General

Malware Config

Signatures

Files

• a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392

  .exe windows x86

  94f75deeee49ee18f9c1cb8f126db384

  
  

  Code Sign

  27:1d:6e:56:ab:0d:76:53:ba:9f:b9:10:0d:e7:d0:fd

  Certificate

  Issuer

  CN=NNVJQLHJTLSAYXWHKJ

  Not Before

  24-07-2019 11:25

  Not After

  31-12-2039 23:59

  Subject

  CN=NNVJQLHJTLSAYXWHKJ

  Extended Key Usages

  ExtKeyUsageCodeSigning

  42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

  Certificate

  Issuer

  CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

  Not Before

  07-06-2005 08:09

  Not After

  30-05-2020 10:48

  Subject

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  27-04-2011 00:00

  Not After

  30-05-2020 10:48

  Subject

  CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

  Certificate

  Issuer

  CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  02-05-2019 00:00

  Not After

  30-05-2020 10:48

  Subject

  CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  23:40:f7:d4:2d:95:32:75:bb:58:1c:f5:d5:b6:23:32:fc:6c:90:8c

  Signer

  Actual PE Digest

  23:40:f7:d4:2d:95:32:75:bb:58:1c:f5:d5:b6:23:32:fc:6c:90:8c

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=NNVJQLHJTLSAYXWHKJ

  03-10-2019 13:23

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DisconnectNamedPipe

  EnterCriticalSection

  ExitProcess

  FlushFileBuffers

  FreeEnvironmentStringsA

  FreeEnvironmentStringsW

  GetACP

  GetCPInfo

  GetCommandLineA

  GetConsoleCP

  GetConsoleMode

  GetConsoleOutputCP

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetEnvironmentStrings

  GetEnvironmentStringsW

  GetFileSize

  GetFileType

  GetLastError

  GetLocalTime

  GetLocaleInfoA

  GetModuleFileNameA

  GetOEMCP

  GetProcAddress

  GetProcessHeap

  GetStartupInfoA

  GetStdHandle

  GetStringTypeA

  GetStringTypeW

  GetSystemTimeAsFileTime

  GetTickCount

  GetVersionExA

  HeapAlloc

  HeapCreate

  HeapDestroy

  HeapFree

  HeapReAlloc

  HeapSize

  InitializeCriticalSection

  InterlockedDecrement

  DeviceIoControl

  IsDBCSLeadByte

  IsDebuggerPresent

  IsValidCodePage

  LCMapStringA

  LCMapStringW

  LeaveCriticalSection

  LoadLibraryA

  MapViewOfFile

  MultiByteToWideChar

  OpenProcess

  OutputDebugStringA

  QueryPerformanceCounter

  ReadFile

  RtlUnwind

  SetEnvironmentVariableA

  SetEvent

  SetFilePointer

  SetHandleCount

  SetLastError

  SetStdHandle

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  UnhandledExceptionFilter

  UnmapViewOfFile

  VirtualFree

  WTSGetActiveConsoleSessionId

  WaitForSingleObject

  WideCharToMultiByte

  WriteConsoleA

  WriteConsoleW

  WriteFile

  lstrcmpiA

  DeleteCriticalSection

  CreateThread

  CreateNamedPipeA

  CreateFileMappingA

  CreateFileA

  CreateEventA

  ConnectNamedPipe

  CompareStringW

  CompareStringA

  GetModuleHandleA

  CloseHandle

  SetErrorMode

  InterlockedIncrement

  VirtualAlloc

  InitializeCriticalSectionAndSpinCount

  GetModuleHandleW

  user32

  CharUpperW

  GetClipboardSequenceNumber

  LoadIconA

  gdi32

  Rectangle

  RectInRegion

  PATHOBJ_vGetBounds

  HT_Get8BPPMaskPalette

  GetCharacterPlacementW

  GdiSetPixelFormat

  GdiDllInitialize

  EngTextOut

  GetStockObject

  SetDIBitsToDevice

  advapi32

  RegQueryValueExA

  RegOpenKeyExA

  shell32

  SHGetDesktopFolder

  SHGetPathFromIDListW

  SHPathPrepareForWriteA

  SHPathPrepareForWriteW

  Sections

  .text

  Size: 1.8MB - Virtual size: 1.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 85KB - Virtual size: 85KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ