file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

3.0MB
MD5

c5674c390dd51958766855cf7efa87dc
SHA1

a26734dc0310816a670a1a76b8c362becd6bf3ce
SHA256

340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba
SHA512

61bacec6fad0ea010d07c413b99365ab95d49fa17ce58f549778ead2202e7a1e81c810fb5910114ae156a480bca84cfb25df5b67bb38f9dff0430945a14484bc
SSDEEP

49152:aujyHxYxAb25frlLGbe6fDZqWTGdd/04KtB1BiV6BEQqKITxr:auExYxW25frlLGbeWDwWEd/0Ff1B3a4g

Score

N/A

Malware Config

Signatures

Files

file.exe
.exe windows x64

a68935b124f91689a1382da100c80f12

Code Sign

17:a8:66:3a:36:58:63:a1:47:5e:dc:4c:ba:9a:1b:41
Certificate

Issuer

CN=Colorful iGame Z390-X RNG Edition V20

Not Before

26/11/2022, 12:57

Not After

27/11/2032, 12:57

Subject

CN=Colorful iGame Z390-X RNG Edition V20

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

94:da:72:13:dc:9b:ef:ab:da:44:69:7a:df:da:35:e9:39:4e:ee:83:c4:06:39:9d:e2:c6:7a:97:64:96:3a:aa
Signer

Actual PE Digest

94:da:72:13:dc:9b:ef:ab:da:44:69:7a:df:da:35:e9:39:4e:ee:83:c4:06:39:9d:e2:c6:7a:97:64:96:3a:aa

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Colorful iGame Z390-X RNG Edition V20

24/11/2022, 14:54
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

SHGetIconOverlayIndexA

mscoree

_CorExeMain

advapi32

RegOpenKeyExA

user32

CopyRect

kernel32

GetModuleHandleA

Sections

Size: - Virtual size: 878KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.4MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a68935b124f91689a1382da100c80f12

Code Sign

17:a8:66:3a:36:58:63:a1:47:5e:dc:4c:ba:9a:1b:41Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

94:da:72:13:dc:9b:ef:ab:da:44:69:7a:df:da:35:e9:39:4e:ee:83:c4:06:39:9d:e2:c6:7a:97:64:96:3a:aaSigner

Signature Validations

Verification

24/11/2022, 14:54 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

shell32

mscoree

advapi32

user32

kernel32

Sections

Size: - Virtual size: 878KB

.rsrc Size: 2.4MB - Virtual size: 3.5MB

Size: 102KB - Virtual size: 101KB

17:a8:66:3a:36:58:63:a1:47:5e:dc:4c:ba:9a:1b:41
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

94:da:72:13:dc:9b:ef:ab:da:44:69:7a:df:da:35:e9:39:4e:ee:83:c4:06:39:9d:e2:c6:7a:97:64:96:3a:aa
Signer

24/11/2022, 14:54
Valid: false

.rsrc
Size: 2.4MB - Virtual size: 3.5MB