307cbd1514b4d291bb52aa148d12656cc66f7c41af1627eb3b6972aab863ccc4

Sharing

Copy URL Twitter E-mail

General

Target
307cbd1514b4d291bb52aa148d12656cc66f7c41af1627eb3b6972aab863ccc4
Size 440KB
Sample261113-ek1mfafv2x
SHA256 307cbd1514b4d291bb52aa148d12656cc66f7c41af1627eb3b6972aab863ccc4
MD5 8822cb8599c5dcad45257482328e5928
SHA1 75f2d85a97142c5c86a275323bdec88d8c3cdf1d
SHA512 68bf8c160f7583148c670c3804c20b43e9f445a8795ceab92b9ecb9dcad887793c4db1ca2c5064d720e4c96b59b2e9b7a2f45e8e695cf3270bf36e7981f1f09e
SSDEEP 6144:jA7Iag3V0aS2wU+AW5GaZPc6G3HrAZ5oN2x5DkkI6tRn22O0xZrGO8J7rTNJ:jA7IToQjpM4aq0TrG3NJ
TLSH
T1EAA4CEAB57423FC8EDA9997886854B692B33FC53C8D7CB0315467910AC222D39FA353D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
307cbd1514b4d291bb52aa148d12656cc66f7c41af1627eb3b6972aab863ccc4

File Explorer

307cbd1514b4d291bb52aa148d12656cc66f7c41af1627eb3b6972aab863ccc4

.exe 440KB

307cbd1514b4d291bb52aa148d12656cc66f7c41af1627eb3b6972aab863ccc4

IMPHASH 99bc815bc0b519b8403de54c3a74fd9c
SHA256 307cbd1514b4d291bb52aa148d12656cc66f7c41af1627eb3b6972aab863ccc4
MD5 8822cb8599c5dcad45257482328e5928
SHA1 75f2d85a97142c5c86a275323bdec88d8c3cdf1d
SHA512 68bf8c160f7583148c670c3804c20b43e9f445a8795ceab92b9ecb9dcad887793c4db1ca2c5064d720e4c96b59b2e9b7a2f45e8e695cf3270bf36e7981f1f09e
SSDEEP 6144:jA7Iag3V0aS2wU+AW5GaZPc6G3HrAZ5oN2x5DkkI6tRn22O0xZrGO8J7rTNJ:jA7IToQjpM4aq0TrG3NJ
TLSH
T1EAA4CEAB57423FC8EDA9997886854B692B33FC53C8D7CB0315467910AC222D39FA353D
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b7:e9:6c:bc:b5:f5:cd:f2:45:46:f8:54:20:2e:8b:4e:11:9b:9f:5e:e4:1a:52:08:38:fd:c7:fb:26:74:03:ad

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 18, 2025

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2025 - Jun 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

25785

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

C:\src\update\build\Release\update.pdb

Name

.text

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

316B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

386KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

307cbd1514b4d291bb52aa148d12656cc66f7c41af1627eb3b6972aab863ccc4

PE Signature issue

advapi32

kernel32

user32

generic