IronBark[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
IronBark.exe
Size 6.9MB
Sample260922-tyttdayenb
SHA256 f4e255dfdf3d23774b0067797cac0f986f1690abbeec217eb60029dcaa7425f8
MD5 ab9f9d02c5e8a5751e87fd5f14b78fce
SHA1 7f347d7007b9fd8f5149228f189f93b0e9ccf71c
SHA512 931c7510dd699dae3f9f38bf6f110f061a4008951bf42f3ac12aad130e85eed772784aba8fa0bb713628160702854ad839396dc7d942e698d25cd1ce57a9797b
SSDEEP 98304:e2eE9xWNu3LvFfafwSlkde15Etbl+10bgrm:RzFmlk8Q
TLSH
T18C768D03F39581EDC05EC0B48356A233EA72F8994739B2EB5BD40B112E66F909F1D75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
IronBark.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
IronBark.exe

File Explorer

IronBark.exe

.exe 6.9MB

IronBark.exe

IMPHASH 3efcce064c7413cdd88935dbd6843eb4
SHA256 f4e255dfdf3d23774b0067797cac0f986f1690abbeec217eb60029dcaa7425f8
MD5 ab9f9d02c5e8a5751e87fd5f14b78fce
SHA1 7f347d7007b9fd8f5149228f189f93b0e9ccf71c
SHA512 931c7510dd699dae3f9f38bf6f110f061a4008951bf42f3ac12aad130e85eed772784aba8fa0bb713628160702854ad839396dc7d942e698d25cd1ce57a9797b
SSDEEP 98304:e2eE9xWNu3LvFfafwSlkde15Etbl+10bgrm:RzFmlk8Q
TLSH
T18C768D03F39581EDC05EC0B48356A233EA72F8994739B2EB5BD40B112E66F909F1D75A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

69:8a:c6:cf:8b:65:21:79:ea:af:ce:b4:01:ec:fb:1a:29:c1:8f:93:42:14:0d:67:16:06:e3:65:d5:56:f6:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Amir Dow,O=Amir Dow,ST=Tel Aviv,C=IL

Chains

May 12, 2026

CN=Amir Dow,O=Amir Dow,ST=Tel Aviv,C=IL

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Amir Dow,O=Amir Dow,ST=Tel Aviv,C=IL

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Amir Dow,O=Amir Dow,ST=Tel Aviv,C=IL

Serial Number

46:4c:3d:b5:14:5e:f8:3c:75:3f:87:57:f3:5f:34:fa

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Nov 26, 2025

Timespan

Nov 26, 2025 - Nov 25, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

4398544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler CancelIo CancelIoEx CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventA CreateEventW CreateFileW CreateIoCompletionPort CreateMutexA CreateProcessW CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer ExitProcess FindClose FindFirstFileExW FindNextFileW FormatMessageW FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent K32GetPerformanceInfo LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MultiByteToWideChar OpenProcess PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx ReadProcessMemory ReleaseMutex RemoveVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadErrorMode SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

bcryptprimitives

ProcessPrng

advapi32

ConvertSidToStringSidW CopySid GetLengthSid GetTokenInformation ImpersonateAnonymousToken IsValidSid OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW RevertToSelf SystemFunction036

oleaut32

GetErrorInfo SysFreeString SysStringLen

user32

AdjustWindowRectEx ChangeDisplaySettingsExW ClientToScreen ClipCursor CloseClipboard CloseTouchInputHandle CreateIcon CreateIconFromResourceEx CreateWindowExA CreateWindowExW DefWindowProcA DefWindowProcW DestroyCursor DestroyIcon DestroyWindow DispatchMessageW EmptyClipboard EnableMenuItem EnumDisplayMonitors FlashWindowEx GetActiveWindow GetAsyncKeyState GetClassInfoExW GetClassNameW GetClientRect GetClipCursor GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMonitorInfoW GetRawInputData GetSystemMenu GetSystemMetrics GetTouchInputInfo GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRgn IsClipboardFormatAvailable IsIconic IsProcessDPIAware LoadCursorW MapVirtualKeyExW MapVirtualKeyW MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjectsEx OpenClipboard PeekMessageW PostMessageW RedrawWindow RegisterClassExA RegisterClassExW RegisterRawInputDevices RegisterTouchWindow RegisterWindowMessageA ReleaseCapture ReleaseDC ScreenToClient SendInput SendMessageW SetCapture SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA ToUnicodeEx TrackMouseEvent TranslateMessage ValidateRect

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

shlwapi

AssocQueryStringW

bcrypt

BCryptGenRandom

gdi32

BitBlt ChoosePixelFormat CreateCompatibleDC CreateDIBSection CreateRectRgn DeleteDC DeleteObject DescribePixelFormat GetDeviceCaps GetPixelFormat SelectObject SetPixelFormat SwapBuffers

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

shell32

CommandLineToArgvW DragFinish DragQueryFileW SHGetKnownFolderPath

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

d3dcompiler_47

D3DCompile

powrprof

CallNtPowerInformation

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize OleInitialize RegisterDragDrop RevokeDragDrop

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

psapi

GetModuleFileNameExW

imm32

ImmAssociateContextEx ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

uxtheme

SetWindowTheme

opengl32

wglCreateContext wglDeleteContext wglGetCurrentContext wglGetCurrentDC wglGetProcAddress wglMakeCurrent wglShareLists

api-ms-win-crt-math-l1-1-0

__setusermatherr _hypotf acos acosf acosh acoshf asin asinf asinh asinhf atan atan2f atanf cbrtf ceil ceilf cos cosf cosh coshf exp exp2 exp2f expf floor floorf fma fmaf fmod fmodf log log1p log1pf log2 log2f logf pow powf round roundf sin sinf sinh sinhf tan tanf tanh tanhf trunc truncf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit strerror terminate

api-ms-win-crt-string-l1-1-0

strcmp strcpy_s strlen wcslen wcsncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

67KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

513B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

IronBark.exe

PE Signature issue

kernel32

bcryptprimitives

advapi32

oleaut32

user32

secur32

shlwapi

bcrypt

gdi32

crypt32

shell32

ntdll

ws2_32

api-ms-win-core-synch-l1-2-0

d3dcompiler_47

powrprof

ole32

dwmapi

psapi

imm32

pdh

uxtheme

opengl32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic