x64dbg[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

x64dbg.exe
Size

59KB
MD5

d4ee3bce0027b08757e4d6cbfa3ab886
SHA1

04d032f7997c70562922951abcfa5fb324eaa8bc
SHA256

127ed2b78d2a0831373d67810c1587f8870c45de526eee60559434ff36ae0aed
SHA512

d633f0c60f4f866aaea262e149889d563032dcecb7abcb339c72e40668b83b6e634607ef2bf281805c49c754e542d5e41ca32574c55086db322d0da0bef42cc0
SSDEEP

768:VHnKO1NrJZhONUrMeJ5shJEHZGTYKaogXLKdSJEk672iRPM:FKGNrVONUwew7EH0zasdsEk672ixM

Score

N/A

Malware Config

Signatures

Files

x64dbg.exe
.exe windows x64

661163ee5bfc34eb52e81688f60bae4f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:51:dd:a9:2d:8d:dd:77:01:0d:9c:9e:78:8b:ca:0a
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

12/07/2021, 00:00

Not After

11/07/2024, 23:59

Subject

CN=Duncan Ogilvie,O=Duncan Ogilvie,L=Wrocław,ST=Dolnośląskie,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

11:63:3e:f8:49:b5:77:b0:4e:84:b8:1c:95:88:75:9e:de:26:83:cd:e5:e1:07:fc:71:79:c9:b4:80:a4:1a:5d
Signer

Actual PE Digest

11:63:3e:f8:49:b5:77:b0:4e:84:b8:1c:95:88:75:9e:de:26:83:cd:e5:e1:07:fc:71:79:c9:b4:80:a4:1a:5d

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Duncan Ogilvie,O=Duncan Ogilvie,L=Wrocław,ST=Dolnośląskie,C=PL

15/12/2022, 13:55
Valid: true

Chain 1

CN=Duncan Ogilvie,O=Duncan Ogilvie,L=Wrocław,ST=Dolnośląskie,C=PL

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetProcAddress
GetCurrentProcess
GetCurrentProcessId
RaiseException
SetUnhandledExceptionFilter
GetCurrentThreadId
GetLastError
IsDebuggerPresent
CloseHandle
GetLocalTime
LoadLibraryA
GetModuleHandleA
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
QueryPerformanceCounter
IsProcessorFeaturePresent
DecodePointer
EncodePointer
GetSystemTimeAsFileTime

user32

MessageBoxW
LoadStringW
MessageBoxA

x64bridge

BridgeStart
BridgeInit

msvcp120

?_Winerror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z

msvcr120

__crtSetUnhandledExceptionFilter
_XcptFilter
wcscat_s
_set_purecall_handler
_set_invalid_parameter_handler
vswprintf_s
?set_terminate@@YAP6AXXZP6AXXZ@Z
signal
_purecall
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memmove
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__CxxFrameHandler3
memcpy
_vsnprintf_s
_lock
_unlock
_calloc_crt
__dllonexit
__C_specific_handler
_onexit
_CxxThrowException
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_ismbblead
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_commode
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
?terminate@@YAXXZ

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

661163ee5bfc34eb52e81688f60bae4f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

6a:51:dd:a9:2d:8d:dd:77:01:0d:9c:9e:78:8b:ca:0aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

11:63:3e:f8:49:b5:77:b0:4e:84:b8:1c:95:88:75:9e:de:26:83:cd:e5:e1:07:fc:71:79:c9:b4:80:a4:1a:5dSigner

Signature Validations

Verification

15/12/2022, 13:55 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

x64bridge

msvcp120

msvcr120

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 660B

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 512B - Virtual size: 112B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

6a:51:dd:a9:2d:8d:dd:77:01:0d:9c:9e:78:8b:ca:0a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

11:63:3e:f8:49:b5:77:b0:4e:84:b8:1c:95:88:75:9e:de:26:83:cd:e5:e1:07:fc:71:79:c9:b4:80:a4:1a:5d
Signer

15/12/2022, 13:55
Valid: true

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 660B

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 512B - Virtual size: 112B