file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

765KB
MD5

f92c0ea7fcbbb5247ae731e1b75d824a
SHA1

35e378bdd3f734bc2e034178a419cded847b8180
SHA256

e6d236c856b00720491ea4fd567137ace59a73d6f4ee5d6512b72e5ad6164f0f
SHA512

28d5a8f6dc16ddc2fa4be27c6ace14413a4ddecd5402d8727d129d30cf0b03f0f7f7abd7cead748f0cf9751f2ea5c49e67d44bca399d1f781c252a0673d7387b
SSDEEP

12288:UofpgVViIYeKB5VZxQ+eaZgAql5erYeZ6ru3OQH/lzr44XWg5NByw:Pp+ShOAq6h6ru3OQH/lhmgJr

Score

N/A

Malware Config

Signatures

Files

file.exe
.exe windows x64

81a55f9d6453a22d5914033b540d49c3

Code Sign

38:6e:7b:5c:94:d5:a3:90:4d:85:dd:71:04:e8:d8:54
Certificate

Issuer

CN=Samsung C32R502FHI LC32R502FHIXCI

Not Before

19/12/2022, 19:34

Not After

20/12/2032, 19:34

Subject

CN=Samsung C32R502FHI LC32R502FHIXCI

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f8:5f:44:68:b7:a5:2f:a7:8e:ec:1b:03:84:1c:d7:58:fc:18:ac:a9:36:03:cc:73:2f:56:d0:ce:ad:35:8e:2a
Signer

Actual PE Digest

f8:5f:44:68:b7:a5:2f:a7:8e:ec:1b:03:84:1c:d7:58:fc:18:ac:a9:36:03:cc:73:2f:56:d0:ce:ad:35:8e:2a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Samsung C32R502FHI LC32R502FHIXCI

15/12/2022, 13:51
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

PathMakeUniqueName

mscoree

_CorExeMain

advapi32

RegQueryValueW

user32

MessageBoxW

kernel32

GetModuleHandleA

Sections

.rsrc
Size: - Virtual size: 883KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

81a55f9d6453a22d5914033b540d49c3

Code Sign

38:6e:7b:5c:94:d5:a3:90:4d:85:dd:71:04:e8:d8:54Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

f8:5f:44:68:b7:a5:2f:a7:8e:ec:1b:03:84:1c:d7:58:fc:18:ac:a9:36:03:cc:73:2f:56:d0:ce:ad:35:8e:2aSigner

Signature Validations

Verification

15/12/2022, 13:51 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

shell32

mscoree

advapi32

user32

kernel32

Sections

.rsrc Size: - Virtual size: 883KB

.rsrc Size: 178KB - Virtual size: 178KB

.rdata Size: 93KB - Virtual size: 92KB

38:6e:7b:5c:94:d5:a3:90:4d:85:dd:71:04:e8:d8:54
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

f8:5f:44:68:b7:a5:2f:a7:8e:ec:1b:03:84:1c:d7:58:fc:18:ac:a9:36:03:cc:73:2f:56:d0:ce:ad:35:8e:2a
Signer

15/12/2022, 13:51
Valid: false

.rsrc
Size: - Virtual size: 883KB

.rsrc
Size: 178KB - Virtual size: 178KB

.rdata
Size: 93KB - Virtual size: 92KB