out_sig[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

out_sig.exe
Size

26.1MB
MD5

f55cea2ada1ffc5f739da81b06ba021a
SHA1

0a6414e20a47d65c3b5a073386bacaddfa5adc23
SHA256

eb014b245950c6186e87448dc63ef843f6c10448c4927e6f4bbe6c976eb5b99c
SHA512

b0e89363580ee248563b7ea1a82934a83c79606ccd29249d13920783065a1b020668cd00edebe3588240a07cf16743a5674ba714bf27fea472a4a368fbaf630a
SSDEEP

393216:Ix0SSzZZLuSrkz++lUEqe3J03HTzJ5CBcGQFECgHPvXPmtQvLYWxM2X2zjYm:IxwzZ9uBqO/4um36Xmuv8KM2XQYm

Score

1^/10

Malware Config

Signatures

Files

out_sig.exe
.exe windows:5 windows x86 arch:x86

1350ad791ddc569501fdbb0321b4e76d

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2013 12:00

Not After

15-01-2038 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a5:04:0a:21:3a:d7:1f:5c:b8:ce:64:67:d9:47:04
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22-01-2024 00:00

Not After

21-01-2027 23:59

Subject

SERIALNUMBER=199911710082,CN=FinePrint Software\, LLC,O=FinePrint Software\, LLC,L=Menlo Park,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:5c:51:48:01:cd:d5:ae:88:52:49:0f:31:68:20:5f:eb:35:a4:5b:2b:8b:10:32:77:b0:74:3c:05:01:45:d7
Signer

Actual PE Digest

79:5c:51:48:01:cd:d5:ae:88:52:49:0f:31:68:20:5f:eb:35:a4:5b:2b:8b:10:32:77:b0:74:3c:05:01:45:d7

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

cabinet

ord22
ord23
ord20

gdi32

GetTextExtentPointW
SetTextColor
GetObjectW
DeleteDC
ScaleWindowExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
SetMapMode
GetClipBox
CreateBitmap
CreateFontIndirectW
DeleteObject
Escape
GetStockObject
GetTextExtentPoint32W
TranslateCharsetInfo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectObject
SetBkColor
GetTextMetricsW
TextOutW
ExtTextOutW
GdiFlush
GetDeviceCaps

rpcrt4

UuidToStringA
RpcStringFreeW
RpcStringFreeA
UuidToStringW
UuidCreate

shlwapi

PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathFindExtensionW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

kernel32

GlobalHandle
LocalAlloc
LocalFree
MulDiv
GetProfileStringW
VerifyVersionInfoW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoW
IsDBCSLeadByteEx
ExpandEnvironmentStringsW
SetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FileTimeToLocalFileTime
FindClose
GetDriveTypeW
GetFullPathNameW
GetTempFileNameW
GetTempPathW
IsDebuggerPresent
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcessId
TerminateProcess
FlushInstructionCache
GetSystemTimeAsFileTime
GetSystemDirectoryW
VirtualAllocEx
WriteProcessMemory
CreateFileMappingW
MapViewOfFile
VirtualFreeEx
UnmapViewOfFile
GetModuleFileNameW
GetUserDefaultUILanguage
FormatMessageW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetTimeZoneInformation
LocalFileTimeToFileTime
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DosDateTimeToFileTime
WaitForSingleObject
GetCurrentProcess
GetCurrentThread
GetModuleHandleW
GetProcAddress
GlobalAlloc
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalFree
VerSetConditionMask
GetCommandLineW
GetCurrentDirectoryW
CreateFileW
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFileSize
GetLogicalDriveStringsW
GetLongPathNameW
QueryDosDeviceW
ReadFile
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointer
SetFileTime
WriteFile
SetLastError
InitializeCriticalSection
LoadLibraryW
SetEvent
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
GetConsoleOutputCP
GetConsoleMode
GetStringTypeW
LCMapStringW
GetFileType
GetStdHandle
ExitProcess
HeapQueryInformation
GetCommandLineA
GetModuleHandleExW
MoveFileExW
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetErrorMode
GetSystemDefaultUILanguage
GlobalFlags
GetVolumeInformationW
FlushFileBuffers
GetFileAttributesExW
GetTickCount64
GetPrivateProfileIntW
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryA
EncodePointer
LocalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
lstrcmpA
OutputDebugStringA
GetACP
SleepEx
CreateEventW
GetCurrentThreadId
CreateProcessW
DecodePointer
GetLastError
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
EnterCriticalSection
GetSystemInfo
GetLocalTime
GetVersion
GetTickCount
GetVersionExW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FreeLibrary
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetModuleHandleA
CloseHandle

user32

CharLowerBuffA
CharLowerBuffW
SetFocus
GetCapture
MsgWaitForMultipleObjects
SetTimer
KillTimer
EnableWindow
IsWindowEnabled
GetSystemMetrics
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
UpdateWindow
RegisterClipboardFormatW
RegisterClipboardFormatA
GetDC
ReleaseDC
PostThreadMessageW
RealChildWindowFromPoint
DestroyMenu
GetMessageW
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
WinHelpW
LoadIconW
GetTopWindow
MapWindowPoints
GetScrollPos
SetActiveWindow
GetMenu
IsIconic
IsWindowVisible
EndDeferWindowPos
BeginDeferWindowPos
DestroyWindow
IsChild
IsMenu
GetClassInfoExW
GetClassInfoW
GetMessageTime
GetMessagePos
IsDialogMessageW
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
EndPaint
BeginPaint
GetSubMenu
SetRectEmpty
SendDlgItemMessageA
InvalidateRect
SetWindowTextW
GetWindowTextLengthW
GetClientRect
GetWindowRect
MessageBoxW
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
GetSysColor
CopyRect
LoadImageW
ValidateRect
SetForegroundWindow
GetForegroundWindow
RegisterClassW
OffsetRect
IsRectEmpty
PtInRect
GetWindowLongW
GetParent
EnumChildWindows
CloseClipboard
GetDlgCtrlID
GetDlgItem
IsWindow
EnumThreadWindows
GetClassNameW
GetWindowThreadProcessId
GetWindow
LoadCursorW
DestroyIcon
MonitorFromWindow
GetMonitorInfoW
GetLastActivePopup
AdjustWindowRectEx
GetMenuItemID
GetFocus
CharUpperA
PostMessageW
SendMessageW
PeekMessageW
UnregisterClassW
SetMenu
DeferWindowPos
SetWindowPos
CreateWindowExW
RegisterWindowMessageW
LoadStringW
SystemParametersInfoW
MapDialogRect
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetDesktopWindow
GetClassLongW
SetWindowLongW
GetSysColorBrush
GetWindowTextW
RemovePropW
GetPropW
SetPropW
RedrawWindow
SetMenuItemInfoW
GetMenuItemCount
GetKeyState
CharUpperW
IsZoomed
ShowWindow
CallWindowProcW
PostQuitMessage
DefWindowProcW
DispatchMessageW
TranslateMessage

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

OpenProcessToken
AllocateAndInitializeSid
RegQueryValueW
RegEnumKeyW
CopySid
EqualSid
FreeSid
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
SetSecurityDescriptorOwner
GetLengthSid
InitializeSecurityDescriptor
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenThreadToken
RegQueryValueExW
RegOpenKeyW
RegCloseKey
IsValidSid

shell32

ShellExecuteW
SHParseDisplayName
SHOpenFolderAndSelectItems

ole32

CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoCreateGuid
CoUninitialize
CoInitializeSecurity
CoInitialize
CoCreateInstance
CoTaskMemFree

oleaut32

VariantInit
VariantChangeType
VariantClear
SysAllocString
SysFreeString

comctl32

ord17
InitCommonControlsEx

uxtheme

IsThemeDialogTextureEnabled
EnableThemeDialogTexture

oledlg

OleUIBusyW

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

.text
Size: 390KB - Virtual size: 392KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 157KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25.5MB - Virtual size: 25.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1350ad791ddc569501fdbb0321b4e76d

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0e:a5:04:0a:21:3a:d7:1f:5c:b8:ce:64:67:d9:47:04Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

79:5c:51:48:01:cd:d5:ae:88:52:49:0f:31:68:20:5f:eb:35:a4:5b:2b:8b:10:32:77:b0:74:3c:05:01:45:d7Signer

Headers

DLL Characteristics

File Characteristics

Imports

cabinet

gdi32

rpcrt4

shlwapi

wtsapi32

kernel32

user32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

uxtheme

oledlg

oleacc

Sections

.text Size: 390KB - Virtual size: 392KB

.rdata Size: 157KB - Virtual size: 160KB

.data Size: 8KB - Virtual size: 28KB

.rsrc Size: 25.5MB - Virtual size: 25.5MB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0e:a5:04:0a:21:3a:d7:1f:5c:b8:ce:64:67:d9:47:04
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

79:5c:51:48:01:cd:d5:ae:88:52:49:0f:31:68:20:5f:eb:35:a4:5b:2b:8b:10:32:77:b0:74:3c:05:01:45:d7
Signer

.text
Size: 390KB - Virtual size: 392KB

.rdata
Size: 157KB - Virtual size: 160KB

.data
Size: 8KB - Virtual size: 28KB

.rsrc
Size: 25.5MB - Virtual size: 25.5MB