XMixer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
XMixer.exe
Size 904KB
Sample261001-ja8yaavbpc
SHA256 6bd2ecf9d4f26dbfb21ecc33715cfa505859bf72e208483619378be16655fc23
MD5 f3f22da313ded515f289cdd91c59c492
SHA1 e6092d9708133392751924f7a4426139aa3f2b4b
SHA512 3f268a48ae0c8f18183918150a809cd725aff893f916dec603018244001ae740770d6bd80e829dcd87c38c93cd2847e36094f1a65983d712340e4beddbe47d37
SSDEEP 12288:wj29DfCcp57hjM5g4KcgC994kwNJRCJHL8Zmyv6CCIil29BVd27X:wU/7hjM5g4KcgC9SCJHL8A+DH9BV07X
TLSH
T186151AC1A862D296D67A8CFAE112FE6751BA7F91D0C0C2F775D43C3B7A0BB860362511
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

XMixer.exe

.exe 904KB

XMixer.exe

IMPHASH 69aca1f52946c9ffa478a793e96c66ab
SHA256 6bd2ecf9d4f26dbfb21ecc33715cfa505859bf72e208483619378be16655fc23
MD5 f3f22da313ded515f289cdd91c59c492
SHA1 e6092d9708133392751924f7a4426139aa3f2b4b
SHA512 3f268a48ae0c8f18183918150a809cd725aff893f916dec603018244001ae740770d6bd80e829dcd87c38c93cd2847e36094f1a65983d712340e4beddbe47d37
SSDEEP 12288:wj29DfCcp57hjM5g4KcgC994kwNJRCJHL8Zmyv6CCIil29BVd27X:wU/7hjM5g4KcgC9SCJHL8A+DH9BV07X
TLSH
T186151AC1A862D296D67A8CFAE112FE6751BA7F91D0C0C2F775D43C3B7A0BB860362511
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

a1:2a:dc:ad:9c:e2:5c:0a:6a:8e:c9:fd:e6:80:50:69:3f:7b:67:1d:c5:af:65:82:f5:65:82:ec:f5:37:41:77

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE

Chains

Feb 2, 2025

CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

e8:3d:3e:2e:ea:42:bf:38:b8:8c:94:ef:bd:db:46:24:7c:c3:53:0b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE

Chains

Feb 2, 2025

CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE

Serial Number

a2:a9:08:26:6d:26:be:22:4f:d6:21:19:fd:95:ae:3c

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 16, 2024 - Sep 16, 2027

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

577457

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WideCharToMultiByte GetVolumeInformationW GetModuleFileNameW GetProcessId GetTimeZoneInformation GetCurrentProcessId GetSystemTime GetExitCodeProcess DecodePointer FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW FormatMessageW LCMapStringW GetStringTypeW GetFileType HeapAlloc HeapFree GetACP GetModuleHandleExW GetStdHandle VirtualQuery VirtualProtect VirtualAlloc RaiseException LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError RtlUnwind TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime MultiByteToWideChar SetEndOfFile QueryPerformanceCounter ExitProcess Beep QueryPerformanceFrequency GetFileTime CopyFileW FreeLibrary LocalFree FindClose FindNextFileW SearchPathW FindFirstFileW CreateDirectoryW OpenThread InterlockedIncrement CreateThread InterlockedExchangeAdd GlobalFlags TerminateThread WriteConsoleW GetExitCodeThread InterlockedDecrement InterlockedCompareExchange InterlockedExchange FindResourceW LoadResource LockResource SizeofResource GetFileSize CloseHandle DeleteFileW SetFileAttributesW GetCurrentThreadId GetFileAttributesW CreateFileW GetTempPathW SetFilePointer WriteFile ReadFile GetModuleHandleW GetProcAddress LoadLibraryW GetSystemInfo GetLastError SetErrorMode IsBadCodePtr GlobalSize GetTickCount GlobalFree GlobalAlloc Sleep GetCurrentProcess

user32

EndDialog MessageBeep DispatchMessageW PeekMessageW SendDlgItemMessageW DialogBoxIndirectParamW IsWindowEnabled EnumWindows BringWindowToTop WaitForInputIdle LoadCursorW SetCursor PostQuitMessage SetForegroundWindow EnableWindow GetWindow GetWindowThreadProcessId LoadIconW GetMessageW IsIconic GetDlgItem IsDlgButtonChecked GetDlgItemTextW ValidateRect GetCapture EndPaint BeginPaint GetCursorPos ReleaseDC GetClassInfoExW MonitorFromWindow ReleaseCapture SetCapture UnionRect TranslateMessage SetFocus GetParent ScreenToClient IsChild GetSysColor SetRect SystemParametersInfoW PtInRect UpdateWindow LoadImageW PostMessageW CopyImage GetDesktopWindow InvalidateRect GetWindowTextLengthW GetMenu MessageBoxW EnumChildWindows SetWindowTextW GetWindowTextW GetMenuItemInfoW GetMenuItemCount GetSubMenu SetMenuItemInfoW GetWindowLongW DefWindowProcW MonitorFromPoint GetWindowRect DestroyWindow GetDC IsWindowVisible SetWindowPos SetActiveWindow FillRect CreateWindowExW GetIconInfo SendMessageW GetCursor GetSystemMetrics UnregisterClassW RegisterClassExW WindowFromPoint ShowWindow IsWindow GetAsyncKeyState SetTimer GetMonitorInfoW IsRectEmpty GetWindowDC SetWindowLongW GetClientRect UpdateLayeredWindow DrawTextW DrawIconEx KillTimer

gdi32

GetObjectType SelectObject GetStockObject SetTextColor SetBkMode DeleteObject CreateCompatibleDC IntersectClipRect CreateFontIndirectW GetObjectW SelectClipRgn BitBlt GetCurrentObject SetStretchBltMode GetDIBits StretchDIBits StretchBlt CreateDIBSection SetBrushOrgEx DeleteDC GetDeviceCaps GdiFlush

advapi32

RegQueryValueExW GetNamedSecurityInfoW RegCloseKey RegOpenKeyExW GetUserNameW FreeSid AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW

shell32

DragQueryFileW SHGetFolderPathW DragFinish DragAcceptFiles DragQueryPoint ShellExecuteExW FindExecutableW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

comctl32

ord17

Sharing

General

Malware Config

Signatures

File Explorer

XMixer.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

generic