jaffacakes118_Trojan.Win32.Goriadu.pkl.e554ad526bb79e5edb6637f3885a1b26
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 160d63dcbfae4628e7a59dd5c22998e8ccae2da82806cdf8999bdad46760f273
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
-
NSIS installer
PE Signature issue
Digest
e3:af:a5:eb:e6:0c:03:81:bd:f8:52:0b:07:09:5b:50:2b:7f:d6:86
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Ctlh China Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D,O=Ctlh China Co.\,Ltd,L=Beijing,ST=Beijing,C=CN
Subject
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Serial Number
70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Timespan
Jan 29, 1996 - Aug 1, 2028
Subject
CN=Ctlh China Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D,O=Ctlh China Co.\,Ltd,L=Beijing,ST=Beijing,C=CN
Serial Number
0f:82:e2:26:9a:b1:2f:70:dd:5a:36:8c:a6:1f:77:b3
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 22, 2009 - Jul 22, 2010
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Minor OS version
0
Major OS version
4
Entry point
12515
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,