General

Malware Config

Signatures

Files

• 3456415723656eef7b0a8b0f655bf5ad0da411df02839dcfb148ea3b7fdffdf0

  .exe windows x86

  1d7a644f480a5182c7c8f41a391ec21f

  
  

  Code Sign

  71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47

  Certificate

  Issuer

  CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

  Not Before

  15-08-2017 07:55

  Not After

  15-08-2028 07:55

  Subject

  CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  32:91:0d:bc:61:0f:83:4f:12:b8:d4:32:5e:d5:bc:92

  Certificate

  Issuer

  CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

  Not Before

  01-07-2019 00:00

  Not After

  30-06-2020 23:59

  Subject

  CN=REFLEX EXPRESS LIMITED,O=REFLEX EXPRESS LIMITED,L=WARRINGTON,ST=Cheshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-08-2009 01:00

  Not After

  08-08-2039 01:00

  Subject

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-04-2015 00:58

  Not After

  08-04-2025 00:58

  Subject

  CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  53:16:42:b2:dd:6f:01:45:46:bb:20:13:67:53:c8:79:fd:13:67:9f

  Signer

  Actual PE Digest

  53:16:42:b2:dd:6f:01:45:46:bb:20:13:67:53:c8:79:fd:13:67:9f

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=REFLEX EXPRESS LIMITED,O=REFLEX EXPRESS LIMITED,L=WARRINGTON,ST=Cheshire,C=GB

  03-07-2019 11:38

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  esent

  JetPrepareUpdate

  msvcrt

  memset

  shlwapi

  ord29

  oleaut32

  VarDecFromR4

  kernel32

  GetCurrentProcessorNumber

  GetCommandLineA

  AddAtomA

  GetProcessShutdownParameters

  GetThreadId

  GetModuleFileNameW

  GetTickCount

  GetCurrentThread

  powrprof

  GetPwrCapabilities

  user32

  IsClipboardFormatAvailable

  IsWindowUnicode

  GetClipboardSequenceNumber

  GetCapture

  Sections

  .text

  Size: 12KB - Virtual size: 10KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .V4Y

  Size: 132KB - Virtual size: 128KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 4KB - Virtual size: 332B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ