ASRtool[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ASRtool.exe
Size

1.7MB
MD5

e49936499752c0a6a2ebc7750c7a5be9
SHA1

14c81d68efc7181acc74fd5ee276f60f40157baa
SHA256

f5d75e69a06d91d33b5feeceeeeeb62eed100aa55e5bd1d6ddc90bebff539524
SHA512

e11ab28188c46a3848c7b187dc42e3b7744112dc6592798c52d320977359f5df60e7504c1dffeb1d51886ec31b4ddde81e0f080b60be2380dc25d86608aefb07
SSDEEP

24576:Mg4NwFpgal9dQRPyRhyDcaviQI/XyNwFnVsA2ILDVsA2ILiJ:MHOxZysE+V9DV9iJ

Score

1^/10

Malware Config

Signatures

Files

ASRtool.exe
.exe windows:4 windows x64 arch:x64

Code Sign

33:00:00:02:3a:8c:c6:3d:d4:71:a1:71:24:00:00:00:00:02:3a
Certificate

Issuer

CN=Microsoft Testing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/06/2017, 17:41

Not After

15/09/2018, 17:41

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:11:84:6f:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Testing Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/07/2010, 21:23

Not After

01/07/2025, 21:33

Subject

CN=Microsoft Testing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c0:b7:ea:81:cd:a1:76:f4:26:66:c8:05:7d:56:d4:9f:72:8b:f2:73:e0:59:4e:5b:20:2d:76:9e:ab:f9:d4:3b
Signer

Actual PE Digest

c0:b7:ea:81:cd:a1:76:f4:26:66:c8:05:7d:56:d4:9f:72:8b:f2:73:e0:59:4e:5b:20:2d:76:9e:ab:f9:d4:3b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\os\obj\amd64fre\amcore\antimalware\source\test\tools\testhips\objfre\amd64\AntiMalware.Tools.DemoExploitGuard.pdb

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:02:3a:8c:c6:3d:d4:71:a1:71:24:00:00:00:00:02:3aCertificate

Extended Key Usages

Key Usages

61:11:84:6f:00:00:00:00:00:03Certificate

Key Usages

c0:b7:ea:81:cd:a1:76:f4:26:66:c8:05:7d:56:d4:9f:72:8b:f2:73:e0:59:4e:5b:20:2d:76:9e:ab:f9:d4:3bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rsrc Size: 2KB - Virtual size: 2KB

33:00:00:02:3a:8c:c6:3d:d4:71:a1:71:24:00:00:00:00:02:3a
Certificate

61:11:84:6f:00:00:00:00:00:03
Certificate

c0:b7:ea:81:cd:a1:76:f4:26:66:c8:05:7d:56:d4:9f:72:8b:f2:73:e0:59:4e:5b:20:2d:76:9e:ab:f9:d4:3b
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rsrc
Size: 2KB - Virtual size: 2KB