27102026_0734_26102026_UnkLowKD23027677005_d291.iso.zip
- SHA256 326c38ce8c77e40e79f0a948223e41955dbaba5050025eae75b98e1efb39bb83
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
UnkLowKD23027677005.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
UnkLowKD23027677005.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral3
Sample
VSPMsg.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
300 seconds
Behavioral task
behavioral4
Sample
VSPMsg.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
300 seconds
General
- Target 27102026_0734_26102026_UnkLowKD23027677005_d291.iso.zip
- Size 578KB
- Sample261027-jd44hada32
- SHA256 326c38ce8c77e40e79f0a948223e41955dbaba5050025eae75b98e1efb39bb83
- MD5 36a2335c3030795cd51b2d487de18bbb
- SHA1 8737feb7177149d82326f0b62f303ae81177e098
- SHA512 baf1cdc451fd10985654244a7c8186bb5caeb0c871e3134194f4d70be5a7954852118d4559f10db9d8250fbc42deb975c2ad82e3b577f82fddf006ca880f805f
- SSDEEP 12288:koxsWlZg4s3BjtcFE5OleyY6gtyZ3PrwjtohbLM2KN+dqH3hft3+L0/IWkKqKAit:jAD3Tals6gI/rktolu+oxflA7jit
- TLSH T17CC423D4FFCD0423FD75899634AF9F96B90C3C50F9A8D07A42470868A7362B86459E8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/VSPMsg.dll
File Explorer
-
27102026_0734_26102026_UnkLowKD23027677005_d291.iso.zip.zip 578KB
-
UnkLowKD23027677005_d291.iso.iso 826KB
-
UnkLowKD23027677005.exe.exe 382KB
-
VSPMsg.dll.dll 19KB
-
ws.png.png 370KB
UnkLowKD23027677005_d291.iso
- SHA256 b0fdbce6459221b1d27a1c246953ec6c5c6c5c82ef938dc6530d954fc32426ec
- MD5 23d40a3c1c905e300afea0d0d5e612b9
- SHA1 35204ee16623c11c1da3fe252dbef0961a39153f
- SHA512 6e0df076c242be403289e8ba936de2ec830d58e38549b5e5646d045bfbf4212daad239eaccb19062aaca4e11bfb968652cb44cf208c3aac84b5a393b9a5b6e1c
- SSDEEP 12288:3k5G8N847bS8v5rMOMT/rUHKrw59oh1LMkKT+dql3hlt3+f0/YWkgqKAih:W847bS8lMVHQKrA9o3y+o/llmh5i
- TLSH T1F105D04AF7A404F5D0ABC239C9678606E7727C9A0770DB8F23A847662F272E05D3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
UnkLowKD23027677005.exe
- IMPHASH 75419444292be768f1cb27ca00682e8f
- SHA256 ffeaef9bc1ce54c3fac9b9517804ca1b73b905c6c0b10ab6fd1dd5615c15bc47
- MD5 32b03da03c2fec73d028114276a897da
- SHA1 2473216fee29bcc660694c32f0a6378295b1e896
- SHA512 5539b28f8d0679b992d744c70872d933fc11caa069b6d8388734487de43bf5464505e2c11f2281c53394c76ed1fdb4e09c4462a4e6e25d534c1ecc3a43853c00
- SSDEEP 6144:IfGoU5G8+K848hEBbS81wfDM5rMOMT+pcBrk:ek5G8N847bS8v5rMOMT/rk
- TLSH T1DB847C5AF7A404F5D0AB8239C9638506E7727C9A0770DB8F23A4476B2F272E05D3E761
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
9c:a8:7a:f8:4f:5d:0a:9e:bf:8a:e1:4f:c8:81:d2:69:f3:be:7f:f9:0f:01:ca:c5:ad:a7:c9:94:fe:1e:a6:a7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 15, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:04:6c:74:06:ff:57:2b:27:72:00:00:00:00:04:04
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:03:bb:1e:5c:00:38:6c:74:ca:00:01:00:00:02:03
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
133680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\dbs\el\ddvsm\out\binaries\amd64ret\bin\amd64\VSPerfMon.pdb
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
ReportEventW
RegisterEventSourceW
ReportEventA
DeregisterEventSource
RegisterTraceGuidsA
GetTraceEnableLevel
GetTraceEnableFlags
IsTextUnicode
EnableTrace
StartTraceW
ControlTraceW
RegOpenKeyExW
RegQueryValueExW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerA
DeleteService
ControlService
StartServiceA
QueryServiceConfigW
OpenServiceW
SetEntriesInAclA
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityInfo
TraceEvent
GetTraceLoggerHandle
GetTokenInformation
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSecurityInfo
LookupAccountNameW
kernel32
OpenEventA
GetFileSize
FindFirstFileW
DeviceIoControl
InitializeCriticalSection
SetThreadAffinityMask
OpenMutexA
GetVersionExW
GetLocalTime
GetComputerNameW
GlobalMemoryStatusEx
ExitThread
FreeLibraryAndExitThread
ReleaseSemaphore
OpenSemaphoreA
SetUnhandledExceptionFilter
GetProcessHeap
DeleteCriticalSection
LocalFree
HeapDestroy
HeapAlloc
HeapSetInformation
CloseHandle
HeapReAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetLastError
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
LCMapStringW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetCurrentThread
OutputDebugStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
SetFilePointerEx
ReadFile
ReadConsoleW
GetFileSizeEx
CreateFileW
WriteConsoleW
GetEnvironmentVariableW
GetModuleFileNameA
FindFirstFileA
GetUserDefaultUILanguage
GetModuleHandleA
LoadLibraryA
FormatMessageA
SizeofResource
LockResource
FindResourceExW
LoadResource
FindResourceW
GetVersionExA
GetSystemInfo
GetConsoleScreenBufferInfo
WriteConsoleA
FormatMessageW
GetConsoleWindow
VirtualAlloc
VirtualUnlock
UnmapViewOfFile
VirtualLock
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
GetFileAttributesW
OpenProcess
QueryPerformanceFrequency
LoadLibraryW
GetDriveTypeW
WaitForMultipleObjects
WaitForSingleObject
CreateProcessW
GetTickCount
WaitNamedPipeA
CreateFileA
SetNamedPipeHandleState
ExpandEnvironmentStringsW
CreateMutexW
ReleaseMutex
DuplicateHandle
GetVersion
CreateEventW
SetEvent
CreateFileMappingW
MapViewOfFileEx
VerSetConditionMask
VerifyVersionInfoW
GetExitCodeProcess
GetFullPathNameW
GetExitCodeThread
ProcessIdToSessionId
CreateThread
SwitchToThread
CreateEventA
GetProcessWorkingSetSize
SetProcessWorkingSetSize
lstrlenW
SetFilePointer
DeleteFileW
ReplaceFileW
SetThreadPriority
ResetEvent
GetOverlappedResult
WriteFileGather
VirtualFree
Sleep
HeapSize
CreateMutexA
InitializeCriticalSectionEx
HeapFree
CompareStringW
SetConsoleCtrlHandler
GetStdHandle
CreateSemaphoreA
vspmsg
GetErrorMessageModule
SetErrorMessageModule
user32
IsWindowVisible
ole32
CoCreateGuid
CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitialize
pdh
PdhGetFormattedCounterValue
PdhAddCounterW
PdhCloseQuery
PdhOpenQueryW
PdhCollectQueryData
shlwapi
PathAddBackslashW
PathAppendW
PathRenameExtensionW
PathRemoveFileSpecW
Name
.text
Size
260KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=262, version=27412,
count=2, id=257, version=34440,
count=2, id=259, version=34440,
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=158, id=261, version=27412,
count=9, id=259, version=34321,
count=17, id=260, version=34321,
count=52, id=261, version=34321,
count=15, id=257, version=27412,
count=271, id=1, productName=Unmarked objects,
count=68, id=265, version=34440,
count=1, id=255, version=34440,
count=1, id=258, version=34440,
VSPMsg.dll
- IMPHASH 651937d4956b80470cfd0b280a285149
- SHA256 6e797e11271df97f8506922f01380655e1d7ee2f70bb86214843bcaf8eacb4d7
- MD5 eb4b1f41eb2d1243e0fb5ef40cc07125
- SHA1 805bd963e78ef6b00be919187b54bf44e4f905cf
- SHA512 67c8b0d264ed099dd729350884c43cd28ed20b22a26194f3531d0d1eb2117765efefc1ccbfdd1466806ea2350be86733a9aa292c2e94f9912039c8a9505aaf13
- SSDEEP 384:U81rA0NDpPYx3m4zc22UWR4FC2rBjOwQ+/g:pC0BE3m4o2DWR4FC2rBjOwQug
- TLSH T1C9924A06C29603E5F866C77995BFA227EAF034043A34975F4B708D196FB2E10E61D399
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
4248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapAlloc
HeapFree
GetProcessHeap
Sleep
LoadLibraryExW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
GetTickCount
GetModuleHandleA
GetACP
GetSystemDefaultLangID
GetSystemDefaultLCID
user32
ReleaseDC
GetForegroundWindow
GetDC
GetErrorMessageModule
SetErrorMessageModule
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.cdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rodata
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ws.png
- SHA256 b20a9b4f8cacfc29e2c6513e2483823d74985d98bfed50cd413efab76ab3bdca
- MD5 809bb7091e29fa0e6db5c775ba0684f5
- SHA1 10febb069e69435f860408605b39a7c82304bed3
- SHA512 5c669b957d8ff4250dcf1b01ae2b0342420771dbb61db7e6324cf73ec6419c8797f5dfebe5e7b7e663729a0d23d82be2e24c2f99ab9e1e776d521a8d281eb9e6
- SSDEEP 6144:3RGJxwHnZkCoIuILYVxM05yXss+dql37F6Qt30Tf0/yRqiokr0qKAihe:4rw59oh1LMkKT+dql3hlt3+f0/YWkgqV
- TLSH T1AA84235ABFD90016FD3ACD55707FCB8AF44D3854FE78E0AAC24F4980162626854E6D4F
- MD5 SHA1 SHA512 SSDEEP TLSH