1[.]exe | Triage™

General

Target
1.exe
Size 27.6MB
Sample250313-yml2ls1xcs
SHA256 585ab6c1cdaa65c9d08decf4e1ab1cf9327f00e18d13e85e338268ccc3587aab
MD5 8e6e0c5a5847177f1105a67f75a2d05e
SHA1 b47636a46a964595ef771df32f215693396af7ad
SHA512 9ddb9dcec05c4f0a49fdb581882fd88addbfc0710da257cdd5a6759ce6c89e30beaf978c266cd37d8aa1c651f33b8b62d01ddbfeb15acb1a148ee1185ea26d5d
SSDEEP 786432:7Fxb8yuOgTwJszi6kPgsZF2cpZd4yQjluNtQ+2drTgYee:7Fxb8yuOg0WRkBNpkxEU+2NgYee
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

1.exe

.exe 27.6MB

1.exe

IMPHASH 262f7b623746b414d0e9c48c1d61145e
SHA256 585ab6c1cdaa65c9d08decf4e1ab1cf9327f00e18d13e85e338268ccc3587aab
MD5 8e6e0c5a5847177f1105a67f75a2d05e
SHA1 b47636a46a964595ef771df32f215693396af7ad
SHA512 9ddb9dcec05c4f0a49fdb581882fd88addbfc0710da257cdd5a6759ce6c89e30beaf978c266cd37d8aa1c651f33b8b62d01ddbfeb15acb1a148ee1185ea26d5d
SSDEEP 786432:7Fxb8yuOgTwJszi6kPgsZF2cpZd4yQjluNtQ+2drTgYee:7Fxb8yuOg0WRkBNpkxEU+2NgYee
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

54:a5:02:24:e4:f5:01:2c:aa:0f:ec:31:06:62:78:b8:c3:d5:45:eb:8c:ed:de:f8:d8:02:e5:01:1c:8b:3e:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=U92419RJ2021PTC078915,CN=WINSTA SPORTS PRIVATE LIMITED,O=WINSTA SPORTS PRIVATE LIMITED,L=Jaipur,ST=Rajasthan,C=IN,1.2.840.113549.1.9.1=#0c1562756e6e796973626b343740676d61696c2e636f6d,1.3.6.1.4.1.311.60.2.1.2=#130952616a61737468616e,1.3.6.1.4.1.311.60.2.1.3=#1302494e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 8, 2025

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=U92419RJ2021PTC078915,CN=WINSTA SPORTS PRIVATE LIMITED,O=WINSTA SPORTS PRIVATE LIMITED,L=Jaipur,ST=Rajasthan,C=IN,1.2.840.113549.1.9.1=#0c1562756e6e796973626b343740676d61696c2e636f6d,1.3.6.1.4.1.311.60.2.1.2=#130952616a61737468616e,1.3.6.1.4.1.311.60.2.1.3=#1302494e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0f:d0:11:b4:bc:cc:c4:f8:6e:60:fa:b1

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 7, 2025 - Mar 8, 2026

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

0

Major OS version

6

Entry point

2314672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb

kernel32

WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW CreateEventExW WaitForSingleObject CreateProcessW GetLastError GetExitCodeProcess SetEvent DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleFileNameW InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW FindClose FindFirstFileW GetFullPathNameW InitializeCriticalSection lstrcpynW CreateThread GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceExW Sleep GetProcAddress LoadLibraryExW FreeLibrary CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcess WideCharToMultiByte GetSystemDirectoryW GetCurrentProcessId DecodePointer CreateNamedPipeW GetExitCodeThread CreateDirectoryW lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW GetModuleHandleW LoadLibraryW CompareStringW RemoveDirectoryW FindNextFileW GetFileSize GetFileAttributesW GetShortPathNameW GetFinalPathNameByHandleW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SetFileTime SystemTimeToFileTime MultiByteToWideChar GetSystemInfo WaitForMultipleObjects GetVersion CreateSemaphoreW ReleaseSemaphore GlobalMemoryStatus GetModuleHandleA VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW OutputDebugStringW GetLocalTime FlushFileBuffers GetTempPathW GetTempFileNameW MoveFileW GetWindowsDirectoryW SetUnhandledExceptionFilter FileTimeToSystemTime GetEnvironmentVariableW GetSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW FormatMessageW ConnectNamedPipe GetEnvironmentStringsW LocalFree InitializeCriticalSectionEx LoadLibraryA GetModuleFileNameA LocalAlloc GetCurrentThread GetConsoleOutputCP Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process CloseHandle GetProcessId TerminateProcess ReadProcessMemory SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetSystemDefaultLangID GetUserDefaultLangID lstrcpyW ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW TerminateThread CompareFileTime CopyFileExW OpenEventW PeekNamedPipe WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive FormatMessageA QueryPerformanceCounter QueryPerformanceFrequency SleepConditionVariableSRW GetLocaleInfoEx GetCurrentDirectoryW FindFirstFileExW MoveFileExW WakeAllConditionVariable EncodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree UnhandledExceptionFilter GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode SetFilePointerEx GetFileSizeEx ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW GetProcessAffinityMask OpenProcess CreateFileW HeapQueryInformation

imagehlp

SymGetModuleBase SymFunctionTableAccess SymGetLineFromAddr SymSetSearchPath SymCleanup SymInitialize SymSetOptions StackWalk

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

756KB

Virtual Size

756KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1.exe

PE Signature issue

kernel32

imagehlp

generic