file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

516KB
MD5

5bceabee5fce9251f4338cd5a128a36c
SHA1

3cc37e9d493c10e77a3f3a6aebb3f67ae4eb58bb
SHA256

a549096a3589e20d456807476acb1f2662c226354658cf9c3b630144bae55c2f
SHA512

71650ed4531310267195b6c69650cc8c37a1b0c6441d69e10f66ce23aed2892e62b8bfeb8cc97ba41557b1c4f8af6e0eed7cce4f1615ec66169ca5a9515ab7b6
SSDEEP

6144:ChCPJQEWstgnHP4PdvxIxNjDqfQvEJZ88ar0SUePbV6IEGTRlIeFltRQb8DAn:VWstwAsxNjDJ2C8euGbPNiwjhDAn

Score

1^/10

Malware Config

Signatures

Files

file.exe
.exe windows x64

Code Sign

f2:4a:b1:30:e1:6e:7d:74:08:07:3f:6b:d0:a6:9d:ac
Certificate

Issuer

CN=installrox Ltd Inc\ ,C=CN

Not Before

14/04/2023, 23:35

Not After

14/04/2024, 23:35

Subject

CN=installrox Ltd Inc\ ,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:3a:ed:9b:79:cf:85:04:88:0b:52:bb:e6:6b:17:6a:e0:49:4e:72:d2:ff:d8:12:cb:4f:55:56:a1:5c:42:51
Signer

Actual PE Digest

45:3a:ed:9b:79:cf:85:04:88:0b:52:bb:e6:6b:17:6a:e0:49:4e:72:d2:ff:d8:12:cb:4f:55:56:a1:5c:42:51

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=installrox Ltd Inc\ ,C=CN

13/04/2023, 18:12
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 509KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

f2:4a:b1:30:e1:6e:7d:74:08:07:3f:6b:d0:a6:9d:acCertificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

45:3a:ed:9b:79:cf:85:04:88:0b:52:bb:e6:6b:17:6a:e0:49:4e:72:d2:ff:d8:12:cb:4f:55:56:a1:5c:42:51Signer

Signature Validations

Verification

13/04/2023, 18:12 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 509KB - Virtual size: 508KB

.rsrc Size: 1024B - Virtual size: 900B

f2:4a:b1:30:e1:6e:7d:74:08:07:3f:6b:d0:a6:9d:ac
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

45:3a:ed:9b:79:cf:85:04:88:0b:52:bb:e6:6b:17:6a:e0:49:4e:72:d2:ff:d8:12:cb:4f:55:56:a1:5c:42:51
Signer

13/04/2023, 18:12
Valid: false

.text
Size: 509KB - Virtual size: 508KB

.rsrc
Size: 1024B - Virtual size: 900B