General

Malware Config

Signatures

Files

• e664364dc7cc75f56ddeca9e946b10ccc54d068a7767e5822134913006f39b1c

  .exe windows x86

  dcbe94b8cc54b8e53867c61cc96811d6

  
  

  Code Sign

  33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34

  Certificate

  Issuer

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  27-03-2013 20:08

  Not After

  27-06-2014 20:08

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  22-04-2014 17:39

  Not After

  22-07-2015 17:39

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31-08-2010 22:19

  Not After

  31-08-2020 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:16:68:34:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  03-04-2007 12:53

  Not After

  03-04-2021 13:03

  Subject

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  24-09-2013 17:41

  Not After

  24-12-2014 17:41

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7a:e2:67:e2:18:14:36:3a:99:64:6c:b9:f2:17:41:98:1c:b8:1d:3a:30:f9:84:ac:91:2f:02:76:6b:4f:cb:45

  Signer

  Actual PE Digest

  7a:e2:67:e2:18:14:36:3a:99:64:6c:b9:f2:17:41:98:1c:b8:1d:3a:30:f9:84:ac:91:2f:02:76:6b:4f:cb:45

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  02-02-2023 17:54

  Valid: false

  67:9c:1f:45:16:78:cf:ad:eb:fb:8d:f0:da:bf:75:33:2e:52:46:03

  Signer

  Actual PE Digest

  67:9c:1f:45:16:78:cf:ad:eb:fb:8d:f0:da:bf:75:33:2e:52:46:03

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  01-05-2014 14:54

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  OpenProcessToken

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegCloseKey

  RegDeleteValueW

  RegQueryValueExW

  GetUserNameW

  InitiateSystemShutdownExW

  CreateWellKnownSid

  InitializeAcl

  SetEntriesInAclW

  DecryptFileW

  ChangeServiceConfigW

  ControlService

  CloseServiceHandle

  QueryServiceStatus

  OpenServiceW

  OpenSCManagerW

  CryptAcquireContextW

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  CryptDestroyHash

  CryptReleaseContext

  RegDeleteKeyW

  RegCreateKeyExW

  RegEnumKeyExW

  RegEnumValueW

  RegQueryInfoKeyW

  RegSetValueExW

  SetEntriesInAclA

  SetSecurityDescriptorGroup

  RegOpenKeyExW

  GetTokenInformation

  CheckTokenMembership

  AllocateAndInitializeSid

  FreeSid

  LookupAccountNameW

  SetNamedSecurityInfoW

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  SetSecurityDescriptorOwner

  QueryServiceConfigW

  user32

  GetMessageW

  PeekMessageW

  PostMessageW

  PostThreadMessageW

  PostQuitMessage

  SetWindowLongW

  DefWindowProcW

  UnregisterClassW

  DispatchMessageW

  TranslateMessage

  GetMonitorInfoW

  IsDialogMessageW

  MessageBoxW

  GetWindowLongW

  RegisterClassW

  IsWindow

  MsgWaitForMultipleObjects

  WaitForInputIdle

  LoadCursorW

  LoadBitmapW

  GetCursorPos

  MonitorFromPoint

  CreateWindowExW

  oleaut32

  SysFreeString

  SysAllocString

  VariantInit

  VariantClear

  gdi32

  DeleteObject

  GetObjectW

  CreateCompatibleDC

  SelectObject

  DeleteDC

  StretchBlt

  shell32

  ShellExecuteExW

  SHGetFolderPathW

  CommandLineToArgvW

  ole32

  CoTaskMemFree

  CoInitializeSecurity

  CLSIDFromProgID

  CoCreateInstance

  CoInitialize

  StringFromGUID2

  CoInitializeEx

  CoUninitialize

  kernel32

  ReadFile

  SetFilePointerEx

  CreateFileW

  GetCurrentProcessId

  GetProcessId

  WriteFile

  ConnectNamedPipe

  SetNamedPipeHandleState

  lstrlenW

  CompareStringW

  LocalFree

  CreateNamedPipeW

  WaitForSingleObject

  OpenProcess

  lstrlenA

  RemoveDirectoryW

  GetFileAttributesW

  ExpandEnvironmentStringsW

  LeaveCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetProcAddress

  VerifyVersionInfoW

  VerSetConditionMask

  GetComputerNameW

  GetTempPathW

  GetSystemDirectoryW

  GetSystemWow64DirectoryW

  GetVolumePathNameW

  GetWindowsDirectoryW

  GetSystemDefaultLangID

  RtlUnwind

  GetDateFormatW

  GetSystemTime

  InterlockedExchange

  LoadLibraryW

  InterlockedCompareExchange

  GetExitCodeThread

  CreateThread

  SetEvent

  WaitForMultipleObjects

  CreateEventW

  ProcessIdToSessionId

  InterlockedIncrement

  InterlockedDecrement

  GetStringTypeW

  GetModuleHandleW

  FindClose

  FindNextFileW

  FindFirstFileW

  CreateProcessW

  SetCurrentDirectoryW

  GetCurrentDirectoryW

  GetExitCodeProcess

  DuplicateHandle

  SetThreadExecutionState

  CopyFileExW

  UnmapViewOfFile

  MapViewOfFile

  CreateFileMappingW

  CreateMutexW

  SetEndOfFile

  ResetEvent

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  CreateFileA

  CompareStringA

  GetSystemTimeAsFileTime

  VirtualFree

  VirtualAlloc

  DeleteFileW

  GetThreadLocale

  GetVersionExW

  GetCurrentThreadId

  TlsAlloc

  TlsSetValue

  ReleaseMutex

  GetLastError

  Sleep

  TlsGetValue

  CloseHandle

  DeleteCriticalSection

  GetTimeZoneInformation

  GetACP

  GetCPInfo

  RaiseException

  HeapAlloc

  HeapFree

  IsDebuggerPresent

  UnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  SystemTimeToTzSpecificLocalTime

  SystemTimeToFileTime

  GlobalAlloc

  GlobalFree

  SetFilePointer

  WideCharToMultiByte

  GetConsoleCP

  GetConsoleMode

  TlsFree

  InitializeCriticalSection

  GetCurrentProcess

  HeapSetInformation

  GetOEMCP

  SetFileAttributesW

  IsValidCodePage

  HeapSize

  HeapReAlloc

  LCMapStringW

  MultiByteToWideChar

  SetStdHandle

  WriteConsoleW

  FlushFileBuffers

  GetLocalTime

  FormatMessageW

  GetTempFileNameW

  GetFullPathNameW

  CreateDirectoryW

  GetProcessHeap

  GetModuleHandleA

  GetFileSizeEx

  GetUserDefaultLangID

  GetTickCount

  QueryPerformanceCounter

  HeapCreate

  SetLastError

  EncodePointer

  GetFileType

  InitializeCriticalSectionAndSpinCount

  SetHandleCount

  GetEnvironmentStringsW

  MoveFileExW

  FreeEnvironmentStringsW

  GetModuleFileNameW

  GetStdHandle

  DecodePointer

  GetCommandLineW

  GetStartupInfoW

  SetUnhandledExceptionFilter

  ExitProcess

  CopyFileW

  cabinet

  ord23

  ord22

  ord20

  crypt32

  CryptHashPublicKeyInfo

  CertGetCertificateContextProperty

  msi

  ord116

  ord17

  ord125

  ord171

  ord8

  ord115

  ord118

  ord205

  ord45

  ord137

  ord141

  ord238

  ord190

  ord88

  ord90

  ord173

  ord111

  ord70

  ord169

  rpcrt4

  UuidCreate

  wininet

  InternetCrackUrlW

  HttpQueryInfoW

  InternetCloseHandle

  HttpAddRequestHeadersW

  HttpOpenRequestW

  InternetErrorDlg

  InternetReadFile

  HttpSendRequestW

  InternetSetOptionW

  InternetConnectW

  InternetOpenW

  wintrust

  CryptCATAdminCalcHashFromFileHandle

  WTHelperProvDataFromStateData

  WTHelperGetProvSignerFromChain

  WinVerifyTrust

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  Sections

  .text

  Size: 227KB - Virtual size: 226KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 103KB - Virtual size: 102KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .wixburn

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 17KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .zero

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ