parsecd[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
parsecd.exe
Size 500KB
Sample261107-3ppbzage67
SHA256 9ae7588e68c24c8dfea187152fce8ceb8c58817e063770e55e313e1c33f10cc4
MD5 f9bb63b7d76cc25a7fa676e337c65e25
SHA1 07a14d67151adb384412eb65de7e9fdae7bb424b
SHA512 7bff2d54ff4d488234e1229e7adfa10a5b8fa8d7fb823314e252358923035051f8635df02f890da0080bc7569ba6f77896b81589a25209ede4df2e08e7ce74c4
SSDEEP 6144:Lg7jodG8uMtMrzm9LBBmfj0RYngodL3l7jvGms7X5cf:ScA8uMaC9NBKj0igKL1f+msjaf
TLSH
T1FFB428BBB2E5B4B4D4A3827D8F14861D95E13C1307D387BB2390776A2A33E814939677
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

parsecd.exe

.exe 500KB

parsecd.exe

IMPHASH ee0f49034503b270f4a83d90ae889a71
SHA256 9ae7588e68c24c8dfea187152fce8ceb8c58817e063770e55e313e1c33f10cc4
MD5 f9bb63b7d76cc25a7fa676e337c65e25
SHA1 07a14d67151adb384412eb65de7e9fdae7bb424b
SHA512 7bff2d54ff4d488234e1229e7adfa10a5b8fa8d7fb823314e252358923035051f8635df02f890da0080bc7569ba6f77896b81589a25209ede4df2e08e7ce74c4
SSDEEP 6144:Lg7jodG8uMtMrzm9LBBmfj0RYngodL3l7jvGms7X5cf:ScA8uMaC9NBKj0igKL1f+msjaf
TLSH
T1FFB428BBB2E5B4B4D4A3827D8F14861D95E13C1307D387BB2390776A2A33E814939677
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

78:12:8a:6c:ba:7c:29:85:d6:db:c2:b9:f2:6b:fd:2c:98:ab:9c:3f:f9:cb:23:28:3b:8b:bd:82:1d:89:cf:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

Chains

Sep 2, 2026

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

Serial Number

08:af:a0:0f:8f:60:47:bf:d6:90:7f:b9:f0:74:49:bf

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2025 - May 12, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

166124

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\native-release\native-release\parsec\build\parsecd.pdb

kernel32

GetWindowsDirectoryW GetProcAddress GetCurrentProcessId GetModuleHandleW GetEnvironmentStringsW DeleteFileW GetStdHandle SetUnhandledExceptionFilter FreeLibrary LoadLibraryW GetConsoleMode MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetCurrentThreadId GetFullPathNameW GetCommandLineA ExitProcess TerminateProcess GetModuleHandleExW GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime SetCurrentDirectoryW HeapAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter IsProcessorFeaturePresent HeapFree GetStartupInfoW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetSystemTimeAsFileTime VirtualProtect LoadLibraryExW CompareStringW LCMapStringW HeapReAlloc GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadConsoleW SetStdHandle RaiseException FlushFileBuffers HeapSize HeapQueryInformation GetProcessHeap IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW GetTimeZoneInformation WriteConsoleW SetEndOfFile InitializeSListHead RtlPcToFileHeader TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwindEx GetCurrentDirectoryW GetCurrentThread SetProcessMitigationPolicy FreeEnvironmentStringsW GetSystemDirectoryW SetEnvironmentVariableW GetCommandLineW FindFirstFileExW FindClose GetCurrentProcess FindNextFileW FindFirstFileW CopyFileW GetLastError GetModuleFileNameW WriteFile SetLastError ReadFile CloseHandle GetFileInformationByHandle CreateFileW FileTimeToSystemTime DeviceIoControl

shlwapi

PathFileExistsW PathIsNetworkPathW

shell32

SHGetKnownFolderPath ord165

user32

MessageBoxW

advapi32

OpenProcessToken GetTokenInformation OpenThreadToken IsWellKnownSid

bcrypt

BCryptOpenAlgorithmProvider BCryptHashData BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptCreateHash

crypt32

CryptBinaryToStringW

wintrust

WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust WTHelperGetProvSignerFromChain

ole32

CoTaskMemFree

Name

.text

Size

181KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

parsecd.exe

kernel32

shlwapi

shell32

user32

advapi32

bcrypt

crypt32

wintrust

ole32

generic