hwid[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

hwid.exe
Size

2.2MB
MD5

55ba1c985f2b0393c86d043960d8c5a0
SHA1

3abec7f9ea28e6563d60defc672da13b5d6e8192
SHA256

f4f27716416e99523a7f18786d5035bf50052b76444c9e769a34acd152318533
SHA512

28b8eb1e5929652cb54e3cbc30bd33b85639047b30b4bf99fcb5180e12f7268223bddfaed46898453199aa119067036621ff32fac9b43aa950f2e5359d8707a4
SSDEEP

49152:bNJCFJXsq8AQLZY7seDNKTtBfqz8pLP1Z+tbPmuAjW2NqjeDf/0hfJ:vCFJXsqTNDIBi8pL/+NUjZqCb/0j

Score

1^/10

Malware Config

Signatures

Files

hwid.exe
.exe windows:6 windows x64 arch:x64

2eabe9054cad5152567f0699947a2c5b

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2031 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:e9:cf:f9:3a:fb:c9:3d:cc:6d:80:6e:3c:44:8e:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-11-2016 00:00

Not After

02-02-2018 12:00

Subject

CN=Manthe Industries\, LLC,O=Manthe Industries\, LLC,L=Appleton,ST=Wisconsin,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

70:12:40:5c:f9:9a:1e:59:68:72:c9:0c:07:c8:63:ae:9d:5d:78:be
Signer

Actual PE Digest

70:12:40:5c:f9:9a:1e:59:68:72:c9:0c:07:c8:63:ae:9d:5d:78:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrcpy

Sections

Size: 111KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bbnxemju
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ufxmuink
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2eabe9054cad5152567f0699947a2c5b

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0d:e9:cf:f9:3a:fb:c9:3d:cc:6d:80:6e:3c:44:8e:9dCertificate

Extended Key Usages

Key Usages

70:12:40:5c:f9:9a:1e:59:68:72:c9:0c:07:c8:63:ae:9d:5d:78:beSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

Size: 111KB - Virtual size: 248KB

.rsrc Size: 512B - Virtual size: 480B

.idata Size: 512B - Virtual size: 4KB

Size: 512B - Virtual size: 3.8MB

bbnxemju Size: 2.1MB - Virtual size: 2.1MB

ufxmuink Size: 512B - Virtual size: 4KB

.pdata Size: 8KB - Virtual size: 8KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:e9:cf:f9:3a:fb:c9:3d:cc:6d:80:6e:3c:44:8e:9d
Certificate

70:12:40:5c:f9:9a:1e:59:68:72:c9:0c:07:c8:63:ae:9d:5d:78:be
Signer

.rsrc
Size: 512B - Virtual size: 480B

.idata
Size: 512B - Virtual size: 4KB

bbnxemju
Size: 2.1MB - Virtual size: 2.1MB

ufxmuink
Size: 512B - Virtual size: 4KB

.pdata
Size: 8KB - Virtual size: 8KB