General

Malware Config

Signatures

Files

• f30097645a438cdb94edb7736507bc488900bfaef2dd1a8ba36947847397f650

  .exe windows x86

  f3e9a595aa7d584c1da60a614a523104

  
  

  Code Sign

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-11-2006 00:00

  Not After

  16-07-2036 23:59

  Subject

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  6b:c4:05:e8:ac:96:2c:67:6f:54:81:6b:cc:4d:43:11

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  13-08-2014 00:00

  Not After

  12-08-2016 23:59

  Subject

  CN=Download Assistant,O=Download Assistant,L=Victoria,ST=British Columbia,C=CA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  2a:ec:0f:97:0e:76:bc:13:32:02:01:ba:0d:9e:ed:83:8f:21:c1:9e

  Signer

  Actual PE Digest

  2a:ec:0f:97:0e:76:bc:13:32:02:01:ba:0d:9e:ed:83:8f:21:c1:9e

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Download Assistant,O=Download Assistant,L=Victoria,ST=British Columbia,C=CA

  17-11-2022 13:17

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  powrprof

  GetPwrCapabilities

  urlmon

  URLDownloadToFileW

  iphlpapi

  GetAdaptersInfo

  dbghelp

  SymGetLineFromAddr64

  SymFromAddr

  StackWalk64

  SymInitialize

  SymGetModuleInfo64

  SymCleanup

  SymGetModuleBase64

  SymSetOptions

  SymFunctionTableAccess64

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  shell32

  Shell_NotifyIconW

  SHFileOperationW

  CommandLineToArgvW

  ord190

  ShellExecuteExW

  SHOpenFolderAndSelectItems

  ord155

  SHGetFolderPathW

  SHCreateDirectoryExW

  shlwapi

  PathIsRelativeW

  SHDeleteValueW

  SHDeleteKeyW

  kernel32

  SetLastError

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  CreateProcessW

  SetUnhandledExceptionFilter

  GetCurrentProcess

  WaitForSingleObject

  GetCurrentThread

  GetLastError

  CreateMutexA

  GetCurrentThreadId

  ReleaseMutex

  CloseHandle

  CreateFileA

  OpenProcess

  GetProcAddress

  LoadLibraryA

  GetCommandLineW

  GetModuleHandleA

  OutputDebugStringA

  FindFirstFileW

  MoveFileExW

  CopyFileW

  FindNextFileW

  DeleteFileW

  GetTickCount

  FindResourceW

  LoadResource

  GetLocaleInfoW

  Sleep

  SizeofResource

  FormatMessageW

  GetVersionExW

  GetExitCodeProcess

  TerminateProcess

  lstrlenW

  LocalAlloc

  LockResource

  GetSystemInfo

  GetUserDefaultUILanguage

  GetCurrentProcessId

  LocalFree

  GetModuleHandleW

  FormatMessageA

  SetEvent

  CreateEventA

  IsValidCodePage

  ReleaseSemaphore

  CreateThread

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GetSystemTimeAsFileTime

  WideCharToMultiByte

  GetFileAttributesW

  GetModuleFileNameW

  MultiByteToWideChar

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  GetACP

  FlushFileBuffers

  GetConsoleMode

  GetConsoleCP

  SetFilePointer

  HeapCreate

  WriteFile

  HeapSize

  GetFileType

  GetStdHandle

  SetHandleCount

  IsProcessorFeaturePresent

  IsDebuggerPresent

  UnhandledExceptionFilter

  InitializeCriticalSectionAndSpinCount

  LCMapStringW

  GetCPInfo

  RaiseException

  ExitProcess

  GetDateFormatA

  GetTimeFormatA

  DeleteFileA

  MoveFileA

  DuplicateHandle

  CreateProcessA

  RtlUnwind

  GetStartupInfoW

  HeapSetInformation

  GetCommandLineA

  HeapReAlloc

  HeapAlloc

  ReadFile

  HeapFree

  LeaveCriticalSection

  EnterCriticalSection

  GetTimeZoneInformation

  SetStdHandle

  VirtualQuery

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  QueryPerformanceCounter

  CompareStringW

  GetFileAttributesA

  CreatePipe

  GetUserDefaultLCID

  GetLocaleInfoA

  EnumSystemLocalesA

  IsValidLocale

  GetStringTypeW

  LoadLibraryW

  CreateFileW

  WriteConsoleW

  SetEndOfFile

  GetProcessHeap

  SetEnvironmentVariableA

  ExpandEnvironmentStringsW

  GetOEMCP

  CreateSemaphoreA

  DeleteCriticalSection

  InitializeCriticalSection

  InterlockedExchange

  InterlockedDecrement

  InterlockedIncrement

  LoadLibraryExA

  GetModuleFileNameA

  FreeLibrary

  user32

  GetDesktopWindow

  GetWindowLongW

  DestroyWindow

  SetWindowRgn

  SetTimer

  GetWindowRect

  PostQuitMessage

  LoadImageW

  SetCapture

  PostMessageW

  KillTimer

  SetForegroundWindow

  LoadCursorW

  RegisterClassExW

  LoadIconW

  SetWindowLongA

  MessageBoxA

  BringWindowToTop

  GetWindowLongA

  GetWindowTextW

  SystemParametersInfoW

  SetWindowLongW

  SetWindowPos

  GetCursorPos

  DefWindowProcW

  CreateWindowExW

  ReleaseCapture

  GetSystemMetrics

  UpdateWindow

  SetWindowTextW

  ShowWindow

  GetLastInputInfo

  GetMessageW

  GetKeyState

  GetClientRect

  TranslateMessage

  SendMessageW

  DispatchMessageW

  gdi32

  CreatePolygonRgn

  CreateFontIndirectW

  SetBkColor

  DeleteObject

  GetStockObject

  SetBkMode

  advapi32

  CryptAcquireContextW

  CryptGenRandom

  CryptReleaseContext

  CreateWellKnownSid

  RegSetValueExW

  RegEnumKeyExW

  CheckTokenMembership

  RegOpenKeyExW

  FreeSid

  RegEnumValueW

  AllocateAndInitializeSid

  RegQueryInfoKeyW

  RegQueryValueExW

  RegCreateKeyExW

  GetTokenInformation

  OpenThreadToken

  OpenProcessToken

  RegCloseKey

  RegOpenKeyExA

  ole32

  CoCreateInstance

  CoUninitialize

  OleInitialize

  OleCreate

  OleSetContainedObject

  CoInitializeEx

  OleUninitialize

  oleaut32

  VariantClear

  VariantCopy

  VariantInit

  SysAllocString

  wininet

  InternetCrackUrlW

  InternetReadFile

  InternetConnectW

  HttpAddRequestHeadersW

  InternetQueryDataAvailable

  InternetSetOptionW

  InternetCloseHandle

  InternetErrorDlg

  HttpOpenRequestW

  HttpQueryInfoA

  InternetOpenW

  HttpSendRequestW

  Sections

  .text

  Size: 468KB - Virtual size: 468KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 135KB - Virtual size: 135KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 9KB - Virtual size: 51KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 260KB - Virtual size: 260KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 43KB - Virtual size: 42KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ