gpg[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

gpg.exe
Size

1.0MB
MD5

b8d4c036160ac2fa5f379b536006eacd
SHA1

9e75a13ef98cb6baf13962ed2fbd55c3134e6626
SHA256

b6f106d3a1d025cab12025036b8888c431a000897ebeadc5abf62570cc6ab1a0
SHA512

24445632c40aeefa1ee1e289150cb3e9c0798402eafb82e07adb09c304de75afd1dbe043897136dbc284bb030545d8693c222a12762814c2a71c79e3cfee87ed
SSDEEP

24576:jS3sb74MqrxZiLPzuXpTfWLB/d3UXi2aTv2398OWUca+BVhQI4U4q8:j5l6XpTfWLn3q+T47

Score

1^/10

Malware Config

Signatures

Files

gpg.exe
.exe windows:4 windows x86 arch:x86

23e3280014cbc48e29547f921087214e

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:e6:84:f0:5c:48:91:1b:af:b3:76:29
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

23/04/2019, 05:54

Not After

02/06/2022, 12:12

Subject

CN=g10 Code GmbH,O=g10 Code GmbH,L=Erkrath,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c10636f646540673130636f64652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ed:ef:48:2d:b4:85:25:78:5f:f7:99:b2:25:40:0e:6b:b3:70:e8:82:ab:19:7a:be:96:28:1e:ed:68:52:a7:3e
Signer

Actual PE Digest

ed:ef:48:2d:b4:85:25:78:5f:f7:99:b2:25:40:0e:6b:b3:70:e8:82:ab:19:7a:be:96:28:1e:ed:68:52:a7:3e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

libassuan-0

assuan_begin_confidential
assuan_end_confidential
assuan_inquire
assuan_new
assuan_release
assuan_send_data
assuan_set_gpg_err_source
assuan_set_log_cb
assuan_set_malloc_hooks
assuan_socket_connect
assuan_transact

libgcrypt-20

gcry_calloc
gcry_calloc_secure
gcry_check_version
gcry_cipher_algo_info
gcry_cipher_algo_name
gcry_cipher_authenticate
gcry_cipher_checktag
gcry_cipher_close
gcry_cipher_ctl
gcry_cipher_decrypt
gcry_cipher_encrypt
gcry_cipher_get_algo_blklen
gcry_cipher_get_algo_keylen
gcry_cipher_map_name
gcry_cipher_open
gcry_cipher_setiv
gcry_cipher_setkey
gcry_control
gcry_create_nonce
gcry_free
gcry_get_config
gcry_is_secure
gcry_kdf_derive
gcry_malloc
gcry_malloc_secure
gcry_md_algo_info
gcry_md_algo_name
gcry_md_close
gcry_md_copy
gcry_md_ctl
gcry_md_debug
gcry_md_enable
gcry_md_get_algo
gcry_md_get_algo_dlen
gcry_md_hash_buffer
gcry_md_is_enabled
gcry_md_is_secure
gcry_md_map_name
gcry_md_open
gcry_md_read
gcry_md_write
gcry_mpi_aprint
gcry_mpi_cmp
gcry_mpi_copy
gcry_mpi_dump
gcry_mpi_get_flag
gcry_mpi_get_nbits
gcry_mpi_get_opaque
gcry_mpi_print
gcry_mpi_randomize
gcry_mpi_release
gcry_mpi_scan
gcry_mpi_set_flag
gcry_mpi_set_opaque
gcry_mpi_set_opaque_copy
gcry_mpi_snew
gcry_pk_algo_info
gcry_pk_algo_name
gcry_pk_ctl
gcry_pk_encrypt
gcry_pk_get_curve
gcry_pk_get_keygrip
gcry_pk_get_nbits
gcry_pk_map_name
gcry_pk_testkey
gcry_pk_verify
gcry_random_bytes
gcry_random_bytes_secure
gcry_randomize
gcry_realloc
gcry_set_fatalerror_handler
gcry_set_log_handler
gcry_set_outofcore_handler
gcry_set_progress_handler
gcry_sexp_build
gcry_sexp_build_array
gcry_sexp_cadr
gcry_sexp_canon_len
gcry_sexp_extract_param
gcry_sexp_find_token
gcry_sexp_length
gcry_sexp_new
gcry_sexp_nth
gcry_sexp_nth_data
gcry_sexp_nth_mpi
gcry_sexp_nth_string
gcry_sexp_release
gcry_sexp_sprint
gcry_sexp_sscan
gcry_strdup
gcry_xcalloc
gcry_xcalloc_secure
gcry_xmalloc
gcry_xmalloc_secure
gcry_xrealloc
gcry_xstrdup

libgpg-error-0

_gpg_w32_bindtextdomain
_gpg_w32_dngettext
_gpg_w32_gettext
_gpg_w32_gettext_localename
_gpg_w32_gettext_use_utf8
_gpg_w32_textdomain
_gpgrt_get_std_stream
_gpgrt_putc_overflow
gpg_err_code_from_errno
gpg_err_code_from_syserror
gpg_err_init
gpg_err_set_errno
gpg_strerror
gpg_strsource
gpgrt_access
gpgrt_argparse
gpgrt_argparser
gpgrt_asprintf
gpgrt_bsprintf
gpgrt_chdir
gpgrt_clearerr
gpgrt_fclose
gpgrt_fclose_snatch
gpgrt_fdopen
gpgrt_fdopen_nc
gpgrt_ferror
gpgrt_fflush
gpgrt_fgetc
gpgrt_fgets
gpgrt_fileno
gpgrt_flockfile
gpgrt_fopen
gpgrt_fopencookie
gpgrt_fopenmem
gpgrt_fprintf
gpgrt_fprintf_unlocked
gpgrt_fputc
gpgrt_fputs
gpgrt_fputs_unlocked
gpgrt_fread
gpgrt_free
gpgrt_fseek
gpgrt_fseeko
gpgrt_ftello
gpgrt_funlockfile
gpgrt_fwrite
gpgrt_getcwd
gpgrt_mkdir
gpgrt_printf
gpgrt_read
gpgrt_rewind
gpgrt_set_alloc_func
gpgrt_set_binary
gpgrt_set_confdir
gpgrt_set_fixed_string_mapper
gpgrt_set_strusage
gpgrt_set_usage_outfnc
gpgrt_setvbuf
gpgrt_snprintf
gpgrt_strusage
gpgrt_sysopen
gpgrt_vasprintf
gpgrt_vbsprintf
gpgrt_vfprintf
gpgrt_vfprintf_unlocked
gpgrt_w32_iconv
gpgrt_w32_iconv_close
gpgrt_w32_iconv_open
gpgrt_write
gpgrt_write_hexstring
gpgrt_write_sanitized

libsqlite3-0

sqlite3_bind_blob
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_parameter_count
sqlite3_bind_text
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_close
sqlite3_column_count
sqlite3_column_name
sqlite3_column_text
sqlite3_column_type
sqlite3_db_handle
sqlite3_errmsg
sqlite3_errstr
sqlite3_exec
sqlite3_finalize
sqlite3_free
sqlite3_malloc
sqlite3_open
sqlite3_prepare_v2
sqlite3_reset
sqlite3_step
sqlite3_vmprintf

zlib1

deflate
deflateEnd
deflateInit2_
deflateInit_
inflate
inflateEnd
inflateInit2_
inflateInit_

advapi32

CopySid
GetLengthSid
GetTokenInformation
GetUserNameW
IsValidSid
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

CloseHandle
CreateDirectoryA
CreateFileA
CreateFileW
CreatePipe
CreateProcessA
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsA
FormatMessageA
GetACP
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetLastError
GetModuleFileNameW
GetPriorityClass
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetTempPathA
GetTickCount
GetVersionExA
InitializeCriticalSection
IsDBCSLeadByte
LeaveCriticalSection
LoadLibraryA
LockFileEx
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
ReadConsoleA
ReadFile
ResumeThread
SetConsoleMode
SetEnvironmentVariableA
SetFilePointer
SetHandleInformation
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
UnlockFileEx
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteFile

msvcrt

__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_errno
_exit
_findclose
_fstati64
_get_osfhandle
_initterm
_iob
_lseeki64
_onexit
_open_osfhandle
_stati64
_stricmp
_strnicmp
_vsnprintf
_wfopen
_wfullpath
_wopen
_wrename
abort
atoi
bsearch
calloc
exit
fclose
ferror
fflush
fgetc
fgets
fopen
fprintf
fputc
fputs
fread
free
fwprintf
fwrite
getenv
isalnum
iscntrl
isgraph
isprint
isspace
isxdigit
malloc
memchr
memcmp
memcpy
memmove
memset
mktime
localtime
gmtime
printf
putc
qsort
raise
realloc
remove
rename
setlocale
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
toupper
ungetc
vfprintf
time
wcscat
wcscpy
wcslen
_wstat
_wfindnext
_wfindfirst
_snwprintf
_write
_unlink
_umask
_stricmp
_strdup
_setmode
_rmdir
_read
_putenv
_open
_memicmp
_isatty
_getpid
_fileno
_fdopen
_dup
_close
_access

shell32

ShellExecuteExW

user32

AllowSetForegroundWindow
MessageBoxW

ws2_32

WSAGetLastError
WSAStartup
closesocket
connect
htons
inet_addr
recv
send
socket

Sections

.text
Size: 833KB - Virtual size: 832KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

23e3280014cbc48e29547f921087214e

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

39:e6:84:f0:5c:48:91:1b:af:b3:76:29Certificate

Extended Key Usages

Key Usages

33:90:20:77:61:c4:26:dd:94:50:03:0dCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

ed:ef:48:2d:b4:85:25:78:5f:f7:99:b2:25:40:0e:6b:b3:70:e8:82:ab:19:7a:be:96:28:1e:ed:68:52:a7:3eSigner

Headers

DLL Characteristics

File Characteristics

Imports

libassuan-0

libgcrypt-20

libgpg-error-0

libsqlite3-0

zlib1

advapi32

kernel32

msvcrt

shell32

user32

ws2_32

Sections

.text Size: 833KB - Virtual size: 832KB

.data Size: 11KB - Virtual size: 11KB

.rdata Size: 177KB - Virtual size: 177KB

.bss Size: - Virtual size: 6KB

.idata Size: 12KB - Virtual size: 12KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 13KB - Virtual size: 12KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

39:e6:84:f0:5c:48:91:1b:af:b3:76:29
Certificate

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

ed:ef:48:2d:b4:85:25:78:5f:f7:99:b2:25:40:0e:6b:b3:70:e8:82:ab:19:7a:be:96:28:1e:ed:68:52:a7:3e
Signer

.text
Size: 833KB - Virtual size: 832KB

.data
Size: 11KB - Virtual size: 11KB

.rdata
Size: 177KB - Virtual size: 177KB

.bss
Size: - Virtual size: 6KB

.idata
Size: 12KB - Virtual size: 12KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 13KB - Virtual size: 12KB