General

Malware Config

Signatures

Files

• SurveyofCriticalBiologicalResourcesinBoulderCountyColorado.exe.gz

  .gz
• sample

  .exe .ps1 windows:4 windows x64 arch:x64 polyglot

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0b:e3:86:32:e9:fb:3c:60:cd:21:b1:3d:da:e6:5a:ad

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  08-05-2024 00:00

  Not After

  07-05-2025 23:59

  Subject

  SERIALNUMBER=780727-9,CN=Ameri Mode Inc.,O=Ameri Mode Inc.,L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  ce:c7:dd:11:9c:ad:24:a3:0d:06:45:03:7a:43:cf:c3:16:e3:b4:bd:3a:8c:b7:35:c1:0a:be:8c:7b:74:1e:28

  Signer

  Actual PE Digest

  ce:c7:dd:11:9c:ad:24:a3:0d:06:45:03:7a:43:cf:c3:16:e3:b4:bd:3a:8c:b7:35:c1:0a:be:8c:7b:74:1e:28

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 347KB - Virtual size: 347KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 305.1MB - Virtual size: 305.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ