Framer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Framer.exe
Size 142.0MB
Sample260623-y729bsf191
SHA256 56afb8c56bcbe69332fd3a30a3f81c419d53fec364f9f7c4bed0b87f6d3a74c6
MD5 0826e57ee21a1f1e313e1553c6d2ca81
SHA1 6757b1593305049f8d9da6fa7db73f80d1227ac9
SHA512 048a82766ac1127a4dd5b45ae64140b26dc513c0bcd359ed88fce3fe8478b2531043b92a0b5601059d915fd510d7eee9b642a9c568198ce0dc7fd9215fb5a436
SSDEEP 3145728:dDNnf8qPiIyfqqZ1CTRGrWELV2Mrtu0AwAEJBP9cXXkKsV82:RFfnKIA3CFG6MQ0Aw3TPqXXkKsV82
TLSH
T1F3683379B3A1E42BC474E4323740587EE9ACF9727F6404C792AE83104FEC6E52E99617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Framer.exe

.exe 142.0MB

Framer.exe

IMPHASH e6f4169f2a5c3a8f93171d9f593bd22a
SHA256 56afb8c56bcbe69332fd3a30a3f81c419d53fec364f9f7c4bed0b87f6d3a74c6
MD5 0826e57ee21a1f1e313e1553c6d2ca81
SHA1 6757b1593305049f8d9da6fa7db73f80d1227ac9
SHA512 048a82766ac1127a4dd5b45ae64140b26dc513c0bcd359ed88fce3fe8478b2531043b92a0b5601059d915fd510d7eee9b642a9c568198ce0dc7fd9215fb5a436
SSDEEP 3145728:dDNnf8qPiIyfqqZ1CTRGrWELV2Mrtu0AwAEJBP9cXXkKsV82:RFfnKIA3CFG6MQ0Aw3TPqXXkKsV82
TLSH
T1F3683379B3A1E42BC474E4323740587EE9ACF9727F6404C792AE83104FEC6E52E99617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

a4:ad:68:72:c8:8d:2f:55:85:84:a9:12:73:0f:81:7b:39:7c:01:4d:41:a7:22:50:08:8d:de:f8:5a:a2:19:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=59920637,CN=Framer B.V.,O=Framer B.V.,STREET=Rozengracht 207 B,L=Amsterdam,ST=Noord-Holland,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 18, 2026

SERIALNUMBER=59920637,CN=Framer B.V.,O=Framer B.V.,STREET=Rozengracht 207 B,L=Amsterdam,ST=Noord-Holland,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=59920637,CN=Framer B.V.,O=Framer B.V.,STREET=Rozengracht 207 B,L=Amsterdam,ST=Noord-Holland,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

01:fd:9e:23:26:94:56:ee:80:63:0b:f8

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 16, 2025 - Apr 26, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

43868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\Setup.pdb

kernel32

LoadResource FindResourceW lstrlenW GetProcAddress GetModuleHandleW DeleteCriticalSection GetTempPathW GetLastError GetTempFileNameW MoveFileW WaitForSingleObject GetExitCodeProcess CloseHandle DeleteFileW GetModuleFileNameW GetCurrentProcess LoadLibraryW FreeLibrary InitializeCriticalSectionEx GetFileAttributesW CreateFileW SetFilePointer ReadFile VerSetConditionMask GetCurrentDirectoryW MultiByteToWideChar LocalFileTimeToFileTime WideCharToMultiByte CreateDirectoryW WriteFile SetFileTime FreeResource SizeofResource LockResource CreateProcessW GetSystemDirectoryW SetDefaultDllDirectories GetCurrentThreadId DecodePointer RaiseException LeaveCriticalSection EnterCriticalSection lstrcmpiW LoadLibraryExW GetConsoleMode GetConsoleCP SystemTimeToFileTime VerifyVersionInfoW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA IsDebuggerPresent OutputDebugStringW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW HeapSize HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW GetFileSizeEx SetFilePointerEx FlushFileBuffers WriteConsoleW

shlwapi

PathIsUNCW

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

Framer.exe

kernel32

shlwapi

comctl32

generic