file[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

file.exe
Size

4.4MB
MD5

4c1bbe87ee4ab42478c8d11e5bb42ebf
SHA1

01911b9c7b596872d3bf53cd6924c7f917799d90
SHA256

c9e867da8945ace03fffb15fb6c8b73e556131b3e7ceb652ec2f3e36bc26ca66
SHA512

37ed30c05f2a73d52980a17d3e4c282c623e6c471ff5ebf0567283f900c2fbfae56e6b9faad435dc9d80e4e2748b2e271a60bc544352733449f6ed129e5d48eb
SSDEEP

98304:mKVgqRNSUVpJgLtclkBCY+2vE79BjrQ/L9nV/7mLY3B31Vs3P3fOj:mZ2NSiJcculwTExV/7p3

Score

1^/10

Malware Config

Signatures

Files

file.exe
.exe windows x86

a2f5171a69aa0c364fdec613d51f1b5b

Code Sign

38:ae:c4:92:d1:ca:7e:b6:47:0f:30:ae:89:e7:fe:94
Certificate

Issuer

CN=Xiaomi Mi TV A2 43 (L43M7-EARU) (black)

Not Before

26-05-2023 09:58

Not After

27-05-2033 09:58

Subject

CN=Xiaomi Mi TV A2 43 (L43M7-EARU) (black)

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:09:b4:0f:b8:f5:30:36:d9:36:5e:a0:7a:82:8c:b4:2b:39:94:7a:54:08:26:85:28:fa:59:2b:22:8c:75:d4
Signer

Actual PE Digest

13:09:b4:0f:b8:f5:30:36:d9:36:5e:a0:7a:82:8c:b4:2b:39:94:7a:54:08:26:85:28:fa:59:2b:22:8c:75:d4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

ReleaseDC

gdi32

GetDeviceCaps

ole32

CoCreateInstance

oleaut32

SysFreeString

crypt32

CryptStringToBinaryA

Sections

.text
Size: - Virtual size: 251KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp:0
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp:1
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp:2
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 536KB - Virtual size: 536KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2f5171a69aa0c364fdec613d51f1b5b

Code Sign

38:ae:c4:92:d1:ca:7e:b6:47:0f:30:ae:89:e7:fe:94Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

13:09:b4:0f:b8:f5:30:36:d9:36:5e:a0:7a:82:8c:b4:2b:39:94:7a:54:08:26:85:28:fa:59:2b:22:8c:75:d4Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ole32

oleaut32

crypt32

Sections

.text Size: - Virtual size: 251KB

.rdata Size: - Virtual size: 56KB

.data Size: - Virtual size: 94KB

.vmp:0 Size: - Virtual size: 1.7MB

.vmp:1 Size: 1024B - Virtual size: 844B

.vmp:2 Size: 3.9MB - Virtual size: 3.9MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 536KB - Virtual size: 536KB

38:ae:c4:92:d1:ca:7e:b6:47:0f:30:ae:89:e7:fe:94
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

13:09:b4:0f:b8:f5:30:36:d9:36:5e:a0:7a:82:8c:b4:2b:39:94:7a:54:08:26:85:28:fa:59:2b:22:8c:75:d4
Signer

.text
Size: - Virtual size: 251KB

.rdata
Size: - Virtual size: 56KB

.data
Size: - Virtual size: 94KB

.vmp:0
Size: - Virtual size: 1.7MB

.vmp:1
Size: 1024B - Virtual size: 844B

.vmp:2
Size: 3.9MB - Virtual size: 3.9MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 536KB - Virtual size: 536KB