file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

814KB
MD5

ba37815aa2f1b7798cef2f1cd39ef495
SHA1

63373e47e062af06604e3897f6ee7b5d4ab57f0e
SHA256

d151ac7349eeddb2e769ffd33665c627fb1ec57004ac42927562b081d1c5de5b
SHA512

c23e5e6ba235eaa1064052f67ed81d3b499f09a3fe034daf95408c0cd3dc878bf9c9a2be83a2da442e396908994e382d4c2e058a0081aaf3dfffdc26b6afa013
SSDEEP

12288:Mo/wyn457hqndsQQtRJLGxZEk+fBfUEEjhQaLALlJ/r7YlvJSeibJWEQv8FrlZG7:MNp7hqndsQQt/GxShQuaLnpO9RFzG7

Score

N/A

Malware Config

Signatures

Files

file.exe
.exe windows x64

cb9da58c0b9b8643e59aafea2923e8fe

Code Sign

17:a8:66:3a:36:58:63:a1:47:5e:dc:4c:ba:9a:1b:41
Certificate

Issuer

CN=Colorful iGame Z390-X RNG Edition V20

Not Before

26/11/2022, 12:57

Not After

27/11/2032, 12:57

Subject

CN=Colorful iGame Z390-X RNG Edition V20

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

66:71:0a:74:06:3b:34:07:e5:7c:df:f7:77:fd:1d:de:f4:e9:74:d2:cf:59:89:93:a2:2b:cc:8b:e2:05:fe:6a
Signer

Actual PE Digest

66:71:0a:74:06:3b:34:07:e5:7c:df:f7:77:fd:1d:de:f4:e9:74:d2:cf:59:89:93:a2:2b:cc:8b:e2:05:fe:6a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Colorful iGame Z390-X RNG Edition V20

24/11/2022, 14:55
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

SHGetDiskFreeSpaceExW

mscoree

_CorExeMain

advapi32

RegQueryValueA

user32

ScrollDC

kernel32

GetModuleHandleA

Sections

Size: - Virtual size: 877KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 221KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cb9da58c0b9b8643e59aafea2923e8fe

Code Sign

17:a8:66:3a:36:58:63:a1:47:5e:dc:4c:ba:9a:1b:41Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

66:71:0a:74:06:3b:34:07:e5:7c:df:f7:77:fd:1d:de:f4:e9:74:d2:cf:59:89:93:a2:2b:cc:8b:e2:05:fe:6aSigner

Signature Validations

Verification

24/11/2022, 14:55 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

shell32

mscoree

advapi32

user32

kernel32

Sections

Size: - Virtual size: 877KB

.rsrc Size: 221KB - Virtual size: 238KB

Size: 102KB - Virtual size: 101KB

17:a8:66:3a:36:58:63:a1:47:5e:dc:4c:ba:9a:1b:41
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

66:71:0a:74:06:3b:34:07:e5:7c:df:f7:77:fd:1d:de:f4:e9:74:d2:cf:59:89:93:a2:2b:cc:8b:e2:05:fe:6a
Signer

24/11/2022, 14:55
Valid: false

.rsrc
Size: 221KB - Virtual size: 238KB