2026-11-03_4eab19e275e5767fb0f769d9109499bc_icedid_mespinoza_njrat_ryuk
- IMPHASH 87d04d2784a56f61d3ce7e21a5970da7
- SHA256 cb54d1f4cc5b7c430a6d4c95006667eb3fc34fa88c5099ddde8e66a26af3677d
Digest
5d:28:5b:8b:0f:7c:37:dd:cd:8b:91:3c:3b:30:97:73:d5:a7:1d:d7:34:27:4f:21:9e:59:38:67:e9:c2:9f:30
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
ad:61:67:76:49:c6:10:34:b8:0d:ea:16:dc:41:5a:d3:8b:6e:c8:36
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Intel(R) Wireless Connectivity Solutions,O=Intel Corporation,L=Santa Clara,ST=CA,C=US
Subject
CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM
Serial Number
69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Issuer
CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 30, 2014 - Mar 17, 2021
Subject
CN=timestamp.intel.com,OU=Thales TSS ESN:E892-D055-162F+OU=Thales TSS ESN:E892-D055-162F,O=Intel Corporation,L=Santa Clara,ST=CA,C=US
Serial Number
28:a1:1e:74:fc:0b:87:54:58:0f:50:95:4c:47:c9:4e:67:75:4f:28
Issuer
CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 24, 2015 - Apr 24, 2018
Subject
CN=Intel(R) Wireless Connectivity Solutions,O=Intel Corporation,L=Santa Clara,ST=CA,C=US
Serial Number
33:00:00:bb:d8:c0:11:d3:0f:92:82:7b:ed:00:02:00:00:bb:d8
Issuer
CN=Intel External Basic Issuing CA 3B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 10, 2017 - Feb 8, 2018
Subject
CN=Intel External Basic Issuing CA 3B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US
Serial Number
61:2c:ff:88:00:01:00:00:00:10
Issuer
CN=Intel External Basic Policy CA,O=Intel Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 8, 2013 - Feb 8, 2018
Subject
CN=Intel External Basic Policy CA,O=Intel Corporation,C=US
Serial Number
79:17:4a:a9:14:17:36:fe:15:a7:ca:9f:2c:ff:45:88
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Feb 1, 2013 - May 30, 2020
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:43:9b:d4:99:23:01:cb:6d:34:00:00:00:00:00:43
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 1, 2017 - Jun 1, 2018
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ab:5e:40:9d:ee:46:df:2c:6c:00:00:00:00:00:ab
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
6
Entry point
87348
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\BuildViews\JenkinsP\workspace\BCP_HSW\6281\iBTW2682\src\ibt_win_src\06-host_sw\win\bin\ibtsiva\Win10Release\x64\ibtsiva.pdb
Name
.text
Size
331KB
Virtual Size
331KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
133KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=162, id=261, version=24610,
count=7, id=259, version=24123,
count=117, id=261, version=24123,
count=34, id=260, version=24123,
count=9, id=257, version=24610,
count=172, id=1, productName=Unmarked objects,
count=12, id=259, version=24610,
count=23, id=260, version=24610,
count=7, id=265, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,