General

Malware Config

Signatures

Files

• 48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1

  .exe windows x64

  e6981a42fc7d4b9fb0d6a5980cf38926

  
  

  Code Sign

  97:31:78:60:37:43:69:27:7f:93:ca:4a:d5:05:e4:48

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  15-01-2021 00:00

  Not After

  15-01-2024 23:59

  Subject

  CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,POSTALCODE=1404,STREET=Goze Delchev\, bl261,L=Sofia,C=BG

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  12-03-2019 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

  Certificate

  Issuer

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  23-10-2020 00:00

  Not After

  22-01-2032 23:59

  Subject

  CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-05-2019 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  f2:db:70:a4:5a:1b:ef:16:ef:be:4d:58:24:39:aa:6c:a8:e2:ab:db:1e:e1:e0:50:7b:8d:c4:d7:03:7c:57:47

  Signer

  Actual PE Digest

  f2:db:70:a4:5a:1b:ef:16:ef:be:4d:58:24:39:aa:6c:a8:e2:ab:db:1e:e1:e0:50:7b:8d:c4:d7:03:7c:57:47

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,POSTALCODE=1404,STREET=Goze Delchev\, bl261,L=Sofia,C=BG

  13-07-2022 16:55

  Valid: true

  Chain 1

  CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,POSTALCODE=1404,STREET=Goze Delchev\, bl261,L=Sofia,C=BG

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Chain 2

  CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,POSTALCODE=1404,STREET=Goze Delchev\, bl261,L=Sofia,C=BG

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  bcrypt

  BCryptOpenAlgorithmProvider

  BCryptFinishHash

  BCryptCloseAlgorithmProvider

  BCryptDestroyHash

  BCryptHashData

  BCryptCreateHash

  BCryptGetProperty

  wininet

  InternetQueryDataAvailable

  HttpOpenRequestA

  HttpQueryInfoW

  InternetQueryOptionW

  InternetOpenA

  InternetCloseHandle

  HttpSendRequestA

  InternetConnectA

  InternetSetOptionW

  InternetReadFile

  HttpAddRequestHeadersA

  shlwapi

  PathFileExistsW

  ws2_32

  freeaddrinfo

  WSACleanup

  __WSAFDIsSet

  accept

  bind

  closesocket

  gethostbyname

  select

  shutdown

  listen

  getaddrinfo

  WSAStartup

  inet_addr

  gethostbyaddr

  send

  socket

  connect

  WSAAddressToStringW

  recv

  htons

  kernel32

  GetFileSizeEx

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  GetStdHandle

  ExitProcess

  GetModuleHandleExW

  FreeLibraryAndExitThread

  ExitThread

  LoadLibraryExW

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  GetModuleFileNameW

  HeapFree

  GetCurrentProcess

  HeapAlloc

  LocalFree

  GetProcessHeap

  MultiByteToWideChar

  FormatMessageW

  CreateDirectoryW

  FindFirstFileW

  EnterCriticalSection

  FindNextFileW

  lstrlenW

  WriteFile

  lstrcpynW

  GetUserDefaultUILanguage

  LeaveCriticalSection

  InitializeCriticalSection

  CreateMutexW

  InitializeCriticalSectionEx

  FindClose

  GetLocaleInfoW

  WaitForSingleObject

  CreateFileW

  GetVersionExW

  Sleep

  GetLastError

  GetCurrentThread

  GetFileType

  DeleteFileW

  CloseHandle

  RaiseException

  LoadLibraryW

  CreateThread

  DecodePointer

  GetProcAddress

  GetFileSize

  DeleteCriticalSection

  GetCurrentProcessId

  GetModuleHandleW

  FreeLibrary

  CopyFileW

  WideCharToMultiByte

  SetUnhandledExceptionFilter

  GetExitCodeProcess

  GetModuleFileNameA

  SetLastError

  RtlCaptureContext

  OutputDebugStringA

  GetEnvironmentVariableW

  GetEnvironmentVariableA

  GetFileAttributesW

  SuspendThread

  GetCurrentDirectoryA

  ResumeThread

  GetVersionExA

  GetThreadContext

  ReadProcessMemory

  CreateEventExW

  WaitForMultipleObjects

  SetEvent

  ResetEvent

  QueryPerformanceCounter

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  OutputDebugStringW

  RtlUnwindEx

  RtlPcToFileHeader

  GetDateFormatW

  GetTimeFormatW

  CompareStringW

  LCMapStringW

  GetStartupInfoW

  IsDebuggerPresent

  IsProcessorFeaturePresent

  TerminateProcess

  UnhandledExceptionFilter

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  GetCPInfo

  GetStringTypeW

  EncodePointer

  ReadFile

  HeapReAlloc

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetFilePointerEx

  SetEnvironmentVariableW

  SetStdHandle

  HeapSize

  WriteConsoleW

  SetEndOfFile

  LoadLibraryA

  InitializeCriticalSectionAndSpinCount

  user32

  RegisterClassExW

  GetWindowPlacement

  LoadAcceleratorsW

  TrackPopupMenu

  LoadStringW

  GetSubMenu

  ShowWindow

  IsWindow

  GetAsyncKeyState

  OffsetRect

  DispatchMessageW

  SetTimer

  CopyRect

  SwitchToThisWindow

  SetMenuItemInfoW

  GetWindowTextA

  SetWindowPlacement

  SetMenuInfo

  SetWindowTextA

  SendDlgItemMessageW

  DialogBoxIndirectParamW

  MoveWindow

  SetMenu

  IsDlgButtonChecked

  UnhookWindowsHookEx

  DestroyMenu

  SetFocus

  TranslateAcceleratorW

  FindWindowW

  LoadCursorW

  SendMessageA

  SetWindowsHookExW

  CheckMenuItem

  GetDlgItem

  AppendMenuW

  SetRect

  KillTimer

  PostQuitMessage

  GetDesktopWindow

  GetParent

  DialogBoxParamW

  GetWindowLongW

  GetMessageW

  GetMenuItemInfoW

  DefWindowProcW

  UpdateWindow

  SetForegroundWindow

  LoadImageW

  GetCursorPos

  BeginPaint

  EndPaint

  EnableWindow

  GetWindowTextW

  ModifyMenuW

  AdjustWindowRectEx

  LoadMenuW

  PostMessageW

  GetWindowRect

  DestroyWindow

  SetWindowPos

  MessageBoxW

  CreateWindowExW

  SendMessageW

  CallNextHookEx

  EndDialog

  SetWindowTextW

  MessageBoxA

  MessageBeep

  TranslateMessage

  gdi32

  GetStockObject

  SetTextColor

  SetBkMode

  GetObjectW

  DeleteObject

  CreateFontIndirectW

  CreateSolidBrush

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetUserNameA

  CryptAcquireContextW

  CryptCreateHash

  CryptHashData

  CryptDestroyHash

  RegCreateKeyW

  CryptGetHashParam

  CryptReleaseContext

  RegQueryValueExW

  RegDeleteValueW

  RegOpenKeyExW

  RegSetValueExW

  RegEnumKeyExW

  RegCloseKey

  shell32

  SHGetFolderPathW

  SHGetPathFromIDListW

  ShellExecuteW

  SHBrowseForFolderW

  Shell_NotifyIconW

  ShellExecuteExW

  SHFileOperationW

  ole32

  CoTaskMemAlloc

  CoInitializeEx

  PropVariantClear

  OleInitialize

  CoUninitialize

  OleUninitialize

  CoTaskMemFree

  CLSIDFromString

  CoCreateInstance

  oleaut32

  VariantInit

  VariantClear

  version

  GetFileVersionInfoSizeA

  VerQueryValueW

  GetFileVersionInfoA

  Sections

  .text

  Size: 518KB - Virtual size: 518KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 198KB - Virtual size: 197KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 34KB - Virtual size: 45KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 244B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ