avast_free_antivirus_setup_online.zip
- SHA256 de9f4f683b4af510f241070e3e352070f606d4566f5da095a9ff2578594e2660
Static task
static1
Behavioral task
behavioral1
Sample
avast_free_antivirus_setup_online.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
avast_free_antivirus_setup_online.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target avast_free_antivirus_setup_online.zip
- Size 136KB
- Sample261110-xt5a4aab64
- SHA256 de9f4f683b4af510f241070e3e352070f606d4566f5da095a9ff2578594e2660
- MD5 23053e42cea8a08674a5e94d3cf51bf2
- SHA1 e57e56bd37bf3ec14d769e693ac1b4b4c1c1a01b
- SHA512 25c797c41861823d9315b7a2c2d42098bfb56e9fb1f9422dd6ecafa9c4d00b59aae624e1286097cf1481d563f1383ecaa83d6f7eebf3b0bb74bffe3b70a41fe2
- SSDEEP 3072:OQeqLLjefZSPZn/D5QvNtnPlS6iSjDJrtK24k/:3TjeQt/D5QndSf2mK
- TLSH T189D322E1B4C2895531B4C72254A864D1AF0F50B939F0B40449CCE3B66D7A4787F7EEAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
avast_free_antivirus_setup_online.zip.zip 136KB
-
avast_free_antivirus_setup_online.exe.exe 245KB
avast_free_antivirus_setup_online.exe
- IMPHASH 5094a6090b28f727d1661b0e4c9330df
- SHA256 6be180ea9a978907b1f39e54a6360404a094d59c21e4ebb1fcb456aef0ff4859
- MD5 bd4dde991518a5d36553d2ac2796ac25
- SHA1 189fd7476f8fbfe9d4ab5e8cd276eed1cac4f1dd
- SHA512 46fde3444ee5e8016d6699534d27bff61d9ee22cdabbb3351d41edff0c28a2a05db3b3c87e22daef9532a84a5b36ac21050dadc25b04efd9b064a1b1c4703e7b
- SSDEEP 6144:rrRG+16NMD16oK3bbLuaTBmmjQMeQ7zVFoUV:rrRxD1rK3fL/majJ6UV
- TLSH T1F4347C2275D18032F5B31A3419F88BB6983EBCB54F3484DF93945B6D1E30AD1AA35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
37:f4:5d:0b:e6:bb:1a:0d:bd:8e:ea:f1:70:a9:ea:81:7f:fd:c5:ea:38:b2:33:4a:9f:35:e8:d3:b2:d0:54:f9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US
Chains
Oct 9, 2025
CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US
Serial Number
40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 11, 2025 - Jun 10, 2028
Subject
CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB
Serial Number
a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 27, 2025 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
1
Major OS version
5
Entry point
4128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb
kernel32
InterlockedExchangeAdd
HeapFree
GetLastError
SetLastError
Sleep
GetFileSizeEx
WriteFile
SetEndOfFile
SetFilePointerEx
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
FindResourceExW
EnumResourceNamesW
GetWindowsDirectoryW
CreateDirectoryW
CreateFileW
MultiByteToWideChar
WideCharToMultiByte
CreateThread
GetSystemTimeAsFileTime
GetNativeSystemInfo
lstrcatA
lstrlenA
GetVersionExA
GetCurrentProcess
GetExitCodeProcess
ResumeThread
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateProcessW
GetPrivateProfileIntA
GetPrivateProfileIntW
GetPrivateProfileStringA
GetPrivateProfileStringW
GetDiskFreeSpaceExW
CopyFileW
MoveFileExW
CreateHardLinkW
LocalFree
HeapAlloc
GetProcessHeap
HeapSetInformation
ExitProcess
IsProcessorFeaturePresent
lstrcpyW
GetModuleHandleW
GetCommandLineW
GetSystemDirectoryW
SetDllDirectoryW
WriteConsoleW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
LCMapStringW
FindResourceW
LoadLibraryW
SizeofResource
LoadResource
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetVersionExW
FreeLibrary
LockResource
GetFileType
GetStringTypeW
InterlockedExchange
GetUserDefaultLangID
GetACP
GetModuleHandleExW
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
LoadLibraryA
DecodePointer
GetVersion
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DeviceIoControl
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
OutputDebugStringW
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetCommandLineA
GetStdHandle
GetModuleFileNameW
GetProcAddress
user32
ReleaseDC
GetMessageW
TranslateMessage
DispatchMessageW
AllowSetForegroundWindow
PostMessageW
wsprintfA
LoadStringW
MessageBoxExW
wsprintfW
SystemParametersInfoW
IsDialogMessageW
LoadImageW
DestroyIcon
FindWindowW
FillRect
GetWindowRect
SendMessageW
EndPaint
BeginPaint
InvalidateRect
GetDC
SetForegroundWindow
GetSystemMetrics
KillTimer
SetTimer
SetFocus
SetWindowPos
DestroyWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
gdi32
GetObjectW
CreateDIBSection
SelectObject
GetTextExtentPoint32W
DeleteObject
CreateSolidBrush
CreatePatternBrush
CreateFontIndirectW
advapi32
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
GetSidSubAuthorityCount
GetSidSubAuthority
IsValidSid
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorA
ole32
CoInitializeEx
CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize
comctl32
ord17
shlwapi
StrStrW
StrToIntW
Name
.text
Size
140KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=241, version=40116,
count=128, id=243, version=40116,
count=24, id=242, version=40116,
count=18, id=260, version=26706,
count=22, id=259, version=26706,
count=2, id=260, version=27054,
count=48, id=261, version=26706,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=221, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=261, version=27054,
count=1, id=255, version=27054,
count=2, id=151,
count=1, id=258, version=27054,