CML[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

CML.exe
Size

1.3MB
MD5

4bb13098023c451a7f7b7f0288cbf011
SHA1

cbd2673a083af54bed15e922e9eb293ef0759d39
SHA256

e7d3eb7704c4e5b67d45e69b7fcac53d73b30b7a41f23966cf1d1a679e4d7d80
SHA512

cc929b16367c2ee662f6ee6876dfa6e0fc035733ff79011ec85197f722a0b5b809fed7f0a8dad23ab118517c5f92690e2d2b82fb6cbe6384bd9ddf58c0f141f3
SSDEEP

24576:4XssSn7Fujf+tboxjt/KMYgqCmvmHHNuHMMYBY/BWjmYk5lYmkAXpbgZ:4csOZptboxjt/pq1vmnNuH+BY/B2mlqK

Score

1^/10

Malware Config

Signatures

Files

CML.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

94:12:41:7e:55:c7:a0:48:36:74:1f:8f:70:fd:c0:b9
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

19-12-2022 00:00

Not After

18-12-2024 23:59

Subject

CN=Thomas Cheyney,O=Thomas Cheyney,ST=West Yorkshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

96:d1:ba:5d:49:68:cf:56:21:b5:e1:0b:ae:d5:b3:40:6e:4e:a4:76:e4:cf:7b:33:e1:4a:fe:2a:11:df:f1:5f
Signer

Actual PE Digest

96:d1:ba:5d:49:68:cf:56:21:b5:e1:0b:ae:d5:b3:40:6e:4e:a4:76:e4:cf:7b:33:e1:4a:fe:2a:11:df:f1:5f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

94:12:41:7e:55:c7:a0:48:36:74:1f:8f:70:fd:c0:b9Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

96:d1:ba:5d:49:68:cf:56:21:b5:e1:0b:ae:d5:b3:40:6e:4e:a4:76:e4:cf:7b:33:e1:4a:fe:2a:11:df:f1:5fSigner

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rsrc Size: 35KB - Virtual size: 34KB

.reloc Size: 512B - Virtual size: 12B

94:12:41:7e:55:c7:a0:48:36:74:1f:8f:70:fd:c0:b9
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

96:d1:ba:5d:49:68:cf:56:21:b5:e1:0b:ae:d5:b3:40:6e:4e:a4:76:e4:cf:7b:33:e1:4a:fe:2a:11:df:f1:5f
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 35KB - Virtual size: 34KB

.reloc
Size: 512B - Virtual size: 12B