General

Malware Config

Signatures

Files

• 676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4

  .exe windows x86

  d7062ff9af9249c2865b3f45cb91d2e5

  
  

  Code Sign

  50:25:69:b2:35:fd:de:bb:4e:a1:e5:d9:0e:58:ab:8c

  Certificate

  Issuer

  CN=NQVIMWUXQOKJOILYUS

  Not Before

  30-10-2019 11:52

  Not After

  31-12-2039 23:59

  Subject

  CN=NQVIMWUXQOKJOILYUS

  Extended Key Usages

  ExtKeyUsageCodeSigning

  42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

  Certificate

  Issuer

  CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

  Not Before

  07-06-2005 08:09

  Not After

  30-05-2020 10:48

  Subject

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  27-04-2011 00:00

  Not After

  30-05-2020 10:48

  Subject

  CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

  Certificate

  Issuer

  CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  02-05-2019 00:00

  Not After

  30-05-2020 10:48

  Subject

  CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  a3:54:80:4b:17:37:bb:b3:a4:d3:3f:7e:1c:0e:1d:a1:13:da:10:f2

  Signer

  Actual PE Digest

  a3:54:80:4b:17:37:bb:b3:a4:d3:3f:7e:1c:0e:1d:a1:13:da:10:f2

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=NQVIMWUXQOKJOILYUS

  30-10-2019 11:54

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  Sleep

  TlsSetValue

  WaitForSingleObject

  WideCharToMultiByte

  WriteConsoleW

  lstrcmpiW

  lstrcpyW

  lstrlenW

  OutputDebugStringW

  GetStringTypeA

  LCMapStringW

  MultiByteToWideChar

  LCMapStringA

  HeapSize

  RtlUnwind

  HeapReAlloc

  HeapAlloc

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  InitializeCriticalSectionAndSpinCount

  LoadLibraryA

  GetVersionExW

  GetUserDefaultLCID

  GetSystemDirectoryW

  GetStdHandle

  GetModuleHandleW

  GetLocaleInfoW

  GetLocaleInfoA

  GetLastError

  GetExitCodeProcess

  FormatMessageW

  CreateProcessW

  CloseHandle

  SetErrorMode

  VirtualAlloc

  GetModuleHandleA

  GetStringTypeW

  GetCommandLineA

  GetStartupInfoA

  SetUnhandledExceptionFilter

  GetProcAddress

  ExitProcess

  WriteFile

  GetModuleFileNameA

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  GetFileType

  DeleteCriticalSection

  TlsGetValue

  TlsAlloc

  TlsFree

  InterlockedIncrement

  SetLastError

  GetCurrentThreadId

  InterlockedDecrement

  HeapCreate

  VirtualFree

  HeapFree

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  LeaveCriticalSection

  EnterCriticalSection

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  IsDebuggerPresent

  user32

  RegisterClassExW

  GetClassInfoExW

  LoadIconA

  GetCursor

  CharLowerA

  InSendMessage

  GetMessageExtraInfo

  IsWindowUnicode

  IsClipboardFormatAvailable

  IsCharLowerA

  GetQueueStatus

  IsIconic

  GetKBCodePage

  IsWindowVisible

  CharLowerW

  OemKeyScan

  IsMenu

  GetKeyState

  GetMenu

  GetThreadDesktop

  GetSysColorBrush

  GetForegroundWindow

  gdi32

  CloseMetaFile

  UpdateColors

  CloseEnhMetaFile

  GetGraphicsMode

  GetStockObject

  UnrealizeObject

  RealizePalette

  GetEnhMetaFileW

  PathToRegion

  GetTextCharset

  EndDoc

  advapi32

  RegQueryValueExA

  RegOpenKeyExA

  imm32

  ImmGetOpenStatus

  Sections

  .text

  Size: 1.8MB - Virtual size: 1.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 34KB - Virtual size: 33KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ