Avenge[.]exe | Triage

Resubmissions

20-07-2023 23:36

230720-3lmnzabf9z 9

20-07-2023 22:34

230720-2hlf3abe61 9

20-07-2023 22:20

230720-1846esbe4t 9

20-07-2023 22:16

230720-162braah63 9

Sharing

Copy URL

Twitter E-mail

General

Target

Avenge.exe
Size

10.3MB
MD5

597c93b8bc848c95c45bfa516eb2b8f7
SHA1

ba10acec02160508996c07c7d3dc71479fa783f6
SHA256

63c7fb3ee4f6855b56ed8321c364e4d708e9dc639d2a89e688fc501b1566a17f
SHA512

4d9efec3733974fff2b0780f93bbc01c921a9ba229f214bcbda5a6b72d959f6e1cce478feb52909633dd6167b1a743db8dcfc01b36c8548ff50687bbbe4b1079
SSDEEP

196608:Cql9GAEMUTFg/v4Pf1SbnMTtriH/khKqwa7LlT/+5ehzF1+pwsNUf8SHR6Y6:CqzEMUTFgoPf1SrKrR+YJ1fr0O8Sx6J

Score

1^/10

Malware Config

Signatures

Files

Avenge.exe
.exe windows x64

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2013 12:00

Not After

15-01-2038 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:09:6d:50:34:a6:af:b6:ea:a7:54:06:fd:8d:77:0c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

12-04-2022 00:00

Not After

12-04-2023 23:59

Subject

SERIALNUMBER=NO - 247005,CN=DIGITAL SERVICES OF MANUEL MUSARELLA,OU=DIGITAL SERVICES OF MANUEL MUSARELLA,O=DIGITAL SERVICES OF MANUEL MUSARELLA,L=Casaleggio Novara,ST=Novara,C=IT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064e6f76617261,1.3.6.1.4.1.311.60.2.1.3=#13024954

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:ad:88:75:a7:e8:8c:96:04:34:18:b6:1a:b4:0a:f3:4e:27:28:63
Signer

Actual PE Digest

04:ad:88:75:a7:e8:8c:96:04:34:18:b6:1a:b4:0a:f3:4e:27:28:63

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 768KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 430KB - Virtual size: 844KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 186KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 37KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 156B

Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 42B

Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 43KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.avenge
Size: - Virtual size: 15.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 8.7MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

09:09:6d:50:34:a6:af:b6:ea:a7:54:06:fd:8d:77:0cCertificate

Extended Key Usages

Key Usages

04:ad:88:75:a7:e8:8c:96:04:34:18:b6:1a:b4:0a:f3:4e:27:28:63Signer

Headers

DLL Characteristics

File Characteristics

Sections

Size: 768KB - Virtual size: 1.7MB

Size: 430KB - Virtual size: 844KB

Size: 186KB - Virtual size: 215KB

Size: 37KB - Virtual size: 64KB

Size: 512B - Virtual size: 56B

.retplne Size: 512B - Virtual size: 156B

Size: 512B - Virtual size: 9B

.voltbl Size: 512B - Virtual size: 42B

Size: 512B - Virtual size: 24B

Size: 43KB - Virtual size: 124KB

Size: 3KB - Virtual size: 6KB

.debug Size: 512B - Virtual size: 4KB

.idata Size: 1KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 129KB - Virtual size: 129KB

.avenge Size: - Virtual size: 15.8MB

.boot Size: 8.7MB - Virtual size: 8.7MB

.reloc Size: 16B - Virtual size: 4KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

09:09:6d:50:34:a6:af:b6:ea:a7:54:06:fd:8d:77:0c
Certificate

04:ad:88:75:a7:e8:8c:96:04:34:18:b6:1a:b4:0a:f3:4e:27:28:63
Signer

.retplne
Size: 512B - Virtual size: 156B

.voltbl
Size: 512B - Virtual size: 42B

.debug
Size: 512B - Virtual size: 4KB

.idata
Size: 1KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 129KB - Virtual size: 129KB

.avenge
Size: - Virtual size: 15.8MB

.boot
Size: 8.7MB - Virtual size: 8.7MB

.reloc
Size: 16B - Virtual size: 4KB