file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

4.4MB
MD5

4adb74fd4d58de543257f6e25e79d5a6
SHA1

63c48229bb7fc465c50380dbc27157c5bfc0068a
SHA256

67993101b0b440ef8c311532647870c8b6f691a539473fc5455259bd94869665
SHA512

30ccd37a179338f85e02ff6210d0ec117b7ad95ec76da8d8eb447648ce3f9ef6b16972652dee3500ed20d7a9b8fe4f77f348ad1d551b2e860036ba88c812ffc3
SSDEEP

98304:5M3qqXlj1sOu5cxpbKUhGmJWGoedU+nPmT3xdSbEOdGPnUo+hWlYxpUfuSEZM5hF:50lj1sOu5cxT7dU+nOT3OgZ/Uo+klYxe

Score

1^/10

Malware Config

Signatures

Files

file.exe
.exe windows:6 windows x86 arch:x86

Password: 12121122

7aa7529d445be8a373d6ef8f33a7bdcb

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:e2:e6:a8:d1:b3:7e:be:6a:d0:f3:2a:52:84:85:91
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

03/10/2023, 00:00

Not After

02/10/2024, 23:59

Subject

CN=Hercules Consulting LLC,O=Hercules Consulting LLC,ST=Wyoming,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:28:8b:a5:72:d4:dc:55:23:35:24:a7:5a:2b:ca:39:3c:04:29:4b:50:07:bc:1e:09:4e:31:37:f2:e8:90:28
Signer

Actual PE Digest

68:28:8b:a5:72:d4:dc:55:23:35:24:a7:5a:2b:ca:39:3c:04:29:4b:50:07:bc:1e:09:4e:31:37:f2:e8:90:28

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
HeapFree
GetStdHandle
FileTimeToLocalFileTime
GetExitCodeThread
InitializeCriticalSectionEx
LCMapStringW
GetLogicalDriveStringsA
GetCurrentProcessId
SetFileAttributesA
QueryPerformanceCounter
DeleteCriticalSection
LoadLibraryW
DeleteFileW
FreeLibraryAndExitThread
GetStringTypeW
GetCurrentThreadId
TlsGetValue
FileTimeToSystemTime
TlsFree
RemoveDirectoryA
InitializeSListHead
HeapSize
LeaveCriticalSection
LoadLibraryA
CreateEventA
GetTickCount
GetCPInfo
WaitForSingleObject
WaitForSingleObjectEx
GlobalUnlock
AreFileApisANSI
SetEvent
GlobalAlloc
SetEndOfFile
GetCurrentDirectoryW
SetFileAttributesW
SetFilePointer
FindNextFileW
VirtualFree
SetFilePointerEx
InitializeCriticalSectionAndSpinCount
WriteFile
LoadLibraryExW
CompareFileTime
FormatMessageA
GetSystemTimeAsFileTime
MoveFileExW
RtlUnwind
SetFileTime
GetProcAddress
GetStartupInfoW
ResetEvent
GetModuleFileNameW
MultiByteToWideChar
GetProcessAffinityMask
FindNextFileA
CreateFileA
FreeLibrary
GetLastError
GetTickCount64
GetTempFileNameW
MoveFileA
CreateDirectoryW
SetPriorityClass
GetModuleHandleA
InitializeCriticalSection
FindFirstFileW
FindFirstFileExA
GetFileAttributesW
GetEnvironmentStringsW
TerminateProcess
IsDebuggerPresent
FlushFileBuffers
ReadFile
QueryPerformanceFrequency
EnterCriticalSection
ReleaseSemaphore
GetFileType
TlsAlloc
WriteConsoleW
GetSystemDirectoryW
RaiseException
IsProcessorFeaturePresent
GlobalFree
WaitForMultipleObjects
RemoveDirectoryW
GetConsoleMode
SetStdHandle
GetModuleHandleW
GlobalMemoryStatus
DecodePointer
HeapAlloc
CreateThread
TlsSetValue
GetModuleHandleExW
GetFileInformationByHandle
FreeEnvironmentStringsW
MoveFileW
GetOEMCP
GetFileAttributesA
CreateSemaphoreA
ExitProcess
GetSystemInfo
Sleep
GetCommandLineW
CreateDirectoryA
LocalFree
HeapReAlloc
GetVersionExA
SetUnhandledExceptionFilter
GetLogicalDriveStringsW
FindFirstFileA
WideCharToMultiByte
GetACP
DeleteFileA
IsValidCodePage
CreateFileW
GetProcessHeap
GetFileSize
UnhandledExceptionFilter
GlobalLock
GetConsoleCP
VirtualAlloc
GetCurrentDirectoryA
IsBadReadPtr
GetCommandLineA
GetModuleFileNameA
FindClose
SetLastError
ExitThread
FormatMessageW
EncodePointer
CloseHandle
GetVersion

user32

MoveWindow
MapDialogRect
ShowWindow
SetWindowTextA
GetWindowRect
EmptyClipboard
LoadStringW
GetMonitorInfoA
EnableWindow
SetCursor
LoadIconA
MessageBoxW
GetWindowTextA
LoadStringA
SendMessageW
SetTimer
SendMessageA
CloseClipboard
GetFocus
ScreenToClient
GetDlgItem
CharUpperW
PostMessageA
SetFocus
InvalidateRect
DialogBoxParamW
LoadCursorA
SetClipboardData
IsDlgButtonChecked
SetWindowTextW
GetWindowTextW
OpenClipboard
CheckDlgButton
GetParent
SetWindowLongA
EndDialog
GetKeyState
DialogBoxParamA
GetWindowTextLengthA
GetWindowTextLengthW
SystemParametersInfoA
MonitorFromWindow
GetWindowLongA
CharUpperA
KillTimer

shell32

SHGetFileInfoA
SHBrowseForFolderA
SHGetPathFromIDListA

ole32

CoCreateInstance
CoInitialize
CoUninitialize
OleInitialize
CoTaskMemFree

oleaut32

VariantClear
SysAllocStringLen
SysAllocString
SysStringLen
SysFreeString

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 571KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 12121122

7aa7529d445be8a373d6ef8f33a7bdcb

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

c8:e2:e6:a8:d1:b3:7e:be:6a:d0:f3:2a:52:84:85:91Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

68:28:8b:a5:72:d4:dc:55:23:35:24:a7:5a:2b:ca:39:3c:04:29:4b:50:07:bc:1e:09:4e:31:37:f2:e8:90:28Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 96KB - Virtual size: 96KB

.data Size: 571KB - Virtual size: 596KB

.rsrc Size: 10KB - Virtual size: 9KB

.reloc Size: 25KB - Virtual size: 24KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

c8:e2:e6:a8:d1:b3:7e:be:6a:d0:f3:2a:52:84:85:91
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

68:28:8b:a5:72:d4:dc:55:23:35:24:a7:5a:2b:ca:39:3c:04:29:4b:50:07:bc:1e:09:4e:31:37:f2:e8:90:28
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 96KB - Virtual size: 96KB

.data
Size: 571KB - Virtual size: 596KB

.rsrc
Size: 10KB - Virtual size: 9KB

.reloc
Size: 25KB - Virtual size: 24KB