pageant[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
pageant.exe
Size 908KB
Sample260716-amarksht3r
SHA256 fa7f58a7dd496f1ae078a67d742a0f4919b39efbe0590a90a1a11e537f1e4d45
MD5 877ce931e192d252163ae90e54660547
SHA1 b91cd5b41fdbe8e2557f426f24314ea50b0cb59f
SHA512 e9edf6a1482df4eddc593a9fc6f4996e27cf7b8d813d3dc7e4268c9931024bb8b9904fb84d33c3bdeb5dd4d8c872821e05eb1aa9d362e61a4b7ea8635160056f
SSDEEP 24576:4JnbkaH+FpcOhS/ouTNVfFCxBjk2kGi05aHSDwBifodWodt:jhSTZqoaaHSDwBi6
TLSH
T1EE15DF57A75602F8D06AC2788A975512FB71F8440B71BADF03E096321F23BD46E3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

pageant.exe

.exe 908KB

pageant.exe

IMPHASH 97b096b3604e6ffc3362c8c84c04f8f3
SHA256 fa7f58a7dd496f1ae078a67d742a0f4919b39efbe0590a90a1a11e537f1e4d45
MD5 877ce931e192d252163ae90e54660547
SHA1 b91cd5b41fdbe8e2557f426f24314ea50b0cb59f
SHA512 e9edf6a1482df4eddc593a9fc6f4996e27cf7b8d813d3dc7e4268c9931024bb8b9904fb84d33c3bdeb5dd4d8c872821e05eb1aa9d362e61a4b7ea8635160056f
SSDEEP 24576:4JnbkaH+FpcOhS/ouTNVfFCxBjk2kGi05aHSDwBifodWodt:jhSTZqoaaHSDwBi6
TLSH
T1EE15DF57A75602F8D06AC2788A975512FB71F8440B71BADF03E096321F23BD46E3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

4b:55:19:ba:4e:4b:3d:9e:ad:01:e7:66:f7:e0:29:b0:89:3e:4d:08:b8:ae:69:37:75:8f:ef:15:a9:44:75:87

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB

Chains

May 14, 2026

CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Digest

8d:74:54:0b:d3:dd:06:9f:4c:8f:c0:0b:82:d2:c2:f1:be:3d:ff:f4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB

Chains

May 14, 2026

CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 1, 2010 - Jan 18, 2038

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Simon Tatham,O=Simon Tatham,ST=Cambridgeshire,C=GB

Serial Number

be:8e:1d:85:c5:d2:52:1b:6d:33:37:9e:3b:85:01:a9

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 27, 2024 - Sep 27, 2027

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

02:7c:39:01:0c:a7:5a:c3:3a:b5:ee:0d:54:0e:f9:e5

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Minor OS version

Major OS version

Entry point

240788

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CopySid EqualSid GetLengthSid GetUserNameA InitializeSecurityDescriptor RegCloseKey RegCreateKeyExA RegEnumKeyA RegOpenKeyA RegOpenKeyExA RegQueryValueExA SetSecurityDescriptorDacl SetSecurityDescriptorOwner

gdi32

DeleteDC ExtTextOutA GetTextExtentPoint32A SelectObject SetBkColor SetTextColor

shell32

ShellExecuteA Shell_NotifyIconA

user32

AppendMenuA CreateDialogParamA CreateMenu CreatePopupMenu CreateWindowExA DefWindowProcA DestroyIcon DestroyMenu DestroyWindow DialogBoxParamA DispatchMessageA DrawFocusRect EnableWindow EndDialog FindWindowA GetCursorPos GetDC GetDesktopWindow GetDlgItem GetMenuDefaultItem GetMenuItemCount GetMenuItemInfoA GetMessageA GetSysColor GetWindowLongPtrA GetWindowRect GetWindowTextA GetWindowTextLengthA InsertMenuItemA IsDialogMessageA IsWindow LoadIconA MapDialogRect MessageBeep MessageBoxA MessageBoxIndirectW MoveWindow MsgWaitForMultipleObjects PeekMessageW PostMessageA PostQuitMessage RegisterClassA RegisterWindowMessageA RemoveMenu SendDlgItemMessageA SendMessageA SetActiveWindow SetDlgItemTextA SetForegroundWindow SetMenuDefaultItem SetWindowLongPtrA SetWindowPos ShowWindow TabbedTextOutA TrackPopupMenu TranslateMessage

kernel32

CloseHandle CompareStringW ConnectNamedPipe CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeA CreateThread DeleteCriticalSection DeleteFileA DeleteFileW EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileA FindFirstFileExW FindNextFileW FindResourceA FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemTimeAsFileTime GetTempPathA GetTickCount GetTimeFormatW GetTimeZoneInformation HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadResource LocalAlloc LocalFree LockResource MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryA SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VirtualQuery WaitForSingleObject WaitNamedPipeA WideCharToMultiByte WriteConsoleW WriteFile

comdlg32

GetOpenFileNameA GetOpenFileNameW GetSaveFileNameA GetSaveFileNameW

Name

.text

Size

365KB

Virtual Size

365KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

362KB

Virtual Size

361KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

pageant.exe

advapi32

gdi32

shell32

user32

kernel32

comdlg32

generic