26430673487.zip
- SHA256 b27dab41051e38c3496a2fdd1a2fa10808bc8b591bb219b6cd70ea76c2d7f672
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a42632c68d2dcea06300e790c9440fe0943ce0dee2075f29170fd2774eacf433.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a42632c68d2dcea06300e790c9440fe0943ce0dee2075f29170fd2774eacf433.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 26430673487.zip
- Size 1.0MB
- Sample261030-e4gnnsvzhx
- SHA256 b27dab41051e38c3496a2fdd1a2fa10808bc8b591bb219b6cd70ea76c2d7f672
- MD5 7ad33228286c19edb676a615fd4bc047
- SHA1 5f882fd25f9dbdca1e34b99690334c777ec7a282
- SHA512 5ee214a4c6a63883c61e3e354ef9408fa4b7d880966a592513c88db9b5b1d5809ab7dc9d8c279e296d1bda2cfe10837acf0bdd7e1df7d1d70c664e1f299bb8af
- SSDEEP 24576:RMxso/2VglrA2h50qspgAo9SD+Ehyo5B2tUfXel2kF/JZxiwa0O2JhqB5I:Wxsm2VSfh50NgGUnWfOskF/JZQwlO2Ow
- TLSH T1A8353303149A227C851E1A1167F5AE378E05BD1D98B4CBD1E3F121FBE2BB959C6E213C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/a42632c68d2dcea06300e790c9440fe0943ce0dee2075f29170fd2774eacf433
File Explorer
-
26430673487.zip.zip 1.0MB
-
a42632c68d2dcea06300e790c9440fe0943ce0dee2075f29170fd2774eacf433.dll 2.4MB
a42632c68d2dcea06300e790c9440fe0943ce0dee2075f29170fd2774eacf433
- IMPHASH 3271ee162568f50a6810be9b8973807f
- SHA256 a42632c68d2dcea06300e790c9440fe0943ce0dee2075f29170fd2774eacf433
- MD5 09636ccd0d3e5cd3b63c4c7960c5ecb6
- SHA1 68b934cd8c60314535f158b1f046efa38798744b
- SHA512 78b117562b22b885255edda848c54702757367f417e4d3581ba40991f33a075b52c9ebd7728af6c06ddbfc2292129a77600f6cc3f15fdad929a84419482b50ee
- SSDEEP 49152:iEgpxSm04xDuQEvLA+u9rtbPejrQc30QD:iErwYLMB3Ha
- TLSH T13AC55C07FF6544B9C0BAA1318973A171BA717C443F2263CB2A90F7682F76BD0A978754
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
1d:b1:a7:2b:9e:30:5c:7b:c8:45:c1:4b:a1:c2:84:c4:e8:54:b5:d1:7a:48:a6:c5:25:b2:12:ba:5b:2a:cc:79
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR
Chains
Sep 14, 2023
CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
PE Signature issue
Digest
98:df:4f:b6:fa:a4:7d:04:8a:8b:6c:b3:33:d7:11:8e:94:ac:8d:b3
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR
Chains
Sep 14, 2023
CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR
Serial Number
45:2d:ba:a0:52:13:f6:ea:e3:56:65:03:d3:5c:05:ad
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 28, 2023 - Mar 27, 2026
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
1
Major OS version
6
Entry point
4592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredContinueHandler
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
PostQueuedCompletionStatus
RaiseFailFastException
ResumeThread
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WriteConsoleW
WriteFile
api-ms-win-crt-heap-l1-1-0
calloc
free
malloc
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_exit
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
abort
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
fwrite
api-ms-win-crt-string-l1-1-0
strlen
strncmp
EwlwLSglm
_cgo_dummy_export
Name
.text
Size
974KB
Virtual Size
974KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
103KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
584B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
295KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
102B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ