1ef0d443f06f9263f204dcafae1ab209fb766a1539c0d6354ecc6654394d4495
- SHA256 1ef0d443f06f9263f204dcafae1ab209fb766a1539c0d6354ecc6654394d4495
Overview
overview
8Static
static
8AR Stateme...ent.js
windows10-2004-x64
8AR Stateme...ent.js
windows11-ltsc_2024-x64
8AR Stateme...up.msi
windows10-2004-x64
8AR Stateme...up.msi
windows11-ltsc_2024-x64
8AR Stateme...nt.dll
windows10-2004-x64
1AR Stateme...nt.dll
windows11-ltsc_2024-x64
1AR Stateme...ce.dll
windows10-2004-x64
1AR Stateme...ce.dll
windows11-ltsc_2024-x64
1AR Stateme...re.dll
windows10-2004-x64
1AR Stateme...re.dll
windows11-ltsc_2024-x64
1AR Stateme...ws.dll
windows10-2004-x64
1AR Stateme...ws.dll
windows11-ltsc_2024-x64
1AR Stateme...ge.dll
windows10-2004-x64
1AR Stateme...ge.dll
windows11-ltsc_2024-x64
1AR Stateme...ll.exe
windows10-2004-x64
1AR Stateme...ll.exe
windows11-ltsc_2024-x64
1AR Stateme...nt.exe
windows10-2004-x64
1AR Stateme...nt.exe
windows11-ltsc_2024-x64
1AR Stateme...er.dll
windows10-2004-x64
1AR Stateme...er.dll
windows11-ltsc_2024-x64
1AR Stateme...er.exe
windows10-2004-x64
3AR Stateme...er.exe
windows11-ltsc_2024-x64
3AR Stateme...ce.exe
windows10-2004-x64
3AR Stateme...ce.exe
windows11-ltsc_2024-x64
3AR Stateme...ce.exe
windows10-2004-x64
3AR Stateme...ce.exe
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
AR Statement/AR Statement.js
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
AR Statement/AR Statement.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
Behavioral task
behavioral3
Sample
AR Statement/File.ClientSetup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral4
Sample
AR Statement/File.ClientSetup.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
Behavioral task
behavioral5
Sample
AR Statement/File.ClientSetup/ScreenConnect.Client.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
AR Statement/File.ClientSetup/ScreenConnect.Client.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
AR Statement/File.ClientSetup/ScreenConnect.ClientService.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
AR Statement/File.ClientSetup/ScreenConnect.ClientService.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
AR Statement/File.ClientSetup/ScreenConnect.Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
AR Statement/File.ClientSetup/ScreenConnect.Core.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
AR Statement/File.ClientSetup/ScreenConnect.Windows.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
AR Statement/File.ClientSetup/ScreenConnect.Windows.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
AR Statement/File.ClientSetup/ScreenConnect.WindowsAuthenticationPackage.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
AR Statement/File.ClientSetup/ScreenConnect.WindowsAuthenticationPackage.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
AR Statement/File.ClientSetup/ScreenConnect.WindowsBackstageShell.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
AR Statement/File.ClientSetup/ScreenConnect.WindowsBackstageShell.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
AR Statement/File.ClientSetup/ScreenConnect.WindowsClient.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
AR Statement/File.ClientSetup/ScreenConnect.WindowsClient.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
AR Statement/File.ClientSetup/ScreenConnect.WindowsCredentialProvider.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
AR Statement/File.ClientSetup/ScreenConnect.WindowsCredentialProvider.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
AR Statement/File.ClientSetup/ScreenConnect.WindowsFileManager.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
AR Statement/File.ClientSetup/ScreenConnect.WindowsFileManager.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral23
Sample
AR Statement/File.ClientSetup/ServiceExeWithService.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
AR Statement/File.ClientSetup/ServiceExeWithService.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
AR Statement/File.ClientSetup/ServiceExeWithoutService.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
AR Statement/File.ClientSetup/ServiceExeWithoutService.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 1ef0d443f06f9263f204dcafae1ab209fb766a1539c0d6354ecc6654394d4495
- Size 14.3MB
- Sample260803-ty96cstamf
- SHA256 1ef0d443f06f9263f204dcafae1ab209fb766a1539c0d6354ecc6654394d4495
- MD5 403bc195bac63435423461a8fcc3cb9e
- SHA1 81662647626814e306d9d9071740799567f37a40
- SHA512 6a761ac9ae8136e360f2dedafa889acfda31ab86ee4d8da98d89e3d3cb4bcdb917653bf591f88424b1f4d7360a06003725c5720837f7c6f578570d93e0b00b6c
- SSDEEP 393216:OBqGaXCIMujAvc39GcWeySaMGvEDCWHCl:O3J5u3WwPU
- TLSH T1AEE633DC032E208F6CBAD8DD6E7283DD7EC2ABEDD7A05618C114DE055B7846166236CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Revoked Certificate in Chain 6 IoCs
One or more certificates in the signing chain have been revoked, indicating potential compromise.
resource unpack001/AR Statement/File.ClientSetup/ScreenConnect.WindowsBackstageShell.exe unpack001/AR Statement/File.ClientSetup/ScreenConnect.WindowsClient.exe unpack001/AR Statement/File.ClientSetup/ScreenConnect.WindowsCredentialProvider.dll unpack001/AR Statement/File.ClientSetup/ScreenConnect.WindowsFileManager.exe unpack001/AR Statement/File.ClientSetup/ServiceExeWithService unpack001/AR Statement/File.ClientSetup/ServiceExeWithoutService - Signed with revoked ConnectWise certificate 6 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule static1/unpack001/AR Statement/File.ClientSetup/ScreenConnect.WindowsBackstageShell.exe revoked_cert_connectwise static1/unpack001/AR Statement/File.ClientSetup/ScreenConnect.WindowsClient.exe revoked_cert_connectwise static1/unpack001/AR Statement/File.ClientSetup/ScreenConnect.WindowsCredentialProvider.dll revoked_cert_connectwise static1/unpack001/AR Statement/File.ClientSetup/ScreenConnect.WindowsFileManager.exe revoked_cert_connectwise static1/unpack001/AR Statement/File.ClientSetup/ServiceExeWithService revoked_cert_connectwise static1/unpack001/AR Statement/File.ClientSetup/ServiceExeWithoutService revoked_cert_connectwise - Unsigned MSI 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AR Statement/File.ClientSetup.msi - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/AR Statement/File.ClientSetup/ScreenConnect.Client.dll unpack001/AR Statement/File.ClientSetup/ScreenConnect.ClientService.dll unpack001/AR Statement/File.ClientSetup/ScreenConnect.Core.dll unpack001/AR Statement/File.ClientSetup/ScreenConnect.Windows.dll - Untrusted Codesign Signers 6 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/AR Statement/File.ClientSetup/ScreenConnect.WindowsBackstageShell.exe unpack001/AR Statement/File.ClientSetup/ScreenConnect.WindowsClient.exe unpack001/AR Statement/File.ClientSetup/ScreenConnect.WindowsCredentialProvider.dll unpack001/AR Statement/File.ClientSetup/ScreenConnect.WindowsFileManager.exe unpack001/AR Statement/File.ClientSetup/ServiceExeWithService unpack001/AR Statement/File.ClientSetup/ServiceExeWithoutService
File Explorer
-
1ef0d443f06f9263f204dcafae1ab209fb766a1539c0d6354ecc6654394d4495.zip 14.3MB
-
AR Statement/AR Statement.js.js 6KB
-
AR Statement/File.ClientSetup.msi.msi 12.8MB
-
AR Statement/File.ClientSetup/Client.Override.en-US.resources227B
-
AR Statement/File.ClientSetup/Client.resources26KB
-
AR Statement/File.ClientSetup/ScreenConnect.Client.dll.dll 192KB
-
AR Statement/File.ClientSetup/ScreenConnect.ClientService.dll.dll 66KB
-
AR Statement/File.ClientSetup/ScreenConnect.Core.dll.dll 536KB
-
AR Statement/File.ClientSetup/ScreenConnect.Windows.dll.dll 1.6MB
-
AR Statement/File.ClientSetup/ScreenConnect.WindowsAuthenticationPackage.dll.dll 254KB
-
AR Statement/File.ClientSetup/ScreenConnect.WindowsBackstageShell.exe.exe 59KB
-
AR Statement/File.ClientSetup/ScreenConnect.WindowsBackstageShell.exe.config.xml 266B
-
AR Statement/File.ClientSetup/ScreenConnect.WindowsClient.exe.exe 588KB
-
AR Statement/File.ClientSetup/ScreenConnect.WindowsClient.exe.config.xml 266B
-
AR Statement/File.ClientSetup/ScreenConnect.WindowsCredentialProvider.dll.dll 822KB
-
AR Statement/File.ClientSetup/ScreenConnect.WindowsFileManager.exe.exe 79KB
-
AR Statement/File.ClientSetup/ScreenConnect.WindowsFileManager.exe.config.xml 266B
-
AR Statement/File.ClientSetup/ServiceExeWithService.exe 93KB
-
AR Statement/File.ClientSetup/ServiceExeWithoutService.exe 93KB
-
AR Statement/File.ClientSetup/app.config.xml 2KB
-
AR Statement/File.ClientSetup/system.config.xml 950B
AR Statement/AR Statement.js
- SHA256 990112dc9c2c6e10da4c546e46f8afcea844444dd31e5dfff8c8ae9b07575a5b
- MD5 729b7b79134094f33f6852460c3800e8
- SHA1 04d33031076c70715886525aeb5a9aeb73cf69b9
- SHA512 644a4daaff83dca55a1ad038cd31f2d1fefc8ff05a672b038ea2111cd8a29cd77b0b339e07df3d16f7c89dc8b63ae0df76abcb1bdb26c9c57a0824b02c68a66b
- SSDEEP 192:kl1Om1Ysn3FkrxR59RxL7NSfjpE4ODr4RXWE3ybcetvTUhmwVby:GFpnExRPBU1E4OO3JSUXy
- TLSH T169E122892FE06265162E1FBB7D7F92CCD16764DD688848AFF21069F05CD0232D9A1B35
- MD5 SHA1 SHA512 SSDEEP TLSH
AR Statement/File.ClientSetup.msi
- SHA256 f8d4db2294c4aa167f767de2e016b5498e7ccd1955002292769e50c9ca53c332
- MD5 996a4007aa678df3484d9a75b76516eb
- SHA1 215a8e5d66e86d399b15f623609f6c46ff9a7204
- SHA512 1e50031733b7ce6a3c3f6348b3f5bc25692aec709fd67fe46b0d375e24b84fe8cdad6568db7b296577240b1e338e2474b06be956c856f6f1fe21348be083cff2
- SSDEEP 196608:UWh0cGw4Wh0cGjWh0cGuWh0cGlWh0cGhWh0cG2Wh0cGI:UWacGWacmWaclWacSWac0Wac9WacZ
- TLSH T11FD6232523FD401AE8F74B79FE3682F46A72BE68DF21C11E5228790D1A74D4096727B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned MSI
Checks for missing Authenticode signature.
AR Statement/File.ClientSetup/Client.Override.en-US.resources
- SHA256 38bdcc2ec25e7464dde7293b5a6ec64eea4b9d9f6fb8c36fdcc5677a6f55b721
- MD5 dfd0bdff874bb29b508f15bdd35cb6a3
- SHA1 de772d64129e084d150d8087ccdac16ef97fb185
- SHA512 6addfae10478871085c796f2af5a11cd78088fc49b245df2229db7546973ff9a16785c72bf61f569e16a3e79f7f48ef8c1badb91313271d9515af3d3b4b759b0
- TLSH T1D7D0A726136C1075C5620E37241531C1172BD51D9038596D9894122C5FB22074F81A22
- MD5 SHA1 SHA512 TLSH
AR Statement/File.ClientSetup/Client.resources
- SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
- MD5 5cd580b22da0c33ec6730b10a6c74932
- SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
- SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
- SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
- TLSH T10BC2D0CA33BDED98E77E63BB7DE840701737BB017D6192126C060411613528AAEA8F4F
- MD5 SHA1 SHA512 SSDEEP TLSH
AR Statement/File.ClientSetup/ScreenConnect.Client.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
- MD5 3724f06f3422f4e42b41e23acb39b152
- SHA1 1220987627782d3c3397d4abf01ac3777999e01c
- SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
- SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
- TLSH T1DD144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
202902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb
mscoree
_CorDllMain
Name
.text
Size
190KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AR Statement/File.ClientSetup/ScreenConnect.ClientService.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
- MD5 5db908c12d6e768081bced0e165e36f8
- SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
- SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
- SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
- TLSH T1C2634A45A3E95E77C9DF5F7C7865B1410FB08A02E462FB989CC9A8D71A537C12E003AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
73914
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb
mscoree
_CorDllMain
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AR Statement/File.ClientSetup/ScreenConnect.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
- MD5 14e7489ffebbb5a2ea500f796d881ad9
- SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
- SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
- SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
- TLSH T12BC47D2233AC9A2EC56E133BB072915DC5F0E906351AF79F76C5E5BC2EC27450E112EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
553910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
534KB
Virtual Size
533KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AR Statement/File.ClientSetup/ScreenConnect.Windows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
- MD5 9ad3964ba3ad24c42c567e47f88c82b2
- SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
- SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
- SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
- TLSH T1DC85BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE396D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1727870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AR Statement/File.ClientSetup/ScreenConnect.WindowsAuthenticationPackage.dll
- IMPHASH 284fc219aff6fd22155390b3e61f4eb5
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
86:08:03:c5:a4:b0:fa:eb:e1:0e:b9:b7:4b:1b:f0:a6:61:7e:f2:a5:04:8d:db:52:af:70:e4:f1:78:09:04:75
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 28, 2024
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
86:08:03:c5:a4:b0:fa:eb:e1:0e:b9:b7:4b:1b:f0:a6:61:7e:f2:a5:04:8d:db:52:af:70:e4:f1:78:09:04:75
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=6401717,CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
May 28, 2024
SERIALNUMBER=6401717,CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=6401717,CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
SERIALNUMBER=6401717,CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0b:26:05:d4:f1:33:bf:4a:48:a2:ac:52:b3:11:03:60
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 30, 2024 - May 2, 2027
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:f8:ae:a0:bd:67:8b:63:ac:eb:00:00:00:00:00:f8
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e2:99:99:95:f1:dc:e3:20:eb:00:01:00:00:01:e2
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
35468
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb
kernel32
CloseHandle
GetLastError
GetModuleHandleExA
OutputDebugStringA
GetModuleFileNameA
WriteConsoleW
CreateFileW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
GetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetFilePointerEx
SetStdHandle
HeapSize
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
advapi32
AllocateLocallyUniqueId
GetSidSubAuthority
CreateWellKnownSid
IsWellKnownSid
GetLengthSid
GetTokenInformation
secur32
LsaGetLogonSessionData
LsaFreeReturnBuffer
LsaApCallPackage
LsaApCallPackagePassthrough
LsaApCallPackageUntrusted
LsaApInitializePackage
LsaApLogonTerminated
LsaApLogonUser
Name
.text
Size
151KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=154, id=261, version=30795,
count=16, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33218,
count=18, id=259, version=33218,
count=72, id=261, version=33218,
count=7, id=257, version=30795,
count=108, id=1, productName=Unmarked objects,
count=1, id=265, version=33523,
count=1, id=256, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
AR Statement/File.ClientSetup/ScreenConnect.WindowsBackstageShell.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e25f32ba3fa32fd0ddd99eb65b26835e30829b5e4b58573690aa717e093a5d8f
- MD5 afa97caf20f3608799e670e9d6253247
- SHA1 7e410fde0ca1350aa68ef478e48274888688f8ee
- SHA512 fe0b378651783ef4add3851e12291c82edccde1dbd1fa0b76d7a2c2dcd181e013b9361bbdae4dae946c0d45fb4bf6f75dc027f217326893c906e47041e3039b0
- SSDEEP 1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
- TLSH T1DE537D4063F84A26C9FE5E3AB4F1D2250AF1AA426451E7AE0ECD51E94E137C16F603F7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Signed with revoked ConnectWise certificate
Binary is signed using a ConnectWise certificate revoked for key compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
a9:58:05:d7:7c:10:ba:cf:2e:77:8f:33:ab:27:36:aa:ed:75:13:21:2a:42:20:e8:72:03:54:e8:ea:32:15:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
Chains
Oct 28, 2024
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
0b:93:60:05:1b:cc:f6:66:42:99:89:98:d5:ba:97:ce
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Aug 17, 2022
Timespan
Aug 17, 2022 - Aug 15, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
55302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb
mscoree
_CorExeMain
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AR Statement/File.ClientSetup/ScreenConnect.WindowsBackstageShell.exe.config
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
AR Statement/File.ClientSetup/ScreenConnect.WindowsClient.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
- MD5 1778204a8c3bc2b8e5e4194edbaf7135
- SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
- SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
- SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
- TLSH T168D46D2677B8DB6BC9EF073AB0B15E2457B0E8036686D78E48A4B5D90DC738149093F7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Signed with revoked ConnectWise certificate
Binary is signed using a ConnectWise certificate revoked for key compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
45:80:8e:46:fb:15:90:9b:04:7d:b6:7d:57:08:13:07:7a:cf:f2:e8:a3:46:40:8c:61:9e:fa:8c:68:15:ac:81
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
Chains
Oct 28, 2024
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
0b:93:60:05:1b:cc:f6:66:42:99:89:98:d5:ba:97:ce
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Aug 17, 2022
Timespan
Aug 17, 2022 - Aug 15, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
596386
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb
mscoree
_CorExeMain
Name
.text
Size
576KB
Virtual Size
575KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
956B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AR Statement/File.ClientSetup/ScreenConnect.WindowsClient.exe.config
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
AR Statement/File.ClientSetup/ScreenConnect.WindowsCredentialProvider.dll
- IMPHASH d989d6d9b30a82450695884c45b21f94
- SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
- MD5 be74ab7a848a2450a06de33d3026f59e
- SHA1 21568dcb44df019f9faf049d6676a829323c601e
- SHA512 2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc
- SSDEEP 12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
- TLSH T10C055C1BE79840B9D0ADC2B5D31B9636BBB6F4864514B68F07D40A227E2FF50AF1C394
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Signed with revoked ConnectWise certificate
Binary is signed using a ConnectWise certificate revoked for key compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
e6:14:6f:5b:dd:3a:f3:0e:6b:14:5f:30:af:85:94:d5:4f:6b:1c:27:36:21:56:0e:c8:f0:94:63:21:ad:2e:2d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
Chains
May 17, 2024
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
0b:93:60:05:1b:cc:f6:66:42:99:89:98:d5:ba:97:ce
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Aug 17, 2022
Timespan
Aug 17, 2022 - Aug 15, 2025
Minor OS version
0
Major OS version
6
Entry point
477420
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
screenconnect_windows_credential_provider.pdb
kernel32
ReadProcessMemory
OpenProcess
CreateNamedPipeW
GetLastError
WaitNamedPipeW
CreateFileW
IsDebuggerPresent
ConnectNamedPipe
GetCommandLineW
DuplicateHandle
LocalFree
ProcessIdToSessionId
Sleep
GetModuleHandleA
OutputDebugStringA
GetConsoleMode
GetCurrentProcess
FreeLibrary
GetConsoleOutputCP
LoadLibraryExA
WriteFile
GetProcAddress
GetProcessHeap
HeapAlloc
HeapFree
WaitForSingleObject
SetStdHandle
HeapSize
GetStringTypeW
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
LoadLibraryA
FindFirstFileExW
GetModuleHandleExW
RtlPcToFileHeader
RaiseException
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
FormatMessageW
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
CancelSynchronousIo
TlsGetValue
SetFilePointerEx
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStdHandle
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
InterlockedFlushSList
TerminateProcess
RtlUnwindEx
QueryPerformanceCounter
HeapReAlloc
lstrlenW
ReleaseMutex
SetFileInformationByHandle
GetFullPathNameW
FindNextFileW
FindClose
FlushFileBuffers
GetFileInformationByHandle
GetFileInformationByHandleEx
IsProcessorFeaturePresent
GetStartupInfoW
FindFirstFileW
GetFinalPathNameByHandleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileType
InitializeSListHead
GetCurrentThreadId
CloseHandle
ReleaseSRWLockExclusive
IsValidCodePage
AcquireSRWLockExclusive
CreateMutexA
WaitForSingleObjectEx
SetThreadStackGuarantee
GetModuleHandleW
FreeEnvironmentStringsW
GetModuleFileNameW
ExitProcess
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
GetCurrentThread
QueryPerformanceFrequency
GetSystemTimeAsFileTime
advapi32
CreateWellKnownSid
InitializeAcl
AddAccessAllowedAce
GetSidIdentifierAuthority
GetSidSubAuthority
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SystemFunction036
SetSecurityDescriptorOwner
ImpersonateLoggedOnUser
LookupAccountSidW
ConvertSidToStringSidW
RevertToSelf
crypt32
CertFreeCertificateContext
CryptHashCertificate
ole32
CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
gdi32
CreateDIBSection
SetDIBits
bcrypt
BCryptGenRandom
oleaut32
SysStringLen
SysAllocStringLen
SysFreeString
GetErrorInfo
SetErrorInfo
ntdll
NtWriteFile
NtReadFile
RtlNtStatusToDosError
DllGetClassObject
Name
.text
Size
532KB
Virtual Size
531KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
223KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=30795,
count=134, id=261, version=30795,
count=10, id=260, version=30795,
count=34, id=261, version=33218,
count=14, id=260, version=33218,
count=17, id=259, version=33218,
count=249, id=1, productName=Unmarked objects,
count=65, productName=Unmarked objects (old),
count=1, id=256, version=33523,
count=1, id=258, version=33523,
AR Statement/File.ClientSetup/ScreenConnect.WindowsFileManager.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ebd04a4540d6e76776bd58deea627345d0f8fba2c04cc65be5e979a8a67a62a1
- MD5 1aee526dc110e24d1399affccd452ab3
- SHA1 04db0e8772933bc57364615d0d104dc2550bd064
- SHA512 482a8ee35d53be907be39dbd6c46d1f45656046baca95630d1f07ac90a66f0e61d41f940fb166677ac4d5a48cf66c28e76d89912aed3d673a80737732e863851
- SSDEEP 1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
- TLSH T18883E68235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Signed with revoked ConnectWise certificate
Binary is signed using a ConnectWise certificate revoked for key compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
2a:54:04:a7:31:8a:de:50:46:73:2c:d6:b7:5b:cf:4b:16:32:e9:b1:22:c7:54:39:4f:8c:8e:a6:fe:d5:e9:d7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
Chains
Oct 28, 2024
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
0b:93:60:05:1b:cc:f6:66:42:99:89:98:d5:ba:97:ce
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Aug 17, 2022
Timespan
Aug 17, 2022 - Aug 15, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
24294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb
mscoree
_CorExeMain
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AR Statement/File.ClientSetup/ScreenConnect.WindowsFileManager.exe.config
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
AR Statement/File.ClientSetup/ServiceExeWithService
- IMPHASH 5f510e22d141c137199e2ff4021a57be
- SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
- MD5 75b21d04c69128a7230a0998086b61aa
- SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
- SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
- SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
- TLSH T1B7935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Signed with revoked ConnectWise certificate
Binary is signed using a ConnectWise certificate revoked for key compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
40:f0:d1:b7:27:a8:0a:62:58:82:1c:61:7b:29:08:72:eb:55:bb:70:05:9f:2e:d6:de:95:4e:c4:b8:d5:19:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
Chains
Oct 28, 2024
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
0b:93:60:05:1b:cc:f6:66:42:99:89:98:d5:ba:97:ce
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Aug 17, 2022
Timespan
Aug 17, 2022 - Aug 15, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
5
Entry point
8575
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb
mscoree
CorBindToRuntimeEx
shlwapi
StrCatW
PathFindFileNameW
StrCpyW
PathRemoveExtensionW
kernel32
SetEvent
CloseHandle
LoadLibraryW
DecodePointer
GetProcAddress
GetLastError
GetCurrentProcessId
GetModuleHandleW
SetStdHandle
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetCommandLineW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DeleteCriticalSection
RtlUnwind
GetFileType
GetProcessHeap
FreeEnvironmentStringsW
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateFileW
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetACP
HeapFree
HeapSize
HeapReAlloc
LCMapStringW
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
advapi32
RegisterServiceCtrlHandlerExW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
SetServiceStatus
RegSetValueExW
StartServiceW
RegCreateKeyW
StartServiceCtrlDispatcherW
OpenServiceW
RegOpenKeyW
oleaut32
VariantInit
SysFreeString
SysAllocString
SafeArrayPutElement
SafeArrayCreateVector
VariantClear
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=122, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=260, version=31616,
count=20, id=259, version=31616,
count=42, id=261, version=31616,
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=112, id=1, productName=Unmarked objects,
count=1, id=265, version=31630,
count=1, id=255, version=31630,
count=1, id=258, version=31630,
AR Statement/File.ClientSetup/ServiceExeWithoutService
- IMPHASH 5f510e22d141c137199e2ff4021a57be
- SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
- MD5 75b21d04c69128a7230a0998086b61aa
- SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
- SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
- SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
- TLSH T1B7935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Signed with revoked ConnectWise certificate
Binary is signed using a ConnectWise certificate revoked for key compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
40:f0:d1:b7:27:a8:0a:62:58:82:1c:61:7b:29:08:72:eb:55:bb:70:05:9f:2e:d6:de:95:4e:c4:b8:d5:19:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
Chains
Oct 28, 2024
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
0b:93:60:05:1b:cc:f6:66:42:99:89:98:d5:ba:97:ce
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Aug 17, 2022
Timespan
Aug 17, 2022 - Aug 15, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
5
Entry point
8575
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb
mscoree
CorBindToRuntimeEx
shlwapi
StrCatW
PathFindFileNameW
StrCpyW
PathRemoveExtensionW
kernel32
SetEvent
CloseHandle
LoadLibraryW
DecodePointer
GetProcAddress
GetLastError
GetCurrentProcessId
GetModuleHandleW
SetStdHandle
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetCommandLineW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DeleteCriticalSection
RtlUnwind
GetFileType
GetProcessHeap
FreeEnvironmentStringsW
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateFileW
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetACP
HeapFree
HeapSize
HeapReAlloc
LCMapStringW
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
advapi32
RegisterServiceCtrlHandlerExW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
SetServiceStatus
RegSetValueExW
StartServiceW
RegCreateKeyW
StartServiceCtrlDispatcherW
OpenServiceW
RegOpenKeyW
oleaut32
VariantInit
SysFreeString
SysAllocString
SafeArrayPutElement
SafeArrayCreateVector
VariantClear
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=122, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=260, version=31616,
count=20, id=259, version=31616,
count=42, id=261, version=31616,
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=112, id=1, productName=Unmarked objects,
count=1, id=265, version=31630,
count=1, id=255, version=31630,
count=1, id=258, version=31630,
AR Statement/File.ClientSetup/app.config
- SHA256 0e1363deb4a78ddb673919723bfbf3b31de2b2621df2f6bfd74c91aad899beca
- MD5 7780a776bd913d95a91a5896f10d9e43
- SHA1 06c858217ac01fd3897f5b77a75cf74203e0db54
- SHA512 932baa5595f3c8d55bc302c17e7748018ecc7426e74dacef8858664b2a5381d646d631128151423017a5b3af7bcfd9aa512f6c99d60954f3560978982c03e337
- TLSH T16B41931CB5C0AF9915726631EB3102D1EC6049331266B0E078DE3267AF70EDA4BF32E6
- MD5 SHA1 SHA512 TLSH
AR Statement/File.ClientSetup/system.config
- SHA256 ceef840968e7ea24c1864739991c1df5f2ffc2a71a0c754e485b532bf9a0ec52
- MD5 2a118abdad82f4ea678dfa310f1a85c3
- SHA1 fd26f7fce0ab62c24e9a9c856afb3e9a8db1ee1f
- SHA512 c5802333d00f3cff9385f2bcca5db16c727f8525a1919c229f83164e674b5d2591d34bccf664d2154fc75b538d53df9c5d3ea7ada6f9255b441bee8dbea87a71
- TLSH T19111D06035C4AA270A932B53CA124B44EF721A6B1846208C76BF323A4F319DA47939DE
- MD5 SHA1 SHA512 TLSH