General

Malware Config

Signatures

Files

• WRSA.exe

  .exe windows x86

  58fe6951c70238da0f8e6edb38a7cd52

  
  

  Code Sign

  5f:de:a0:b8:9d:2d:6f:09:b6:24:ce:76:43:eb:7f:92

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  15-04-2021 00:00

  Not After

  14-04-2024 23:59

  Subject

  CN=Webroot,OU=Webroot,O=Webroot,L=Broomfield,ST=Colorado,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  22-07-2015 21:03

  Not After

  22-07-2025 21:03

  Subject

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:1a:80:b8:ac:eb:3e:d8:d3:04:c0:52:c6:ec:5e:cd:2f:aa:f7:c9:8a:ef:b1:eb:89:62:3a:7f:38:d2:ce:fb

  Signer

  Actual PE Digest

  07:1a:80:b8:ac:eb:3e:d8:d3:04:c0:52:c6:ec:5e:cd:2f:aa:f7:c9:8a:ef:b1:eb:89:62:3a:7f:38:d2:ce:fb

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Webroot,OU=Webroot,O=Webroot,L=Broomfield,ST=Colorado,C=US

  01-11-2021 16:48

  Valid: true

  Chain 1

  CN=Webroot,OU=Webroot,O=Webroot,L=Broomfield,ST=Colorado,C=US

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  LocalFileTimeToFileTime

  GetCurrentThreadId

  GetLocalTime

  GetDiskFreeSpaceExW

  GetSystemTimeAsFileTime

  MoveFileW

  RemoveDirectoryW

  GetDriveTypeW

  CreateDirectoryW

  TerminateProcess

  GetCommandLineA

  GetCurrentProcess

  OpenEventW

  CreateEventW

  ReleaseMutex

  CreateFileW

  GetFileAttributesW

  WriteFile

  SetUnhandledExceptionFilter

  GetLastError

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  VirtualFree

  GetModuleHandleW

  LoadResource

  LockResource

  SizeofResource

  FindResourceW

  LoadLibraryW

  OpenProcess

  GetLocaleInfoW

  GetExitCodeProcess

  DeleteFileW

  GetPrivateProfileStringW

  GetUserDefaultUILanguage

  CopyFileW

  ProcessIdToSessionId

  GetTimeFormatW

  GetDateFormatW

  SystemTimeToFileTime

  FileTimeToLocalFileTime

  DecodePointer

  HeapSize

  WriteConsoleW

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  TerminateThread

  WaitForMultipleObjects

  ExpandEnvironmentStringsW

  GlobalFree

  GetComputerNameW

  SetErrorMode

  GetVolumeInformationW

  FileTimeToSystemTime

  CheckRemoteDebuggerPresent

  GetCurrentProcessId

  SetEvent

  DuplicateHandle

  GetCommandLineW

  GetProcAddress

  FreeLibrary

  ExitProcess

  SetConsoleScreenBufferSize

  GetConsoleScreenBufferInfo

  AllocConsole

  GetStdHandle

  GetTickCount

  GlobalAlloc

  WaitForSingleObject

  CloseHandle

  Sleep

  HeapFree

  HeapReAlloc

  HeapAlloc

  GetProcessHeap

  MultiByteToWideChar

  WideCharToMultiByte

  GetCurrentThread

  GlobalLock

  GlobalUnlock

  DeviceIoControl

  LocalAlloc

  LocalFree

  GetSystemTime

  VerSetConditionMask

  VerifyVersionInfoW

  GetFileSizeEx

  SetHandleInformation

  UnmapViewOfFile

  SetFileAttributesW

  CreateFileMappingA

  MapViewOfFile

  MulDiv

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  GetProcessTimes

  GetModuleHandleA

  GetSystemDirectoryA

  LoadLibraryA

  WTSGetActiveConsoleSessionId

  SetFilePointer

  SetEndOfFile

  MoveFileExW

  CreateSemaphoreW

  GetSystemInfo

  CreateFileMappingW

  AssignProcessToJobObject

  ResumeThread

  GetFileSize

  SetThreadPriority

  FindResourceA

  CreateThread

  QueryDosDeviceW

  LoadLibraryExW

  CreateEventA

  OutputDebugStringA

  WaitForSingleObjectEx

  CompareFileTime

  TryEnterCriticalSection

  GetSystemPowerStatus

  VirtualProtectEx

  ReleaseSemaphore

  CreateSemaphoreA

  GetFileAttributesA

  CreateFileA

  DeleteFileA

  CreateDirectoryA

  GetShortPathNameW

  ReadProcessMemory

  VirtualQueryEx

  GetProcessIoCounters

  Thread32Next

  Thread32First

  CreateToolhelp32Snapshot

  OpenThread

  ReadFile

  AreFileApisANSI

  FindFirstFileW

  CompareStringW

  SetLastError

  GetFullPathNameW

  FindNextFileW

  GetLongPathNameW

  GetCPInfo

  GetProcessAffinityMask

  SetFileTime

  GetModuleFileNameW

  FoldStringW

  CreateHardLinkW

  FindClose

  GetVersionExW

  GetSystemDirectoryW

  GetConsoleMode

  TzSpecificLocalTimeToSystemTime

  ResetEvent

  IsDBCSLeadByte

  SetThreadExecutionState

  SystemTimeToTzSpecificLocalTime

  GetFileType

  FlushFileBuffers

  GetOEMCP

  PeekNamedPipe

  GetACP

  IsValidCodePage

  GetFileInformationByHandle

  VerLanguageNameW

  UnhandledExceptionFilter

  IsProcessorFeaturePresent

  InitializeCriticalSectionAndSpinCount

  QueryPerformanceCounter

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  RtlUnwind

  RaiseException

  EncodePointer

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  SetStdHandle

  ReadConsoleW

  GetConsoleOutputCP

  SetFilePointerEx

  GetModuleHandleExW

  QueryPerformanceFrequency

  LCMapStringW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetTimeZoneInformation

  GetStringTypeW

  CreateProcessW

  GetFileAttributesExW

  FindFirstFileExW

  GetEnvironmentStringsW

  user32

  PostQuitMessage

  FillRect

  DrawTextW

  CreateWindowExW

  CallWindowProcW

  DrawIcon

  DrawFrameControl

  FindWindowA

  SetRect

  SetCursor

  LoadCursorW

  SetLayeredWindowAttributes

  MoveWindow

  AttachThreadInput

  ClientToScreen

  DrawTextA

  OffsetRect

  GetClassNameA

  SetWindowTextW

  InflateRect

  GetMonitorInfoW

  GetShellWindow

  MonitorFromRect

  EqualRect

  FindWindowExW

  SystemParametersInfoW

  FindWindowExA

  UnhookWindowsHookEx

  WaitForInputIdle

  CallNextHookEx

  MapWindowPoints

  GetFocus

  GetMessagePos

  SendInput

  GetGUIThreadInfo

  SetWindowsHookExW

  MapVirtualKeyExW

  CreateDesktopW

  CharToOemBuffW

  OemToCharA

  CharToOemA

  OemToCharBuffA

  CharLowerW

  CharUpperW

  GetMessageExtraInfo

  DispatchMessageW

  TranslateMessage

  BeginPaint

  PostThreadMessageW

  LockWorkStation

  SetWindowLongW

  GetWindowLongW

  wsprintfW

  EnumWindows

  GetDC

  IsWindowVisible

  EnumDisplayDevicesW

  GetGuiResources

  ReleaseDC

  GetWindowDC

  PtInRect

  MessageBoxW

  EndPaint

  GetAncestor

  GetForegroundWindow

  keybd_event

  GetAsyncKeyState

  GetKeyboardLayout

  GetWindowTextW

  SwitchToThisWindow

  IsWindow

  DestroyIcon

  LoadImageA

  LoadImageW

  SetTimer

  GetClientRect

  SetWindowRgn

  SetWindowPos

  GetWindowRect

  SetForegroundWindow

  DestroyWindow

  DefWindowProcW

  CheckMenuItem

  EnableWindow

  IsIconic

  InvalidateRect

  PostMessageW

  GetWindowThreadProcessId

  FindWindowW

  GetDesktopWindow

  EnableMenuItem

  GetSystemMetrics

  UpdateWindow

  EmptyClipboard

  SetClipboardData

  CloseClipboard

  OpenClipboard

  KillTimer

  ShowWindow

  SetFocus

  SendMessageW

  SetWindowTextA

  ScreenToClient

  GetCursorPos

  SetMessageExtraInfo

  SetWinEventHook

  UnhookWinEvent

  GetWindowTextA

  GetMessageW

  MessageBeep

  gdi32

  SetBrushOrgEx

  GetDeviceCaps

  CreateDIBSection

  DeleteDC

  BitBlt

  SetTextColor

  SelectObject

  CreateCompatibleDC

  DeleteObject

  CreateRoundRectRgn

  SetBkMode

  GetStockObject

  CreateCompatibleBitmap

  GetPixel

  CreateSolidBrush

  CreatePen

  SetWorldTransform

  SetDCPenColor

  RoundRect

  SetStretchBltMode

  SetDCBrushColor

  Rectangle

  StretchBlt

  SetGraphicsMode

  PatBlt

  SetPixel

  IntersectClipRect

  ExtTextOutW

  SetBkColor

  ExcludeClipRect

  SelectClipRgn

  MoveToEx

  LineTo

  CreateFontA

  GetObjectW

  CombineRgn

  CreateRectRgn

  advapi32

  GetAce

  QueryServiceStatusEx

  OpenServiceW

  OpenSCManagerW

  CloseServiceHandle

  GetTraceEnableFlags

  GetTraceEnableLevel

  GetTraceLoggerHandle

  UnregisterTraceGuids

  RegisterTraceGuidsW

  RegSetValueExW

  RegCreateKeyExW

  RegCloseKey

  GetUserNameW

  TraceMessage

  DuplicateTokenEx

  GetLengthSid

  SetThreadToken

  OpenProcessToken

  ConvertStringSidToSidW

  SetTokenInformation

  GetTokenInformation

  SetSecurityInfo

  InitializeAcl

  CheckTokenMembership

  FreeSid

  CreateWellKnownSid

  AllocateAndInitializeSid

  RegOpenKeyExW

  OpenSCManagerA

  RegNotifyChangeKeyValue

  CreateProcessAsUserW

  SetEntriesInAclW

  GetFileSecurityW

  SetNamedSecurityInfoW

  BuildExplicitAccessWithNameW

  GetAclInformation

  GetSecurityDescriptorDacl

  ConvertSidToStringSidW

  IsValidSid

  SetFileSecurityW

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  ole32

  CreateStreamOnHGlobal

  gdiplus

  GdipDisposeImage

  GdipDrawImageRect

  GdipGetImageHeight

  GdiplusShutdown

  GdiplusStartup

  GdipDeleteGraphics

  GdipGetImageWidth

  GdipLoadImageFromStream

  GdipCreateFromHDC

  ws2_32

  socket

  getaddrinfo

  WSAAddressToStringA

  freeaddrinfo

  closesocket

  gethostbyname

  inet_addr

  connect

  htons

  send

  Sections

  .text

  Size: 2.1MB - Virtual size: 2.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 305KB - Virtual size: 305KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 22KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2.7MB - Virtual size: 2.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 80KB - Virtual size: 80KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ