WatchDogs2[.]exe | Triage™

General

Target
WatchDogs2.exe
Size 524KB
Sample260805-xpws6ade72
SHA256 dbc465877dd69f9b2c97b6004d713fc2c2166298514af516aee8bf2fbd0a97f3
MD5 5f6c9078d1d32cb5b20882f99a810547
SHA1 7c5f7238ca9a62e3e750106057c707b2161c12ba
SHA512 3374172e6d0f30c2b91e160fec0fa44b9e7cf505368a53765aaa414731e29e31d04b53e5269e32dd837c642a7d92f0d3264dae398ac17c7c5519b41af9021efb
SSDEEP 12288:ber/5tX2M/qba+Jq3V8JZP+mALcdYJ0MAEe//:qrB92M/qbDhALcRMRe//
TLSH
T179B412D9769C70C3E00214BE6FF6897A3D29BC76E1061C466C61BE2D0479287A937FC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

WatchDogs2.exe

.exe 524KB

WatchDogs2.exe

IMPHASH f6af9f0661d81308157217ca4e6263c1
SHA256 dbc465877dd69f9b2c97b6004d713fc2c2166298514af516aee8bf2fbd0a97f3
MD5 5f6c9078d1d32cb5b20882f99a810547
SHA1 7c5f7238ca9a62e3e750106057c707b2161c12ba
SHA512 3374172e6d0f30c2b91e160fec0fa44b9e7cf505368a53765aaa414731e29e31d04b53e5269e32dd837c642a7d92f0d3264dae398ac17c7c5519b41af9021efb
SSDEEP 12288:ber/5tX2M/qba+Jq3V8JZP+mALcdYJ0MAEe//:qrB92M/qbDhALcRMRe//
TLSH
T179B412D9769C70C3E00214BE6FF6897A3D29BC76E1061C466C61BE2D0479287A937FC6
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

e0:07:4c:13:1b:b4:0a:fd:3b:2d:e6:98:2c:c9:f7:c7:cf:0c:7d:24:b5:9f:98:76:bc:90:85:77:a6:6f:78:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Blue Byte GmbH,OU=IT,O=Blue Byte GmbH,L=Düsseldorf,ST=Nordrhein-Westfalen,C=DE

Chains

Jul 25, 2017

CN=Blue Byte GmbH,OU=IT,O=Blue Byte GmbH,L=Düsseldorf,ST=Nordrhein-Westfalen,C=DE

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Blue Byte GmbH,OU=IT,O=Blue Byte GmbH,L=Düsseldorf,ST=Nordrhein-Westfalen,C=DE

Serial Number

7f:91:17:af:f8:17:55:29:ec:4a:25:11

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 23, 2017 - Apr 10, 2020

Minor OS version

0

Major OS version

6

Entry point

5488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

K:\bin\WatchDogs2.pdb

WatchDogs2.exe

shlwapi

msvcr110

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

WatchDogs2.exe

shlwapi

msvcr110

kernel32

generic