ScrubDummy[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ScrubDummy.exe
Size 1.6MB
Sample260624-apb3eshv3p
SHA256 0ab22927d1a3e57abcfad547c4fd69f0caa9df0d4b22f4396af62841e08e075a
MD5 a01bb689692081a972eb4859ad27accf
SHA1 0f43db1898d1f8281eb39d3940218421b897e0a0
SHA512 9762c9ece64ffab0e4cb21c73854480ee974d00a6bf7519d6e900ca647f69dae339d2d65484e0c157156dca14b134483e9530af675b204291a3039bde2509897
SSDEEP 49152:LHPMdPfyjnLWNFgaTncvmtvIDc8EXcSl+CYRhRwkrSQoZVJ:LHPMkDSFCmtTcS41TrdU
TLSH
T1FB756C11F290903AF9F700F69ABA45BCAA287E30176950CB53C07D9E5B719E17E31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
ScrubDummy.exe

File Explorer

ScrubDummy.exe

.exe 1.6MB

ScrubDummy.exe

IMPHASH 5213ec08af1fc213e8ced7559b268116
SHA256 0ab22927d1a3e57abcfad547c4fd69f0caa9df0d4b22f4396af62841e08e075a
MD5 a01bb689692081a972eb4859ad27accf
SHA1 0f43db1898d1f8281eb39d3940218421b897e0a0
SHA512 9762c9ece64ffab0e4cb21c73854480ee974d00a6bf7519d6e900ca647f69dae339d2d65484e0c157156dca14b134483e9530af675b204291a3039bde2509897
SSDEEP 49152:LHPMdPfyjnLWNFgaTncvmtvIDc8EXcSl+CYRhRwkrSQoZVJ:LHPMkDSFCmtTcS41TrdU
TLSH
T1FB756C11F290903AF9F700F69ABA45BCAA287E30176950CB53C07D9E5B719E17E31B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

60:bb:81:a3:d4:cd:a7:18:98:b2:be:72:b9:8d:c1:c7:42:30:6f:24

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Secured Globe\, Inc.,O=Secured Globe\, Inc.,L=New York,ST=New York,C=US

Chains

Jun 8, 2026

CN=Secured Globe\, Inc.,O=Secured Globe\, Inc.,L=New York,ST=New York,C=US

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Secured Globe\, Inc.,O=Secured Globe\, Inc.,L=New York,ST=New York,C=US

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Serial Number

07:84:3d:ad:01:c1:15:c2:74:ee:41:a7:28:22:46:79

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 23, 2022 - Jun 22, 2032

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Secured Globe\, Inc.,O=Secured Globe\, Inc.,L=New York,ST=New York,C=US

Serial Number

02:3e:c2:28:8e:29:ff:a1:fe:b7:e3:b6:c4:ed:ef:c9

Issuer

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 15, 2026 - Jan 16, 2027

Minor OS version

Major OS version

Entry point

1080383

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\micha\source\repos\DummyScrub\Win32\Release\ScrubDummy.pdb

kernel32

CompareStringEx GetCPInfo GetACP SetLastError GetModuleHandleA MulDiv GetSystemDirectoryW LoadLibraryExW GlobalDeleteAtom lstrcmpW GlobalAddAtomW GlobalFindAtomW CompareStringW lstrcmpA GetCurrentThread GetVersionExW CompareStringA GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetThreadLocale TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalAlloc LocalReAlloc GlobalFlags GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage VirtualProtect GetVolumeInformationW DuplicateHandle GetTickCount64 FileTimeToLocalFileTime GetFileSizeEx GetFileTime SystemTimeToTzSpecificLocalTime SetErrorMode GetUserDefaultLCID UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation EnumSystemLocalesW IsValidLocale LCMapStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP GetStdHandle HeapQueryInformation GetFileType SetStdHandle GetCommandLineW GetCommandLineA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread VirtualQuery VirtualAlloc RtlUnwind RaiseException SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive LCMapStringEx GetLocaleInfoEx EncodePointer GetStringTypeW GetExitCodeThread CreateProcessW AttachConsole TerminateProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot GetModuleHandleW DecodePointer FindClose FindNextFileW FindFirstFileW CopyFileW GetModuleFileNameW FreeResource FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime FreeLibrary GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx LocalFree CreateFileMappingA GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo HeapReAlloc DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitializeCriticalSectionEx EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GlobalLock GlobalAlloc GlobalFree GlobalUnlock FileTimeToSystemTime SystemTimeToFileTime GetSystemTime FindResourceW LoadResource LockResource SizeofResource MoveFileW DeleteFileW CloseHandle WriteFile CreateFileW GetFileAttributesExW GetEnvironmentVariableW GetLastError CreateDirectoryW GetCurrentProcess WideCharToMultiByte

user32

IsRectEmpty SetRect InvalidateRgn CopyAcceleratorTableW CharNextW ReleaseCapture SetCapture DestroyMenu RealChildWindowFromPoint LoadCursorW IntersectRect SetCursor GetMessageW GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW MapDialogRect SetWindowContextHelpId PostQuitMessage GetCursorPos LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageW SetWindowTextW IsDlgButtonChecked CheckDlgButton GetNextDlgGroupItem MoveWindow ShowWindow MonitorFromWindow WinHelpW GetWindow GetTopWindow GetClassLongW MapWindowPoints AdjustWindowRectEx GetWindowTextLengthW RemovePropW GetPropW SetPropW GetScrollPos ValidateRect GetForegroundWindow SetActiveWindow GetWindowRect GetDC ReleaseDC PrintWindow SetMenu GetMenu GetCapture SetFocus GetDlgCtrlID GetDlgItem IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos DestroyWindow IsChild IsMenu CreateWindowExW MessageBeep CharUpperW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW RegisterClipboardFormatW PostThreadMessageW EqualRect EnableWindow GetClientRect GetParent InvalidateRect IsWindow SendMessageW UpdateWindow TabbedTextOutW DrawTextW DrawTextExW GrayStringW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx GetSysColor CopyRect GetSystemMetrics RedrawWindow GetFocus GetKeyState SetWindowLongW PostMessageW ScreenToClient LoadIconW SetTimer IsIconic DrawIcon KillTimer MonitorFromPoint GetMonitorInfoW PtInRect GetWindowPlacement SetWindowPlacement SetForegroundWindow PeekMessageW TranslateMessage GetSysColorBrush DispatchMessageW UnregisterClassW DefWindowProcW GetMessageTime GetMessagePos RegisterWindowMessageW GetLastActivePopup MessageBoxW IsWindowEnabled ClientToScreen EndPaint BeginPaint GetWindowDC GetMenuItemCount GetMenuItemID GetSubMenu OffsetRect SetRectEmpty SendDlgItemMessageA AllowSetForegroundWindow GetDesktopWindow SetWindowPos EnumWindows GetClassNameW GetWindowTextW GetWindowThreadProcessId FindWindowExW GetWindowLongW

gdi32

SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateRectRgnIndirect GetMapMode GetBkColor GetTextColor GetRgnBox SetBkMode SetTextColor PtVisible SetBkColor ExtSelectClipRgn SaveDC RestoreDC GetWindowExtEx GetViewportExtEx GetStockObject GetClipBox CreateBitmap CreateFontIndirectW GetDeviceCaps Escape ExtTextOutW TextOutW RectVisible CreateCompatibleDC CreateCompatibleBitmap SelectObject PatBlt DeleteDC BitBlt DeleteObject GetObjectW CreateSolidBrush SetMapMode

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegEnumKeyW RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegEnumValueW RegQueryValueW GetUserNameW RegDeleteKeyW RegCloseKey RegCreateKeyExW RegSetValueExW

shell32

ShellExecuteW Shell_NotifyIconW SHGetFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW PathFindFileNameW PathRemoveFileSpecW PathIsUNCW PathStripToRootW ord12

uxtheme

SetWindowTheme

ole32

CoFreeUnusedLibraries CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CoInitialize CLSIDFromString CoCreateGuid CoTaskMemFree CLSIDFromProgID CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemAlloc OleUninitialize OleInitialize CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard CoRegisterMessageFilter

oleaut32

SysStringLen VariantTimeToSystemTime GetActiveObject SysAllocStringLen SystemTimeToVariantTime SafeArrayDestroy VariantChangeType VariantCopy OleCreateFontIndirect VariantClear SysFreeString VariantInit SysAllocString

oledlg

OleUIBusyW

urlmon

URLDownloadToFileW

gdiplus

GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdipAlloc GdiplusShutdown GdipFree GdipCreateBitmapFromHBITMAP GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize

wininet

DeleteUrlCacheEntryW InternetOpenUrlW InternetCloseHandle InternetReadFile InternetOpenW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

oleacc

LresultFromObject CreateStdAccessibleObject

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

209KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ScrubDummy.exe

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

urlmon

gdiplus

wininet

version

oleacc

generic