General

Malware Config

Signatures

Files

• 2dfc554fce0f0ff45e892b8fcd0c4d29ae61029735bb8a81f90d6a0df640ccfa

  .exe windows x86

  3da603644b06c0ab1ac412a11aae3146

  
  

  Code Sign

  47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  17-11-2006 00:00

  Not After

  16-07-2036 23:59

  Subject

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  1c:09:db:bc:73:2d:4b:58:f7:a8:8e:ba:cf:32:34:17

  Certificate

  Issuer

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Not Before

  09-12-2011 00:00

  Not After

  06-02-2014 23:59

  Subject

  CN=LLC Mail.Ru,O=LLC Mail.Ru,L=Moscow,ST=Moscow,C=RU

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  ad:a8:90:61:74:48:ff:41:e0:54:71:06:7a:83:f5:c3:10:a5:b4:d6

  Signer

  Actual PE Digest

  ad:a8:90:61:74:48:ff:41:e0:54:71:06:7a:83:f5:c3:10:a5:b4:d6

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=LLC Mail.Ru,O=LLC Mail.Ru,L=Moscow,ST=Moscow,C=RU

  17-11-2022 13:16

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wininet

  InternetOpenUrlA

  InternetConnectA

  HttpOpenRequestA

  HttpSendRequestA

  InternetReadFile

  HttpQueryInfoA

  InternetCloseHandle

  InternetOpenA

  InternetSetOptionA

  shlwapi

  wvnsprintfA

  PathFindFileNameA

  PathFindExtensionA

  PathFileExistsA

  kernel32

  Sleep

  SetLastError

  GetTempPathA

  lstrcatA

  GetModuleFileNameA

  FindResourceA

  LoadResource

  SizeofResource

  LockResource

  CreateThread

  DeleteFileA

  WaitForSingleObject

  GetStdHandle

  CreateMutexA

  AllocConsole

  FreeConsole

  CloseHandle

  ReleaseMutex

  WriteConsoleA

  lstrlenA

  HeapAlloc

  GetProcessHeap

  HeapFree

  ExitProcess

  GetCommandLineW

  GetModuleHandleA

  SystemTimeToFileTime

  lstrcmpiA

  FindClose

  FindFirstFileA

  SetFileTime

  lstrcpyA

  OutputDebugStringA

  GetLastError

  WideCharToMultiByte

  SetFileAttributesA

  WriteFile

  CreateFileA

  SetFilePointer

  MoveFileA

  GetSystemTimeAsFileTime

  MoveFileExA

  FreeResource

  user32

  GetDlgItem

  MessageBoxW

  EnableWindow

  SetWindowLongA

  GetWindowLongA

  SetWindowTextA

  DialogBoxParamA

  SendMessageA

  GetWindowLongW

  SetWindowLongW

  SetTimer

  LoadIconA

  KillTimer

  MoveWindow

  ScreenToClient

  EndDialog

  SendDlgItemMessageA

  MessageBoxA

  SetWindowPos

  GetWindowRect

  ShowWindow

  DefWindowProcA

  SetFocus

  GetWindowTextA

  gdi32

  GetStockObject

  CreateFontW

  comdlg32

  GetSaveFileNameA

  shell32

  CommandLineToArgvW

  ShellExecuteA

  SHGetSpecialFolderPathA

  ShellExecuteExA

  Sections

  .text

  Size: 32KB - Virtual size: 31KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 21KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ