General

Malware Config

Signatures

Files

• 5b797156841ddeed8a05b7779a243014a26f98832598db58707369fcab803dbb

  .exe windows x86

  60eda45ed9195e2968758b61b6601296

  
  

  Code Sign

  42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

  Certificate

  Issuer

  CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

  Not Before

  07-06-2005 08:09

  Not After

  30-05-2020 10:48

  Subject

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  24-08-2011 00:00

  Not After

  30-05-2020 10:48

  Subject

  CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  8a:a8:3f:75:34:0c:eb:fd:7a:fc:71:62:9d:16:d1:0c

  Certificate

  Issuer

  CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  24-03-2014 00:00

  Not After

  24-03-2015 23:59

  Subject

  CN=SOFTWARE AGILITY LIMITED,O=SOFTWARE AGILITY LIMITED,POSTALCODE=DE11 9RY,STREET=5 NAPIER CLOSE\,CHURCH GRESLEY,L=SWADLINCOTE,ST=DERBYSHIRE,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  b7:b5:1f:ef:6a:d8:d2:a3:04:e0:23:e9:1a:ba:69:33:dd:f8:d5:37

  Signer

  Actual PE Digest

  b7:b5:1f:ef:6a:d8:d2:a3:04:e0:23:e9:1a:ba:69:33:dd:f8:d5:37

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=SOFTWARE AGILITY LIMITED,O=SOFTWARE AGILITY LIMITED,POSTALCODE=DE11 9RY,STREET=5 NAPIER CLOSE\,CHURCH GRESLEY,L=SWADLINCOTE,ST=DERBYSHIRE,C=GB

  17-11-2022 13:13

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFilePointer

  ReadFile

  WriteFile

  DeleteFileW

  GetLastError

  GetModuleFileNameW

  GetTempPathW

  GetTempFileNameW

  FindResourceW

  SizeofResource

  LoadResource

  LockResource

  GetVersionExW

  WaitForSingleObject

  InitializeCriticalSection

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  CreateMutexW

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  OpenProcess

  CloseHandle

  CreateProcessW

  GetCurrentProcessId

  WideCharToMultiByte

  FlushFileBuffers

  FindResourceExW

  GetModuleHandleW

  GetProcAddress

  Sleep

  ReleaseMutex

  GetNativeSystemInfo

  InterlockedDecrement

  GetPriorityClass

  Module32FirstW

  HeapDestroy

  HeapReAlloc

  HeapSize

  RaiseException

  InitializeCriticalSectionAndSpinCount

  LoadLibraryW

  IsValidCodePage

  GetOEMCP

  GetACP

  IsProcessorFeaturePresent

  GetFileSize

  CreateFileW

  GetFileAttributesW

  GetSystemTime

  HeapFree

  MultiByteToWideChar

  GetProcessHeap

  HeapAlloc

  GetCommandLineW

  lstrlenW

  LocalFree

  TerminateProcess

  IsDebuggerPresent

  UnhandledExceptionFilter

  GetCurrentProcess

  GetTickCount

  QueryPerformanceCounter

  HeapCreate

  SetLastError

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  GetFileType

  SetHandleCount

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetStdHandle

  ExitProcess

  SetUnhandledExceptionFilter

  LCMapStringW

  GetCPInfo

  RtlUnwind

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  GetStartupInfoW

  HeapSetInformation

  DecodePointer

  EncodePointer

  InterlockedExchange

  GetStringTypeW

  InterlockedIncrement

  user32

  ShowWindow

  GetDlgItem

  PeekMessageW

  SendMessageW

  CreateDialogParamW

  PostQuitMessage

  GetMessageW

  TranslateMessage

  DispatchMessageW

  wvsprintfW

  advapi32

  GetCurrentHwProfileW

  RegSetValueExW

  RegQueryValueExW

  RegOpenKeyExW

  RegCreateKeyExW

  CryptReleaseContext

  CryptDestroyHash

  CryptGetHashParam

  CryptHashData

  CryptCreateHash

  CryptAcquireContextW

  ole32

  CoInitialize

  CoInitializeSecurity

  CoSetProxyBlanket

  CoUninitialize

  CoCreateInstance

  oleaut32

  SysStringByteLen

  SysFreeString

  SysStringLen

  SysAllocStringLen

  SysAllocStringByteLen

  VariantClear

  SysAllocString

  VariantInit

  VarBstrCat

  VariantChangeType

  shlwapi

  StrCmpW

  StrToIntExW

  PathFileExistsW

  winhttp

  WinHttpConnect

  WinHttpSendRequest

  WinHttpSetTimeouts

  WinHttpOpen

  WinHttpCrackUrl

  WinHttpReceiveResponse

  WinHttpQueryDataAvailable

  WinHttpReadData

  WinHttpSetOption

  WinHttpCloseHandle

  WinHttpQueryHeaders

  WinHttpOpenRequest

  rpcrt4

  UuidToStringW

  UuidEqual

  UuidCreate

  UuidCreateSequential

  RpcStringFreeW

  Sections

  .4CAA559

  Size: 111KB - Virtual size: 111KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 100KB - Virtual size: 99KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ