Thor[.]iso | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Thor.iso
Size

95.3MB
MD5

d4518b96caa3986189662761582750c7
SHA1

5e1853b44723667e3ed475935f72e51ee1170251
SHA256

122ed45736c260b07f44e7d568646c3e96dee95f7db6e59a0d336a8d885d2892
SHA512

2bcbc6e686f26495556e4ec3fa3226f3cb267e491cf1eabf59cb0ccb5b7c080557d96df80f6dc400d711a62643cf873fa3705d7c7479bc040e3cf0d7fa1c3154
SSDEEP

786432:AnNlnAhhwt8XEyXJ9SOyh16MlEY2/AbQ:AnNlnAhhwG7Jah1d2IM

Score

8^/10

pdf link upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
static1/unpack001/thor/tools/upx.exe	upx

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Files

Thor.iso
.iso
thor/9970066f2f6b0c622516e37df966797d_94b979fe6cd4f1ee45af9a29ffe3c608.lic
thor/DESKTOP-UCQEET9_files_md5s.csv
thor/DESKTOP-UCQEET9_thor_2022-10-28_0957.txt
thor/changes.log
thor/config/directory-excludes.cfg
thor/config/false_positive_filters.cfg
thor/config/thor-util.yml
thor/config/thor.yml
thor/config/tmpl-action.yml
thor/config/tmpl-deepdive.yml
thor/config/tmpl-log-to-share.yml
thor/config/tmpl-sigma.yml
thor/custom-signatures/iocs/templates/custom-c2-domains.txt.template
thor/custom-signatures/iocs/templates/custom-events.template
thor/custom-signatures/iocs/templates/custom-filename-iocs.txt.template
thor/custom-signatures/iocs/templates/custom-hash-iocs.txt.template
thor/custom-signatures/iocs/templates/custom-keywords.txt.template
thor/custom-signatures/iocs/templates/custom-mutexes.txt.template
thor/docs/License_Acknowledgement.txt
thor/docs/THOR_Lite_EULA.pdf
.pdf
thor/docs/THOR_LogAnalysis.pdf
.pdf
- https://countuponsecurity.com/2016/05/18/digital-forensics-shimcache-artifacts/
- http://SRV1123.internal.net/10.0.0.112
- https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
- http://system.internal.net/10.1.2.50
- http://System23.local.net/10.2.2.14
- http://gi.webshop.com
- https://adsecurity.org/?p=2288
- http://niiconsulting.com/checkmate/2016/02/hunting-passwords-in-sysvol/
- http://System32.local.net/10.2.0.7
- http://win55.local.net
- http://system123.local.net/10.6.2.10
- http://system123.local.net/10.10.1.8
- http://www.welivesecurity.com/2014/05/20/miniduke-still-duking/
- https://github.com/darkquasar/WMI_Persistence
- http://server44.local.net/10.23.3.1
- http://server44.local.net/1.253.103.134
- http://server44.local.net/10.7.1.100
- https://sysforensics.org/2014/01/know-your-windows-processes/
- http://server22.local.net/10.6.19.8
- http://server.local.net/10.1.19.2
- http://.lookipv6.com
- http://www.swiftforensics.com/2013/12/amcachehve-in-windows-8-goldmine-for.html
- https://windowsir.blogspot.de/2017/03/incorporating-amcache-data-into.html
- http://server4448.local.net/10.0.10.1
- http://server23.local.net/10.19.2.17
- http://server77.local.net/10.10.9.19
- http://system444.local.net/172.27.2.7
- http://60.10.1.183.in-addr.arpa
- http://system88.local.net/10.10.9.15
- http://altftp.compsys.biz
- http://vpnaccess.companybranch.info
- http://in-add.arpa
- http://ipv6.com
- http://benign-site-ipv6.com
- http://servftp.companyname.biz
- http://www2.companybranch.cn
- https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/
- http://server555.local.net/10.7.1.14
- http://master.comp-a.net
- http://server99.local.net/10.1.1.55
- http://ctldl.windowsupdate.com
- http://www.company-intranet.net
- http://update1.f-secure.com
- http://server55.local.net/10.16.1.44
- http://server55.local.net/10.1.12.2
- http://server88.local.net/10.10.9.33
- http://server77.local.net/10.1.90.18
- http://server66.local.net/147.2.20.16
- http://server66.local.net/10.1.30.2
- http://server44.local.net/10.216.2.186
- http://server44.local.net/10.16.3.7
- http://goo.gl/Fm00Q8
- http://1dns.dubkill.com.in
- http://s3newss.effers.com
- http://upport.proxydns.com
- http://e.authorizeddns.org
- http://server44.local.net/10.10.1.4
- http://server44.local.net/10.16.22.2
- https://www.virustotal.com/en/
- http://Virustotal.com
- https://www.virustotal.com
- https://www.virustotal.com/en/domain/DOMAIN/information/
- https://www.virustotal.com/en/ip-address/58.158.177.102/information/
- http://virustotal.com
- https://www.winitor.com
- https://www.passivetotal.org
- https://cymon.io
- https://censys.io
- https://www.threatcrowd.org
- https://cse.google.com/cse/publicurl?cx=003248445720253387346:turlh5vi4xc
- https://www.hybrid-analysis.com
- http://munin.py
- https://github.com/Neo23x0/munin
- Show all
thor/docs/THOR_Manual.url
thor/docs/THOR_Thunderstorm_Setup_Guide.pdf
.pdf
- http://thunderstorm-installer.sh
thor/docs/THOR_Util_Manual.url
thor/signatures/changes.log
thor/signatures/iocs/c2-iocs.dat
thor/signatures/iocs/falsepositive-hashes.dat
thor/signatures/iocs/filename-iocs.dat
thor/signatures/iocs/hash-iocs.dat
thor/signatures/iocs/keywords.dat
thor/signatures/iocs/otx-hash-iocs.dat
thor/signatures/misc/file-type-signatures.dat
thor/signatures/sigrev
thor/signatures/yara/thor-lite-all.yas
thor/signatures/yara/thor-lite-deepscan-selectors.yasx
thor/signatures/yara/thor-lite-keywords.yas
thor/signatures/yara/thor-lite-log-sigs.yas
thor/signatures/yara/thor-lite-meta.yas
thor/signatures/yara/thor-lite-process-memory-sigs.yas
thor/signatures/yara/thor-lite-registry.yas
thor/thor-lite-util.exe
.exe windows x86

0a2e9042b10a9ee7b9df3103855f0def

Code Sign

d3:99:b7:dd:da:5b:88:91:28:37:ff:56:b1:4f:53:49
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-09-2020 00:00

Not After

03-09-2023 23:59

Subject

CN=Nextron Systems GmbH,O=Nextron Systems GmbH,POSTALCODE=63128,STREET=Bruchstr. 8,L=Dietzenbach,ST=Hessen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:e3:f3:cc:56:bd:1c:a3:f4:96:1d:2b:bd:f2:45:f6:ec:f8:96:be
Signer

Actual PE Digest

01:e3:f3:cc:56:bd:1c:a3:f4:96:1d:2b:bd:f2:45:f6:ec:f8:96:be

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Nextron Systems GmbH,O=Nextron Systems GmbH,POSTALCODE=63128,STREET=Bruchstr. 8,L=Dietzenbach,ST=Hessen,C=DE

27-07-2022 07:48
Valid: true

Chain 1

CN=Nextron Systems GmbH,O=Nextron Systems GmbH,POSTALCODE=63128,STREET=Bruchstr. 8,L=Dietzenbach,ST=Hessen,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Chain 2

CN=Nextron Systems GmbH,O=Nextron Systems GmbH,POSTALCODE=63128,STREET=Bruchstr. 8,L=Dietzenbach,ST=Hessen,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

ControlTraceW
EnableTraceEx2
OpenTraceW
ProcessTrace
StartTraceW

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerA
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
FreeLibrary
GetConsoleMode
GetEnvironmentStringsW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile

msvcrt

__getmainargs
__initenv
__lconv_init
__mb_cur_max
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_beginthread
_cexit
_errno
_initterm
_iob
_lock
_onexit
_unlock
abort
atoi
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
memcpy
memset
setlocale
signal
strchr
strerror
strlen
strncmp
vfprintf
wcslen

tdh

TdhGetEventInformation
TdhGetEventMapInformation
TdhGetProperty
TdhGetPropertySize

Exports

Exports

_cgo_dummy_export
handleEvent

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 230KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
thor/thor-lite-util.exe.sig
thor/thor-lite.exe
.exe windows x86

36fee6a7cc4139fbaa9c3e8085baf4ba

Code Sign

d3:99:b7:dd:da:5b:88:91:28:37:ff:56:b1:4f:53:49
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-09-2020 00:00

Not After

03-09-2023 23:59

Subject

CN=Nextron Systems GmbH,O=Nextron Systems GmbH,POSTALCODE=63128,STREET=Bruchstr. 8,L=Dietzenbach,ST=Hessen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

63:dc:3d:03:30:fd:50:a8:f0:37:53:a6:4b:1d:09:94:55:7a:06:7f
Signer

Actual PE Digest

63:dc:3d:03:30:fd:50:a8:f0:37:53:a6:4b:1d:09:94:55:7a:06:7f

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Nextron Systems GmbH,O=Nextron Systems GmbH,POSTALCODE=63128,STREET=Bruchstr. 8,L=Dietzenbach,ST=Hessen,C=DE

27-07-2022 07:48
Valid: true

Chain 1

CN=Nextron Systems GmbH,O=Nextron Systems GmbH,POSTALCODE=63128,STREET=Bruchstr. 8,L=Dietzenbach,ST=Hessen,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Chain 2

CN=Nextron Systems GmbH,O=Nextron Systems GmbH,POSTALCODE=63128,STREET=Bruchstr. 8,L=Dietzenbach,ST=Hessen,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AdjustTokenPrivileges
ControlTraceW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
DeregisterEventSource
EnableTraceEx2
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
ImpersonateSelf
LookupPrivilegeValueA
OpenProcessToken
OpenTraceW
ProcessTrace
RegisterEventSourceW
ReportEventW
StartTraceW

kernel32

AddVectoredExceptionHandler
AreFileApisANSI
CloseHandle
CreateDirectoryA
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexA
CreateMutexW
CreateSemaphoreW
CreateThread
CreateWaitableTimerA
CreateWaitableTimerExW
DeleteCriticalSection
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindFirstFileW
FindNextFileW
FlushConsoleInputBuffer
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetEnvironmentStringsW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLogicalDrives
GetLongPathNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessId
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetThreadContext
GetTickCount64
GetTickCount
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsBadReadPtr
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OpenProcess
OpenThreadToken
OutputDebugStringA
OutputDebugStringW
PostQueuedCompletionStatus
QueryDosDeviceA
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReadProcessMemory
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResumeThread
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetLastError
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnlockFile
UnlockFileEx
UnmapViewOfFile
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile

msvcrt

__getmainargs
__initenv
__lconv_init
__mb_cur_max
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_assert
_beginthread
_beginthreadex
_cexit
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_fstat64
_initterm
_iob
_lock
_lseeki64
_onexit
_setjmp3
_setmode
_snprintf
_time64
_unlock
_vsnprintf
_wfopen
abort
atof
atoi
calloc
clearerr
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fgetwc
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwrite
getc
getenv
getwc
isalpha
islower
isprint
isspace
isupper
iswctype
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
localtime
gmtime
_mkgmtime64
putc
putwc
qsort
raise
rand
realloc
setlocale
setvbuf
signal
srand
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtok_s
strtol
strtoul
strxfrm
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
time
_strdup
_stricmp
_strnicmp
_strtoi64
wcscoll
wcscpy
wcsftime
wcslen
wcsstr
wcsxfrm
_vsnwprintf
_stat
longjmp
_write
_strdup
_read
_open
_fileno
_fdopen
_close

ntdll

NtCreateFile
RtlInitUnicodeString
VerSetConditionMask
ZwQueryInformationFile

psapi

EnumProcessModules
GetMappedFileNameA
GetModuleFileNameExA
GetProcessImageFileNameA
QueryWorkingSet

shlwapi

PathCanonicalizeA

tdh

TdhGetEventInformation
TdhGetEventMapInformation
TdhGetProperty
TdhGetPropertySize

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
MessageBoxW

Exports

Exports

_cgo_dummy_export
authorizerTrampoline
callbackTrampoline
commitHookTrampoline
compareTrampoline
compilerCallback
doneTrampoline
freeCallback
handleEvent
includeCallback
memoryBlockFetch
memoryBlockFetchNull
memoryBlockIteratorFilesize
memoryBlockIteratorFirst
memoryBlockIteratorNext
preUpdateHookTrampoline
rollbackHookTrampoline
scanCallbackFunc
stepTrampoline
streamRead
streamWrite
updateHookTrampoline

Sections

.text
Size: 14.7MB - Virtual size: 14.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 538KB - Virtual size: 538KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21.7MB - Virtual size: 21.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 786KB - Virtual size: 786KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 282KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 678B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 595KB - Virtual size: 594KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
thor/thor-lite.exe.sig
thor/thor64-lite.exe
.exe windows x64

5380985d53c8645a6a722b5dfee21c39

Code Sign

d3:99:b7:dd:da:5b:88:91:28:37:ff:56:b1:4f:53:49
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-09-2020 00:00

Not After

03-09-2023 23:59

Subject

CN=Nextron Systems GmbH,O=Nextron Systems GmbH,POSTALCODE=63128,STREET=Bruchstr. 8,L=Dietzenbach,ST=Hessen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f5:a4:76:74:c4:ea:1f:87:59:d2:eb:04:d1:56:69:1b:6e:51:e1:ae
Signer

Actual PE Digest

f5:a4:76:74:c4:ea:1f:87:59:d2:eb:04:d1:56:69:1b:6e:51:e1:ae

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Nextron Systems GmbH,O=Nextron Systems GmbH,POSTALCODE=63128,STREET=Bruchstr. 8,L=Dietzenbach,ST=Hessen,C=DE

27-07-2022 07:48
Valid: true

Chain 1

CN=Nextron Systems GmbH,O=Nextron Systems GmbH,POSTALCODE=63128,STREET=Bruchstr. 8,L=Dietzenbach,ST=Hessen,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Chain 2

CN=Nextron Systems GmbH,O=Nextron Systems GmbH,POSTALCODE=63128,STREET=Bruchstr. 8,L=Dietzenbach,ST=Hessen,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AdjustTokenPrivileges
ControlTraceW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
DeregisterEventSource
EnableTraceEx2
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
ImpersonateSelf
LookupPrivilegeValueA
OpenProcessToken
OpenThreadToken
OpenTraceW
ProcessTrace
RegisterEventSourceW
ReportEventW
StartTraceW

kernel32

AddVectoredExceptionHandler
AreFileApisANSI
CloseHandle
CreateDirectoryA
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexA
CreateMutexW
CreateSemaphoreW
CreateThread
CreateWaitableTimerA
CreateWaitableTimerExW
DeleteCriticalSection
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindFirstFileW
FindNextFileW
FlushConsoleInputBuffer
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLogicalDrives
GetLongPathNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessId
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetThreadContext
GetTickCount
GetTickCount64
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsBadReadPtr
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
PostQueuedCompletionStatus
QueryDosDeviceA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReadProcessMemory
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetLastError
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnlockFile
UnlockFileEx
UnmapViewOfFile
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler

msvcrt

___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_assert
_beginthread
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_fmode
_fstat64
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_mkgmtime64
_onexit
_setjmp
_setmode
_snprintf
_stat64
_strdup
_stricmp
_strnicmp
_strtoi64
_time64
_unlock
_vsnprintf
_vsnwprintf
_wfopen
abort
atof
atoi
calloc
clearerr
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fgetwc
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwrite
getc
getenv
getwc
isalpha
islower
isprint
isspace
isupper
iswctype
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
putwc
qsort
raise
rand
realloc
setlocale
setvbuf
signal
srand
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtok_s
strtol
strtoul
strxfrm
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcscpy
wcsftime
wcslen
wcsstr
wcsxfrm
longjmp
_write
_strdup
_read
_open
_fileno
_fdopen
_close

ntdll

NtCreateFile
RtlInitUnicodeString
RtlVirtualUnwind
VerSetConditionMask
ZwQueryInformationFile

psapi

EnumProcessModulesEx
GetMappedFileNameA
GetModuleFileNameExA
GetProcessImageFileNameA
QueryWorkingSet

shlwapi

PathCanonicalizeA

tdh

TdhGetEventInformation
TdhGetEventMapInformation
TdhGetProperty
TdhGetPropertySize

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
MessageBoxW

Exports

Exports

_cgo_dummy_export
authorizerTrampoline
callbackTrampoline
commitHookTrampoline
compareTrampoline
compilerCallback
doneTrampoline
freeCallback
handleEvent
includeCallback
memoryBlockFetch
memoryBlockFetchNull
memoryBlockIteratorFilesize
memoryBlockIteratorFirst
memoryBlockIteratorNext
preUpdateHookTrampoline
rollbackHookTrampoline
scanCallbackFunc
stepTrampoline
streamRead
streamWrite
updateHookTrampoline

Sections

.text
Size: 16.3MB - Virtual size: 16.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 665KB - Virtual size: 664KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22.8MB - Virtual size: 22.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 498KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 678B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
thor/thor64-lite.exe.sig
thor/tools/UnRAR.exe
.exe windows x86

8a029a5a06419e9e92db27b854b3a8e6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-06-2017 00:00

Not After

01-06-2020 23:59

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-06-2017 00:00

Not After

01-06-2020 23:59

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0b:39:99:11:d8:bf:9d:7d:04:8f:f9:24:bd:bb:5a:70:88:d4:e0:0f:59:4e:1f:16:39:07:ed:ee:53:09:07:d3
Signer

Actual PE Digest

0b:39:99:11:d8:bf:9d:7d:04:8f:f9:24:bd:bb:5a:70:88:d4:e0:0f:59:4e:1f:16:39:07:ed:ee:53:09:07:d3

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

11-08-2017 13:54
Valid: true

Chain 1

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

f6:80:12:43:81:de:b7:f7:c7:61:e9:fe:b4:27:ef:10:50:b7:31:26
Signer

Actual PE Digest

f6:80:12:43:81:de:b7:f7:c7:61:e9:fe:b4:27:ef:10:50:b7:31:26

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

11-08-2017 13:54
Valid: true

Chain 1

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetDriveTypeW
GetDiskFreeSpaceExW
SetFileAttributesW
GetFileAttributesW
GetVolumeInformationW
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetModuleFileNameW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
SetErrorMode
GetModuleHandleW
FreeLibrary
LoadLibraryW
LoadLibraryExW
GetProcAddress
GetCurrentProcessId
GetCurrentThread
SetConsoleCtrlHandler
SetThreadExecutionState
GetSystemDirectoryW
SetPriorityClass
GetProcessAffinityMask
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
HeapSize
DecodePointer
SetFilePointerEx
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FormatMessageW
Sleep
SetLastError
GetLastError
LocalFree
WriteConsoleW
ReadConsoleW
SetConsoleMode
GetConsoleMode
WriteFile
GetStdHandle
GetFileType
SetThreadPriority
GetCommandLineW
FindNextFileA
FindFirstFileExA
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RtlUnwind
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
QueryPerformanceFrequency
GetModuleFileNameA
GetCommandLineA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
GetConsoleCP

user32

CharLowerW
CharUpperW
MessageBeep
ExitWindowsEx
LoadStringW
CharToOemBuffW
CharToOemA
OemToCharA
OemToCharBuffA

advapi32

FreeSid
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeValueW
SetFileSecurityW
AdjustTokenPrivileges
OpenProcessToken
CheckTokenMembership

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc

Sections

.text
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
thor/tools/UnRAR.exe.sig
thor/tools/bifrost-server.py
.py .sh linux
thor/tools/bifrost-server.py.sig
thor/tools/remote-run/Run-Thor.ps1
.ps1
thor/tools/remote-run/Run-Thor.ps1.sig
thor/tools/remote-run/thor-remote-share.bat
thor/tools/remote-run/thor-remote-share.bat.sig
thor/tools/upx.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 392KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
thor/tools/upx.exe.sig

Sharing

General

Malware Config

Signatures

Files

0a2e9042b10a9ee7b9df3103855f0def

Code Sign

d3:99:b7:dd:da:5b:88:91:28:37:ff:56:b1:4f:53:49Certificate

Extended Key Usages

Key Usages

01Certificate

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

01:e3:f3:cc:56:bd:1c:a3:f4:96:1d:2b:bd:f2:45:f6:ec:f8:96:beSigner

Signature Validations

Verification

27-07-2022 07:48 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

tdh

Exports

Exports

Sections

.text Size: 4.1MB - Virtual size: 4.1MB

.data Size: 249KB - Virtual size: 248KB

.rdata Size: 3.8MB - Virtual size: 3.8MB

.eh_fram Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 230KB

.edata Size: 512B - Virtual size: 100B

.idata Size: 3KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 188KB - Virtual size: 188KB

36fee6a7cc4139fbaa9c3e8085baf4ba

Code Sign

d3:99:b7:dd:da:5b:88:91:28:37:ff:56:b1:4f:53:49Certificate

Extended Key Usages

Key Usages

01Certificate

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

63:dc:3d:03:30:fd:50:a8:f0:37:53:a6:4b:1d:09:94:55:7a:06:7fSigner

Signature Validations

Verification

27-07-2022 07:48 Valid: true

Chain 1

Chain 2

d3:99:b7:dd:da:5b:88:91:28:37:ff:56:b1:4f:53:49
Certificate

01
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

01:e3:f3:cc:56:bd:1c:a3:f4:96:1d:2b:bd:f2:45:f6:ec:f8:96:be
Signer

27-07-2022 07:48
Valid: true

.text
Size: 4.1MB - Virtual size: 4.1MB

.data
Size: 249KB - Virtual size: 248KB

.rdata
Size: 3.8MB - Virtual size: 3.8MB

.eh_fram
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 230KB

.edata
Size: 512B - Virtual size: 100B

.idata
Size: 3KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 188KB - Virtual size: 188KB

d3:99:b7:dd:da:5b:88:91:28:37:ff:56:b1:4f:53:49
Certificate

01
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

63:dc:3d:03:30:fd:50:a8:f0:37:53:a6:4b:1d:09:94:55:7a:06:7f
Signer

27-07-2022 07:48
Valid: true

.text
Size: 14.7MB - Virtual size: 14.7MB

.data
Size: 538KB - Virtual size: 538KB

.rdata
Size: 21.7MB - Virtual size: 21.7MB

.eh_fram
Size: 786KB - Virtual size: 786KB

.bss
Size: - Virtual size: 282KB

.edata
Size: 1024B - Virtual size: 678B

.idata
Size: 9KB - Virtual size: 8KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 26KB - Virtual size: 25KB

.reloc
Size: 595KB - Virtual size: 594KB

d3:99:b7:dd:da:5b:88:91:28:37:ff:56:b1:4f:53:49
Certificate

01
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

f5:a4:76:74:c4:ea:1f:87:59:d2:eb:04:d1:56:69:1b:6e:51:e1:ae
Signer

27-07-2022 07:48
Valid: true

.text
Size: 16.3MB - Virtual size: 16.3MB

.data
Size: 665KB - Virtual size: 664KB