Client[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Client.exe
Size 8.7MB
Sample260925-rb8ynstwcy
SHA256 85021b05ec25aa7f359dc374d35b670029d2062f189db201870e2d0a319acb5f
MD5 20e6faa8e6a0d61511fe2c901c523044
SHA1 6e6d267cc33cf3e35b0a69afa4756682decdedb4
SHA512 f2170b8e86a2cbf2cacfdb72c8d10bd09d0cf63bfa9b96d2a39649282ea0c30efbcc094c0f890d818d2db7076303a34ab0246cb819803ab067203a24af9425c5
SSDEEP 196608:N/QCiuNWe3LszlVSSYRfVPL4SodMWFe1zzdjYKzE+rUd6:GCiWW+ozzS5i12zZjYKzEc
TLSH
T1929612E5605A5599FB4A9371C1C45D29F10ABD513CB7A8062F8D3E0BBA3A2C0D7B2CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Client.exe

.exe 8.7MB

Client.exe

IMPHASH 17ab4b9d8eb71e16b4c199c01e8f7b73
SHA256 85021b05ec25aa7f359dc374d35b670029d2062f189db201870e2d0a319acb5f
MD5 20e6faa8e6a0d61511fe2c901c523044
SHA1 6e6d267cc33cf3e35b0a69afa4756682decdedb4
SHA512 f2170b8e86a2cbf2cacfdb72c8d10bd09d0cf63bfa9b96d2a39649282ea0c30efbcc094c0f890d818d2db7076303a34ab0246cb819803ab067203a24af9425c5
SSDEEP 196608:N/QCiuNWe3LszlVSSYRfVPL4SodMWFe1zzdjYKzE+rUd6:GCiWW+ozzS5i12zZjYKzEc
TLSH
T1929612E5605A5599FB4A9371C1C45D29F10ABD513CB7A8062F8D3E0BBA3A2C0D7B2CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

55:5b:c3:83:ae:41:66:fd:75:d0:08:53:6a:b4:e8:53:b5:68:14:26:f5:9b:09:98:3b:db:d6:64:75:44:0d:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=467614,CN=ACME TEKNOLOJİ A.Ş.,O=ACME TEKNOLOJİ A.Ş.,L=ÇANKAYA,ST=ANKARA,C=TR,1.3.6.1.4.1.311.60.2.1.3=#13025452,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 7, 2026

SERIALNUMBER=467614,CN=ACME TEKNOLOJİ A.Ş.,O=ACME TEKNOLOJİ A.Ş.,L=ÇANKAYA,ST=ANKARA,C=TR,1.3.6.1.4.1.311.60.2.1.3=#13025452,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:b9:3d:d9:e7:e9:26:32:ac:d6:0a:be:ac:38

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=Globalsign R45 TSA for Authenticode 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:b8:30:0d:fb:a8:75:b3:3b:57:cc:26:37:82

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=467614,CN=ACME TEKNOLOJİ A.Ş.,O=ACME TEKNOLOJİ A.Ş.,L=ÇANKAYA,ST=ANKARA,C=TR,1.3.6.1.4.1.311.60.2.1.3=#13025452,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

05:33:39:3c:39:6d:dd:f7:ce:76:87:fc

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 20, 2023 - Sep 20, 2026

Minor OS version

Major OS version

Entry point

22648168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

12.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

455KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

Virtual Size

12B

Characteristics

Name

.tls

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_sysc

Size

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp2

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Client.exe

kernel32

user32

d3dx9_43

shell32

advapi32

dbghelp

ws2_32

d3d9

gdi32

d3dcompiler_43

winmm

imm32

ole32

version

oleaut32

setupapi

generic