fghj[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

fghj.exe
Size

3.1MB
MD5

549e550f48b48de65c69c4e87bffaa00
SHA1

ff5914ba3411ba52049f9cec0b7c5267d2f7015a
SHA256

b4129afa37522ee77ca932eb2f29c16df3ad47dc6cc52864ef488fbb537296e2
SHA512

de2a949ae9ce6f6b80cccea0ae0b7ebd997df54cfc697285c52220ee42d7294d8b9202bc7edece9241b8b6bf7215365608bc704d2cfe636dd528eb2d03320586
SSDEEP

98304:R5tGWuHhHh+oGqWy9zLyj3y5Jmpb3wUgzE:R5UWAhlGqpJyjxpbAUgw

Score

1^/10

Malware Config

Signatures

Files

fghj.exe
.exe windows:5 windows x86 arch:x86

2bdb3f8e4a236153c327872fbf3556d1

Code Sign

37:74:43:4f:9e:b4:0e:22:1f:92:36:ca:1f:2f:27:17
Certificate

Issuer

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA EV E36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cb
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28-02-2023 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:bb:55:d5:d6:3e:8e:7a:2c:38:8e:74:ee:af:ed:c5
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV E36,O=Sectigo Limited,C=GB

Not Before

05-09-2024 00:00

Not After

05-09-2027 23:59

Subject

SERIALNUMBER=30191723,CN=High-Logic B.V.,O=High-Logic B.V.,ST=Utrecht,C=NL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e4c

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15-01-2024 00:00

Not After

14-04-2035 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22-03-2021 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

98:af:05:81:75:22:7d:c1:3c:36:3c:9a:e9:41:9f:c7:03:ab:37:52:0f:2d:4f:b0:c5:d2:02:d0:2d:4e:e9:1d
Signer

Actual PE Digest

98:af:05:81:75:22:7d:c1:3c:36:3c:9a:e9:41:9f:c7:03:ab:37:52:0f:2d:4f:b0:c5:d2:02:d0:2d:4e:e9:1d

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Morpheme.pdb

Imports

kernel32

GetLastError
CreateMutexW
CloseHandle
ExitProcess
GetEnvironmentVariableW
LocalFree
LocalAlloc
GetCurrentProcess
GetVersionExA
SetThreadLocale
GetCommandLineW
GetModuleHandleW
HeapAlloc
GetProcessHeap
HeapFree
ReleaseMutex
WaitForSingleObject
QueueUserAPC
SetWaitableTimer
ExitThread
CreateWaitableTimerW
CreateThread
FindResourceW
CreateDirectoryW
ReadFile
GetFileSize
CreateFileW
WriteFile
GetTempFileNameW
GetTempPathW
RemoveDirectoryW
DeleteFileW
FreeLibrary
FreeResource
LockResource
SizeofResource
LoadResource
LoadLibraryW
SetFilePointer
GetProcAddress
GetSystemDirectoryW
GetSystemTime
FindResourceA
OutputDebugStringW
LoadLibraryA
GetThreadLocale
InterlockedExchange
RaiseException

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 327KB - Virtual size: 327KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2bdb3f8e4a236153c327872fbf3556d1

Code Sign

37:74:43:4f:9e:b4:0e:22:1f:92:36:ca:1f:2f:27:17Certificate

Extended Key Usages

Key Usages

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cbCertificate

Extended Key Usages

Key Usages

b4:bb:55:d5:d6:3e:8e:7a:2c:38:8e:74:ee:af:ed:c5Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

98:af:05:81:75:22:7d:c1:3c:36:3c:9a:e9:41:9f:c7:03:ab:37:52:0f:2d:4f:b0:c5:d2:02:d0:2d:4e:e9:1dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 284B

.rsrc Size: 2.7MB - Virtual size: 2.7MB

.reloc Size: 327KB - Virtual size: 327KB

37:74:43:4f:9e:b4:0e:22:1f:92:36:ca:1f:2f:27:17
Certificate

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cb
Certificate

b4:bb:55:d5:d6:3e:8e:7a:2c:38:8e:74:ee:af:ed:c5
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

98:af:05:81:75:22:7d:c1:3c:36:3c:9a:e9:41:9f:c7:03:ab:37:52:0f:2d:4f:b0:c5:d2:02:d0:2d:4e:e9:1d
Signer

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 284B

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

.reloc
Size: 327KB - Virtual size: 327KB