2026-08-23_f54749a953b9fa774dacbbeb86f2cca3_icedid_njrat_ryuk
- IMPHASH e4608ac9ca2a79d406a6f8011056cbdd
- SHA256 ee50a1c82df3d3f9928dcf8c07ffcab6a57bc7b4e21f50de809ea9df4d9a024b
Digest
4d:11:d8:d8:70:c4:9b:11:fb:73:52:6b:2b:38:e3:17:bf:b6:25:7a:b5:4b:b7:7d:d4:d1:8b:4f:3e:5f:86:bd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91110000101967333M,CN=Beijing VRV Software Corporation Limited.,O=Beijing VRV Software Corporation Limited.,STREET=海淀区中关村南大街34号中关村科技发展大厦C座1602室,L=北京,ST=北京,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
PE Signature issue
Digest
e0:6b:8d:f1:47:dd:25:82:27:f0:c9:1e:84:b9:c8:1a:bd:59:9e:a5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Beijing VRV Software Corporation Limited.,O=Beijing VRV Software Corporation Limited.,ST=北京市,C=CN
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=Beijing VRV Software Corporation Limited.,O=Beijing VRV Software Corporation Limited.,ST=北京市,C=CN
Serial Number
0d:be:ca:28:52:43:84:15:36:73:6b:19:2e:d0:f1:f6
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 7, 2020 - Sep 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=91110000101967333M,CN=Beijing VRV Software Corporation Limited.,O=Beijing VRV Software Corporation Limited.,STREET=海淀区中关村南大街34号中关村科技发展大厦C座1602室,L=北京,ST=北京,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
47:8e:35:21:07:49:e6:d7:1a:0b:c2:05
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 6, 2020 - May 1, 2023
Subject
CN=GlobalSign TSA for Advanced - G2
Serial Number
0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2018 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 2, 2011 - Mar 29, 2029
Minor OS version
0
Major OS version
6
Entry point
59864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\Desktop\npcap\packetWin7\NPFInstall\x64\Release\NPFInstall.pdb
Name
.text
Size
187KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
228B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=241, version=40116,
count=151, id=243, version=40116,
count=14, id=242, version=40116,
count=2, id=261, version=23013,
count=8, id=259, version=24123,
count=38, id=261, version=24123,
count=21, id=260, version=24123,
count=3, id=206, version=65501,
count=21, id=203, version=65501,
count=184, id=1, productName=Unmarked objects,
count=13, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,