tixati[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tixati.exe
Size

48.4MB
MD5

7533b345433d13f943f34c2e9f066f47
SHA1

8ce3ffbd9293e1b30cc502bc713a84920c4de512
SHA256

7b6b8e29e334f96b805fe7941285d76cef9210e7f7618d1ebfcc1ad49109d55b
SHA512

ae5354f0bf36f5f3084ad753c56238f9bf944efa0e6df51c30ac8e4462802c3b1942b4abb3a0f51b1f45e11f90afb61ea69355e7482a83416997b0bacdfbe741
SSDEEP

393216:EUjeexvjQEPJBamIyUkLiu8L5YnCXA7r3pfwdRD/toYS:EUjeexvUExBlLi31YZcRZoN

Score

1^/10

Malware Config

Signatures

Files

tixati.exe
.exe windows x64

5e6cd45bf63d24308929c4ab917309a6

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

aa:3a:b5:5f:68:1c:38:37:2e:ef:4a:1c:2b:23:02:eb
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

14/06/2021, 00:00

Not After

14/06/2023, 23:59

Subject

CN=Tixati Software Inc.,O=Tixati Software Inc.,L=Toronto,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:6a:de:e1:27:a9:91:07:51:60:db:2d:49:ef:db:c7:61:59:5f:82:e0:9b:92:8a:ab:c7:53:ba:3b:85:b3:5a
Signer

Actual PE Digest

42:6a:de:e1:27:a9:91:07:51:60:db:2d:49:ef:db:c7:61:59:5f:82:e0:9b:92:8a:ab:c7:53:ba:3b:85:b3:5a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Tixati Software Inc.,O=Tixati Software Inc.,L=Toronto,ST=Ontario,C=CA

16/05/2023, 12:27
Valid: true

Chain 1

CN=Tixati Software Inc.,O=Tixati Software Inc.,L=Toronto,ST=Ontario,C=CA

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

AdjustTokenPrivileges
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
DeregisterEventSource
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegisterEventSourceW
ReportEventW

comctl32

ImageList_Create
ImageList_Destroy
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_SetBkColor
InitCommonControlsEx

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectW
CreateSolidBrush
DeleteDC
DeleteObject
EnumFontFamiliesExW
GdiFlush
GetBkColor
GetBkMode
GetCurrentObject
GetDeviceCaps
GetObjectW
GetStockObject
GetTextColor
GetTextMetricsW
IntersectClipRect
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetBrushOrgEx
SetDCBrushColor
SetPixelV
SetStretchBltMode
SetTextColor
StretchBlt

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

kernel32

AddVectoredExceptionHandler
CloseHandle
ConvertFiberToThread
ConvertThreadToFiber
CreateDirectoryW
CreateEventA
CreateEventW
CreateFiber
CreateFileW
CreateMutexW
CreateSemaphoreA
CreateTimerQueueTimer
DeleteCriticalSection
DeleteFiber
DeleteFileW
DeleteTimerQueueTimer
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeLibrary
GetACP
GetCPInfoExW
GetCommandLineW
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetEnvironmentVariableW
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetFileType
GetHandleInformation
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessId
GetShortPathNameW
GetStartupInfoW
GetStdHandle
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadPriority
GetTickCount
GetVersion
GetVersionExW
GetVolumePathNameW
GlobalAlloc
GlobalLock
GlobalUnlock
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MoveFileExW
MulDiv
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleW
ReadDirectoryChangesW
ReadFile
ReleaseSemaphore
RemoveDirectoryW
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleMode
SetEvent
SetFilePointerEx
SetFileTime
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadExecutionState
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
__C_specific_handler

msimg32

AlphaBlend

msvcrt

___lc_codepage_func
___mb_cur_max_func
__doserrno
__iob_func
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_beginthreadex
_cexit
_ctime64
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_fileno
_fmode
_fstat64
_fdopen
_getcwd
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_mktime64
_onexit
_read
_setjmp
_setmode
_snprintf
_stat64
_strdup
_strdup
_stricmp
_strnicmp
_time64
_ultoa
_unlock
_vsnprintf
_vsnwprintf
_wcmdln
_wcslwr
_wcsupr
_wfopen
_write
_wsystem
abort
atoi
calloc
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwrite
getc
getenv
getwc
isalnum
isalpha
islower
isspace
isupper
iswctype
isxdigit
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
putc
putwc
qsort
raise
rand
realloc
setlocale
setvbuf
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtol
strtoul
strxfrm
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscat
wcscmp
wcscoll
wcscpy
wcsftime
wcslen
wcsncpy
wcsstr
wcsxfrm

ole32

CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree

shell32

CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
DragQueryPoint
DuplicateIcon
SHFileOperationW
SHGetDesktopFolder
SHGetFileInfoW
SHGetFolderPathW
SHGetSpecialFolderPathW
ShellExecuteW
Shell_NotifyIconW

shlwapi

StrCmpLogicalW
StrRetToStrW

user32

BeginPaint
BringWindowToTop
CallWindowProcW
ClientToScreen
CloseClipboard
CopyIcon
CreateIconFromResourceEx
CreateWindowExW
DefWindowProcW
DestroyIcon
DestroyWindow
DispatchMessageW
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIconEx
DrawStateW
DrawTextW
EmptyClipboard
EnableMenuItem
EnableWindow
EndPaint
EnumDisplayMonitors
EnumThreadWindows
ExitWindowsEx
FillRect
FindWindowExW
FrameRect
GetActiveWindow
GetCapture
GetClassNameW
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetFocus
GetForegroundWindow
GetKeyState
GetMessagePos
GetMessageTime
GetMessageW
GetMonitorInfoW
GetParent
GetProcessWindowStation
GetQueueStatus
GetScrollInfo
GetScrollPos
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetUserObjectInformationW
GetWindow
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
InvalidateRect
IsClipboardFormatAvailable
IsIconic
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadCursorW
LoadImageW
MessageBeep
MessageBoxW
MonitorFromPoint
MonitorFromWindow
MoveWindow
OpenClipboard
PostMessageW
PostQuitMessage
PtInRect
RedrawWindow
RegisterClassExW
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
ScreenToClient
SendMessageW
SetCapture
SetClipboardData
SetCursor
SetFocus
SetForegroundWindow
SetScrollInfo
SetScrollPos
SetTimer
SetWindowLongPtrW
SetWindowPlacement
SetWindowPos
SetWindowTextW
ShowScrollBar
ShowWindow
SystemParametersInfoW
TranslateMessage
UpdateWindow
WindowFromPoint

usp10

ScriptBreak
ScriptFreeCache
ScriptItemize
ScriptLayout
ScriptPlace
ScriptShape
ScriptTextOut

uxtheme

CloseThemeData
DrawThemeBackground
DrawThemeText
GetThemeTextExtent
OpenThemeData

winmm

PlaySoundW
timeBeginPeriod
timeGetTime

ws2_32

WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAResetEvent
WSASetEvent
WSAStartup
WSAStringToAddressW
WSAWaitForMultipleEvents
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
htons
ioctlsocket
listen
recv
recvfrom
send
sendto
setsockopt
socket

Sections

.text
Size: 35.1MB - Virtual size: 35.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 675KB - Virtual size: 674KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 9.0MB - Virtual size: 9.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 938KB - Virtual size: 938KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug
Size: 94B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5e6cd45bf63d24308929c4ab917309a6

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

aa:3a:b5:5f:68:1c:38:37:2e:ef:4a:1c:2b:23:02:ebCertificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

42:6a:de:e1:27:a9:91:07:51:60:db:2d:49:ef:db:c7:61:59:5f:82:e0:9b:92:8a:ab:c7:53:ba:3b:85:b3:5aSigner

Signature Validations

Verification

16/05/2023, 12:27 Valid: true

Chain 1

Headers

File Characteristics

Imports

advapi32

comctl32

gdi32

iphlpapi

kernel32

msimg32

msvcrt

ole32

shell32

shlwapi

user32

usp10

uxtheme

winmm

ws2_32

Sections

.text Size: 35.1MB - Virtual size: 35.1MB

.data Size: 675KB - Virtual size: 674KB

.rdata Size: 9.0MB - Virtual size: 9.0MB

.pdata Size: 938KB - Virtual size: 938KB

.xdata Size: 2.5MB - Virtual size: 2.5MB

.bss Size: - Virtual size: 1.1MB

.idata Size: 17KB - Virtual size: 17KB

.CRT Size: 512B - Virtual size: 112B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 152KB - Virtual size: 152KB

.debug Size: 94B - Virtual size: 512B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

aa:3a:b5:5f:68:1c:38:37:2e:ef:4a:1c:2b:23:02:eb
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

42:6a:de:e1:27:a9:91:07:51:60:db:2d:49:ef:db:c7:61:59:5f:82:e0:9b:92:8a:ab:c7:53:ba:3b:85:b3:5a
Signer

16/05/2023, 12:27
Valid: true

.text
Size: 35.1MB - Virtual size: 35.1MB

.data
Size: 675KB - Virtual size: 674KB

.rdata
Size: 9.0MB - Virtual size: 9.0MB

.pdata
Size: 938KB - Virtual size: 938KB

.xdata
Size: 2.5MB - Virtual size: 2.5MB

.bss
Size: - Virtual size: 1.1MB

.idata
Size: 17KB - Virtual size: 17KB

.CRT
Size: 512B - Virtual size: 112B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 152KB - Virtual size: 152KB

.debug
Size: 94B - Virtual size: 512B