General

Malware Config

Signatures

Files

• Setup_File_Magic_2022.exe

  .exe windows x86

  3e766de363c948164bb7e88bf1124c5a

  
  

  Code Sign

  42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

  Certificate

  Issuer

  CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

  Not Before

  07-06-2005 08:09

  Not After

  30-05-2020 10:48

  Subject

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  27-04-2011 00:00

  Not After

  30-05-2020 10:48

  Subject

  CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

  Certificate

  Issuer

  CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  02-05-2019 00:00

  Not After

  30-05-2020 10:48

  Subject

  CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  59:c8:3f:99:c9:67:61:fa:39:e5:c0:7f:da:2a:c7:55

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  29-05-2019 00:00

  Not After

  28-05-2020 23:59

  Subject

  CN=SOLVUSOFT CORPORATION,O=SOLVUSOFT CORPORATION,POSTALCODE=89107,STREET=848 N RAINBOW BLVD 3321,L=Las Vegas,ST=NV,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  45:52:20:d1:41:cb:a6:cc:d9:29:b5:5e:9b:67:86:34:ec:7a:64:9f:e2:ad:44:2d:a1:75:fc:4b:0c:6d:08:ce

  Signer

  Actual PE Digest

  45:52:20:d1:41:cb:a6:cc:d9:29:b5:5e:9b:67:86:34:ec:7a:64:9f:e2:ad:44:2d:a1:75:fc:4b:0c:6d:08:ce

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=SOLVUSOFT CORPORATION,O=SOLVUSOFT CORPORATION,POSTALCODE=89107,STREET=848 N RAINBOW BLVD 3321,L=Las Vegas,ST=NV,C=US

  04-06-2019 19:12

  Valid: true

  Chain 1

  CN=SOLVUSOFT CORPORATION,O=SOLVUSOFT CORPORATION,POSTALCODE=89107,STREET=848 N RAINBOW BLVD 3321,L=Las Vegas,ST=NV,C=US

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  comctl32

  ord17

  ImageList_ReplaceIcon

  ImageList_Draw

  ImageList_Create

  ImageList_Destroy

  _TrackMouseEvent

  ImageList_GetIconSize

  shlwapi

  PathFileExistsW

  UrlIsW

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  kernel32

  GlobalUnlock

  CreateDirectoryW

  ReadFile

  GetFullPathNameW

  lstrlenW

  WriteFile

  LockFile

  SetFilePointer

  SetEndOfFile

  GetTempPathW

  CreateFileW

  UnlockFile

  lstrcmpW

  FlushFileBuffers

  MulDiv

  GetExitCodeProcess

  CreateMutexW

  ReleaseMutex

  TlsAlloc

  GlobalFlags

  GlobalFree

  WideCharToMultiByte

  TlsFree

  MoveFileW

  VirtualQuery

  DeleteFileW

  GetModuleFileNameW

  GetUserDefaultUILanguage

  GetVersion

  AreFileApisANSI

  TryEnterCriticalSection

  HeapCreate

  HeapFree

  InterlockedCompareExchange

  GetDiskFreeSpaceW

  OutputDebugStringA

  GetFullPathNameA

  UnlockFileEx

  GetFileAttributesW

  GetVersionExW

  UnmapViewOfFile

  HeapValidate

  HeapSize

  Sleep

  GetTempPathA

  GetDiskFreeSpaceA

  GetFileAttributesA

  GetFileAttributesExW

  FlushViewOfFile

  CreateFileA

  LoadLibraryA

  WaitForSingleObjectEx

  GetVersionExA

  DeleteFileA

  HeapReAlloc

  GetSystemInfo

  HeapAlloc

  HeapCompact

  HeapDestroy

  CreateFileMappingA

  LocalFree

  LockFileEx

  GetFileSize

  GetCurrentProcessId

  GetProcessHeap

  SystemTimeToFileTime

  GetSystemTimeAsFileTime

  GetSystemTime

  FormatMessageA

  CreateFileMappingW

  MapViewOfFile

  QueryPerformanceCounter

  GetTickCount

  GlobalAlloc

  GetCurrentDirectoryW

  IsValidCodePage

  FindNextFileA

  FindFirstFileExA

  FindClose

  ReadConsoleW

  WriteConsoleW

  SetStdHandle

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetTimeFormatW

  GetDateFormatW

  GetACP

  GetStdHandle

  GetModuleFileNameA

  ExitProcess

  SetFilePointerEx

  GetFileType

  GetConsoleMode

  GetConsoleCP

  GetModuleHandleExW

  ExitThread

  GetTimeZoneInformation

  RaiseException

  RtlUnwind

  CreateTimerQueue

  UnregisterWaitEx

  QueryDepthSList

  InterlockedFlushSList

  InterlockedPushEntrySList

  InterlockedPopEntrySList

  ReleaseSemaphore

  DuplicateHandle

  VirtualFree

  VirtualProtect

  VirtualAlloc

  LoadLibraryExW

  GetModuleHandleA

  FreeLibraryAndExitThread

  GetThreadTimes

  GetCurrentThread

  UnregisterWait

  RegisterWaitForSingleObject

  SetThreadAffinityMask

  GetProcessAffinityMask

  GetNumaHighestNodeNumber

  DeleteTimerQueueTimer

  ChangeTimerQueueTimer

  CreateTimerQueueTimer

  GetLogicalProcessorInformation

  GetThreadPriority

  SetThreadPriority

  CreateThread

  SignalObjectAndWait

  InitializeSListHead

  GetStartupInfoW

  IsDebuggerPresent

  IsProcessorFeaturePresent

  TerminateProcess

  GetCurrentProcess

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  ResetEvent

  SetEvent

  GetCPInfo

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  DecodePointer

  EncodePointer

  GetModuleHandleW

  SwitchToThread

  CreateEventW

  InitializeCriticalSectionAndSpinCount

  SetLastError

  GetStringTypeW

  FreeLibrary

  GetProcAddress

  GlobalLock

  FindResourceW

  LoadLibraryW

  InterlockedIncrement

  TlsGetValue

  DeleteCriticalSection

  CloseHandle

  TerminateThread

  OutputDebugStringW

  GetLastError

  FormatMessageW

  MultiByteToWideChar

  ResumeThread

  SuspendThread

  GetCurrentThreadId

  WaitForSingleObject

  InitializeCriticalSection

  LeaveCriticalSection

  InterlockedDecrement

  lstrcpynW

  EnterCriticalSection

  TlsSetValue

  GetOEMCP

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  LocalFileTimeToFileTime

  user32

  RegisterWindowMessageW

  GetParent

  TranslateMessage

  TranslateAcceleratorW

  PeekMessageW

  GetMenuItemCount

  InflateRect

  UpdateWindow

  LockWindowUpdate

  GetWindowLongW

  DispatchMessageW

  IsWindow

  SendMessageW

  GetMessageW

  EndPaint

  ScreenToClient

  CreatePopupMenu

  GetAsyncKeyState

  OffsetRect

  IsMenu

  GetDlgCtrlID

  ClientToScreen

  IsChild

  MapWindowPoints

  SendDlgItemMessageW

  GetSysColor

  DestroyMenu

  IsRectEmpty

  SetCapture

  TrackPopupMenuEx

  RemoveMenu

  CheckMenuItem

  AppendMenuW

  DrawTextW

  PtInRect

  ReleaseCapture

  GetCursorPos

  InvalidateRect

  GetWindowPlacement

  SetWindowPlacement

  EnableWindow

  RedrawWindow

  SetCursor

  UnregisterClassW

  CopyRect

  GetClientRect

  SetRect

  CreateDialogParamW

  DefWindowProcW

  LoadMenuW

  CallWindowProcW

  PostMessageW

  GetWindowRect

  DestroyWindow

  GetDC

  SetWindowPos

  MessageBoxW

  CreateWindowExW

  CallNextHookEx

  EndDialog

  GetSystemMetrics

  SetWindowTextW

  ShowWindow

  GetClassInfoW

  IsDialogMessageW

  WindowFromDC

  RegisterClassW

  DialogBoxIndirectParamW

  UnhookWindowsHookEx

  IntersectRect

  SetFocus

  GetUpdateRect

  LoadCursorW

  SetWindowsHookExW

  SetWindowLongW

  GetDlgItem

  PostQuitMessage

  GetDesktopWindow

  CreateDialogIndirectParamW

  SystemParametersInfoW

  DialogBoxParamW

  LoadImageW

  ReleaseDC

  BeginPaint

  gdi32

  CreatePen

  LineTo

  GetTextExtentPoint32W

  CreateRectRgn

  CreateRectRgnIndirect

  Rectangle

  SelectClipRgn

  MoveToEx

  PaintRgn

  CreateFontIndirectW

  CombineRgn

  RoundRect

  ExtTextOutW

  SetLayout

  CreateFontW

  GetDeviceCaps

  GetObjectW

  CreateSolidBrush

  SaveDC

  GetStockObject

  DeleteDC

  RestoreDC

  DeleteObject

  CreateCompatibleBitmap

  BitBlt

  CreateCompatibleDC

  SetBkColor

  SelectObject

  comdlg32

  GetFileTitleW

  shell32

  ShellExecuteExW

  ShellExecuteW

  ole32

  CLSIDFromString

  OleInitialize

  CoCreateInstance

  CoCreateGuid

  CoUninitialize

  OleUninitialize

  CoInitialize

  CreateStreamOnHGlobal

  oleaut32

  SysAllocString

  SafeArrayCreateVector

  VariantClear

  OleLoadPicture

  wininet

  DeleteUrlCacheEntryW

  InternetCheckConnectionW

  urlmon

  URLDownloadToFileW

  Sections

  .text

  Size: 989KB - Virtual size: 989KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 175KB - Virtual size: 174KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 19KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 26KB - Virtual size: 25KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 44KB - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ