8baafadc92d93f8e1211dabfe060d4c22e725e6a1d229a06bf81581072e8af6a

Sharing

Copy URL Twitter E-mail

General

Target
8baafadc92d93f8e1211dabfe060d4c22e725e6a1d229a06bf81581072e8af6a
Size 68KB
Sample261107-nktcsscw7m
SHA256 8baafadc92d93f8e1211dabfe060d4c22e725e6a1d229a06bf81581072e8af6a
MD5 867344fa881bbf04b65677d93d81adf1
SHA1 6d1d2a0d60a4b8f1287ad6001174bda7c3f20ccb
SHA512 0bbeb4d99b67cd51a4b3b4d8508d75d1ba12d264d774e287c2bcf1c08064b4b31b4f1c71d9a993fcab4f1a5be2b7a698adcdd556fe68ae1b0728934c40f352d9
SSDEEP 768:zMHk7tF3JgxMbHS3QyDOlUlqwGLGzV3U31NeYNJOl4Q2PJkk0v2ue15AL4:zMHk77RbHSg0BGLGz1eO6HJkk0vpM
TLSH
T10B633B17CE65506BE26ADD78C5824C11EE72BCC68BA1A5CF57910DE60E61BD0AF3E302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
8baafadc92d93f8e1211dabfe060d4c22e725e6a1d229a06bf81581072e8af6a

File Explorer

8baafadc92d93f8e1211dabfe060d4c22e725e6a1d229a06bf81581072e8af6a

.exe 68KB

8baafadc92d93f8e1211dabfe060d4c22e725e6a1d229a06bf81581072e8af6a

IMPHASH c9b41fc50ecbe895405946920ec2a08a
SHA256 8baafadc92d93f8e1211dabfe060d4c22e725e6a1d229a06bf81581072e8af6a
MD5 867344fa881bbf04b65677d93d81adf1
SHA1 6d1d2a0d60a4b8f1287ad6001174bda7c3f20ccb
SHA512 0bbeb4d99b67cd51a4b3b4d8508d75d1ba12d264d774e287c2bcf1c08064b4b31b4f1c71d9a993fcab4f1a5be2b7a698adcdd556fe68ae1b0728934c40f352d9
SSDEEP 768:zMHk7tF3JgxMbHS3QyDOlUlqwGLGzV3U31NeYNJOl4Q2PJkk0v2ue15AL4:zMHk77RbHSg0BGLGz1eO6HJkk0vpM
TLSH
T10B633B17CE65506BE26ADD78C5824C11EE72BCC68BA1A5CF57910DE60E61BD0AF3E302
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

2a:fb:f4:7b:d4:99:d3:e2:d8:fb:d0:ff:e9:86:61:42:01:f8:d8:3c:8f:86:d8:c5:31:d1:dc:f4:dc:bb:26:87

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,STREET=1 F.\, No. 15\, Lide Rd.\, Beitou Dist.\,,L=Taipei,ST=Taipei,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 16, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

75:ef:25:14:de:19:46:15:2a:7a:4e:9e

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 25, 2025 - Apr 25, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

28912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shlwapi

PathFindExtensionW PathFileExistsW

kernel32

GetSystemTimeAsFileTime CreateDirectoryW GetCommandLineW InitializeCriticalSectionEx SetProcessMitigationPolicy MultiByteToWideChar OutputDebugStringW DeleteCriticalSection GetCurrentThreadId GetCurrentProcessId GetLastError InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry QueryPerformanceCounter GetModuleHandleW GetStartupInfoW IsProcessorFeaturePresent RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent

advapi32

GetUserNameW

shell32

CommandLineToArgvW ShellExecuteW SHGetFolderPathW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

msvcp140

?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?id@?$ctype@_W@std@@2V0locale@2@A ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate memcpy memset __C_specific_handler _CxxThrowException __current_exception __current_exception_context memmove

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _configure_narrow_argv _cexit _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _initialize_narrow_environment _c_exit _register_thread_local_exe_atexit_callback _invoke_watson terminate _crt_atexit

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64_s

api-ms-win-crt-stdio-l1-1-0

ungetc setvbuf fputwc __p__commode _set_fmode fwrite _fseeki64 fgetwc fgetc fsetpos ungetwc fgetpos fclose fflush

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

8baafadc92d93f8e1211dabfe060d4c22e725e6a1d229a06bf81581072e8af6a

PE Signature issue

shlwapi

kernel32

advapi32

shell32

ole32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic