WSx4uV1cuW[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

WSx4uV1cuW.exe
Size

10.4MB
MD5

828b3cd3ef32dcaab4785783447d9e69
SHA1

c51c1733a65871b29815fc1705fdca0d106fc53c
SHA256

375e0894fd27423e0ccb09084bc288ee5eec4eec9b91bd981141437e1861ff51
SHA512

7fbe1edd3a2703948c3756efe4df50d1964e0db1463520c236e9040e5d3095c86d75a53ddbdf6080661f5ecf97a632d82e932a5ce7a502d873cac12620431524
SSDEEP

196608:V8kNN6lOsJGIh3NUDk5HJ6UbP9poJzfh1U5t/0K4ARGeK/:V8kNN6lTJG0NUwbPmfh1U5t/0otq

Score

N/A

Malware Config

Signatures

Files

WSx4uV1cuW.exe
.exe windows x64

Password: infected

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:79:50:43:47:29:89:c9:db:9c:38:3e:06:be:1b:e4
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

06/04/2020, 00:00

Not After

10/04/2023, 12:00

Subject

CN=Manthe Industries\, LLC,O=Manthe Industries\, LLC,L=STEVENS POINT,ST=WISCONSIN,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3e:b7:66:6e:03:52:e1:15:2c:a8:d5:74:10:3b:b1:85:9c:3b:7e:f9
Signer

Actual PE Digest

3e:b7:66:6e:03:52:e1:15:2c:a8:d5:74:10:3b:b1:85:9c:3b:7e:f9

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Manthe Industries\, LLC,O=Manthe Industries\, LLC,L=STEVENS POINT,ST=WISCONSIN,C=US

29/09/2022, 19:04
Valid: true

Chain 1

CN=Manthe Industries\, LLC,O=Manthe Industries\, LLC,L=STEVENS POINT,ST=WISCONSIN,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 772KB - Virtual size: 772KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 431KB - Virtual size: 487KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: - Virtual size: 9.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 364B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0d:79:50:43:47:29:89:c9:db:9c:38:3e:06:be:1b:e4Certificate

Extended Key Usages

Key Usages

3e:b7:66:6e:03:52:e1:15:2c:a8:d5:74:10:3b:b1:85:9c:3b:7e:f9Signer

Signature Validations

Verification

29/09/2022, 19:04 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 772KB - Virtual size: 772KB

.data Size: 431KB - Virtual size: 487KB

.pdata Size: 176KB - Virtual size: 175KB

_RDATA Size: 512B - Virtual size: 252B

.data Size: 8KB - Virtual size: 8KB

.reloc Size: 32KB - Virtual size: 31KB

.idata Size: 2KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 8KB - Virtual size: 8KB

.text Size: - Virtual size: 9.0MB

.text Size: 6.3MB - Virtual size: 6.3MB

.data Size: 18KB - Virtual size: 18KB

.data Size: 20KB - Virtual size: 20KB

.reloc Size: 364B - Virtual size: 4KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:79:50:43:47:29:89:c9:db:9c:38:3e:06:be:1b:e4
Certificate

3e:b7:66:6e:03:52:e1:15:2c:a8:d5:74:10:3b:b1:85:9c:3b:7e:f9
Signer

29/09/2022, 19:04
Valid: true

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 772KB - Virtual size: 772KB

.data
Size: 431KB - Virtual size: 487KB

.pdata
Size: 176KB - Virtual size: 175KB

_RDATA
Size: 512B - Virtual size: 252B

.data
Size: 8KB - Virtual size: 8KB

.reloc
Size: 32KB - Virtual size: 31KB

.idata
Size: 2KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 8KB - Virtual size: 8KB

.text
Size: - Virtual size: 9.0MB

.text
Size: 6.3MB - Virtual size: 6.3MB

.data
Size: 18KB - Virtual size: 18KB

.data
Size: 20KB - Virtual size: 20KB

.reloc
Size: 364B - Virtual size: 4KB