2026-10-19_4032186a875657ea9a701d35c9ea819e_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar
- IMPHASH ec3b9b111872a735b88bd78381ea572d
- SHA256 384ff16f779fdba585780b421e63ecc2272737ad81355ab184467427850ba1d8
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
e3:66:e4:c6:e1:96:2a:b1:0f:10:8f:fc:ec:e7:6c:2d:7a:06:3d:c4:93:d0:0a:20:fe:e6:f4:25:11:de:ca:f7
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:37:41:8f:43:e7:5a:5b:6f:a7:00:00:00:00:01:37
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 15, 2020 - Jan 12, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
2
Major OS version
5
Entry point
370080
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msedge_proxy.exe.pdb
Name
.text
Size
786KB
Virtual Size
785KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
152KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gehcont
Size
512B
Virtual Size
84B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
289B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ