file[.]exe | Triage™

file.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693
MD5 7adfc6a2e7a5daa59d291b6e434a59f3
SHA1 e21ef8be7b78912bed36121404270e5597a3fe25
SHA512 30f56bd75fe83e8fb60a816c1a0322bc686863d7ab17a763fff977a88f5582c356b4fcfe7c0c9e3e5925bfee7fc44e4ea8b96f82a011ed5e7cd236253187181b
SSDEEP 24576:RvqqvYZAFnc7EtexlphsFHMQSuRoEPmXG1YO:8qvOA1jexlDsoAmXKYO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

27:da:21:5c:19:04:59:7c:bb:db:c0:9d:7f:a9:90:af:dc:5f:4a:83:82:5d:12:f4:da:24:e7:90:c2:58:34:be

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=912 309 975,CN=Vivaldi Technologies AS,O=Vivaldi Technologies AS,STREET=Mølleparken 6,L=Oslo,ST=Oslo,C=NO,1.3.6.1.4.1.311.60.2.1.3=#13024e4f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 17, 2024

SERIALNUMBER=912 309 975,CN=Vivaldi Technologies AS,O=Vivaldi Technologies AS,STREET=Mølleparken 6,L=Oslo,ST=Oslo,C=NO,1.3.6.1.4.1.311.60.2.1.3=#13024e4f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=912 309 975,CN=Vivaldi Technologies AS,O=Vivaldi Technologies AS,STREET=Mølleparken 6,L=Oslo,ST=Oslo,C=NO,1.3.6.1.4.1.311.60.2.1.3=#13024e4f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0e:61:94:e2:77:9d:53:1f:89:69:50:ff

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2023 - Dec 18, 2026

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/Continue

SHA256 a8181f349864c6c9a216935894392b75d0d1430d43a255ff3a9ad56c325487e7
MD5 6184a8fc79d602bc18c0badb08598580
SHA1 de3a273e7020d43729044e41272c301118cc3641
SHA512 41687b30ecd957eb1b6d332133f1c1d7e01cc1c8bf56526dfa20de3937ed549133e93872380e3b51b63b33134c62d4df91c7e08e908ca18b3e6f9d52e89378cb
SSDEEP 768:vzso+XZDvXwh7WaHnsAdKppiQljFTU6cOHd3:LsFBXc7WaMYQpiQljRN
MD5 SHA1 SHA512 SSDEEP

$TEMP/Speak

SHA256 93ddbcd9109129656049162e3f6a8d9fffdc5a3da262e0a2bf2bc4624014f7b0
MD5 0e16cafd2403c552149e325d90637d12
SHA1 efe1e6af41751ca9978c3a21c82ef135a8846f21
SHA512 0251de7abb9a4457cf16dab0b1e88d0897c5b6655cdf27b9c298c1796925ea2514cd2f065106eccd56b97a6804e84f459806d528837bf9718c7c9e525f7159ec
SSDEEP 1536:dv/iE+BO9feoh41Cm6o2QdecHYN/TVXbC:dHi9BOEs41JN2QdtHYFFbC
MD5 SHA1 SHA512 SSDEEP

WorkerIx/Continues

SHA256 e04a1b86ce1a5352f7c3a5ddb8b500993f4342ef4e188ed156009e5271795af1
MD5 2226738a67da04cef580c99f70b9a514
SHA1 48bbfbfdce94231ebc1833b87ff6e79aa716e3b4
SHA512 c653aafd3aa2d320eef1d5b9cf9e58372e778c41147c3d85bcb6e231c8703d19f410ebb2f58f2a9f0671f027fce2baeeec70252e926bb9880128ba6dcedfdb08
SSDEEP 384:eVBYHob1k4dljIDMob5chIukwWXVU9/b16+atFkjPom:eR1k4HjIJa1OVa/b16+atAPom
MD5 SHA1 SHA512 SSDEEP

WorkerIx/Corresponding

SHA256 fa349d460b066e9b325db200251ae35892353462c352728cfb0fa405c293f725
MD5 7eb7312237cf8653a876136046ce8b3e
SHA1 250d61e72b9a6d0d436e04b569459bb69bb2ab9e
SHA512 778fbbec7cd5c9d2aa3623f73604fd7a6e98d3673b50ab7e8ac54c8aa3d955c103d7cdc0838e00f256ade000c979860bf54d3d2b36dd3dcd4fe8fca9f1c82699
SSDEEP 12288:/pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:/T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

WorkerIx/Dietary

SHA256 6d86469ced96b57db84de11f9eac77c8076a3bfa65942776f7cc50625fbd31ca
MD5 30a3ed3849e36b4c26a02cf030ea985a
SHA1 d3d29d3ba2c033d0abb6105cd274001e65d07f4e
SHA512 158aabac6f79393a2a7faed30693f78191bf97771a6125229873abedceef71d5df7d5bb934fdfa1ff4c683df49a158e5ba3efea9a4dd10dce8ba24b3c4fc507d
SSDEEP 1536:W2Kcm/aSE8g+5pcwQJiCDvjkiEk1T7bmZCsbfRRzozVFb9/wHBxMJxCFF:W2w/u6AwQ9vjFjTvsCsbfRRozHgxMaFF
MD5 SHA1 SHA512 SSDEEP

WorkerIx/Minister

SHA256 526b6cbf430fc40eb8d23cd2c4ee1c81e04a2c9e01167370527f19465f67c452
MD5 97dd60ac57e3f1873f3120688d47cd3d
SHA1 e8941900dac0dd9b9ac4b7a08d3ace40c3cc9736
SHA512 831eb3f1bd352173db735e4f5e2a4c9380006e3146ecd466b415d7ef7e2c0a345b4da0ebc0415043a9599859e2fb2a131e8d3fc5012d1ccc7473b0ebd4fd076a
SSDEEP 3072:brklr7dwYrsHKN3Il8do2mvAY6N3eUXBcbF2n23:bm7+KsYIl8do9FYhxcbF223
MD5 SHA1 SHA512 SSDEEP

WorkerIx/Mobile

SHA256 08e8e54417a8e7007aeedb0399f4e549fc31aaf6031416c8d30306fe350c1f84
MD5 b81b3a6c6725be1cdd528e5fb3a9aa07
SHA1 069d5fd30b48bf5345d21c2af0106325e9372c8f
SHA512 7a04ee23c0b3d832fa518390253c0153829e7ab0907209dc67c5eae687ad648ab18aa7d064e544c1da3b03cc610ed10fe63a73fc5aaa129402a561843aa975e2
SSDEEP 1536:tkUl1VfagFJ8VOATq22GEpmMb0mMDKzSUW+F/scfV5Uq/FypYOaJT:tkUlfagFJcOATl2bbCDKzTWMzUCwpzG
MD5 SHA1 SHA512 SSDEEP

WorkerIx/Mr

SHA256 5defb1b1225282e2ab46d4257416334b5344e5b0a020b4b7900436c59684de65
MD5 0c3f23378f256b116fca366d08dbd146
SHA1 c6c92667dea09b7a4b2b00193ee043278854db1e
SHA512 0db03b484ce0849bd005ec962e69fea3f8b728739e622ad57519e9411d5257026938b9eb8db050bb355a624f34b19bfe0e0fb8af888bab99d4febb5ec89381f3
SSDEEP 1536:CzYfX1FH8AhbqeIKIwpZOaIitfopTBXUZDJBL7EmQyi/:MYflx8Ah0AkdTEZDJl+y+
MD5 SHA1 SHA512 SSDEEP

WorkerIx/Sonic

SHA256 fc6ba37a8bfe546d8186e92c2f729080b00d4371ef2e8e3a18ec66acc1cf199e
MD5 1b5bba21607d9a9c3293ff564ecf4f1a
SHA1 de790d57fbfae12e649bf65fd9695e36a266696a
SHA512 b9e23dd79986397c9fe5c1ac150c60c8993f89488645f06e0865abb2491dc3b9949867753d76cab34352445459601c339a6f78ff8b48323951638f9666d6a74a
MD5 SHA1 SHA512

WorkerIx/Template

SHA256 4734d4d0626e140398a788226a5985e814bbd674f4218b60a89fd2da8f4ceb94
MD5 0e70f873cb8f5615dd364325b714895a
SHA1 089a8f5d7d90e7eedd6d02e30aa458440c89d7a7
SHA512 867dbac35991b2222f5fb4f5fc6dca4640b386356dff12322fdc06bb05b8af7c438e15f9fc6b4d4cedc27f081480d4187c1b4007831d9a052c3beda8d3c56ac4
SSDEEP 768:tgPLJcZKaNZ6vBI1RggHmYLsbPsbrdPmOHv7J3LjgmvtCXK76MPraSv6KeJeQiKb:tgPLGZJNZhnmY9rdlzJD8Zm7Qi8M6UG
MD5 SHA1 SHA512 SSDEEP

WorkerIx/Zinc

SHA256 dc4aac8b9eb62788bd04316293cde7e3d839e828e3e3082a2d81922ca8a94c81
MD5 51143491656ae2ee983d709c45a41861
SHA1 1cf8eb8d13246195cfc6168524d212c9a65b4681
SHA512 239f2903b3b5177b32971ae3eb3eab2cc4c3d7856a3839f184c7f59b7e3cd53de4dac3363519e82acd183e564ae688dc8a7e5097c1283699714584ee13bed67d
SSDEEP 1536:pN68Jyg4Hxj+nYKff0E5cjEYsiYFCpw/ej4j93rtJl+:ykyTHxjsYpE50EYsnuyekrtJ8
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$TEMP/Continue

$TEMP/Speak

WorkerIx/Continues

WorkerIx/Corresponding

WorkerIx/Dietary

WorkerIx/Minister

WorkerIx/Mobile

WorkerIx/Mr

WorkerIx/Sonic

WorkerIx/Template

WorkerIx/Zinc