rig-windows-x86_64-0.11.0.zip
- SHA256 81218ebc88d24f100686106542ac487fa9b2755f905539b450e0eb87a5364f9d
Overview
overview
5Static
static
1bin/gsudo.exe
windows10-2004-x64
1bin/gsudo.exe
windows11-ltsc_2024-x64
1bin/rig-shim.exe
windows10-2004-x64
1bin/rig-shim.exe
windows11-ltsc_2024-x64
1bin/rig.exe
windows10-2004-x64
1bin/rig.exe
windows11-ltsc_2024-x64
1share/fish...ig.vbs
windows10-2004-x64
5share/fish...ig.vbs
windows11-ltsc_2024-x64
5share/rig/_rig.ps1
windows10-2004-x64
3share/rig/_rig.ps1
windows11-ltsc_2024-x64
3share/zsh/...ig.vbs
windows10-2004-x64
5share/zsh/...ig.vbs
windows11-ltsc_2024-x64
5Static task
static1
Behavioral task
behavioral1
Sample
bin/gsudo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
bin/gsudo.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
bin/rig-shim.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
bin/rig-shim.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
bin/rig.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
bin/rig.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
share/fish/vendor_completions.d/rig.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
share/fish/vendor_completions.d/rig.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
share/rig/_rig.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
share/rig/_rig.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
share/zsh/site-functions/_rig.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
share/zsh/site-functions/_rig.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target rig-windows-x86_64-0.11.0.zip
- Size 8.2MB
- Sample261029-2rwcmacf52
- SHA256 81218ebc88d24f100686106542ac487fa9b2755f905539b450e0eb87a5364f9d
- MD5 eb1d9bc45c6a00e6c7da9de7f5a2655e
- SHA1 09e0161e6a70c57ac0aea5296fe7a46c487951af
- SHA512 cffd435ab7c69f171b9b74af6f5f3017859eeb3a0e451395511d848ed78f35c98ee2c5f68b78d4d1ba69ce7bec9ed9a230fec2161476f6eecd207ca06615b6f8
- SSDEEP 196608:DlJFdsWQBc0Q5o/YQGkObCz/PIsG6OcY14Rk/BbNOQy7lTf8+E:rFdsvBcL3XC7AKY14C/BbsqX
- TLSH T1B5863318EAED6A4FE90C3ED47F8BA1B4E029392087115BAB7CA51F575DCF5A04327027
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
rig-windows-x86_64-0.11.0.zip.zip 8.2MB
-
bin/gsudo.exe.exe 4.1MB
-
bin/rig-shim.exe.exe 281KB
-
bin/rig.exe.exe 16.8MB
-
share/bash-completion/completions/rig.bash195KB
-
share/elvish/lib/rig.elv102KB
-
share/fish/vendor_completions.d/rig.fish.vbs 153KB
-
share/rig/_rig.ps1187KB
-
share/zsh/site-functions/_rig.vbs 170KB
bin/gsudo.exe
- IMPHASH 6e8f5f6ed50a6264a8f8991080ea07e7
- SHA256 80429dbaf959263030c87fc610c2f1052b08c63575e1dad56cac5e502eecb414
- MD5 cd9ca49714ca97c78a1da84bf1e58e84
- SHA1 64ea3ee312922774c74d2a8a77170217521eac7d
- SHA512 cd55596402ff1578b2f054cea34435a74f91f7dcf1ade8578fbd561d46eb760b627b34590d09c7f17011b0db8c2b594646482c3c51067aa723943ab0f16de860
- SSDEEP 49152:IsOTyIe/mfHR9/zVFlheaNJ88/hQzKNg2V6SpaOkGscSZ231DIwz99c3hV3rKd2y:KBVFDhQx+zLzE
- TLSH T17F169E1593E900A9E437EB38CA65D233DAB07D925734D24F0698F6062F73A508B7F726
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
97:af:83:66:a3:f1:bc:98:55:e0:fc:bb:1b:89:49:8a:4d:f8:36:06:ba:17:2f:32:5d:9d:aa:1c:cb:bf:51:91
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Gerardo Grignoli,O=Gerardo Grignoli,ST=Ciudad Autónoma de Buenos Aires,C=AR
Chains
Oct 6, 2025
CN=Gerardo Grignoli,O=Gerardo Grignoli,ST=Ciudad Autónoma de Buenos Aires,C=AR
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Gerardo Grignoli,O=Gerardo Grignoli,ST=Ciudad Autónoma de Buenos Aires,C=AR
Serial Number
d6:10:5e:ce:8e:35:cf:70:08:b5:35:39:91:82:bf:c9
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 21, 2022 - Nov 20, 2025
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
0
Major OS version
6
Entry point
2493960
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\gsudo\gsudo\src\gsudo\bin\net9.0\win-x64\native\gsudo.pdb
advapi32
AdjustTokenPrivileges
CheckTokenMembership
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
CreateProcessAsUserW
CreateWellKnownSid
DeregisterEventSource
DuplicateTokenEx
GetLengthSid
GetSecurityDescriptorLength
GetSidSubAuthority
GetTokenInformation
GetWindowsAccountDomainSid
ImpersonateLoggedOnUser
LookupPrivilegeValueW
OpenProcessToken
OpenThreadToken
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegisterEventSourceW
ReportEventW
RevertToSelf
SetKernelObjectSecurity
SetThreadToken
SetTokenInformation
bcrypt
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptFinishHash
BCryptHashData
BCryptGetProperty
crypt32
CryptProtectMemory
CryptUnprotectMemory
kernel32
TlsAlloc
InitializeCriticalSectionAndSpinCount
TlsGetValue
RaiseException
RtlPcToFileHeader
TlsSetValue
TlsFree
EncodePointer
AttachConsole
CancelIoEx
CancelSynchronousIo
CancelThreadpoolIo
CheckRemoteDebuggerPresent
CloseHandle
CloseThreadpoolIo
CloseThreadpoolWait
CloseThreadpoolWork
ConnectNamedPipe
CreateDirectoryW
CreateEventExW
CreateFileW
CreateNamedPipeW
CreatePipe
CreateProcessW
CreateThread
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
DisconnectNamedPipe
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeConsole
FreeEnvironmentStringsW
FreeLibrary
GenerateConsoleCtrlEvent
GetCPInfoExW
GetCommandLineW
GetConsoleCP
GetConsoleCursorInfo
GetConsoleMode
GetConsoleOutputCP
GetConsoleProcessList
GetConsoleScreenBufferInfo
GetConsoleScreenBufferInfoEx
GetConsoleTitleW
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumberEx
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetDynamicTimeZoneInformation
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetLocaleInfoEx
GetLogicalDrives
GetLongPathNameW
GetModuleFileNameW
GetOverlappedResult
GetProcAddress
GetProcessId
GetStdHandle
GetSystemDirectoryW
GetSystemTime
GetThreadPriority
GetTickCount64
InitializeConditionVariable
InitializeCriticalSection
InitializeProcThreadAttributeList
IsDebuggerPresent
IsWow64Process
K32EnumProcessModulesEx
K32EnumProcesses
K32GetModuleBaseNameW
K32GetModuleFileNameExW
K32GetModuleInformation
LeaveCriticalSection
LoadLibraryExW
LocalAlloc
LocalFree
MultiByteToWideChar
OpenEventW
OpenProcess
OpenThread
PeekConsoleInputW
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
RaiseFailFastException
ReadConsoleInputW
ReadConsoleW
ReadFile
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleOutputCP
SetConsoleTextAttribute
SetConsoleTitleW
SetCurrentDirectoryW
SetEnvironmentVariableW
SetEvent
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetThreadErrorMode
SetThreadPriority
SetThreadpoolTimer
SetThreadpoolWait
Sleep
SleepConditionVariableCS
StartThreadpoolIo
SubmitThreadpoolWork
SystemTimeToFileTime
TerminateProcess
TzSpecificLocalTimeToSystemTime
UpdateProcThreadAttribute
VirtualAlloc
VirtualFree
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForThreadpoolWaitCallbacks
WaitNamedPipeW
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
FlushProcessWriteBuffers
WaitForSingleObjectEx
AddVectoredExceptionHandler
GetModuleHandleW
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
VerSetConditionMask
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
CreateMemoryResourceNotification
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
VerifyVersionInfoW
InitializeContext
GetEnabledXStateFeatures
LocateXStateFeature
SetXStateFeaturesMask
VirtualQuery
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
SleepEx
DebugBreak
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
RtlUnwindEx
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
ole32
CoTaskMemFree
CoInitializeEx
CoGetApartmentType
CoCreateGuid
CoUninitialize
CoTaskMemAlloc
CoWaitForMultipleHandles
version
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
free
malloc
_set_new_mode
api-ms-win-crt-math-l1-1-0
modf
ceil
__setusermatherr
api-ms-win-crt-string-l1-1-0
strlen
_stricmp
strcpy_s
strcmp
wcsncmp
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_initialize_onexit_table
terminate
_crt_atexit
abort
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
__p___argc
_exit
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
DotNetRuntimeDebugHeader
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
911KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=35207,
count=13, id=260, version=35207,
count=47, id=261, version=35207,
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=257, version=33140,
count=309, id=1, productName=Unmarked objects,
count=9, id=259, version=35209,
count=2, id=260, version=35209,
count=1, productName=Unmarked objects (old),
count=63, id=261, version=35209,
count=1, id=256, version=35217,
count=1, id=258, version=35217,
bin/rig-shim.exe
- IMPHASH 54927eb2d0ca502165b6d78c2e6dca54
- SHA256 02f624394cdad3b4cda7fd6b61acda1c0854feec121e76bf340e3d42f22449ef
- MD5 4492e7f34a77fd08036743fb392efd28
- SHA1 c9ed158058b7e845b987fe474baec1ba551b4c4b
- SHA512 ed49c1afc7c5cf958fc6cde8f0378b7b2d91f434357eaf30088071a0ca0c5596a827c2a4466d3033eea5ec4a1dffc05d98701b21a2bd47c1acb75d59f77b27e3
- SSDEEP 3072:sL/RZ/p57Sk/JLxQnE/C1CQn0mNsFw6l8vY1IJ3RBo8zfgOp+X3wGSyEi3v:i17S+JLxQFCQdNycvY6BB3cOp+nVEi3v
- TLSH T1CD544A21BA555CA9D95AC47882468A73B63234C71B32F9FF02C442383F6BAF65F3C654
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c4:af:2f:a8:08:d2:ed:32:6c:45:ca:f2:91:dc:6b:cc:ef:ee:47:01:61:79:89:c1:ea:ed:3c:6b:0f:43:28:22
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US
Chains
Oct 7, 2026
CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2020 - Mar 18, 2045
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US
Serial Number
6f:ba:10:f9:14:42:5f:94:29:66:b2:8a
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 16, 2026 - Sep 7, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
182288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
rig_shim.pdb
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
kernel32
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CloseHandle
CompareStringOrdinal
GetLastError
FreeEnvironmentStringsW
WaitForSingleObject
SetLastError
GetFullPathNameW
GetCurrentThreadId
SetFileInformationByHandle
CreateFileW
GetStdHandle
GetCurrentProcess
DuplicateHandle
GetProcessHeap
HeapFree
HeapReAlloc
QueryPerformanceCounter
CreateThread
GetCurrentProcessId
ReadFileEx
SleepEx
WriteFileEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetFileTime
GetFileInformationByHandle
GetFileInformationByHandleEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
TerminateProcess
GetEnvironmentStringsW
GetExitCodeProcess
SetFilePointerEx
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetCurrentDirectoryW
GetCommandLineW
lstrlenW
ExitProcess
GetProcAddress
WideCharToMultiByte
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
HeapAlloc
GetModuleFileNameW
MultiByteToWideChar
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
GetFileAttributesW
FlsFree
FlsAlloc
GetModuleHandleExW
GetModuleHandleW
IsThreadAFiber
FlsSetValue
FormatMessageW
GetModuleHandleA
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
ntdll
NtCreateNamedPipeFile
NtReadFile
RtlNtStatusToDosError
NtOpenFile
NtWriteFile
api-ms-win-crt-string-l1-1-0
strcmp
wcslen
strcpy_s
strlen
wcsncmp
api-ms-win-crt-runtime-l1-1-0
_exit
_crt_atexit
terminate
_register_onexit_function
abort
_c_exit
_seh_filter_exe
_cexit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
__p___argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
__p___argc
_initialize_onexit_table
_initterm_e
_set_app_type
exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
calloc
free
Name
.text
Size
196KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=35207,
count=12, id=260, version=35207,
count=40, id=261, version=35207,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=17, productName=Unmarked objects (old),
count=1, id=258, version=35229,
bin/rig.exe
- IMPHASH 6e0f568f4c2ecc4f353eb54f96f7534a
- SHA256 1ad8e5d80b55399b37080e35c3b20677d77fe83c70a13b726a2ad38e240b46f0
- MD5 b90afb6a5482b2db902b2dcffb2076cf
- SHA1 0e86081ebf562c52fc5ec2d262c07c1ceafe132e
- SHA512 e6d73a72c0758f4cae6fefcd9c618a2e36382249bcd0023c29f3d70348358c485677dcc07c4a136848798b4d80426fdcfdb0a5fccb3308e4cce9c57dc290453e
- SSDEEP 98304:XMLPvO7xMF+QE5i008kg6jtISO1xvdwkFx2hf9iQ5wm+tEX38woOyuzoo6Fl98Du:y35Dg6jtD6xvyVhfN+tW3Fy1s3xhW
- TLSH T1D6071915BB9A58ACD15AC870834A8A735A3130DB1B35B9FF44C486793FA9AF45F3C318
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
54:cb:31:55:f8:3e:7e:e0:ec:4a:bf:fc:64:de:04:31:80:eb:e2:ea:ad:b8:93:5a:e8:23:7a:7f:2d:90:ad:18
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US
Chains
Oct 7, 2026
CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2020 - Mar 18, 2045
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US
Serial Number
6f:ba:10:f9:14:42:5f:94:29:66:b2:8a
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 16, 2026 - Sep 7, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
12595468
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
rig.pdb
kernel32
CloseHandle
GetStdHandle
SetStdHandle
GetShortPathNameW
CreateSemaphoreA
SetConsoleCtrlHandler
GetModuleHandleW
GetProcAddress
GetCurrentProcess
IsWow64Process
WaitForSingleObject
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RtlPcToFileHeader
RtlUnwindEx
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
SetHandleInformation
VirtualProtect
GetFileInformationByHandleEx
LoadLibraryW
MoveFileExW
HeapAlloc
SetFileAttributesW
GetCurrentThreadId
AreFileApisANSI
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
ReadFile
SetFileInformationByHandle
HeapCreate
GetFullPathNameW
GetFileSize
WriteFile
GetDiskFreeSpaceW
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
DuplicateHandle
GetCurrentProcessId
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
CreateFileMappingW
MapViewOfFile
GetTickCount
GetCommandLineW
GetTempPathW
CreatePipe
QueryPerformanceCounter
FormatMessageA
WideCharToMultiByte
SystemTimeToFileTime
FormatMessageW
MultiByteToWideChar
OutputDebugStringA
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
GetSystemInfo
GetConsoleMode
SetConsoleMode
GetDynamicTimeZoneInformation
SetNamedPipeHandleState
RegisterWaitForSingleObject
UnregisterWaitEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetOverlappedResult
PostQueuedCompletionStatus
CancelIoEx
CreateMutexW
GetQueuedCompletionStatusEx
GetFileAttributesW
GetModuleHandleA
SetFileTime
UnmapViewOfFile
FlushFileBuffers
GetComputerNameExW
LoadLibraryExW
HeapValidate
DeviceIoControl
lstrlenW
ReleaseSemaphore
CreateFileW
ExitProcess
CreateProcessA
SetConsoleTextAttribute
CompareStringOrdinal
FreeEnvironmentStringsW
SetLastError
HeapSize
CopyFileExW
CreateHardLinkW
CreateThread
CreateEventW
Sleep
ReadFileEx
SleepEx
WriteFileEx
GetSystemTimePreciseAsFileTime
CancelIo
GetFileInformationByHandle
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
TerminateProcess
GetEnvironmentStringsW
GetExitCodeProcess
CreateDirectoryW
SetFilePointerEx
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetCurrentDirectoryW
GetTempPathA
HeapReAlloc
RemoveDirectoryW
FindFirstFileExW
FindClose
SwitchToThread
CreateMutexA
ReleaseMutex
GetFinalPathNameByHandleW
CreateSymbolicLinkW
GetEnvironmentVariableW
SetEnvironmentVariableW
WriteConsoleW
GetConsoleOutputCP
CreateWaitableTimerExW
SetWaitableTimer
FlsFree
FlsAlloc
GetModuleHandleExW
IsThreadAFiber
FlsSetValue
GetFileType
WaitForMultipleObjects
QueryPerformanceFrequency
DeleteFileA
FindNextFileW
WaitForSingleObjectEx
LoadLibraryA
GetModuleFileNameW
CreateFileA
GetDiskFreeSpaceA
GetFileAttributesA
LocalFree
DeleteFileW
GetLastError
HeapFree
GetProcessHeap
GetFileAttributesExW
SetConsoleCursorPosition
FlushViewOfFile
OutputDebugStringW
bcryptprimitives
ProcessPrng
advapi32
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegCloseKey
OpenProcessToken
GetTokenInformation
GetUserNameW
RegDeleteKeyExW
RegCreateKeyExW
RegDeleteTreeW
ws2_32
send
recv
getsockopt
connect
ioctlsocket
WSASend
getsockname
bind
WSASocketW
shutdown
getpeername
setsockopt
WSAIoctl
freeaddrinfo
WSAGetLastError
getaddrinfo
closesocket
WSAStartup
secur32
AcquireCredentialsHandleA
AcceptSecurityContext
InitializeSecurityContextW
DeleteSecurityContext
ApplyControlToken
FreeContextBuffer
EncryptMessage
DecryptMessage
QueryContextAttributesW
FreeCredentialsHandle
crypt32
CertFreeCertificateContext
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertDuplicateStore
CertGetCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WakeByAddressAll
WaitOnAddress
ntdll
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile
NtReadFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtWriteFile
NtOpenFile
NtCreateNamedPipeFile
shell32
CommandLineToArgvW
SHGetKnownFolderPath
ole32
CoTaskMemFree
api-ms-win-crt-string-l1-1-0
strcmp
strspn
wcsncmp
wcslen
strcpy_s
strncmp
strcspn
strlen
api-ms-win-crt-math-l1-1-0
round
log2
fmod
log
trunc
ceil
truncf
pow
__setusermatherr
api-ms-win-crt-convert-l1-1-0
_wtoi64
api-ms-win-crt-heap-l1-1-0
_msize
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_initterm_e
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_endthreadex
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_beginthreadex
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
abort
_seh_filter_exe
_wassert
exit
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
12.3MB
Virtual Size
12.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
34KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
534KB
Virtual Size
533KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=259, version=35207,
count=14, id=260, version=35207,
count=40, id=261, version=35207,
count=6, id=257, version=30151,
count=90, id=260, version=35229,
count=5, id=257, version=33145,
count=380, id=1, productName=Unmarked objects,
count=521, productName=Unmarked objects (old),
count=1, id=258, version=35229,
share/bash-completion/completions/rig.bash
- SHA256 2e1254ff964d374d628e9f3521e2c8aa08e556de73a9453434a2072698fbae85
- MD5 91791916897fe05a8782e2c07842f44f
- SHA1 40a07234ae5de9f21f9310cfab7b53908055122c
- SHA512 c5e9d3d368f882e948699a91385a84e6a17d66f56eaf32270fc594b3cc6d823f42a1e3a180b3164b9ebddfc376bb754d545abd14f9967d5d65f39b996ca29c9b
- SSDEEP 768:lCsIhT4PLMV+DB/UK/0NWDeClelxGE+fdfJRWdyrO9yoc4/VoIBWQi4xfqwC4F8/:o+N5Vq9F8/
- TLSH T1AB1438A06D9F31B0C397D66C5B926507A2181E73809BEE28FB4DA7E55FB3134E1A50C3
- MD5 SHA1 SHA512 SSDEEP TLSH
share/elvish/lib/rig.elv
- SHA256 29124823b2580e87ef566f15be192f859ba7e919034a95dda3c5050944f850a5
- MD5 e0d7fc538ada4b47c05174ea2739589f
- SHA1 b22ce9a0ec4f1543b1d54de9829a442a9e267694
- SHA512 13ac67988d78fbed74894a29baf924245e8370fe13a7381139147a309a8277bb1dcbd6627aa27f36cc5f9b72803202cd4665d7eacb5eeb83c731d74c5f2319e4
- SSDEEP 3072:T31rWRlkbI8PlPW6a7jJ+GMl+XJMh+afEWJYzvW4Ebkvmq9Ed:T31rWRlkbIA9W6a7d7/0EkYzvW4Ebt
- TLSH T1F5A3D33B6734662B104B4AD2E3BF84E26B5297A314663DDC308DC0545F29DE7869FEB0
- MD5 SHA1 SHA512 SSDEEP TLSH
share/fish/vendor_completions.d/rig.fish
- SHA256 7e2bb88be8657af7ddfd0ed53c46171fa5faf80d5e8c4e34614e92fdebb41d11
- MD5 1ec19ab3b176c28085dfe939dd97b88a
- SHA1 084ca0850e1ba716e73f478a94f74c56d2318615
- SHA512 4e63872085b95fea99ccb80347f5faac040b79ec17a899a971c746287c453865fd831b6a818e200394f045e6c61ba237638fd219babb8a6fb383b963b950653a
- SSDEEP 3072:bjcVJCYmR0pUrS5qpVUBWZalWcS1yQQfx6PWqwRNJYgWp2wCiuqOIpmCcS3:bjc8ZalWchNJYgWQwC/qOIpmCcQ
- TLSH T17DF3362F426FD53343385EBDD299C4D38B260BD323D36A0A3F6BE87C9207678A564654
- MD5 SHA1 SHA512 SSDEEP TLSH
share/rig/_rig.ps1
- SHA256 f49e8a54d24ab26615aef37d69eedd6114efe7f176006b2b820ed814cc508cad
- MD5 aab84de92fc72f3e66c5e7f941cbaae2
- SHA1 993487489c322cb9d9d25ecea60298b91faf1e58
- SHA512 c9fdd7b62de6c417e587ab503963920c68c7b7cc710f30dedb411e41877ddc25a6a3e39cd280835ef59563f7a412190f4c23ed90f7c757d92a0de4605b5291e9
- SSDEEP 3072:fw2AQWgXE+r8E1su/4CxcH6wuKc6XU4x4RxWAMRJbiFa4Of3W9:o2AQ5XE+r8E1su/4sqQq4fWAMRJbnE
- TLSH T1AF146D15135BC24723430398D39F94366DF9A1F26ABF29063DDC8A24875BF76E04A6F8
- MD5 SHA1 SHA512 SSDEEP TLSH
share/zsh/site-functions/_rig
- SHA256 ccf0a448f971713cce84a84f0ce587486171b2ec17eaffe87ff7729d2a94577f
- MD5 1ecaa9d9198534b8c6658cd7d761d199
- SHA1 ea1045de6c6620013f87112acaed7332363e7ac0
- SHA512 94f96144043b866816f9e543f34aadd1cccdaff0e99de398d6f7f2548a9823d583331f5505feee27453c6ce83553ce83d2eadc6695c903defe23e9ba973fd039
- SSDEEP 3072:qfw2ZGMLfntoJ5QFwIKb+HiczgxBdnTBN+Z:qfw2ZGcntoJmGIKb+HiczgHdnlN+Z
- TLSH T18F04214705FE393798C903D0EA9AE3139F379311244F261372BCBB99835D5AED1B2686
- MD5 SHA1 SHA512 SSDEEP TLSH