file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

1.5MB
MD5

a738a33f882c7082a98b246126228895
SHA1

0fb74e1cc79f64eb718b2ca2fd29495baa064973
SHA256

310374f06e4f91f3392b38da586fcdf3f5183974df9f9a4b37edba39b2aab5b1
SHA512

fd3e04b397faaca658cae8765acee88115326684518f0f01610d294d2b2e9590cb22b414c8ec28eaf2bc984de2d2887c13985b6ba3ca4010f562225e698ad846
SSDEEP

12288:XO8Z33ShEvoTOC4E2Htn2LLee2sCNOUFhqWXeTGtI3Tlv+5t3PwuZDUqPmQrvJ/c:jd+TkI3sPVUWKox2I2bti5I7dT

Score

1^/10

Malware Config

Signatures

Files

file.exe
.exe windows x64

Code Sign

27:0b:f1:5b:08:35:44:3a:c8:3b:a6:99:52:0a:d9:81
Certificate

Issuer

CN=Opendod Ltd inc\ ,C=CN

Not Before

15/05/2023, 18:23

Not After

15/05/2024, 18:23

Subject

CN=Opendod Ltd inc\ ,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f0:6b:78:ee:79:d3:df:63:09:30:24:5c:72:27:a6:5b:7a:09:4f:8a:16:59:53:6d:23:6f:d2:ba:bb:10:97:2f
Signer

Actual PE Digest

f0:6b:78:ee:79:d3:df:63:09:30:24:5c:72:27:a6:5b:7a:09:4f:8a:16:59:53:6d:23:6f:d2:ba:bb:10:97:2f

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Opendod Ltd inc\ ,C=CN

16/05/2023, 12:30
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

27:0b:f1:5b:08:35:44:3a:c8:3b:a6:99:52:0a:d9:81Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

f0:6b:78:ee:79:d3:df:63:09:30:24:5c:72:27:a6:5b:7a:09:4f:8a:16:59:53:6d:23:6f:d2:ba:bb:10:97:2fSigner

Signature Validations

Verification

16/05/2023, 12:30 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rsrc Size: 1024B - Virtual size: 884B

27:0b:f1:5b:08:35:44:3a:c8:3b:a6:99:52:0a:d9:81
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

f0:6b:78:ee:79:d3:df:63:09:30:24:5c:72:27:a6:5b:7a:09:4f:8a:16:59:53:6d:23:6f:d2:ba:bb:10:97:2f
Signer

16/05/2023, 12:30
Valid: false

.text
Size: 1.5MB - Virtual size: 1.5MB

.rsrc
Size: 1024B - Virtual size: 884B