file[.]exe | Triage™

file.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 907706946fe86a55bf29fefb4e5d2d0f0f490bd1b565cb39bdf8daad60acabfc
MD5 8e42154340d1bbc53124f99ba0c32f4c
SHA1 040ab2d5c10313dbc2a90bea01e7be35be26e533
SHA512 bd32fb25575d90a0bc7f9e79c6dec2fcf0874f9be630cb71d438b267e03d28b37d085e0a24b19b325ae0801a8f4f50626c428b464c703aebefad976c23be7ff2
SSDEEP 24576:vfLGjUJ+7ewtyRYd41pdz8Z7tmvZZCEP9cEeGcMo0cHTCPTEFhEOsDObVCAih:nUsCegqgZBmZZCEVKGcM0zCLyhJsAKh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

8c:f4:70:05:88:2a:e5:c6:34:be:d1:39:bb:3d:99:33:81:38:cd:31:5f:36:bf:5f:65:ea:49:74:29:de:b5:62

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=4559077,CN=Now.gg\, INC,O=Now.gg\, INC,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 26, 2024

SERIALNUMBER=4559077,CN=Now.gg\, INC,O=Now.gg\, INC,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=4559077,CN=Now.gg\, INC,O=Now.gg\, INC,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=4559077,CN=Now.gg\, INC,O=Now.gg\, INC,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

04:f9:d5:0a:6c:79:2c:9f:d3:9d:47:2e:98:37:b5:ff

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 14, 2023 - Apr 5, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$INTERNET_CACHE/Adjust

SHA256 096c03a100040e3aa18471b45cb8676cffa084e14048ff25e2baa3b9ee6be286
MD5 5f998222206b54a015de203d50013919
SHA1 0f0c03ee1d535c5ab9a11f7b0cb0fd0cd17f3250
SHA512 56d2b681e4f6bf116907b9e56b30851f56580018fb07ea5c1646eb8c78a01d367c0f9a048321abc8e57f53a76b164f6ee10259a70bc3396efe110bbe53a713cc
SSDEEP 1536:NsW4dIsTu9aAwueAUPxKfi6JfTcQdAOxXPlAk:yViaAteAUPx6RXPGk
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Besides

SHA256 c5562d70a3486e40af0d77231324f6415383b676cd37d2be60a52f3066d159c4
MD5 e6f59e2d5eb54747cf837c35e9df9fe3
SHA1 d9ad2413360d2acc0b3a23b959a927a3530f3462
SHA512 79939286d29c420460dc16a0c92947fa7f02d7cf74b342e7545224c61b9c630815320a1d7a75d075cb0f96fbcfcb6e242e60ea7fbd66c9a86a42a09f60f4b497
SSDEEP 3072:mXARFDFnzNfy7RMGDePAUsM5N/8RHWVvUF5k5C4F9+kP6MTx0:mw71NMrDuANM5N/8RHW+FW/9CCx0
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Buck

SHA256 4f8b24e2a41f06385a217d2cf3ba9118e3c9ff2e1af4898f8818ab6b4b47d608
MD5 6268ac4040c9c50d6cc138f00d1ff031
SHA1 b0474a799086ad83f26ac4c94990b18f791e58ab
SHA512 fca29346189cbe532c740ac2af77f270a76e7e0239c81f1af13421846c5396ea69b2f19e31e5554e3803b2a15a9f0d84a28a160d0d62150570fce29fc180407f
MD5 SHA1 SHA512

$INTERNET_CACHE/Environmental

SHA256 6bb78419c4697b5287cf6f9b31d66357ee7a907c8b432a097bebb5f6bad403dc
MD5 bfd5e0f0435f2984613b57209faefb96
SHA1 57d35bf49135e2e552453a983a0bd3bab1c2b93f
SHA512 7ebefa19f63074445066c30722090eb553f095bdbbf7b31b1334a8fb539de7f4818167987115ba1485d1f3e834490ea45866d42549b25882548cf03cdd9ef108
SSDEEP 6144:sChNuqcxN4QVtKSnVKYUWOtci/aVrdHfX5bZYalrISe6HKfPeohX:xeqCPKSnVKqOraVrdHfX5bZPrNHaWoh
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Kirk

SHA256 78cb40e0df6752c4454168d11f4af632825d95aeaf2901b475549b8fa6e860e7
MD5 80e5c12559f7db2eff61d9c75d8916ed
SHA1 f6010cb54f65f2fd781bbcac052581ba5eac3bc5
SHA512 ab34f30f4d157398d172e1fc6cd68625150f6781ee7bd9cb803d3e09248aea52339be30161ff1ad38a33624391087307a1b06fa270a719dd8b3e5785e7248fc0
SSDEEP 3072:xhBaQ5h+Roc0UPSmadFLH7Jv8tlTc7PvuaaxabyTR0WtP58/wMW4xTLIKQLJsvPS:xP60dPLH7JSleLaxQydPP5KKATbQLivq
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Move

SHA256 a2f1a59c5715117971c921258f1ee3f0d065dd695810c4924e150a518b02a437
MD5 e315eec0df8fa4518bcea1a2d74e75c8
SHA1 81e7cf34cb69e2196dd60ca0eb8ad9d7b1c8a2c6
SHA512 745187fb15036640fa6e9b1bcc163a985ee774e84580fdd2c76e89a7546c9ccbbf8d18e8706dd215cf20d3be77c78ae22af06a204e75c1fe937ae21901729560
SSDEEP 3072:n21UpOPbnA3jJamkna+ubHFZ4cKhPQmbKdQwkOu4IUoUC4DTGE:2OpOPb8Imt+yHrnhwOf1VCYx
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Optimal

SHA256 2cac89fb2c6f1153b8a9e824e7e934fbb969c01f626fbaf65d3411d9e8b4c962
MD5 f72ea29a6ba0b7ba31239d5555f8d4c0
SHA1 1859148e0396f7d1c97212f825fd412ae311e589
SHA512 53131d9137dd357ab0c0d09db1ac19698bd604b3f70f08b37bca9d9599f77f2abe205104ab2ed00f163736f104e6233ac54aba7c9d57ad944fb2b9412a0a9765
SSDEEP 1536:UELxsnBgarS9atzPIGfAwmrnN3EfrDWyu0uZo2+9B9a:UELx6BgarSMtQGVenNaWy4ZNo9a
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Resume

SHA256 08d11b731018d74681d829202e8926ed547023aaeea764bb3d6f426f2e531883
MD5 d36c9e3b7c98f094f3a3a2026c7f5d40
SHA1 bcbc3b22b164146ae8a108c256211114cd557524
SHA512 abf4a4d02455ceb0f7df0f9654c72f5539cf60e7f5fae0efca309927576a1f229713c5918fd2c2ccb8c2c3757d22463bdedda3742ecd4b093ad1e2a7309d31b2
SSDEEP 6144:ch820nOG7V5n6qKDBYJAxI0kuql5o4wFT15KLf59dQ7SucwQ:cvuXJN6VDBYQql5o4wFT15KLf56SuhQ
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Skype

SHA256 12c7a7d489c0c2032fd37edaf8c0616e4ff44e0d2f6ed0b9ebdae834d262d764
MD5 74c926a03678fbdb41d0b347e9968f54
SHA1 3e20927c48eaa226aff887fd199a109cc268d846
SHA512 4cbf5c2f64e9c2826ebf5cbdb97e03d55dde7470a95e7aac2f80e3e98bd4606f9b97b368c3229c4a4a1014a55c905480aaf32a748f48c1c24b0632de584f0d06
SSDEEP 3072:cXS1YNuXjTchZP7Ho0Svd7OktxIpjRbAKLw4WqW1rvGJYPfMa:cC1SuzTgo0SvVfqpjRAKE4W7NMa
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Sword

SHA256 f6238ef450cbf68796a99593c18eb1e64d359263c77baf4aec1acb942fe808ee
MD5 79dabe9b028f94d9af71be6224b0a58f
SHA1 ae6c5eebe69bc60d4a55ca30e08a5a8ddb4feb5e
SHA512 3d5680d18e86a66f4e430b5de76c6d73114328ea2ef59b98f0d1c69fc746bf1c4ad45850db14172fa9936e51566cd13c413a63bf830f884ef919cdef2cdd5743
SSDEEP 384:Pf/7BZ3+A1toYTLD0H+jsMGGmnYB+/U0urFIzMR/eYaVTJgZ/PbQ:vX+MV8HqsMtme4U0gIzMRAHgZU
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/W

SHA256 80810fa392f77775e1415507bde2a6c7a3a18cc442494db47e089c64886694d8
MD5 38c9e1bcc01e87e599cac5a8772bf25e
SHA1 35abdd6e42088e131d0151a3027c634932322b50
SHA512 f154380b9ca0059342d705b35b97e246d87e82ae63491fdfea32a399f3b6c89d56fd46bbabb9e00ccf32e1d0afbdacc84cec9581ba2e4acd69ce62991c33bb8d
SSDEEP 3072:Gzm1fbhvr0GPS07Ge00f3m12n8B47sbWzdM:GzubhvDPS0amf3vn8C7syzdM
MD5 SHA1 SHA512 SSDEEP

$INTERNET_CACHE/Winds

SHA256 ddef45c206e72ac0ab26c1793cfd8bb8f2c34ca6acc7f3bdc196b0fc2ddcf04a
MD5 3ea30d6c00dee320fab47266261cc4d4
SHA1 c4b062d349ea502580c2b846e2a3dcce0ad19985
SHA512 d5ec23930a5519e4f92c28a89bd15caca219f12c1d10ff1377a2e519fa5121598bd5bb23e0f3121e2684a68d325329715c686979c7e323e919afa502dcedaf2a
SSDEEP 3072:4MmMyrpULlhJLLwpOmvLsncz6zFzQXLgDIF/d8:4MmMopOmvLxC
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$INTERNET_CACHE/Adjust

$INTERNET_CACHE/Besides

$INTERNET_CACHE/Buck

$INTERNET_CACHE/Environmental

$INTERNET_CACHE/Kirk

$INTERNET_CACHE/Move

$INTERNET_CACHE/Optimal

$INTERNET_CACHE/Resume

$INTERNET_CACHE/Skype

$INTERNET_CACHE/Sword

$INTERNET_CACHE/W

$INTERNET_CACHE/Winds