ONLYOFFICEDesktopInstaller[.]exe

Resubmissions

07/11/2026, 23:02

261107-2z89fsgd798

07/11/2026, 23:01

261107-2zq3waf12w8

07/11/2026, 22:36

261107-2h7z3afy7x8

07/11/2026, 22:12

261107-14vfesss5p7

Sharing

Copy URL Twitter E-mail

General

Target
ONLYOFFICEDesktopInstaller.exe
Size 1.0MB
Sample261107-2z89fsgd79
SHA256 d9e0d2295c976371a5b07be66c9b6814c7440a87d104fa7430583aa61fb2e59d
MD5 70f2db80213ba7857ead8f38878d7cd4
SHA1 ad0fb476d957f964e72bb04df2a1f2993e614734
SHA512 bbfe46b8dc8ffc25f543b214754693cc82e95a3304fad17a8528756ed0f5560c91e51c94386656e495fb214762ae514fa19ac9e356a4e458267d8c69cbb54957
SSDEEP 24576:PEY0gWo/nDttK4ylK20CnqGkb91czQT64L9WSto8WDRe4v3b:PI4nJtK4ylK20CnDw1cET64Do8URea3b
TLSH
T1C135E319FD8984F2D09341B12D1A966D53F9EF148B2105D7E29836BF3AF81E10A33D6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
ONLYOFFICEDesktopInstaller.exe

File Explorer

ONLYOFFICEDesktopInstaller.exe

.exe 1.0MB

ONLYOFFICEDesktopInstaller.exe

IMPHASH 24ddf9462546864d6ecb627417c18c5a
SHA256 d9e0d2295c976371a5b07be66c9b6814c7440a87d104fa7430583aa61fb2e59d
MD5 70f2db80213ba7857ead8f38878d7cd4
SHA1 ad0fb476d957f964e72bb04df2a1f2993e614734
SHA512 bbfe46b8dc8ffc25f543b214754693cc82e95a3304fad17a8528756ed0f5560c91e51c94386656e495fb214762ae514fa19ac9e356a4e458267d8c69cbb54957
SSDEEP 24576:PEY0gWo/nDttK4ylK20CnqGkb91czQT64L9WSto8WDRe4v3b:PI4nJtK4ylK20CnDw1cET64Do8URea3b
TLSH
T1C135E319FD8984F2D09341B12D1A966D53F9EF148B2105D7E29836BF3AF81E10A33D6E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

24:30:d5:8b:27:8f:a6:73:73:d5:73:0e:90:6b:27:36:3c:6f:87:7a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Ascensio System SIA,O=Ascensio System SIA,L=Riga,C=LV

Chains

Dec 18, 2025

CN=Ascensio System SIA,O=Ascensio System SIA,L=Riga,C=LV

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Ascensio System SIA,O=Ascensio System SIA,L=Riga,C=LV

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=Ascensio System SIA,O=Ascensio System SIA,L=Riga,C=LV

Serial Number

02:06:f1:56:14:73:b5:ad:43:b3:bd:93:8e:cb:82:be

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 13, 2023 - Mar 14, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

339357

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetClientRect GetWindowRect ClientToScreen EndPaint BeginPaint MonitorFromRect ReleaseDC GetDC LoadImageW FindWindowW ScreenToClient SetRect OffsetRect EnumChildWindows DrawIconEx GetAncestor DestroyIcon GetMessageW TranslateMessage MessageBoxW PostQuitMessage RegisterClassExW GetPropW GetWindowLongW SetWindowLongW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx LoadCursorW SetTimer KillTimer SetWindowPos GetWindowPlacement IsWindowVisible IsZoomed GetDCEx RedrawWindow MapWindowPoints FillRect FrameRect EnumThreadWindows GetWindow MonitorFromWindow GetMonitorInfoW SetFocus SetForegroundWindow SetWindowTextW ReleaseCapture GetCursorPos WindowFromPoint PtInRect SetParent SetCursor GetClassLongW SetClassLongW SystemParametersInfoA UpdateWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassW DefWindowProcW SendMessageW PostMessageW DispatchMessageW GetSystemMetrics

shell32

SHFileOperationW CommandLineToArgvW ShellExecuteExW SHGetFolderPathW SHAppBarMessage DragQueryFileW DragFinish

shlwapi

SHDeleteKeyW SHGetValueW ColorRGBToHLS ColorHLSToRGB

winhttp

WinHttpCrackUrl WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen

wintrust

WinVerifyTrust

gdi32

CreateFontA ExtSelectClipRgn OffsetRgn ExcludeClipRect CreateSolidBrush CreateRectRgn CombineRgn MoveToEx GetObjectW CreateDIBSection SelectObject LineTo DeleteObject DeleteDC CreateCompatibleDC BitBlt GetDeviceCaps CreatePen

gdiplus

GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipCreateMetafileFromStream GdipCreatePath GdipDeletePath GdipResetPath GdipClosePathFigure GdipAddPathLine GdipAddPathArc GdipCreateMatrix GdipCreateMatrix2 GdipDeleteMatrix GdipCreateRegion GdipDeleteRegion GdipGetRegionBounds GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenWidth GdipSetPenColor GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipSetWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawLines GdipDrawRectangle GdipDrawEllipseI GdipDrawPath GdipGraphicsClear GdipFillRectangleI GdipFillEllipse GdipFillEllipseI GdipFillPath GdipDrawImageRectI GdipCreateFontFromLogfontW GdipDeleteFont GdipDrawString GdipMeasureCharacterRanges GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipGetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipMeasureString GdiplusShutdown GdiplusStartup GdipSetStringFormatMeasurableCharacterRanges

advapi32

CryptReleaseContext RegOpenKeyExW CryptAcquireContextW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash OpenProcessToken GetTokenInformation RegQueryValueExW ConvertSidToStringSidW RegCloseKey

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW

ole32

CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal

msi

ord246 ord70

winmm

timeEndPeriod timeBeginPeriod timeGetDevCaps

comctl32

_TrackMouseEvent

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

kernel32

HeapFree HeapReAlloc HeapAlloc RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc GetVersionExW LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SwitchToThread SignalObjectAndWait CreateTimerQueue InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent SetEvent GetCPInfo LCMapStringW CompareStringW GetCurrentThread WaitForSingleObjectEx DuplicateHandle GetTickCount GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue GetModuleHandleExW CreateEventW InitializeCriticalSectionAndSpinCount SetLastError ExitProcess GetStdHandle IsValidCodePage GetACP GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx GetTimeZoneInformation FindFirstFileExW QueryPerformanceCounter GetStringTypeW IsProcessorFeaturePresent QueueUserWorkItem DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection WideCharToMultiByte RaiseException DecodePointer EncodePointer MulDiv GetCurrentThreadId MultiByteToWideChar GetModuleHandleA HeapWalk HeapUnlock HeapLock GetProcessHeap FormatMessageW LoadLibraryW GetProcAddress GetModuleFileNameW FreeLibrary IsWow64Process GetExitCodeProcess GetCurrentProcess Sleep WaitForSingleObject GetTempPathW ReadFile GetFileAttributesW FindNextFileW FindFirstFileW FindClose GetLocaleInfoW GlobalFree GlobalUnlock GlobalLock GlobalAlloc FindResourceW SizeofResource LockResource LoadResource GetModuleHandleW FreeResource WriteFile DeleteFileW CreateFileW GetUserDefaultUILanguage LocalFree CreateMutexW GetLastError CloseHandle GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle ReadConsoleW SetEndOfFile WriteConsoleW HeapSize TlsAlloc

Name

.text

Size

591KB

Virtual Size

590KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

260KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ONLYOFFICEDesktopInstaller.exe

user32

shell32

shlwapi

winhttp

wintrust

gdi32

gdiplus

advapi32

rpcrt4

ole32

msi

winmm

comctl32

oleaut32

kernel32

generic