2563a07f426efaabcb5f050e21b397e637965e3bd97eb0ad41f5374ca8aad6e6

Sharing

Copy URL

Twitter E-mail

General

Target

2563a07f426efaabcb5f050e21b397e637965e3bd97eb0ad41f5374ca8aad6e6
Size

3.8MB
MD5

70c931858fa895d58e4d987cc53cea75
SHA1

4244d5a55844d205debfd12450a7096376380247
SHA256

2563a07f426efaabcb5f050e21b397e637965e3bd97eb0ad41f5374ca8aad6e6
SHA512

b2a4ccb5278dee16df2c162bbaa94787b7a43d6bb87b09fb85728efd854b6b707047bd8518fbac930b0601a046262ff040633de3926ddfbf5b7ad501b8343ced
SSDEEP

49152:hIjzyjnpUhMhukQNosSICGr8CLBb475k42LB3tEF:hIjzyjnpUMONosSxGrhN81c5K

Score

N/A

Malware Config

Signatures

Files

2563a07f426efaabcb5f050e21b397e637965e3bd97eb0ad41f5374ca8aad6e6
.exe windows x86

64e6a9ff9e7228c21348997eb96a2b62

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:d5:0a:0e:09:bb:9a:83:6f:fb:90:a3
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

03-02-2022 12:53

Not After

04-02-2023 12:53

Subject

SERIALNUMBER=1005311-2,CN=Toliz Info Tech Solutions INC.,O=Toliz Info Tech Solutions INC.,STREET=49 Hinsley Crescent,L=Ajax,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c174162696761696c2e4440736f6c6265727465632e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:38:fc:34:92:54:0d:58:52:63:23:28:bb:54:97:1d:8f:e0:43:77:ab:7e:e8:a3:80:9a:d9:aa:c7:df:d1:27
Signer

Actual PE Digest

28:38:fc:34:92:54:0d:58:52:63:23:28:bb:54:97:1d:8f:e0:43:77:ab:7e:e8:a3:80:9a:d9:aa:c7:df:d1:27

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=1005311-2,CN=Toliz Info Tech Solutions INC.,O=Toliz Info Tech Solutions INC.,STREET=49 Hinsley Crescent,L=Ajax,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c174162696761696c2e4440736f6c6265727465632e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

15-04-2022 23:33
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
LoadResource
GetModuleHandleW
GetProcessHeap
CreateThread
SetLastError
FindResourceW
CancelIo
DuplicateHandle
GlobalHandle
SetThreadExecutionState
RemoveDirectoryW
GetCurrentProcessId
Process32NextW
ProcessIdToSessionId
LocalFree
SetUnhandledExceptionFilter
Process32FirstW
GetModuleFileNameW
GetFileSize
CreatePipe
GetStartupInfoW
WaitForMultipleObjects
DeviceIoControl
QueryPerformanceCounter
ReleaseMutex
GetStdHandle
GetExitCodeProcess
GetOverlappedResult
GetComputerNameW
SystemTimeToTzSpecificLocalTime
ExitProcess
CreateToolhelp32Snapshot
GlobalLock
ConnectNamedPipe
LoadLibraryExW
GetFileSizeEx
FreeResource
GlobalFree
Sleep
FreeLibrary
CopyFileW
SetThreadPriority
MoveFileW
DisconnectNamedPipe
WaitForSingleObject
InterlockedIncrement
SetPriorityClass
InterlockedExchange
LoadLibraryW
FindClose
OpenProcess
GetVersionExW
DeleteFileW
GetCurrentProcess
GetEnvironmentVariableW
LeaveCriticalSection
InitializeCriticalSection
GetCurrentDirectoryW
GetCurrentThread
GetCurrentThreadId
VerifyVersionInfoW
InterlockedDecrement
InterlockedExchangeAdd
GetTickCount
GetTempPathW
FlushFileBuffers
WriteFile
CreateProcessW
CloseHandle
SetFilePointerEx
GetProcAddress
ResetEvent
MulDiv
GetThreadPriority
WideCharToMultiByte
PeekNamedPipe
FindNextFileW
GetDriveTypeW
EnterCriticalSection
MoveFileExW
SetEndOfFile
CreateDirectoryW
CreateEventW
VerSetConditionMask
MultiByteToWideChar
SetEnvironmentVariableW
FindFirstFileW
lstrlenA
GetCommandLineW
SetFileAttributesW
lstrcpyW
MapViewOfFile
CreateFileMappingW
ResumeThread
FileTimeToLocalFileTime
SetCurrentDirectoryW
GetShortPathNameW
GetSystemTime
GetDiskFreeSpaceExW
GetUserDefaultLCID
VirtualQuery
GetPrivateProfileIntW
GetLocaleInfoW
GetPrivateProfileSectionNamesW
GlobalSize
GetTimeZoneInformation
GetSystemInfo
GlobalAlloc
GetVersionExA
CreateMutexW
GetPrivateProfileStringW
HeapFree
GetModuleFileNameA
GetUserDefaultUILanguage
WaitNamedPipeW
HeapAlloc
GlobalUnlock
SizeofResource
LockResource
GetACP
SetFilePointer
CreateNamedPipeW
GetLastError
TerminateProcess
GetFileTime
FileTimeToSystemTime
GetUserDefaultLangID
GetLogicalDriveStringsW
LocalAlloc
GlobalMemoryStatusEx
QueryPerformanceFrequency
GetFileAttributesW
SetEvent
CreateFileW
ReadFile
DeleteCriticalSection
UnmapViewOfFile
GetSystemTimeAsFileTime
HeapReAlloc
UnhandledExceptionFilter
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
CreateFileA
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
RtlUnwind
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStringTypeW
GetStringTypeA
TlsFree
HeapSize
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
IsDebuggerPresent
HeapDestroy
HeapCreate
GetLocaleInfoA
VirtualFree
RaiseException
VirtualAlloc

advapi32

GetSidLengthRequired
RegOpenKeyExW
GetUserNameW
SetFileSecurityW
DuplicateTokenEx
RegDeleteKeyW
RegDeleteValueW
GetSidSubAuthority
FreeSid
RegSetValueExW
GetAce
InitializeAcl
CryptDestroyKey
RegQueryValueExW
CheckTokenMembership
CryptAcquireContextW
SetSecurityDescriptorDacl
CryptDestroyHash
CryptCreateHash
InitializeSecurityDescriptor
AllocateAndInitializeSid
RegSetKeySecurity
CryptDecrypt
RegCloseKey
RegCreateKeyExW
RegEnumKeyW
RegOpenKeyW
CryptDuplicateKey
CryptDeriveKey
InitializeSid
RegEnumValueW
OpenProcessToken
RegQueryInfoKeyW
RegEnumKeyExW
AddAccessAllowedAce
CryptHashData
CryptEncrypt

gdi32

BitBlt
SetWindowExtEx
SetBrushOrgEx
CreateBitmap
GetWindowExtEx
SetBkColor
Polygon
GetDIBits
GetViewportExtEx
SetTextAlign
GetObjectA
CreateDIBSection
CreatePatternBrush
GetTextExtentPoint32W
SetPixel
SetViewportExtEx
ExtFloodFill
CreateCompatibleBitmap
CreateRoundRectRgn
ExtTextOutW
SetDIBits
GetDeviceCaps
StretchBlt
DeleteObject
CreatePen
LineTo
GetBkMode
DeleteDC
CreateFontW
SetTextColor
Polyline
MoveToEx
SetBkMode
CreateFontIndirectW
GetCurrentObject
SelectObject
CreateCompatibleDC
TextOutW
CreateSolidBrush
GetStockObject
GetObjectW
CreateDIBitmap
PolyPolyline
SetStretchBltMode

ole32

CoSetProxyBlanket
PropVariantClear
CreateStreamOnHGlobal
CoGetMalloc
CoCreateInstance
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoTaskMemFree
CoInitializeSecurity

oleaut32

SysAllocString
VariantInit
OleLoadPicturePath
VariantClear
SysAllocStringLen
SysStringByteLen
SysFreeString
SysAllocStringByteLen
OleLoadPicture

shell32

Shell_NotifyIconW
SHGetFolderPathW
SHParseDisplayName
DragQueryFileW
ord155
SHGetPathFromIDListW
DragFinish
ShellExecuteExW
SHEmptyRecycleBinW
DragQueryPoint
SHGetMalloc
SHChangeNotify
ShellExecuteA
DragAcceptFiles
SHBrowseForFolderW
SHGetDesktopFolder
ord680
CommandLineToArgvW
SHCreateShellItem
ShellExecuteW

shlwapi

SHDeleteEmptyKeyW
StrCmpLogicalW
SHDeleteKeyW
PathCompactPathExW

user32

SetWindowPos
GetMenu
InvalidateRect
IsZoomed
SetFocus
GetDlgCtrlID
IsIconic
SetTimer
EndPaint
CreatePopupMenu
IsWindowEnabled
SetCapture
MapVirtualKeyW
EndMenu
OpenClipboard
MonitorFromWindow
CallNextHookEx
CreateDialogIndirectParamW
SetWindowWord
GetClassNameA
ScrollWindowEx
GetKeyNameTextW
EnumWindows
MapDialogRect
SetMenuItemInfoW
GetWindowThreadProcessId
GetSysColorBrush
SetClassLongW
LoadIconW
DispatchMessageW
GetScrollInfo
SystemParametersInfoW
GetMessageW
ClientToScreen
GetAsyncKeyState
GetWindowTextLengthW
keybd_event
CharUpperW
InsertMenuItemW
GetClassNameW
GetMenuBarInfo
AllowSetForegroundWindow
GetScrollBarInfo
RemovePropW
ModifyMenuW
RegisterWindowMessageW
EnableWindow
FindWindowExW
FindWindowW
SetActiveWindow
wsprintfW
SetMenuInfo
CreateDialogParamW
GetIconInfo
DeleteMenu
PostQuitMessage
PeekMessageW
DialogBoxIndirectParamW
GetWindowTextW
SetWindowPlacement
GetSystemMetrics
ReleaseCapture
SetWindowsHookExW
CloseClipboard
MapWindowPoints
GetDlgItemTextW
GetClipboardData
FlashWindowEx
SetScrollInfo
CheckMenuItem
GetComboBoxInfo
IsDialogMessageW
IsClipboardFormatAvailable
LoadStringW
TranslateMessage
IsCharAlphaW
RegisterClassW
InsertMenuW
IsWindow
SetMenu
AttachThreadInput
InflateRect
DrawIconEx
MsgWaitForMultipleObjects
SetDlgItemTextW
SetDlgItemInt
SetWindowRgn
CallWindowProcW
DrawFocusRect
GetMonitorInfoW
GetPropW
DrawEdge
GetAncestor
GetCursor
MonitorFromRect
GetMenuItemCount
GetWindowWord
WindowFromPoint
GetWindow
WindowFromDC
DrawStateW
MonitorFromPoint
GetMenuInfo
GetKeyboardState
GetCapture
GetSubMenu
EndDialog
GetDlgItemInt
GetActiveWindow
PostMessageW
GetCursorInfo
SetWindowLongW
CopyImage
SetPropW
GetFocus
BeginPaint
SetWindowTextW
DefWindowProcW
DestroyWindow
SetForegroundWindow
MessageBoxW
ReleaseDC
CheckDlgButton
ScreenToClient
UpdateWindow
DialogBoxParamW
GetDesktopWindow
SetCursor
GetWindowRect
LoadImageW
EnableMenuItem
TrackPopupMenu
MoveWindow
BringWindowToTop
DestroyIcon
GetClientRect
ShowWindow
CreateWindowExW
SendMessageW
IsWindowVisible
DrawTextW
GetDlgItem
GetWindowLongW
KillTimer
GetKeyState
WaitForInputIdle
GetSysColor
IsDlgButtonChecked
GetForegroundWindow
GetWindowDC
AppendMenuW
FrameRect
LoadCursorW
RemoveMenu
DestroyMenu
UnhookWindowsHookEx
GetWindowPlacement
ChildWindowFromPoint
GetMenuItemInfoW
DrawTextExW
GetDC
GetParent
SendDlgItemMessageW
FillRect

crypt32

CertCloseStore
CertFreeCertificateContext
CertVerifySubjectCertificateContext
CryptQueryObject
CertFindCertificateInStore

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 477KB - Virtual size: 477KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 569KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 672KB - Virtual size: 671KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

dkga
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

dncpju
Size: 948KB - Virtual size: 948KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64e6a9ff9e7228c21348997eb96a2b62

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

05:d5:0a:0e:09:bb:9a:83:6f:fb:90:a3Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

28:38:fc:34:92:54:0d:58:52:63:23:28:bb:54:97:1d:8f:e0:43:77:ab:7e:e8:a3:80:9a:d9:aa:c7:df:d1:27Signer

Signature Validations

Verification

15-04-2022 23:33 Valid: false

Headers

File Characteristics

Imports

kernel32

advapi32

gdi32

ole32

oleaut32

shell32

shlwapi

user32

crypt32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 477KB - Virtual size: 477KB

.data Size: 38KB - Virtual size: 569KB

.rsrc Size: 672KB - Virtual size: 671KB

.reloc Size: 115KB - Virtual size: 114KB

dkga Size: 201KB - Virtual size: 201KB

dncpju Size: 948KB - Virtual size: 948KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

05:d5:0a:0e:09:bb:9a:83:6f:fb:90:a3
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

28:38:fc:34:92:54:0d:58:52:63:23:28:bb:54:97:1d:8f:e0:43:77:ab:7e:e8:a3:80:9a:d9:aa:c7:df:d1:27
Signer

15-04-2022 23:33
Valid: false

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 477KB - Virtual size: 477KB

.data
Size: 38KB - Virtual size: 569KB

.rsrc
Size: 672KB - Virtual size: 671KB

.reloc
Size: 115KB - Virtual size: 114KB

dkga
Size: 201KB - Virtual size: 201KB

dncpju
Size: 948KB - Virtual size: 948KB