FortiClientVPNOnlineInstaller[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

FortiClientVPNOnlineInstaller.bin
Size

5.7MB
MD5

0e46f2eb75a6a2c283100ca0f23541e7
SHA1

020a61041798d1a713626737c83750a2442c989f
SHA256

f631ef4ce81b9a0984d44a9468db2ae30cb37bdad67aaeb43f53d50039d8c5aa
SHA512

0ef241df8b18461689a619013bdd5bf280dd0d91ac61c6c9bdf145ef9db72f1cf0682628067bdf277a75b9ff0465d031adb0a5b9fba83caad856912ea5b577ef
SSDEEP

98304:RpYu1FgaNGYgBf03/aGXbEPI/RFYBzkvvjjz9GMd4RFTsMnIS/PKo7uJIxNulRP0:TgaNGYaISGL8k/79yPKo7pxNul0KW

Score

1^/10

Malware Config

Signatures

Files

FortiClientVPNOnlineInstaller.bin
.exe windows x86

01611790d4db10d23c5fb1fe83554ee2

Code Sign

06:67:51:81:e7:b5:e1:03:0b:3d:40:92:6e:2a:47:d3
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/11/2020, 00:00

Not After

22/10/2023, 23:59

Subject

SERIALNUMBER=2770852,CN=ORANGE VIEW LIMITED,O=ORANGE VIEW LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:ed:33:20:27:90:7f:50:be:1b:7f:f4:2b:e5:9a:a5
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/11/2020, 00:00

Not After

22/10/2023, 23:59

Subject

SERIALNUMBER=2770852,CN=ORANGE VIEW LIMITED,O=ORANGE VIEW LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:0a:f8:a7:55:3e:f2:f7:c8:37:d7:3a:73:e0:41:e5:82:20:42:c9:24:c3:5b:e1:4c:c0:5b:03:58:c9:05:b7
Signer

Actual PE Digest

1a:0a:f8:a7:55:3e:f2:f7:c8:37:d7:3a:73:e0:41:e5:82:20:42:c9:24:c3:5b:e1:4c:c0:5b:03:58:c9:05:b7

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2770852,CN=ORANGE VIEW LIMITED,O=ORANGE VIEW LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

26/10/2022, 01:27
Valid: true

Chain 1

SERIALNUMBER=2770852,CN=ORANGE VIEW LIMITED,O=ORANGE VIEW LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

74:5f:9a:14:85:51:37:3e:9d:93:ba:85:62:52:28:2c:d6:15:df:f6
Signer

Actual PE Digest

74:5f:9a:14:85:51:37:3e:9d:93:ba:85:62:52:28:2c:d6:15:df:f6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=2770852,CN=ORANGE VIEW LIMITED,O=ORANGE VIEW LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

26/10/2022, 01:25
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winhttp

WinHttpSetCredentials
WinHttpQueryAuthSchemes
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpQueryHeaders
WinHttpSetStatusCallback
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpGetProxyForUrl
WinHttpQueryDataAvailable
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpGetIEProxyConfigForCurrentUser

wininet

InternetSetOptionW

kernel32

GlobalFree
GlobalAlloc
GetProcessId
GetShortPathNameW
GetFileAttributesA
GetUserDefaultLCID
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryA
GetSystemInfo
GetModuleFileNameA
HeapSize
HeapReAlloc
GetUserDefaultUILanguage
CreateProcessA
MulDiv
IsBadWritePtr
DecodePointer
LocalAlloc
CreateSemaphoreW
OpenSemaphoreW
ReleaseSemaphore
CreateThread
CreateNamedPipeW
ConnectNamedPipe
GetUserDefaultLangID
FileTimeToSystemTime
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetNativeSystemInfo
GetVersionExW
GetComputerNameExW
GetWindowsDirectoryW
GetSystemDirectoryW
CreateProcessW
GetCurrentProcess
DeviceIoControl
CreatePipe
SetLastError
RaiseException
SetHandleInformation
OutputDebugStringA
ExitProcess
GetLocaleInfoEx
GetStringTypeW
ExpandEnvironmentStringsW
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
GetTimeFormatW
GetDateFormatW
GetLocalTime
SetFileAttributesW
GetFileAttributesW
FindClose
DeleteFileW
ReadDirectoryChangesW
CreateWaitableTimerW
WaitForMultipleObjects
CancelWaitableTimer
SetWaitableTimer
CreateEventW
ResetEvent
SetEvent
GetOverlappedResult
FindNextFileW
FindFirstFileW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetCurrentThreadId
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetProcessHeap
HeapFree
HeapAlloc
FormatMessageW
LocalFree
TerminateProcess
lstrcpyA
WideCharToMultiByte
GetTempPathW
GetFileSizeEx
MultiByteToWideChar
GetCurrentDirectoryW
SetCurrentDirectoryW
lstrlenW
GetTickCount
Sleep
OpenMutexW
InitializeCriticalSectionEx
SetNamedPipeHandleState
GetLastError
CloseHandle
WriteFile
ReadFile
GetVolumeInformationW
CreateFileW
LCMapStringEx
CompareStringEx
GetCPInfo
OutputDebugStringW
RtlUnwind
ExitThread
FreeLibraryAndExitThread
MoveFileExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
GetTimeZoneInformation
HeapQueryInformation
GetCommandLineA
GetCommandLineW
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
InitOnceComplete
InitOnceBeginInitialize
VirtualAlloc
VirtualQuery
SetStdHandle
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetStdHandle
GlobalSize
GlobalUnlock
GlobalLock
CopyFileW
FlushFileBuffers
GetFileSize
GetFullPathNameW
LockFile
SetEndOfFile
SetFilePointer
UnlockFile
DuplicateHandle
LoadLibraryExW
lstrcmpiW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
CompareStringW
lstrcmpA
GlobalGetAtomNameW
FileTimeToLocalFileTime
GetFileAttributesExW
GetFileTime
SystemTimeToTzSpecificLocalTime
SetThreadPriority
ResumeThread
GlobalAddAtomW
GlobalFlags
lstrcmpW
EncodePointer
GlobalDeleteAtom
GlobalFindAtomW
GetLocaleInfoW
VirtualProtect
lstrcpyW
FindResourceExW
VerSetConditionMask
VerifyVersionInfoW
GetProfileIntW
SearchPathW
GetTempFileNameW
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
FormatMessageA
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
QueryPerformanceFrequency
GetExitCodeThread

user32

CallNextHookEx
DestroyIcon
GetDlgCtrlID
GetFocus
SetWindowTextW
PtInRect
GetWindow
RealChildWindowFromPoint
SetFocus
SetScrollPos
GetScrollPos
GetDlgItem
CheckDlgButton
IsDialogMessageW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
FillRect
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
GetMessagePos
GetMessageTime
CallWindowProcW
RegisterClassW
GetClassInfoW
IsMenu
IsChild
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsIconic
GetCapture
GetMenu
SetMenu
UpdateWindow
SetActiveWindow
RedrawWindow
ScrollWindow
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropW
GetPropW
RemovePropW
MapWindowPoints
CopyRect
EqualRect
GetClassLongW
GetTopWindow
LoadIconW
SetScrollInfo
GetScrollInfo
WinHelpW
MonitorFromWindow
InflateRect
IntersectRect
GetMenuItemInfoW
CopyImage
SendDlgItemMessageA
SetRectEmpty
OffsetRect
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
MapDialogRect
ShowOwnedPopups
SetCursor
DeleteMenu
InvalidateRect
TrackMouseEvent
GetNextDlgGroupItem
SetCapture
ValidateRect
WindowFromPoint
DrawFocusRect
IsRectEmpty
DrawIconEx
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
MapVirtualKeyW
GetKeyNameTextW
PostQuitMessage
PeekMessageW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
SetWindowRgn
SetParent
DrawEdge
DrawFrameControl
IsZoomed
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
FrameRect
DrawIcon
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
RegisterClassExW
GetClassInfoExW
CreateWindowExW
DestroyWindow
SetWindowPos
EnableWindow
GetWindowRect
GetWindowLongW
SetWindowLongW
GetDesktopWindow
GetActiveWindow
MessageBoxW
SendMessageW
SetWindowsHookExW
ReleaseCapture
LoadCursorW
GetAncestor
GetSystemMetrics
MonitorFromRect
IsWindow
GetMonitorInfoW
LoadStringW
WaitForInputIdle
IsWindowVisible
CreateDialogParamW
SetDlgItemTextW
SendDlgItemMessageW
SetTimer
KillTimer
LoadMenuW
DestroyMenu
CheckMenuItem
GetSubMenu
TrackPopupMenu
DrawTextW
GetForegroundWindow
SetForegroundWindow
BeginPaint
EndPaint
GetCursorPos
ClientToScreen
ScreenToClient
GetSysColor
SetClassLongW
GetParent
EnumThreadWindows
GetKeyState
GetWindowTextLengthW
GetWindowTextW
GetSysColorBrush
GetLastActivePopup
GetWindowThreadProcessId
IsWindowEnabled
UnhookWindowsHookEx
CharUpperW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetMenuState
EnumDisplayMonitors
DefWindowProcW
FindWindowW
PostMessageW
GetClientRect
AdjustWindowRectEx
DispatchMessageW
TranslateMessage
GetMessageW
SetRect
GetMenuStringW
ReleaseDC
GetDC
GetAsyncKeyState
ShowWindow
SetLayeredWindowAttributes
GetClassNameW
LoadImageW
RegisterWindowMessageW
MoveWindow
FindWindowExW
SystemParametersInfoW

gdi32

SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
ExtSelectClipRgn
GetObjectW
MoveToEx
TextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
CreateFontIndirectW
CreateRectRgnIndirect
PatBlt
SetRectRgn
DPtoLP
GetTextExtentPoint32W
GetTextMetricsW
SelectClipRgn
CreateEllipticRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
SelectPalette
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
CreateBitmap
BitBlt
DeleteObject
DeleteDC
CreateDCW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
EnumFontFamiliesW
ExtTextOutW
SetTextColor
SetBkColor
SelectObject
GetStockObject
GetDeviceCaps
GetSystemPaletteEntries
CopyMetaFileW
CreateDIBitmap
CreateCompatibleBitmap
GetBkColor
GetTextFaceW
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
RoundRect
OffsetRgn
GetRgnBox
Rectangle
LPtoDP
CreateRoundRectRgn
Polyline
Polygon
CreatePolygonRgn
GetTextColor
Ellipse
GetTextCharsetInfo
SetDIBColorTable
CreateDIBSection
StretchBlt
SetPixel
RealizePalette

winspool.drv

GetJobW
OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegSetValueExA
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
CredWriteW
CredReadW
CredEnumerateW
CredDeleteW
CredFree
GetUserNameW
RegDeleteKeyExW
RegEnumValueW
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
RegFlushKey
RegOpenKeyW
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueW
RegNotifyChangeKeyValue
RegCreateKeyA
RegCreateKeyW
RegDeleteKeyW
RegOpenKeyA
RegQueryValueW
RegDeleteKeyA

shell32

SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW
SHGetKnownFolderPath
ShellExecuteW
ShellExecuteExW
Shell_NotifyIconW
DragFinish
SHBrowseForFolderW
SHAppBarMessage
DragQueryFileW
SHCreateDirectoryExW

ole32

OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleSetContainedObject
OleLockRunning
OleInitialize
OleUninitialize
DoDragDrop
CreateStreamOnHGlobal
CoInitializeEx
CoInitialize
CoUninitialize
CoCreateInstance
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
OleCreate
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid

oleaut32

VariantChangeType
VariantClear
VariantInit
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
SysStringLen
SysFreeString
LoadTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocString
VariantCopy
VarBstrFromDate
SysAllocStringLen

msimg32

TransparentBlt
AlphaBlend

shlwapi

UrlEscapeW
PathAddExtensionW
PathAppendW
PathFindFileNameW
PathIsDirectoryW
PathIsFileSpecW
PathRemoveExtensionW
PathRemoveFileSpecW
PathRenameExtensionW
UrlCanonicalizeW
PathIsUNCW
PathStripToRootW
PathFindExtensionW
StrFormatKBSizeW
PathFileExistsW

uxtheme

GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetThemePartSize

bcrypt

BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptVerifySignature
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptDestroyHash

crypt32

CertFreeCertificateContext
CryptUnprotectData
CryptProtectData
CryptStringToBinaryW
CertAddCertificateContextToStore
CertFindCertificateInStore
CertCloseStore
CertOpenStore
CryptImportPublicKeyInfoEx2
CryptHashCertificate2
CertVerifySubjectCertificateContext
CertCreateCertificateContext

ws2_32

getnameinfo
WSACleanup
WSAStartup

iphlpapi

GetAdaptersAddresses

secur32

GetUserNameExW

gdiplus

GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageRectI
GdipSetInterpolationMode

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 279KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01611790d4db10d23c5fb1fe83554ee2

Code Sign

06:67:51:81:e7:b5:e1:03:0b:3d:40:92:6e:2a:47:d3Certificate

Extended Key Usages

Key Usages

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0d:ed:33:20:27:90:7f:50:be:1b:7f:f4:2b:e5:9a:a5Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

1a:0a:f8:a7:55:3e:f2:f7:c8:37:d7:3a:73:e0:41:e5:82:20:42:c9:24:c3:5b:e1:4c:c0:5b:03:58:c9:05:b7Signer

Signature Validations

Verification

26/10/2022, 01:27 Valid: true

Chain 1

74:5f:9a:14:85:51:37:3e:9d:93:ba:85:62:52:28:2c:d6:15:df:f6Signer

Signature Validations

Verification

26/10/2022, 01:25 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

version

winhttp

wininet

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

msimg32

shlwapi

uxtheme

bcrypt

crypt32

ws2_32

iphlpapi

secur32

gdiplus

oleacc

imm32

winmm

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 70KB - Virtual size: 96KB

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 279KB - Virtual size: 278KB

06:67:51:81:e7:b5:e1:03:0b:3d:40:92:6e:2a:47:d3
Certificate

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0d:ed:33:20:27:90:7f:50:be:1b:7f:f4:2b:e5:9a:a5
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

1a:0a:f8:a7:55:3e:f2:f7:c8:37:d7:3a:73:e0:41:e5:82:20:42:c9:24:c3:5b:e1:4c:c0:5b:03:58:c9:05:b7
Signer

26/10/2022, 01:27
Valid: true

74:5f:9a:14:85:51:37:3e:9d:93:ba:85:62:52:28:2c:d6:15:df:f6
Signer

26/10/2022, 01:25
Valid: false

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 70KB - Virtual size: 96KB

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 279KB - Virtual size: 278KB