25afa5194b15575cd17909b818639ab80791454bb93e58abc10adecfc13e9eb2

Sharing

Copy URL Twitter E-mail

General

Target

25afa5194b15575cd17909b818639ab80791454bb93e58abc10adecfc13e9eb2
Size

6.6MB
MD5

d59aaa62823e5a903d0b674e204dc7ba
SHA1

e4af1230c0863ea87a6e126deb900c58b3904b05
SHA256

25afa5194b15575cd17909b818639ab80791454bb93e58abc10adecfc13e9eb2
SHA512

01f7f2d29aa3e6293727a37dd7a3ad6e8b4b4d769b08ee451d023c52693b0b422ba3858fd37b96c5e4b5e44c17db26d1ad71c3947decd77cce5c73f85879d5d5
SSDEEP

98304:Ch/i/i82Fi+mAxbteqTFQJ5SMu8eoMCgNb7EuJY5CO20RGBI6UERwF9RVgXbhH24:CGWi+mM/Rp8eoMC+b7+CO49H7

Score

N/A

Malware Config

Signatures

Files

25afa5194b15575cd17909b818639ab80791454bb93e58abc10adecfc13e9eb2
.exe windows x86

fa3740f07f6d2725edcaa42e6d766d63

Code Sign

0d:52:11:4a:ab:a1:b5:e4:b4:b1:ac:e5:8c:31:9e:4e
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/06/2020, 00:00

Not After

13/06/2023, 12:00

Subject

SERIALNUMBER=597114,CN=EnigmaSoft Limited,O=EnigmaSoft Limited,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:52:11:4a:ab:a1:b5:e4:b4:b1:ac:e5:8c:31:9e:4e
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/06/2020, 00:00

Not After

13/06/2023, 12:00

Subject

SERIALNUMBER=597114,CN=EnigmaSoft Limited,O=EnigmaSoft Limited,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:32:4c:f5:07:49:87:e9:d7:3e:25:f7:eb:4f:ed:b0:6d:8b:de:4d:ad:d3:e4:c6:1d:e5:8a:91:29:c6:bd:23
Signer

Actual PE Digest

d4:32:4c:f5:07:49:87:e9:d7:3e:25:f7:eb:4f:ed:b0:6d:8b:de:4d:ad:d3:e4:c6:1d:e5:8a:91:29:c6:bd:23

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=597114,CN=EnigmaSoft Limited,O=EnigmaSoft Limited,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

28/12/2022, 20:31
Valid: true

Chain 1

SERIALNUMBER=597114,CN=EnigmaSoft Limited,O=EnigmaSoft Limited,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

6a:91:7d:55:a6:d5:8f:36:0d:cd:f1:a2:8c:09:f5:bc:78:66:5f:78
Signer

Actual PE Digest

6a:91:7d:55:a6:d5:8f:36:0d:cd:f1:a2:8c:09:f5:bc:78:66:5f:78

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=597114,CN=EnigmaSoft Limited,O=EnigmaSoft Limited,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

28/12/2022, 20:31
Valid: true

Chain 1

SERIALNUMBER=597114,CN=EnigmaSoft Limited,O=EnigmaSoft Limited,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipCreatePath
GdipCreateRegion
GdipSetClipRegion
GdipSetInfinite
GdipGetClip
GdipDeleteRegion
GdipDeleteGraphics
GdipGetImageHeight
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipImageRotateFlip
GdipGetImagePixelFormat
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromResource
GdipCreateBitmapFromStream
GdipClosePathFigure
GdipAddPathArcI
GdipResetPath
GdipDeletePen
GdipDrawPath
GdipSetPenDashStyle
GdipCreatePen1
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipSetCompositingMode
GdipFillRectangleI
GdipDeleteBrush
GdipCreateTextureIAI
GdipSetImageAttributesColorKeys
GdipSetImageAttributesWrapMode
GdipDrawImagePointRectI
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDrawImageRectRectI
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdipCreateBitmapFromHBITMAP
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDeletePath
GdipCombineRegionPath
GdipSetSmoothingMode
GdipGetImageWidth

usp10

ScriptStringAnalyse
ScriptStringOut
ScriptStringGetLogicalWidths
ScriptStringGetOrder
ScriptStringXtoCP
ScriptString_pSize
ScriptString_pcOutChars
ScriptStringFree
ScriptString_pLogAttr
ScriptStringCPtoX

crypt32

CryptDecodeObject
CryptMsgClose
CryptQueryObject
CryptMsgGetParam
CertGetNameStringW
CryptHashCertificate
CertGetCertificateContextProperty
CertCloseStore
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

ws2_32

WSAIoctl
closesocket
WSASetLastError
getpeername
getsockname
socket
ntohs
connect
getsockopt
htons
setsockopt
send
recvfrom
listen
accept
bind
shutdown
getaddrinfo
htonl
gethostname
recv
WSAGetLastError
WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSACleanup
WSAStartup
select
__WSAFDIsSet
ioctlsocket
freeaddrinfo
getnameinfo
sendto

psapi

GetProcessMemoryInfo
GetModuleFileNameExW
EnumProcessModules
GetProcessImageFileNameW

kernel32

CreateEventA
GetLastError
MoveFileExW
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
DeleteCriticalSection
DeleteFileW
Sleep
GetCurrentProcess
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetTickCount
CreateFileW
HeapFree
QueryPerformanceFrequency
GetProcessHeap
lstrcmpiW
QueryPerformanceCounter
FindResourceW
GetUserDefaultLCID
GetDiskFreeSpaceExW
LoadLibraryW
HeapAlloc
GetProcAddress
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetCurrentProcessId
GetLocalTime
ReadFile
GetFileSizeEx
WriteFile
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
GetExitCodeProcess
EnumResourceNamesW
SizeofResource
InterlockedDecrement
GetModuleFileNameW
MultiByteToWideChar
LoadResource
GetModuleHandleW
InterlockedIncrement
SetDllDirectoryW
LoadLibraryExW
FreeLibrary
FileTimeToSystemTime
SystemTimeToFileTime
TerminateProcess
OpenProcess
OpenMutexW
GetSystemDirectoryW
SleepEx
InitializeCriticalSection
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
FormatMessageW
GetEnvironmentVariableA
GetStdHandle
WaitForMultipleObjects
PeekNamedPipe
GetFileType
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
LoadLibraryA
ConvertFiberToThread
ConvertThreadToFiber
FindClose
FindFirstFileW
FindNextFileW
GetSystemTime
WaitForSingleObjectEx
MulDiv
ExpandEnvironmentStringsW
GetLongPathNameW
CreateDirectoryW
CopyFileW
DeviceIoControl
LocalFree
GetSystemInfo
GetNativeSystemInfo
LocalAlloc
ProcessIdToSessionId
GetVolumeInformationW
lstrcpyW
lstrcatW
CreateProcessW
CreatePipe
SetHandleInformation
HeapReAlloc
GetComputerNameW
GetCurrentThread
GetLogicalDriveStringsW
GetDriveTypeW
GetModuleHandleA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GlobalSize
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindFirstVolumeW
GetVolumePathNamesForVolumeNameW
QueryDosDeviceW
FindNextVolumeW
FindVolumeClose
lstrlenW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetFilePointer
MoveFileW
SetFilePointerEx
GetTimeFormatW
GetDateFormatW
LockResource
GetLogicalDrives
DeleteVolumeMountPointW
DefineDosDeviceW
GetVolumeNameForVolumeMountPointW
SetVolumeMountPointW
GlobalMemoryStatusEx
GetLocaleInfoW
CreateEventW
CreateNamedPipeW
GetLocaleInfoA
CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
lstrcmpA
FileTimeToLocalFileTime
lstrcpynW
RemoveVectoredExceptionHandler
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
IsBadReadPtr
VirtualQuery
FreeResource
GetFileSize
CreateSemaphoreA
DuplicateHandle
ReleaseSemaphore
CloseHandle
SetEvent
GetStringTypeW
EncodePointer
CompareStringW
LCMapStringW
GetCPInfo
ResetEvent
WaitForMultipleObjectsEx
OpenEventA
SetWaitableTimer
ResumeThread
CreateWaitableTimerA
FormatMessageA
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeExW
LCMapStringA
GetStringTypeExA
RtlUnwind
GetModuleFileNameA
WriteConsoleW
GetACP
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
CreateThread
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
ExitProcess
GetCommandLineA
GetCommandLineW
GetConsoleCP
HeapSize
IsValidCodePage
GetOEMCP
IsValidLocale
EnumSystemLocalesW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
SetEnvironmentVariableA
SetEnvironmentVariableW
FindFirstFileExW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEndOfFile
GetTempPathW
GetVersionExW
CreateProcessA

user32

OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
GetClipboardData
EnableWindow
SetTimer
KillTimer
SetWindowRgn
IsCharAlphaNumericA
ScreenToClient
UpdateLayeredWindow
SetCaretPos
SetActiveWindow
GetKeyState
DestroyCaret
ClientToScreen
CreateCaret
ShowCaret
HideCaret
InsertMenuW
TrackPopupMenu
MessageBoxW
GetSystemMetrics
LoadAcceleratorsW
LoadStringW
GetClassInfoW
DispatchMessageW
PeekMessageW
RegisterClassW
CharNextW
TranslateMessage
UpdateWindow
SetForegroundWindow
LoadImageW
GetWindow
MonitorFromWindow
EndDialog
GetWindowInfo
LockSetForegroundWindow
MapWindowPoints
EnumWindows
GetWindowDC
SetWindowTextW
InvalidateRect
GetDC
ReleaseDC
GetFocus
RegisterClassExW
IsWindowEnabled
SetRect
GetClassInfoExW
InflateRect
IsZoomed
DrawTextW
IsIconic
GetCapture
TrackMouseEvent
SetFocus
SetCapture
ReleaseCapture
GetCursorPos
PostMessageW
ShowWindow
RedrawWindow
GetDlgItem
GetWindowLongW
DefWindowProcW
AdjustWindowRectEx
CallWindowProcW
GetWindowRect
DestroyWindow
IsWindowVisible
SetWindowPos
EnumChildWindows
CreateWindowExW
SendMessageW
IsWindow
OffsetRect
LoadCursorW
SetCursor
SetWindowLongW
GetClientRect
GetParent
PtInRect
BeginPaint
EndPaint
UnregisterClassW
ExitWindowsEx
GetMessageExtraInfo
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
FindWindowExW
GetWindowTextLengthW
GetMenuItemInfoW
MessageBeep
CreatePopupMenu
GetActiveWindow
IsDialogMessageW
DestroyMenu
BringWindowToTop
TranslateAcceleratorW
LoadIconW
TrackPopupMenuEx
RemoveMenu
AllowSetForegroundWindow
MonitorFromPoint
GetMenuItemCount
MoveWindow
LoadStringA
AppendMenuW
PostQuitMessage
DialogBoxParamW
GetMessageW
GetMonitorInfoW
LoadMenuW

gdi32

TextOutW
GetTextMetricsW
StartPage
EndPage
GetBkColor
SetTextAlign
GetTextColor
GetDeviceCaps
CombineRgn
GetDIBits
ExtCreatePen
LineTo
MoveToEx
ExtTextOutW
CreateFontW
GetObjectW
SetBrushOrgEx
SetStretchBltMode
GetTextExtentPoint32W
CreatePen
Rectangle
SelectClipRgn
IntersectClipRect
SetBkColor
CreateSolidBrush
SetTextColor
SetBkMode
BitBlt
CreateCompatibleBitmap
SaveDC
SelectObject
CreateCompatibleDC
DeleteDC
SetViewportOrgEx
ExcludeClipRect
RestoreDC
DeleteObject
CreateRectRgn
ExtSelectClipRgn

advapi32

CloseServiceHandle
CryptSignHashW
OpenServiceW
OpenSCManagerW
GetNamedSecurityInfoW
GetExplicitEntriesFromAclW
InitializeAcl
SetEntriesInAclW
SetNamedSecurityInfoW
QueryServiceStatusEx
ControlService
LookupAccountNameW
RegSaveKeyExW
RegEnumValueW
OpenProcessToken
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
RegSetKeySecurity
AddAccessAllowedAce
SetSecurityDescriptorDacl
ConvertSidToStringSidW
LookupPrivilegeValueW
GetTokenInformation
GetLengthSid
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
AccessCheck
IsValidSecurityDescriptor
CryptEnumProvidersW
AdjustTokenPrivileges
GetUserNameW
DuplicateToken
FreeSid
OpenThreadToken
AllocateAndInitializeSid
SetSecurityDescriptorGroup

shell32

SHOpenFolderAndSelectItems
SHParseDisplayName
ShellExecuteW

ole32

CreateStreamOnHGlobal
CoInitializeEx
CoTaskMemRealloc
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VariantInit
SysAllocString
VariantClear
VarUI4FromStr
SysFreeString

shlwapi

ord1
StrCmpNIW
StrCmpIW

comctl32

ord410
ord413
ord412

msimg32

AlphaBlend

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 939KB - Virtual size: 938KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 122KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa3740f07f6d2725edcaa42e6d766d63

Code Sign

0d:52:11:4a:ab:a1:b5:e4:b4:b1:ac:e5:8c:31:9e:4eCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

0d:52:11:4a:ab:a1:b5:e4:b4:b1:ac:e5:8c:31:9e:4eCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

d4:32:4c:f5:07:49:87:e9:d7:3e:25:f7:eb:4f:ed:b0:6d:8b:de:4d:ad:d3:e4:c6:1d:e5:8a:91:29:c6:bd:23Signer

Signature Validations

Verification

28/12/2022, 20:31 Valid: true

Chain 1

6a:91:7d:55:a6:d5:8f:36:0d:cd:f1:a2:8c:09:f5:bc:78:66:5f:78Signer

Signature Validations

Verification

28/12/2022, 20:31 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

usp10

crypt32

version

ws2_32

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.rdata Size: 939KB - Virtual size: 938KB

.data Size: 122KB - Virtual size: 175KB

.gfids Size: 2KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 208KB - Virtual size: 208KB

0d:52:11:4a:ab:a1:b5:e4:b4:b1:ac:e5:8c:31:9e:4e
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

0d:52:11:4a:ab:a1:b5:e4:b4:b1:ac:e5:8c:31:9e:4e
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

d4:32:4c:f5:07:49:87:e9:d7:3e:25:f7:eb:4f:ed:b0:6d:8b:de:4d:ad:d3:e4:c6:1d:e5:8a:91:29:c6:bd:23
Signer

28/12/2022, 20:31
Valid: true

6a:91:7d:55:a6:d5:8f:36:0d:cd:f1:a2:8c:09:f5:bc:78:66:5f:78
Signer

28/12/2022, 20:31
Valid: true

.text
Size: 4.2MB - Virtual size: 4.2MB

.rdata
Size: 939KB - Virtual size: 938KB

.data
Size: 122KB - Virtual size: 175KB

.gfids
Size: 2KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 208KB - Virtual size: 208KB