file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 711KB
Sample240219-nd9q7sda49
SHA256 7cebc71cd9ea4bb12f67f86c200dc086e29601b2d1d31e75eac4b0ec5ef3ccb5
MD5 690b862d21eef78e0ac54559b692f1bc
SHA1 bdfa3b017aad1b5a658797cceb626551a857618e
SHA512 fc8aee9dea2b2a3e1409fdbd76af59937385a53938f480e2af85437377f8b96e5bcef30709bda8b35f9b048cdcba1f3c14eae3a77e9aed9417c63e4204d8a3c5
SSDEEP 12288:V8fRqGVut+MSaTjHY7tSbOXeLqiYEoJ0EuhrFbHK5DXwC5g6Y:ORqzvSa8SAeLqGoYrFbqFwC5gD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 711KB

file.exe

IMPHASH 9b306529b5b00246f6c79f96dde25d12
SHA256 7cebc71cd9ea4bb12f67f86c200dc086e29601b2d1d31e75eac4b0ec5ef3ccb5
MD5 690b862d21eef78e0ac54559b692f1bc
SHA1 bdfa3b017aad1b5a658797cceb626551a857618e
SHA512 fc8aee9dea2b2a3e1409fdbd76af59937385a53938f480e2af85437377f8b96e5bcef30709bda8b35f9b048cdcba1f3c14eae3a77e9aed9417c63e4204d8a3c5
SSDEEP 12288:V8fRqGVut+MSaTjHY7tSbOXeLqiYEoJ0EuhrFbHK5DXwC5g6Y:ORqzvSa8SAeLqGoYrFbqFwC5gD
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

93:a7:84:53:22:46:2c:70:a3:a5:f1:af:dd:bb:87:68:55:93:b4:b7:0d:73:fd:64:62:ec:5e:46:82:5f:71:da

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

Chains

Oct 18, 2023

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

Serial Number

04:cb:5b:11:6c:ee:82:84:0c:02:09:14:b1:a4:d0:4d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 17, 2021 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

24452

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

ShowWindow

kernel32

LoadLibraryExW WriteConsoleW GetTempPathA CloseHandle VirtualAlloc GetModuleHandleA GetProcAddress LoadLibraryA LoadLibraryW GlobalSize GlobalFlags GlobalHandle LocalHandle LocalSize FreeConsole GetConsoleWindow CreateToolhelp32Snapshot Process32First Process32Next CreateFileW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RaiseException RtlUnwind GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary DecodePointer ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

PE Signature issue

user32

kernel32

generic