qt-unified-windows-x64-4[.]5[.]1-online[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

qt-unified-windows-x64-4.5.1-online.exe
Size

41.0MB
MD5

158075f546ad960242b614bdebfb5ddb
SHA1

bcd5cf3d8438708b0f20701687fdf84ba96f6c68
SHA256

68676e121f6e3c31b8218d7801696d8446a93ae480901c8c8a6a4a718b4c8f7d
SHA512

cd9f191734ed58a0b0a1e83c8e56a427e6f40e8e02b817344ae64067fcc4939017924199fc640ae505a95c482613c2c12979d0f9ae74c5c9aa28e1091ba69f5a
SSDEEP

393216:Dy8KM3n97x8bPm+uoD1hbmSK6vgIQP1Zaoes50r2zMwR8dWgZZ+E67ZOxpeklZJ7:+5pJ+gPlZ67ZbETP

Score

1^/10

Malware Config

Signatures

Files

qt-unified-windows-x64-4.5.1-online.exe
.exe windows x64

97070e8bdd418e50949b3120f4f1530e

Code Sign

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/07/2009, 17:25

Not After

07/12/2030, 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 15:43

Not After

07/11/2030, 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 19:19

Not After

29/12/2040, 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:a4:66:cd:fc:68:ed:79:2a:d9:33:e5:6e:a2:d9:d9
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

18/11/2022, 07:19

Not After

01/12/2025, 07:19

Subject

SERIALNUMBER=2637805-2,CN=The Qt Company Oy,O=The Qt Company Oy,L=Espoo,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24/12/1999, 17:50

Not After

24/07/2029, 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22/07/2015, 19:02

Not After

22/06/2029, 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

04/10/2022, 17:21

Not After

01/01/2029, 00:00

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

75:2b:59:cc:58:2a:f3:04:86:11:40:aa:d8:4a:0c:0b:06:8f:39:98:e5:03:05:f5:31:fe:aa:e2:9f:a1:0a:11
Signer

Actual PE Digest

75:2b:59:cc:58:2a:f3:04:86:11:40:aa:d8:4a:0c:0b:06:8f:39:98:e5:03:05:f5:31:fe:aa:e2:9f:a1:0a:11

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2637805-2,CN=The Qt Company Oy,O=The Qt Company Oy,L=Espoo,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

07/12/2022, 09:40
Valid: true

Chain 1

SERIALNUMBER=2637805-2,CN=The Qt Company Oy,O=The Qt Company Oy,L=Espoo,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

uxtheme

GetThemePartSize
GetThemeColor
GetThemeInt
GetThemeEnumValue
GetThemeMargins
OpenThemeData
GetThemeTransitionDuration
CloseThemeData
ord47
GetThemeBackgroundRegion
IsThemeBackgroundPartiallyTransparent
GetThemeBool
GetThemePropertyOrigin
DrawThemeTextEx
SetWindowThemeAttribute
GetThemeSysFont
SetWindowTheme
IsThemeActive
IsAppThemed
GetCurrentThemeName
DrawThemeBackground

dwmapi

DwmExtendFrameIntoClientArea
DwmDefWindowProc
DwmSetWindowAttribute
DwmIsCompositionEnabled
DwmGetWindowAttribute
DwmEnableBlurBehindWindow

gdi32

GetBitmapBits
GetObjectW
CreateFontIndirectW
EnumFontFamiliesExW
GetFontData
GetStockObject
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
GetTextMetricsW
GetTextFaceW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetCharABCWidthsI
SetGraphicsMode
SetTextAlign
GetPixelFormat
ExtTextOutW
DescribePixelFormat
SetPixelFormat
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetDeviceCaps
GetDIBits
SelectObject
CreateFontIndirectA
CreateSolidBrush
GetTextExtentPoint32W
Rectangle
SetBkMode
SetTextColor
TextOutW
GetRegionData
CombineRgn
CreateRectRgn
SwapBuffers
ChoosePixelFormat
CreateBitmap
CreateDCW
SetLayout
OffsetRgn
GdiFlush
CreateDIBSection
SelectClipRgn
SetWorldTransform

oleaut32

SysFreeString
SysAllocString
SafeArrayCreateVector
SafeArrayPutElement

imm32

ImmGetVirtualKey
ImmGetDefaultIMEWnd
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetOpenStatus
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow

iphlpapi

ConvertInterfaceLuidToNameW
ConvertInterfaceNameToLuidW
GetAdaptersAddresses
ConvertInterfaceLuidToGuid
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToIndex

crypt32

CertEnumCertificatesInStore
CertOpenSystemStoreW
CertFindCertificateInStore
CertCloseStore
CertCreateCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertGetCertificateChain
CertFreeCertificateChain
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertOpenStore

user32

RegisterDeviceNotificationW
CharNextExA
MsgWaitForMultipleObjectsEx
GetQueueStatus
DispatchMessageW
TranslateMessage
PostThreadMessageW
MapVirtualKeyA
GetSystemMetrics
GetDC
SendInput
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
DrawIconEx
ChangeWindowMessageFilterEx
RealGetWindowClassW
CloseTouchInputHandle
GetTouchInputInfo
GetAsyncKeyState
GetMessageExtraInfo
TrackMouseEvent
GetClipboardFormatNameW
GetCursorInfo
GetIconInfo
CreateIconIndirect
CreateCursor
LoadCursorW
GetCursor
EnumDisplayDevicesW
TrackPopupMenuEx
MapVirtualKeyW
ToUnicode
ToAscii
IsZoomed
PeekMessageW
FindWindowA
SetCaretPos
ShowCaret
HideCaret
DestroyCaret
CreateCaret
IsWindowEnabled
RegisterWindowMessageW
GetKeyboardLayout
RegisterClipboardFormatW
ChangeClipboardChain
SetClipboardViewer
IsHungAppWindow
LoadIconW
GetMonitorInfoW
MonitorFromWindow
SetMenuItemInfoW
GetMenuItemInfoW
TrackPopupMenu
RemoveMenu
ModifyMenuW
AppendMenuW
InsertMenuW
DestroyMenu
CreatePopupMenu
CreateMenu
DrawMenuBar
SetMenu
LoadImageW
GetSysColorBrush
VkKeyScanW
WindowFromPoint
RegisterClassExW
GetClassInfoW
UnregisterClassW
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
GetKeyboardLayoutList
GetAncestor
MonitorFromPoint
DestroyIcon
DestroyCursor
SetParent
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
ScreenToClient
ClientToScreen
SetCursor
AdjustWindowRectEx
GetWindowRect
SetWindowRgn
GetUpdateRect
SetForegroundWindow
GetForegroundWindow
EnableMenuItem
GetSystemMenu
GetMenu
ReleaseCapture
SetCapture
GetCapture
IsTouchWindow
UnregisterTouchWindow
RegisterTouchWindow
SetFocus
IsIconic
SetWindowPlacement
GetWindowPlacement
MoveWindow
FlashWindowEx
SetLayeredWindowAttributes
UpdateLayeredWindow
IsChild
AttachThreadInput
SendMessageW
UpdateLayeredWindowIndirect
MessageBeep
IsWindow
GetDoubleClickTime
GetDesktopWindow
GetSysColor
SystemParametersInfoW
FindWindowExA
SystemParametersInfoA
SetWindowLongPtrA
GetClientRect
GetWindowTextW
SetWindowTextW
InvalidateRect
EndPaint
BeginPaint
IsWindowVisible
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
EnumDisplayMonitors
GetTopWindow
GetCursorPos
SetCursorPos
GetWindowTextA
ReleaseDC
VkKeyScanA
GetKeyState
EmptyClipboard
GetClipboardData
SetClipboardData
UnregisterDeviceNotification
CloseClipboard
OpenClipboard
GetGUIThreadInfo
SetCaretBlinkTime
GetCaretBlinkTime
GetWindowLongPtrA
GetClassNameA
EnumChildWindows
KillTimer
SetTimer
CreateWindowExA
GetWindow
keybd_event
SetKeyboardState
GetKeyboardState
GetFocus
SendMessageA
RegisterWindowMessageA
SendMessageTimeoutW
GetWindowThreadProcessId
EnumWindows
PostMessageW
ChildWindowFromPointEx

ws2_32

WSASend
WSACleanup
WSASetLastError
getaddrinfo
WSASendTo
ntohl
gethostbyname
accept
bind
closesocket
connect
ioctlsocket
getpeername
getsockname
getsockopt
htonl
gethostname
WSAAsyncSelect
htons
listen
ntohs
recv
select
send
setsockopt
socket
WSAStartup
WSAGetLastError
WSARecvFrom
freeaddrinfo
getnameinfo
__WSAFDIsSet
WSAAccept
WSAConnect
WSAHtonl
WSAIoctl
WSANtohl
WSANtohs
WSARecv
WSASocketW

advapi32

CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
GetLengthSid
AddAccessAllowedAce
RegNotifyChangeKeyValue
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
LookupPrivilegeValueW
PrivilegeCheck
AdjustTokenPrivileges
OpenProcessToken
RegFlushKey
SystemFunction036
GetSidSubAuthority
GetSidSubAuthorityCount
AccessCheck
CopySid
DuplicateToken
MapGenericMask
LookupAccountSidW
GetEffectiveRightsFromAclW
GetNamedSecurityInfoW
BuildTrusteeWithSidW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW

mpr

WNetGetUniversalNameA

userenv

GetUserProfileDirectoryW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

netapi32

NetShareEnum
NetApiBufferFree

kernel32

EncodePointer
DecodePointer
RtlPcToFileHeader
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetStringTypeW
Process32FirstW
CreateMutexW
ReleaseMutex
FindNextChangeNotification
FindFirstChangeNotificationW
FindCloseChangeNotification
LCMapStringW
CompareStringW
GetUserGeoID
GetGeoInfoW
FindFirstFileExW
SetFilePointerEx
GetFileInformationByHandleEx
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
MoveFileExW
MoveFileW
CopyFileW
RemoveDirectoryW
GetLogicalDrives
DeleteFileW
SetCurrentDirectoryW
WriteFileEx
SleepEx
CancelIoEx
InitializeSListHead
RegisterWaitForSingleObject
UnregisterWaitEx
GetUserPreferredUILanguages
GetUserDefaultLCID
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
GetSystemDirectoryW
GetModuleFileNameW
GetTickCount64
QueryPerformanceFrequency
GetProcessId
WaitForSingleObjectEx
ResumeThread
TerminateThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
SwitchToThread
DuplicateHandle
GetLocalTime
GetStartupInfoW
CompareStringEx
IsProcessorFeaturePresent
GetNativeSystemInfo
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateFiber
DeleteFiber
SwitchToFiber
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetModuleHandleExW
SystemTimeToFileTime
GetSystemTime
SetLastError
SetEvent
CreateNamedPipeW
ConnectNamedPipe
WaitNamedPipeW
DisconnectNamedPipe
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
ExitProcess
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
RtlDeleteFunctionTable
RtlAddFunctionTable
GetSystemInfo
VirtualProtect
GetTimeZoneInformation
GetConsoleWindow
LocalAlloc
GetVolumeInformationW
GetUserDefaultLangID
GlobalSize
GetLocaleInfoW
CheckRemoteDebuggerPresent
ExpandEnvironmentStringsW
WTSGetActiveConsoleSessionId
GetModuleHandleW
lstrcmpW
GetTickCount
GetCurrentThreadId
SetUnhandledExceptionFilter
RaiseException
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
CreateThread
WaitForMultipleObjects
CreatePipe
OutputDebugStringW
CompareFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
GetProcessTimes
FormatMessageA
SetHandleInformation
LoadLibraryExW
FreeLibrary
LoadLibraryA
GetModuleHandleA
OutputDebugStringA
GetStdHandle
Sleep
SetEnvironmentVariableW
GetExitCodeProcess
PeekNamedPipe
GetFullPathNameW
GetProcessHeap
HeapFree
HeapAlloc
GetOEMCP
GetACP
IsValidCodePage
WideCharToMultiByte
MultiByteToWideChar
GetTempPathW
VirtualFree
VirtualAlloc
CreateEventW
ResetEvent
CancelIo
GetOverlappedResult
ReadFile
GetVolumePathNameW
GetDiskFreeSpaceW
FindNextFileW
LoadLibraryW
GetProcAddress
SetFileTime
SetFilePointer
SetFileAttributesW
SetEndOfFile
GetFileType
GetFileInformationByHandle
GetFileAttributesW
FindFirstFileW
FindClose
CreateDirectoryW
GetCurrentDirectoryW
DeviceIoControl
WriteFile
UnlockFile
LockFile
FlushFileBuffers
CreateFileW
GetThreadTimes
FreeLibraryAndExitThread
RtlUnwindEx
RtlUnwind
SetStdHandle
SetConsoleCtrlHandler
SystemTimeToTzSpecificLocalTime
GetCommandLineA
ExitThread
GetConsoleOutputCP
IsValidLocale
EnumSystemLocalesW
HeapReAlloc
GetFileSizeEx
HeapSize
WriteConsoleW
ReadFileEx
CreateToolhelp32Snapshot
TerminateProcess
WaitForSingleObject
SetErrorMode
GetVolumePathNamesForVolumeNameW
GetDriveTypeW
GetDriveTypeA
GetDiskFreeSpaceExA
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
FreeConsole
GetConsoleProcessList
GetCommandLineW
CloseHandle
GetLastError
GetCurrentProcess
CreateProcessW
LocalFree
FormatMessageW
GetFileAttributesExW
GetLongPathNameW
GetShortPathNameW
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
GetEnvironmentVariableW
OpenProcess
GetLogicalDriveStringsA
Process32NextW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitialize
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleInitialize
OleUninitialize
OleSetClipboard
OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
ReleaseStgMedium
CoGetMalloc
CoCreateGuid
CoTaskMemFree
StringFromGUID2

shell32

ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
SHCreateItemFromIDList
SHChangeNotify
SHGetMalloc
SHGetPathFromIDListW
SHGetKnownFolderIDList
SHBrowseForFolderW
Shell_NotifyIconW
Shell_NotifyIconGetRect
ord155
SHParseDisplayName
SHGetKnownFolderPath
SHFileOperationW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetFileInfoW
SHGetStockIconInfo
SHGetFolderLocation
ord727
SHCreateItemFromParsingName

winmm

timeKillEvent
PlaySoundW
timeSetEvent

bcrypt

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptGenRandom
BCryptFinishHash
BCryptHashData
BCryptEncrypt
BCryptDestroyKey
BCryptCreateHash
BCryptDeriveKeyPBKDF2

Exports

Exports

registercoco
squishqtwrapper_init

Sections

.text
Size: 26.2MB - Virtual size: 26.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12.2MB - Virtual size: 12.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 632KB - Virtual size: 801KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmimed
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97070e8bdd418e50949b3120f4f1530e

Code Sign

4a:53:8c:28Certificate

Key Usages

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7fCertificate

Extended Key Usages

Key Usages

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2bCertificate

Extended Key Usages

Key Usages

61:a4:66:cd:fc:68:ed:79:2a:d9:33:e5:6e:a2:d9:d9Certificate

Extended Key Usages

Key Usages

38:63:de:f8Certificate

Key Usages

58:da:13:ff:00:00:00:00:51:ce:0d:f7Certificate

Extended Key Usages

Key Usages

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1fCertificate

Extended Key Usages

Key Usages

75:2b:59:cc:58:2a:f3:04:86:11:40:aa:d8:4a:0c:0b:06:8f:39:98:e5:03:05:f5:31:fe:aa:e2:9f:a1:0a:11Signer

Signature Validations

Verification

07/12/2022, 09:40 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

wtsapi32

uxtheme

dwmapi

gdi32

oleaut32

imm32

iphlpapi

crypt32

user32

ws2_32

advapi32

mpr

userenv

version

netapi32

kernel32

ole32

shell32

winmm

bcrypt

Exports

Exports

Sections

.text Size: 26.2MB - Virtual size: 26.2MB

.rdata Size: 12.2MB - Virtual size: 12.2MB

.data Size: 632KB - Virtual size: 801KB

.pdata Size: 1.3MB - Virtual size: 1.3MB

.qtmetad Size: 1024B - Virtual size: 672B

.qtmimed Size: 315KB - Virtual size: 315KB

_RDATA Size: 512B - Virtual size: 148B

.rsrc Size: 93KB - Virtual size: 92KB

.reloc Size: 221KB - Virtual size: 220KB

4a:53:8c:28
Certificate

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

61:a4:66:cd:fc:68:ed:79:2a:d9:33:e5:6e:a2:d9:d9
Certificate

38:63:de:f8
Certificate

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Certificate

75:2b:59:cc:58:2a:f3:04:86:11:40:aa:d8:4a:0c:0b:06:8f:39:98:e5:03:05:f5:31:fe:aa:e2:9f:a1:0a:11
Signer

07/12/2022, 09:40
Valid: true

.text
Size: 26.2MB - Virtual size: 26.2MB

.rdata
Size: 12.2MB - Virtual size: 12.2MB

.data
Size: 632KB - Virtual size: 801KB

.pdata
Size: 1.3MB - Virtual size: 1.3MB

.qtmetad
Size: 1024B - Virtual size: 672B

.qtmimed
Size: 315KB - Virtual size: 315KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 93KB - Virtual size: 92KB

.reloc
Size: 221KB - Virtual size: 220KB