AtivadorKey[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AtivadorKey.exe
Size 84.4MB
Sample260626-3hs2ksft41
SHA256 0dc8c359dac4ad9706ed31823cc6a3ec91aa59511d867617e939ec6e257ecfcd
MD5 31183793769d0048e5d614403dd8235c
SHA1 1ddb462d520022d185e5c51dd495525e51c1cba8
SHA512 ea7058366a4c56629100f6743db4d4833b22b3dfe841e94e36f909769927035f1b4aae09c87173c041da9a640aafc45ba9c8c8c43aebe7fc5ef4569c7fe925ed
SSDEEP 786432:BiqD1FcYAcqwnQ3elMUbbVSP+ERS2RKPvdjkhajEGhlKilLgXOFDWKY:wIcCbABhQjE5ybY
TLSH
T17418AF56B3A50095D57BE07CCE078613E7B1BC161360A7DB20A4EA692F73BE22B7D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
AtivadorKey.exe

File Explorer

AtivadorKey.exe

.exe 84.4MB

AtivadorKey.exe

IMPHASH 254bc68f13467887f90e72a94dbc6b01
SHA256 0dc8c359dac4ad9706ed31823cc6a3ec91aa59511d867617e939ec6e257ecfcd
MD5 31183793769d0048e5d614403dd8235c
SHA1 1ddb462d520022d185e5c51dd495525e51c1cba8
SHA512 ea7058366a4c56629100f6743db4d4833b22b3dfe841e94e36f909769927035f1b4aae09c87173c041da9a640aafc45ba9c8c8c43aebe7fc5ef4569c7fe925ed
SSDEEP 786432:BiqD1FcYAcqwnQ3elMUbbVSP+ERS2RKPvdjkhajEGhlKilLgXOFDWKY:wIcCbABhQjE5ybY
TLSH
T17418AF56B3A50095D57BE07CCE078613E7B1BC161360A7DB20A4EA692F73BE22B7D740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f0:32:b3:e0:82:96:51:0c:fc:95:3a:69:67:21:9d:62:90:89:71:d9:b2:84:cd:b1:0d:fa:34:96:ba:16:55:5a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=NightStore

Chains

Jun 26, 2026

CN=NightStore

Subject

CN=NightStore

Serial Number

14:8e:84:f8:6e:8b:a2:96:45:c7:7e:94:d5:32:9e:c6

Issuer

CN=NightStore

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 24, 2026 - Jun 24, 2027

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

4342

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddDllDirectory CloseHandle CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateProcessW DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceA FormatMessageA FreeLibrary GenerateConsoleCtrlEvent GetCommandLineW GetCurrentProcessId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetProcAddress GetProcessId GetShortPathNameW GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTempPathW InitializeCriticalSection IsDBCSLeadByteEx K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadResource LockResource MapViewOfFile MultiByteToWideChar OpenProcess ReadFile SetConsoleCtrlHandler SetDllDirectoryW SetEnvironmentVariableW SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __argc __iob_func __set_app_type __setusermatherr __wargv __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _lock _onexit _unlock _wcmdln _wcsdup _wcsicmp _wrename abort calloc exit fwprintf fprintf fputc fputwc free fwrite iswctype localeconv malloc mbstowcs memcpy memset puts signal strerror strlen strncmp vfprintf wcschr wcscmp wcslen wcsncmp wcstoul

shell32

CommandLineToArgvW SHFileOperationW SHGetFolderPathW

Name

.text

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

84.4MB

Virtual Size

84.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AtivadorKey.exe

PE Signature issue

kernel32

msvcrt

shell32

generic