General

Malware Config

Signatures

Files

• 5f5d1afc2a4500202b9f7e2d5b80e84112e7dc1302543e8bf2610ab8c99f7c3a

  .exe windows x86

  c1e35a855d20d45e9c84f5bd029dd388

  
  

  Code Sign

  01:68:36:31:1f:c3:9f:bb:8e:6f:30:8b:b0:3c:c2:b3

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-10-2020 00:00

  Not After

  13-10-2021 23:59

  Subject

  CN=SERVICE STREAM LIMITED,O=SERVICE STREAM LIMITED,STREET=Level 4\, 357 Collins Street,L=Melbourne,ST=Victoria,C=AU

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  01-01-2004 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  12-03-2019 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:e6:39:a5:e0:6f:2e:d9:d5:4d:f3:1c:ae:39:02:6f:e8:2a:39:09

  Signer

  Actual PE Digest

  09:e6:39:a5:e0:6f:2e:d9:d5:4d:f3:1c:ae:39:02:6f:e8:2a:39:09

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=SERVICE STREAM LIMITED,O=SERVICE STREAM LIMITED,STREET=Level 4\, 357 Collins Street,L=Melbourne,ST=Victoria,C=AU

  02-05-2022 15:30

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetProcAddress

  LoadLibraryA

  VirtualAlloc

  VirtualFree

  VirtualProtect

  GetModuleHandleA

  lstrcmpA

  GetCurrentThread

  GetLastError

  GetCurrentThreadId

  user32

  GetCursorPos

  GetAsyncKeyState

  GetCaretBlinkTime

  GetActiveWindow

  RegisterClipboardFormatW

  GetClassInfoExA

  comctl32

  InitCommonControls

  advapi32

  DecryptFileA

  ole32

  ReadOleStg

  oleacc

  LresultFromObject

  GetRoleTextW

  oleaut32

  VarUI1FromDate

  VarSub

  VarI2FromCy

  imagehlp

  UnDecorateSymbolName

  SymFromAddr

  UnmapDebugInformation

  gdi32

  GdiStartPageEMF

  shlwapi

  SHRegCreateUSKeyA

  UrlCreateFromPathW

  winspool.drv

  AddPortA

  DocumentPropertySheets

  StartDocDlgA

  oledlg

  OleUIObjectPropertiesA

  winmm

  waveInClose

  PlaySoundW

  comdlg32

  dwLBSubclass

  version

  GetFileVersionInfoW

  VerFindFileW

  gdiplus

  GdipGetImageType

  GdipDrawCurve

  shell32

  ILAppendID

  Options_RunDLLA

  InternalExtractIconListA

  DragQueryFile

  msimg32

  AlphaBlend

  vSetDdrawflag

  Sections

  .code

  Size: 939KB - Virtual size: 939KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 118KB - Virtual size: 118KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE