f6426b0740788f8f1dda84a95b928d86[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

f6426b0740788f8f1dda84a95b928d86.bin
Size

3.0MB
MD5

f6426b0740788f8f1dda84a95b928d86
SHA1

0bc615dfc759ff4b5e78ea7ff013c5a1f95995ce
SHA256

6d5597875970b6a30f1a8ad83800edebe692582fad0044fb25002e525bbe7af0
SHA512

fb911d7ce4612224d081cce4534969e018fab45649b1f5ae75ab2bf4ac95f0b44e3894333bdd2aaa38927916569339a0933171ec1532923836e5f1d6cef6968c
SSDEEP

49152:YhDpY69PS9SsbCmlaJUgNTxR4VRVB2nLVBTpRqPupM7T2NTZLdaDftd5So:YhDpT9KYkC+GUWTxRSRVUnLOPtn2NF8

Score

1^/10

Malware Config

Signatures

Files

f6426b0740788f8f1dda84a95b928d86.bin
.exe windows x86

6a6a748618bddf4d2c97e7a1998d6f30

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

20-04-2022 00:00

Not After

05-04-2025 23:59

Subject

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

20-04-2022 00:00

Not After

05-04-2025 23:59

Subject

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

87:25:9e:1f:d0:0d:18:40:13:a9:a6:87:c7:f1:ea:4d:5f:e4:04:aa:26:50:44:e6:d0:e3:7e:75:0b:e7:73:be
Signer

Actual PE Digest

87:25:9e:1f:d0:0d:18:40:13:a9:a6:87:c7:f1:ea:4d:5f:e4:04:aa:26:50:44:e6:d0:e3:7e:75:0b:e7:73:be

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

29-12-2022 07:11
Valid: true

Chain 1

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

dc:87:ae:59:a6:af:49:50:91:bf:1b:e8:d6:0c:87:6f:8c:d5:06:28
Signer

Actual PE Digest

dc:87:ae:59:a6:af:49:50:91:bf:1b:e8:d6:0c:87:6f:8c:d5:06:28

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

29-12-2022 07:11
Valid: true

Chain 1

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

wldap32

ord211
ord301
ord27
ord60
ord45
ord143
ord46
ord41
ord22
ord217
ord50
ord26
ord33
ord79
ord35
ord32
ord200
ord30

crypt32

CertCreateCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertFindExtension
CryptDecodeObjectEx
CryptQueryObject
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertOpenStore
CertFindCertificateInStore
PFXImportCertStore
CertCloseStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CryptStringToBinaryA

kernel32

lstrcmpiW
lstrcpynW
lstrcpyW
SetLastError
FreeLibrary
GetSystemDirectoryA
LoadLibraryA
GetModuleHandleA
QueryPerformanceFrequency
SleepEx
QueryPerformanceCounter
VerifyVersionInfoA
GetEnvironmentVariableA
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
MoveFileExA
GetFileSizeEx
CreateFileA
GetDriveTypeW
GetCurrentProcess
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetEnvironmentVariableW
SetErrorMode
CreateProcessW
GetExitCodeProcess
TerminateProcess
lstrcmpW
SetEndOfFile
TerminateThread
GetFileAttributesExW
CreateThread
SetFilePointerEx
SetFileAttributesW
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
GetLocalTime
GetLogicalProcessorInformation
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
CreateTimerQueue
MoveFileExW
FindNextFileW
GetFileInformationByHandle
FileTimeToLocalFileTime
AreFileApisANSI
RtlUnwind
GetCommandLineA
LoadLibraryExW
ExitThread
IsProcessorFeaturePresent
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
FindClose
GetCPInfo
OutputDebugStringW
IsDebuggerPresent
GetStringTypeW
EncodePointer
GetExitCodeThread
GetCurrentThread
DuplicateHandle
ChangeTimerQueueTimer
GlobalAlloc
RegisterWaitForSingleObject
UnregisterWait
VerSetConditionMask
FormatMessageW
CreateTimerQueueTimer
LocalFree
UnhandledExceptionFilter
GetStartupInfoW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
GetModuleHandleExW
GetFullPathNameW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadConsoleW
SetStdHandle
GetThreadTimes
FreeLibraryAndExitThread
ReleaseSemaphore
InitializeSListHead
UnregisterWaitEx
VirtualAlloc
VirtualFree
VirtualProtect
SetConsoleCtrlHandler
WriteConsoleW
SetEnvironmentVariableA
GetVersion
InterlockedCompareExchange
InterlockedExchangeAdd
DeleteFiber
ConvertFiberToThread
GlobalMemoryStatus
SetConsoleMode
ReadConsoleA
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
SystemTimeToFileTime
SetFileTime
SetFilePointer
LocalFileTimeToFileTime
GetFileAttributesW
CreateDirectoryW
CreateMutexW
ReleaseMutex
MulDiv
ExitProcess
WideCharToMultiByte
lstrlenW
GlobalUnlock
GlobalLock
GetModuleHandleW
GetTickCount
ReadFile
GetFileSize
GetCurrentDirectoryW
GetACP
MultiByteToWideChar
DeleteFileW
CreateSemaphoreW
SetUnhandledExceptionFilter
FreeResource
OpenProcess
GetCurrentProcessId
GetModuleFileNameW
VirtualQuery
WriteFile
CreateFileW
lstrcatW
GetTempPathW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
Sleep
CreateEventW
GetNativeSystemInfo
GetVersionExW
LoadLibraryW
GetProcAddress
GetTimeZoneInformation
WaitForSingleObject
SetEvent
CloseHandle
GetSystemTimeAsFileTime
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetUserDefaultLCID
GetSystemDefaultLCID
GetCurrentThreadId
FindResourceExW
FindResourceW
LoadResource
LockResource
SetThreadAffinityMask

user32

wsprintfW
GetSystemMetrics
ScreenToClient
PtInRect
GetWindowRect
LoadIconW
IsWindow
GetClassNameW
PostQuitMessage
MessageBoxW
IsIconic
ShowWindow
DrawTextA
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
FindWindowW
GetLastActivePopup
CreatePopupMenu
AppendMenuW
GetCursorPos
TrackPopupMenu
BringWindowToTop
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA
UpdateWindow
IsWindowEnabled
SetRect
DrawTextW
CharPrevW
GetWindowRgn
UpdateLayeredWindow
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
CreateCaret
EnableMenuItem
DestroyMenu
GetGUIThreadInfo
FillRect
ClientToScreen
GetCaretBlinkTime
InvalidateRgn
CreateAcceleratorTableW
MoveWindow
EqualRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SetWindowRgn
AdjustWindowRectEx
GetPropW
SetPropW
GetMenu
EnableWindow
GetClassInfoExW
RegisterClassExW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMonitorInfoW
MonitorFromWindow
LoadImageW
GetWindow
GetParent
SetWindowLongW
GetWindowLongW
IsRectEmpty
IntersectRect
GetSysColor
MapWindowPoints
GetClientRect
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
SetForegroundWindow
SetActiveWindow
SetCursor
InflateRect
UnionRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
PostMessageW
CreateWindowExW
DestroyWindow
SetWindowPos
IsWindowVisible
IsZoomed
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDC
ReleaseDC

gdi32

SetBitmapBits
GetBitmapBits
GetTextExtentPointA
GdiFlush
TextOutW
MoveToEx
GetObjectA
SetStretchBltMode
StretchBlt
SetBkColor
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateDIBSection
PtInRegion
CreateRectRgn
SetTextColor
SetBkMode
CreateSolidBrush
CreatePatternBrush
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

advapi32

RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
CryptImportKey
CryptDecrypt
CryptSetHashParam
CryptSignHashW
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryValueExW
RegCloseKey
CryptAcquireContextW
RegEnumKeyExW
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegDeleteValueW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptEncrypt
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptDestroyKey
RegQueryInfoKeyW

shell32

SHGetFolderLocation
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW
DragQueryFileW
SHGetFolderPathW
ord165
CommandLineToArgvW
SHFileOperationW
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHBrowseForFolderW

ole32

CreateStreamOnHGlobal
ReleaseStgMedium
OleLockRunning
CLSIDFromProgID
CLSIDFromString
OleDuplicateData
DoDragDrop
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantCopy
VariantInit
VariantChangeType
SysFreeString
VariantClear
SysAllocString

shlwapi

PathFileExistsW
wnsprintfW

gdiplus

GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArc
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

dbghelp

MiniDumpWriteDump

ws2_32

WSASetLastError
freeaddrinfo
socket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
recv
WSACleanup
WSAGetLastError
send
closesocket
WSAStartup
gethostname
gethostbyname
getaddrinfo
accept
listen
htonl
sendto
recvfrom
WSAEnumNetworkEvents
WSACloseEvent
inet_addr
inet_ntoa
ntohl
ioctlsocket
__WSAFDIsSet
select
WSACreateEvent
connect
WSAEventSelect

winhttp

WinHttpCloseHandle
WinHttpAddRequestHeaders
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpOpen
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpConnect
WinHttpSendRequest

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 624KB - Virtual size: 624KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a6a748618bddf4d2c97e7a1998d6f30

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

87:25:9e:1f:d0:0d:18:40:13:a9:a6:87:c7:f1:ea:4d:5f:e4:04:aa:26:50:44:e6:d0:e3:7e:75:0b:e7:73:beSigner

Signature Validations

Verification

29-12-2022 07:11 Valid: true

Chain 1

Chain 2

dc:87:ae:59:a6:af:49:50:91:bf:1b:e8:d6:0c:87:6f:8c:d5:06:28Signer

Signature Validations

Verification

29-12-2022 07:11 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

wldap32

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

imm32

dbghelp

ws2_32

winhttp

version

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 624KB - Virtual size: 624KB

.data Size: 43KB - Virtual size: 91KB

.tls Size: 512B - Virtual size: 17B

.rsrc Size: 235KB - Virtual size: 235KB

.reloc Size: 114KB - Virtual size: 113KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:e3:82:17:61:e3:5a:96:b4:54:de:9e:4d:5a:50:12
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

87:25:9e:1f:d0:0d:18:40:13:a9:a6:87:c7:f1:ea:4d:5f:e4:04:aa:26:50:44:e6:d0:e3:7e:75:0b:e7:73:be
Signer

29-12-2022 07:11
Valid: true

dc:87:ae:59:a6:af:49:50:91:bf:1b:e8:d6:0c:87:6f:8c:d5:06:28
Signer

29-12-2022 07:11
Valid: true

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 624KB - Virtual size: 624KB

.data
Size: 43KB - Virtual size: 91KB

.tls
Size: 512B - Virtual size: 17B

.rsrc
Size: 235KB - Virtual size: 235KB

.reloc
Size: 114KB - Virtual size: 113KB