General

Malware Config

Signatures

Files

• 15d5c7d616c67d99cbd604cc6401fc2c60e51b29f227cf9c332201a510810693

  .exe windows x86

  2c5f2513605e48f2d8ea5440a870cb9e

  
  

  Code Sign

  33:68:3b:d3:23:36:a3:b4:48:dd:f1:7e:64:80:1a:f6

  Certificate

  Issuer

  CN=n1kobg

  Not Before

  05-12-2018 11:10

  Not After

  05-12-2032 00:00

  Subject

  CN=n1kobg

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  77:65:10:21:8c:ce:12:d7:be:38:fd:ac:a3:68:06:e1:b9:92:9c:d4

  Signer

  Actual PE Digest

  77:65:10:21:8c:ce:12:d7:be:38:fd:ac:a3:68:06:e1:b9:92:9c:d4

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=n1kobg

  15-01-2019 09:27

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  memset

  wcsncmp

  memmove

  wcsncpy

  wcsstr

  _wcsnicmp

  _wcsdup

  free

  _wcsicmp

  wcslen

  wcscpy

  wcscmp

  wcscat

  memcpy

  tolower

  malloc

  kernel32

  GetModuleHandleW

  HeapCreate

  GetStdHandle

  SetConsoleCtrlHandler

  HeapDestroy

  ExitProcess

  WriteFile

  GetTempFileNameW

  LoadLibraryExW

  EnumResourceTypesW

  FreeLibrary

  RemoveDirectoryW

  EnumResourceNamesW

  GetCommandLineW

  LoadResource

  SizeofResource

  FreeResource

  FindResourceW

  GetNativeSystemInfo

  GetShortPathNameW

  GetWindowsDirectoryW

  GetSystemDirectoryW

  EnterCriticalSection

  CloseHandle

  LeaveCriticalSection

  InitializeCriticalSection

  WaitForSingleObject

  TerminateThread

  CreateThread

  GetProcAddress

  GetVersionExW

  Sleep

  WideCharToMultiByte

  HeapAlloc

  HeapFree

  LoadLibraryW

  GetCurrentProcessId

  GetCurrentThreadId

  GetModuleFileNameW

  PeekNamedPipe

  TerminateProcess

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GetCurrentProcess

  DuplicateHandle

  CreatePipe

  CreateProcessW

  GetExitCodeProcess

  SetUnhandledExceptionFilter

  HeapSize

  MultiByteToWideChar

  CreateDirectoryW

  SetFileAttributesW

  GetTempPathW

  DeleteFileW

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  CreateFileW

  SetFilePointer

  TlsFree

  TlsGetValue

  TlsSetValue

  TlsAlloc

  HeapReAlloc

  DeleteCriticalSection

  InterlockedCompareExchange

  InterlockedExchange

  GetLastError

  SetLastError

  UnregisterWait

  GetCurrentThread

  RegisterWaitForSingleObject

  user32

  CharUpperW

  CharLowerW

  MessageBoxW

  DefWindowProcW

  DestroyWindow

  GetWindowLongW

  GetWindowTextLengthW

  GetWindowTextW

  UnregisterClassW

  LoadIconW

  LoadCursorW

  RegisterClassExW

  IsWindowEnabled

  EnableWindow

  GetSystemMetrics

  CreateWindowExW

  SetWindowLongW

  SendMessageW

  SetFocus

  CreateAcceleratorTableW

  SetForegroundWindow

  BringWindowToTop

  GetMessageW

  TranslateAcceleratorW

  TranslateMessage

  DispatchMessageW

  DestroyAcceleratorTable

  PostMessageW

  GetForegroundWindow

  GetWindowThreadProcessId

  IsWindowVisible

  EnumWindows

  SetWindowPos

  gdi32

  GetStockObject

  comctl32

  InitCommonControlsEx

  shell32

  ShellExecuteExW

  SHGetFolderLocation

  SHGetPathFromIDListW

  winmm

  timeBeginPeriod

  ole32

  CoInitialize

  CoTaskMemFree

  shlwapi

  PathAddBackslashW

  PathRenameExtensionW

  PathQuoteSpacesW

  PathRemoveArgsW

  PathRemoveBackslashW

  Sections

  .code

  Size: 14KB - Virtual size: 14KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text

  Size: 54KB - Virtual size: 53KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 179KB - Virtual size: 178KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ