Discount list and amount discount_400a.iso
- SHA256 f9310bbcfec880bbfa7cd1ffaf2cfc62dc6c070b68d0005e830cb9e11874aa24
Password
spf200
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Discount list and amount discount_400a.iso
Resource
win10v2004-20260911-en
windows10-2004-x64
32 signatures
900 seconds
Behavioral task
behavioral2
Sample
Discount list and amount discount_400a.iso
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
General
- Target Discount list and amount discount_400a.iso
- Size 792KB
- Sample261030-jnvmtaxtax
- SHA256 f9310bbcfec880bbfa7cd1ffaf2cfc62dc6c070b68d0005e830cb9e11874aa24
- MD5 dd7ce94332c3270bb5fb7a132f9da8d1
- SHA1 b178b5d9648b2dc41662f2aaa9d683eed6e97da3
- SHA512 2f04817895d0e215062c3b53289b88cba29452b216a846d5019772828cc508254ce3ab404d75ab68f3df2cb439a5a83a5e638d64d822a7776a7d3881122d714f
- SSDEEP 24576:vP4OeYVZPiEBPogtiUkeWPrphc/eex/BY4gwe:3NeG5Dix+Y2/eex/a4gwe
- TLSH T13A051266736024F6D4B792788D955A62FB71B41B03B053DF322C86791F237D92E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/wmicodegen.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/wmicodegen.dll
File Explorer
-
Discount list and amount discount_400a.iso.iso 792KB
-
out.iso.iso 792KB
-
Discount list and amount discount.exe.exe 174KB
-
wmicodegen.dll.dll 8KB
-
ws.png.png 555KB
out.iso
- SHA256 f9310bbcfec880bbfa7cd1ffaf2cfc62dc6c070b68d0005e830cb9e11874aa24
- MD5 dd7ce94332c3270bb5fb7a132f9da8d1
- SHA1 b178b5d9648b2dc41662f2aaa9d683eed6e97da3
- SHA512 2f04817895d0e215062c3b53289b88cba29452b216a846d5019772828cc508254ce3ab404d75ab68f3df2cb439a5a83a5e638d64d822a7776a7d3881122d714f
- SSDEEP 24576:vP4OeYVZPiEBPogtiUkeWPrphc/eex/BY4gwe:3NeG5Dix+Y2/eex/a4gwe
- TLSH T13A051266736024F6D4B792788D955A62FB71B41B03B053DF322C86791F237D92E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
spf200
Discount list and amount discount.exe
- IMPHASH 2aa2b758b667e9bc3668dd7e59073362
- SHA256 41d9c8f7662e76d62da7aac907d6419be76f60259241e16e7d8025ed4aa34d12
- MD5 bb97150614bcb7fba7040f6674037605
- SHA1 d3a6234a854886088eb29b21b26125b811a87768
- SHA512 32d77ccc2aec0cda4ef0eadb39a787221d25d7e0f01dcfa2dd23e94b8843037f70bccc6ffa33537acd01c1a04c03a3b0d108a7799abd4d73420d8ff26e8d62c4
- SSDEEP 3072:chlUYCVlFF4smO1RWUdESZhMiPx4DPmCJvo1aJBl0Zbln8D:chOY4tmOymfZJxAPj+sJsA
- TLSH T1C4048C5673A824F6D4728178CA959A56F772B42B033183DF035486791F33BEA6E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
spf200
Digest
cd:46:40:28:ab:a6:65:ca:88:cf:55:48:8f:eb:18:9e:00:9a:b4:91:13:f6:fa:b4:79:c0:fc:7f:fb:6c:f4:c7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:87:bc:82:6e:85:a1:ae:53:a8:00:00:00:00:00:87
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Convert-MofToProvider.pdb
kernel32
CompareStringA
HeapSetInformation
SetThreadPreferredUILanguages
GetModuleHandleA
CreateFileW
WriteConsoleW
GetCommandLineA
GetVersionExW
RtlLookupFunctionEntry
RtlUnwindEx
ExitProcess
GetModuleHandleExW
GetProcAddress
GetLastError
MultiByteToWideChar
CreateDirectoryA
HeapAlloc
RtlPcToFileHeader
RaiseException
SetUnhandledExceptionFilter
EncodePointer
DecodePointer
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
GetStdHandle
WriteFile
GetModuleFileNameA
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
RtlUnwind
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
CloseHandle
HeapFree
GetLocaleInfoA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesA
GetStringTypeW
Sleep
LoadLibraryExW
IsProcessorFeaturePresent
CreateFileA
LCMapStringW
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
ReadConsoleW
GetLocaleInfoW
SetEndOfFile
GetProcessHeap
SetFilePointer
SetThreadStackGuarantee
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
wmicodegen
GeneratorMain
err
ValidIdent
GeneratorAdapterCode
user32
LoadStringW
Name
.text
Size
104KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=259, version=33145,
count=2, productName=Unmarked objects (old),
count=128, id=260, version=33145,
count=56, id=261, version=33145,
count=7, id=257, version=33145,
count=102, id=1, productName=Unmarked objects,
count=4, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
wmicodegen.dll
- IMPHASH 7ab454bd9cbaf1b3b527b365e6fefe48
- SHA256 2bc69875eccc9161171a619fed516109af3b1f4c475cd169d03455852516194a
- MD5 2a6b34d5f7d85fa34578c085381fbdb1
- SHA1 418b710d513a2a6ca592f84e0760b6d96e5a34b1
- SHA512 7cc6d43edc30608df52d42702d51c4a2a0eef6ca5cd962956d58935305932363003ab14ff2fce140e04ec9c3c18950a3cac7563970ef420c0285f93b4213d6ea
- SSDEEP 192:RhLjzEh3s1Omm2zGTjBqq8f7HWFfQWsZJTHnyQ3hJgGl:Rx+81Vm2zyBqqCaFfQWsby2hn
- TLSH T1B502E903FAA071F8CC2ED57507877423E6F4BC489924266FEB538B3678B06926739568
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
spf200
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
user32
ReleaseDC
GetDC
kernel32
GetTickCount
GeneratorAdapterCode
GeneratorMain
LookupString
ValidIdent
err
Name
.textc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.cdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ldata
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rodata
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ws.png
- SHA256 6b77c908dcaa1913763ecafe4bfbd34766ef12ebcfe1a0671c1f0964ec8b1712
- MD5 9ec588434303120637c253b66620569c
- SHA1 1440d48b9679166120d71f1311778911c10f741d
- SHA512 eef376477e4e568e1be9dfe0a52619614d3ded0ba9cac0a05dde2fb0fe7c84f7be6610375daece0337edafa549a7127242ead28762c73b33288d2263360f1b92
- SSDEEP 12288:WAtEYODk4isZukogpcYlhXIRUkeWP0spanKL1c/4vex/B2pvAq9weN:WiEBPogtiUkeWPrphc/eex/BY4gweN
- TLSH T13EC423B5B71139ABF1FBA7F21CBA2D736D68398E07C837D3513A8CA5144121C242B56B
- MD5 SHA1 SHA512 SSDEEP TLSH