file[.]exe | Triage™

General

Target
file.exe
Size 802KB
Sample221203-yd39jadf7s
SHA256 1570f6daac9b4567a4c1f68da417ac43adbeadedc94a2ec92d8f6341f08bb85d
MD5 266531bc43d8aa514ef4ac6bbf06fbce
SHA1 f398542a6db9d63ffaa6b221792b561b045533c9
SHA512 aa35b78c1f374b0585da1cb87ab2f368798cfd9476864efcbd235a02597be46bd6ee66ab170dc328e661b4e68ad8b90c57d544ec704d1b369b5c181be22a8394
SSDEEP 24576:rm5bRpdKx7w7eGXo3G4bZlZDckCo8xvQkf7Rh:m7eGXo2CDckz4vpf7Rh
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 802KB

file.exe

IMPHASH b889316d3a8b1477c173216ddf567051
SHA256 1570f6daac9b4567a4c1f68da417ac43adbeadedc94a2ec92d8f6341f08bb85d
MD5 266531bc43d8aa514ef4ac6bbf06fbce
SHA1 f398542a6db9d63ffaa6b221792b561b045533c9
SHA512 aa35b78c1f374b0585da1cb87ab2f368798cfd9476864efcbd235a02597be46bd6ee66ab170dc328e661b4e68ad8b90c57d544ec704d1b369b5c181be22a8394
SSDEEP 24576:rm5bRpdKx7w7eGXo3G4bZlZDckCo8xvQkf7Rh:m7eGXo2CDckz4vpf7Rh
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

b0:20:85:1c:f4:77:a2:bb:89:3a:1d:ac:4d:78:f5:98:36:3f:51:1e:ca:c7:4d:2e:69:1a:2a:71:2b:22:2e:ff

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Serial Number

0c:64:96:2e:44:67:ed:cc:15:79:64:6b:73:37:ec:8c

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2019 - Jan 11, 2022

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

Major OS version

Entry point

161560

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

MessageBoxW GetCursor MessageBeep

shell32

CommandLineToArgvW

kernel32

InitializeSListHead CreateFileW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW GetCommandLineW GetModuleHandleA GetProcAddress LocalFree MultiByteToWideChar FormatMessageA GetStringTypeW WideCharToMultiByte GetCurrentThreadId CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW QueryPerformanceCounter QueryPerformanceFrequency SetFileInformationByHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW GetLocaleInfoEx CompareStringEx GetCPInfo GetCurrentProcessId WriteConsoleW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess FreeEnvironmentStringsW RaiseException RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetCurrentThread SetConsoleCtrlHandler FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc GetTimeZoneInformation OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

PE Signature issue

user32

shell32

kernel32