DBar[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

DBar.exe
Size

3.4MB
MD5

099b950c7ca279c7e643ee04c7e0cdae
SHA1

baec19ac53cc1eb2a7e20ec4a9d9cc20699fcb93
SHA256

9235b6f273f307e95e804eca1dff08561088bb07b35cacf4181f5ed04d674542
SHA512

36722d9d0eaa4290c8ffc1dda536ae24d9c085dc3a0af50b4ac1125ed9f7c34fbd37e1ebf37ac66c8e401aece027905d382c4353934d7f64d193800315d00fda
SSDEEP

49152:m/FLe7o5egX8blyMzbE39fSYXQP0FwFpiOPAWkKs3btrwFsDYWQrZCb9mU+FP:W8E39fSYXQP06piAAWkKsCFHZCKFP

Score

1^/10

Malware Config

Signatures

Files

DBar.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

7d:9c:3f:75:09:b9:da:f4:72:f7:52:ab:37:99:19:e1
Certificate

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

18/05/2023, 15:38

Not After

17/05/2026, 05:38

Subject

SERIALNUMBER=155722923,CN=Apollo Technologies Inc,O=Apollo Technologies Inc,L=Panama City,C=PA,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

26/03/2019, 17:44

Not After

22/03/2034, 17:44

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a3:2b:91:47:b0:33:ad:7e:bb:3d:85:54:4f:d3:cf:26:94:02:21:7f:7b:87:02:47:59:07:a1:96:e6:b3:8a:24
Signer

Actual PE Digest

a3:2b:91:47:b0:33:ad:7e:bb:3d:85:54:4f:d3:cf:26:94:02:21:7f:7b:87:02:47:59:07:a1:96:e6:b3:8a:24

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\user\Documents\desktop-bar\DBar\bin\x86\Release\Dotfuscated\DBar.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

7d:9c:3f:75:09:b9:da:f4:72:f7:52:ab:37:99:19:e1Certificate

Extended Key Usages

Key Usages

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

a3:2b:91:47:b0:33:ad:7e:bb:3d:85:54:4f:d3:cf:26:94:02:21:7f:7b:87:02:47:59:07:a1:96:e6:b3:8a:24Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rsrc Size: 121KB - Virtual size: 120KB

.reloc Size: 512B - Virtual size: 12B

7d:9c:3f:75:09:b9:da:f4:72:f7:52:ab:37:99:19:e1
Certificate

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

a3:2b:91:47:b0:33:ad:7e:bb:3d:85:54:4f:d3:cf:26:94:02:21:7f:7b:87:02:47:59:07:a1:96:e6:b3:8a:24
Signer

.text
Size: 3.3MB - Virtual size: 3.3MB

.rsrc
Size: 121KB - Virtual size: 120KB

.reloc
Size: 512B - Virtual size: 12B