file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

1.4MB
MD5

ab5f3a328764bd1df74b9e042bdd702e
SHA1

fc39f240cdf0716e63e75f69fc59ea4e44510003
SHA256

d15f2dcf4e0705b78a1736eac273dbdece6317df130b740395f45e761ae5dca2
SHA512

9eb49687864fec5a268f20915581136b84cdd786b7855aef83d456a4f3b241bdc5ddb375143f8ffaaef1081105890032c5d33da59c2a3514198b45425d126c74
SSDEEP

24576:GS9mE7v7zmwbY2QkHqai6GuJFESjBndfPV135tRJ8QFFYwiWjLMTYSnMF:GS9mE7vvmYY29qT6GuJFESF1J/pJMkSO

Score

N/A

Malware Config

Signatures

Files

file.exe
.exe windows x64

9af99c4647e788951fc37fd2f8305eac

Code Sign

30:53:fb:c3:22:9a:9e:ad:47:c1:25:8a:04:a0:09:c8
Certificate

Issuer

CN=Toshiba MQ01ABMxx 2.5 MQ01ABD060

Not Before

07/10/2022, 20:43

Not After

08/10/2032, 20:43

Subject

CN=Toshiba MQ01ABMxx 2.5 MQ01ABD060

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e4:b3:5c:f5:24:aa:71:0e:45:4b:d0:82:9e:7c:88:fc:47:af:af:54:ad:ba:0e:e9:07:f8:b7:e3:79:d8:9c:03
Signer

Actual PE Digest

e4:b3:5c:f5:24:aa:71:0e:45:4b:d0:82:9e:7c:88:fc:47:af:af:54:ad:ba:0e:e9:07:f8:b7:e3:79:d8:9c:03

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Toshiba MQ01ABMxx 2.5 MQ01ABD060

01/12/2022, 14:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

PathMakeUniqueName

mscoree

_CorExeMain

advapi32

GetUserNameA

user32

RegisterClassExW

kernel32

GetModuleHandleA

Sections

Size: - Virtual size: 876KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 882KB - Virtual size: 881KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9af99c4647e788951fc37fd2f8305eac

Code Sign

30:53:fb:c3:22:9a:9e:ad:47:c1:25:8a:04:a0:09:c8Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

e4:b3:5c:f5:24:aa:71:0e:45:4b:d0:82:9e:7c:88:fc:47:af:af:54:ad:ba:0e:e9:07:f8:b7:e3:79:d8:9c:03Signer

Signature Validations

Verification

01/12/2022, 14:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

shell32

mscoree

advapi32

user32

kernel32

Sections

Size: - Virtual size: 876KB

.rsrc Size: 882KB - Virtual size: 881KB

Size: 102KB - Virtual size: 101KB

30:53:fb:c3:22:9a:9e:ad:47:c1:25:8a:04:a0:09:c8
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

e4:b3:5c:f5:24:aa:71:0e:45:4b:d0:82:9e:7c:88:fc:47:af:af:54:ad:ba:0e:e9:07:f8:b7:e3:79:d8:9c:03
Signer

01/12/2022, 14:34
Valid: false

.rsrc
Size: 882KB - Virtual size: 881KB