General

Malware Config

Signatures

Files

• public.zip

  .zip
• public.exe

  .exe windows x86

  5877688b4859ffd051f6be3b8e0cd533

  
  

  Code Sign

  06:2b:40:9e:df:1c:6b:5e:bb:b6:46:1e:64:ef:5e:94

  Certificate

  Issuer

  CN=Kiyo Corporation

  Not Before

  28-03-2023 15:16

  Not After

  31-12-2039 23:59

  Subject

  CN=Kiyo Corporation

  90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

  Certificate

  Issuer

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  11-05-2022 00:00

  Not After

  10-08-2033 23:59

  Subject

  CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-05-2019 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  c4:3f:1a:39:0a:00:15:31:42:98:12:ae:aa:6e:f1:b3:a0:d9:1b:7c:8b:a0:e3:07:71:3e:fd:78:96:14:9e:4b

  Signer

  Actual PE Digest

  c4:3f:1a:39:0a:00:15:31:42:98:12:ae:aa:6e:f1:b3:a0:d9:1b:7c:8b:a0:e3:07:71:3e:fd:78:96:14:9e:4b

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Kiyo Corporation

  30-03-2023 11:03

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  memset

  wcsncmp

  memmove

  wcsncpy

  wcsstr

  _wcsnicmp

  _wcsdup

  free

  _wcsicmp

  wcslen

  wcscpy

  wcscmp

  memcpy

  tolower

  wcscat

  malloc

  kernel32

  GetModuleHandleW

  HeapCreate

  GetStdHandle

  HeapDestroy

  ExitProcess

  WriteFile

  GetTempFileNameW

  LoadLibraryExW

  EnumResourceTypesW

  FreeLibrary

  RemoveDirectoryW

  GetExitCodeProcess

  EnumResourceNamesW

  GetCommandLineW

  LoadResource

  SizeofResource

  FreeResource

  FindResourceW

  GetNativeSystemInfo

  GetShortPathNameW

  GetWindowsDirectoryW

  GetSystemDirectoryW

  EnterCriticalSection

  CloseHandle

  LeaveCriticalSection

  InitializeCriticalSection

  WaitForSingleObject

  TerminateThread

  CreateThread

  Sleep

  GetProcAddress

  GetVersionExW

  WideCharToMultiByte

  HeapAlloc

  HeapFree

  LoadLibraryW

  GetCurrentProcessId

  GetCurrentThreadId

  GetModuleFileNameW

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GetCurrentProcess

  TerminateProcess

  SetUnhandledExceptionFilter

  HeapSize

  MultiByteToWideChar

  CreateDirectoryW

  SetFileAttributesW

  GetTempPathW

  DeleteFileW

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  CreateFileW

  SetFilePointer

  TlsFree

  TlsGetValue

  TlsSetValue

  TlsAlloc

  HeapReAlloc

  DeleteCriticalSection

  InterlockedCompareExchange

  InterlockedExchange

  GetLastError

  SetLastError

  UnregisterWait

  GetCurrentThread

  DuplicateHandle

  RegisterWaitForSingleObject

  user32

  CharUpperW

  CharLowerW

  MessageBoxW

  DefWindowProcW

  DestroyWindow

  GetWindowLongW

  GetWindowTextLengthW

  GetWindowTextW

  UnregisterClassW

  LoadIconW

  LoadCursorW

  RegisterClassExW

  IsWindowEnabled

  EnableWindow

  GetSystemMetrics

  CreateWindowExW

  SetWindowLongW

  SendMessageW

  SetFocus

  CreateAcceleratorTableW

  SetForegroundWindow

  BringWindowToTop

  GetMessageW

  TranslateAcceleratorW

  TranslateMessage

  DispatchMessageW

  DestroyAcceleratorTable

  PostMessageW

  GetForegroundWindow

  GetWindowThreadProcessId

  IsWindowVisible

  EnumWindows

  SetWindowPos

  gdi32

  GetStockObject

  comctl32

  InitCommonControlsEx

  shell32

  ShellExecuteExW

  SHGetFolderLocation

  SHGetPathFromIDListW

  winmm

  timeBeginPeriod

  ole32

  CoInitialize

  CoTaskMemFree

  shlwapi

  PathAddBackslashW

  PathRenameExtensionW

  PathQuoteSpacesW

  PathRemoveArgsW

  PathRemoveBackslashW

  Sections

  .code

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text

  Size: 53KB - Virtual size: 52KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 234KB - Virtual size: 234KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ