wire[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wire.exe
Size 343KB
Sample260814-xva4msgk6w
SHA256 6729c71328ce8498c26e6a46b7ba2fe84c611814d92703bdc2c1ebb7339d43fd
MD5 3d96f407857914c19b2cc48c9d54238e
SHA1 b3df3fc61edf024546954659a68042d7bb2dff33
SHA512 1a92713182a8165ef84c02801fc12ebcedf9917ea712b4a1467d788d6219ff50a811ba6fb0b05ca14bd08ed66401d6e916b1629b4d6e3ea44fabe0627ae37859
SSDEEP 6144:tZMJkE3mH7mubOw4uT795LnMNto67whLgLeEN7ShMks5JgMuFxTOrYqAOY4BuJLZ:tZMy/H7mubf4uTX+N7whAeQPuFxTOrYH
TLSH
T15874B0127AC1E032D9B101705FA9DB25967EAC300F6159EBA3D47A2E9F306D1DA31F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
wire.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
wire.exe

File Explorer

wire.exe

.exe 343KB

wire.exe

IMPHASH b8180d09e11cc2eabba9d2ec5570f101
SHA256 6729c71328ce8498c26e6a46b7ba2fe84c611814d92703bdc2c1ebb7339d43fd
MD5 3d96f407857914c19b2cc48c9d54238e
SHA1 b3df3fc61edf024546954659a68042d7bb2dff33
SHA512 1a92713182a8165ef84c02801fc12ebcedf9917ea712b4a1467d788d6219ff50a811ba6fb0b05ca14bd08ed66401d6e916b1629b4d6e3ea44fabe0627ae37859
SSDEEP 6144:tZMJkE3mH7mubOw4uT795LnMNto67whLgLeEN7ShMks5JgMuFxTOrYqAOY4BuJLZ:tZMy/H7mubf4uTX+N7whAeQPuFxTOrYH
TLSH
T15874B0127AC1E032D9B101705FA9DB25967EAC300F6159EBA3D47A2E9F306D1DA31F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5a:dc:0a:d4:a2:80:77:e9:11:3c:0e:55:5b:07:68:15:91:01:d2:85:2f:2c:25:2e:21:ea:ce:df:f3:06:3e:cd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=13720448,CN=WEILAI NETWORK TECHNOLOGY CO.\, LIMITED,O=WEILAI NETWORK TECHNOLOGY CO.\, LIMITED,L=London,ST=London,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 11, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

03:a9:18:8a:a5:10:c0:f8:34:34:26:bf

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Jul 14, 2026

Timespan

Apr 26, 2023 - Apr 26, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

119534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\job\jumpservice\jumpservice\lib\wire.pdb

kernel32

LeaveCriticalSection InitializeCriticalSection SetFilePointer CreateFileW GetCurrentThreadId WriteFile WaitForSingleObject CreateEventW SetEvent WideCharToMultiByte EnterCriticalSection DeleteCriticalSection GetLastError CloseHandle GetConsoleMode GetConsoleOutputCP FlushFileBuffers MultiByteToWideChar EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW GetTimeZoneInformation HeapFree HeapAlloc GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize WriteConsoleW

advapi32

SetServiceStatus StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW

wire

Start_auto_num Stop_auto

Sharing

General

Malware Config

Signatures

File Explorer

wire.exe

PE Signature issue

kernel32

advapi32

wire

generic