Demo[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Demo.exe
Size

23KB
MD5

8cd7215866ffb7451d142120b80d7a65
SHA1

6ff089e6ce57bd08bcd4d839b994662204c1a9a6
SHA256

e3344a661731547c17072bdae0cc63677fc1c9ae5e487b1f73fc9953009e2e51
SHA512

8e50312a24b8d2f7863fda60da15d0beadd961d6267c65604956dff45d0fc2c402869299c2474a610eafd5765a920492b1aed11fd72c1e8f9829e0e6741c4310
SSDEEP

384:5smSmK4quaT9dD84EhYsQKMK6jpTOFjXDHp2PnhkO:5X2aK9dw4Ehv+KgZOFjXDHwhr

Score

1^/10

Malware Config

Signatures

Files

Demo.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

1e:b1:32:d5:5c:7c:9d:a3:86:37:a7:5d:27:97:d9:ca
Certificate

Issuer

CN=JemmyLoveJenny EV Code Signing CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2018, 00:00

Not After

31/12/2019, 23:59

Subject

SERIALNUMBER=SERIALNUMBER,CN=JemmyLoveJenny Software,OU=jemmylovejenny.tk,O=EV CodeSigning Certificate,L=Shanghai,ST=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:5c:7c:9d:a3
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2015, 00:00

Not After

31/12/2039, 23:59

Subject

CN=JemmyLoveJenny EV Code Signing CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:b1:32:d5:4a:bf:10:0b:86:37:a7:5d:27:97:d9:cb
Certificate

Issuer

CN=JemmyLoveJenny EV Code Signing CA (SHA2),OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2018, 00:00

Not After

31/12/2019, 23:59

Subject

SERIALNUMBER=SERIALNUMBER,CN=JemmyLoveJenny Software,OU=jemmylovejenny.tk,O=EV CodeSigning Certificate,L=Shanghai,ST=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:b1:32:d5:4a:bf:10:0b
Certificate

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Not Before

01/01/2015, 00:00

Not After

31/12/2039, 23:59

Subject

CN=JemmyLoveJenny EV Code Signing CA (SHA2),OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6c:b4:83:20:12:af:f5:aa:a9:41:1d:a5:af:8c:e5:89:74:fa:81:ec:dc:40:1e:db:25:76:31:d0:f5:1e:ec:d4
Signer

Actual PE Digest

6c:b4:83:20:12:af:f5:aa:a9:41:1d:a5:af:8c:e5:89:74:fa:81:ec:dc:40:1e:db:25:76:31:d0:f5:1e:ec:d4

Digest Algorithm

sha256

PE Digest Matches

true

f5:6f:ae:75:08:c6:53:25:58:1d:37:58:32:48:b9:0d:a1:d7:55:cb
Signer

Actual PE Digest

f5:6f:ae:75:08:c6:53:25:58:1d:37:58:32:48:b9:0d:a1:d7:55:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

1e:b1:32:d5:5c:7c:9d:a3:86:37:a7:5d:27:97:d9:caCertificate

Extended Key Usages

Key Usages

1e:b1:32:d5:5c:7c:9d:a3Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

1e:b1:32:d5:4a:bf:10:0b:86:37:a7:5d:27:97:d9:cbCertificate

Extended Key Usages

Key Usages

1e:b1:32:d5:4a:bf:10:0bCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

6c:b4:83:20:12:af:f5:aa:a9:41:1d:a5:af:8c:e5:89:74:fa:81:ec:dc:40:1e:db:25:76:31:d0:f5:1e:ec:d4Signer

f5:6f:ae:75:08:c6:53:25:58:1d:37:58:32:48:b9:0d:a1:d7:55:cbSigner

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

1e:b1:32:d5:5c:7c:9d:a3:86:37:a7:5d:27:97:d9:ca
Certificate

1e:b1:32:d5:5c:7c:9d:a3
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

1e:b1:32:d5:4a:bf:10:0b:86:37:a7:5d:27:97:d9:cb
Certificate

1e:b1:32:d5:4a:bf:10:0b
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

6c:b4:83:20:12:af:f5:aa:a9:41:1d:a5:af:8c:e5:89:74:fa:81:ec:dc:40:1e:db:25:76:31:d0:f5:1e:ec:d4
Signer

f5:6f:ae:75:08:c6:53:25:58:1d:37:58:32:48:b9:0d:a1:d7:55:cb
Signer

.text
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B