TS4_x64[.]exe | Triage

Resubmissions

30/12/2022, 20:40

221230-zf4thsge73 1

30/12/2022, 20:34

221230-zclhrsge62 1

30/12/2022, 19:01

221230-xpql5sbe8y 1

Sharing

Copy URL Twitter E-mail

General

Target

TS4_x64.exe
Size

32.9MB
MD5

28373e84e141c4dcaead5f1ca67dda34
SHA1

fb181bbdab45e6c41f81f85a76fc468f23f07d4a
SHA256

bdbeb5f5c77d0df98180f7c08d64645c2ef0e06406233d401839a3f7d1c2da61
SHA512

69192741e4984d5dd00a7f2b67954ee655d7cb8656df1c060ebf27ca4161620afbafb8a2555aa86f7121618f7d2bc56b9bc0ee95e69bc8b230a9cfe8ecf4f829
SSDEEP

393216:0conDztEXMVA/wUEHGZLeuGyahaQFyFrxKKfoXiWPCcNduQ2Hu/buEiUjMwXjVDK:0ntET6cXy+62G01

Score

N/A

Malware Config

Signatures

Files

TS4_x64.exe
.exe windows x64

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:b2:0c:9e:f6:00:15:d5:59:0f:ca:a2:bf:ed:4d:ca
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22/10/2021, 00:00

Not After

22/10/2022, 23:59

Subject

CN=Electronic Arts\, Inc.,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2c:b8:bc:24:6b:7f:cc:66:8a:c9:f8:71:64:cf:c0:ae:87:f6:51:d0
Signer

Actual PE Digest

2c:b8:bc:24:6b:7f:cc:66:8a:c9:f8:71:64:cf:c0:ae:87:f6:51:d0

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Electronic Arts\, Inc.,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US

23/09/2022, 01:09
Valid: true

Chain 1

CN=Electronic Arts\, Inc.,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Exports

Exports

AmdPowerXpressRequestHighPerformance
DSS
GetDenuvoTicketLocation
GetDenuvoTimeTicketRequest
NvOptimusEnablement
SetTelemetryTrampolineFunctions

Sections

.text
Size: 23.7MB - Virtual size: 23.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 603KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.anadius
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:b2:0c:9e:f6:00:15:d5:59:0f:ca:a2:bf:ed:4d:caCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

2c:b8:bc:24:6b:7f:cc:66:8a:c9:f8:71:64:cf:c0:ae:87:f6:51:d0Signer

Signature Validations

Verification

23/09/2022, 01:09 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 23.7MB - Virtual size: 23.7MB

.rdata Size: 7.0MB - Virtual size: 7.0MB

.data Size: 603KB - Virtual size: 1.1MB

.pdata Size: 1.3MB - Virtual size: 1.3MB

_RDATA Size: 10KB - Virtual size: 9KB

.rsrc Size: 126KB - Virtual size: 125KB

.reloc Size: 252KB - Virtual size: 252KB

.anadius Size: 2KB - Virtual size: 1KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:b2:0c:9e:f6:00:15:d5:59:0f:ca:a2:bf:ed:4d:ca
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

2c:b8:bc:24:6b:7f:cc:66:8a:c9:f8:71:64:cf:c0:ae:87:f6:51:d0
Signer

23/09/2022, 01:09
Valid: true

.text
Size: 23.7MB - Virtual size: 23.7MB

.rdata
Size: 7.0MB - Virtual size: 7.0MB

.data
Size: 603KB - Virtual size: 1.1MB

.pdata
Size: 1.3MB - Virtual size: 1.3MB

_RDATA
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 126KB - Virtual size: 125KB

.reloc
Size: 252KB - Virtual size: 252KB

.anadius
Size: 2KB - Virtual size: 1KB