memtest[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

memtest.exe
Size

474KB
MD5

631ea355665f28d4707448e442fbf5b8
SHA1

8430c56c0518f2419155f2a828d49233aebdb7ab
SHA256

8e0fe1dbd00deef72e508f9e5ac776382e2f7088339d00f6086ca97efa0b1437
SHA512

d5d6098eb664df89b993619eb614b153e85d37cffc3d18cfc4868b11a1424154134dc448d5eee2033ded352f72e01bb65cfce628b4dc0f182aa4744129db7f80
SSDEEP

12288:LSlWXeyMarNguU+kMntpHbWSn/S1aYrXmd0gVRkpgMbc4hLqn6p6e:nXeyMYeuUrKbH1HMbd+64e

Score

1^/10

Malware Config

Signatures

Files

memtest.exe
.exe windows x86

Code Sign

61:04:b3:f5:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:13

Not After

25/07/2011, 19:23

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:15:23:0f:00:00:00:00:00:0a
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 21:57

Not After

07/03/2011, 21:57

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

6f:38:c9:cd:52:00:98:60:d5:e8:ed:a9:f3:bb:e7:14:c4:0a:53:33
Signer

Actual PE Digest

6f:38:c9:cd:52:00:98:60:d5:e8:ed:a9:f3:bb:e7:14:c4:0a:53:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 317KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGER32C
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 538KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGER32R
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

61:04:b3:f5:00:00:00:00:00:0dCertificate

Extended Key Usages

Key Usages

61:15:23:0f:00:00:00:00:00:0aCertificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

6f:38:c9:cd:52:00:98:60:d5:e8:ed:a9:f3:bb:e7:14:c4:0a:53:33Signer

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 317KB - Virtual size: 317KB

PAGER32C Size: 34KB - Virtual size: 33KB

PAGE Size: 2KB - Virtual size: 1KB

.rdata Size: 49KB - Virtual size: 49KB

.data Size: 12KB - Virtual size: 538KB

PAGER32R Size: 1024B - Virtual size: 896B

.rsrc Size: 35KB - Virtual size: 34KB

.reloc Size: 15KB - Virtual size: 15KB

61:04:b3:f5:00:00:00:00:00:0d
Certificate

61:15:23:0f:00:00:00:00:00:0a
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

6f:38:c9:cd:52:00:98:60:d5:e8:ed:a9:f3:bb:e7:14:c4:0a:53:33
Signer

.text
Size: 317KB - Virtual size: 317KB

PAGER32C
Size: 34KB - Virtual size: 33KB

PAGE
Size: 2KB - Virtual size: 1KB

.rdata
Size: 49KB - Virtual size: 49KB

.data
Size: 12KB - Virtual size: 538KB

PAGER32R
Size: 1024B - Virtual size: 896B

.rsrc
Size: 35KB - Virtual size: 34KB

.reloc
Size: 15KB - Virtual size: 15KB