fences4.zip
- SHA256 b7c91c3092611b9830590b493a69a3d3af6180d6eee325308bb495886263c5f7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Fences4_setup_sd.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fences4_setup_sd.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
stardock.fences.3.0.5.x64-patch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
stardock.fences.3.0.5.x64-patch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target fences4.zip
- Size 12.3MB
- Sample261102-dc7v4sea29
- SHA256 b7c91c3092611b9830590b493a69a3d3af6180d6eee325308bb495886263c5f7
- MD5 f25fe250ffaadf37030429ef52c5ecfd
- SHA1 9a3f1564427d4ff2e39eecf17c2128ecda163086
- SHA512 05d923065231f1ba3c9f7d8b0d78a5c8d54bd2b251a2cbd581cb10cf351dfa5c0f8328f88f4a46b0ce9853d1fd244c4442014f125f7feb073332a2dcb6432225
- SSDEEP 196608:ncu6764nWv8ISBkpiSvf5LAGVq9doohFujCRiMWGgG9oxlyw5wYF7DdZ+VTqHlZW:nRe9kpiQfSG7omjC8U/UlT97DdZ+FqVs
- TLSH T181D633301B3B63BAC943911D9B23F1AA32E27F42154BCCDD52C6ABC8F65555BD08A07E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/stardock.fences.3.0.5.x64-patch.exe
File Explorer
-
fences4.zip.zip 12.3MB
-
Fences4_setup_sd.exe.exe 12.4MB
-
stardock.fences.3.0.5.x64-patch.exe.exe 388KB
Fences4_setup_sd.exe
- IMPHASH d619eda1a774da262071361b928bb2e4
- SHA256 6f8aa84021cc190bfc9c7efa375f6e8adfafa8bb1832ba5ea6ddc8a211ca888f
- MD5 f8db736dc6c611ff78e853e79cf749f6
- SHA1 592bb1965595331ec7cf3322be2aad6b1cd1c001
- SHA512 5d4bc2adf6f14a9d34bc01affb10dd62da2c5e1cf2e84a7e0940c17edb3e47fba04052899283eaf132dbc399b10c1eb1275a9f7e90e26e2e45a7c697f65c3328
- SSDEEP 196608:oNaqQ8EAwKAviL86vrdP2qfozoDU4WQ8J8v/l8+kUvpakbrEcQrFvB+X5abjPBLN:oAPhiL8YrkqTU4WPJ822p/srFvB+Jar
- TLSH T11AD63312A761D0BAE59D1035C8A183F25B723E74EB1788EB97C17DCC7870AF2A735069
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2e:ff:87:e0:c9:51:cf:a2:74:10:0b:ed:e5:bd:e2:19:83:7e:30:00:f3:70:eb:e4:0f:1f:18:64:97:70:20:fb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=STARDOCK SYSTEMS\, INC.,O=STARDOCK SYSTEMS\, INC.,L=Plymouth,ST=Michigan,C=US
Chains
Dec 7, 2021
CN=STARDOCK SYSTEMS\, INC.,O=STARDOCK SYSTEMS\, INC.,L=Plymouth,ST=Michigan,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=STARDOCK SYSTEMS\, INC.,O=STARDOCK SYSTEMS\, INC.,L=Plymouth,ST=Michigan,C=US
Serial Number
0c:16:3c:4a:24:38:b0:3a:43:e1:70:f4:83:b7:b8:c8
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 8, 2019 - Apr 20, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
1
Major OS version
5
Entry point
11489
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
lstrcpyA
lstrcatA
lstrlenA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
_lclose
GetModuleFileNameA
_lread
_llseek
_lopen
_lwrite
_lcreat
CreateDirectoryA
SetCurrentDirectoryA
GetDiskFreeSpaceA
GetFileAttributesA
CompareStringA
DeleteFileA
GetTempPathA
GetCurrentDirectoryA
CloseHandle
GetExitCodeProcess
GetLastError
LocalFree
GetCurrentProcess
MoveFileExA
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapReAlloc
RtlUnwind
HeapSize
Sleep
RemoveDirectoryA
FreeLibrary
IsValidCodePage
GetOEMCP
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
HeapCreate
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
user32
TranslateMessage
DispatchMessageA
PeekMessageA
wsprintfA
LoadCursorA
SetCursor
MessageBoxA
MsgWaitForMultipleObjects
advapi32
GetTokenInformation
OpenProcessToken
shell32
ShellExecuteExA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=67, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=102, id=1, productName=Unmarked objects,
count=25, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
stardock.fences.3.0.5.x64-patch.exe
- IMPHASH dc73a9bd8de0fd640549c85ac4089b87
- SHA256 5405e5c8a154f6219c933dba05ef3ca2d1162e666cd36b183ba8580f209c898e
- MD5 a83c862ce356ce27aa1bcad439de71ac
- SHA1 777680118a9128f5f59b3855ddeb6361b4171722
- SHA512 4e2e1039dab95ef3d27d6f1fa2e3674bd29f29c41d9bd0d9bea7cfc3dc1f7821ba013b76ca07b713852f923b4662df90a1da9180bbd14ee6442e66da6bb8e853
- SSDEEP 6144:zFbE8KURmKDa4PRwrPw/SMekXKKoGGJavRO+tGj9ZCkXleBnXr8x5JbY7ZZv:zFVKMmf4PRyP0XRoGIM2Hod8npYNp
- TLSH T1A18423B96EC92B5CC51219F304EBE8CA87CF2D73B1B571B9A7601D199E360A7CC8E054
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4139
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile
Name
.text
Size
512B
Virtual Size
502B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
385KB
Virtual Size
384KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
82B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=18, version=8444,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=17, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,