msedge[.]exe | Triage™

General

Target
msedge.exe
Size 41KB
Sample260803-ksazmseq4x
SHA256 c92181f1511afc52f73eb2653789addca570e338956c5b1d2d4d91ffc9da53d3
MD5 3327629e32260bba932130b5a9e92dc6
SHA1 f1f4ebab7f190241a06bb30d1b8b0eac224f6a72
SHA512 3f83f8f20dc30da5fc3a6b204aae8460b2b376e5a18e6cc7e465ba8a976aaede89571aeedf8ef937f491c6e39d17024fd59f8c397f95f65b01aace6a147c1f0d
SSDEEP 768:AK80TEIghWxOa+KwRSZSjobg+Q/T3sfyEE8mLk5U0:c0TEIghWxOaxwRSZqobg+QAfzj40
TLSH
T14C13185FEA7920D2E9B9E03CC596712AF9B035E103B15BC35791862A0B737E4B93D384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
msedge.exe

File Explorer

msedge.exe

.exe 41KB

msedge.exe

IMPHASH a4bceae4dbeb0a29832e381cc3f4cb85
SHA256 c92181f1511afc52f73eb2653789addca570e338956c5b1d2d4d91ffc9da53d3
MD5 3327629e32260bba932130b5a9e92dc6
SHA1 f1f4ebab7f190241a06bb30d1b8b0eac224f6a72
SHA512 3f83f8f20dc30da5fc3a6b204aae8460b2b376e5a18e6cc7e465ba8a976aaede89571aeedf8ef937f491c6e39d17024fd59f8c397f95f65b01aace6a147c1f0d
SSDEEP 768:AK80TEIghWxOa+KwRSZSjobg+Q/T3sfyEE8mLk5U0:c0TEIghWxOaxwRSZqobg+QAfzj40
TLSH
T14C13185FEA7920D2E9B9E03CC596712AF9B035E103B15BC35791862A0B737E4B93D384
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0f:df:e1:95:94:13:04:78:22:2d:55:1b:cc:68:16:ad:db:0b:ff:1d:8e:3e:8d:13:61:ee:8e:21:aa:49:b2:0f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 2, 2026

CN=Microsoft Windows,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

4a:c1:54:94:f9:50:89:06:84:91:9a:94:5a:35:14:8f:93:93:35:48

Issuer

CN=Microsoft Windows,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 2, 2026 - Aug 2, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

0

Major OS version

6

Entry point

18560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\user\source\repos\client_test\x64\Release\client_test.pdb

kernel32

GetModuleHandleA GetProcAddress GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

ws2_32

htons inet_addr

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __current_exception_context memcmp memmove _CxxThrowException __C_specific_handler __current_exception __std_exception_copy memcpy

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit __p___argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _set_app_type _exit _register_thread_local_exe_atexit_callback exit _initterm_e _seh_filter_exe _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __p___argc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strlen

Sharing

General

Malware Config

Signatures

File Explorer

msedge.exe

PE Signature issue

kernel32

msvcp140

ws2_32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

generic