SUMo[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

SUMo.exe
Size

2.1MB
MD5

6249bcbb6eadb5dff57169800888cebf
SHA1

6ece54869b148da98b33b2970ea0e1fce8203217
SHA256

c42634ea616b933a85fa9654986a4647480de821d609561e4fc3f7449931e2c0
SHA512

0da0ca616f5c0d6ce93d35563a9c8530b9681abc0483787426fe9fcb895365aef6464a41c464b93a565464a439bcc422c1778fcbf9ade3a2ed636f9229a20c47
SSDEEP

24576:yAWNX5L4TLN3vEdPqIR0MfiWotrI8FiUQtLKB6KNnv2M5aIvufnXuSkkBwNW+piC:yA1hKjRYpX+juv2M598eSkkBwrJ

Score

N/A

Malware Config

Signatures

Files

SUMo.exe
.exe windows x86

Code Sign

28:ab:01:a5:fe:68:ad:f3:59:ae:7f:90:0e:a4:f3:94
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

06-04-2021 00:00

Not After

05-04-2024 23:59

Subject

CN=KC SOFTWARES SASU,O=KC SOFTWARES SASU,L=AUTERIVE,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11-05-2022 00:00

Not After

10-08-2033 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:ce:0a:99:ae:cc:7e:9f:eb:54:21:6d:60:a8:a9:58:81:ec:5e:73:ea:b4:19:4c:39:0c:fa:f7:34:49:c0:9d
Signer

Actual PE Digest

4c:ce:0a:99:ae:cc:7e:9f:eb:54:21:6d:60:a8:a9:58:81:ec:5e:73:ea:b4:19:4c:39:0c:fa:f7:34:49:c0:9d

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=KC SOFTWARES SASU,O=KC SOFTWARES SASU,L=AUTERIVE,C=FR

04-11-2022 15:44
Valid: true

Chain 1

CN=KC SOFTWARES SASU,O=KC SOFTWARES SASU,L=AUTERIVE,C=FR

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Chain 2

CN=KC SOFTWARES SASU,O=KC SOFTWARES SASU,L=AUTERIVE,C=FR

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 13KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 18B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 603KB - Virtual size: 603KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

28:ab:01:a5:fe:68:ad:f3:59:ae:7f:90:0e:a4:f3:94Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

4c:ce:0a:99:ae:cc:7e:9f:eb:54:21:6d:60:a8:a9:58:81:ec:5e:73:ea:b4:19:4c:39:0c:fa:f7:34:49:c0:9dSigner

Signature Validations

Verification

04-11-2022 15:44 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 1.3MB - Virtual size: 1.3MB

DATA Size: 79KB - Virtual size: 79KB

BSS Size: - Virtual size: 13KB

.idata Size: 12KB - Virtual size: 12KB

.tls Size: - Virtual size: 18B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 89KB - Virtual size: 89KB

.rsrc Size: 603KB - Virtual size: 603KB

28:ab:01:a5:fe:68:ad:f3:59:ae:7f:90:0e:a4:f3:94
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

4c:ce:0a:99:ae:cc:7e:9f:eb:54:21:6d:60:a8:a9:58:81:ec:5e:73:ea:b4:19:4c:39:0c:fa:f7:34:49:c0:9d
Signer

04-11-2022 15:44
Valid: true

CODE
Size: 1.3MB - Virtual size: 1.3MB

DATA
Size: 79KB - Virtual size: 79KB

BSS
Size: - Virtual size: 13KB

.idata
Size: 12KB - Virtual size: 12KB

.tls
Size: - Virtual size: 18B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 89KB - Virtual size: 89KB

.rsrc
Size: 603KB - Virtual size: 603KB