Paladin[.]exe | Triage

Resubmissions

10-04-2024 03:57

240410-ejctzsgb61 9

Sharing

Copy URL

Twitter E-mail

General

Target

Paladin.exe
Size

9.5MB
MD5

60fb5bcf43d7462fba8a16edde2c9524
SHA1

4118779194de403e1b7baf9d5a1dc43ee48130dc
SHA256

86ef1a5f70b1f18a40f4f3bc6f975e29543c6a0266c123276dbc9c3057dcee5b
SHA512

8fac729c002e2d0f7b20eb27caf599ddff1af44c3162ee4f9c5aab355869c577139e2c3d038a186fb6576825f7cca99c2a3cda20e64ea1672c9318992236d94f
SSDEEP

196608:RFxF82Yk816W8Gb9y0TiaujeMGsDPkcUvwRm0zEeOppTc6FrGp:RTuSp149yRz9Pkc6wRSLC5

Score

1^/10

Malware Config

Signatures

Files

Paladin.exe
.exe windows:6 windows x64 arch:x64

Code Sign

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29
Certificate

Issuer

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:c1:00:ab:92:30:22:d3:fa:dc:e4:9a:65:0d:51:8a
Certificate

Issuer

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

05-10-2021 00:00

Not After

06-10-2022 23:59

Subject

SERIALNUMBER=3128605-6,CN=Monelite Oy,O=Monelite Oy,L=Palokka,C=FI,1.3.6.1.4.1.311.60.2.1.3=#13024649,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:a8:9f:ff:02:17:2e:1e:ba:f0:4f:1b:39:c6:40:f3:81:d5:89:2e:9c:9c:44:1c:ee:76:9a:5a:a0:5f:9a:f9
Signer

Actual PE Digest

0d:a8:9f:ff:02:17:2e:1e:ba:f0:4f:1b:39:c6:40:f3:81:d5:89:2e:9c:9c:44:1c:ee:76:9a:5a:a0:5f:9a:f9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 1.7MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 465KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 27KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 82KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 29KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 9KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

pld
Size: - Virtual size: 11.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Code Sign

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29Certificate

Extended Key Usages

Key Usages

0a:c1:00:ab:92:30:22:d3:fa:dc:e4:9a:65:0d:51:8aCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0d:a8:9f:ff:02:17:2e:1e:ba:f0:4f:1b:39:c6:40:f3:81:d5:89:2e:9c:9c:44:1c:ee:76:9a:5a:a0:5f:9a:f9Signer

Headers

DLL Characteristics

File Characteristics

Sections

Size: 1.7MB - Virtual size: 3.5MB

Size: 465KB - Virtual size: 2.5MB

Size: 27KB - Virtual size: 182KB

Size: 82KB - Virtual size: 143KB

Size: 512B - Virtual size: 252B

Size: 29KB - Virtual size: 119KB

Size: 9KB - Virtual size: 32KB

.idata Size: 1024B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 108KB - Virtual size: 108KB

pld Size: - Virtual size: 11.5MB

.boot Size: 7.1MB - Virtual size: 7.1MB

.reloc Size: 16B - Virtual size: 4KB

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29
Certificate

0a:c1:00:ab:92:30:22:d3:fa:dc:e4:9a:65:0d:51:8a
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0d:a8:9f:ff:02:17:2e:1e:ba:f0:4f:1b:39:c6:40:f3:81:d5:89:2e:9c:9c:44:1c:ee:76:9a:5a:a0:5f:9a:f9
Signer

.idata
Size: 1024B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 108KB - Virtual size: 108KB

pld
Size: - Virtual size: 11.5MB

.boot
Size: 7.1MB - Virtual size: 7.1MB

.reloc
Size: 16B - Virtual size: 4KB