2026-08-10_aa7b2c0a132ff215d3c09b03d4329c76_cloudeye_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_vidar
- IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
- SHA256 94d66cb314b615e3a8c430cd4ca70605d0a24520e3aeeda2c2eff1d74f86c458
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
-
NSIS installer
PE Signature issue
Digest
a1:76:2e:4c:fe:5f:b6:2d:01:38:9d:2f:0f:b6:d2:74:29:9d:97:ed:81:b3:21:02:67:4b:7b:28:c6:98:6c:99
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=U.S. MEDICAL SERVICES INC.,O=U.S. MEDICAL SERVICES INC.,L=CASTLE PINES,ST=Colorado,C=US
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=U.S. MEDICAL SERVICES INC.,O=U.S. MEDICAL SERVICES INC.,L=CASTLE PINES,ST=Colorado,C=US
Serial Number
33:00:04:9a:96:19:73:75:d9:1c:28:ba:dc:00:00:00:04:9a:96
Issuer
CN=Microsoft ID Verified CS EOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Oct 2, 2025
Timespan
Oct 2, 2025 - Oct 5, 2025
Subject
CN=Microsoft ID Verified CS EOC CA 01,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:06:4a:1a:fa:cf:05:61:6a:74:00:00:00:00:00:06
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 1, 2021 - Apr 1, 2036
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7B1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:4f:34:b5:07:c1:2b:97:54:fc:00:00:00:00:00:4f
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 27, 2025 - Feb 26, 2026
Minor OS version
0
Major OS version
4
Entry point
12559
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,