General

Malware Config

Signatures

Files

• a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b

  .dll windows x86

  6fc91e135f967218c3d36d0b14484e5a

  
  

  Code Sign

  ac:30:7e:52:57:bb:81:4b:81:8d:36:33:b6:30:32:6f

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  23-11-2020 00:00

  Not After

  23-11-2021 23:59

  Subject

  CN=Aqua Direct s.r.o.,O=Aqua Direct s.r.o.,POSTALCODE=619 00,STREET=Železná 646/8,L=Brno,C=CZ

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  01-01-2004 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  12-03-2019 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  17:59:20:90:3a:06:c2:55:59:19:63:67:d5:e3:0e:c0:64:14:62:4f

  Signer

  Actual PE Digest

  17:59:20:90:3a:06:c2:55:59:19:63:67:d5:e3:0e:c0:64:14:62:4f

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Aqua Direct s.r.o.,O=Aqua Direct s.r.o.,POSTALCODE=619 00,STREET=Železná 646/8,L=Brno,C=CZ

  21-03-2023 12:26

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetVersion

  LoadLibraryA

  VirtualAlloc

  VirtualProtect

  GetProcAddress

  GetProcessId

  lstrlenA

  lstrcatA

  lstrcmpA

  GetCurrentProcess

  MoveFileExW

  SetCriticalSectionSpinCount

  DeleteTimerQueueEx

  VerLanguageNameW

  PrivCopyFileExW

  user32

  GetGUIThreadInfo

  GetCursorInfo

  GetCursorPos

  GetWindowThreadProcessId

  GetKeyboardType

  CharToOemA

  LockWorkStation

  GetKeyboardLayoutList

  SetCaretPos

  UnlockWindowStation

  GetMenuContextHelpId

  InvertRect

  EndDeferWindowPos

  CharToOemBuffA

  imagehlp

  SymGetLineFromName

  SymGetLinePrev

  SymSetContext

  SymRegisterFunctionEntryCallback64

  RemoveRelocations

  GetImageUnusedHeaderBytes

  ole32

  OleCreateStaticFromData

  OleRegGetMiscStatus

  CoRevokeMallocSpy

  OleDuplicateData

  StgConvertVariantToProperty

  HENHMETAFILE_UserFree

  CreateDataAdviseHolder

  HBITMAP_UserUnmarshal

  OleConvertOLESTREAMToIStorage

  RegisterDragDrop

  CoEnableCallCancellation

  version

  GetFileVersionInfoW

  VerFindFileA

  GetFileVersionInfoSizeW

  GetFileVersionInfoSizeA

  VerInstallFileW

  winspool.drv

  DeviceCapabilities

  EnumPrinterDataExW

  AddPrinterDriverW

  EnumJobsW

  AddPortExW

  SpoolerPrinterEvent

  DeletePrintProcessorA

  IsValidDevmodeW

  SetPrinterDataA

  oledlg

  OleUIEditLinksW

  OleUIBusyW

  OleUIConvertA

  OleUIPasteSpecialA

  OleUIChangeIconW

  OleUIChangeSourceA

  gdiplus

  GdipGetAllPropertyItems

  GdipGetTextureImage

  GdipGetPageScale

  GdipGetImagePalette

  GdipIsVisiblePointI

  GdipGetTextRenderingHint

  GdipGetFamily

  GdipGetImageThumbnail

  gdi32

  OffsetWindowOrgEx

  CheckColorsInGamut

  GetWindowOrgEx

  GdiDeleteSpoolFileHandle

  GdiGetLocalFont

  PATHOBJ_bEnumClipLines

  FixBrushOrgEx

  CopyMetaFileW

  DdEntry3

  msimg32

  TransparentBlt

  vSetDdrawflag

  AlphaBlend

  GradientFill

  shlwapi

  AssocCreate

  StrStrIA

  PathIsUNCServerShareA

  StrRetToStrA

  StrFromTimeIntervalA

  HashData

  oleacc

  DllUnregisterServer

  IID_IAccessible

  AccessibleChildren

  CreateStdAccessibleProxyA

  GetRoleTextA

  winmm

  auxOutMessage

  timeGetTime

  mciSetDriverData

  mci32Message

  Sections

  .code

  Size: 195KB - Virtual size: 194KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 58KB - Virtual size: 58KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE