DeltaX[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DeltaX.exe
Size 542KB
Sample260528-ejy28agx2w
SHA256 46e0df8cae0d062d7947d2b63a19627d7ddef232fefdbb5cec0177261ca6700a
MD5 fc925367927b169ff255149e081f8da7
SHA1 7a9a2c79328903163badba415eff50ccf101e231
SHA512 ba99b8ed212a31b9066650843809beefeace4c4b6295c4555546e898e9055f5793535ed161548f219a5a9c11eadf2a6c00e065a00334a2f5c5c6b0f69a5aafe5
SSDEEP 6144:MBEEkTsE1938TnLGE5PBJ+ublbJwXt1RQal++EAJmD8AMRljLbbXb8NIWbwujx5s:6cl196nLGOb3+aYAMRBbLSIhwYYX8
TLSH
T152C44A147F998E08E481163E455E1609DBEED1F22572B303370AEF624D059DEDE2E3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
DeltaX.exe

File Explorer

DeltaX.exe

.exe 542KB

DeltaX.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 46e0df8cae0d062d7947d2b63a19627d7ddef232fefdbb5cec0177261ca6700a
MD5 fc925367927b169ff255149e081f8da7
SHA1 7a9a2c79328903163badba415eff50ccf101e231
SHA512 ba99b8ed212a31b9066650843809beefeace4c4b6295c4555546e898e9055f5793535ed161548f219a5a9c11eadf2a6c00e065a00334a2f5c5c6b0f69a5aafe5
SSDEEP 6144:MBEEkTsE1938TnLGE5PBJ+ublbJwXt1RQal++EAJmD8AMRljLbbXb8NIWbwujx5s:6cl196nLGOb3+aYAMRBbLSIhwYYX8
TLSH
T152C44A147F998E08E481163E455E1609DBEED1F22572B303370AEF624D059DEDE2E3EA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

74:7a:9d:a4:86:0d:78:09:61:31:2a:1a:92:2e:75:2e:a0:a4:3b:7a:bc:ae:76:23:44:3c:6b:c8:3a:fa:f0:9d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=14198230,CN=Crystal Future OÜ,O=Crystal Future OÜ,STREET=Pikk tn 7-5,L=Tallinn,ST=Harju,C=EE,1.2.840.113549.1.9.1=#0c1563656f406372797374616c6675747572652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 13, 2022

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

PE Signature issue

Digest

74:7a:9d:a4:86:0d:78:09:61:31:2a:1a:92:2e:75:2e:a0:a4:3b:7a:bc:ae:76:23:44:3c:6b:c8:3a:fa:f0:9d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Nov 13, 2022

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2015 - Jun 4, 2025

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

68:b5:f9:08:2e:c8:38:ba:1f:19:64:06

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 17, 2021 - Nov 18, 2023

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

534494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

DeltaX.exe

PE Signature issue

PE Signature issue

mscoree

dotnet