Es[.]png | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Es.png
Size

1.5MB
MD5

9f2bc4d45165db582fce07fd752f75da
SHA1

5a5ea4256809bf29548fb61d225abe9ba8723c61
SHA256

95e8acf7cd3f13bce462022a400248b686cd7c976a8923f9abd7160dae45246f
SHA512

11e6018f1bb2ba04d30de433fa77df7d525e79789705606eba070c6ca1d4c85d140894ebacb34d9b5d94fe7603f6fcb0ac3a74d0ee0d4b57a8e94b4b6c07eaae
SSDEEP

24576:SX7vRM8Lc3718l5QuhAYx2SBaNNK9NlZWsKY+LBdJf4BdBwFxuhaVbrXr5++/w1h:

Score

N/A

Malware Config

Signatures

Files

Es.png
.dll windows x86

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:07:36:17:d3:3f:88:69:5d:42:9e:f6:b4:d2:60:5a
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

22-07-2021 00:00

Not After

22-07-2022 23:59

Subject

CN=V MANAGEMENT LTD LTD,O=V MANAGEMENT LTD LTD,L=LONDON,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4d:88:d3:2c:37:35:27:95:b3:54:24:36:fa:05:bd:fc:43:73:00:e1:a6:60:cd:45:c2:b3:7f:03:56:95:f7:1a
Signer

Actual PE Digest

4d:88:d3:2c:37:35:27:95:b3:54:24:36:fa:05:bd:fc:43:73:00:e1:a6:60:cd:45:c2:b3:7f:03:56:95:f7:1a

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=V MANAGEMENT LTD LTD,O=V MANAGEMENT LTD LTD,L=LONDON,C=GB

16-06-2022 11:52
Valid: true

Chain 1

CN=V MANAGEMENT LTD LTD,O=V MANAGEMENT LTD LTD,L=LONDON,C=GB

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

CPlApplet
DllInstall
DvMOIWh9LO
EhgYL4D
FoVkX8Gn4
MZ4HkRHpJ
ONNR6Z
PVA4vI
QfovLYl
WGdQaR
YbtAWMTcHY
allbYiE
dv0VUmKE
fDNAaPd1ryr
gvkdjUQ2
jsZe3Qjp4c
lZRXA5Z7yK
vqympm
y0HR3TqxRAY
yEwXsVmLJm
zHiBDwBvP7q

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

b3:07:36:17:d3:3f:88:69:5d:42:9e:f6:b4:d2:60:5aCertificate

Extended Key Usages

Key Usages

4d:88:d3:2c:37:35:27:95:b3:54:24:36:fa:05:bd:fc:43:73:00:e1:a6:60:cd:45:c2:b3:7f:03:56:95:f7:1aSigner

Signature Validations

Verification

16-06-2022 11:52 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 12B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

b3:07:36:17:d3:3f:88:69:5d:42:9e:f6:b4:d2:60:5a
Certificate

4d:88:d3:2c:37:35:27:95:b3:54:24:36:fa:05:bd:fc:43:73:00:e1:a6:60:cd:45:c2:b3:7f:03:56:95:f7:1a
Signer

16-06-2022 11:52
Valid: true

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 12B