General

Malware Config

Signatures

Files

• e845e5c7d95b80e85fe3c3c1875ca165b2f033221b4255b313c40d4ff82d832f

  .exe windows x86

  51caee0f3184cdb77601b6c641c3dbca

  
  

  Code Sign

  50:1b:a4:d1:90:51:bf:40:b9:42:2d:33:e6:c2:04:1f

  Certificate

  Issuer

  CN=OUOVLLTHGWMXXUBAOE

  Not Before

  27-05-2019 05:04

  Not After

  31-12-2039 23:59

  Subject

  CN=OUOVLLTHGWMXXUBAOE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

  Certificate

  Issuer

  CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

  Not Before

  07-06-2005 08:09

  Not After

  30-05-2020 10:48

  Subject

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  27-04-2011 00:00

  Not After

  30-05-2020 10:48

  Subject

  CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

  Certificate

  Issuer

  CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  02-05-2019 00:00

  Not After

  30-05-2020 10:48

  Subject

  CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  82:f9:19:aa:c3:d0:b6:a8:60:72:01:b5:76:08:86:19:1f:3a:16:a7

  Signer

  Actual PE Digest

  82:f9:19:aa:c3:d0:b6:a8:60:72:01:b5:76:08:86:19:1f:3a:16:a7

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=OUOVLLTHGWMXXUBAOE

  27-05-2019 16:54

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  VirtualAllocEx

  GetModuleHandleW

  GetUserDefaultUILanguage

  DuplicateHandle

  WaitForSingleObject

  Sleep

  GetCurrentProcess

  CreateThread

  SetThreadPriority

  TerminateThread

  ResumeThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemInfo

  WaitForMultipleObjects

  CreateFileW

  FlushFileBuffers

  GetFileType

  GetLogicalDrives

  ReadFile

  SetEndOfFile

  SetFilePointerEx

  WriteFile

  SetErrorMode

  CreateFileMappingW

  MapViewOfFile

  UnmapViewOfFile

  MoveFileExW

  GetCurrentDirectoryW

  CreateDirectoryW

  FindClose

  FindFirstFileW

  GetFileAttributesExW

  GetFileInformationByHandle

  GetFullPathNameW

  GetLongPathNameW

  RemoveDirectoryW

  GetTempPathW

  DeviceIoControl

  MoveFileW

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  QueryPerformanceCounter

  GetCurrencyFormatW

  GetTickCount

  FindFirstFileExW

  GetTimeFormatW

  GetStartupInfoW

  GetModuleFileNameW

  MultiByteToWideChar

  WideCharToMultiByte

  FreeLibrary

  GetTimeZoneInformation

  GetGeoInfoW

  GetUserGeoID

  GetModuleHandleExW

  ExitProcess

  GetVolumeInformationW

  lstrcmpW

  ReleaseMutex

  CreateMutexW

  VirtualAlloc

  VirtualFree

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  EncodePointer

  RaiseException

  InitializeCriticalSectionAndSpinCount

  LoadLibraryExW

  SetLastError

  GetCommandLineA

  ExitThread

  FreeLibraryAndExitThread

  SetStdHandle

  GetConsoleMode

  ReadConsoleW

  GetConsoleCP

  GetStdHandle

  GetModuleFileNameA

  GetACP

  HeapFree

  HeapAlloc

  LCMapStringW

  EnumSystemLocalesW

  DecodePointer

  HeapReAlloc

  GetCPInfo

  SetEnvironmentVariableA

  WriteConsoleW

  GetStringTypeW

  IsValidCodePage

  GetOEMCP

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetProcessHeap

  FindFirstFileExA

  FindNextFileA

  HeapSize

  GetDateFormatW

  GetThreadPriority

  GetCurrentThread

  ResetEvent

  LoadLibraryW

  GetSystemDirectoryW

  CreateEventW

  WaitForSingleObjectEx

  SetEvent

  GetConsoleWindow

  OutputDebugStringW

  FindNextChangeNotification

  GetLocalTime

  GetSystemTime

  GetUserDefaultLCID

  CompareStringW

  GetCurrentProcessId

  GlobalSize

  LoadLibraryA

  GetLocaleInfoW

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  OpenProcess

  CheckRemoteDebuggerPresent

  GetUserDefaultLangID

  CreateProcessW

  CloseHandle

  ExpandEnvironmentStringsW

  IsValidLocale

  IsValidLanguageGroup

  FormatMessageW

  GetProcAddress

  GetCurrentThreadId

  GetLastError

  FindNextFileW

  FindCloseChangeNotification

  FindFirstChangeNotificationW

  LocalFree

  GetCommandLineW

  GetVersionExW

  CopyFileW

  SetFileAttributesW

  GetFileAttributesW

  GetDriveTypeW

  QueryPerformanceFrequency

  DeleteFileW

  VirtualQuery

  VirtualProtect

  GetLocaleInfoA

  GetStringTypeA

  LCMapStringA

  LocalAlloc

  GetEnvironmentVariableW

  lstrlenW

  GetModuleHandleA

  GetStartupInfoA

  GetVersionExA

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  SetHandleCount

  HeapDestroy

  HeapCreate

  user32

  GetDesktopWindow

  GetClipboardOwner

  GetThreadDesktop

  GetCaretBlinkTime

  DestroyWindow

  GetKeyState

  IsIconic

  GetTopWindow

  GetSysColor

  GetListBoxInfo

  IsWindowVisible

  MessageBoxW

  PostThreadMessageA

  TranslateMessage

  SetTimer

  GetMessageA

  PeekMessageW

  DispatchMessageW

  MsgWaitForMultipleObjects

  CharNextA

  KillTimer

  gdi32

  GetTextAlign

  GetDCPenColor

  CloseMetaFile

  CreateMetaFileA

  FillPath

  GetFontLanguageInfo

  GetSystemPaletteUse

  GetLayout

  advapi32

  RegOpenKeyA

  RegQueryValueExA

  msvcrt

  _except_handler3

  __set_app_type

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _initterm

  __getmainargs

  _acmdln

  exit

  _XcptFilter

  _exit

  _onexit

  __dllonexit

  _controlfp

  Sections

  .text

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 20KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 69KB - Virtual size: 69KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ