General

Malware Config

Signatures

Files

• 1.zip

  .zip
• 1/control.exe

  .exe windows x86

  e429f70455f107f91cc4781d386989f0

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  EventUnregister

  RegOpenKeyExW

  EventSetInformation

  EventRegister

  EventWriteTransfer

  RegCloseKey

  RegEnumValueW

  kernel32

  GetStartupInfoW

  GetModuleFileNameA

  InitOnceBeginInitialize

  CreateSemaphoreExW

  HeapFree

  SetLastError

  EnterCriticalSection

  GetCommandLineW

  lstrlenW

  ReleaseSemaphore

  GetModuleHandleExW

  ExpandEnvironmentStringsW

  CompareStringOrdinal

  LeaveCriticalSection

  InitializeCriticalSectionEx

  WaitForThreadpoolTimerCallbacks

  WaitForSingleObject

  GetCurrentThreadId

  ReleaseMutex

  FormatMessageW

  GetLastError

  ReleaseSRWLockExclusive

  OutputDebugStringW

  CloseThreadpoolTimer

  InitOnceComplete

  AcquireSRWLockExclusive

  WaitForSingleObjectEx

  OpenSemaphoreW

  CloseHandle

  SetThreadpoolTimer

  ReleaseSRWLockShared

  CreateThreadpoolTimer

  HeapSetInformation

  HeapAlloc

  GetProcAddress

  CreateMutexExW

  AcquireSRWLockShared

  DeleteCriticalSection

  GetCurrentProcessId

  GetProcessHeap

  GetModuleHandleW

  DebugBreak

  IsDebuggerPresent

  user32

  AllowSetForegroundWindow

  msvcrt

  _XcptFilter

  _purecall

  ??3@YAXPAX@Z

  _except_handler4_common

  _controlfp

  ?terminate@@YAXXZ

  _onexit

  __dllonexit

  _unlock

  _lock

  _acmdln

  _initterm

  __setusermatherr

  _ismbblead

  __p__fmode

  _cexit

  _exit

  exit

  __set_app_type

  __getmainargs

  _amsg_exit

  memmove_s

  __p__commode

  memcpy_s

  _vsnwprintf

  memcmp

  memset

  shlwapi

  ord158

  ord437

  StrTrimW

  api-ms-win-core-com-l1-1-0

  CoTaskMemAlloc

  CoUninitialize

  CoInitializeEx

  CoCreateInstance

  CoTaskMemFree

  api-ms-win-core-synch-l1-2-0

  Sleep

  api-ms-win-core-errorhandling-l1-1-0

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  api-ms-win-core-processthreads-l1-1-0

  GetCurrentProcess

  TerminateProcess

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-1-0

  GetTickCount

  GetSystemTimeAsFileTime

  shell32

  ShellExecuteExW

  Sections

  .text

  Size: 40KB - Virtual size: 40KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 98KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 1/edputil.dll

  .dll regsvr32 windows x86

  21bbdd7b51845fee5e30423983adaddc

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetEnvironmentVariableW

  OutputDebugStringW

  lstrcatW

  CloseHandle

  CreateProcessW

  IsWow64Process

  GetCurrentProcess

  Exports

  Exports

  DllRegisterServer

  EdpAddAppClipboardConsentInCache

  EdpAuditAction

  EdpCanCallerAccessWin32Clipboard

  EdpCheckAccess

  EdpCheckAccessForContext

  EdpCheckIsDpapiNgEntId

  EdpCheckIsRmsEntId

  EdpClearClipboardMetaData

  EdpConvertProtectorToExternalId

  EdpFreeContext

  EdpGetAppLockerUniqueAppIdentifier

  EdpGetAppLockerUniqueAppIdentifierByToken

  EdpGetAppLockerUniqueAppIdentifierByTokenEx

  EdpGetClipboardAccessDeniedData

  EdpGetContextForBinaryPath

  EdpGetContextForImpersonatedToken

  EdpGetContextForPackageFullName

  EdpGetContextForProcess

  EdpGetContextForWindow

  EdpGetDataInfoFromDataObject

  EdpGetDataInfoFromWin32Clipboard

  EdpGetEnterpriseIdForClipboard

  EdpGetEnterpriseIdForDataObject

  EdpGetEnterpriseIdForUIEnforcement

  EdpGetEnterpriseIdForUIEnforcementFromProcess

  EdpGetFilePathsForDataObject

  EdpGetIsManaged

  EdpGetPersonalEnterpriseIdString

  EdpGetPrimaryIdentities

  EdpGetPrimaryIdentityIfManaged

  EdpGetSourceAppIdForClipboard

  EdpGetSourceIsEnlightenedForClipboard

  EdpGetWindowFromThreadId

  EdpIsAppClipboardConsentCached

  EdpIsContextExemptOrEnlightenedAllowed

  EdpIsFileAccessAllowed

  EdpIsUIPolicyEvaluationEnabledForThread

  EdpIsValidSubjectForEncryption

  EdpRequestAccess

  EdpRequestAccessForContext

  EdpSetEnterpriseIdForClipboard

  EdpSetSourceAppIdForClipboard

  EdpSetSourceIsEnlightenedForClipboard

  EdpShouldShowEnterpriseIndicator

  EdpUtilCreateEnterpriseContextFromEnterpriseId

  EdpUtilFreeEnterpriseContext

  EdpUtilGetEnterpriseContextByName

  EdpUtilGetEnterpriseContextByProcess

  EdpUtilGetEnterpriseContextByWindowHandle

  EdpUtilGetEnterpriseContextForCurrentView

  EdpUtilGetEnterpriseContextForView

  EdpUtilIsAppEnlightened

  EdpUtilQueryPolicy

  GetProcessUniqueIdFromToken

  Sections

  .text

  Size: 512B - Virtual size: 485B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 48B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 1/msoffice32.dll

  .dll regsvr32 windows x86

  446cda0346af9f8bf8adda69091d2673

  
  

  Code Sign

  e9:25:0e:df:b5:d6:e6:6b:aa:96:88:98:fe:58:d3:d1

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  11-11-2021 00:00

  Not After

  11-11-2022 23:59

  Subject

  CN=Everything Not Saved Will Be Lost Oy,O=Everything Not Saved Will Be Lost Oy,ST=Uusimaa,C=FI

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  01

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  01-01-2004 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  a5:f8:9d:a9:61:8c:3b:62:f2:69:4a:b3:52:c1:6d:d7:3b:96:ff:38

  Signer

  Actual PE Digest

  a5:f8:9d:a9:61:8c:3b:62:f2:69:4a:b3:52:c1:6d:d7:3b:96:ff:38

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Everything Not Saved Will Be Lost Oy,O=Everything Not Saved Will Be Lost Oy,ST=Uusimaa,C=FI

  17-11-2022 13:15

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetStdHandle

  CreateFileA

  FindFirstFileA

  FindNextFileA

  GetFileAttributesA

  SetEndOfFile

  CloseHandle

  GetLastError

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  CreateThread

  GetCurrentThreadId

  MapViewOfFile

  CreateFileMappingA

  CreateActCtxA

  ReleaseActCtx

  ActivateActCtx

  DeactivateActCtx

  RaiseException

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  SetLastError

  HeapAlloc

  HeapFree

  GetModuleHandleW

  GetProcAddress

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  FreeLibrary

  LoadLibraryExW

  LCMapStringW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  ExitProcess

  GetModuleHandleExW

  GetProcessHeap

  GetStringTypeW

  MultiByteToWideChar

  WideCharToMultiByte

  HeapSize

  HeapReAlloc

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentProcessId

  InitializeSListHead

  InterlockedFlushSList

  RtlUnwind

  GetModuleFileNameA

  FindClose

  FindFirstFileExA

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetFileType

  SetStdHandle

  WriteFile

  FlushFileBuffers

  GetConsoleCP

  GetConsoleMode

  SetFilePointerEx

  WriteConsoleW

  DecodePointer

  CreateFileW

  Exports

  Exports

  DllRegisterServer

  Sections

  .text

  Size: 67KB - Virtual size: 66KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 341KB - Virtual size: 340KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 172KB - Virtual size: 174KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 512B - Virtual size: 160B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ