2026-10-27_faeaf8c97b898fc8527b5ac126bde999_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_remcos_smoke-loader
- SHA256 10a8bf0816199c98ebfb9fac6cd34c9b27cd0ef2dead881b4dce186e12b3ce1c
-
Detects executables packed with Enigma
-
Detects packed executables observed in Molerats
Digest
b9:a1:a5:59:d0:30:9d:d7:49:05:48:52:a9:2e:a1:3d:d2:c7:ed:e8:24:be:36:60:d8:8a:a1:96:e9:62:8c:fd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=SCHIRATTI ENRICO EUGENIO,O=SCHIRATTI ENRICO EUGENIO,L=Limena,ST=Padova,C=IT
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=SCHIRATTI ENRICO EUGENIO,O=SCHIRATTI ENRICO EUGENIO,L=Limena,ST=Padova,C=IT
Serial Number
33:00:08:7a:3d:62:34:26:d5:88:aa:71:5c:00:00:00:08:7a:3d
Issuer
CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 16, 2026 - Oct 19, 2026
Subject
CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 26, 2026 - Mar 26, 2031
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 1, 2021 - Apr 1, 2036
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:5b:4a:b5:8d:41:32:6d:dc:74:00:00:00:00:00:5b
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 8, 2026 - Jan 7, 2027
Minor OS version
0
Major OS version
4
Entry point
163308
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.enigma1
Size
752KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.enigma2
Size
292KB
Virtual Size
292KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=14, version=7299,
count=21, id=9, version=8783,
count=1, id=13, version=9782,