tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

5.7MB
MD5

619b2dd7930248e276b3c290cdbcafa8
SHA1

c845014831033dd16605c813333eace8cfbb096c
SHA256

be97908b8e34b67d0e14866689d16ff50f6a6ed828ac66884fcdc0afe8964ed2
SHA512

d22b65f8771fec7a83b716f344fab49c681e6c1912f7dd30f014f2504d8f59431b83c1ea82c432510bccf55c11abc5d97940d6ac0a32012b580dd4013ceeca1e
SSDEEP

98304:4vIWA2YFB3YUAF9CDqaA/kYNBzaRyID3JSJ0Rfldem6IbUka5wnnmuPbh:4vAx3YJFaA9Nlo5hj642ul

Score

N/A

Malware Config

Signatures

Files

tmp
.exe windows x86

81576bf9def037286df3235a2bdcac8f

Code Sign

7a:42:07:e6:2f:33:04:90:4b:23:27:7b:f1:ff:9e:93
Certificate

Issuer

CN=www.transportation.com.de

Not Before

16/12/2022, 09:22

Not After

16/12/2023, 09:42

Subject

CN=www.transportation.com.de

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:d8:45:49:37:80:09:4b:1c:df:dd:76:22:3a:51:37:a3:91:ae:15:99:f2:3d:c6:cd:fb:5d:43:29:1f:a7:a3
Signer

Actual PE Digest

51:d8:45:49:37:80:09:4b:1c:df:dd:76:22:3a:51:37:a3:91:ae:15:99:f2:3d:c6:cd:fb:5d:43:29:1f:a7:a3

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=www.transportation.com.de

15/12/2022, 14:00
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetClipboardFormatNameW
CharUpperBuffW

gdi32

GetStockObject

Sections

.text
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.thgk0
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.thgk1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.thgk2
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81576bf9def037286df3235a2bdcac8f

Code Sign

7a:42:07:e6:2f:33:04:90:4b:23:27:7b:f1:ff:9e:93Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

51:d8:45:49:37:80:09:4b:1c:df:dd:76:22:3a:51:37:a3:91:ae:15:99:f2:3d:c6:cd:fb:5d:43:29:1f:a7:a3Signer

Signature Validations

Verification

15/12/2022, 14:00 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

Sections

.text Size: - Virtual size: 1.7MB

.rdata Size: - Virtual size: 16KB

.data Size: - Virtual size: 1.7MB

.thgk0 Size: - Virtual size: 2.6MB

.thgk1 Size: 1KB - Virtual size: 1KB

.thgk2 Size: 5.7MB - Virtual size: 5.7MB

.rsrc Size: 15KB - Virtual size: 15KB

7a:42:07:e6:2f:33:04:90:4b:23:27:7b:f1:ff:9e:93
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

51:d8:45:49:37:80:09:4b:1c:df:dd:76:22:3a:51:37:a3:91:ae:15:99:f2:3d:c6:cd:fb:5d:43:29:1f:a7:a3
Signer

15/12/2022, 14:00
Valid: false

.text
Size: - Virtual size: 1.7MB

.rdata
Size: - Virtual size: 16KB

.data
Size: - Virtual size: 1.7MB

.thgk0
Size: - Virtual size: 2.6MB

.thgk1
Size: 1KB - Virtual size: 1KB

.thgk2
Size: 5.7MB - Virtual size: 5.7MB

.rsrc
Size: 15KB - Virtual size: 15KB