0B4kiiFQ[.]exe | Triage™

Resubmissions

04/08/2026, 02:40

260804-c58gnsbg343

15/06/2023, 13:13

230615-qgasdshc591

Sharing

Copy URL Twitter E-mail

General

Target
0B4kiiFQ.exe
Size 1.0MB
Sample260804-c58gnsbg34
SHA256 6725494dce5cd19e3e690cf9066d0a4b3463d92ee2bd2430c3c56fdad34f26da
MD5 10aef60119757c2878de95048445d824
SHA1 0a4913b21e1caabed3ecdf8c7538dd4d4629f3b4
SHA512 66238462a25141931d0335954bb2cd9e8082ed02ee83e04398c48a7128e8de0f486834c834deef613149b28c30b3cfdb928777ee4e26dea7759874ae8b998388
SSDEEP 24576:xst76ubD7XOXwTiXxjSgJdSXgvELGwpKiiyHI:6B72wTihjSgFveBG
TLSH
T1FB351A47E7A721E9D876D0388593233AF9B078688334DFD793944A160B32BF4A63E754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
0B4kiiFQ.exe

File Explorer

0B4kiiFQ.exe

.exe 1.0MB

0B4kiiFQ.exe

IMPHASH 253aab0ff4cd840a76c3f83b60641128
SHA256 6725494dce5cd19e3e690cf9066d0a4b3463d92ee2bd2430c3c56fdad34f26da
MD5 10aef60119757c2878de95048445d824
SHA1 0a4913b21e1caabed3ecdf8c7538dd4d4629f3b4
SHA512 66238462a25141931d0335954bb2cd9e8082ed02ee83e04398c48a7128e8de0f486834c834deef613149b28c30b3cfdb928777ee4e26dea7759874ae8b998388
SSDEEP 24576:xst76ubD7XOXwTiXxjSgJdSXgvELGwpKiiyHI:6B72wTihjSgFveBG
TLSH
T1FB351A47E7A721E9D876D0388593233AF9B078688334DFD793944A160B32BF4A63E754
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

12:dd:6a:30:3e:09:ec:5f:e9:c9:22:ea:dc:f2:5d:44:4c:c3:7c:e6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=22178368,CN=Micro-Star International CO.\, LTD.,O=Micro-Star International CO.\, LTD.,L=Zhonghe District,ST=New Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 18, 2023

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

Serial Number

02:45:3a:c8:86:a0:1b:7e:6a:aa:18:42:9a:18:4a:62

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 21, 2021 - May 7, 2024

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Minor OS version

Major OS version

Entry point

355084

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwindEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EnterCriticalSection LeaveCriticalSection HeapFree IsValidCodePage GetACP GetOEMCP GetCPInfo IsDebuggerPresent IsProcessorFeaturePresent SetConsoleCtrlHandler FreeLibrary LoadLibraryExW OutputDebugStringW HeapAlloc HeapReAlloc GetStringTypeW HeapSize MultiByteToWideChar CompareStringW LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW CloseHandle CreateFileW AreFileApisANSI GetProcAddress GetModuleHandleExW ExitProcess OutputDebugStringA GetLocalTime CreateDirectoryA CreateFileA GetExitCodeProcess CreateProcessA GetFirmwareEnvironmentVariableA SetFirmwareEnvironmentVariableA GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleInputA SetConsoleMode RtlPcToFileHeader RaiseException ReadFile ReadConsoleW DeleteFileW FindClose FindFirstFileExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation WaitForSingleObject GetFileAttributesExW FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetFullPathNameW GetCurrentDirectoryW SetEnvironmentVariableA SetEndOfFile GetFullPathNameA DecodePointer EncodePointer GetCurrentThreadId SetLastError GetLastError GetCommandLineA GetSystemDirectoryA GetWindowsDirectoryA LoadLibraryA GetCurrentDirectoryA DeleteFileA CreateMutexA GetVersionExA GetModuleHandleA SetProcessAffinityMask SetThreadExecutionState CreateThread LocalFree GetSystemFirmwareTable DeviceIoControl CreateNamedPipeA

advapi32

StartServiceA OpenSCManagerA DeleteService CreateServiceA ControlService CloseServiceHandle RegOpenKeyExA LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken OpenServiceA

shell32

ShellExecuteA

user32

ExitWindowsEx SystemParametersInfoA BlockInput GetMessageA TranslateMessage DispatchMessageA DefWindowProcA RegisterClassExA CreateWindowExA MessageBoxA wsprintfA

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

0B4kiiFQ.exe

kernel32

advapi32

shell32

user32

generic