a3f33b111929ff4d5bd2d7c0fe5a89bec6e26e12fcef8627f44b77f31274104d

Sharing

Copy URL Twitter E-mail

General

Target
a3f33b111929ff4d5bd2d7c0fe5a89bec6e26e12fcef8627f44b77f31274104d
Size 10.3MB
Sample260604-zzyrlsfs3w
SHA256 a3f33b111929ff4d5bd2d7c0fe5a89bec6e26e12fcef8627f44b77f31274104d
MD5 dc599a2215e02296b4d7e1da84120dd3
SHA1 625901a2c3264ac80e21eeaaa5a02f5b118504dc
SHA512 63fa19b74a4125257b464e007d0ecc2ddce63fcf05b03c5307656ab3cc1d5ef84cdacc7eab8b6659656ecbc845cb6a877907dff53ed425d283e49db8772b7383
SSDEEP 98304:glnrftGaTpmGaJheiN79m/moMObzcv3Hb:ghY7reiN7qMObS
TLSH
T1F2B68D077C4354EAC0B996348492CA6272A2FE1E1F7BA7E71E14627F2A371DC647B314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
a3f33b111929ff4d5bd2d7c0fe5a89bec6e26e12fcef8627f44b77f31274104d

File Explorer

a3f33b111929ff4d5bd2d7c0fe5a89bec6e26e12fcef8627f44b77f31274104d

.exe 10.3MB

a3f33b111929ff4d5bd2d7c0fe5a89bec6e26e12fcef8627f44b77f31274104d

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 a3f33b111929ff4d5bd2d7c0fe5a89bec6e26e12fcef8627f44b77f31274104d
MD5 dc599a2215e02296b4d7e1da84120dd3
SHA1 625901a2c3264ac80e21eeaaa5a02f5b118504dc
SHA512 63fa19b74a4125257b464e007d0ecc2ddce63fcf05b03c5307656ab3cc1d5ef84cdacc7eab8b6659656ecbc845cb6a877907dff53ed425d283e49db8772b7383
SSDEEP 98304:glnrftGaTpmGaJheiN79m/moMObzcv3Hb:ghY7reiN7qMObS
TLSH
T1F2B68D077C4354EAC0B996348492CA6272A2FE1E1F7BA7E71E14627F2A371DC647B314
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a1:7c:f6:de:ed:a1:25:a0:a0:7b:64:95:ba:77:88:3e:d0:02:57:04:a7:59:0c:42:5e:a3:80:ba:fb:14:79:a7

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3817822,CN=SignalRGB (Whirlwind Virtual Realities Inc),O=SignalRGB (Whirlwind Virtual Realities Inc),ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

CN=Sectigo Public Code Signing CA EV E36,O=Sectigo Limited,C=GB

Serial Number

37:74:43:4f:9e:b4:0e:22:1f:92:36:ca:1f:2f:27:17

Issuer

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Serial Number

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cb

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 28, 2023 - Dec 31, 2028

Subject

Serial Number

68:07:16:26:86:69:af:ba:bf:23:9c:e4:7b:23:9a:04

Issuer

CN=Sectigo Public Code Signing CA EV E36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2024 - Nov 7, 2026

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

450304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

917KB

Virtual Size

917KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

a3f33b111929ff4d5bd2d7c0fe5a89bec6e26e12fcef8627f44b77f31274104d

PE Signature issue

kernel32

generic