MultiKey_18.1.1_x64.zip
- SHA256 34eee0d09ad45cd0d65e37fbc6f710ed153a54904205f5cfe1cdf241545f7baf
Resubmissions
16/09/2026, 21:34
260916-1e49bswbpc29/06/2026, 10:19
260629-mcm1dacx8p29/05/2026, 14:02
260529-rceq8aes3m15/05/2026, 23:59
260515-31wkescs5m28/03/2026, 12:39
260328-pv1qasat3t23/03/2026, 16:05
260323-tjg62aas4j22/02/2026, 18:46
260222-xe5cjsex7e01/02/2026, 17:15
260201-vsyqtaav6h01/02/2026, 17:03
260201-vkww9aat2f07/01/2026, 22:28
260107-2dzsws1nhqStatic task
static1
3 signatures
General
- Target MultiKey_18.1.1_x64.zip
- Size 19.3MB
- Sample260916-1e49bswbpc
- SHA256 34eee0d09ad45cd0d65e37fbc6f710ed153a54904205f5cfe1cdf241545f7baf
- MD5 b7d7159b2009efe022a13a2230776204
- SHA1 de42e42880615597a9286671052f8010089e5231
- SHA512 89edaa7c86d668fec2e111f8ff234e9928066469b7a989245a532bedf470f6e3fd80af9744e7e6eb3e5e24b68acb467ec98091cc2bf6a366673420bf8a3c450a
- SSDEEP 393216:NpyCw93hn6ZRSsxaaQTHvP7vOqBGbtYnBsRwTeg+DXl0rrk/kkoYe0:NBwth6ZRrfQrvPzO2GbtYnBsI5+08kkb
- TLSH T1D11733A79D2EF52F3C05C656F2341A4E41E81706B3D0F01BE3EE0ADEA6536852339D5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned MSI 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MultiKey_18.1.1_x64/haspdinst.msi - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MultiKey_18.1.1_x64/bcdedit.exe - Untrusted Codesign Signers 3 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/MultiKey_18.1.1_x64/CertMgr.exe unpack001/MultiKey_18.1.1_x64/Devcon.exe unpack001/MultiKey_18.1.1_x64/MulttKey.sys
File Explorer
-
MultiKey_18.1.1_x64.zip.zip 19.3MB
-
MultiKey_18.1.1_x64/CertMgr.exe.exe 75KB
-
MultiKey_18.1.1_x64/Devcon.exe.exe 83KB
-
MultiKey_18.1.1_x64/GlobalSign Root.cer785B
-
MultiKey_18.1.1_x64/MasterCAM_185221_hasp_dealer.reg13KB
-
MultiKey_18.1.1_x64/MulttKey.cat10KB
-
MultiKey_18.1.1_x64/MulttKey.inf1KB
-
MultiKey_18.1.1_x64/MulttKey.sys.sys 75KB
-
MultiKey_18.1.1_x64/SolidCAM.reg1KB
-
MultiKey_18.1.1_x64/bcdedit.exe.exe 338KB
-
MultiKey_18.1.1_x64/haspdinst.msi.msi 19.6MB
-
MultiKey_18.1.1_x64/install.cmd521B
-
MultiKey_18.1.1_x64/remove.cmd1KB
-
MultiKey_18.1.1_x64/restart.cmd55B
MultiKey_18.1.1_x64/CertMgr.exe
- IMPHASH 87a243a257c7f81cc72105e9fe6911b4
- SHA256 460f33be67797f80c8842160ccfbfd8fbd714e08c08c6dcec0c08fb1fef8b0f6
- MD5 b5aa0d4d656b222115b213c26a5ef83b
- SHA1 f0e9f3aef239ab6f9fe3b07ad4a0e9c2baafcc1c
- SHA512 a955733098c9ab3c088e70daa011d793b317e001f193e51f9385bf9507ee0581901347cf8f82cfdbb14a85a7ec9a4211aa868beebdfc5e5f6b4349c8f1d86c4b
- SSDEEP 1536:ey6Y9om7pIViCuMU+n5kijLIFW1D25yRUyumdYw+WXsA9iYzvnq5:2upIVixM6Iv1YyCyumdt+WXsozq5
- TLSH T1CF73B41163FC0048F5F76AB99AB2A525CE73BC502F31C69F0398919D0F73BA1897572A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
89:48:a8:09:b4:78:d4:bb:ab:e3:98:19:8e:fa:8c:d4:e3:ad:71:d4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 15, 2009
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:27:81:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2008 - Jan 22, 2010
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:94:2d:00:00:00:00:00:09
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
1
Major OS version
6
Entry point
41512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
CertMgr.pdb
advapi32
CryptAcquireContextA
CryptReleaseContext
kernel32
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetFileSize
MapViewOfFile
WideCharToMultiByte
CreateFileW
Sleep
GetSystemTime
MultiByteToWideChar
CompareFileTime
SystemTimeToFileTime
FileTimeToLocalFileTime
CloseHandle
HeapSetInformation
GetModuleHandleA
SetLastError
CreateFileMappingA
GetLastError
FileTimeToSystemTime
UnmapViewOfFile
WriteFile
msvcrt
malloc
?terminate@@YAXXZ
memset
memcpy
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_wtol
towupper
realloc
_wasctime
_vsnwprintf
printf
strtok
wprintf
scanf
free
_wcsicmp
vwprintf
memcmp
user32
LoadStringA
LoadStringW
crypt32
CertAddCTLContextToStore
CertDeleteCRLFromStore
CryptMsgClose
CertDeleteCertificateFromStore
CryptDecodeObject
CertEnumCertificateContextProperties
CertRDNValueToStrA
CryptFreeOIDFunctionAddress
CryptStringToBinaryA
CryptSIPLoad
CertFreeCRLContext
CryptGetOIDFunctionAddress
CertAddEncodedCertificateToStore
CertOpenStore
CertGetPublicKeyLength
CertFreeCertificateContext
CertFindCTLInStore
CertAddCertificateContextToStore
CryptSIPRetrieveSubjectGuid
CertFindCertificateInStore
CertCloseStore
CryptInstallOIDFunctionAddress
CertGetCRLFromStore
CertAddEncodedCTLToStore
CertGetCRLContextProperty
CryptMsgUpdate
CertGetCertificateContextProperty
CertEnumCTLsInStore
CertGetCTLContextProperty
CertEnumCertificatesInStore
CertDuplicateCRLContext
CertFreeCTLContext
CryptInitOIDFunctionSet
CryptMsgGetParam
CertDuplicateCertificateContext
CertAddCRLContextToStore
CertDuplicateCTLContext
CryptHashPublicKeyInfo
CertSetCertificateContextProperty
CryptEncodeObject
CryptMsgGetAndVerifySigner
CertSaveStore
CertAddEncodedCRLToStore
CertDeleteCTLFromStore
CryptMsgOpenToDecode
CertRDNValueToStrW
CryptStringToBinaryW
CryptFindOIDInfo
cryptui
CryptUIDlgCertMgr
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
290B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=169, id=1, productName=Unmarked objects,
count=64, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
MultiKey_18.1.1_x64/Devcon.exe
- IMPHASH da57f1f45971374acef79d6f22a034f3
- SHA256 d03d78e356fe378bc71b1a6abc178fa24c9659aa397b71c36437340693cb5495
- MD5 63e1ce5d67e03c7e2aae73a372895dfc
- SHA1 e5c735ac08601166975df94e5104f529d62a5916
- SHA512 bdf8a7f2abb8f4b989f4a8ab4d1c5eff9694a2408318d0aff184f6e81e6fd7435ef2c636c0a83f9b34647e537c94d8a66582f97892e7a86b21cdbc347e143f37
- SSDEEP 768:oNzEAAwFR1A/guQi2QVoh1Ad5VWQlqTSxOp3JAiFJptHyX82BSOe9oKSJ2SLD0Bc:KEARA/guQpNe4TSxOp3e4ptHyXF4O7Ws
- TLSH T11983D80223E84659F2F77A346AB552215E777C91AE3CC68E029C911D0FE3E90DC74BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
21:ed:5e:f8:3b:bc:d4:65:12:ed:3d:64:34:92:83:05:f1:76:b2:30
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=GlobalSign
Chains
Jun 12, 2016
CN=GlobalSign
Subject
CN=GlobalSign
Serial Number
17:53:e3:6a:60:a8:f7:a0:4c:0b:5e:4c:78:fc:2b:14
Issuer
CN=GlobalSign
Timespan
Jun 3, 2016 - Dec 31, 2039
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 3, 2015 - Mar 3, 2026
Minor OS version
3
Major OS version
6
Entry point
28380
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
devcon.pdb
advapi32
OpenProcessToken
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateSystemShutdownExW
RegCloseKey
CloseServiceHandle
OpenSCManagerW
OpenServiceW
RegDeleteValueW
RegSetValueExW
kernel32
GetCurrentProcess
FormatMessageW
lstrlenW
GetLastError
CloseHandle
LocalFree
GetDateFormatW
FreeLibrary
LoadLibraryW
FileTimeToSystemTime
GetProcAddress
GetFullPathNameW
FindFirstFileW
GetFileAttributesW
FindClose
FindNextFileW
GetWindowsDirectoryW
Sleep
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
msvcrt
wcschr
_wcsicmp
towlower
_wcsnicmp
fputs
__iob_func
wcsrchr
fputws
?terminate@@YAXXZ
memset
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wprintf
??2@YAPEAX_K@Z
towupper
??3@YAXPEAX@Z
iswalpha
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ole32
CLSIDFromString
setupapi
SetupScanFileQueueW
SetupDiGetClassDevsExW
SetupDiGetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiClassNameFromGuidExW
CM_Reenumerate_DevNode_Ex
SetupCopyOEMInfW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetINFClassW
CM_Disconnect_Machine
SetupDiBuildClassInfoListExW
SetupDiCreateDeviceInfoW
SetupDiCreateDeviceInfoList
CM_Connect_MachineW
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
SetupDiBuildDriverInfoList
SetupDiGetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiSetSelectedDriverW
SetupGetStringFieldW
CM_Get_Res_Des_Data_Size_Ex
SetupDiEnumDriverInfoW
CM_Free_Log_Conf_Handle
CM_Get_Device_ID_ExW
CM_Get_Next_Res_Des_Ex
SetupCloseFileQueue
SetupDiGetDriverInstallParamsW
CM_Get_Res_Des_Data_Ex
SetupDiOpenClassRegKeyExW
SetupCloseInfFile
SetupOpenFileQueue
SetupDiCallClassInstaller
SetupDiDestroyDriverInfoList
SetupOpenInfFileW
CM_Free_Res_Des_Handle
CM_Get_First_Log_Conf_Ex
SetupDiSetDeviceInstallParamsW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW
SetupDiGetClassDescriptionExW
SetupDiClassGuidsFromNameExW
SetupDiOpenDeviceInfoW
SetupDiGetDeviceInfoListDetailW
SetupDiCreateDeviceInfoListExW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
user32
CharNextW
CharPrevW
LoadStringW
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
460B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=205, version=65501,
count=65, id=206, version=65501,
count=16, id=207, version=65501,
count=15, id=203, version=65501,
count=176, id=1, productName=Unmarked objects,
count=3, id=211, version=65501,
count=1, id=126, version=50727,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
MultiKey_18.1.1_x64/GlobalSign Root.cer
- SHA256 9e5b560b19ac62646d836e518b16543c7ba676dd7d371bf4256e35df2fa190b3
- MD5 0e5fbd477172ad4a8391f6871009336a
- SHA1 ba3e53c9d3710d9a8ed0efbc5b4019a196eb15f0
- SHA512 62b805f0c160110bebbe32c0bce595e05fd71245dfa9d04c4cc0e8ab120f5558e199ae6b6ad450d27a769eac55d95a43591a1e2e6b17aec5f392ec13ff2b4f4a
- TLSH T1CB01C5AF8E35980536089C1895E18C6B4A2CD8A0016A34B1A03CC1E47429BE8021842E
- MD5 SHA1 SHA512 TLSH
MultiKey_18.1.1_x64/MasterCAM_185221_hasp_dealer.reg
- SHA256 89a9f81635993e6da3e48ccba41f66660cf41c0481008d8882531ef148fd3202
- MD5 b1c314b2f8431a12b421eeccd8984cba
- SHA1 f65d81d3d98811ad68be3d2cc03138bae14dc838
- SHA512 31d79bc415c7649aa0941a6a9fd609aeb5078c6e0cdac44db4814a3b66dbd83cca958fbfcd46e5d23a46a703360e952ced03117f3247b3415a73d84ed1b82c1b
- SSDEEP 192:fwYsFM20qI6pOrjpaU0QipOeWnpaSTkIfuDdQUi8ygf6bBaXhGIB7JQgFpZveY/l:UFVbWrkU0Ge1MLXgfDhGINqgFXmobx
- TLSH T17D529C3ACFA5152B81738D79CEF751A3FE562803322DDC4A44C737850D93A8A78A635E
- MD5 SHA1 SHA512 SSDEEP TLSH
MultiKey_18.1.1_x64/MulttKey.cat
- SHA256 fb30676ba2b900bfd57d57e7412b3987177d58f16896ab4c93fa03b459c10485
- MD5 14288a0a86e4263f2bf5538ceb6780bf
- SHA1 21356518cfc33720f60f4b7ed2de9776124c9aa1
- SHA512 51ece5a8f41b4043dc9a2cf41a05f25e617214f54a6b3a8d1fd6a009b8ae387019100faee48a5abf044c36813a76596b4707a9a80735f238b5fec5cac25bb1dd
- SSDEEP 192:8sWh7IFJ6+ebCf6wQpkqs1I5Zgjln9MFnAvlBXd/N547cgoMa7r657lZaAPd:8zm8bCz1M6jMFclB5N2tT
- TLSH T1DE2209EB161D1062AD87CF5095D9E5969F71F382ADC8B18E617A88951E86BF0372C00F
- MD5 SHA1 SHA512 SSDEEP TLSH
MultiKey_18.1.1_x64/MulttKey.inf
- SHA256 3f09ea4df9543b34bbf07739796674dc15094cabf7c324bc17594d4ec59090da
- MD5 4f057869153e848ac3d8f191b5131b5f
- SHA1 6f47a9ff5f1659d34dbae59e569ee544c1cd2a6a
- SHA512 daffdf813b01e91a58ea8100c863f4db8897d57cf469780b696b2e32afb6c71fe49952562c8dacbcf943f682074baf49b37b889753ce36abd114c8acc0f246d8
- TLSH T1B221E04D41A70A9B5467952A2B5F65C3F40C3188F9943C5CB5EC432D4F44F2BA36D2BA
- MD5 SHA1 SHA512 TLSH
MultiKey_18.1.1_x64/MulttKey.sys
- IMPHASH 40bc7c96a49b823ba43d53770f0440e2
- SHA256 2669bfebe9c46d93a1fce43b07200265cc95008f819300e6e87c232a2901b7e1
- MD5 457c6d50e9035f05a78528412d840b72
- SHA1 a8683815b7f98f4f975a6476c691b8ab2156a3b0
- SHA512 f83aba205906917b8a9c7b91b14ba34d7aa2012001b91e21b5c8099ea9dd39d8de5ff9dc73d2ed5c8d45fcc911358f66dddd4618d9dd932c44dd5280d46ba668
- SSDEEP 1536:kICS4AZJnvrvUcveb5sAOcWCLG6tB0Ti2CxDMws:f3JnvrvH+sAOcWWG6tuuLop
- TLSH T155735B97A2D849B3C69A8378C5D05E56EBBCF54C0760B3FBA184C9522A077F83D7C618
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
ec:e6:82:ca:8a:70:a4:39:44:ff:69:b5:4d:7a:1a:1a:b9:7d:16:5d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=HT Srl,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=HT Srl,L=Milan,ST=Italy,C=IT
Chains
Apr 1, 2011
CN=HT Srl,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=HT Srl,L=Milan,ST=Italy,C=IT
Subject
CN=HT Srl,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=HT Srl,L=Milan,ST=Italy,C=IT
Serial Number
42:1c:b6:de:8a:18:ac:26:c5:2b:2d:f9:8e:52:d1:eb
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 30, 2010 - Jul 30, 2011
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
61:0c:12:06:00:00:00:00:00:1b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Subject
CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN
Serial Number
1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6
Issuer
CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2000 - Dec 31, 2099
Subject
CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN
Serial Number
1e:b1:32:d5
Issuer
CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jan 1, 2000 - Dec 31, 2099
Subject
CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN
Serial Number
1e:b1:32:d5:7e:79:68:96
Issuer
CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2000 - Dec 31, 2099
Minor OS version
2
Major OS version
5
Entry point
78240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
z:\develop\multikey\mk_18_1\src\objfre_wnet_AMD64\amd64\MultiKey.pdb
ntoskrnl.exe
strncmp
IoGetCurrentProcess
ExFreePool
KeClearEvent
KeSetEvent
IofCompleteRequest
IoInvalidateDeviceRelations
RtlCopyUnicodeString
ExAllocatePoolWithTag
IoAttachDeviceToDeviceStack
IoDeleteDevice
IoRegisterDeviceInterface
KeInitializeEvent
IoCreateDevice
IoSetDeviceInterfaceState
KeLeaveCriticalRegion
ExReleaseFastMutex
ExAcquireFastMutex
KeEnterCriticalRegion
__chkstk
IoRequestDeviceEject
KeWaitForSingleObject
IofCallDriver
ObfReferenceObject
IoDetachDevice
PoCallDriver
PoStartNextPowerIrp
PoSetPowerState
swprintf
ObfDereferenceObject
IoBuildSynchronousFsdRequest
IoGetAttachedDeviceReference
ZwClose
ZwSetValueKey
ZwOpenKey
RtlInitUnicodeString
ZwQueryValueKey
KeDelayExecutionThread
RtlTimeFieldsToTime
RtlTimeToTimeFields
ZwEnumerateKey
ZwQueryKey
KeBugCheckEx
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
756B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=43, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=10, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
MultiKey_18.1.1_x64/SolidCAM.reg
- SHA256 522bfb4f2e36025fa94fb4c2b31954eae9eec85049c3532a133ac03062536d3d
- MD5 f78b6a670d31afbaa0789a03bcfd2b14
- SHA1 7ecd78e6f01c8dae3f409277cdb0af60b4010e7c
- SHA512 10623472f0408eed77cf29f607c46a52894bf26ab27be539eacb7cb3c4390223262d4edd8cb1b7e5881fe2a27720424af81bb02108584e0d397bfea0e8af91b8
- TLSH T19E312936DBEA3006A1F389B9DDE695235B377517323DC04E20D11F4E0BE360554127AB
- MD5 SHA1 SHA512 TLSH
MultiKey_18.1.1_x64/bcdedit.exe
- IMPHASH 312fc7fd1e17a4ef9ec25deba51d7921
- SHA256 3bbbf787d5b383146afda55514a28764ae0ccd42c7f1298c94f0804dae61d377
- MD5 780836bb63852990382df27de7fefd20
- SHA1 6feedabbc6576a4bdc68935677b7a01f130b98f2
- SHA512 4dfc69562bc80ebab751e4c34d5fcdb01a02f3bebfc466ba72a0b382dfe62bbadc2966c74eea7b0f9a923df703238bf4aeb465ddbd51618f03df6535f803263d
- SSDEEP 3072:finOQyFY+BN0fOYz7RmSh67xRz+0AOkcH5pyvtRNAs7UfBpRhdNV/ysXo34D62x5:fQgYGN0fOq7RmSw7xt+xb0EIPc
- TLSH T1C4741D02A3E90205F0F37B759AB556619A77BC85AA39D68E129C004E0FF3F909D74B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
169656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bcdedit.pdb
kernel32
GetFileType
GetConsoleMode
WriteConsoleW
GetConsoleOutputCP
WideCharToMultiByte
WriteFile
CreateFileW
CloseHandle
DeviceIoControl
FormatMessageW
LocalFree
GetModuleFileNameW
LoadLibraryW
GetProcAddress
FreeLibrary
GetStdHandle
Sleep
SearchPathW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
OutputDebugStringA
GetLastError
QueryDosDeviceW
SetLastError
RtlCompareMemory
UnmapViewOfFile
GetSystemDefaultUILanguage
FindResourceExW
LoadResource
LoadLibraryExW
GetLocaleInfoW
GetVersionExW
CreateFileMappingW
GetUserDefaultUILanguage
MapViewOfFile
msvcrt
_commode
_fmode
__set_app_type
memcpy
memset
memmove
__setusermatherr
?terminate@@YAXXZ
free
calloc
isdigit
mbtowc
__mb_cur_max
isleadbyte
isxdigit
localeconv
_iob
_snprintf
_itoa
wctomb
malloc
ferror
iswctype
wcstombs
realloc
__badioinfo
__pioinfo
_read
_fileno
_lseeki64
_write
_isatty
ungetc
bsearch
wcsncmp
strncmp
wcsstr
wcsrchr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_wcsupr
_wcslwr
_errno
_wsetlocale
towupper
iswspace
_vsnwprintf
wcschr
wcstoul
_wcsnicmp
_wcsicmp
memcmp
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtClose
NtOpenFile
RtlStringFromGUID
RtlGUIDFromString
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlFreeUnicodeString
RtlAllocateHeap
RtlFreeHeap
RtlNtStatusToDosError
NtQuerySystemInformation
NtDeviceIoControlFile
NtWaitForSingleObject
NtCreateEvent
NtQueryKey
NtEnumerateKey
NtQueryAttributesFile
NtOpenKey
RtlCreateAcl
NtSaveKey
NtUnloadKey
RtlFreeSid
RtlSetDaclSecurityDescriptor
NtDeleteValueKey
NtLoadKey
NtOpenThreadToken
NtCreateKey
NtCreateFile
RtlLengthSecurityDescriptor
RtlAddAccessAllowedAceEx
NtOpenProcessToken
NtSetSecurityObject
NtQueryValueKey
NtSetValueKey
NtAdjustPrivilegesToken
NtDeleteKey
RtlAllocateAndInitializeSid
RtlLengthSid
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlInitAnsiString
NtOpenSymbolicLinkObject
LdrGetProcedureAddress
NtQuerySymbolicLinkObject
NtQueryInformationFile
LdrGetDllHandle
NtQueryVolumeInformationFile
NtDeleteFile
NtResetEvent
NtAllocateUuids
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
Name
.text
Size
193KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
135KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=185, id=1, productName=Unmarked objects,
count=65, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=32, id=137, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
MultiKey_18.1.1_x64/haspdinst.msi
- SHA256 df51d09d3e04e543e81fafd6abe640f1c3ca62ec757319d93fc2bc54140fefa5
- MD5 7c05af709409c13b963308b041b35c75
- SHA1 091fcd69c3186f673cf8fb10c0f920536304ed14
- SHA512 df093dc65ed6067635e89bfb7272e39108382b90c6700c76c014fb2c2db1d708c18fef21899ec321ad0677abbc2d1714f28f907d576764734dc135aad6d29324
- SSDEEP 393216:fD4GrtA9J3mx5gqdTAO6UasxomajBTMRUCgt06u1dMymkvIlOfIcaNQD:RpAv2x5R56t0oPjBgRUCe06u0ymNUIcT
- TLSH T1592733AB4C0A93F0FA44C3B7E563B48F5675E23FA16D11A637B6F06D3171A40A277086
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned MSI
Checks for missing Authenticode signature.
MultiKey_18.1.1_x64/install.cmd
- SHA256 c8bcbde9fd308fb45ee68d32a836e9f817babf44a959bd820b32fbe4bbd80dbe
- MD5 f0f5882366a9b508e71218e2b2ce4d53
- SHA1 ae86096b7b2a47e1dd11aacfa0732e68c907bc2b
- SHA512 5cb29fe793c109633710ec8b43de955c495794140cd93eb9fd6a670dde57d395c9a46896bcfb6cd43026968c95d1417eb127c89a060d11a3b49cf5614881c128
- TLSH T177F0244E082F0BD38901D9DC174A90FDEA4840C7B46E7D80705E2133E4A330E46137BB
- MD5 SHA1 SHA512 TLSH
MultiKey_18.1.1_x64/remove.cmd
- SHA256 433769a358b44b87df34de9bb14da3bb740422d784abba0fc882fe2912bffde6
- MD5 b926e50ce306a3e4b522ddcd325f358c
- SHA1 cdc769007f7222dbe0dfc14dce4095dad8f81bed
- SHA512 45a09fbed9addb82b39fcc989f60cd559c5faad400e8a7dc689e151e78ba1922dd0b445e3b21c3dc9e1bc4737e5cdc01931979a1c05fac5061586351a13b91aa
- TLSH T1B721795F0E9B0D926013C04177BB81F6623861EBA163BDC025C42022F053E9A83BA77E
- MD5 SHA1 SHA512 TLSH
MultiKey_18.1.1_x64/restart.cmd
- SHA256 ffe92190671418d586ab6c781af68f35ee45058cab32b064f71857adc55da5ad
- MD5 f5bf6f6c80bb200ec8a86a864fb3f3b3
- SHA1 6f691ad9b3a2e2972d6acf4f2c5f94dd5da866b0
- SHA512 a079b900a46aab6969b97a6ecb2fbe3feecc48689866723fefde7c0369d0c3f0f600dbb8916b50182578c69a24e714a9d2d4663943804c1e279ff714408d43ae
- TLSH T1789002491A1315025943D1424508615D59D96144A0022ED170D8732A594D547241367C
- MD5 SHA1 SHA512 TLSH