General

Malware Config

Signatures

Files

• 7b76c17c1e6a9fabe541335c809bf31c9b9c657c07691a2104ecd53e8a413f04

  .exe windows x86

  9ccb98a73b351647b1a2fd5623e17f49

  
  

  Code Sign

  4c:35:75:3f:cf:2a:de:ad:46:0c:1f:dd:50:bf:2e:14

  Certificate

  Issuer

  CN=12361235123

  Not Before

  26-02-2012 20:29

  Not After

  31-12-2039 23:59

  Subject

  CN=12361235123

  Extended Key Usages

  ExtKeyUsageCodeSigning

  d7:51:62:75:dd:d3:75:e8:69:0a:23:b3:a6:52:da:ad:41:a0:46:96

  Signer

  Actual PE Digest

  d7:51:62:75:dd:d3:75:e8:69:0a:23:b3:a6:52:da:ad:41:a0:46:96

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=12361235123

  17-11-2022 13:30

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetWindowsDirectoryW

  GetWindowsDirectoryA

  lstrlenA

  lstrcpyA

  CreateFileA

  VirtualAlloc

  advapi32

  RegOpenKeyExA

  shell32

  ExtractAssociatedIconW

  ExtractIconExW

  ExtractIconEx

  SHFormatDrive

  SHGetIconOverlayIndexW

  ShellExecuteEx

  WOWShellExecute

  SHBrowseForFolder

  SHGetSpecialFolderLocation

  SHGetIconOverlayIndexA

  SHInvokePrinterCommandA

  SHCreateDirectoryExW

  SHPathPrepareForWriteA

  SHGetFileInfoW

  SHGetDiskFreeSpaceA

  DuplicateIcon

  Shell_NotifyIcon

  Shell_NotifyIconA

  SHBrowseForFolderW

  ExtractIconExA

  SHGetPathFromIDList

  SHFileOperationW

  DoEnvironmentSubstA

  SHLoadInProc

  DoEnvironmentSubstW

  ExtractAssociatedIconExW

  SHQueryRecycleBinW

  DragQueryFile

  CommandLineToArgvW

  SHCreateProcessAsUserW

  SHGetPathFromIDListA

  SHGetDataFromIDListW

  DragFinish

  ShellExecuteW

  SHCreateDirectoryExA

  SHGetDiskFreeSpaceExA

  SHGetFileInfo

  ShellExecuteExW

  SHAddToRecentDocs

  SHGetMalloc

  SHQueryRecycleBinA

  SHGetInstanceExplorer

  SHInvokePrinterCommandW

  DragQueryPoint

  SHGetFolderLocation

  DragQueryFileA

  SHFileOperationA

  SHBrowseForFolderA

  SHGetDiskFreeSpaceExW

  SHPathPrepareForWriteW

  SHGetSpecialFolderPathA

  SHGetFileInfoA

  ShellExecuteA

  ExtractIconW

  FindExecutableA

  ExtractAssociatedIconA

  shlwapi

  StrRChrIA

  StrStrIW

  StrChrIA

  StrStrW

  StrStrA

  StrCmpNIA

  StrRStrIW

  StrRChrIW

  StrChrIW

  StrRChrW

  Sections

  .text

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text11

  Size: 258KB - Virtual size: 258KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text12

  Size: 1024B - Virtual size: 912B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text1

  Size: 1024B - Virtual size: 1000B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 528B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ