2026-10-01_495fd9d92fab5a3cdb0d5d5c7309bf26_coinminer_darpapox_elex_hacktools_nymaim_rhadamanthys_wannacry
- IMPHASH 730073214094cd328547bf1f72289752
- SHA256 30df728d2f34e405026f483ffc1eb9fd4046ba3745d5bb044ac9166b9f4d57fd
-
AmmyyAdmin payload
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
05:90:95:0c:6d:21:44:c3:39:82:ee:d5:28:73:c3:bf:11:20:6d:10
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Ammyy LLC,O=Ammyy LLC,POSTALCODE=115230,STREET=Varshavskoe shosse\, 32,L=Moscow,ST=Russian Federation,C=RU
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Ammyy LLC,O=Ammyy LLC,POSTALCODE=115230,STREET=Varshavskoe shosse\, 32,L=Moscow,ST=Russian Federation,C=RU
Serial Number
e7:2f:7d:af:59:8d:88:b5:ac:fb:72:a8:1b:50:40:e8
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 20, 2017 - Jun 20, 2019
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 9, 2013 - May 8, 2028
Minor OS version
0
Major OS version
4
Entry point
5759
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
728KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=10, version=8047,
count=2, id=14, version=7299,
count=2, id=4, version=8047,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=64, id=1, productName=Unmarked objects,
count=4, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,