packages.zip
- SHA256 71656022e68656f42c891d370d26f900a5fb92bdcea1e2bd2d3a299a2abcd66f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
packages.zip
Resource
win11-20260911-en
windows11-21h2-x64
11 signatures
900 seconds
Behavioral task
behavioral2
Sample
HealthCheckService.lnk
Resource
win11-20260911-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral3
Sample
MSBuild.exe
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
900 seconds
General
- Target packages.zip
- Size 8.1MB
- Sample261030-2jpvwaff77
- SHA256 71656022e68656f42c891d370d26f900a5fb92bdcea1e2bd2d3a299a2abcd66f
- MD5 3bdd09a0ca7ab537aa57a726bc0fb8d5
- SHA1 7c7c70b7a1ce3ea882bbdc340cb5037d4b7411fb
- SHA512 2ed2340ad4a494462a5cc71d36960c0155cb073a1a25c0eeb5ce60ffeef1157a187e0562e9a12b2f2b35432286c6a9fde44cd2d23f269f406fd3cfb4c4ae67b7
- SSDEEP 196608:7aPbp83O3UYRBIs/VeSJmxiWDXzCe5ukOcqjzTtxRB5P:7Y88TvIUVjWD+e5uVcqDnRjP
- TLSH T1998633EB843EC29BCAB97739EF819F153ECB90812E69BCF50CD15B58B17681207D9910
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/MSBuild.exe
File Explorer
-
packages.zip.zip 8.1MB
-
.gitattributes52B
-
.gitignore66B
-
AssemblyInfo.cs462B
-
CHANGELOG.md663B
-
CONTRIBUTORS40B
-
Directory.Build.props274B
-
HealthCheckService.Build.props.xml 2KB
-
HealthCheckService.csproj.user.xml 7KB
-
HealthCheckService.lnk.lnk 1KB
-
HealthCheckService.sln1005B
-
LICENSE1KB
-
MSBuild.exe.exe 249KB
-
NuGet.config212B
-
README.md590B
-
Resources.resx.xml 18.4MB
-
app.config633B
-
build.cmd.cmd .bat 540B
-
config_43537.log203B
-
config_b7791.tmp223B
-
filelist363B
-
packages.config205B
.gitattributes
- SHA256 c0e4f20c88314e4c0ea6f41e977747e07e21a2322e15c81725628b53a14ce77a
- MD5 f6cef101900768b28ff9a6332b8afbc9
- SHA1 d0125c1e525d7dce793928406258505b4d0f4844
- SHA512 3e81c1bfd34e22cb71f5b1a73cbc129876b367f162556a773f97f45953556a67f606068f51a628e41762c4f0a8b1c6fdd8179f486e628ef039ac49c002a705ca
- TLSH T1ED900201B5455755A45020C0D422B5450164179F3262D078095AA980B0901A86D291E5
- MD5 SHA1 SHA512 TLSH
.gitignore
- SHA256 da94df32f9751d635aaaf89c41868815af3d7df3b03e2be9d471db6be3e271cd
- MD5 d6e586ea4294851b2b1b5fc443b54c33
- SHA1 b384a6c9ec65b063a930348bc5eee60f918e6711
- SHA512 bdfabe593d5193c5d46f2e9a35eb2f3110c8cced9e2f5ea08f9fd8487f2c79e018595df2dd15259a927ffd880977c30df2f84b7a3e8e5c4dcee5aceefe2eb3be
- TLSH T138A0220080B023202C8A00C3F2322008E30820BC208BA0B3AE82E332BA08A003300028
- MD5 SHA1 SHA512 TLSH
AssemblyInfo.cs
- SHA256 5e56e20a1055082c5a660c93121f3d03865ee2e63150aae086cdd356e7e568a9
- MD5 214a09a238dbdfc8667b43559ed0b761
- SHA1 ad5acf741dfb84dcfe9b416b9da81b77f62abe08
- SHA512 793341c55e30288bdce1e3eac85639caa17d8ba9a0897e0ecef05b6c2ee4e5cc282484536bdd7ad1ebbf0652ec16f2c95e95ad497ed69491d074d0d31e19f8c9
- TLSH T1F2F03AAC960AA75DCF1001D3BCA3758C539E333142EE984162EC7C13F84ABB8A514775
- MD5 SHA1 SHA512 TLSH
CHANGELOG.md
- SHA256 9551d339b5387ba0975ec289e629f1d098bbe02b3f199453018822daafde9fba
- MD5 add8a049a05c38119b52b59074604217
- SHA1 142fcf6ceb9640ae66184583f8d772e96d170eca
- SHA512 12e4fbe5dd8ccb8dcbe38dfa3b4f9417c567b88cc9fe1d9ff2ba6369dda3e480bba7d3783e39d4c869045db058855484a2ed80032af54fb9966d8077fd330613
- TLSH T1770162E623B7E0106A7B809B6C0263E54908F5939A868D1DFD58255BC3E60A1CEED25E
- MD5 SHA1 SHA512 TLSH
CONTRIBUTORS
- SHA256 496eea68fa11043c59227ccbfd758975667a015ca094b808a5184dc05832d914
- MD5 259c919b55d5c33cbc8f1bf95f5feb45
- SHA1 f6c3cdc8207075269ca73a4566e07bea3c16ca56
- SHA512 7ac8c56efe7c4d44ae4d24774252fa3ffbe14c84a70ca643e6738c223db920e6daf863df4ab10fe414f8de6fa7e523db958ce4b0f8c8404bd16bad9be12dfb8f
- MD5 SHA1 SHA512
Directory.Build.props
- SHA256 e2d57d93edf616586052c3d8e02357e0ead041f3a159a450660983ee56902a72
- MD5 9499a6acb612504b0df83847192f831d
- SHA1 47114dd428304bd615b371ac2c7bd08d0448e863
- SHA512 e80ae61cb9279823c1c37efa09009350ad516e2961447d5897b7a7a698aa2e7f376d1e97b34af0e7a0130f2e0c5f19b152ab37607ca1a2784a9d39f864869e91
- TLSH T111D05E16AFC17A355EF0A02846366A68EB9BA26208710834B6CEC84F879680D5933B31
- MD5 SHA1 SHA512 TLSH
HealthCheckService.Build.props
- SHA256 ec26640fd2c1592a82dbbba942a4ffc4e60fc62008ca335bc33bf4f43f5fa96a
- MD5 6d934e650070e503c7d2b8054e614c89
- SHA1 f505c467fd7e68ec0e6f860ef84d0cac3bba5a47
- SHA512 a710117e9947b34e1ea4238d236c853ca649a1b0ecdc1741dca0db94237f94d4af358a943919ebd4aa90f0947bb753591ece56a0a4c9143370c95045aa0eed48
- TLSH T1865174A491D8AB3F1DB343BB60FEB220E47E61B32259209D36CEC55D163E4642F1B645
- MD5 SHA1 SHA512 TLSH
HealthCheckService.csproj.user
- SHA256 ac4e92bf50ddcaa5ab96c67eee365fc0172dc6baae12235b5881ac7e4b7901dc
- MD5 57eeb0b19c19b6570ad9f4afd73a0241
- SHA1 3893bdac7c21973200666db0021ca128bbb3c749
- SHA512 87fd18725cb1223f85f61aa65df4ba5de6ddd606850f97d89a1d2c9e220d23222db4682942e164fa21172ae98237f56d1a532727fa7d1fda4d2774f1ff2f9634
- SSDEEP 192:jgaOJz8KVDuwGi7oLdupe4yFjetD1EqHEsM:jgaOKKFuKJ8FatD1E8I
- TLSH T1BAE18DD347E03965AE128EE97471ED08EFB752FEA92044D03E49860F0CA6928249FF64
- MD5 SHA1 SHA512 SSDEEP TLSH
HealthCheckService.lnk
- SHA256 4002b7190215f22001bd3cbaf99d77c2acb45d7cbadc05a86c06feec79e5f286
- MD5 8e92da2dd9dec1a35b68cd28ccaa9e04
- SHA1 904ed27fa486695a71755bf20750490c870295ea
- SHA512 58f97158a3a2230dc356006cc63e2ca719c45737fef67934736a9af434a102312a043380509628b65303247eaf4973c2c137967250d13c4613916f7b9c064e0d
- TLSH T18C31460C598E1B21C372C933A8AF9312D9763851FA921F9A408482C82554600BC62D1F
- MD5 SHA1 SHA512 TLSH
HealthCheckService.sln
- SHA256 c449e9d0ed1552fa1f72c7604e0b0e29786b6150d7688d6e8f8f896e24c237ef
- MD5 0b8bcd829b0991f727af53ed40d5d28d
- SHA1 75e55c6a1d2436973c546aefad24a370fc22e4b1
- SHA512 33d9c96e1c585f498535cbd5d558ed8802f26b3ef44860380f1a08b0e2f2c49fc828097d01eaf79c3242da4cffbf6b17651ed478818e1a5af63f43e3b3882e3e
- TLSH T122112BAD504E5CB56A5913FBA2A51CD3AE334240C2EE183C218E14DC7E2FED5623B84B
- MD5 SHA1 SHA512 TLSH
LICENSE
- SHA256 786346c1137289228aa43e1d7e5c09a9dc19751a06541cbfc13dc946c10d63c4
- MD5 6bae22cb6325eab4d3ffdd365846f177
- SHA1 3775c8a02156160c4c0b2b49dc5f45d463890d62
- SHA512 7f7e18005759655fbae591e87c692292f4faaea0bddcc8de401edb8fb64373be779ab2e45377fa96b5aff6e6557781eabacce160e39c96da61a37bff33e865ba
- TLSH T18511E92F72990373188617A00578ECC5F22BB05B7F6F1584302DF2051326058C6FFC64
- MD5 SHA1 SHA512 TLSH
MSBuild.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6bc58e85a42bcf60df74c23de212c882d8fdc5e6a60f20f5f3c5e392da6b0ad0
- MD5 2024ddf63513a9ea309091339a84a656
- SHA1 e070bfca3872ce23ef6a08e325fcfa9e157c1591
- SHA512 2b3d534b3335fdb239c661d856190ad7fd5e5daf51cc1724b0c9325b619632859ee6fd98369d2a1a99f6c041edb7c2daba88e0d3e0b661b34095f94efe40c074
- SSDEEP 3072:JDEKKwBWmSEoRooC7GvORoQYiY35e8w2XpFU4rwOe+ZbZEFf02RFivFuv4GuhK:NHK2W0u1tvORstRXfM102bicw4
- TLSH T185445A01A7EC4615F6FF1A78B8B015158B76F867E866E35E388C61AC1F73740EA60363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
04:37:b4:6c:71:9a:9a:37:21:d7:52:82:76:79:d9:b3:bd:a0:ba:c9:e9:3d:de:d5:30:86:bd:12:45:35:eb:ad
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 8, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:51:14:76:cc:c5:85:83:6e:0b:00:00:00:00:02:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:89:b4:bf:86:30:84:1c:4b:8f:00:01:00:00:01:89
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
236110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
mscoree
_CorExeMain
Name
.text
Size
223KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NuGet.config
- SHA256 7cf9c98cdfe6575f757ce573dfd192c685471f399874c5183ac5fb28a2d453bf
- MD5 eac4c49b4fb98100628c2a01cf322216
- SHA1 332cb675d31ca5fc92bbb67c2f8d95e1108a3935
- SHA512 f3cdebd9b5bb7a9cab3317d8cf8427ee29bc4e474da3fb64a600689f5214a8386f68528c6b21c39f5f4edc257626bd239df5e8f6fb4158910190de69dd36464f
- TLSH T1A6D0239745400D07D721DD2EEF9A1D04F77D73179412148DF47591374D710B80597100
- MD5 SHA1 SHA512 TLSH
README.md
- SHA256 a0c5712d1c33ce01a18dedb40f360aa04e97b4f2c40e3fa86557fe0fae13e9d6
- MD5 b1c21f12cc2ea2ad3fee6ebf25ec8ed9
- SHA1 cced075cea8613c2135fe532e5447789483d945e
- SHA512 d2f75b1ebb85fe77b1cde8abf89be725707df466d60c6d26fee5e45889a07a834263c00ecd24060aa47ae8bcb48b2f1ea39f1d9550b6dcb0808f782017ac79a8
- TLSH T135F0022B6AAB96B625330140146013E3C34880326F76880037CC143831AFE1DF57F3AD
- MD5 SHA1 SHA512 TLSH
Resources.resx
- SHA256 ead873ad8fd385b5ea75760ecf29e3fd5fb02910800fb6bb28df5fe7c8fb3302
- MD5 cb14911fe4f8c2fb0f0d3118c8a85513
- SHA1 a28297903589cdbd82a36c7ad533c0ff084fcd07
- SHA512 46cdc436c94fc610716d46d1adee94104b40a9762094f6f08c64fb0a6da311fcc22096e46dabf9e43a45290fa7931d0dbbd9c2d5958cb280042cbd3164f866bf
- SSDEEP 49152:SuNx75byaD3OJe3cTLDRAua/bffWG8Fg3BF/Zp5tKF0FkMxGIlxoeWGLBE5qktAa:M
- TLSH T1C517FFBF6150A9D3E1694E06E3FD7B1803F523739F5B589930F032847BAAA43AD1AD41
- MD5 SHA1 SHA512 SSDEEP TLSH
app.config
- SHA256 181984d8968449b313a273a589a22ef7e14b5dc95758f73629a5e69a62a448cc
- MD5 d6cb9ab0f33d5e7d0f95ab5912dbbae5
- SHA1 45d7c676101215119df440a6f609fda44796dc6c
- SHA512 18a629b33104b6214c1dae9ddc8b35af3f20d01087e2dbc6b0249ab80d0fa8e35587c71f3cfa0ec2b7c23dd8c7185d27e5bb4a3275237b2351c07fbfdcfefefb
- TLSH T19DF0A4356ED4AD57DF322D2FA9225E189F7C92D72491094CB0B921971E325C60613296
- MD5 SHA1 SHA512 TLSH
build.cmd
- SHA256 77cdd53df2ac8814f5cbf06f06f45632ba6cdad1f0d539bb4725a3cf8fe41ce6
- MD5 1a7162c7e74d1b7740291e036e7fdc75
- SHA1 d76d3f9f72af2a78e60ab404cc249732197c0e72
- SHA512 5db558cdac55c15c5deb99876903bf31fbdfb3727aac2b914f04e2ae413f571628c5df856cdf78cb247bda2bce5dd9899ce13522a6526675591181d711dc42b0
- TLSH T1F7F04C06351A6468A57B1BA075B2991077CE82FB5F18F3D8A1C4CC1494CD54E59CD1A8
- MD5 SHA1 SHA512 TLSH
config_43537.log
- SHA256 e665f2101d24ce49fb67981f2cf988bbf93159b4b9d9db99dd8e48e761842954
- MD5 83859282bf21ee4d297c5c8b53fb6170
- SHA1 a0b1947a0b8edf471600284784bdd0a508d8d407
- SHA512 27d60087ebe3b8d8b8e07b6290ffb307b1f8e58850496866b40ad65c89d75e797fc1e3aab3e4d411fe9f9bfef0e13e58712eb3620ab8887eba125faa097ba797
- TLSH T15CD02343D1D0A55555995C1615C175624646F0DF14DD15646EE65CC144177D1107DC04
- MD5 SHA1 SHA512 TLSH
config_b7791.tmp
- SHA256 9796f7822c25d9358a9b1949cf10ae6fd0c42d550dda1502fde12e626b68e9f7
- MD5 61b86c46c58d8b3a7c06029c36911dd3
- SHA1 fcc8b302e24d0b97191cc070bafe110c139780a3
- SHA512 a431788bbca360c721bd8285f179722a1dfad4c4c71e0c1869b90163bc8fee162ad1c8b5c655c8ceef51402deeca864b45cae5264b23045c7b157d06dd2cbb32
- TLSH T138D023BCC3002BE48B6301F1C4D44745091C0C1CD4138894163F3210394790018C80D0
- MD5 SHA1 SHA512 TLSH
filelist
- SHA256 6777c6f048554f7a335baa2e10c1a654552e1cf3a86c508b872073afbd760e4c
- MD5 95ec339d068fec16479f34953779da51
- SHA1 56f4d43261a8cdd249c1293d78f84e751ab30780
- SHA512 2d8024696205d05939ae7c6c1b533c31c8b61ac2df709e76e2707366558d591acc29f2bce846c89546f9c15bf7ef44072412de449596b72ca144abc3697dff96
- TLSH T14DE092237F8EF97E6A140B8188162521298849E1866772203BD5613D03ECC9C3A7F632
- MD5 SHA1 SHA512 TLSH
packages.config
- SHA256 528036986b240c2dec72172f83bc719d96971df203354de737083e279287efba
- MD5 70fdf1f85026e452294f4da88a51231d
- SHA1 686fa45059f2c7e3f8d399f7587293d3e510d2cc
- SHA512 71abb4ca3fee2379ccee248d570edff10493e96429f4f59d0321309c42d2f6360d298ce544a4d08bd4f76d64c35460132718736348a8ef4a2a6091bf18874e3b
- TLSH T1F6D0A90402A9667287702EA4BBEA81091B3C7027B5220ACCBCE01342832240A8207746
- MD5 SHA1 SHA512 TLSH