tesseract[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
tesseract.exe
Size 84KB
Sample261102-agpnjsf14l
SHA256 ccd044d6cf16eaaad151260e1fcc5e3e1504cd1b8644e940b4f7ae3e315dd0d3
MD5 909620ccbeb6e71ade7ca94212da8a77
SHA1 e8dc2bcd65217d10ecbb28a10d12c4e86f2dc7af
SHA512 16aeeec0ee04c8cf6e563720265dd7f1fa306ce49c8db98ba13c77a4d32e9f6adc2ddab9cb1003c964bc53dd955c60daa6aee117a666a8e023eac57cf0c94c1c
SSDEEP 1536:nPx4lPgEk/vfVaYGEltgu2rTEEqojSuOGVdcgCP4Xw8VfYG3473:XxnMYGEYYEqn2dEcYP73
TLSH
T12E835A47F74360FDC407C57856D69272DA31FC160838ABAF3658CB361F22E906F69929
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
tesseract.exe

File Explorer

tesseract.exe

.exe 84KB

tesseract.exe

IMPHASH 2409aa1c2fd6b345564d78b00abee900
SHA256 ccd044d6cf16eaaad151260e1fcc5e3e1504cd1b8644e940b4f7ae3e315dd0d3
MD5 909620ccbeb6e71ade7ca94212da8a77
SHA1 e8dc2bcd65217d10ecbb28a10d12c4e86f2dc7af
SHA512 16aeeec0ee04c8cf6e563720265dd7f1fa306ce49c8db98ba13c77a4d32e9f6adc2ddab9cb1003c964bc53dd955c60daa6aee117a666a8e023eac57cf0c94c1c
SSDEEP 1536:nPx4lPgEk/vfVaYGEltgu2rTEEqojSuOGVdcgCP4Xw8VfYG3473:XxnMYGEYYEqn2dEcYP73
TLSH
T12E835A47F74360FDC407C57856D69272DA31FC160838ABAF3658CB361F22E906F69929
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

78:f0:0a:56:3a:05:e7:d1:13:ac:9c:c2:5e:4e:fa:e1:de:cb:76:d9:e1:5e:d7:6f:ff:8f:cc:7e:12:0e:72:72

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Universität Mannheim,O=Universität Mannheim,ST=Baden-Württemberg,C=DE

Chains

Nov 11, 2024

CN=Universität Mannheim,O=Universität Mannheim,ST=Baden-Württemberg,C=DE

CN=GEANT Code Signing CA 4,O=GEANT Vereniging,C=NL

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Universität Mannheim,O=Universität Mannheim,ST=Baden-Württemberg,C=DE

CN=GEANT Code Signing CA 4,O=GEANT Vereniging,C=NL

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Universität Mannheim,O=Universität Mannheim,ST=Baden-Württemberg,C=DE

CN=GEANT Code Signing CA 4,O=GEANT Vereniging,C=NL

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Universität Mannheim,O=Universität Mannheim,ST=Baden-Württemberg,C=DE

Serial Number

95:eb:7d:25:7b:b3:57:08:cb:8f:78:09:af:8b:8b:ee

Issuer

CN=GEANT Code Signing CA 4,O=GEANT Vereniging,C=NL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 9, 2022 - Dec 9, 2023

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=GEANT Code Signing CA 4,O=GEANT Vereniging,C=NL

Serial Number

87:5f:fb:be:35:3c:9d:a3:21:b4:45:56:8c:de:09:50

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 18, 2020 - May 1, 2033

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

libtesseract-5

_ZN9tesseract10SIMDDetect14avx_available_E _ZN9tesseract10SIMDDetect14fma_available_E _ZN9tesseract10SIMDDetect14sse_available_E _ZN9tesseract10SIMDDetect15avx2_available_E _ZN9tesseract10SIMDDetect18avx512F_available_E _ZN9tesseract10SIMDDetect19avx512BW_available_E _ZN9tesseract10SIMDDetect21avx512VNNI_available_E _ZN9tesseract10SIMDDetect6UpdateEv _ZN9tesseract11TessBaseAPI11GetDatapathEv _ZN9tesseract11TessBaseAPI11SetVariableEPKcS2_ _ZN9tesseract11TessBaseAPI12ProcessPagesEPKcS2_iPNS_18TessResultRendererE _ZN9tesseract11TessBaseAPI13AnalyseLayoutEv _ZN9tesseract11TessBaseAPI13SetOutputNameEPKc _ZN9tesseract11TessBaseAPI14SetPageSegModeENS_11PageSegModeE _ZN9tesseract11TessBaseAPI3EndEv _ZN9tesseract11TessBaseAPI4InitEPKcS2_NS_13OcrEngineModeEPPciPKSt6vectorINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESaISC_EESG_b _ZN9tesseract11TessBaseAPI7VersionEv _ZN9tesseract11TessBaseAPI8SetImageEP3Pix _ZN9tesseract11TessBaseAPIC1Ev _ZN9tesseract11TessBaseAPID1Ev _ZN9tesseract15TessOsdRendererC1EPKc _ZN9tesseract15TessPDFRendererC1EPKcS2_b _ZN9tesseract15TessTsvRendererC1EPKcb _ZN9tesseract16TessAltoRendererC1EPKc _ZN9tesseract16TessHOcrRendererC1EPKcb _ZN9tesseract16TessPAGERendererC1EPKc _ZN9tesseract16TessTextRendererC1EPKc _ZN9tesseract16TessUnlvRendererC1EPKc _ZN9tesseract18TessResultRenderer6insertEPS0_ _ZN9tesseract19TessBoxTextRendererC1EPKc _ZN9tesseract19TessLSTMBoxRendererC1EPKc _ZN9tesseract22TessWordStrBoxRendererC1EPKc _ZN9tesseract4Dict15GlobalDawgCacheEv _ZN9tesseract7tprintfEPKcz _ZN9tesseract9log_levelE _ZNK9tesseract11TessBaseAPI14GetPageSegModeEv _ZNK9tesseract11TessBaseAPI14PrintVariablesEP6_iobuf _ZNK9tesseract11TessBaseAPI15GetBoolVariableEPKcPb _ZNK9tesseract11TessBaseAPI15PrintFontsTableEP6_iobuf _ZNK9tesseract11TessBaseAPI29GetAvailableLanguagesAsVectorEPSt6vectorINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESaIS7_EE _ZNK9tesseract12PageIterator11OrientationEPNS_11OrientationEPNS_16WritingDirectionEPNS_13TextlineOrderEPf

libarchive-13

archive_version_details

libcurl-4

curl_version

libleptonica-6

getImagelibVersions getLeptonicaVersion lept_free pixDestroy pixRead setMsgSeverity

libtiff-6

TIFFSetErrorHandler TIFFSetWarningHandler

kernel32

DeleteCriticalSection EnterCriticalSection GetConsoleOutputCP GetLastError GetStartupInfoA InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar SetConsoleOutputCP SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fileno _fmode _initterm _lock _onexit _setmode _unlock abort atoi calloc exit fprintf fputc free fwrite getenv localeconv malloc memcmp memcpy memset signal strchr strcmp strerror strlen strncmp strncpy vfprintf wcslen

libgcc_s_seh-1

_Unwind_Resume

libstdc++-6

_ZNSt8ios_base4InitC1Ev _ZNSt8ios_base4InitD1Ev _ZSt17__throw_bad_allocv _ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base _ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base _ZSt19__throw_logic_errorPKc _ZSt20__throw_length_errorPKc _ZSt20__throw_out_of_rangePKc _ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_ _ZTVN10__cxxabiv117__class_type_infoE _ZTVN10__cxxabiv120__si_class_type_infoE _ZdlPvy _Znwy __cxa_begin_catch __cxa_end_catch __cxa_guard_abort __cxa_guard_acquire __cxa_guard_release __cxa_rethrow __gxx_personality_seh0

Name

.text

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tesseract.exe

PE Signature issue

libtesseract-5

libarchive-13

libcurl-4

libleptonica-6

libtiff-6

kernel32

msvcrt

libgcc_s_seh-1

libstdc++-6

generic