA1 SHA512 TLSH
internal/rollback/rollback.go
- SHA256 94c86c62c4ba201ac66ac5a2ab38cc3535a9dca86c6d0fa177ea26a77d9c4c07
- MD5 e1171bb3ff63ef770b508b635ae57990
- SHA1 8ffd0814b48865a6250f2d63f2592a39d488db05
- SHA512 a3ebbfa91019c5e558cd9c701c8919ee9b0e575568b282e50c0373291cb7c5b3046f18aa2935192a875ed99cb4bc9010c2caf0cd7bc7619e887beeb25b065547
- TLSH T1AFF008CBB1490B6929631431FFD0D7D6D597CD3795327272F84CC06C97044545218646
- MD5 SHA1 SHA512 TLSH
scripts/install.sh
- SHA256 c009309f9ca69b0adc10ad6fc75ce561ac9d74c52aaa990183d9c9a76b47289a
- MD5 d71cab2d1dcfc7d93575de11fbeb0fce
- SHA1 e96f36ec8cbd6f1bf238afba205623f4c2b311b8
- SHA512 c9aacaa45d7d4d855d49d8c26fa682ab5ee67017980a14b04869d7d01b70dc948095ceef29a995c4340cd2994f67c52c9cbba082db947e9e6b4139ae798f787f
- TLSH T144D05B983A4559B795915BB6DAA7551077E4C0351D699C1110673411A30678D33BC12D
- MD5 SHA1 SHA512 TLSH