GitHubDesktopSetup-x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
GitHubDesktopSetup-x64.exe
Size 159.7MB
Sample240831-ajdn3athqd
SHA256 0b8fe4bbd5f8abbd4a21e70e9d6cca9aecba7d8833cc2385d95538709789eefd
MD5 fe89096a5931a7fb9af6da752a2adde6
SHA1 37afa4a1019157c931395074e575868eeb0b9140
SHA512 edae85e73e8160503f3c118402f7afb7d59b0abe5c484fed2ae9498c7e0c7b262ac389b038cd02822ef7c3a5ad1c84690963a69995f086909a9e780adc97db1c
SSDEEP 3145728:kqZrr8lXnOTp8kH0Gk23xeWn54sRZmhBbuhu3SVZkvRUcm8Q+f:kA23a8kHM8I05h+3xCkqD8Z
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

GitHubDesktopSetup-x64.exe

.exe 159.7MB

GitHubDesktopSetup-x64.exe

IMPHASH e6f4169f2a5c3a8f93171d9f593bd22a
SHA256 0b8fe4bbd5f8abbd4a21e70e9d6cca9aecba7d8833cc2385d95538709789eefd
MD5 fe89096a5931a7fb9af6da752a2adde6
SHA1 37afa4a1019157c931395074e575868eeb0b9140
SHA512 edae85e73e8160503f3c118402f7afb7d59b0abe5c484fed2ae9498c7e0c7b262ac389b038cd02822ef7c3a5ad1c84690963a69995f086909a9e780adc97db1c
SSDEEP 3145728:kqZrr8lXnOTp8kH0Gk23xeWn54sRZmhBbuhu3SVZkvRUcm8Q+f:kA23a8kHM8I05h+3xCkqD8Z
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

5f:9d:db:c9:b4:44:5a:5e:44:fb:ad:84:2e:d3:00:98:61:70:07:15:b3:57:3e:fc:89:2b:99:8e:3f:57:4b:e4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=GitHub\, Inc.,O=GitHub\, Inc.,L=San Francisco,ST=California,C=US

Chains

Jul 31, 2024

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=GitHub\, Inc.,O=GitHub\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

33:00:01:47:e8:e0:af:d7:e9:21:28:0b:dd:00:00:00:01:47:e8

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 31, 2024 - Aug 3, 2024

Subject

CN=GitHub\, Inc.,O=GitHub\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

33:00:01:47:e8:e0:af:d7:e9:21:28:0b:dd:00:00:00:01:47:e8

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 31, 2024 - Aug 3, 2024

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:3c:7f:1b:a0:ca:00:37:45:b9:00:00:00:00:00:3c

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 15, 2024 - Feb 15, 2025

Minor OS version

Major OS version

Entry point

43868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\Setup.pdb

kernel32

LoadResource FindResourceW lstrlenW GetProcAddress GetModuleHandleW DeleteCriticalSection GetTempPathW GetLastError GetTempFileNameW MoveFileW WaitForSingleObject GetExitCodeProcess CloseHandle DeleteFileW GetModuleFileNameW GetCurrentProcess LoadLibraryW FreeLibrary InitializeCriticalSectionEx GetFileAttributesW CreateFileW SetFilePointer ReadFile VerSetConditionMask GetCurrentDirectoryW MultiByteToWideChar LocalFileTimeToFileTime WideCharToMultiByte CreateDirectoryW WriteFile SetFileTime FreeResource SizeofResource LockResource CreateProcessW GetSystemDirectoryW SetDefaultDllDirectories GetCurrentThreadId DecodePointer RaiseException LeaveCriticalSection EnterCriticalSection lstrcmpiW LoadLibraryExW GetConsoleMode GetConsoleCP SystemTimeToFileTime VerifyVersionInfoW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA IsDebuggerPresent OutputDebugStringW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW HeapSize HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW GetFileSizeEx SetFilePointerEx FlushFileBuffers WriteConsoleW

shlwapi

PathIsUNCW

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

GitHubDesktopSetup-x64.exe

PE Signature issue

kernel32

shlwapi

comctl32

generic