egifan7[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

egifan7.exe
Size

23.1MB
MD5

b0a82f7a9aa62c3919fb5c0bfb47deeb
SHA1

f7aff3685134fd68893a6541e3f850ca7a398dd5
SHA256

42fcf328d1c4c8d00fabe339983efeab42fb5bae06a52c4583ab0df8573efdda
SHA512

e7f274318a88fdb5efe89c9918c835ca2ebef53fe6ce0d72f7c1bb50a4c180f484ead2350618f6d2b9ad2821b80b8874a3dab7a563f9bec54ed83a1ef37b7e2d
SSDEEP

393216:f/nir8+5ZtPL1ko9OqEV8KGaXnby6TdWM6M6evmovhDkxT1BrPAeGNqqd77pRMk8:Hnir8w/D13hY+aXuxZM6eOWkZLrPGNBO

Score

1^/10

Malware Config

Signatures

Files

egifan7.exe
.exe windows:1 windows x86 arch:x86

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18-11-2009 10:00

Not After

18-03-2019 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3f:85:d8:1f:b1:9e:50:6b:3a:e6:fc:64
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24-01-2017 17:23

Not After

24-04-2020 17:23

Subject

CN=Blumentals Solutions SIA,O=Blumentals Solutions SIA,L=Jurmala,ST=Rigas rajons,C=LV

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

13:b7:74:ee:59:e3:5e:c6:06:26:16:89
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

28-02-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 002-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:48:d3:17:4f:3e:a7:73:a3:15:fc:39:1e:e4:8d:e3:d1:fe:9f:19:b9:75:80:97:87:00:2d:d7:89:b4:cc:23
Signer

Actual PE Digest

11:48:d3:17:4f:3e:a7:73:a3:15:fc:39:1e:e4:8d:e3:d1:fe:9f:19:b9:75:80:97:87:00:2d:d7:89:b4:cc:23

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

04:00:00:00:00:01:25:07:1d:f9:afCertificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

3f:85:d8:1f:b1:9e:50:6b:3a:e6:fc:64Certificate

Extended Key Usages

Key Usages

13:b7:74:ee:59:e3:5e:c6:06:26:16:89Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

11:48:d3:17:4f:3e:a7:73:a3:15:fc:39:1e:e4:8d:e3:d1:fe:9f:19:b9:75:80:97:87:00:2d:d7:89:b4:cc:23Signer

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 40KB - Virtual size: 40KB

DATA Size: 1024B - Virtual size: 592B

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 11KB - Virtual size: 11KB

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

3f:85:d8:1f:b1:9e:50:6b:3a:e6:fc:64
Certificate

13:b7:74:ee:59:e3:5e:c6:06:26:16:89
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

11:48:d3:17:4f:3e:a7:73:a3:15:fc:39:1e:e4:8d:e3:d1:fe:9f:19:b9:75:80:97:87:00:2d:d7:89:b4:cc:23
Signer

CODE
Size: 40KB - Virtual size: 40KB

DATA
Size: 1024B - Virtual size: 592B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 11KB - Virtual size: 11KB