tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

57.1MB
MD5

f87b9a1ef935dc1b370a90553ce3aaf2
SHA1

ec79c365704797c1f5ef9160dc2f38d15f20526e
SHA256

36f8e0c11454ab58c3dcc936c622e6bbe036b17d5fcf1981bc9700cecf8e34a5
SHA512

e73c29d4074f41837569614ad7390f06446191b0fcedafa38982b89209fd80394a53f6534eccecc66d21c618417d81c19d02110a320dbc8c99708b3e4138c5ad
SSDEEP

1572864:9H9p4GOd/Dls8cCdswvsGiFwVtsO6BEKUyE8uRDwukoJ:9dp4N/DApGiFwX3RJ

Score

1^/10

Malware Config

Signatures

Files

tmp
.exe windows x64

a86f32d1ecb3f4efc0d80bd5600f686d

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:cb:eb:be:f6:dc:20:74:db:4f:41:2a:eb:98:24:56
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

20/11/2021, 00:00

Not After

19/11/2024, 23:59

Subject

CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:cb:eb:be:f6:dc:20:74:db:4f:41:2a:eb:98:24:56
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

20/11/2021, 00:00

Not After

19/11/2024, 23:59

Subject

CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

99:73:b5:8f:1d:12:d3:f3:b7:72:30:1f:e7:1d:99:a5:b4:89:22:69:05:71:ed:86:5a:eb:88:65:da:04:d1:d2
Signer

Actual PE Digest

99:73:b5:8f:1d:12:d3:f3:b7:72:30:1f:e7:1d:99:a5:b4:89:22:69:05:71:ed:86:5a:eb:88:65:da:04:d1:d2

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US

11/05/2023, 10:04
Valid: true

Chain 1

CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

cb:51:6a:24:44:bd:de:ff:6b:3e:75:78:83:68:62:88:ca:63:f0:03
Signer

Actual PE Digest

cb:51:6a:24:44:bd:de:ff:6b:3e:75:78:83:68:62:88:ca:63:f0:03

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US

11/05/2023, 10:04
Valid: true

Chain 1

CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentThread
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

CryptCreateHash

user32

MessageBoxW

shell32

ShellExecuteExW

ole32

CoInitializeEx

crypt32

CertFindCertificateInStore

ws2_32

accept

bcrypt

BCryptGenRandom

oleaut32

GetErrorInfo

Sections

.text
Size: 627KB - Virtual size: 626KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.58V
Size: 42.2MB - Virtual size: 42.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.eI/
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.L}N
Size: 13.8MB - Virtual size: 13.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 329KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a86f32d1ecb3f4efc0d80bd5600f686d

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

20:cb:eb:be:f6:dc:20:74:db:4f:41:2a:eb:98:24:56Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

20:cb:eb:be:f6:dc:20:74:db:4f:41:2a:eb:98:24:56Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

99:73:b5:8f:1d:12:d3:f3:b7:72:30:1f:e7:1d:99:a5:b4:89:22:69:05:71:ed:86:5a:eb:88:65:da:04:d1:d2Signer

Signature Validations

Verification

11/05/2023, 10:04 Valid: true

Chain 1

cb:51:6a:24:44:bd:de:ff:6b:3e:75:78:83:68:62:88:ca:63:f0:03Signer

Signature Validations

Verification

11/05/2023, 10:04 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

user32

shell32

ole32

crypt32

ws2_32

bcrypt

oleaut32

Sections

.text Size: 627KB - Virtual size: 626KB

.rdata Size: 179KB - Virtual size: 178KB

.data Size: 5KB - Virtual size: 10KB

.pdata Size: 22KB - Virtual size: 21KB

_RDATA Size: 512B - Virtual size: 348B

.58V Size: 42.2MB - Virtual size: 42.2MB

.eI/ Size: 3KB - Virtual size: 3KB

.L}N Size: 13.8MB - Virtual size: 13.8MB

.reloc Size: 5KB - Virtual size: 5KB

.rsrc Size: 329KB - Virtual size: 328KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

20:cb:eb:be:f6:dc:20:74:db:4f:41:2a:eb:98:24:56
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

20:cb:eb:be:f6:dc:20:74:db:4f:41:2a:eb:98:24:56
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

99:73:b5:8f:1d:12:d3:f3:b7:72:30:1f:e7:1d:99:a5:b4:89:22:69:05:71:ed:86:5a:eb:88:65:da:04:d1:d2
Signer

11/05/2023, 10:04
Valid: true

cb:51:6a:24:44:bd:de:ff:6b:3e:75:78:83:68:62:88:ca:63:f0:03
Signer

11/05/2023, 10:04
Valid: true

.text
Size: 627KB - Virtual size: 626KB

.rdata
Size: 179KB - Virtual size: 178KB

.data
Size: 5KB - Virtual size: 10KB

.pdata
Size: 22KB - Virtual size: 21KB

_RDATA
Size: 512B - Virtual size: 348B

.58V
Size: 42.2MB - Virtual size: 42.2MB

.eI/
Size: 3KB - Virtual size: 3KB

.L}N
Size: 13.8MB - Virtual size: 13.8MB

.reloc
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 329KB - Virtual size: 328KB