ngrok-v3-stable-windows-amd64.zip
- SHA256 438bad3dbefd7e244be9dfae3889dcf99073b515845b66ab5617e4887bc24636
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ngrok.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target ngrok-v3-stable-windows-amd64.zip
- Size 11.8MB
- Sample261113-peeswsbw2k
- SHA256 438bad3dbefd7e244be9dfae3889dcf99073b515845b66ab5617e4887bc24636
- MD5 5f917f5f910bd39a5d9caa964d8e290d
- SHA1 2e05406316f70cfa48aa98c023db44523a99845a
- SHA512 d8a9920fbfc305373f8b9659a47d5ca424552c08f66e2b2de1ff072ceb4f6801e7a4ee9d07e95327055a7d172c4cd1d5ebae47fee5963c0699ce1f10384de9da
- SSDEEP 196608:ALIliF8PJ/ly4JZu6n3NzqGUm+/PCrQubwsMErVsrxxFR2twU4WnUazVanC0YnWn:AL8I8PJU43qGdsCzbw3SsrxfRWwAdJnm
- TLSH T14FC633F3C9BDB52263C5AF5AA1566A0CE5C560F2D2E4F5DA3092C34298850FCC9F86DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/ngrok.exe
File Explorer
-
ngrok-v3-stable-windows-amd64.zip.zip 11.8MB
-
ngrok.exe.exe 31.6MB
ngrok.exe
- IMPHASH 70df50797f7a85a271c38135c5679c40
- SHA256 5089402d3a5cb601d75e98231c799c1b770b894a381190a5a1c2f4a57482c8a3
- MD5 3323fc11983c21d5769a18260784c451
- SHA1 c5153734c0f4bcd9dea6667107c1e9505642e2b4
- SHA512 0d049dacf23e95e62beee33d214501082c9ce4fc24c4acf9335f64d0982c1f17df8ce1208309107521d7ef336b79404256216b6311d32db7849d577e9cbadbbc
- SSDEEP 196608:JQneo1svCABeVXt+IxZEtUe+D8HNnOUz9E2rYpwWLB:Z1B+VZEtU8YpbLB
- TLSH T1B0773803F96508E9D0EDD970C66695127FB17C694B3063EB1B54FA202F7ABE06EB9310
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
89:a0:ac:a9:f8:bb:73:fc:ff:72:40:dc:71:a8:e7:d3:f2:bb:96:cc:1d:87:65:42:7e:ec:83:71:4c:d4:3b:1d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=4599079,CN=ngrok\, Inc.,O=ngrok\, Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 23, 2026
SERIALNUMBER=4599079,CN=ngrok\, Inc.,O=ngrok\, Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Subject
SERIALNUMBER=4599079,CN=ngrok\, Inc.,O=ngrok\, Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
07:82:0f:da:9f:83:49:e1:01:8c:a9:60:0d:1e:39:63
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2026 - Jan 24, 2029
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Minor OS version
0
Major OS version
10
Entry point
614944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetProcAddress
LoadLibraryExW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetThreadPriority
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateWaitableTimerA
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
13.4MB
Virtual Size
13.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16.7MB
Virtual Size
16.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
827KB
Virtual Size
33.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
353KB
Virtual Size
353KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
294KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ