ElectronRob.rar
- SHA256 7709b8e6fe27a77e62613f71849a6ba98627161287e71d52bf1baf66df8951b0
Password
2024
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ElectronR/Electron.exe
Resource
win10-20231215-en
windows10-1703-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ElectronR/WpfAnimatedGif.dll
Resource
win10-20231220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
ElectronR/binkawin.dll
Resource
win10-20231215-en
windows10-1703-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
ElectronR/cef_extensions.js
Resource
win10-20231215-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
ElectronR/metod 2/loader.exe
Resource
win10-20231215-en
windows10-1703-x64
6 signatures
150 seconds
General
- Target ElectronRob.rar
- Size 13.1MB
- Sample240210-nslb6adf22
- SHA256 7709b8e6fe27a77e62613f71849a6ba98627161287e71d52bf1baf66df8951b0
- MD5 cb7e582c4b521b64a1b4f1a40c78e058
- SHA1 34f7b1c3d6e091104f40e3f77ba40755889109f4
- SHA512 02d042c695eb9d6dc84998dc59f0e9099eaa5f6a05e14a0968fc4032d02e1e9d5325ad7be53366a75c40f5160f6a8926fcbffd309976733532c29e8b7477f8c8
- SSDEEP 196608:IrF12894WPC9yPRtpahDyGIFb9SNUeKA3F6I6++r0MOp0O7Rn7Il6C9Sf9VIfjS:GF11yWBtpODyzSjR6+8eR2IVILS
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ElectronR/WpfAnimatedGif.dll unpack001/ElectronR/binkawin.asi
File Explorer
-
ElectronRob.rar.rar 13.1MB
-
ElectronR/EXPAND.MIX447KB
-
ElectronR/Electron.exe.exe 250.0MB
-
ElectronR/WpfAnimatedGif.dll.dll 41KB
-
ElectronR/ai.cfg44B
-
ElectronR/arialbd.ttf281KB
-
ElectronR/binkawin.asi.dll 55KB
-
ElectronR/cef_extensions.pak.js 1.6MB
-
ElectronR/icudtl.dat9.8MB
-
ElectronR/metod 2/loader.exe.exe 222KB
-
ElectronR/resources.pak6.9MB
-
ElectronR/v8_context_snapshot.bin592KB
ElectronR/EXPAND.MIX
- SHA256 e144753593161f867a26428f901a09de5cb8a71bab6e690dd9ca727e76d4f724
- MD5 336eaf636e7c0b9022987cec5521873d
- SHA1 f5640023c961291b3d34026f7a0ad4be8d3f2a0c
- SHA512 911430cc1582d0c8d669bc7a9d7486b7b12532b304fb7a87f8ab580a8a117970bcfcbd31fcb4b10877810eacf12e14d19aa8cfa12a60d1ab379e9f355438cea5
- SSDEEP 12288:dqHBdYRqHBdYRqHBdYm9lJLUNnDxD/TM6Pc2NE7+3Yee:CHLUFDVMGDNEC3Pe
- MD5 SHA1 SHA512 SSDEEP
ElectronR/Electron.exe
- IMPHASH 2e838409987529c95afc2990bcd62f7c
- SHA256 f5648a7be659a5f7e9f1c240aa2f7d512a462b8a5f9b3185ed5e134aebe34ea4
- MD5 db98747f25aaa57cdf0c5024edd63ffb
- SHA1 40afd52b14e3564fb3a6d7b8c7da58ad0d0352e2
- SHA512 8d3bb0d832cb987db4dde7a400449eda0e166cdb553111f6a54f6493400db9863915d09fdfa69c4e15c551fe7a70e390970668aa6e2e8de2e7a217c3e001456f
- SSDEEP 24576:mus8z4tMW/Sq7ppJbWPPqxQFBRmPEdIS8gHKr0Mi27CBhbX7:xsOtqlpJeqxKBRPtpr27ABL
- MD5 SHA1 SHA512 SSDEEP
Password
2024
PE Signature issue
Digest
17:3e:4d:ec:56:5c:4f:6e:22:2b:f8:10:fb:3e:48:cb:7c:b3:bd:e7:53:cd:a8:8e:b0:28:4e:07:21:c4:4c:ef
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=912 309 975,CN=Vivaldi Technologies AS,O=Vivaldi Technologies AS,STREET=Mølleparken 6,L=Oslo,ST=Oslo,C=NO,1.3.6.1.4.1.311.60.2.1.3=#13024e4f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 31, 2024
SERIALNUMBER=912 309 975,CN=Vivaldi Technologies AS,O=Vivaldi Technologies AS,STREET=Mølleparken 6,L=Oslo,ST=Oslo,C=NO,1.3.6.1.4.1.311.60.2.1.3=#13024e4f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=912 309 975,CN=Vivaldi Technologies AS,O=Vivaldi Technologies AS,STREET=Mølleparken 6,L=Oslo,ST=Oslo,C=NO,1.3.6.1.4.1.311.60.2.1.3=#13024e4f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0e:61:94:e2:77:9d:53:1f:89:69:50:ff
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2023 - Dec 18, 2026
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
1
Major OS version
5
Entry point
122573
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ord17
kernel32
SetLastError
GetDiskFreeSpaceExW
SetFileAttributesW
Sleep
GetExitCodeThread
CreateThread
SystemTimeToFileTime
GetLocalTime
GetFileAttributesW
CreateDirectoryW
lstrlenA
WriteFile
GetStdHandle
GetModuleHandleW
LockResource
LoadResource
SizeofResource
FindResourceExA
MulDiv
GlobalFree
GlobalAlloc
lstrcmpiA
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
MultiByteToWideChar
GetLocaleInfoW
lstrcmpiW
GetEnvironmentVariableW
SetCurrentDirectoryW
lstrcmpW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
GetCurrentDirectoryW
GetTempPathW
WideCharToMultiByte
CompareFileTime
ExpandEnvironmentStringsW
GetSystemTimeAsFileTime
SetThreadLocale
LoadLibraryA
SetEnvironmentVariableW
CreateFileW
GetDriveTypeW
SetProcessWorkingSetSize
GetCurrentProcess
GetModuleFileNameW
GetVersionExW
LoadLibraryW
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
GetCurrentThreadId
GetSystemDirectoryW
TerminateThread
SuspendThread
GetCommandLineW
LocalFree
lstrcpyW
FormatMessageW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualFree
GetFileSize
SetFilePointer
ReadFile
SetFileTime
SetEndOfFile
GetFileInformationByHandle
WaitForMultipleObjects
DecodePointer
EncodePointer
ExitThread
RtlUnwind
RaiseException
HeapAlloc
HeapFree
HeapReAlloc
GetCommandLineA
HeapSetInformation
HeapSize
ExitProcess
IsProcessorFeaturePresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
InitializeCriticalSectionAndSpinCount
HeapCreate
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeW
LCMapStringW
GetStartupInfoW
CreateProcessW
GetLastError
CreateJobObjectW
ResumeThread
AssignProcessToJobObject
CreateIoCompletionPort
SetInformationJobObject
GetQueuedCompletionStatus
WaitForSingleObject
CloseHandle
GetExitCodeProcess
GetProcAddress
lstrlenW
GetTickCount
IsBadReadPtr
user32
GetClientRect
SetWindowLongW
UnhookWindowsHookEx
SetFocus
GetSystemMetrics
SystemParametersInfoW
DrawTextW
GetDC
ClientToScreen
GetWindow
DialogBoxIndirectParamW
DrawIconEx
CallWindowProcW
DefWindowProcW
CallNextHookEx
PtInRect
SetWindowsHookExW
LoadImageW
LoadIconW
MessageBeep
EnableWindow
GetDlgItem
GetSystemMenu
CreateWindowExA
wvsprintfW
wsprintfW
GetParent
ScreenToClient
CreateWindowExW
GetDesktopWindow
GetWindowRect
SetWindowPos
SetTimer
GetMessageW
DispatchMessageW
KillTimer
CharUpperW
SendMessageW
ShowWindow
BringWindowToTop
EndDialog
IsWindow
GetKeyState
MessageBoxA
DestroyWindow
GetSysColor
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
GetClassNameA
GetWindowLongW
GetMenu
GetWindowDC
ReleaseDC
EnableMenuItem
CopyImage
gdi32
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
DeleteObject
CreateFontIndirectW
SetStretchBltMode
StretchBlt
GetCurrentObject
GetObjectW
DeleteDC
advapi32
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFileInfoW
ole32
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance
oleaut32
OleLoadPicture
SysAllocString
SysAllocStringLen
VariantClear
SysFreeString
Name
.text
Size
138KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=233, id=1, productName=Unmarked objects,
count=25, id=158, productName=VS2010 build 30319, version=30319,
count=76, id=170, productName=VS2010 build 30319, version=30319,
count=83, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
ElectronR/WpfAnimatedGif.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4498d8d1a0549717852507993b7c0350d1da408d22943ed8244d16441abfaf99
- MD5 f591261c6d85601764b3b8aea8df8b2e
- SHA1 1b16ea63fcb9b60e41f871f428880059c40ded0c
- SHA512 05dafbb83d136cd75588f0883497864e942770258461998ab654aa07a1087df590446c28029b6c2fabe27520d47f88eff63ddf80448beaf96887ec5f801544aa
- SSDEEP 768:jDcl7W1UiZTo1ooEqzW3SQwiNsI8l5wwyvUPrYZBkcD:X8QpZTsooEX3SQwr9y4UZRD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2024
Minor OS version
0
Major OS version
4
Entry point
48030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb
mscoree
_CorDllMain
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ElectronR/ai.cfg
- SHA256 db9ec7ae21d140904d44d6e6550c0c964e32ef11c055696b355835905c9c3a53
- MD5 73ed0e22c8cc70ed93dfd0c1b8f81e19
- SHA1 f16c87ca3eb393ee34f57fb59781cd37f5963db0
- SHA512 3dbe1fd660c7446c4a70c99cf6bf7909c76cd02ca24930bdeee851da094850b2fd6f6742025d215ce7dbf3348225c0b64d28e3f1ba133bdd9c7beece84d7e54f
- MD5 SHA1 SHA512
ElectronR/arialbd.ttf
- SHA256 be221654612db226df09f0246de80d4e1aaf07d4484a7117ee34c303358fa44f
- MD5 ac8ce60bf9ef976a52176e90335cab62
- SHA1 77307ba38a136e1329c595f001a4dff1e98274d1
- SHA512 3fdbebb145c6fcc825808dd011d893bba944c36fbfb69b35a711389a46f0c8e7aa6fe8b3a562b7453e0acec6d2aac5a7535404f8b3efac494b575ada5532d4d6
- SSDEEP 6144:HeFckV5uFRVgbjY6fC65BmWYYEwzl/BB7prc2HNxGc7w2oQgP:HOVkFbuU6loWYvwhP7prc2HNx7Po/
- MD5 SHA1 SHA512 SSDEEP
ElectronR/binkawin.asi
- IMPHASH eb47f3eba69cd506a684fe741aa6a115
- SHA256 dd68562b5e4686e1a07603057db7a12040821beadd81d142bfb6a57d2de45ddb
- MD5 d51b5b46735b25c2d8372608159ed1a9
- SHA1 2c178740901103d66a59131e19548d84c44fa768
- SHA512 7c9a856fea8f7d4bddfc2b67724b475f7561979fbcf088ef2ce839e7c10870920ab4ea6b7d29254ab9d585a917eff5481c73644290350265682c627ab8fa110b
- SSDEEP 1536:Ed01XORcuxj9ijJ644BXOpmE88Y+xs9PuMLHXwbJoeQ3fr:S0tOJxj9GJ644l2m78pm5uMLHX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2024
Minor OS version
0
Major OS version
5
Entry point
15040
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\devel\projects\mss\build\win\binkawin.pdb
user32
GetCursorPos
MessageBoxA
kernel32
DisableThreadLibraryCalls
TerminateProcess
GetCurrentProcess
GetTickCount
_RIB_Main@20
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
BINK_acd
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
BINK_fft
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BINKDATA
Size
1024B
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BINKCONS
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
BINKDATA
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
714B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=1, productName=Unmarked objects,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=137, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ElectronR/cef_extensions.pak
- SHA256 ce0db41570a927a119ddbb29484f02bc1aa6151503f87d8441290daa0b9a3ff1
- MD5 fb65975b17de4a98bd39a56adfba5e49
- SHA1 24f554f8d738e5e38d80930b1386092f062b2b18
- SHA512 8c7bba37bdbdf426fe8d4bb665b62534b1a98259c4a2f7aaf23cfc5c124f480308496be3f0ff5cbd3a79a2eae3acc2eaf263ca7ab8a62fd5879905d64fc37dc4
- SSDEEP 49152:KP7H5FrBDef67G1hdAKG8YVu4ZZCGr68IC72y:B1hLYo6ZCG+8byy
- MD5 SHA1 SHA512 SSDEEP
ElectronR/icudtl.dat
- SHA256 c61704cc9cf5797bf32301a2b3312158af3fe86eadc913d937031cf594760c2d
- MD5 d866d68e4a3eae8cdbfd5fc7a9967d20
- SHA1 42a5033597e4be36ccfa16d19890049ba0e25a56
- SHA512 4cc04e708b9c3d854147b097e44ff795f956b8a714ab61ddd5434119ade768eb4da4b28938a9477e4cb0d63106cce09fd1ec86f33af1c864f4ea599f8d999b97
- SSDEEP 196608:KWzwSv9AAQlCy4liXUxCGZHa93Whlw6Zi88EIb:KnKlQlz4liXUxCGZHa93Whlw6Zf8EIb
- MD5 SHA1 SHA512 SSDEEP
ElectronR/metod 2/loader.exe
- IMPHASH bf5a4aa99e5b160f8521cadd6bfe73b8
- SHA256 13fd7e1bb427d92b65e9d9d868b653e2fbf73974268204146bb3a38618ab7082
- MD5 d21b999040db0b326696983a772f862a
- SHA1 77f4fd6966bb5231b1e70b1513cc8c72e41ee37f
- SHA512 8d7a23d58c5ce24ab5c515c7bb4374639fcef4bc106563d6bf2e3a5dd1e582795864952f879dfb8bb7342825ac13740caec0633297c9dbecd2cc67920ceb0d70
- SSDEEP 3072:XDKW1FgppLRHMY0TBfJvjcTp5XMlbchJjQfhd6S34vgI1P1fRfxA:XDKW1Fgbdl0TBBvjc/Mp4+hdov14
- MD5 SHA1 SHA512 SSDEEP
Password
2024
PE Signature issue
Digest
8b:81:3f:9d:38:6f:3e:91:40:1a:3c:db:35:c9:3a:1a:e4:f8:af:d2
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=GOG sp. z o.o,O=GOG sp. z o.o,L=WARSZAWA,ST=MAZOWIECKIE,C=PL
Chains
Jun 16, 2023
CN=GOG sp. z o.o,O=GOG sp. z o.o,L=WARSZAWA,ST=MAZOWIECKIE,C=PL
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=GOG sp. z o.o,O=GOG sp. z o.o,L=WARSZAWA,ST=MAZOWIECKIE,C=PL
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=GOG sp. z o.o,O=GOG sp. z o.o,L=WARSZAWA,ST=MAZOWIECKIE,C=PL
Serial Number
0b:97:6d:d3:81:4e:72:2f:75:0a:35:f3:bc:91:bf:a0
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2023 - Mar 19, 2024
Minor OS version
0
Major OS version
5
Entry point
52527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
ole32
OleInitialize
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
ElectronR/resources.pak
- SHA256 3a7eec7fe51921a1531f3d934dc6885720b5c7c38b7198db34ade25ea24e6902
- MD5 5817575bebaa468835fcdc4741090f82
- SHA1 b4c202af84bb9d76dd5b2ca5b1792f92eee5fe3f
- SHA512 f17a2e5219d36ead2b0f08f3bd8ae8c8bbcb884a953982a1d5e4bd7a72ff7f2a436d4a01438f483f3696ec85cbfa901300ba7c8152459b034f3a4a586be988c6
- SSDEEP 196608:Y4nT7XupsHKtC6KmGdtdhB48hCUkrlsyCV5vXbh:Y4TLzHB/Dv148hXkrG5vXbh
- MD5 SHA1 SHA512 SSDEEP
ElectronR/v8_context_snapshot.bin
- SHA256 8fd87ecced06e11ae3c68bff23bd01030e0cc92e54d1187beded519805cafbfd
- MD5 aab40be534be83067f33dded0412b9df
- SHA1 427bfe3b250a002832e163324bf4e6988ecc578a
- SHA512 14574bbe99040e6468a02befea6a767d6e6f10182c460a70be6b1b0596850ca41d65024314ad4dc00a3142ded14dc43e571df8e81f06116e7793c8bec4d84321
- SSDEEP 6144:GCbAnnin8pTRrvrLtgD+VN3PXDR7jb1PJWhL:ag82KX3/ZjtJQL
- MD5 SHA1 SHA512 SSDEEP