sample[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

sample.exe
Size

36.5MB
MD5

f4f09daf453ec132f236afea3057cae3
SHA1

95ccc5a22cb64b2854b5744114fa1192e801e13b
SHA256

0b09619651d76a4f7d3be0a0a7ce8e2ffe9be39763d46726394176d7fb412c14
SHA512

aad84ac0a52b67f485afc2ba8550158dc4de423eb0ec109cad7b63a0ac7e8c4efa4773121c375768e97cf08c73eaa941b7327ea8bbbd363427e1575eb613bd48
SSDEEP

786432:0HA6WVMsB1QfQGoSWXitzk3RJLxXx/AbDxLgCpq5UZBU6X88XBbGs:0H8Vh1rXiYrVh/Abtck0ocs

Score

1^/10

Malware Config

Signatures

Files

sample.exe
.exe windows x86

b8c5cab057ee86d24bc2da56eef68c5b

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

87:82:52:60:00:00:00:00:51:d3:73:d9
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

10/06/2015, 13:42

Not After

10/11/2030, 14:12

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:12:fb:1d:55:0c:f1:95:d9:9b:a4:91:ab:7b:27:ef
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

29/04/2021, 10:25

Not After

29/04/2023, 10:25

Subject

SERIALNUMBER=91440101583379031K,CN=GUANZHOU GAOMON ELECTRONIC TECHNOLOGY CO.\,LTD .,O=GUANZHOU GAOMON ELECTRONIC TECHNOLOGY CO.\,LTD .,L=Guangzhou,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

87:82:52:60:00:00:00:00:51:d3:73:d9
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

10/06/2015, 13:42

Not After

10/11/2030, 14:12

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:12:fb:1d:55:0c:f1:95:d9:9b:a4:91:ab:7b:27:ef
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

29/04/2021, 10:25

Not After

29/04/2023, 10:25

Subject

SERIALNUMBER=91440101583379031K,CN=GUANZHOU GAOMON ELECTRONIC TECHNOLOGY CO.\,LTD .,O=GUANZHOU GAOMON ELECTRONIC TECHNOLOGY CO.\,LTD .,L=Guangzhou,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:c6:3f:bb:95:ce:8e:82:9d:aa:52:b5:42:28:fa:d0:d1:a5:58:a9:9c:0b:d3:28:63:e3:4e:90:c2:87:34:f5
Signer

Actual PE Digest

2d:c6:3f:bb:95:ce:8e:82:9d:aa:52:b5:42:28:fa:d0:d1:a5:58:a9:9c:0b:d3:28:63:e3:4e:90:c2:87:34:f5

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91440101583379031K,CN=GUANZHOU GAOMON ELECTRONIC TECHNOLOGY CO.\,LTD .,O=GUANZHOU GAOMON ELECTRONIC TECHNOLOGY CO.\,LTD .,L=Guangzhou,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

14/07/2021, 02:26
Valid: true

Chain 1

SERIALNUMBER=91440101583379031K,CN=GUANZHOU GAOMON ELECTRONIC TECHNOLOGY CO.\,LTD .,O=GUANZHOU GAOMON ELECTRONIC TECHNOLOGY CO.\,LTD .,L=Guangzhou,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

2c:0d:f6:da:f0:43:eb:cb:0e:bc:cd:4b:b1:0b:66:89:1a:c8:90:48
Signer

Actual PE Digest

2c:0d:f6:da:f0:43:eb:cb:0e:bc:cd:4b:b1:0b:66:89:1a:c8:90:48

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91440101583379031K,CN=GUANZHOU GAOMON ELECTRONIC TECHNOLOGY CO.\,LTD .,O=GUANZHOU GAOMON ELECTRONIC TECHNOLOGY CO.\,LTD .,L=Guangzhou,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

14/07/2021, 02:26
Valid: true

Chain 1

SERIALNUMBER=91440101583379031K,CN=GUANZHOU GAOMON ELECTRONIC TECHNOLOGY CO.\,LTD .,O=GUANZHOU GAOMON ELECTRONIC TECHNOLOGY CO.\,LTD .,L=Guangzhou,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDriveTypeW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetStdHandle
SetStdHandle
GetOEMCP
HeapQueryInformation
ReadConsoleW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
VirtualAlloc
GetCommandLineA
RtlUnwind
GetACP
GetCPInfo
GetStringTypeW
LCMapStringW
OutputDebugStringW
FindFirstFileExW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetUserDefaultLCID
SearchPathW
GetProfileIntW
GetTempFileNameW
VerifyVersionInfoW
VerSetConditionMask
FindResourceExW
lstrcpyW
VirtualProtect
GlobalFindAtomW
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
EncodePointer
GlobalFlags
SetErrorMode
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalGetAtomNameW
InitializeCriticalSectionAndSpinCount
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
FreeLibrary
GetCurrentThreadId
GetThreadLocale
LoadLibraryA
LoadLibraryExW
GetModuleHandleA
OutputDebugStringA
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
MulDiv
GlobalSize
LoadLibraryW
Sleep
SetCurrentDirectoryW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
SetLastError
GetTickCount
FileTimeToSystemTime
DosDateTimeToFileTime
GetFileType
GetProcessHeap
DecodePointer
GetCurrentDirectoryW
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
DuplicateHandle
SetFilePointer
SetFileTime
HeapFree
ResetEvent
SetEvent
ReleaseSemaphore
WaitForMultipleObjects
ResumeThread
CreateSemaphoreW
CreateEventW
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetUserDefaultUILanguage
LocalAlloc
lstrcmpiW
GetSystemInfo
GetVersionExW
TerminateProcess
OpenProcess
GetModuleHandleW
GetProcAddress
GetCurrentProcessId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetLocalTime
ExitProcess
GetCurrentThread
SetThreadPriority
GetCurrentProcess
GetTempPathW
GetWindowsDirectoryW
QueryPerformanceCounter
GetSystemDirectoryW
GetCommandLineW
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
FlushFileBuffers
WriteFile
ReadFile
GetFileSize
DeleteCriticalSection
InitializeCriticalSection
VirtualQuery
GetFileAttributesW
LocalFree
FormatMessageW
FindClose
FindNextFileW
FindFirstFileW
CloseHandle
CreateFileW
CreateDirectoryW
DeleteFileW
CopyFileW
GetLastError
FreeResource
FindResourceW
LoadResource
LockResource
SizeofResource
GetShortPathNameW
GetModuleFileNameW
SystemTimeToFileTime
GetSystemTime
QueryPerformanceFrequency

user32

GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
SetForegroundWindow
SetActiveWindow
TrackPopupMenu
SetMenu
GetMenu
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsMenu
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
GetTopWindow
MessageBeep
GetNextDlgTabItem
GetNextDlgGroupItem
IsChild
EqualRect
IsRectEmpty
SetRect
InvalidateRgn
CopyAcceleratorTableW
OffsetRect
CharNextW
InvalidateRect
UpdateWindow
KillTimer
SetTimer
DeleteMenu
SystemParametersInfoW
CopyImage
WindowFromPoint
ReleaseCapture
SetCapture
GetCapture
WaitMessage
RealChildWindowFromPoint
GetClassNameW
PtInRect
IsDialogMessageW
SetWindowTextW
SetFocus
GetDlgCtrlID
GetScrollInfo
WinHelpW
ShowScrollBar
CheckDlgButton
TabbedTextOutW
GetDC
GetWindowDC
ReleaseDC
BeginPaint
GetDlgItem
GetSysColorBrush
GetWindowTextLengthW
GetWindowTextW
SetCursor
GetMonitorInfoW
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
MapDialogRect
SetWindowContextHelpId
IntersectRect
CopyRect
GetLastActivePopup
MessageBoxW
IsWindowEnabled
EnableWindow
FillRect
GetSysColor
DestroyIcon
BringWindowToTop
LoadAcceleratorsW
TranslateAcceleratorW
LoadMenuW
CreatePopupMenu
DestroyMenu
InsertMenuItemW
SetRectEmpty
LoadImageW
UnpackDDElParam
ReuseDDElParam
GetMenuItemInfoW
SubtractRect
RegisterClipboardFormatW
ClientToScreen
EndPaint
SetPropW
RemovePropW
AdjustWindowRectEx
MapWindowPoints
GetClassLongW
LoadIconW
MonitorFromWindow
SetScrollInfo
SendDlgItemMessageA
CreateDialogIndirectParamW
EndDialog
GetAsyncKeyState
GetKeyNameTextW
MapVirtualKeyW
UnionRect
GetSystemMenu
SetParent
PostThreadMessageW
TrackMouseEvent
LockWindowUpdate
DrawFocusRect
GetIconInfo
EnableScrollBar
wsprintfW
GetWindowThreadProcessId
PostMessageW
SetCaretPos
ShowCaret
CreateCaret
CharPrevW
wvsprintfW
SendMessageW
GetSystemMetrics
HideCaret
GetPropW
GetWindow
GetDesktopWindow
IsWindow
GetForegroundWindow
DrawIconEx
ShowWindow
InflateRect
DrawTextW
UnregisterClassW
ScreenToClient
GetClientRect
IsZoomed
GetWindowLongW
SetWindowLongW
RegisterClassExW
LoadCursorW
DefWindowProcW
GetParent
MoveWindow
GetWindowRgn
GetWindowRect
DestroyWindow
SetWindowPos
CreateWindowExW
PostQuitMessage
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
CharUpperW
UnhookWindowsHookEx
DrawTextExW
GrayStringW
InvertRect
NotifyWinEvent
GetMenuDefaultItem
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongW
SetWindowRgn
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
DrawEdge
DrawFrameControl
SetCursorPos
CopyIcon
FrameRect
DrawIcon
UpdateLayeredWindow
MonitorFromPoint
GetComboBoxInfo
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
DestroyCursor
CreateMenu
ShowOwnedPopups

gdi32

ExtSelectClipRgn
SelectPalette
SetBkColor
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextAlign
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
CreateFontIndirectW
CreateRectRgnIndirect
GetMapMode
PatBlt
SetRectRgn
DPtoLP
GetBkColor
GetTextColor
GetRgnBox
SelectClipRgn
RestoreDC
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
SaveDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateBitmap
GetDeviceCaps
CreateDCW
CopyMetaFileW
CreateRectRgn
PtInRegion
SetTextColor
BitBlt
CreateCompatibleBitmap
StretchBlt
CreateDIBSection
GetObjectW
CreateCompatibleDC
SetDIBColorTable
DeleteDC
GetCharABCWidthsW
CreatePenIndirect
DeleteObject
GetObjectA
GetTextExtentPoint32W
SelectObject
SetBkMode

msimg32

AlphaBlend
TransparentBlt

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegEnumKeyExW
RegCloseKey
RegEnumValueW
RegQueryValueW
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
RegDeleteKeyExW
RegEnumKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW

shell32

DragQueryFileW
DragFinish
SHGetFileInfoW
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHAppBarMessage
SHGetDesktopFolder

comctl32

ord17
_TrackMouseEvent
InitCommonControlsEx

shlwapi

PathRemoveFileSpecW
PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
StrFormatKBSizeW

uxtheme

GetWindowTheme
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeText
DrawThemeBackground
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetCurrentThemeName
GetThemeColor
IsAppThemed
GetThemePartSize

ole32

CoCreateGuid
RegisterDragDrop
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoInitializeEx
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CLSIDFromProgID
CLSIDFromString
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocStringLen
SysAllocString
SafeArrayDestroy
VariantInit
OleCreateFontIndirect
LoadTypeLi
VarBstrFromDate
SysFreeString
VariantClear
VariantCopy
VariantChangeType

oledlg

OleUIBusyW

winmm

PlaySoundW

gdiplus

GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipCreatePath
GdipDeletePath
GdipDeleteFontFamily
GdipGetFamily
GdipAddPathString
GdipGetFontSize
GdipGetFontStyle
GdipGetPathWorldBounds
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipCreateStringFormat
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromStream
GdiplusShutdown
GdiplusStartup
GdipCreateFromHDC
GdipDrawImageRectI
GdipCreateBitmapFromFile
GdipCreateTexture
GdipDeleteBrush
GdipCloneBrush
GdipSetTextureWrapMode
GdipTranslateTextureTransform
GdipScaleTextureTransform
GdipSetSmoothingMode
GdipFillEllipse
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipDrawEllipse
GdipDrawArc
GdipCreateBitmapFromHBITMAP
GdipSetInterpolationMode
GdipCreateLineBrushI
GdipSetTextRenderingHint
GdipDrawString
GdipGetImagePaletteSize
GdipFree

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 427KB - Virtual size: 427KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34.0MB - Virtual size: 34.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8c5cab057ee86d24bc2da56eef68c5b

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

87:82:52:60:00:00:00:00:51:d3:73:d9Certificate

Extended Key Usages

Key Usages

3c:12:fb:1d:55:0c:f1:95:d9:9b:a4:91:ab:7b:27:efCertificate

Extended Key Usages

Key Usages

87:82:52:60:00:00:00:00:51:d3:73:d9Certificate

Extended Key Usages

Key Usages

3c:12:fb:1d:55:0c:f1:95:d9:9b:a4:91:ab:7b:27:efCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

2d:c6:3f:bb:95:ce:8e:82:9d:aa:52:b5:42:28:fa:d0:d1:a5:58:a9:9c:0b:d3:28:63:e3:4e:90:c2:87:34:f5Signer

Signature Validations

Verification

14/07/2021, 02:26 Valid: true

Chain 1

2c:0d:f6:da:f0:43:eb:cb:0e:bc:cd:4b:b1:0b:66:89:1a:c8:90:48Signer

Signature Validations

Verification

14/07/2021, 02:26 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

winmm

gdiplus

imm32

version

oleacc

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 427KB - Virtual size: 427KB

.data Size: 27KB - Virtual size: 55KB

.gfids Size: 106KB - Virtual size: 106KB

.giats Size: 512B - Virtual size: 16B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 34.0MB - Virtual size: 34.0MB

.reloc Size: 146KB - Virtual size: 146KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

87:82:52:60:00:00:00:00:51:d3:73:d9
Certificate

3c:12:fb:1d:55:0c:f1:95:d9:9b:a4:91:ab:7b:27:ef
Certificate

87:82:52:60:00:00:00:00:51:d3:73:d9
Certificate

3c:12:fb:1d:55:0c:f1:95:d9:9b:a4:91:ab:7b:27:ef
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

2d:c6:3f:bb:95:ce:8e:82:9d:aa:52:b5:42:28:fa:d0:d1:a5:58:a9:9c:0b:d3:28:63:e3:4e:90:c2:87:34:f5
Signer

14/07/2021, 02:26
Valid: true

2c:0d:f6:da:f0:43:eb:cb:0e:bc:cd:4b:b1:0b:66:89:1a:c8:90:48
Signer

14/07/2021, 02:26
Valid: true

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 427KB - Virtual size: 427KB

.data
Size: 27KB - Virtual size: 55KB

.gfids
Size: 106KB - Virtual size: 106KB

.giats
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 34.0MB - Virtual size: 34.0MB

.reloc
Size: 146KB - Virtual size: 146KB