84e9b2b5634652d178c68e4c6992632b1868f0694134b73cd96dde7c05c8f262

Sharing

Copy URL Twitter E-mail

General

Target

84e9b2b5634652d178c68e4c6992632b1868f0694134b73cd96dde7c05c8f262
Size

6.6MB
MD5

c63e20841fed7e3fef9c88f91d8ad413
SHA1

7056332f0d88177e0c19a44612ae87bf5642ce94
SHA256

84e9b2b5634652d178c68e4c6992632b1868f0694134b73cd96dde7c05c8f262
SHA512

8cae5f1890ed20b9b7aaa625f3b1b547f270b199dfd351c607278178676299c6f2f83f091dfdb38ae551849525759dd4260b77b2c545fc16aac57d5d86c47b9f
SSDEEP

98304:6zCgxMDk3jEO+F7qxBO7j/11ajr5pJ+9PbES9qCJV03oJT2wIZx3oy+DbhHcxvT:6HMOjEO++CqFpJ+9PbxXV0YJFD9Hcxv

Score

1^/10

Malware Config

Signatures

Files

84e9b2b5634652d178c68e4c6992632b1868f0694134b73cd96dde7c05c8f262
.exe windows x86

bd5bb7a06d790254864d2eb76b319898

Code Sign

0d:52:11:4a:ab:a1:b5:e4:b4:b1:ac:e5:8c:31:9e:4e
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/06/2020, 00:00

Not After

13/06/2023, 12:00

Subject

SERIALNUMBER=597114,CN=EnigmaSoft Limited,O=EnigmaSoft Limited,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:52:11:4a:ab:a1:b5:e4:b4:b1:ac:e5:8c:31:9e:4e
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/06/2020, 00:00

Not After

13/06/2023, 12:00

Subject

SERIALNUMBER=597114,CN=EnigmaSoft Limited,O=EnigmaSoft Limited,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:ba:d4:f0:48:3d:28:ae:a2:7d:58:36:e3:c4:e4:e7:85:ea:23:de:4d:24:1e:9c:8d:5b:ee:d1:86:69:c2:43
Signer

Actual PE Digest

d4:ba:d4:f0:48:3d:28:ae:a2:7d:58:36:e3:c4:e4:e7:85:ea:23:de:4d:24:1e:9c:8d:5b:ee:d1:86:69:c2:43

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=597114,CN=EnigmaSoft Limited,O=EnigmaSoft Limited,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

01/03/2023, 16:20
Valid: true

Chain 1

SERIALNUMBER=597114,CN=EnigmaSoft Limited,O=EnigmaSoft Limited,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

d9:29:55:e3:c3:4f:45:22:42:92:8a:bc:52:d6:44:43:be:3d:ba:13
Signer

Actual PE Digest

d9:29:55:e3:c3:4f:45:22:42:92:8a:bc:52:d6:44:43:be:3d:ba:13

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=597114,CN=EnigmaSoft Limited,O=EnigmaSoft Limited,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

01/03/2023, 16:20
Valid: true

Chain 1

SERIALNUMBER=597114,CN=EnigmaSoft Limited,O=EnigmaSoft Limited,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipCreateRegion
GdipSetClipRegion
GdipSetInfinite
GdipCreateFromHDC
GdipGetClip
GdipDeleteRegion
GdipDeleteGraphics
GdipGetImageHeight
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipImageRotateFlip
GdipGetImagePixelFormat
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromResource
GdipCreateBitmapFromStream
GdipClosePathFigure
GdipAddPathArcI
GdipResetPath
GdipFillPath
GdipCreateSolidFill
GdipDeletePen
GdipDrawPath
GdipSetPenDashStyle
GdipCreatePen1
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipSetCompositingMode
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateTextureIAI
GdipSetImageAttributesColorKeys
GdipSetImageAttributesWrapMode
GdipDrawImagePointRectI
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDrawImageRectRectI
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdipCreateBitmapFromHBITMAP
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDeletePath
GdipCombineRegionPath
GdipSetSmoothingMode
GdipGetImageWidth

usp10

ScriptStringAnalyse
ScriptStringOut
ScriptStringCPtoX
ScriptStringGetLogicalWidths
ScriptStringGetOrder
ScriptStringXtoCP
ScriptString_pSize
ScriptString_pcOutChars
ScriptStringFree
ScriptString_pLogAttr

crypt32

CryptDecodeObject
CryptMsgClose
CryptQueryObject
CryptMsgGetParam
CertGetNameStringW
CryptHashCertificate
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertCloseStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

recvfrom
listen
accept
freeaddrinfo
getaddrinfo
htonl
gethostname
bind
WSAIoctl
closesocket
getnameinfo
getpeername
getsockname
socket
ntohs
sendto
getsockopt
htons
setsockopt
send
recv
WSAGetLastError
WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
shutdown
WSAEnumNetworkEvents
WSACleanup
WSAStartup
select
__WSAFDIsSet
connect
ioctlsocket
WSASetLastError

psapi

GetProcessMemoryInfo
GetModuleFileNameExW
EnumProcessModules
GetProcessImageFileNameW

kernel32

LocalFree
FreeLibrary
WideCharToMultiByte
FormatMessageA
CreateEventA
GetLastError
MoveFileExW
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
DeleteCriticalSection
DeleteFileW
Sleep
GetCurrentProcess
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetTickCount
CreateFileW
HeapFree
QueryPerformanceFrequency
GetProcessHeap
lstrcmpiW
QueryPerformanceCounter
FindResourceW
LCMapStringA
GetStringTypeExA
GetUserDefaultLCID
GetDiskFreeSpaceExW
LoadLibraryA
LoadLibraryW
HeapAlloc
GetProcAddress
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetCurrentProcessId
GetLocalTime
ReadFile
GetFileSizeEx
WriteFile
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
GetExitCodeProcess
EnumResourceNamesW
SizeofResource
InterlockedDecrement
GetModuleFileNameW
MultiByteToWideChar
LoadResource
GetModuleHandleW
InterlockedIncrement
SetDllDirectoryW
LoadLibraryExW
GetVersionExW
FileTimeToSystemTime
CloseHandle
TerminateProcess
OpenProcess
OpenMutexW
GetSystemDirectoryW
SleepEx
InitializeCriticalSection
VerSetConditionMask
VerifyVersionInfoW
GetEnvironmentVariableA
GetStdHandle
WaitForMultipleObjects
PeekNamedPipe
GetFileType
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
FindClose
FindFirstFileW
FindNextFileW
GetSystemTime
WaitForSingleObjectEx
GetStringTypeExW
LCMapStringW
MulDiv
ExpandEnvironmentStringsW
GetLongPathNameW
CreateDirectoryW
CopyFileW
DeviceIoControl
GetSystemInfo
GetNativeSystemInfo
LocalAlloc
ProcessIdToSessionId
GetVolumeInformationW
lstrcpyW
lstrcatW
CreateProcessW
CreatePipe
SetHandleInformation
HeapReAlloc
GetComputerNameW
GetCurrentThread
GetLogicalDriveStringsW
GetDriveTypeW
GetModuleHandleA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GlobalSize
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindFirstVolumeW
GetVolumePathNamesForVolumeNameW
QueryDosDeviceW
FindNextVolumeW
FindVolumeClose
lstrlenW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetFilePointer
MoveFileW
SetFilePointerEx
GetTimeFormatW
GetDateFormatW
LockResource
GetLogicalDrives
DeleteVolumeMountPointW
DefineDosDeviceW
GetVolumeNameForVolumeMountPointW
SetVolumeMountPointW
GlobalMemoryStatusEx
GetLocaleInfoW
CreateEventW
CreateNamedPipeW
GetLocaleInfoA
CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
lstrcmpA
FileTimeToLocalFileTime
lstrcpynW
RemoveVectoredExceptionHandler
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
IsBadReadPtr
VirtualQuery
FreeResource
GetFileSize
CreateSemaphoreA
DuplicateHandle
ReleaseSemaphore
SetEvent
FormatMessageW
GetStringTypeW
TryEnterCriticalSection
EncodePointer
CompareStringW
GetCPInfo
ResetEvent
WaitForMultipleObjectsEx
OpenEventA
SetWaitableTimer
ResumeThread
CreateWaitableTimerA
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
VirtualProtect
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
GetModuleFileNameA
WriteConsoleW
GetACP
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
ExitThread
SetConsoleCtrlHandler
ExitProcess
GetCommandLineA
GetCommandLineW
GetConsoleCP
HeapSize
IsValidCodePage
GetOEMCP
IsValidLocale
EnumSystemLocalesW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
SetEnvironmentVariableA
SetEnvironmentVariableW
FindFirstFileExW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEndOfFile
GetTempPathW
SystemTimeToFileTime
CreateProcessA

user32

ScreenToClient
UpdateLayeredWindow
SetCaretPos
SetActiveWindow
GetKeyState
DestroyCaret
ClientToScreen
CreateCaret
ShowCaret
HideCaret
InsertMenuW
TrackPopupMenu
IsDialogMessageW
DestroyMenu
BringWindowToTop
TranslateAcceleratorW
LoadIconW
TrackPopupMenuEx
RemoveMenu
AppendMenuW
PostQuitMessage
DialogBoxParamW
GetMessageW
LoadMenuW
MessageBoxW
GetSystemMetrics
LoadAcceleratorsW
LoadStringW
GetClassInfoW
DispatchMessageW
PeekMessageW
RegisterClassW
CharNextW
TranslateMessage
UpdateWindow
SetForegroundWindow
LoadImageW
GetWindow
MonitorFromWindow
EndDialog
GetWindowInfo
GetMonitorInfoW
ExitWindowsEx
EnumWindows
GetWindowDC
SetWindowTextW
MoveWindow
LoadStringA
GetDC
ReleaseDC
GetFocus
RegisterClassExW
IsWindowEnabled
SetRect
GetClassInfoExW
InflateRect
IsZoomed
DrawTextW
IsIconic
GetCapture
TrackMouseEvent
SetFocus
SetCapture
ReleaseCapture
GetCursorPos
PostMessageW
ShowWindow
RedrawWindow
GetDlgItem
GetWindowLongW
DefWindowProcW
AdjustWindowRectEx
CallWindowProcW
GetWindowRect
DestroyWindow
IsWindowVisible
SetWindowPos
EnumChildWindows
CreateWindowExW
SendMessageW
IsWindow
OffsetRect
LoadCursorW
SetCursor
SetWindowLongW
GetClientRect
GetParent
PtInRect
BeginPaint
EndPaint
UnregisterClassW
IsCharAlphaNumericA
SetWindowRgn
KillTimer
SetTimer
EnableWindow
GetClipboardData
IsClipboardFormatAvailable
CloseClipboard
SetClipboardData
EmptyClipboard
GetMessageExtraInfo
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
FindWindowExW
GetWindowTextLengthW
GetMenuItemInfoW
AllowSetForegroundWindow
MonitorFromPoint
OpenClipboard
InvalidateRect
GetMenuItemCount
LockSetForegroundWindow
MessageBeep
CreatePopupMenu
MapWindowPoints
GetActiveWindow

gdi32

StartPage
GetTextMetricsW
TextOutW
EndPage
GetBkColor
SetTextAlign
GetTextColor
GetDeviceCaps
CreateRectRgn
GetDIBits
ExtCreatePen
LineTo
MoveToEx
ExtTextOutW
CreateFontW
GetObjectW
SetBrushOrgEx
SetStretchBltMode
GetTextExtentPoint32W
CreatePen
Rectangle
SelectClipRgn
IntersectClipRect
SetBkColor
CreateSolidBrush
SetTextColor
SetBkMode
BitBlt
CreateCompatibleBitmap
SaveDC
SelectObject
CreateCompatibleDC
DeleteDC
SetViewportOrgEx
ExcludeClipRect
RestoreDC
DeleteObject
CombineRgn
ExtSelectClipRgn

advapi32

SetSecurityDescriptorOwner
AddAccessAllowedAce
SetSecurityDescriptorDacl
ConvertSidToStringSidW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumValueW
GetUserNameW
DuplicateToken
FreeSid
OpenThreadToken
AllocateAndInitializeSid
SetSecurityDescriptorGroup
IsValidSecurityDescriptor
AccessCheck
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatusEx
ControlService
LookupAccountNameW
RegSaveKeyExW
InitializeSecurityDescriptor
RegQueryValueExW
GetTokenInformation
GetLengthSid
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
GetNamedSecurityInfoW
GetExplicitEntriesFromAclW
InitializeAcl
SetEntriesInAclW
OpenProcessToken
SetNamedSecurityInfoW
RegSetKeySecurity

shell32

SHOpenFolderAndSelectItems
SHParseDisplayName
ShellExecuteW

ole32

CreateStreamOnHGlobal
CoInitializeEx
CoTaskMemRealloc
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VariantInit
SysAllocString
VariantClear
VarUI4FromStr
SysFreeString

shlwapi

ord1
StrCmpNIW
StrCmpIW

comctl32

ord412
ord410
ord413

msimg32

AlphaBlend

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 934KB - Virtual size: 934KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 123KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd5bb7a06d790254864d2eb76b319898

Code Sign

0d:52:11:4a:ab:a1:b5:e4:b4:b1:ac:e5:8c:31:9e:4eCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

0d:52:11:4a:ab:a1:b5:e4:b4:b1:ac:e5:8c:31:9e:4eCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

d4:ba:d4:f0:48:3d:28:ae:a2:7d:58:36:e3:c4:e4:e7:85:ea:23:de:4d:24:1e:9c:8d:5b:ee:d1:86:69:c2:43Signer

Signature Validations

Verification

01/03/2023, 16:20 Valid: true

Chain 1

d9:29:55:e3:c3:4f:45:22:42:92:8a:bc:52:d6:44:43:be:3d:ba:13Signer

Signature Validations

Verification

01/03/2023, 16:20 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

usp10

crypt32

version

ws2_32

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.rdata Size: 934KB - Virtual size: 934KB

.data Size: 123KB - Virtual size: 176KB

.gfids Size: 5KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 207KB - Virtual size: 207KB

0d:52:11:4a:ab:a1:b5:e4:b4:b1:ac:e5:8c:31:9e:4e
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

0d:52:11:4a:ab:a1:b5:e4:b4:b1:ac:e5:8c:31:9e:4e
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

d4:ba:d4:f0:48:3d:28:ae:a2:7d:58:36:e3:c4:e4:e7:85:ea:23:de:4d:24:1e:9c:8d:5b:ee:d1:86:69:c2:43
Signer

01/03/2023, 16:20
Valid: true

d9:29:55:e3:c3:4f:45:22:42:92:8a:bc:52:d6:44:43:be:3d:ba:13
Signer

01/03/2023, 16:20
Valid: true

.text
Size: 4.2MB - Virtual size: 4.2MB

.rdata
Size: 934KB - Virtual size: 934KB

.data
Size: 123KB - Virtual size: 176KB

.gfids
Size: 5KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 207KB - Virtual size: 207KB