gh_2.97.0_windows_amd64.zip
- SHA256 35d7fe05c4dd1411ffda1e73dfc7c6f44b75c936ca51fa6595c657fdc0350cec
Static task
static1
Behavioral task
behavioral1
Sample
bin/gh.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
bin/gh.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target gh_2.97.0_windows_amd64.zip
- Size 14.2MB
- Sample260816-w15d1avbpg
- SHA256 35d7fe05c4dd1411ffda1e73dfc7c6f44b75c936ca51fa6595c657fdc0350cec
- MD5 9d0861e20df430cb2e1aa2be9e28a32a
- SHA1 0a67a25d4bd114046b0ebb759b2feea970da963d
- SHA512 8f9e9ee5784e9b301167e456f6b59e43bf6c32635147de4cb7a871885297c61ccdfe143122a5f72949c8d8acabf9aa46bddf94c968a3b2c91f83d3994cf39e07
- SSDEEP 393216:6HxSKYZgOZ4mE391iy52S1aUeWDh2gn2JXso6a2hhTXSZ8:kxzYZ+J9YyUDUJDh72JX4VSZ8
- TLSH T110E633A208F5EE5C868D1EDF87C07D5BE5B3DE2930E21354E8BB122BCAF54A653D0944
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
gh_2.97.0_windows_amd64.zip.zip 14.2MB
-
LICENSE1KB
-
bin/gh.exe.exe 39.8MB
LICENSE
- SHA256 8999137010582da29456c10e0a628bf3fa7ead05ab3ae5f424ad25cd0dd94574
- MD5 52f67637e4b210e4f16270ad3436ddf3
- SHA1 cff8f7decbe2f10e819d87dcc620ed403e0d3a45
- SHA512 db575e35e2370d1f35c4206ee5c4e662965b05aa4e514df288d2a7a2fea1445bbdac32e7bcc4500fbf77cec562eb6256993571ab661412ec73ce59df09bf9772
- TLSH T1C111861E729503631892576155A9ECC5F12BB14A7F6F1584346DF2091326458C5FFC64
- MD5 SHA1 SHA512 TLSH
bin/gh.exe
- IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
- SHA256 e2efa10a5d2ce93cac9bc4b676932b62947c0967c01c8f2c3a9cb4437ad358d3
- MD5 f0cc29de676806eb691a7a13d36cdfe1
- SHA1 194f39e80434ff6ba05ee59448d40406ca864088
- SHA512 f0a0a0787ddca2742041126ffd5fbaa5aefc3fac319fa354d474bc8b3ca4daafe7db8fa8bcbfc8d501935bc059219116fea14a006ab4502b907ef3ff5bdc4a67
- SSDEEP 196608:W5poDJ2uwILLHE8NwIBvYorLOg4nkkAvD9nfakx3Fv9kFj:W7o9k8uZ5g4nLABniK9Mj
- TLSH T15D973943F8A50CE5D4ADC935C56286137F627CA9872423C77B58FA206F3ABD096BB350
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9c:a3:f5:e4:fa:0c:92:27:80:08:c4:37:6c:a0:5c:ac:f2:64:e5:87:d1:2e:06:2a:fb:d5:cb:d2:ea:55:26:63
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=GitHub\, Inc.,O=GitHub\, Inc.,L=San Francisco,ST=California,C=US
Chains
Jul 31, 2026
CN=GitHub\, Inc.,O=GitHub\, Inc.,L=San Francisco,ST=California,C=US
CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=GitHub\, Inc.,O=GitHub\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
33:00:04:00:c8:79:c3:bd:e0:2d:24:ae:22:00:00:00:04:00:c8
Issuer
CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 29, 2026 - Aug 1, 2026
Subject
CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:16:31:92:8d:92:02:65:7b:9a:00:00:00:00:00:16
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 26, 2026 - Mar 26, 2031
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 1, 2021 - Apr 1, 2036
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:24:d3:95:e0:a2:e9:c9:31:00:00:00:00:00:57
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 23, 2025 - Oct 22, 2026
Minor OS version
1
Major OS version
6
Entry point
578560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetProcAddress
LoadLibraryExW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
16.9MB
Virtual Size
16.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20.8MB
Virtual Size
20.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.4MB
Virtual Size
33.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
416KB
Virtual Size
415KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
358KB
Virtual Size
358KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ