General

Malware Config

Signatures

Files

• 988ba4728db4c7fb5bbe34c07c298856

  .exe windows x86

  616a74cc49697a109c9099edcedf2191

  
  

  Code Sign

  01

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  01-01-2004 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  18:b1:41:41:6f:9a:66:4c:1e:a6:f6:b5:59:e5:db:82

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

  Not Before

  11-10-2021 00:00

  Not After

  11-10-2022 23:59

  Subject

  SERIALNUMBER=572790,CN=Open Box Models Limited,O=Open Box Models Limited,ST=Galway,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  ab:24:be:a7:4a:a5:f9:53:1e:16:87:9d:03:b9:d8:a5:7b:0a:1b:e6:3d:ab:34:53:b0:5a:f0:09:bf:43:55:8b

  Signer

  Actual PE Digest

  ab:24:be:a7:4a:a5:f9:53:1e:16:87:9d:03:b9:d8:a5:7b:0a:1b:e6:3d:ab:34:53:b0:5a:f0:09:bf:43:55:8b

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=572790,CN=Open Box Models Limited,O=Open Box Models Limited,ST=Galway,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

  28-01-2022 14:03

  Valid: true

  Chain 1

  SERIALNUMBER=572790,CN=Open Box Models Limited,O=Open Box Models Limited,ST=Galway,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

  CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  shfolder

  SHGetFolderPathW

  shlwapi

  PathIsRelativeW

  PathIsUNCW

  PathIsURLW

  StrToIntW

  PathCombineW

  UrlCombineW

  PathIsDirectoryW

  PathIsDirectoryEmptyW

  PathFileExistsW

  PathCanonicalizeW

  PathFindFileNameW

  wininet

  InternetCrackUrlW

  HttpQueryInfoW

  InternetCloseHandle

  InternetConnectW

  HttpSendRequestW

  HttpOpenRequestW

  InternetSetOptionW

  InternetOpenW

  InternetReadFile

  InternetErrorDlg

  msi

  ord96

  ord281

  ord141

  ord171

  ord115

  ord94

  ord8

  ord34

  ord145

  ord70

  ord90

  ord246

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  gdi32

  SelectObject

  GetTextMetricsW

  DeleteDC

  CreateDCW

  GetObjectW

  DeleteObject

  CreateSolidBrush

  SetBkColor

  SetTextColor

  GetDeviceCaps

  CreateFontIndirectW

  GetTextExtentPoint32W

  GetStockObject

  psapi

  GetProcessImageFileNameW

  EnumProcesses

  user32

  GetWindowTextLengthW

  CheckDlgButton

  GetSystemMenu

  EnableMenuItem

  EnableWindow

  IsWindow

  FillRect

  DestroyIcon

  DrawTextW

  EndPaint

  DrawIcon

  DrawIconEx

  BeginPaint

  GetIconInfo

  MessageBeep

  MessageBoxW

  GetLastActivePopup

  GetActiveWindow

  SetRect

  SetCursor

  SetCapture

  InvalidateRect

  ReleaseCapture

  GetClientRect

  DrawFocusRect

  RemovePropW

  CallWindowProcW

  GetPropW

  SetPropW

  GetParent

  IsWindowVisible

  ShutdownBlockReasonCreate

  SetDlgItemTextW

  EndDialog

  GetSysColor

  SendMessageW

  LoadImageW

  GetWindowTextW

  ShutdownBlockReasonDestroy

  DialogBoxParamW

  UpdateWindow

  ShowWindow

  ScreenToClient

  GetDlgItem

  IsDialogMessageW

  MoveWindow

  SendDlgItemMessageW

  SystemParametersInfoW

  GetWindowRect

  CreateDialogParamW

  LoadCursorW

  GetClassNameW

  DispatchMessageW

  TranslateMessage

  TranslateAcceleratorW

  GetMessageW

  LoadAcceleratorsW

  ReleaseDC

  GetDC

  EnumWindows

  LoadStringW

  WaitForInputIdle

  GetSystemMetrics

  PostMessageW

  DefWindowProcW

  GetWindowLongW

  SetWindowLongW

  CreateWindowExW

  RegisterClassExW

  DestroyWindow

  SendNotifyMessageW

  KillTimer

  SetTimer

  WaitMessage

  SetFocus

  SetWindowPos

  SetForegroundWindow

  WinHelpW

  RedrawWindow

  GetDialogBaseUnits

  OpenClipboard

  EmptyClipboard

  SetClipboardData

  CloseClipboard

  GetAsyncKeyState

  GetWindow

  CreateDialogIndirectParamW

  PostQuitMessage

  PeekMessageW

  SetWindowTextW

  ole32

  CoUninitialize

  CoSetProxyBlanket

  CoCreateInstance

  CoInitializeEx

  oleaut32

  SafeArrayLock

  SafeArrayUnlock

  SafeArrayRedim

  SafeArrayGetUBound

  SafeArrayGetLBound

  SafeArrayDestroy

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayCreate

  SysAllocStringLen

  SysStringLen

  VariantInit

  VariantClear

  SysAllocString

  SysFreeString

  kernel32

  RtlUnwind

  GetCPInfo

  GetStartupInfoW

  HeapSetInformation

  DecodePointer

  EncodePointer

  GetStringTypeW

  InterlockedIncrement

  InterlockedCompareExchange

  LCMapStringW

  SetUnhandledExceptionFilter

  ExitProcess

  GetStdHandle

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  GetFileType

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  HeapCreate

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  TerminateProcess

  UnhandledExceptionFilter

  IsDebuggerPresent

  IsProcessorFeaturePresent

  GetACP

  GetOEMCP

  IsValidCodePage

  GetConsoleCP

  GetConsoleMode

  FlushFileBuffers

  GetLocaleInfoA

  EnumSystemLocalesA

  IsValidLocale

  WriteConsoleW

  SetStdHandle

  InterlockedExchangeAdd

  RaiseException

  HeapSize

  HeapReAlloc

  HeapDestroy

  lstrlenA

  LocalUnlock

  LocalLock

  GlobalUnlock

  GlobalLock

  VirtualFree

  VirtualAlloc

  MulDiv

  ConnectNamedPipe

  SetNamedPipeHandleState

  WaitNamedPipeW

  CreateNamedPipeW

  GetCurrentThread

  InitializeCriticalSectionAndSpinCount

  GetCurrentThreadId

  ReleaseMutex

  SetFilePointer

  lstrcpyW

  DeleteAtom

  CompareStringW

  LoadLibraryA

  GetModuleHandleW

  LoadLibraryW

  GetSystemDirectoryW

  LocalAlloc

  GetCurrentProcess

  GetVersionExW

  GetSystemTime

  SetProcessShutdownParameters

  GetUserDefaultLCID

  GetCommandLineW

  QueueUserWorkItem

  WideCharToMultiByte

  FreeLibrary

  GetProcAddress

  SearchPathW

  WriteFile

  ReadFile

  GetFileSize

  CreateFileW

  GetLocalTime

  MultiByteToWideChar

  RemoveDirectoryW

  FindNextFileW

  FindClose

  FindFirstFileW

  SetLastError

  CreateDirectoryW

  GetFileAttributesW

  HeapFree

  GetProcessHeap

  HeapAlloc

  InterlockedDecrement

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  lstrcmpiW

  OpenProcess

  ProcessIdToSessionId

  GlobalDeleteAtom

  GlobalAddAtomW

  GlobalFindAtomW

  lstrlenW

  CallNamedPipeW

  GetSystemWow64DirectoryW

  GetCurrentProcessId

  GlobalAlloc

  GetLastError

  Sleep

  GlobalFree

  SizeofResource

  LockResource

  LoadResource

  FindResourceW

  FindResourceExW

  InitializeCriticalSection

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  SetEndOfFile

  WaitForSingleObject

  CloseHandle

  FormatMessageW

  LocalFree

  CreateThread

  GetTickCount

  WaitForMultipleObjects

  TerminateThread

  CreateEventW

  GetModuleFileNameW

  SetEvent

  InterlockedExchange

  CopyFileExW

  DeleteFileW

  MoveFileW

  SetFileAttributesW

  GetLocaleInfoW

  GetFullPathNameW

  CreateProcessW

  GetExitCodeProcess

  advapi32

  CloseServiceHandle

  RegCloseKey

  RegOpenKeyExW

  RegCreateKeyExW

  RegQueryValueExW

  RegSetValueExW

  RegDeleteValueW

  RegEnumKeyExW

  RegEnumValueW

  RegQueryInfoKeyW

  InitializeAcl

  CreateWellKnownSid

  AbortSystemShutdownW

  OpenProcessToken

  GetTokenInformation

  GetSidSubAuthority

  DuplicateToken

  CheckTokenMembership

  GetLengthSid

  CopySid

  FreeSid

  ConvertStringSidToSidW

  SetEntriesInAclW

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  OpenThreadToken

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  AllocateAndInitializeSid

  AddAccessAllowedAce

  OpenSCManagerW

  CreateServiceW

  ChangeServiceConfig2W

  SetNamedSecurityInfoW

  OpenServiceW

  ControlService

  QueryServiceStatus

  DeleteService

  StartServiceW

  shell32

  ShellExecuteW

  ShellExecuteExW

  urlmon

  ObtainUserAgentString

  Sections

  .text

  Size: 436KB - Virtual size: 435KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 85KB - Virtual size: 84KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 9KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 263KB - Virtual size: 262KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ