General

Malware Config

Signatures

Files

• 777730a4dba9903962bc374ce2174401eb647970985ff2f684ef6d30d6b6b7d5

  .dll windows x86

  b202c5ea77ba4c12a8f152492d1c3f28

  
  

  Code Sign

  33:3c:a7:d1:00:b1:39:b0:d9:c1:a9:7c:b4:58:e2:26

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  16-12-2020 00:00

  Not After

  16-12-2021 23:59

  Subject

  CN=FSE\, d.o.o.,O=FSE\, d.o.o.,POSTALCODE=1000,STREET=Šmartinska cesta 106,L=Ljubljana,C=SI

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  01-01-2004 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  12-03-2019 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  9e:ce:58:b3:02:f2:94:e3:17:75:dd:e8:c1:ea:fa:98:44:bb:1e:4d

  Signer

  Actual PE Digest

  9e:ce:58:b3:02:f2:94:e3:17:75:dd:e8:c1:ea:fa:98:44:bb:1e:4d

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=FSE\, d.o.o.,O=FSE\, d.o.o.,POSTALCODE=1000,STREET=Šmartinska cesta 106,L=Ljubljana,C=SI

  18-03-2022 14:22

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetProcAddress

  GetModuleHandleA

  LoadLibraryA

  RaiseException

  SizeofResource

  GetConsoleAliasW

  CreateEventA

  BuildCommDCBAndTimeoutsA

  GetComputerNameW

  SetFileApisToOEM

  PrepareTape

  GetCurrentThread

  GetStringTypeExA

  GlobalUnfix

  GetProfileSectionA

  EndUpdateResourceA

  RemoveDirectoryW

  SetThreadPriority

  GetSystemTimeAdjustment

  GetConsoleAliasesW

  GetCommState

  GlobalWire

  SetConsoleCP

  SetConsoleOutputCP

  lstrlenW

  GetAtomNameW

  CreateTapePartition

  WriteProfileSectionA

  CancelTimerQueueTimer

  _lread

  SetFileApisToANSI

  GetUserDefaultLCID

  GetVersion

  GetModuleHandleW

  ExpandEnvironmentStringsA

  lstrlenA

  MultiByteToWideChar

  FreeLibrary

  GetCommandLineA

  GetVersionExA

  GetStartupInfoA

  SetUnhandledExceptionFilter

  ExitProcess

  WriteFile

  GetStdHandle

  GetModuleFileNameA

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  WideCharToMultiByte

  GetLastError

  GetEnvironmentStringsW

  SetHandleCount

  GetFileType

  DeleteCriticalSection

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  SetLastError

  InterlockedDecrement

  GetCurrentThreadId

  HeapDestroy

  HeapCreate

  VirtualFree

  HeapFree

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  HeapAlloc

  LeaveCriticalSection

  EnterCriticalSection

  OutputDebugStringA

  InitializeCriticalSection

  GetCPInfo

  GetACP

  GetOEMCP

  Sleep

  VirtualAlloc

  HeapReAlloc

  RtlUnwind

  LCMapStringA

  LCMapStringW

  GetStringTypeA

  GetStringTypeW

  GetLocaleInfoA

  VirtualProtect

  GetSystemInfo

  VirtualQuery

  user32

  GetKeyboardType

  CreateWindowExW

  DefDlgProcW

  TrackPopupMenu

  SetDebugErrorLevel

  GetCaretPos

  LoadIconA

  GetQueueStatus

  gdi32

  UnrealizeObject

  GetTextExtentExPointA

  GetRandomRgn

  StretchBlt

  GdiGetLocalFont

  GdiConvertFont

  EngEraseSurface

  EngTransparentBlt

  EnumFontsA

  GdiEntry7

  CheckColorsInGamut

  ModifyWorldTransform

  CreateRectRgnIndirect

  AnyLinkedFonts

  AddFontResourceExW

  SetWindowExtEx

  GetArcDirection

  CreateFontW

  GetEnhMetaFileW

  GetStockObject

  AddFontResourceA

  GetEnhMetaFileBits

  comdlg32

  PrintDlgA

  advapi32

  RegQueryValueExA

  SetSecurityDescriptorDacl

  GetTokenInformation

  GetKernelObjectSecurity

  StartServiceA

  RegCloseKey

  RegOpenKeyExA

  RegOpenKeyA

  shell32

  Shell_NotifyIconA

  SHGetSpecialFolderLocation

  SHGetPathFromIDListA

  ShellExecuteA

  SHQueryRecycleBinA

  ole32

  CreateStreamOnHGlobal

  IsEqualGUID

  GetHGlobalFromStream

  comctl32

  ImageList_SetIconSize

  ImageList_Write

  UninitializeFlatSB

  imm32

  ImmGetVirtualKey

  Sections

  .text

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2.3MB - Virtual size: 2.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rdata3

  Size: 102KB - Virtual size: 101KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata5

  Size: 1024B - Virtual size: 1000B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata4

  Size: 1024B - Virtual size: 1000B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 104KB - Virtual size: 104KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 580B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ