ld[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ld.exe
Size 1.9MB
Sample231124-dqqtrafh5s
SHA256 b7679af91c842b241b0684f4e42174fbecaa22241dc5ad9d1b4d47efa8305a6e
MD5 a73515f107be14c65b4a977cec4a211c
SHA1 debfa1811d6219aae456f55d1134a1ddc82c4ba5
SHA512 59468ce727a02dc300fb5a1a8f0eb8e2fd15cb26008c92355287c7fef997e7d986c7adc84fa02645695aea16ee904a3e017b9d8b30eb55249f19c0e29b5fe9ab
SSDEEP 49152:OzrUs3rGXnI3Fsn6a3v/8dQnsMtJf53FtwlhcHE:Os2s6m8r
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

ld.exe

.exe 1.9MB

ld.exe

IMPHASH c7fb2b0f7d1b9bb69de473555ebdc92c
SHA256 b7679af91c842b241b0684f4e42174fbecaa22241dc5ad9d1b4d47efa8305a6e
MD5 a73515f107be14c65b4a977cec4a211c
SHA1 debfa1811d6219aae456f55d1134a1ddc82c4ba5
SHA512 59468ce727a02dc300fb5a1a8f0eb8e2fd15cb26008c92355287c7fef997e7d986c7adc84fa02645695aea16ee904a3e017b9d8b30eb55249f19c0e29b5fe9ab
SSDEEP 49152:OzrUs3rGXnI3Fsn6a3v/8dQnsMtJf53FtwlhcHE:Os2s6m8r
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

4a:db:7d:53:2f:45:f6:30:c8:3f:14:a8:d9:d1:29:d1:0c:cc:7b:e3

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Chains

Jun 20, 2017

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Serial Number

08:4c:af:4d:f4:99:14:1d:40:4b:71:99:aa:2c:21:31

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 25, 2015 - Oct 3, 2018

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Minor OS version

Major OS version

Entry point

4606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

GetViewportExtEx DeleteMetaFile CancelDC

ole32

CoGetApartmentType CoGetObjectContext

advapi32

CryptDestroyKey

kernel32

GetTimeZoneInformation CreateFileW HeapSize CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo FormatMessageA GetStringTypeW WideCharToMultiByte MultiByteToWideChar RaiseException InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive RtlCaptureStackBackTrace InitOnceBeginInitialize InitOnceComplete GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW EncodePointer DecodePointer QueryPerformanceFrequency LocalFree GetLocaleInfoEx InitializeCriticalSectionEx LCMapStringEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetTickCount64 CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetFileInformationByHandleEx CreateSymbolicLinkW CompareStringEx GetCPInfo HeapReAlloc RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetCurrentThread HeapFree SetConsoleCtrlHandler HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap GetFileType OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW WriteConsoleW

Name

.text

Size

819KB

Virtual Size

818KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

811KB

Virtual Size

810KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Mo0a

Size

264KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ld.exe

PE Signature issue

gdi32

ole32

advapi32

kernel32

generic