NULLSUB.zip
- SHA256 2a705d55e06d535a1d2e333bfdd7b84e278122d4752de14c324d667c67e6ce50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NULLSUB.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
NULLSUB.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target NULLSUB.zip
- Size 1.2MB
- Sample261107-pmfedsc13q
- SHA256 2a705d55e06d535a1d2e333bfdd7b84e278122d4752de14c324d667c67e6ce50
- MD5 1f9f9b30a14d798c649d2085522e4346
- SHA1 5c6f307768639df597d8612ef8b49fc125b61384
- SHA512 0a256ee5dcbf4d9248621bf2f1940f1ff2609d776c7c48295ec7e2fe8f95f57fd39b35437b8c220cefffc1e5b8d3817efeb6252d690efdc71b57c48b1bcd638b
- SSDEEP 24576:PDlv3W3G2ki+lNzK/tBS84AW1pYk9bfbCpUz9kbswLZe4Btx2:RPW+zK/tV4h1pJ97bCmcXzI
- TLSH T1EF4533498CD5FDCB29A033A7C90A199AF39D4ADAFB14D0D60E2615B746CF2F1E09364C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/NULLSUB.exe
File Explorer
-
NULLSUB.zip.zip 1.2MB
-
NULLSUB.exe.exe 1.6MB
-
READ-ME-FIRST.txt381B
NULLSUB.exe
- IMPHASH 32728a394d0b2ddb601cecc57e0d417b
- SHA256 880627b8212d9125e6ef18b1f1ea7ac91507c0f49eecad2ff301a666a4d56d51
- MD5 2661f0e3c12e7994e62b9145f05980c7
- SHA1 ba4a988f8e76164cedc649585ed5d1088f1970d4
- SHA512 357400f57472bd9fc80828cc99b502a508c823ab864c7b850c40e0fcba5abf0259ddb353253580a046dfac3b14f7b13a0498f04a303e305c616e61670d77ea53
- SSDEEP 24576:5ZDbBW6TgcDu82VMcxdecBZgnvfYCNByNgjDThfC9Q+iYQA:5ZDb/ZkitEgnfjxb+9
- TLSH T15F8502A1F8C59441C82FD231D643EE3123376FBEB9B188CA058C7786B2979414F6D96B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
3c:a2:8a:93:7a:f1:cd:e9:06:eb:d7:81:67:be:f1:34:fa:60:b6:6a:96:b7:81:1e:31:81:35:81:f0:a2:bd:f2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=TechSoft Solutions,O=TechSoft Solutions
Chains
Nov 7, 2026
CN=TechSoft Solutions,O=TechSoft Solutions
Subject
CN=TechSoft Solutions,O=TechSoft Solutions
Serial Number
29:13:de:c7:2b:8a:9a:a8:41:8a:59:0e:07:a0:26:7d
Issuer
CN=TechSoft Solutions,O=TechSoft Solutions
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 7, 2026 - Nov 7, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
520
Entry point
4144
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCloseKey
RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW
iphlpapi
GetAdaptersAddresses
kernel32
AddVectoredExceptionHandler
CheckRemoteDebuggerPresent
CloseHandle
CreateFileW
CreateProcessW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExitProcess
FindResourceW
FlushInstructionCache
FreeLibrary
GetACP
GetCurrentProcess
GetCurrentThread
GetFileAttributesA
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetStartupInfoA
GetSystemDirectoryA
GetSystemFirmwareTable
GetSystemInfo
GetTempPathW
GetThreadContext
GetTickCount64
GetVolumeInformationW
GlobalMemoryStatusEx
InitializeCriticalSection
IsDBCSLeadByte
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadResource
LockResource
OutputDebugStringA
Process32First
Process32Next
SetUnhandledExceptionFilter
SizeofResource
Sleep
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
api-ms-win-crt-convert-l1-1-0
mbrtowc
wcrtomb
api-ms-win-crt-environment-l1-1-0
__p__environ
getenv
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-private-l1-1-0
__C_specific_handler
memcmp
memcpy
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p__acmdln
_cexit
_configure_narrow_argv
_crt_atexit
_errno
_exit
_initialize_narrow_environment
_set_app_type
_initterm
_initterm_e
_set_invalid_parameter_handler
abort
exit
signal
strerror
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
fflush
fputc
fputwc
setvbuf
api-ms-win-crt-string-l1-1-0
memset
strcpy
strlen
strncmp
strnlen
wcscat
wcscpy
wcslen
wcsnlen
shell32
ShellExecuteW
user32
FindWindowA
Name
tEtSVs9L
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
2gfhKGxP
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
620tdVfg
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
IzpMUHUV
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
789FbD70
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
TBogfGRC
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
k5T7Zw9R
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
s9yp08TC
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
6P8K4jQl
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
CVvqZrOJ
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
O4V6N1CB
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
READ-ME-FIRST.txt
- SHA256 c0755c1d0d1788563f6c2d0eba8300c1d68e33a0dbf54d0a8ec367e6e92d8c43
- MD5 fed2db909ed0416907e10507161fda6f
- SHA1 d3831928f01f14e25b077a616322f7bbb6d2d4e2
- SHA512 903ecbfedb70ccea5c2b9e8af9196d3f98a76c74e670e389fbe657c6d1b21eca1999f6cf0e4cfa51e8c6aedfe3ad2067740cebcedd633821b595ce0b91edcf33
- TLSH T1CBE06A7B44C3137E1BF78DCB120918A4D5194180F72DC472E32401140400CD7C7154C5
- MD5 SHA1 SHA512 TLSH