MatrizRO_Instalador[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

MatrizRO_Instalador.zip
Size

2.2MB
MD5

b0fe9bb054bf4b6872c417bcd6f26f98
SHA1

33e61297ad6b39263c32ed32d5fb19e18d546b81
SHA256

63d47cde2ddc44180cd1479906e0f239cee0fcedfe060d77028b7efad24ceccb
SHA512

81ab2ca100a8b4704d5f37701bc4f542acfdd8710fc0fb253493e9a10c415fa31a3cb40b2bb40c3e1a435e752c44de8d5888c966e6de31f5b6c38d3a3f0f01f3
SSDEEP

49152:gq+t2tpt5VTMr8D2xBQddfvTrYh8Vw7s7OmT7Huf1Mi5fRC6MnYGsPG:gq+AZ5VYrW2Xcdf68Vwe5T81l5ZCpYT+

Score

N/A

Malware Config

Signatures

Files

MatrizRO_Instalador.zip
.zip
MatrizRO_Instalador/Application Files/GeneracionMatrizRO_1_0_0_4/ClosedXML.dll.deploy
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MatrizRO_Instalador/Application Files/GeneracionMatrizRO_1_0_0_4/DocumentFormat.OpenXml.dll.deploy
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

06:7e:0e:bd:ca:b8:99:ab:9d:1d:07:13:b4:33:9b:dc
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16-09-2016 00:00

Not After

28-10-2019 12:00

Subject

CN=.NET Foundation,O=.NET Foundation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:7e:0e:bd:ca:b8:99:ab:9d:1d:07:13:b4:33:9b:dc
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16-09-2016 00:00

Not After

28-10-2019 12:00

Subject

CN=.NET Foundation,O=.NET Foundation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04-01-2017 00:00

Not After

18-01-2028 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dd:6d:57:fc:e6:30:1a:58:b5:63:2f:f7:14:3c:a4:12:5e:7e:ce:8a:d0:4d:a6:42:d4:58:a7:26:8a:0a:2e:43
Signer

Actual PE Digest

dd:6d:57:fc:e6:30:1a:58:b5:63:2f:f7:14:3c:a4:12:5e:7e:ce:8a:d0:4d:a6:42:d4:58:a7:26:8a:0a:2e:43

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=.NET Foundation,O=.NET Foundation,L=Redmond,ST=WA,C=US

20-01-2023 15:48
Valid: false

14:04:31:bf:1c:12:62:48:96:a5:ae:58:3b:75:ff:e3:86:dc:cf:1d
Signer

Actual PE Digest

14:04:31:bf:1c:12:62:48:96:a5:ae:58:3b:75:ff:e3:86:dc:cf:1d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=.NET Foundation,O=.NET Foundation,L=Redmond,ST=WA,C=US

06-06-2017 22:59
Valid: true

Chain 1

CN=.NET Foundation,O=.NET Foundation,L=Redmond,ST=WA,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MatrizRO_Instalador/Application Files/GeneracionMatrizRO_1_0_0_4/EXCEL 006.ico.deploy
MatrizRO_Instalador/Application Files/GeneracionMatrizRO_1_0_0_4/ExcelNumberFormat.dll.deploy
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MatrizRO_Instalador/Application Files/GeneracionMatrizRO_1_0_0_4/GeneracionMatrizRO.application
MatrizRO_Instalador/Application Files/GeneracionMatrizRO_1_0_0_4/GeneracionMatrizRO.exe.config.deploy
MatrizRO_Instalador/Application Files/GeneracionMatrizRO_1_0_0_4/GeneracionMatrizRO.exe.deploy
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

6f:49:59:b8:ef:b5:f9:9c:48:a7:fe:1a:a5:53:50:7b
Certificate

Issuer

CN=DESKTOP-S5GBO2G\\Rommel León Cuisano

Not Before

30-03-2022 17:29

Not After

30-03-2023 23:29

Subject

CN=DESKTOP-S5GBO2G\\Rommel León Cuisano

f9:95:f2:19:4e:bf:ff:1b:ac:a4:77:df:c6:54:ea:ef:12:8b:be:82:ec:5a:7e:58:ef:79:1b:33:3f:7e:3c:66
Signer

Actual PE Digest

f9:95:f2:19:4e:bf:ff:1b:ac:a4:77:df:c6:54:ea:ef:12:8b:be:82:ec:5a:7e:58:ef:79:1b:33:3f:7e:3c:66

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=DESKTOP-S5GBO2G\\Rommel León Cuisano

20-01-2023 15:48
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MatrizRO_Instalador/Application Files/GeneracionMatrizRO_1_0_0_4/GeneracionMatrizRO.exe.manifest
MatrizRO_Instalador/Application Files/GeneracionMatrizRO_1_0_0_4/Icono_2.ico.deploy
MatrizRO_Instalador/Application Files/GeneracionMatrizRO_1_0_0_4/System.IO.Packaging.dll.deploy
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:9a:9a:9b:16:c2:83:da:d5:c2:00:00:00:00:00:9a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30-03-2016 19:21

Not After

30-06-2017 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-06-2015 17:42

Not After

04-09-2016 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28-10-2015 20:31

Not After

28-01-2017 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:1c:7d:b7:1b:4f:ad:ea:f5:d0:c6:98:68:93:21:fa:e8:fd:a3:09:08:47:b2:35:9b:f3:b7:cb:a6:67:06:6c
Signer

Actual PE Digest

d8:1c:7d:b7:1b:4f:ad:ea:f5:d0:c6:98:68:93:21:fa:e8:fd:a3:09:08:47:b2:35:9b:f3:b7:cb:a6:67:06:6c

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20-01-2023 15:48
Valid: false

bc:79:6f:19:6b:6d:a2:b8:57:0e:c3:e7:86:8c:d2:06:9d:b5:0b:9a
Signer

Actual PE Digest

bc:79:6f:19:6b:6d:a2:b8:57:0e:c3:e7:86:8c:d2:06:9d:b5:0b:9a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12-06-2016 06:09
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MatrizRO_Instalador/GeneracionMatrizRO.application
MatrizRO_Instalador/setup.exe
.exe windows x86

4bbd4adfc99174f1d7d82430fab6116e

Code Sign

6f:49:59:b8:ef:b5:f9:9c:48:a7:fe:1a:a5:53:50:7b
Certificate

Issuer

CN=DESKTOP-S5GBO2G\\Rommel León Cuisano

Not Before

30-03-2022 17:29

Not After

30-03-2023 23:29

Subject

CN=DESKTOP-S5GBO2G\\Rommel León Cuisano

fe:9f:38:a1:8a:40:46:90:97:3b:a2:18:b4:3e:d4:a7:59:75:20:ac:de:c2:1c:bc:a7:a0:ab:dd:5e:1d:07:f9
Signer

Actual PE Digest

fe:9f:38:a1:8a:40:46:90:97:3b:a2:18:b4:3e:d4:a7:59:75:20:ac:de:c2:1c:bc:a7:a0:ab:dd:5e:1d:07:f9

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=DESKTOP-S5GBO2G\\Rommel León Cuisano

20-01-2023 15:48
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetNativeSystemInfo
EndUpdateResourceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetEvent
CreateEventW
LoadResource
LockResource
SizeofResource
FindResourceW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
DeleteFileW
GetFileAttributesW
GetTempFileNameW
ReadFile
GetCurrentProcessId
GetCurrentProcess
GetSystemInfo
GetSystemDirectoryW
GetWindowsDirectoryW
GetVersionExW
GetModuleFileNameW
GlobalAlloc
GlobalFree
LocalFree
FormatMessageW
CopyFileW
GetDateFormatW
GetTimeFormatW
CompareStringW
WideCharToMultiByte
RaiseException
InitializeCriticalSectionAndSpinCount
Sleep
HeapSetInformation
SetFilePointer
GetDiskFreeSpaceExW
CreateFileW
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrlenW
OpenProcess
MulDiv
GetTickCount
GetExitCodeProcess
LoadLibraryW
GetTempPathW
SwitchToThread
FindNextFileW
UpdateResourceA
BeginUpdateResourceA
FindResourceA
lstrlenA
DeleteFileA
CreateFileA
UpdateResourceW
BeginUpdateResourceW
GetVersion
GetEnvironmentVariableA
HeapReAlloc
HeapSize
WriteConsoleW
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
OutputDebugStringW
SetEndOfFile
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapFree
HeapAlloc
FindFirstFileW
FindClose
GetProcAddress
FreeLibrary
WaitForSingleObject
GetLastError
CloseHandle
WriteFile
GetFileType
GetStringTypeW
GetACP
GetModuleHandleExW
ExitProcess
MultiByteToWideChar
VirtualProtect
VirtualQuery
GetModuleHandleW
LoadLibraryExA
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle

gdi32

GetStockObject
EnumFontFamiliesExW
DeleteObject
CreateFontIndirectW
GetObjectW
GetTextMetricsW
SelectObject
GetTextExtentPoint32W
GetDeviceCaps
DeleteDC
CreateCompatibleDC

ole32

CoUninitialize
CoInitialize

secur32

GetComputerObjectNameW

shell32

ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteA

user32

SystemParametersInfoW
IsDialogMessageW
LoadImageW
LoadIconW
LoadCursorW
SetClassLongW
ScreenToClient
GetWindowRect
GetClientRect
SetWindowTextW
ShowScrollBar
SetForegroundWindow
EnableWindow
MsgWaitForMultipleObjects
SetFocus
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItem
CreateDialogIndirectParamW
CreateDialogParamW
MoveWindow
ShowWindow
DestroyWindow
SendMessageW
SendMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
ExitWindowsEx
MessageBoxW
ReleaseDC
GetDC
DrawTextW
GetSystemMetrics
GetDialogBaseUnits
MessageBoxA
SetCursor
GetFocus

crypt32

CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW
InternetCombineUrlW

msi

ord150
ord92
ord8
ord78

Exports

Exports

_DecodePointerInternal@4
_EncodePointerInternal@4

Sections

.text
Size: 374KB - Virtual size: 374KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

06:7e:0e:bd:ca:b8:99:ab:9d:1d:07:13:b4:33:9b:dcCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

06:7e:0e:bd:ca:b8:99:ab:9d:1d:07:13:b4:33:9b:dcCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

dd:6d:57:fc:e6:30:1a:58:b5:63:2f:f7:14:3c:a4:12:5e:7e:ce:8a:d0:4d:a6:42:d4:58:a7:26:8a:0a:2e:43Signer

Signature Validations

Verification

20-01-2023 15:48 Valid: false

14:04:31:bf:1c:12:62:48:96:a5:ae:58:3b:75:ff:e3:86:dc:cf:1dSigner

Signature Validations

Verification

06-06-2017 22:59 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 5.4MB - Virtual size: 5.4MB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 25KB - Virtual size: 24KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

6f:49:59:b8:ef:b5:f9:9c:48:a7:fe:1a:a5:53:50:7bCertificate

f9:95:f2:19:4e:bf:ff:1b:ac:a4:77:df:c6:54:ea:ef:12:8b:be:82:ec:5a:7e:58:ef:79:1b:33:3f:7e:3c:66Signer

Signature Validations

Verification

20-01-2023 15:48 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

.text
Size: 1.1MB - Virtual size: 1.1MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

06:7e:0e:bd:ca:b8:99:ab:9d:1d:07:13:b4:33:9b:dc
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

06:7e:0e:bd:ca:b8:99:ab:9d:1d:07:13:b4:33:9b:dc
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

dd:6d:57:fc:e6:30:1a:58:b5:63:2f:f7:14:3c:a4:12:5e:7e:ce:8a:d0:4d:a6:42:d4:58:a7:26:8a:0a:2e:43
Signer

20-01-2023 15:48
Valid: false

14:04:31:bf:1c:12:62:48:96:a5:ae:58:3b:75:ff:e3:86:dc:cf:1d
Signer

06-06-2017 22:59
Valid: true

.text
Size: 5.4MB - Virtual size: 5.4MB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

6f:49:59:b8:ef:b5:f9:9c:48:a7:fe:1a:a5:53:50:7b
Certificate

f9:95:f2:19:4e:bf:ff:1b:ac:a4:77:df:c6:54:ea:ef:12:8b:be:82:ec:5a:7e:58:ef:79:1b:33:3f:7e:3c:66
Signer

20-01-2023 15:48
Valid: false

.text
Size: 79KB - Virtual size: 79KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:00:9a:9a:9b:16:c2:83:da:d5:c2:00:00:00:00:00:9a
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

d8:1c:7d:b7:1b:4f:ad:ea:f5:d0:c6:98:68:93:21:fa:e8:fd:a3:09:08:47:b2:35:9b:f3:b7:cb:a6:67:06:6c
Signer

20-01-2023 15:48
Valid: false

bc:79:6f:19:6b:6d:a2:b8:57:0e:c3:e7:86:8c:d2:06:9d:b5:0b:9a
Signer

12-06-2016 06:09
Valid: false

.text
Size: 31KB - Virtual size: 31KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 12B

6f:49:59:b8:ef:b5:f9:9c:48:a7:fe:1a:a5:53:50:7b
Certificate

fe:9f:38:a1:8a:40:46:90:97:3b:a2:18:b4:3e:d4:a7:59:75:20:ac:de:c2:1c:bc:a7:a0:ab:dd:5e:1d:07:f9
Signer

20-01-2023 15:48
Valid: false

.text
Size: 374KB - Virtual size: 374KB

.data
Size: 5KB - Virtual size: 9KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 153KB - Virtual size: 152KB

.reloc
Size: 15KB - Virtual size: 14KB