Client[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Client.exe
Size 9.2MB
Sample261110-xpcqaacz4w
SHA256 0516f838fb75e5d6c51b13c51046c9755ac11ef82ad6baf3cd8b8af685a1ba59
MD5 9d2413ec3c83dead047a40b1430cca98
SHA1 79ac0ae265437b554b4aaaadb66c1fa738cf8702
SHA512 c5757b61d50eb736e43b459c715c5cee078dcfab32d1f1e4c2c5b1720e53600f7b2609e2c25b5b235a9c8cc60c8193d79486cf0b53e25ed913e31efd1f40de6a
SSDEEP 196608:NFjcCiso0nuzjGbYjdp2xghHZgbcIp5BgZZGlV31UVIfyV0d6S9:NFjcfsYRp2xgh5gnMZGlV3WN0H
TLSH
T17BA612134B4E325B134AF711AC90D4F8AC4D36866AC431F6A453E31DDC262D6E6B8DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
Client.exe

File Explorer

Client.exe

.exe 9.2MB

Client.exe

IMPHASH 6d567096ea84f0381c29c2413b8b373f
SHA256 0516f838fb75e5d6c51b13c51046c9755ac11ef82ad6baf3cd8b8af685a1ba59
MD5 9d2413ec3c83dead047a40b1430cca98
SHA1 79ac0ae265437b554b4aaaadb66c1fa738cf8702
SHA512 c5757b61d50eb736e43b459c715c5cee078dcfab32d1f1e4c2c5b1720e53600f7b2609e2c25b5b235a9c8cc60c8193d79486cf0b53e25ed913e31efd1f40de6a
SSDEEP 196608:NFjcCiso0nuzjGbYjdp2xghHZgbcIp5BgZZGlV31UVIfyV0d6S9:NFjcfsYRp2xgh5gnMZGlV3WN0H
TLSH
T17BA612134B4E325B134AF711AC90D4F8AC4D36866AC431F6A453E31DDC262D6E6B8DEB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

11:df:fc:a7:77:eb:c8:2e:b4:63:bd:5d:13:9b:52:d5:9e:99:f6:bf:7c:5a:c7:cd:b4:97:7b:45:74:d3:05:d3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 10, 2026

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

11:df:fc:a7:77:eb:c8:2e:b4:63:bd:5d:13:9b:52:d5:9e:99:f6:bf:7c:5a:c7:cd:b4:97:7b:45:74:d3:05:d3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 10, 2026

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:17:d4:df:d9:e3:95:0b:e7:ef:00:00:00:00:00:17

Issuer

CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 6, 2026 - Aug 5, 2027

Subject

CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1e:e9:35:2b:ec:86:01:54:15:00:00:00:00:00:1e

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 4, 2026 - Aug 4, 2031

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:44:4e:42:4c:8a:cb:02:7e:2b:00:00:00:00:01:44

Issuer

CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 18, 2026 - Jun 17, 2027

Subject

CN=Windows Production PCA 2023,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:17:85:bd:56:09:4b:f8:c8:21:00:00:00:00:00:17

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 13, 2023 - Jun 13, 2035

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Client.exe

PE Signature issue

PE Signature issue

kernel32

user32

generic