General

Malware Config

Signatures

Files

• ExamShieldLauncher.exe

  .exe windows x86

  18b37dcf3ff15bf9d314cf492a746dc7

  
  

  Code Sign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  29-03-2022 00:00

  Not After

  14-03-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  02:75:16:98:34:1a:24:0f:a7:2c:d7:38:cd:37:2e:21

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  17-03-2022 00:00

  Not After

  22-03-2023 23:59

  Subject

  CN=PEOPLECERT INTERNATIONAL LTD,O=PEOPLECERT INTERNATIONAL LTD,L=Nicosia,C=CY

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  e1:af:a1:19:87:08:b7:30:3e:6a:ce:11:7d:e8:e2:f8:a9:b5:3d:59

  Signer

  Actual PE Digest

  e1:af:a1:19:87:08:b7:30:3e:6a:ce:11:7d:e8:e2:f8:a9:b5:3d:59

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=PEOPLECERT INTERNATIONAL LTD,O=PEOPLECERT INTERNATIONAL LTD,L=Nicosia,C=CY

  18-08-2022 07:34

  Valid: true

  Chain 1

  CN=PEOPLECERT INTERNATIONAL LTD,O=PEOPLECERT INTERNATIONAL LTD,L=Nicosia,C=CY

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Chain 2

  CN=PEOPLECERT INTERNATIONAL LTD,O=PEOPLECERT INTERNATIONAL LTD,L=Nicosia,C=CY

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteConsoleW

  GetConsoleMode

  GetConsoleCP

  GetStringTypeW

  GetTimeZoneInformation

  IsProcessorFeaturePresent

  LCMapStringW

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  IsDebuggerPresent

  UnhandledExceptionFilter

  TerminateProcess

  QueryPerformanceCounter

  GetLastError

  HeapCreate

  SetHandleCount

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetStdHandle

  SetUnhandledExceptionFilter

  VirtualQuery

  GetSystemInfo

  VirtualAlloc

  GetSystemTimeAsFileTime

  HeapSize

  HeapQueryInformation

  GetFileType

  SetStdHandle

  CreateThread

  ExitThread

  HeapReAlloc

  RaiseException

  RtlUnwind

  DecodePointer

  EncodePointer

  HeapAlloc

  HeapFree

  GetStartupInfoW

  HeapSetInformation

  GetCommandLineW

  FindResourceExW

  VirtualProtect

  SearchPathW

  GetProfileIntW

  GetNumberFormatW

  GetWindowsDirectoryW

  GetTempPathW

  GetTempFileNameW

  SetErrorMode

  GetCurrentDirectoryW

  GlobalGetAtomNameW

  GlobalFlags

  TlsFree

  LocalReAlloc

  TlsSetValue

  TlsAlloc

  InitializeCriticalSection

  GlobalHandle

  GlobalReAlloc

  TlsGetValue

  lstrcpyW

  GetSystemDirectoryW

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileIntW

  lstrcmpA

  GetUserDefaultUILanguage

  ConvertDefaultLocale

  GetSystemDefaultUILanguage

  GetLocaleInfoW

  LoadLibraryExW

  ReleaseActCtx

  CreateActCtxW

  GetFullPathNameW

  GetVolumeInformationW

  FindFirstFileW

  FindClose

  DuplicateHandle

  GetFileSize

  SetEndOfFile

  UnlockFile

  LockFile

  FlushFileBuffers

  SetFilePointer

  WriteFile

  ReadFile

  lstrcmpiW

  CreateEventW

  SuspendThread

  SetEvent

  SetThreadPriority

  GetFileTime

  GetFileSizeEx

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  GetFileAttributesExW

  CreateFileW

  WideCharToMultiByte

  GlobalSize

  GlobalAlloc

  MulDiv

  GetCurrentProcessId

  GlobalLock

  GlobalUnlock

  GlobalFree

  FreeResource

  GetCurrentThreadId

  GlobalAddAtomW

  GlobalFindAtomW

  GlobalDeleteAtom

  GetVersionExW

  GetProcAddress

  CompareStringW

  LoadLibraryW

  ActivateActCtx

  DeactivateActCtx

  SetLastError

  FreeLibrary

  lstrcmpW

  CloseHandle

  GetCurrentProcess

  GetCurrentThread

  VerifyVersionInfoW

  VerSetConditionMask

  CopyFileW

  CopyFileExW

  InterlockedIncrement

  InterlockedDecrement

  GetModuleFileNameW

  CreateDirectoryW

  GetModuleHandleW

  InterlockedExchange

  Sleep

  GetFileAttributesW

  DeleteFileW

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionAndSpinCount

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  MultiByteToWideChar

  lstrlenA

  GetTickCount

  WaitForSingleObject

  ResumeThread

  ExitProcess

  LocalFree

  lstrlenW

  LocalAlloc

  FormatMessageW

  SetEnvironmentVariableA

  user32

  CopyIcon

  UnpackDDElParam

  ReuseDDElParam

  InsertMenuItemW

  TranslateAcceleratorW

  FrameRect

  RegisterClipboardFormatW

  EmptyClipboard

  CloseClipboard

  SetClipboardData

  OpenClipboard

  GetNextDlgGroupItem

  GetIconInfo

  HideCaret

  InvertRect

  LockWindowUpdate

  BringWindowToTop

  SetCursorPos

  SetRect

  CreateAcceleratorTableW

  LoadAcceleratorsW

  GetKeyboardState

  GetKeyboardLayout

  ToUnicodeEx

  CopyAcceleratorTableW

  DrawFocusRect

  DrawFrameControl

  DrawEdge

  DrawIconEx

  SetClassLongW

  DestroyAcceleratorTable

  SetParent

  DestroyIcon

  UnregisterClassW

  GetMenuDefaultItem

  SetMenuDefaultItem

  CreatePopupMenu

  IsMenu

  MonitorFromPoint

  UpdateLayeredWindow

  EnableScrollBar

  UnionRect

  IsRectEmpty

  IsZoomed

  GetAsyncKeyState

  NotifyWinEvent

  MessageBeep

  ReleaseCapture

  WindowFromPoint

  SetCapture

  KillTimer

  SetTimer

  SetWindowRgn

  GetSystemMenu

  DeleteMenu

  OffsetRect

  IntersectRect

  CopyImage

  RealChildWindowFromPoint

  DestroyMenu

  GetMenuItemInfoW

  InflateRect

  GetSysColorBrush

  LoadCursorW

  SetLayeredWindowAttributes

  EnumDisplayMonitors

  SystemParametersInfoW

  SetRectEmpty

  ShowOwnedPopups

  SetCursor

  PostQuitMessage

  CharUpperW

  GetMessageW

  TranslateMessage

  MapVirtualKeyW

  GetKeyNameTextW

  GetCursorPos

  EndPaint

  CharUpperBuffW

  GetWindowDC

  ReleaseDC

  GetDC

  ClientToScreen

  GrayStringW

  DrawTextExW

  DrawTextW

  TabbedTextOutW

  GetMenuStringW

  AppendMenuW

  InsertMenuW

  RemoveMenu

  GetWindowThreadProcessId

  GetDesktopWindow

  GetActiveWindow

  CreateDialogIndirectParamW

  GetNextDlgTabItem

  EndDialog

  SetMenuItemBitmaps

  GetMenuCheckMarkDimensions

  ModifyMenuW

  GetMenuState

  EnableMenuItem

  CheckMenuItem

  IsWindowEnabled

  ShowWindow

  MoveWindow

  SetWindowTextW

  IsDialogMessageW

  EnableWindow

  MessageBoxW

  SendMessageW

  UpdateWindow

  PostMessageW

  CheckDlgButton

  RegisterWindowMessageW

  SendDlgItemMessageW

  SendDlgItemMessageA

  WinHelpW

  IsChild

  GetCapture

  SetWindowsHookExW

  CallNextHookEx

  GetClassLongW

  SetPropW

  GetPropW

  RemovePropW

  GetFocus

  IsWindow

  SetFocus

  GetWindowTextLengthW

  GetWindowTextW

  GetForegroundWindow

  GetLastActivePopup

  SetActiveWindow

  DispatchMessageW

  BeginDeferWindowPos

  EndDeferWindowPos

  GetDlgItem

  GetTopWindow

  DestroyWindow

  UnhookWindowsHookEx

  PostThreadMessageW

  WaitMessage

  DefFrameProcW

  DefMDIChildProcW

  DrawMenuBar

  TranslateMDISysAccel

  CreateMenu

  IsClipboardFormatAvailable

  GetUpdateRect

  GetDoubleClickTime

  IsCharLowerW

  MapVirtualKeyExW

  SubtractRect

  GetMessageTime

  GetMessagePos

  PeekMessageW

  MonitorFromWindow

  GetMonitorInfoW

  MapWindowPoints

  ScrollWindow

  TrackPopupMenu

  GetKeyState

  SetMenu

  DestroyCursor

  MapDialogRect

  GetWindowRgn

  BeginPaint

  SetWindowLongW

  GetWindowLongW

  wsprintfW

  LoadIconW

  IsIconic

  GetSystemMetrics

  GetClientRect

  DrawIcon

  LoadImageW

  DrawStateW

  FillRect

  InvalidateRect

  LoadBitmapW

  GetClassNameW

  GetSubMenu

  LoadMenuW

  GetWindowRect

  GetParent

  GetWindow

  PtInRect

  CopyRect

  SetWindowPos

  GetMenu

  CallWindowProcW

  DefWindowProcW

  GetDlgCtrlID

  GetWindowPlacement

  SetWindowPlacement

  SetScrollInfo

  GetScrollInfo

  DeferWindowPos

  EqualRect

  ScreenToClient

  AdjustWindowRectEx

  GetSysColor

  RegisterClassW

  GetClassInfoW

  GetClassInfoExW

  CreateWindowExW

  GetMenuItemCount

  GetMenuItemID

  ValidateRect

  IsWindowVisible

  RedrawWindow

  ShowScrollBar

  SetForegroundWindow

  GetScrollPos

  SetScrollPos

  GetScrollRange

  SetScrollRange

  gdi32

  CreateEllipticRgn

  Polyline

  Ellipse

  Polygon

  CreatePalette

  GetPaletteEntries

  GetNearestPaletteIndex

  RealizePalette

  GetSystemPaletteEntries

  OffsetRgn

  GetRgnBox

  SetDIBColorTable

  StretchBlt

  SetPixel

  Rectangle

  EnumFontFamiliesExW

  ExtFloodFill

  SetPaletteEntries

  LPtoDP

  GetWindowOrgEx

  GetViewportOrgEx

  PtInRegion

  FillRgn

  FrameRgn

  GetBoundsRect

  GetTextFaceW

  SetPixelV

  GetTextColor

  OffsetViewportOrgEx

  SetViewportOrgEx

  SelectObject

  GetBkColor

  CreatePolygonRgn

  CreateDIBSection

  CreateRoundRectRgn

  DPtoLP

  CombineRgn

  SetRectRgn

  GetTextExtentPoint32W

  GetTextCharsetInfo

  EnumFontFamiliesW

  GetTextMetricsW

  CreateCompatibleBitmap

  CreateFontIndirectW

  CreateDIBitmap

  PatBlt

  CreateRectRgnIndirect

  CreateHatchBrush

  CreatePen

  GetObjectType

  SelectPalette

  CreateCompatibleDC

  CreatePatternBrush

  DeleteDC

  ExtSelectClipRgn

  ScaleWindowExtEx

  SetWindowExtEx

  OffsetWindowOrgEx

  SetWindowOrgEx

  Escape

  ExtTextOutW

  TextOutW

  RectVisible

  PtVisible

  GetPixel

  BitBlt

  GetWindowExtEx

  GetViewportExtEx

  CreateRectRgn

  SelectClipRgn

  SetLayout

  GetLayout

  SetTextAlign

  MoveToEx

  LineTo

  IntersectClipRect

  ExcludeClipRect

  GetClipBox

  SetMapMode

  SetROP2

  SetPolyFillMode

  SetBkMode

  RestoreDC

  SaveDC

  CreateDCW

  CopyMetaFileW

  GetDeviceCaps

  ScaleViewportExtEx

  CreateBitmap

  DeleteObject

  CreateSolidBrush

  GetObjectW

  GetStockObject

  SetTextColor

  SetBkColor

  SetViewportExtEx

  msimg32

  TransparentBlt

  AlphaBlend

  comdlg32

  GetFileTitleW

  winspool.drv

  OpenPrinterW

  DocumentPropertiesW

  ClosePrinter

  advapi32

  RegCreateKeyExW

  RegOpenKeyExW

  RegEnumKeyExW

  RegCloseKey

  RegQueryValueExW

  OpenThreadToken

  OpenProcessToken

  DuplicateToken

  AllocateAndInitializeSid

  InitializeSecurityDescriptor

  GetLengthSid

  InitializeAcl

  AddAccessAllowedAce

  RegEnumValueW

  RegQueryValueW

  RegEnumKeyW

  RegDeleteKeyW

  RegDeleteValueW

  RegSetValueExW

  SetSecurityDescriptorDacl

  FreeSid

  AccessCheck

  IsValidSecurityDescriptor

  SetSecurityDescriptorOwner

  SetSecurityDescriptorGroup

  IsTextUnicode

  shell32

  DragQueryFileW

  ShellExecuteW

  SHGetFileInfoW

  SHGetDesktopFolder

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHGetFolderPathW

  DragFinish

  SHAppBarMessage

  SHGetSpecialFolderLocation

  comctl32

  ord17

  ImageList_GetIconSize

  shlwapi

  PathStripToRootW

  PathIsUNCW

  PathFindExtensionW

  PathFindFileNameW

  PathRemoveFileSpecW

  UrlUnescapeW

  ole32

  ReleaseStgMedium

  CoTaskMemAlloc

  OleDuplicateData

  CoCreateGuid

  CoCreateInstance

  CoInitialize

  CoUninitialize

  CreateStreamOnHGlobal

  DoDragDrop

  CoInitializeEx

  OleCreateMenuDescriptor

  OleDestroyMenuDescriptor

  OleTranslateAccelerator

  IsAccelerator

  OleLockRunning

  OleGetClipboard

  RegisterDragDrop

  CoLockObjectExternal

  RevokeDragDrop

  CoTaskMemFree

  oleaut32

  SysAllocStringLen

  VariantClear

  VariantChangeType

  VariantInit

  SysAllocString

  VariantTimeToSystemTime

  SystemTimeToVariantTime

  VarBstrFromDate

  SysStringLen

  SysAllocStringByteLen

  SysFreeString

  gdiplus

  GdipDrawImageI

  GdipGetImageGraphicsContext

  GdipBitmapUnlockBits

  GdipBitmapLockBits

  GdipCreateBitmapFromScan0

  GdipCreateBitmapFromStream

  GdipGetImagePalette

  GdipGetImagePaletteSize

  GdipGetImagePixelFormat

  GdipGetImageHeight

  GdipGetImageWidth

  GdipCloneImage

  GdipDrawImageRectI

  GdipSetInterpolationMode

  GdipCreateFromHDC

  GdiplusShutdown

  GdiplusStartup

  GdipCreateBitmapFromHBITMAP

  GdipDisposeImage

  GdipFree

  GdipAlloc

  GdipDeleteGraphics

  wininet

  InternetCloseHandle

  InternetOpenW

  InternetSetStatusCallbackW

  InternetConnectW

  HttpOpenRequestW

  InternetSetOptionW

  HttpSendRequestW

  InternetCanonicalizeUrlW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetReadFile

  InternetErrorDlg

  crypt32

  CertFreeCertificateContext

  oleacc

  LresultFromObject

  AccessibleObjectFromWindow

  CreateStdAccessibleObject

  imm32

  ImmGetOpenStatus

  ImmGetContext

  ImmReleaseContext

  winmm

  PlaySoundW

  Sections

  .text

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 273KB - Virtual size: 273KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 23KB - Virtual size: 52KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 303KB - Virtual size: 302KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 168KB - Virtual size: 167KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ