Financial Statistical Reports_1435.iso
- SHA256 5ba583585e4fe56cdee37569ffd4702d908035c8bf9b8991c69143cc7a665f63
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Financial Statistical Reports.exe
Resource
win11-20260911-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Financial Statistical Reports.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
VSPMsg.dll
Resource
win11-20260911-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
VSPMsg.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target Financial Statistical Reports_1435.iso
- Size 984KB
- Sample261102-cq4vyadh77
- SHA256 5ba583585e4fe56cdee37569ffd4702d908035c8bf9b8991c69143cc7a665f63
- MD5 7f275c951df49d42b0ab11a73a2b6130
- SHA1 061f54faa107a713c184b7322df05227ba1c7d7e
- SHA512 bb450ca99dcee8a3cb226217720ab2aed2fb151bab560d4c8f1a0a0f468b399617a165e703c9c44fe76023282a65531f561db66c78348edd9ff51156ca7e12e4
- SSDEEP 12288:MKTr92i/qCDrWz88MsbP0cVt0ogGVuG8FHHOrWTNEFTyEgRCzBd+fZ8OMO3J:hVyuWg8MkV+7ouBFHHXTNE1oCdd+f+p
- TLSH T14025F046F3A419F5D0ABC138C9628516E772BC9A0775CBCF33A8466A2F232D14E3D752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/VSPMsg.dll
File Explorer
-
Financial Statistical Reports_1435.iso.iso 984KB
-
out.iso.iso 984KB
-
Financial Statistical Reports.exe.exe 367KB
-
VSPMsg.dll.dll 9KB
-
ws.png.png 555KB
out.iso
- SHA256 5ba583585e4fe56cdee37569ffd4702d908035c8bf9b8991c69143cc7a665f63
- MD5 7f275c951df49d42b0ab11a73a2b6130
- SHA1 061f54faa107a713c184b7322df05227ba1c7d7e
- SHA512 bb450ca99dcee8a3cb226217720ab2aed2fb151bab560d4c8f1a0a0f468b399617a165e703c9c44fe76023282a65531f561db66c78348edd9ff51156ca7e12e4
- SSDEEP 12288:MKTr92i/qCDrWz88MsbP0cVt0ogGVuG8FHHOrWTNEFTyEgRCzBd+fZ8OMO3J:hVyuWg8MkV+7ouBFHHXTNE1oCdd+f+p
- TLSH T14025F046F3A419F5D0ABC138C9628516E772BC9A0775CBCF33A8466A2F232D14E3D752
- MD5 SHA1 SHA512 SSDEEP TLSH
Financial Statistical Reports.exe
- IMPHASH 0fe2dbc3c552fce90abf4316acc494a0
- SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
- MD5 d455b3b0529d73929fb2f2ecd43b4f75
- SHA1 934549d96c0d836579d0ffd0d8c580ecbcd87b65
- SHA512 b490795b2bf54e1edb0d1f7075cf9c58fc7255e0ecef0ebce499ad42945700e2237421196f57880b92f7e3d036ee9b95354c9157d3f3b3a9a7fd65ff7d9c0952
- SSDEEP 6144:UK0CMcoPY19CebAiwu6B36NDrd8zzJ6aFMMkxGbP0cw:UKTr92i/qCDrWz88MsbP0cw
- TLSH T1EC849D46F7A418F5E0A7C139C9628906E7727C9A0770CBCF23A4466B2F272E15D3D762
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
59:cc:05:a4:75:9f:4e:a3:9a:9b:ac:7e:00:6c:ae:e6:6a:5f:da:d9:32:76:0f:e1:03:22:e1:42:bf:40:a5:7d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 15, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:04:6c:74:06:ff:57:2b:27:72:00:00:00:00:04:04
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0b:11:9d:56:29:92:f9:bf:85:00:01:00:00:02:0b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
122992
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\dbs\el\ddvsm\out\binaries\amd64ret\bin\amd64\VSPerfCmd.pdb
advapi32
GetAce
GetAclInformation
GetSecurityDescriptorDacl
GetSecurityInfo
RegOpenKeyExA
IsValidSid
RegQueryValueExA
RegCloseKey
GetExplicitEntriesFromAclA
ConvertStringSecurityDescriptorToSecurityDescriptorW
IsValidSecurityDescriptor
GetNamedSecurityInfoW
GetSecurityDescriptorSacl
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
RegCreateKeyExW
GetSecurityDescriptorOwner
SetSecurityDescriptorSacl
RegSetValueExW
InitializeSecurityDescriptor
MapGenericMask
SetSecurityDescriptorGroup
RegOpenKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
IsTextUnicode
SetSecurityDescriptorDacl
SetEntriesInAclA
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidLengthRequired
SetNamedSecurityInfoW
GetSecurityDescriptorControl
SetSecurityInfo
IsValidAcl
GetSecurityDescriptorLength
LookupAccountSidW
MakeSelfRelativeSD
LookupAccountNameW
MakeAbsoluteSD
GetSidIdentifierAuthority
CreateServiceW
QueryServiceStatus
CloseServiceHandle
QueryServiceConfigA
OpenSCManagerA
DeleteService
ChangeServiceConfigA
ControlService
StartServiceA
OpenServiceW
kernel32
CreateSemaphoreA
OpenSemaphoreA
CreateMutexA
SetNamedPipeHandleState
WaitNamedPipeA
CreateFileA
MapViewOfFileEx
CreateFileMappingW
CreateEventW
GetVersion
DuplicateHandle
ReleaseMutex
CreateMutexW
ExpandEnvironmentStringsW
CreateProcessW
WaitForMultipleObjects
GetUserDefaultUILanguage
FindFirstFileA
GetModuleFileNameA
PeekNamedPipe
CreatePipe
CreateEventA
ResetEvent
SetEvent
MapViewOfFile
SetUnhandledExceptionFilter
HeapSetInformation
GetProcAddress
LocalAlloc
GetTickCount
GetModuleHandleW
GetCurrentProcessId
SwitchToThread
RaiseException
OpenMutexA
Sleep
ProcessIdToSessionId
MultiByteToWideChar
OpenProcess
CreateFileW
WaitForSingleObject
GetLocaleInfoW
GetModuleFileNameW
DeviceIoControl
SetLastError
GetSystemDefaultLCID
OpenEventA
FindResourceW
LoadResource
FindResourceExW
CloseHandle
LockResource
GetModuleHandleA
GetEnvironmentVariableW
SizeofResource
GetProcessHeap
DeleteCriticalSection
LocalFree
HeapDestroy
HeapAlloc
HeapReAlloc
GetVersionExA
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
CompareStringW
TlsAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetFileType
LCMapStringW
OutputDebugStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
WriteConsoleW
FindFirstFileW
InitializeCriticalSection
GetConsoleScreenBufferInfo
WriteConsoleA
FormatMessageW
GetConsoleWindow
FormatMessageA
GetSystemInfo
GetFileAttributesW
LoadLibraryA
QueryPerformanceFrequency
LoadLibraryW
GetDriveTypeW
GetFileSize
VirtualAlloc
VirtualUnlock
UnmapViewOfFile
VirtualLock
CreateFileMappingA
OpenFileMappingA
vspmsg
SetErrorMessageModule
GetErrorMessageModule
user32
IsWindowVisible
ole32
CoUninitialize
CoCreateInstance
CLSIDFromString
CoInitialize
CoInitializeEx
oleaut32
SysAllocStringLen
SysAllocString
SysFreeString
setupapi
SetupDiSetClassRegistryPropertyA
SetupDiGetClassRegistryPropertyA
shlwapi
SHCreateStreamOnFileW
PathAddBackslashW
PathAppendW
PathRemoveFileSpecW
pdh
PdhLookupPerfNameByIndexW
xmllite
CreateXmlReader
Name
.text
Size
250KB
Virtual Size
249KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=262, version=27412,
count=2, id=257, version=34440,
count=2, id=259, version=34440,
count=12, id=260, version=27412,
count=5, id=259, version=27412,
count=157, id=261, version=27412,
count=9, id=259, version=34321,
count=19, id=260, version=34321,
count=52, id=261, version=34321,
count=21, id=257, version=27412,
count=242, id=1, productName=Unmarked objects,
count=55, id=265, version=34440,
count=1, id=255, version=34440,
count=1, id=258, version=34440,
VSPMsg.dll
- IMPHASH 7ab454bd9cbaf1b3b527b365e6fefe48
- SHA256 20fed915cd893469f7b5d74b0f9d1e845b62bfbb4fdf93a8434269e87a193f10
- MD5 c086f13c6381d7016a7f51d383eaf70b
- SHA1 1831e420e6d64c669cd484fdf5efd04b4bcd74a8
- SHA512 3715f05cec8cacfdb36ad2afbd939e7ca195b090c7dd24568e9d87bca020ee42973171c13a6917aaad112f723ce455987833918618cb67d1b2b9afd1eb2dd878
- SSDEEP 192:5LjzBNDets1OmDZk8Vc+eqyf7H2M/wWZJcYXHrlnT+Qgeol:pvyq1Vdk8eqc6M/wW0yrRCQ2l
- TLSH T18512FA02F7E031FCD87AC27407976123E6B1BC499932E71FAB8257623870651EA39769
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
user32
ReleaseDC
GetDC
kernel32
GetTickCount
GetErrorMessageModule
SetErrorMessageModule
Name
.ntext
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.cdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rodata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ws.png
- SHA256 12346f1926105296487d5f48018e9539d3b3feee58c3473bb978dda1289a306b
- MD5 1e4b9e7a7c8043ebbc7e8887d8228585
- SHA1 9c6e0903a6ecfa93eefbdd4ec1b73721c8f26211
- SHA512 514bdbbb1ea328a738321488c6d52f1a16d38e813b62bf2340774e5012909affc6cf1efe52cc8977da02cc043d1a90d123d0122636d348e46f253a440b255ff4
- SSDEEP 12288:v0ogGVuG8FHHOrWTNEFTyEgRCzBd+fZ8OMO3JE:c7ouBFHHXTNE1oCdd+f+pF
- TLSH T120C423B1C092D760C21D9CF892EDA2349370CF9D253E10CBF794D51AEFE28859659AC7
- MD5 SHA1 SHA512 SSDEEP TLSH