winutil[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
winutil.exe
Size 2.4MB
Sample260708-bfcs2ahx5k
SHA256 a736ca877c6ce2381af5db8c6e61efe030f61a4de24e7bf815624f47380cf097
MD5 c9cbe99810c5d08e4e81264aa23ddd85
SHA1 2d8c87a8d907b09eb5ce52a4222663c135ba4afa
SHA512 8185f0a3cd05524e5da31a678e2d04e97287d81bda3af0b89728c43376c77e57b7d4b84cc300c8a703f3a2a3c8139a9b94d7c5702b65c9ce707f9375f57f7343
SSDEEP 24576:3KW208JCMNEIpkg/jrH2y4AxC52U8uUFDEjyFM3VIH06iyiMgvR:3a08JCMNht3p4AxC52UvERYIU6iT
TLSH
T1D0C54A03E6D046E7C375A238CE574621FF33799B02113AAB36ECE108AF72BD5461B656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

winutil.exe

.exe 2.4MB

winutil.exe

IMPHASH b5b807466c748bbc85618613badce51a
SHA256 a736ca877c6ce2381af5db8c6e61efe030f61a4de24e7bf815624f47380cf097
MD5 c9cbe99810c5d08e4e81264aa23ddd85
SHA1 2d8c87a8d907b09eb5ce52a4222663c135ba4afa
SHA512 8185f0a3cd05524e5da31a678e2d04e97287d81bda3af0b89728c43376c77e57b7d4b84cc300c8a703f3a2a3c8139a9b94d7c5702b65c9ce707f9375f57f7343
SSDEEP 24576:3KW208JCMNEIpkg/jrH2y4AxC52U8uUFDEjyFM3VIH06iyiMgvR:3a08JCMNht3p4AxC52UvERYIU6iT
TLSH
T1D0C54A03E6D046E7C375A238CE574621FF33799B02113AAB36ECE108AF72BD5461B656
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

0e:2e:5f:d0:0b:47:b1:e0:94:ce:80:13:19:e1:83:0d:db:da:32:a3:4a:66:49:3f:64:7c:01:59:47:cc:ca:17

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=0804226889,CN=CT Tech Group LLC,O=CT Tech Group LLC,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13055465786173,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Mar 5, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

0a:0c:65:5f:c7:4f:15:e9:6d:18:aa:01:8b:05:6e:68

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 30, 2025 - Mar 29, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

882732

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winutil.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

kernel32

CreateFileW SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetModuleHandleW FormatMessageW GetModuleHandleA FindFirstFileExW GetConsoleOutputCP GetSystemTimeAsFileTime GetConsoleMode GetStdHandle RtlVirtualUnwind WideCharToMultiByte ReleaseMutex SetHandleInformation CreateMutexA GetCurrentProcessId CreateThread WriteFileEx SleepEx ReadFileEx GetSystemTimePreciseAsFileTime QueryPerformanceCounter QueryPerformanceFrequency CreateEventW CancelIo GetOverlappedResult ReadFile CompareStringOrdinal GetModuleFileNameW GetFullPathNameW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle GetCurrentProcess WaitForMultipleObjects GetExitCodeProcess GetProcAddress LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW CreateDirectoryW SetLastError GetCurrentThreadId GetLastError CreateWaitableTimerExW Sleep SetWaitableTimer HeapReAlloc HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetEnvironmentVariableW InitializeSListHead lstrlenW SetUnhandledExceptionFilter CloseHandle HeapAlloc WriteConsoleW FindClose WaitForSingleObject GetSystemDirectoryW MultiByteToWideChar

shell32

SHGetKnownFolderPath ShellExecuteExW

ole32

CoTaskMemFree

ws2_32

WSASend recv WSARecv WSADuplicateSocketW send getaddrinfo freeaddrinfo WSASocketW WSACleanup WSAStartup select connect ioctlsocket WSAGetLastError getsockname getpeername accept bind getsockopt closesocket listen setsockopt

ntdll

NtWriteFile NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtOpenFile

vcruntime140

__CxxFrameHandler3 memcpy __C_specific_handler memcmp __current_exception __current_exception_context memset memmove

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc _initialize_narrow_environment _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _set_app_type terminate _initialize_onexit_table _register_onexit_function _crt_atexit _seh_filter_exe __p___argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

winutil.exe

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

kernel32

shell32

ole32

ws2_32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic