imagex[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
imagex.exe
Size 470KB
Sample260723-pg6dmacj7z
SHA256 22f0c8b4e10d97e106cce28f2eb993adebdfacbf25babc37889350e2c220bed9
MD5 e0ad0c49291d7f63edefcef137e91d4f
SHA1 fc17bac4c13cf3bbb4a39bcd6e43500bfa4d99ed
SHA512 c238b4e24aed356959cabcd6f0dbc794f03f69e850cc9ec04327c37aee04f81126db9471e9bd05e480d0bccf6652c381c5554fed160245fdc51ae06a9a9ef988
SSDEEP 12288:EWWUV8uS1puhCHFKmSbS2NwojRbjhnT7Ja:EvewpuhCHFKprnRbjhTla
TLSH
T12DA4182272D4A139F8F736B05A7C7234077EF9615B34D7CF56401A9AA8B4AC08E3476B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
imagex.exe

File Explorer

imagex.exe

.exe 470KB

imagex.exe

IMPHASH dfe7912144378ceb495918a3382218d2
SHA256 22f0c8b4e10d97e106cce28f2eb993adebdfacbf25babc37889350e2c220bed9
MD5 e0ad0c49291d7f63edefcef137e91d4f
SHA1 fc17bac4c13cf3bbb4a39bcd6e43500bfa4d99ed
SHA512 c238b4e24aed356959cabcd6f0dbc794f03f69e850cc9ec04327c37aee04f81126db9471e9bd05e480d0bccf6652c381c5554fed160245fdc51ae06a9a9ef988
SSDEEP 12288:EWWUV8uS1puhCHFKmSbS2NwojRbjhnT7Ja:EvewpuhCHFKprnRbjhTla
TLSH
T12DA4182272D4A139F8F736B05A7C7234077EF9615B34D7CF56401A9AA8B4AC08E3476B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

85:ed:69:5d:97:b6:0a:4e:16:30:94:5c:68:bd:8f:f2:32:02:ae:e5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 14, 2009

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:27:81:00:00:00:00:00:08

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2008 - Jan 22, 2010

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:a2:30:00:00:00:00:00:08

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

Major OS version

Entry point

109319

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

imagex.pdb

kernel32

PulseEvent CreateFileMappingW MapViewOfFile UnmapViewOfFile GetVolumeInformationW DuplicateHandle UnlockFileEx LockFileEx GetOverlappedResult CreateMutexW ReleaseMutex HeapReAlloc GetFileSize GetCurrentThread SetThreadIdealProcessor WaitForMultipleObjects GetFileInformationByHandle CreateEventW InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEndOfFile SetFilePointerEx SetFilePointer ReadFile GetFileSizeEx LocalAlloc CreateDirectoryW FlushFileBuffers GetLogicalDriveStringsW DeviceIoControl RemoveDirectoryW CreateFileW CopyFileW SetFileAttributesW GetCurrentDirectoryW LoadLibraryW FreeLibrary CreateThread WaitForSingleObject OpenEventW SetEvent ResetEvent CloseHandle GetCommandLineW ExpandEnvironmentStringsW UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter GetModuleHandleA SetUnhandledExceptionFilter InterlockedCompareExchange Sleep InterlockedExchange GetExitCodeProcess CreateProcessW GetSystemDirectoryW GetStartupInfoW GetSystemInfo GetProcAddress GetTickCount GetModuleFileNameW SetConsoleCtrlHandler GetTempFileNameW GetTempPathW DeleteFileW GetLogicalDrives GetDriveTypeW lstrcmpW GetSystemWindowsDirectoryW GetFileAttributesW SetLastError CompareStringW GetFullPathNameW FindFirstFileW FindNextFileW FindClose HeapFree FormatMessageW LocalFree InitializeCriticalSection EnterCriticalSection FillConsoleOutputCharacterW WriteFile LeaveCriticalSection GetStdHandle GetConsoleScreenBufferInfo WriteConsoleW SetConsoleCursorPosition GetConsoleMode GetProcessHeap HeapAlloc WideCharToMultiByte GetLastError lstrlenW

msvcrt

_onexit _lock __dllonexit _unlock _controlfp ?terminate@@YAXXZ memmove memcpy __set_app_type __p__fmode __p__commode __setusermatherr _amsg_exit exit _XcptFilter _exit _cexit __wgetmainargs _iob wcschr wcsrchr _wtol memset printf fflush _vsnwprintf _wcsnicmp _wcsicmp towupper wcsncmp wcstoul ??3@YAXPAX@Z ??2@YAPAXI@Z _purecall iswspace _initterm bsearch

ntdll

RtlDeleteCriticalSection RtlReAllocateHeap RtlLeaveCriticalSection RtlEnterCriticalSection RtlRaiseStatus NtYieldExecution RtlInitUnicodeString NtCreateFile NtQueryInformationFile NtOpenFile NtQueryDirectoryFile NtClose RtlAdjustPrivilege RtlDosPathNameToNtPathName_U NtSetInformationFile RtlAllocateHeap RtlFreeHeap RtlNtStatusToDosError RtlUnwind RtlInitializeCriticalSection

user32

CharNextW LoadStringW CharPrevW

rpcrt4

RpcStringBindingComposeW UuidFromStringW NdrClientCall2 RpcStringFreeW UuidToStringW RpcBindingFromStringBindingW RpcBindingSetAuthInfoW RpcBindingFree UuidCreate

shlwapi

StrStrIW PathMatchSpecW

setupapi

SetupGetLineTextW SetupFindFirstLineW SetupOpenInfFileW SetupFindNextLine SetupCloseInfFile

advapi32

RegDeleteKeyW GetSecurityDescriptorControl GetAclInformation SetSecurityInfo RegFlushKey RegEnumKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegSetValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership FreeSid GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner CloseEncryptedFileRaw WriteEncryptedFileRaw OpenEncryptedFileRawW ReadEncryptedFileRaw GetSecurityDescriptorLength GetSecurityInfo SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAceEx InitializeAcl GetLengthSid SetThreadToken OpenThreadToken RegLoadKeyW RegUnLoadKeyW GetSecurityDescriptorSacl

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Sharing

General

Malware Config

Signatures

File Explorer

imagex.exe

PE Signature issue

kernel32

msvcrt

ntdll

user32

rpcrt4

shlwapi

setupapi

advapi32

version

generic