10-2_Expedited_Procurement_Contract_7df0[1].iso
- SHA256 6abffbd8a1464d3daf742fb291821560b3071ad6bf428a230dc647de7e659a20
Static task
static1
1 signatures
General
- Target 10-2_Expedited_Procurement_Contract_7df0[1].iso
- Size 784KB
- Sample261102-ly6tyaeg22
- SHA256 6abffbd8a1464d3daf742fb291821560b3071ad6bf428a230dc647de7e659a20
- MD5 96ad47d13f2e13d8fd265c5dd906b1cf
- SHA1 d6afbfe0dd182ff8742ba8a0b3899adba9f8ef77
- SHA512 fd1c7185a8b2e07e454cc30121996ab90b6203338ec376eca8a56050e06dccae57ed1a4ed3b0746f020dafde40da4aadfb5208d602a4df1c9fa916a1c30716c4
- SSDEEP 12288:GKTr92i/qCDrWz88MsbP0cvFNIc91sg6ChCeaNML9rlvDVyKzw:/VyuWg8MkvFOcEg1hZiorlZzw
- TLSH T19305D059FBA455F5D067C078C4928502E6727C960770DBDF23A8873A1F232E29E3DB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/VSPMsg.dll
File Explorer
-
10-2_Expedited_Procurement_Contract_7df0[1].iso.iso 784KB
-
out.iso.iso 784KB
-
10-2 Expedited Procurement Contract.exe.exe 367KB
-
VSPMsg.dll.dll 364KB
out.iso
- SHA256 6abffbd8a1464d3daf742fb291821560b3071ad6bf428a230dc647de7e659a20
- MD5 96ad47d13f2e13d8fd265c5dd906b1cf
- SHA1 d6afbfe0dd182ff8742ba8a0b3899adba9f8ef77
- SHA512 fd1c7185a8b2e07e454cc30121996ab90b6203338ec376eca8a56050e06dccae57ed1a4ed3b0746f020dafde40da4aadfb5208d602a4df1c9fa916a1c30716c4
- SSDEEP 12288:GKTr92i/qCDrWz88MsbP0cvFNIc91sg6ChCeaNML9rlvDVyKzw:/VyuWg8MkvFOcEg1hZiorlZzw
- TLSH T19305D059FBA455F5D067C078C4928502E6727C960770DBDF23A8873A1F232E29E3DB62
- MD5 SHA1 SHA512 SSDEEP TLSH
10-2 Expedited Procurement Contract.exe
- IMPHASH 0fe2dbc3c552fce90abf4316acc494a0
- SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
- MD5 d455b3b0529d73929fb2f2ecd43b4f75
- SHA1 934549d96c0d836579d0ffd0d8c580ecbcd87b65
- SHA512 b490795b2bf54e1edb0d1f7075cf9c58fc7255e0ecef0ebce499ad42945700e2237421196f57880b92f7e3d036ee9b95354c9157d3f3b3a9a7fd65ff7d9c0952
- SSDEEP 6144:UK0CMcoPY19CebAiwu6B36NDrd8zzJ6aFMMkxGbP0cw:UKTr92i/qCDrWz88MsbP0cw
- TLSH T1EC849D46F7A418F5E0A7C139C9628906E7727C9A0770CBCF23A4466B2F272E15D3D762
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
59:cc:05:a4:75:9f:4e:a3:9a:9b:ac:7e:00:6c:ae:e6:6a:5f:da:d9:32:76:0f:e1:03:22:e1:42:bf:40:a5:7d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 15, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:04:6c:74:06:ff:57:2b:27:72:00:00:00:00:04:04
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0b:11:9d:56:29:92:f9:bf:85:00:01:00:00:02:0b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
122992
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\dbs\el\ddvsm\out\binaries\amd64ret\bin\amd64\VSPerfCmd.pdb
advapi32
GetAce
GetAclInformation
GetSecurityDescriptorDacl
GetSecurityInfo
RegOpenKeyExA
IsValidSid
RegQueryValueExA
RegCloseKey
GetExplicitEntriesFromAclA
ConvertStringSecurityDescriptorToSecurityDescriptorW
IsValidSecurityDescriptor
GetNamedSecurityInfoW
GetSecurityDescriptorSacl
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
RegCreateKeyExW
GetSecurityDescriptorOwner
SetSecurityDescriptorSacl
RegSetValueExW
InitializeSecurityDescriptor
MapGenericMask
SetSecurityDescriptorGroup
RegOpenKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
IsTextUnicode
SetSecurityDescriptorDacl
SetEntriesInAclA
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidLengthRequired
SetNamedSecurityInfoW
GetSecurityDescriptorControl
SetSecurityInfo
IsValidAcl
GetSecurityDescriptorLength
LookupAccountSidW
MakeSelfRelativeSD
LookupAccountNameW
MakeAbsoluteSD
GetSidIdentifierAuthority
CreateServiceW
QueryServiceStatus
CloseServiceHandle
QueryServiceConfigA
OpenSCManagerA
DeleteService
ChangeServiceConfigA
ControlService
StartServiceA
OpenServiceW
kernel32
CreateSemaphoreA
OpenSemaphoreA
CreateMutexA
SetNamedPipeHandleState
WaitNamedPipeA
CreateFileA
MapViewOfFileEx
CreateFileMappingW
CreateEventW
GetVersion
DuplicateHandle
ReleaseMutex
CreateMutexW
ExpandEnvironmentStringsW
CreateProcessW
WaitForMultipleObjects
GetUserDefaultUILanguage
FindFirstFileA
GetModuleFileNameA
PeekNamedPipe
CreatePipe
CreateEventA
ResetEvent
SetEvent
MapViewOfFile
SetUnhandledExceptionFilter
HeapSetInformation
GetProcAddress
LocalAlloc
GetTickCount
GetModuleHandleW
GetCurrentProcessId
SwitchToThread
RaiseException
OpenMutexA
Sleep
ProcessIdToSessionId
MultiByteToWideChar
OpenProcess
CreateFileW
WaitForSingleObject
GetLocaleInfoW
GetModuleFileNameW
DeviceIoControl
SetLastError
GetSystemDefaultLCID
OpenEventA
FindResourceW
LoadResource
FindResourceExW
CloseHandle
LockResource
GetModuleHandleA
GetEnvironmentVariableW
SizeofResource
GetProcessHeap
DeleteCriticalSection
LocalFree
HeapDestroy
HeapAlloc
HeapReAlloc
GetVersionExA
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
CompareStringW
TlsAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetFileType
LCMapStringW
OutputDebugStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
WriteConsoleW
FindFirstFileW
InitializeCriticalSection
GetConsoleScreenBufferInfo
WriteConsoleA
FormatMessageW
GetConsoleWindow
FormatMessageA
GetSystemInfo
GetFileAttributesW
LoadLibraryA
QueryPerformanceFrequency
LoadLibraryW
GetDriveTypeW
GetFileSize
VirtualAlloc
VirtualUnlock
UnmapViewOfFile
VirtualLock
CreateFileMappingA
OpenFileMappingA
vspmsg
SetErrorMessageModule
GetErrorMessageModule
user32
IsWindowVisible
ole32
CoUninitialize
CoCreateInstance
CLSIDFromString
CoInitialize
CoInitializeEx
oleaut32
SysAllocStringLen
SysAllocString
SysFreeString
setupapi
SetupDiSetClassRegistryPropertyA
SetupDiGetClassRegistryPropertyA
shlwapi
SHCreateStreamOnFileW
PathAddBackslashW
PathAppendW
PathRemoveFileSpecW
pdh
PdhLookupPerfNameByIndexW
xmllite
CreateXmlReader
Name
.text
Size
250KB
Virtual Size
249KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=262, version=27412,
count=2, id=257, version=34440,
count=2, id=259, version=34440,
count=12, id=260, version=27412,
count=5, id=259, version=27412,
count=157, id=261, version=27412,
count=9, id=259, version=34321,
count=19, id=260, version=34321,
count=52, id=261, version=34321,
count=21, id=257, version=27412,
count=242, id=1, productName=Unmarked objects,
count=55, id=265, version=34440,
count=1, id=255, version=34440,
count=1, id=258, version=34440,
VSPMsg.dll
- IMPHASH 77e6998d35b0bc16ebf3e6bf817cf0ff
- SHA256 84c3c6a4fc8b2adb3aa5696e1a342c8c3673bcc0a524eb0501835aea9a7b6918
- MD5 2d8eb77898ce15b3d7fcb0eb8b37daa5
- SHA1 c2901f1dec41d82645df24fcb36676e819c66167
- SHA512 5dee1593abdf462e94d3645a4386d3448f8aa289077c942af25750bec1dd68baa07d72122a88790428fe6c1084965a607f492a7861e43f3a902e60018b893b78
- SSDEEP 6144:0CSOEmINm3YW4F91TAsPH8FjCh+XelgNqXVLP9rQeZhnvDVyRUzfsQM:0FNIc91sg6ChCeaNML9rlvDVyKzw
- TLSH T15684F17E4C92E235D71950FCD0D291108671B8A147603EF70AEAE7380A159E3DF62FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4848
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcessHeap
HeapAlloc
HeapFree
GetModuleHandleA
LoadLibraryExW
GetProcAddress
LoadLibraryA
FreeLibrary
CreateMutexW
CloseHandle
GetSystemInfo
GetLocalTime
GlobalMemoryStatusEx
GetTickCount
GetErrorMessageModule
SetErrorMessageModule
Name
CODE
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.idata
Size
310KB
Virtual Size
309KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
DATA
Size
512B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.xdata
Size
512B
Virtual Size
372B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rodata
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ