15539717292[.]exe | Triage™

General

Target
15539717292.exe
Size 196KB
Sample261011-mkcvdagc53
SHA256 65cbed2e8db313b8966638e40eb27f94156c294eb060b28a02c130d146518c39
MD5 808de473370ef6b5d98ab752f245a3ca
SHA1 800bd4ad10c17471829693fac3cee4502b14f029
SHA512 fafaff03ad502523b3627e59e1026b8af4217a80215782a90667bc4f4c330871d8c3d890f2601b68ec9a42c0171d12b9e5b87067c95dcad1132b0a8979c56a4c
SSDEEP 3072:WkHnWPw0GnbgoCxI+HRoEp51jdnRNuCQJYgl/Ftgpu5ivZ2in:x240Gnbgog37uCQJYgNPgV2E
TLSH
T174145B62BF40823BDA424AF14AC985A71775B3353C30D09776E90F6EABB36826F35351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
15539717292.exe

File Explorer

15539717292.exe

.exe 196KB

15539717292.exe

IMPHASH fa12988c1f536d0d5a773434549432dc
SHA256 65cbed2e8db313b8966638e40eb27f94156c294eb060b28a02c130d146518c39
MD5 808de473370ef6b5d98ab752f245a3ca
SHA1 800bd4ad10c17471829693fac3cee4502b14f029
SHA512 fafaff03ad502523b3627e59e1026b8af4217a80215782a90667bc4f4c330871d8c3d890f2601b68ec9a42c0171d12b9e5b87067c95dcad1132b0a8979c56a4c
SSDEEP 3072:WkHnWPw0GnbgoCxI+HRoEp51jdnRNuCQJYgl/Ftgpu5ivZ2in:x240Gnbgog37uCQJYgNPgV2E
TLSH
T174145B62BF40823BDA424AF14AC985A71775B3353C30D09776E90F6EABB36826F35351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c0:d1:ff:6d:82:ba:e0:9e:31:2c:e3:42:ac:8e:84:c9:11:eb:af:06

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Cheat Engine,O=Cheat Engine,L=Eindhoven,ST=Noord Brabant,C=NL,1.2.840.113549.1.9.1=#0c156461726b5f6279746540686f746d61696c2e636f6d

Chains

Jun 2, 2013

CN=Cheat Engine,O=Cheat Engine,L=Eindhoven,ST=Noord Brabant,C=NL,1.2.840.113549.1.9.1=#0c156461726b5f6279746540686f746d61696c2e636f6d

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Serial Number

04:00:00:00:00:01:20:19:c1:90:66

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 18, 2009 - Jan 28, 2028

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Serial Number

01:00:00:00:00:01:25:b0:b4:cc:01

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 21, 2009 - Dec 22, 2020

Subject

CN=Cheat Engine,O=Cheat Engine,L=Eindhoven,ST=Noord Brabant,C=NL,1.2.840.113549.1.9.1=#0c156461726b5f6279746540686f746d61696c2e636f6d

Serial Number

11:21:ec:fe:ba:3f:53:10:2b:74:1b:7e:1a:ed:b2:50:1c:7c

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2013 - Jul 22, 2014

Minor OS version

0

Major OS version

4

Entry point

161744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CloseHandle CompareStringA CompareStringW CreateDirectoryA CreateEventA CreateFileA CreateProcessA CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection EnumCalendarInfoA EnumResourceLanguagesA EnumResourceNamesA EnumResourceTypesA ExitProcess ExitThread FileTimeToDosDateTime FileTimeToLocalFileTime FindClose FindFirstFileA FindNextFileA FindResourceA FindResourceExA FormatMessageA FreeLibrary FreeResource GetCommandLineA GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesA GetLastError GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetThreadLocale GetThreadPriority GetUserDefaultLCID GetVersionExA GetWindowsDirectoryA HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadResource LocalAlloc LocalFree LockResource MultiByteToWideChar ReadFile ReadProcessMemory RemoveDirectoryA ResetEvent ResumeThread SetEndOfFile SetEvent SetFilePointer SetLastError SetThreadLocale SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TerminateThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualFree WaitForSingleObject WideCharToMultiByte WriteFile

oleaut32

SysAllocStringLen SysFreeString SysReAllocStringLen

user32

CharLowerA CharLowerBuffA CharLowerBuffW CharUpperA CharUpperBuffA CharUpperBuffW GetSystemMetrics MessageBeep MessageBoxA

Name

.text

Size

154KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

15539717292.exe

PE Signature issue

kernel32

oleaut32

user32

generic