file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

3.0MB
MD5

50fd8ce32047a579854acde722f6f910
SHA1

8a4c81d3c8f55fcea765e445e678ea91f66f8b43
SHA256

3865dd3eecf6f1a2a37f6b2157e8456e85c5262118529c6b2135890f0c09ecc0
SHA512

4de93c167079e7589347308fb25bcad45d5bf684bcaaafe821c229c091f3f56e45c1c45b41a5cf793b4e1753e8d5825cdc0cc55a0f7111122fd5d79d6928a4ab
SSDEEP

49152:rujyHxYxAb25frlLGbe6fDZqWTGdd/04KtB1BiV6BEQqKITxr8:ruExYxW25frlLGbeWDwWEd/0Ff1B3a43

Score

N/A

Malware Config

Signatures

Files

file.exe
.exe windows x64

a68935b124f91689a1382da100c80f12

Code Sign

17:a8:66:3a:36:58:63:a1:47:5e:dc:4c:ba:9a:1b:41
Certificate

Issuer

CN=Colorful iGame Z390-X RNG Edition V20

Not Before

26/11/2022, 12:57

Not After

27/11/2032, 12:57

Subject

CN=Colorful iGame Z390-X RNG Edition V20

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

94:da:72:13:dc:9b:ef:ab:da:44:69:7a:df:da:35:e9:39:4e:ee:83:c4:06:39:9d:e2:c6:7a:97:64:96:3a:aa
Signer

Actual PE Digest

94:da:72:13:dc:9b:ef:ab:da:44:69:7a:df:da:35:e9:39:4e:ee:83:c4:06:39:9d:e2:c6:7a:97:64:96:3a:aa

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Colorful iGame Z390-X RNG Edition V20

24/11/2022, 14:54
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

SHGetIconOverlayIndexA

mscoree

_CorExeMain

advapi32

RegOpenKeyExA

user32

CopyRect

kernel32

GetModuleHandleA

Sections

Size: - Virtual size: 878KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.4MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a68935b124f91689a1382da100c80f12

Code Sign

17:a8:66:3a:36:58:63:a1:47:5e:dc:4c:ba:9a:1b:41Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

94:da:72:13:dc:9b:ef:ab:da:44:69:7a:df:da:35:e9:39:4e:ee:83:c4:06:39:9d:e2:c6:7a:97:64:96:3a:aaSigner

Signature Validations

Verification

24/11/2022, 14:54 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

shell32

mscoree

advapi32

user32

kernel32

Sections

Size: - Virtual size: 878KB

.rsrc Size: 2.4MB - Virtual size: 3.5MB

Size: 102KB - Virtual size: 101KB

17:a8:66:3a:36:58:63:a1:47:5e:dc:4c:ba:9a:1b:41
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

94:da:72:13:dc:9b:ef:ab:da:44:69:7a:df:da:35:e9:39:4e:ee:83:c4:06:39:9d:e2:c6:7a:97:64:96:3a:aa
Signer

24/11/2022, 14:54
Valid: false

.rsrc
Size: 2.4MB - Virtual size: 3.5MB