44620[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

44620.exe
Size

288KB
MD5

f3cdb6d084eb1476923a99f04b868329
SHA1

943949819b8354ec72c6d7bc2990e60960cc983c
SHA256

53867ae1994d09f07b882ff96d80fc9d38b50e3aae70054985e07b20634ac14f
SHA512

d0d03f489f2163bb3b133bdc42b7b809ba88baeeeebe7541fca3380b59412ba88f87890e78c9fe5fb1398826f303f1d2b3f00e2cf98259a9a018409a7d2a2528
SSDEEP

6144:oQTBRm0/hGz940BNWWCmxKg5VzHUgaRv4w8DX4yyHO3APeyUqhIG:/Q0pKHGKKgzz0gaupYHO8eyUqZ

Score

N/A

Malware Config

Signatures

Files

44620.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:02:9b:13:02:82:8f:f3:90:4e:d2:00:00:00:00:02:9b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27-01-2022 19:36

Not After

26-01-2023 19:36

Subject

CN=Skype Software Sarl,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:bd:13:4d:5e:a2:44:db:8c:64:54:88:3b:1d:98:4f:ce:f9:1e:e5:99:fa:30:4e:e8:15:69:ac:bd:86:3e:a9
Signer

Actual PE Digest

76:bd:13:4d:5e:a2:44:db:8c:64:54:88:3b:1d:98:4f:ce:f9:1e:e5:99:fa:30:4e:e8:15:69:ac:bd:86:3e:a9

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Skype Software Sarl,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21-09-2022 12:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:02:9b:13:02:82:8f:f3:90:4e:d2:00:00:00:00:02:9bCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

76:bd:13:4d:5e:a2:44:db:8c:64:54:88:3b:1d:98:4f:ce:f9:1e:e5:99:fa:30:4e:e8:15:69:ac:bd:86:3e:a9Signer

Signature Validations

Verification

21-09-2022 12:06 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 50KB - Virtual size: 49KB

.sdata Size: 215KB - Virtual size: 215KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

33:00:00:02:9b:13:02:82:8f:f3:90:4e:d2:00:00:00:00:02:9b
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

76:bd:13:4d:5e:a2:44:db:8c:64:54:88:3b:1d:98:4f:ce:f9:1e:e5:99:fa:30:4e:e8:15:69:ac:bd:86:3e:a9
Signer

21-09-2022 12:06
Valid: false

.text
Size: 50KB - Virtual size: 49KB

.sdata
Size: 215KB - Virtual size: 215KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B