General

Malware Config

Signatures

Files

• 3c56ab9f14f390d86b2453d144704c6775990b6a31b28fcb0ae43dc0fb996140

  .exe windows x86

  324d880ff6c41370ac1dd8774593749b

  
  

  Code Sign

  7c:7f:c3:61:6f:31:57:a2:8f:70:2c:c1:df:27:5d:cd

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  06-04-2018 00:00

  Not After

  06-04-2019 23:59

  Subject

  CN=CFES Projects Ltd,O=CFES Projects Ltd,POSTALCODE=CM1 1JR,STREET=Suite 434\, 4th Floor Victoria House,L=Chelmsford,ST=Essex,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  23:82:9e:f4:94:0a:9e:08:79:85:5f:3d:73:4b:bf:7d:95:b3:06:30

  Signer

  Actual PE Digest

  23:82:9e:f4:94:0a:9e:08:79:85:5f:3d:73:4b:bf:7d:95:b3:06:30

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=CFES Projects Ltd,O=CFES Projects Ltd,POSTALCODE=CM1 1JR,STREET=Suite 434\, 4th Floor Victoria House,L=Chelmsford,ST=Essex,C=GB

  30-06-2022 15:35

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  user32

  GetMessageW

  GetPropW

  MessageBoxA

  InsertMenuA

  LoadBitmapA

  DrawStateW

  FindWindowA

  GetDlgItemTextW

  CharToOemA

  LoadMenuW

  GetClassLongW

  CharUpperW

  LoadIconA

  GetWindow

  MessageBoxA

  LoadImageW

  kernel32

  GetConsoleTitleA

  FindResourceExW

  LoadLibraryA

  GetProcAddress

  lstrlenW

  FormatMessageA

  CloseHandle

  FindNextFileW

  ReadConsoleA

  OpenMutexA

  GetPrivateProfileStringA

  GetTempFileNameA

  TlsGetValue

  GetLogicalDriveStringsA

  CreateJobObjectA

  WaitForSingleObjectEx

  GlobalAddAtomW

  GetTickCount

  CreateProcessA

  GetLongPathNameA

  LoadLibraryExA

  GetLocalTime

  CreateFileA

  InterlockedDecrement

  certcli

  CAEnumNextCA

  CACloseCertType

  CADeleteCA

  CACloseCA

  Sections

  .code

  Size: 53KB - Virtual size: 52KB

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .bss

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  rsrc

  Size: 49KB - Virtual size: 49KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ