CmdID / Files

cvtres.exe

Microsoft Resource File To COFF Object Conversion Utility file version info

Program on Windows 2 known copies with hashes 2 Sigma rules name it

Is it the real cvtres.exe?

file version info and known copies

Installed inC:\Windows\Microsoft.NET\Framework64\v4.0.30319\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\

Signed byMicrosoft Windows

ProductMicrosoft .NET Framework, Microsoft Corporation

DescriptionMicrosoft Resource File To COFF Object Conversion Utility

2 known copies

14.10.25028.0 built by: VCTOOLSD15RTM · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe · signed by Microsoft Windows

1fe531eac592b480aa4bd16052b909c3431434f17e7ae163d248355558ce43a6

14.10.25028.0 built by: VCTOOLSD15RTM · C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe · signed by Microsoft Windows

e4dbdbf7888ea96f3f8aa5c4c7f2bcf6e57d724dd8194fe5f35b673c6ef724ea

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name cvtres.exe

highVisual Basic Command Line Compiler UsageEnsar Şamil, @sblmsrsn, @oscd_initiative

Sigma names cvtres.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.