PhotoPad[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

PhotoPad.exe
Size

8.7MB
MD5

8b3e138741dd81aab4073a6b2fa350b5
SHA1

d93c39a4861a899190d9e7fbea1f19c01d7b23f6
SHA256

4c19118800b3e0e5897312c9aa2196bd44e48b72ec4c486c3e71dc56178eb2a5
SHA512

de3a6a99982cd45b844f4bbcb2d4067187bea72eb1b57cb9b448dd2a4ad5aacb0a7c8a6b8dca024783ed9b8cad24301402eab7af212fdbaa19e577a6e28a461b
SSDEEP

98304:82QzHEOhfz6qBE7zlacT340cXY0NFtYr3gfEwy3EXORiDMZ3MxmVZ:+jTr6qYD6XYKtYruEwy0XOEC3MmZ

Score

N/A

Malware Config

Signatures

Files

PhotoPad.exe
.exe windows x86

30280da50c69929d9d7aa3681cbae966

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:1a:e2:23:9b:b9:6c:5a:ef:49:d0:ae:50:26:69:12
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

20-05-2022 00:00

Not After

19-05-2023 23:59

Subject

SERIALNUMBER=1005619-7,CN=Aarav Consulting Inc.,O=Aarav Consulting Inc.,L=Brampton,ST=Ontario,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:09:63:78:2a:f1:b4:47:76:80:6c:09:43:24:d0:3d:ed:40:9a:03:72:d4:08:ad:bf:0d:96:39:d5:2b:da:40
Signer

Actual PE Digest

42:09:63:78:2a:f1:b4:47:76:80:6c:09:43:24:d0:3d:ed:40:9a:03:72:d4:08:ad:bf:0d:96:39:d5:2b:da:40

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=1005619-7,CN=Aarav Consulting Inc.,O=Aarav Consulting Inc.,L=Brampton,ST=Ontario,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

21-05-2022 21:53
Valid: true

Chain 1

SERIALNUMBER=1005619-7,CN=Aarav Consulting Inc.,O=Aarav Consulting Inc.,L=Brampton,ST=Ontario,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmGetCompositionStringW
ImmNotifyIME
ImmSetCandidateWindow
ImmGetVirtualKey
ImmGetContext
ImmReleaseContext

kernel32

GetComputerNameW
Process32FirstW
GetModuleFileNameW
SetEndOfFile
FreeResource
GetEnvironmentVariableA
GetPrivateProfileSectionNamesW
GetExitCodeProcess
FindCloseChangeNotification
GetOverlappedResult
RtlCaptureContext
ExitProcess
OpenFileMappingW
RemoveDirectoryW
ReleaseMutex
FileTimeToLocalFileTime
CancelIo
GetProcessHeap
CreateMutexW
GetSystemTime
QueryPerformanceCounter
GetCurrentProcessId
FindNextChangeNotification
ProcessIdToSessionId
FormatMessageW
SetEnvironmentVariableW
LockResource
HeapAlloc
LocalAlloc
ConnectNamedPipe
TerminateProcess
SetCurrentDirectoryW
CreateFileMappingW
ReadProcessMemory
GetEnvironmentVariableW
SetLastError
WaitNamedPipeW
VirtualQuery
SetFilePointer
lstrcpyW
GetCommandLineW
ResumeThread
FindResourceW
Process32NextW
GetDriveTypeW
GetStartupInfoW
CreateNamedPipeW
SystemTimeToTzSpecificLocalTime
SuspendThread
DuplicateHandle
GlobalHandle
SetThreadPriority
UnmapViewOfFile
GetThreadContext
CreateToolhelp32Snapshot
GetCPInfo
LocalFree
GlobalAlloc
ResetEvent
WaitForMultipleObjects
WideCharToMultiByte
lstrlenA
CreateFileA
SetEnvironmentVariableA
GetDiskFreeSpaceExW
GetStdHandle
CreateThread
FileTimeToSystemTime
GetPrivateProfileStringW
GetVersionExA
QueryPerformanceFrequency
GetTimeZoneInformation
LoadLibraryExW
GetShortPathNameW
MapViewOfFile
SetUnhandledExceptionFilter
LoadResource
GetPrivateProfileIntW
CreatePipe
HeapFree
GetCurrentDirectoryA
GetUserDefaultLCID
GetModuleFileNameA
SizeofResource
GetCurrentProcess
GetACP
FindFirstChangeNotificationW
SetFilePointerEx
MultiByteToWideChar
InterlockedIncrement
VerifyVersionInfoW
CloseHandle
DeleteCriticalSection
GetFileSizeEx
MulDiv
MoveFileExW
GetLocaleInfoW
VerSetConditionMask
GlobalFree
WriteFile
GlobalUnlock
LeaveCriticalSection
CopyFileW
OpenProcess
DeleteFileW
GlobalSize
InterlockedExchangeAdd
GetCurrentThreadId
GetThreadPriority
InitializeCriticalSection
FindNextFileW
ReadFile
LoadLibraryW
GetTickCount
GetFileTime
GetFileAttributesW
GlobalMemoryStatusEx
FreeLibrary
GetSystemInfo
MoveFileW
Sleep
GetProcAddress
InterlockedExchange
LoadLibraryA
CreateProcessW
CreateDirectoryW
GetCurrentDirectoryW
GetModuleHandleW
GetVersionExW
FindClose
GlobalLock
EnterCriticalSection
SetEvent
PeekNamedPipe
GetTempPathW
GetCurrentThread
CreateFileW
CreateEventW
FlushFileBuffers
FindFirstFileW
WaitForSingleObject
SetFileAttributesW
InterlockedDecrement
GetLastError
DisconnectNamedPipe
GetSystemTimeAsFileTime
RtlUnwind
GetCommandLineA
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RaiseException
GetStringTypeW
GetStringTypeA
HeapReAlloc
UnhandledExceptionFilter
IsDebuggerPresent
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
GetLocaleInfoA
HeapSize
LCMapStringW

advapi32

RegOpenKeyW
RegQueryInfoKeyW
RegCreateKeyExW
CryptCreateHash
CryptImportKey
SetFileSecurityW
SetSecurityDescriptorDacl
CryptDestroyHash
GetSidLengthRequired
CheckTokenMembership
RegSetKeySecurity
CryptDestroyKey
AllocateAndInitializeSid
CryptHashData
CryptGetKeyParam
OpenProcessToken
CryptSetKeyParam
CryptDecrypt
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
RegDeleteKeyW
RegCloseKey
CryptEncrypt
InitializeSid
GetAce
RegDeleteValueW
RegOpenKeyExW
DuplicateTokenEx
RegSetValueExW
GetUserNameW
CryptReleaseContext
FreeSid
RegQueryValueExW
GetSidSubAuthority
RegEnumKeyW
CryptDuplicateKey
CryptAcquireContextW
RegEnumValueW
RegEnumKeyExW
CryptDeriveKey

gdi32

DeleteObject
CreatePatternBrush
LineTo
CreateCompatibleDC
ExtTextOutW
GetStockObject
SetBrushOrgEx
GetObjectW
CreateCompatibleBitmap
EndPage
EndDoc
CreateFontW
TextOutW
CreateDIBitmap
GetDeviceCaps
Polygon
SetTextColor
StretchDIBits
StartDocW
GetDIBColorTable
SetDIBits
StartPage
MoveToEx
CreateRectRgnIndirect
GetBkMode
CreateSolidBrush
GetCurrentObject
GetClipBox
SetDCBrushColor
CombineRgn
SetPixel
SetBitmapBits
Rectangle
Polyline
SetWindowExtEx
SetTextAlign
StretchBlt
EnumFontFamiliesExW
GetTextAlign
SelectObject
GetDIBits
SetStretchBltMode
GetTextMetricsA
PolyPolyline
SetViewportExtEx
CreateDCW
GetBitmapBits
GetObjectA
PolyDraw
CreatePolygonRgn
PolyTextOutW
CreateDIBSection
CreateBrushIndirect
GetTextCharset
GetViewportExtEx
CreateRectRgn
GetWindowExtEx
SetDIBitsToDevice
SetBkMode
CreatePen
SetBkColor
BitBlt
GetTextMetricsW
CreateFontIndirectW
CreateBitmap
DeleteDC
GetTextExtentPoint32W

ole32

CoInitialize
RegisterDragDrop
CoInitializeSecurity
CoCreateInstance
ReleaseStgMedium
CoSetProxyBlanket
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoGetMalloc
CreateStreamOnHGlobal

oleaut32

OleLoadPicture
SysAllocStringLen
OleCreatePropertyFrame
SysFreeString
OleLoadPicturePath
VariantInit
SysAllocString
SysStringByteLen
VariantClear
SysAllocStringByteLen

shell32

SHGetMalloc
ShellExecuteW
DragQueryPoint
SHGetFolderPathW
ShellExecuteExW
SHGetDesktopFolder
SHChangeNotify
ord680
DragAcceptFiles
DragFinish
SHEmptyRecycleBinW
SHCreateShellItem
DragQueryFileW
SHParseDisplayName
SHGetPathFromIDListW
SHBrowseForFolderW
CommandLineToArgvW
ord155
ShellExecuteA

shlwapi

SHDeleteEmptyKeyW
PathCompactPathExW
StrCmpLogicalW
SHDeleteKeyW

user32

SetWindowsHookExW
CheckDlgButton
GetForegroundWindow
CreateWindowExW
CreateDialogParamW
GetDlgCtrlID
BeginPaint
IsIconic
SetActiveWindow
IsDlgButtonChecked
EnableWindow
GetDlgItem
GetDC
SetFocus
SetForegroundWindow
LoadImageW
UpdateWindow
GetWindowPlacement
SetPropW
SetLayeredWindowAttributes
SetTimer
SetWindowLongW
LoadIconW
SetCapture
SetMenuItemInfoW
DefWindowProcW
PostMessageW
CreatePopupMenu
OpenClipboard
GetClipboardData
GetAsyncKeyState
IsZoomed
SetScrollInfo
IsWindowEnabled
FillRect
MapWindowPoints
GetClientRect
GetWindowTextLengthW
WaitForInputIdle
CallWindowProcW
SetMenu
GetParent
DialogBoxParamW
IsWindowVisible
ScrollWindowEx
GetDialogBaseUnits
GetSysColor
GetDoubleClickTime
GetWindowDC
GetSystemMetrics
DestroyIcon
UnhookWindowsHookEx
MoveWindow
FrameRect
AppendMenuW
CallNextHookEx
SetWindowPlacement
SetMenuInfo
GetMonitorInfoW
ShowScrollBar
EnumDisplayMonitors
PostQuitMessage
EqualRect
DrawIconEx
GetNextDlgGroupItem
FindWindowExW
GetPriorityClipboardFormat
EnumWindows
SendInput
IsCharAlphaW
SetClipboardData
GetClassInfoW
SetDlgItemTextW
DrawEdge
TrackPopupMenu
InsertMenuW
GetWindowTextW
GetAncestor
ChildWindowFromPoint
LoadStringW
GetSubMenu
OffsetRect
EnumDisplayDevicesW
EnumDisplaySettingsW
EndMenu
FindWindowW
GetSysColorBrush
CharUpperW
SetWindowPos
WindowFromDC
GetIconInfo
CreateIconIndirect
GetMenuInfo
ValidateRect
SetWindowRgn
InflateRect
GetClassNameA
MonitorFromPoint
MonitorFromRect
EndDialog
MapDialogRect
PeekMessageW
IsDialogMessageW
DrawTextExW
AdjustWindowRectEx
GetMenuItemCount
GetKeyNameTextW
GetComboBoxInfo
DrawStateW
MonitorFromWindow
GetKeyboardState
MapVirtualKeyW
GetActiveWindow
FlashWindowEx
CountClipboardFormats
GetWindow
DialogBoxIndirectParamW
CheckMenuItem
TranslateMessage
WindowFromPoint
GetMenuBarInfo
GetMessageW
EnumChildWindows
keybd_event
DispatchMessageW
GetDlgItemTextW
DrawFocusRect
InvalidateRgn
GetWindowThreadProcessId
AllowSetForegroundWindow
wsprintfW
AttachThreadInput
MsgWaitForMultipleObjects
CheckRadioButton
UnregisterClassW
DestroyCursor
GetPropW
InvalidateRect
VkKeyScanW
DrawTextW
SystemParametersInfoW
KillTimer
GetScrollBarInfo
ClientToScreen
ScreenToClient
CopyImage
SetClassLongW
RegisterClipboardFormatW
InsertMenuItemW
GetMenu
GetCursorInfo
GetWindowRect
GetFocus
IsWindow
PtInRect
EnableMenuItem
SetCursor
IsClipboardFormatAvailable
RemovePropW
GetMenuItemInfoW
RedrawWindow
DestroyMenu
ShowWindow
GetCapture
LoadCursorW
ModifyMenuW
GetKeyState
GetWindowLongW
RemoveMenu
SendMessageW
DeleteMenu
GetClassNameW
GetDesktopWindow
GetCursor
EndPaint
GetScrollInfo
ReleaseDC
GetUpdateRect
SendDlgItemMessageW
SetWindowTextW
RegisterClassW
ReleaseCapture
DestroyWindow
EmptyClipboard
CloseClipboard
MessageBoxW
CreateDialogIndirectParamW

msimg32

AlphaBlend
GradientFill

crypt32

CertCloseStore
CertVerifySubjectCertificateContext
CryptQueryObject
CertFreeCertificateContext
CertFindCertificateInStore

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 542KB - Virtual size: 544KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

WefYKEL
Size: 231KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.giang
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ferdina
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

30280da50c69929d9d7aa3681cbae966

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0f:1a:e2:23:9b:b9:6c:5a:ef:49:d0:ae:50:26:69:12Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

42:09:63:78:2a:f1:b4:47:76:80:6c:09:43:24:d0:3d:ed:40:9a:03:72:d4:08:ad:bf:0d:96:39:d5:2b:da:40Signer

Signature Validations

Verification

21-05-2022 21:53 Valid: true

Chain 1

Headers

File Characteristics

Imports

imm32

kernel32

advapi32

gdi32

ole32

oleaut32

shell32

shlwapi

user32

msimg32

crypt32

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 542KB - Virtual size: 544KB

.data Size: 29KB - Virtual size: 280KB

.rsrc Size: 2.1MB - Virtual size: 2.1MB

.reloc Size: 192KB - Virtual size: 192KB

WefYKEL Size: 231KB - Virtual size: 232KB

.giang Size: 512B - Virtual size: 4KB

.ferdina Size: 2.8MB - Virtual size: 2.8MB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:1a:e2:23:9b:b9:6c:5a:ef:49:d0:ae:50:26:69:12
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

42:09:63:78:2a:f1:b4:47:76:80:6c:09:43:24:d0:3d:ed:40:9a:03:72:d4:08:ad:bf:0d:96:39:d5:2b:da:40
Signer

21-05-2022 21:53
Valid: true

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 542KB - Virtual size: 544KB

.data
Size: 29KB - Virtual size: 280KB

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

.reloc
Size: 192KB - Virtual size: 192KB

WefYKEL
Size: 231KB - Virtual size: 232KB

.giang
Size: 512B - Virtual size: 4KB

.ferdina
Size: 2.8MB - Virtual size: 2.8MB