General

  • Target
    RevolutionMacro.exe
  • Size 80.7MB
  • Sample261102-xdk8aayw8p
  • SHA256 f1265f44fde306800bc82414f71d636400e24c63edd5c00c564e375951c6bb59
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • RevolutionMacro.exe
    .exe 80.7MB

RevolutionMacro.exe

  • IMPHASH 0e5680d929071a7e6b71f9f61caa3206
  • SHA256 f1265f44fde306800bc82414f71d636400e24c63edd5c00c564e375951c6bb59
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest
fb:7f:cb:56:59:75:3e:1c:9b:23:38:16:33:55:64:98:96:c6:84:df:14:11:1b:44:98:bf:b6:84:fc:e5:49:82
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=REVOLUTION SOFTWARE LLC,O=REVOLUTION SOFTWARE LLC,L=Portland,ST=Oregon,C=US
Chains

Jan 1, 0001

Minor OS version
1
Major OS version
6
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED
PDB paths