tmp | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

tmp
Size

13.3MB
MD5

c8c0bd9fb6afbc25324d767ff3f83b05
SHA1

8399edd9967a9b0a909e98f0ce311ebfa3402ea0
SHA256

505d85e3f2cc036bd585825a9bf3fd03a90a849d76dc29e842a1b3725d0b86ce
SHA512

03e28fef1d830cada115f49d5ed6b85199df3fcd953ca37443e96c2538ba37fc9c3b766f14447aa114fa16b2e9177db741e5b209b0e2479f3b672a0569a70792
SSDEEP

196608:cu3r9+J1zWgjWfVKyLsVXVe7Z2LXOVseTDCOBv9CpsN67lt4xAttU0FEFNPzHUdO:5MJ1zWgCcYYh+VsXOR9CpsAt4xUwNr0Q

Score

1^/10

Malware Config

Signatures

Files

tmp
.exe windows x86

881ebfb4b8b20e1f3b3657fb82622ad3

Code Sign

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11-09-2018 09:28

Not After

11-09-2023 09:28

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

26-03-2019 17:44

Not After

22-03-2034 17:44

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:55:9d:9a:1e:2f:c1:a4:79:d6:27:68:4d:11:3a:59
Certificate

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

19-08-2021 19:03

Not After

18-08-2024 19:03

Subject

SERIALNUMBER=C 86211,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,1.3.6.1.4.1.311.60.2.1.3=#1302435a,1.3.6.1.4.1.311.60.2.1.2=#1306507261677565,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09-12-2022 18:30

Not After

06-12-2032 18:30

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11-09-2018 09:26

Not After

11-09-2023 09:26

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13-11-2019 18:50

Not After

12-11-2034 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:7d:83:05:1c:6f:25:ef:86:67:85:44:c9:37:4e:ec:24:62:31:61:a7:a7:d0:94:23:8a:bf:4b:68:de:40:90
Signer

Actual PE Digest

c6:7d:83:05:1c:6f:25:ef:86:67:85:44:c9:37:4e:ec:24:62:31:61:a7:a7:d0:94:23:8a:bf:4b:68:de:40:90

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=C 86211,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,1.3.6.1.4.1.311.60.2.1.3=#1302435a,1.3.6.1.4.1.311.60.2.1.2=#1306507261677565,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

24-01-2023 16:43
Valid: true

Chain 1

SERIALNUMBER=C 86211,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,1.3.6.1.4.1.311.60.2.1.3=#1302435a,1.3.6.1.4.1.311.60.2.1.2=#1306507261677565,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Chain 2

SERIALNUMBER=C 86211,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,1.3.6.1.4.1.311.60.2.1.3=#1302435a,1.3.6.1.4.1.311.60.2.1.2=#1306507261677565,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AcquireSRWLockExclusive
CreateEventA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

oleaut32

GetErrorInfo

msvcrt

__dllonexit

user32

CharUpperBuffW

Sections

0AgA1+Go
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

;(no/S-o
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

-:72;#O2
Size: 519KB - Virtual size: 519KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Olk[COt1
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

3#K-QF=+
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vtS$[_Qb
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

s<BCQX"H
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0dG2mOJb
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

b^C.zFX,
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

j-Y=i7f6
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

we"&TAtD
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

B'(*vsJ5
Size: 249KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

881ebfb4b8b20e1f3b3657fb82622ad3

Code Sign

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83Certificate

Key Usages

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04Certificate

Extended Key Usages

Key Usages

78:55:9d:9a:1e:2f:c1:a4:79:d6:27:68:4d:11:3a:59Certificate

Extended Key Usages

Key Usages

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4bCertificate

Extended Key Usages

Key Usages

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1cCertificate

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

c6:7d:83:05:1c:6f:25:ef:86:67:85:44:c9:37:4e:ec:24:62:31:61:a7:a7:d0:94:23:8a:bf:4b:68:de:40:90Signer

Signature Validations

Verification

24-01-2023 16:43 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

oleaut32

msvcrt

user32

Sections

0AgA1+Go Size: 248KB - Virtual size: 247KB

;(no/S-o Size: 512B - Virtual size: 136B

-:72;#O2 Size: 519KB - Virtual size: 519KB

Olk[COt1 Size: 23KB - Virtual size: 22KB

3#K-QF=+ Size: - Virtual size: 1KB

vtS$[_Qb Size: 4KB - Virtual size: 3KB

s<BCQX"H Size: 512B - Virtual size: 64B

0dG2mOJb Size: 512B - Virtual size: 32B

b^C.zFX, Size: 6.4MB - Virtual size: 6.4MB

j-Y=i7f6 Size: 1KB - Virtual size: 1KB

we"&TAtD Size: 5.9MB - Virtual size: 5.9MB

B'(*vsJ5 Size: 249KB - Virtual size: 249KB

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83
Certificate

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

78:55:9d:9a:1e:2f:c1:a4:79:d6:27:68:4d:11:3a:59
Certificate

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

c6:7d:83:05:1c:6f:25:ef:86:67:85:44:c9:37:4e:ec:24:62:31:61:a7:a7:d0:94:23:8a:bf:4b:68:de:40:90
Signer

24-01-2023 16:43
Valid: true

0AgA1+Go
Size: 248KB - Virtual size: 247KB

;(no/S-o
Size: 512B - Virtual size: 136B

-:72;#O2
Size: 519KB - Virtual size: 519KB

Olk[COt1
Size: 23KB - Virtual size: 22KB

3#K-QF=+
Size: - Virtual size: 1KB

vtS$[_Qb
Size: 4KB - Virtual size: 3KB

s<BCQX"H
Size: 512B - Virtual size: 64B

0dG2mOJb
Size: 512B - Virtual size: 32B

b^C.zFX,
Size: 6.4MB - Virtual size: 6.4MB

j-Y=i7f6
Size: 1KB - Virtual size: 1KB

we"&TAtD
Size: 5.9MB - Virtual size: 5.9MB

B'(*vsJ5
Size: 249KB - Virtual size: 249KB