General

  • Target
    GovCracker.exe
  • Size 152.2MB
  • Sample261102-lyxw2aa14j
  • SHA256 47af25983d05a72239c8571cf9ac203ddac8a36eac5a29a6c2088a9fc666d652
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

File Explorer

  • GovCracker.exe
    .exe 152.2MB

GovCracker.exe

  • IMPHASH 8a34d2e5912e3d13caec44729685a874
  • SHA256 47af25983d05a72239c8571cf9ac203ddac8a36eac5a29a6c2088a9fc666d652
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Codesign digest Mismatch

    File was altered after it was signed.

PE Signature issue

Digest
cd:9c:65:79:a9:52:bd:14:b6:b1:a3:de:ab:45:d4:8b:d6:74:31:6c:75:a8:eb:5b:d2:de:3f:76:ca:a3:2c:63
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=HRB 7363,CN=DECRYPTA Technologies GmbH,O=DECRYPTA Technologies GmbH,L=Schwerte,ST=Nordrhein-Westfalen,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1305486167656e,1.3.6.1.4.1.311.60.2.1.2=#13134e6f7264726865696e2d5765737466616c656e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Minor OS version
0
Major OS version
6
Entry point
6067232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb