x64dbg[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

x64dbg.exe
Size

59KB
MD5

96bdbb4be321d0c86b237135c8f7c3b2
SHA1

63486682a9777377ce0b39c3a396d7e8fe5a2f44
SHA256

b55ddfd873d0032687d5ceef821001e60c06bacca4e3fcd485fd44690b861c2a
SHA512

73fff01e0196c51c7e3a229d787164cb88b5ff71e79faa1161265ff6aad69968586316ec7bd47359faafd4c5103944566a5ca46bb10663911782c52bf563725c
SSDEEP

768:0yHnKO1Y4rRZhONUrMeJ5shJEHZGTYKaogXLKdSDEk672iRPPt/m:zKWY4rdONUwew7EH0zasdWEk672ixM

Score

N/A

Malware Config

Signatures

Files

x64dbg.exe
.exe windows x64

661163ee5bfc34eb52e81688f60bae4f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:51:dd:a9:2d:8d:dd:77:01:0d:9c:9e:78:8b:ca:0a
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

12/07/2021, 00:00

Not After

11/07/2024, 23:59

Subject

CN=Duncan Ogilvie,O=Duncan Ogilvie,L=Wrocław,ST=Dolnośląskie,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

4b:45:f8:3f:16:69:09:3e:59:5b:92:88:87:0e:c7:d5:73:7c:42:f9:5b:13:0d:36:6a:5d:ec:78:f4:fc:0e:ee
Signer

Actual PE Digest

4b:45:f8:3f:16:69:09:3e:59:5b:92:88:87:0e:c7:d5:73:7c:42:f9:5b:13:0d:36:6a:5d:ec:78:f4:fc:0e:ee

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Duncan Ogilvie,O=Duncan Ogilvie,L=Wrocław,ST=Dolnośląskie,C=PL

09/09/2022, 12:41
Valid: true

Chain 1

CN=Duncan Ogilvie,O=Duncan Ogilvie,L=Wrocław,ST=Dolnośląskie,C=PL

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetProcAddress
GetCurrentProcess
GetCurrentProcessId
RaiseException
SetUnhandledExceptionFilter
GetCurrentThreadId
GetLastError
IsDebuggerPresent
CloseHandle
GetLocalTime
LoadLibraryA
GetModuleHandleA
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
QueryPerformanceCounter
IsProcessorFeaturePresent
DecodePointer
EncodePointer
GetSystemTimeAsFileTime

user32

MessageBoxW
LoadStringW
MessageBoxA

x64bridge

BridgeStart
BridgeInit

msvcp120

?_Winerror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z

msvcr120

__crtSetUnhandledExceptionFilter
_XcptFilter
wcscat_s
_set_purecall_handler
_set_invalid_parameter_handler
vswprintf_s
?set_terminate@@YAP6AXXZP6AXXZ@Z
signal
_purecall
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memmove
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__CxxFrameHandler3
memcpy
_vsnprintf_s
_lock
_unlock
_calloc_crt
__dllonexit
__C_specific_handler
_onexit
_CxxThrowException
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_ismbblead
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_commode
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
?terminate@@YAXXZ

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

661163ee5bfc34eb52e81688f60bae4f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

6a:51:dd:a9:2d:8d:dd:77:01:0d:9c:9e:78:8b:ca:0aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

4b:45:f8:3f:16:69:09:3e:59:5b:92:88:87:0e:c7:d5:73:7c:42:f9:5b:13:0d:36:6a:5d:ec:78:f4:fc:0e:eeSigner

Signature Validations

Verification

09/09/2022, 12:41 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

x64bridge

msvcp120

msvcr120

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 660B

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 512B - Virtual size: 112B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

6a:51:dd:a9:2d:8d:dd:77:01:0d:9c:9e:78:8b:ca:0a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

4b:45:f8:3f:16:69:09:3e:59:5b:92:88:87:0e:c7:d5:73:7c:42:f9:5b:13:0d:36:6a:5d:ec:78:f4:fc:0e:ee
Signer

09/09/2022, 12:41
Valid: true

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 660B

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 512B - Virtual size: 112B