tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

10.5MB
MD5

78e97779f936b06a8c4c96240b7bc85b
SHA1

c005df8a050723df4127a429b00b9e1ac489c3ff
SHA256

f4edf7a7d5dba93cbf95ed6b266b64579544676b1f09a27fa487d3c95700eadc
SHA512

cda792eeb136f3d9a4136c4d7a38056835a01d1bad31e4d12f5381a3fdb86b24b7b1690c77c10f8244806b6316be07c78d1ffa4886ecf0a133b1d57d319f08d2
SSDEEP

196608:O/f9xKWGpcR5lx1RbqSlkwQc0aynRo62peRd/7A7bNWiWSZVidn7IHe:gfdGpcFASSwH0ayRo62wdDMhW3d0He

Score

1^/10

Malware Config

Signatures

Files

tmp
.exe windows x64

f2840be3e67e34224f9222b9bf5c6ad8

Code Sign

1f:b8:fb:34:1b:ad:b8:8a:42:98:d8:3e:97:c5:85:21
Certificate

Issuer

CN=SSD Western Digital Blue SA510 1 ТБ SATA (WDS100T3B0A)

Not Before

28/05/2023, 12:56

Not After

29/05/2033, 12:56

Subject

CN=SSD Western Digital Blue SA510 1 ТБ SATA (WDS100T3B0A)

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:fb:da:6e:4f:df:0f:ef:04:e5:52:0a:f2:48:96:fc:1b:a3:4a:a4:4f:35:db:d8:d4:cc:7d:cf:c0:0d:55:33
Signer

Actual PE Digest

0a:fb:da:6e:4f:df:0f:ef:04:e5:52:0a:f2:48:96:fc:1b:a3:4a:a4:4f:35:db:d8:d4:cc:7d:cf:c0:0d:55:33

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcrt

__C_specific_handler

wtsapi32

WTSSendMessageW

user32

GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 9.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 10.5MB - Virtual size: 10.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f2840be3e67e34224f9222b9bf5c6ad8

Code Sign

1f:b8:fb:34:1b:ad:b8:8a:42:98:d8:3e:97:c5:85:21Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

0a:fb:da:6e:4f:df:0f:ef:04:e5:52:0a:f2:48:96:fc:1b:a3:4a:a4:4f:35:db:d8:d4:cc:7d:cf:c0:0d:55:33Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

wtsapi32

user32

Sections

.text Size: - Virtual size: 122KB

.data Size: - Virtual size: 9.6MB

.rdata Size: - Virtual size: 19KB

.pdata Size: - Virtual size: 6KB

.xdata Size: - Virtual size: 4KB

.bss Size: - Virtual size: 15KB

.idata Size: - Virtual size: 2KB

.CRT Size: - Virtual size: 96B

.tls Size: - Virtual size: 16B

.vmp0 Size: - Virtual size: 4.1MB

.vmp1 Size: 10.5MB - Virtual size: 10.5MB

.reloc Size: 512B - Virtual size: 192B

.rsrc Size: 5KB - Virtual size: 4KB

1f:b8:fb:34:1b:ad:b8:8a:42:98:d8:3e:97:c5:85:21
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

0a:fb:da:6e:4f:df:0f:ef:04:e5:52:0a:f2:48:96:fc:1b:a3:4a:a4:4f:35:db:d8:d4:cc:7d:cf:c0:0d:55:33
Signer

.text
Size: - Virtual size: 122KB

.data
Size: - Virtual size: 9.6MB

.rdata
Size: - Virtual size: 19KB

.pdata
Size: - Virtual size: 6KB

.xdata
Size: - Virtual size: 4KB

.bss
Size: - Virtual size: 15KB

.idata
Size: - Virtual size: 2KB

.CRT
Size: - Virtual size: 96B

.tls
Size: - Virtual size: 16B

.vmp0
Size: - Virtual size: 4.1MB

.vmp1
Size: 10.5MB - Virtual size: 10.5MB

.reloc
Size: 512B - Virtual size: 192B

.rsrc
Size: 5KB - Virtual size: 4KB