General

Malware Config

Signatures

Files

• Setup64.exe

  .exe windows x86

  Password: mo2021**

  60324a972222e6e43f74642c909d6552

  
  

  Code Sign

  33:00:00:04:90:0e:61:14:98:12:78:23:70:00:00:00:00:04:90

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12-05-2022 20:47

  Not After

  11-05-2023 20:47

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06-07-2010 20:40

  Not After

  06-07-2025 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  15:e2:29:fe:14:35:70:74:b6:6a:98:f8:0b:49:59:7c

  Certificate

  Issuer

  CN=C2RService,O=C2RService,L=Redmond,ST=Washington,C=US

  Not Before

  17-02-2017 00:12

  Not After

  31-12-2039 23:59

  Subject

  CN=C2RService,O=C2RService,L=Redmond,ST=Washington,C=US

  b9:f2:07:9e:65:87:c7:7d:ec:a6:92:92:17:c3:15:f3:33:43:3d:07

  Signer

  Actual PE Digest

  b9:f2:07:9e:65:87:c7:7d:ec:a6:92:92:17:c3:15:f3:33:43:3d:07

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=C2RService,O=C2RService,L=Redmond,ST=Washington,C=US

  30-03-2023 10:56

  Valid: false

  e0:ea:f9:42:aa:c9:44:e0:ea:8b:6e:1d:ac:c2:a9:da:a4:b7:08:33:55:f2:1c:96:82:62:bf:42:ec:01:a7:79

  Signer

  Actual PE Digest

  e0:ea:f9:42:aa:c9:44:e0:ea:8b:6e:1d:ac:c2:a9:da:a4:b7:08:33:55:f2:1c:96:82:62:bf:42:ec:01:a7:79

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  30-03-2023 10:56

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  Imports

  advapi32

  ConvertSidToStringSidW

  OpenProcessToken

  GetTokenInformation

  RegSetValueExW

  RegQueryValueExW

  RegCreateKeyExW

  RegOpenKeyExW

  RegCloseKey

  CryptAcquireContextW

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  CryptDestroyHash

  CryptReleaseContext

  CreateWellKnownSid

  CheckTokenMembership

  RegEnumKeyExW

  RegQueryInfoKeyW

  RegEnumValueW

  RegDeleteTreeW

  RegDeleteKeyW

  RegGetValueW

  RegDeleteValueW

  IsValidSid

  GetSidSubAuthorityCount

  GetSidSubAuthority

  EventWriteTransfer

  EventRegister

  EventUnregister

  GetFileSecurityW

  SetFileSecurityW

  RegNotifyChangeKeyValue

  RevertToSelf

  OpenThreadToken

  GetLengthSid

  CopySid

  InitializeAcl

  AddAccessAllowedAce

  AllocateAndInitializeSid

  FreeSid

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  GetSecurityDescriptorDacl

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ConvertSidToStringSidA

  EqualSid

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  OpenSCManagerW

  CloseServiceHandle

  OpenServiceW

  QueryServiceStatusEx

  QueryServiceConfigW

  StartServiceW

  ControlService

  EnumDependentServicesW

  ChangeServiceConfigW

  RegEnumValueA

  RegDeleteValueA

  RegGetValueA

  EventWrite

  ole32

  CoInitialize

  CoCancelCall

  CLSIDFromString

  CoRevokeInitializeSpy

  CoRegisterInitializeSpy

  CreateStreamOnHGlobal

  CoTaskMemAlloc

  CoTaskMemFree

  StringFromCLSID

  CoCreateInstance

  CoSetProxyBlanket

  CoCreateGuid

  StringFromGUID2

  CoCreateFreeThreadedMarshaler

  IIDFromString

  CoInitializeSecurity

  CoInitializeEx

  CoUninitialize

  CoEnableCallCancellation

  CoDisableCallCancellation

  gdi32

  SetDCBrushColor

  SetDCPenColor

  GetTextMetricsW

  CreateFontW

  SetBkColor

  SetTextColor

  DeleteObject

  Rectangle

  GetStockObject

  CreatePen

  GetTextExtentPoint32W

  GetDeviceCaps

  SelectObject

  CreateSolidBrush

  oleaut32

  VariantInit

  VariantClear

  SysFreeString

  SysAllocString

  kernel32

  RtlUnwind

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCPInfo

  EncodePointer

  CloseThreadpoolWork

  FreeLibraryWhenCallbackReturns

  IsProcessorFeaturePresent

  DeleteTimerQueueTimer

  CloseHandle

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  LoadLibraryW

  SetLastError

  GetModuleFileNameW

  OutputDebugStringA

  CompareStringEx

  LocalFree

  HeapFree

  GetProcessHeap

  GetCurrentProcess

  GetCurrentProcessId

  FreeLibrary

  CreateThread

  GetCurrentThreadId

  GetExitCodeThread

  CreateEventExW

  WriteFile

  DeleteFileW

  WideCharToMultiByte

  IsWow64Process

  GetModuleHandleExW

  ExpandEnvironmentStringsW

  GlobalFree

  MultiByteToWideChar

  RaiseException

  InitializeCriticalSectionEx

  DeleteCriticalSection

  DecodePointer

  CreateMutexW

  GetNativeSystemInfo

  VerSetConditionMask

  VerifyVersionInfoW

  GetUserDefaultLocaleName

  FlsFree

  FlsAlloc

  AttachConsole

  AllocConsole

  GetStdHandle

  WriteConsoleW

  FreeConsole

  LocaleNameToLCID

  FindClose

  UnmapViewOfFile

  CreateFileA

  CreateFileMappingA

  GetFileSize

  MapViewOfFile

  Sleep

  GetStringTypeExW

  GetUserDefaultLCID

  LoadLibraryA

  LCMapStringW

  FormatMessageA

  InitializeSRWLock

  AcquireSRWLockExclusive

  ReleaseSRWLockExclusive

  AcquireSRWLockShared

  ReleaseSRWLockShared

  GetProcessTimes

  GetTickCount64

  GetSystemTimeAsFileTime

  TerminateProcess

  GetModuleFileNameA

  GetShortPathNameA

  K32GetModuleFileNameExW

  CreateProcessW

  LoadLibraryExW

  FindResourceW

  SizeofResource

  LoadResource

  OpenProcess

  GlobalMemoryStatusEx

  GetVersionExW

  GetDiskFreeSpaceExW

  CreateFileW

  DeviceIoControl

  SetErrorMode

  GetComputerNameW

  MulDiv

  FormatMessageW

  GetLogicalProcessorInformation

  GetSystemDirectoryW

  HeapAlloc

  IsValidCodePage

  GetSystemTime

  SystemTimeToFileTime

  FileTimeToSystemTime

  GetCPInfoExW

  CreateEventW

  SetEvent

  WaitForSingleObject

  WaitForMultipleObjectsEx

  WakeConditionVariable

  WakeAllConditionVariable

  SleepConditionVariableSRW

  CloseThreadpoolTimer

  SetThreadpoolTimer

  CreateThreadpoolTimer

  CloseThreadpoolWait

  SetThreadpoolWait

  WaitForThreadpoolWaitCallbacks

  CreateThreadpoolWait

  CreateThreadpoolWork

  SubmitThreadpoolWork

  ReleaseSemaphore

  WaitForSingleObjectEx

  QueryDepthSList

  TryEnterCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  InitializeSListHead

  InterlockedPushEntrySList

  InterlockedPopEntrySList

  RtlCaptureStackBackTrace

  TzSpecificLocalTimeToSystemTime

  OpenEventW

  ReleaseMutex

  CreateMutexExW

  OpenMutexW

  GetTempPathW

  GetLongPathNameW

  TlsAlloc

  TlsFree

  FlsGetValue

  TlsGetValue

  FlsSetValue

  TlsSetValue

  ResetEvent

  IsDebuggerPresent

  GetFileAttributesExW

  FindFirstFileExW

  MoveFileExW

  FindNextFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetFileAttributesW

  ReadFile

  SetFilePointerEx

  SetEndOfFile

  GetFileSizeEx

  FlushFileBuffers

  LockFileEx

  UnlockFileEx

  GetFileInformationByHandleEx

  GetCurrentDirectoryW

  GetTempFileNameW

  CopyFileExW

  GetVolumePathNamesForVolumeNameW

  SetFileInformationByHandle

  CreateFileMappingW

  WaitForMultipleObjects

  OpenThread

  GetFileType

  SetFilePointer

  GetOverlappedResult

  GetFileAttributesW

  GetFileTime

  ReplaceFileW

  CopyFileW

  QueryPerformanceCounter

  QueryPerformanceFrequency

  GlobalAlloc

  LockResource

  SetFileTime

  CancelIoEx

  GetProcessAffinityMask

  CreateWaitableTimerW

  SetWaitableTimerEx

  CancelWaitableTimer

  GetTickCount

  WerRegisterMemoryBlock

  WerUnregisterMemoryBlock

  QueryFullProcessImageNameW

  CreateIoCompletionPort

  PostQueuedCompletionStatus

  GetThreadIOPendingFlag

  GetCurrentThread

  GetQueuedCompletionStatus

  GetStartupInfoW

  CreateMemoryResourceNotification

  GetSystemPowerStatus

  IsSystemResumeAutomatic

  QueryUnbiasedInterruptTime

  OutputDebugStringW

  OpenEventA

  CreateEventA

  OpenMutexA

  CreateMutexA

  OpenSemaphoreA

  CreateSemaphoreA

  OpenFileMappingA

  LocalAlloc

  GetThreadLocale

  FindFirstFileW

  lstrcmpW

  FlushViewOfFile

  GetFullPathNameW

  DeleteFileA

  GetTempPathA

  ProcessIdToSessionId

  GetCommandLineW

  SetEnvironmentVariableW

  GetPriorityClass

  GetExitCodeProcess

  K32EnumProcesses

  GetTimeZoneInformation

  IsValidLocale

  GetLocaleInfoEx

  LCIDToLocaleName

  LCMapStringEx

  GetSystemDefaultLCID

  ResolveLocaleName

  EnumSystemLocalesEx

  GetSystemDefaultLocaleName

  GetFileAttributesA

  LoadLibraryExA

  GetLocaleInfoW

  GetUserPreferredUILanguages

  GetACP

  GetUserGeoID

  AreFileApisANSI

  HeapCreate

  GetDiskFreeSpaceW

  LockFile

  InitializeCriticalSection

  GetFullPathNameA

  HeapValidate

  HeapSize

  GetDiskFreeSpaceA

  HeapReAlloc

  GetSystemInfo

  HeapCompact

  HeapDestroy

  UnlockFile

  K32GetProcessMemoryInfo

  GetPhysicallyInstalledSystemMemory

  GetProductInfo

  SwitchToThread

  InitializeCriticalSectionAndSpinCount

  SleepConditionVariableCS

  InitializeConditionVariable

  InitOnceBeginInitialize

  InitOnceComplete

  GetFileInformationByHandle

  GetStringTypeW

  GetSystemPreferredUILanguages

  K32GetProcessImageFileNameW

  GetDateFormatW

  GetTimeFormatW

  GetDriveTypeW

  GetThreadTimes

  FreeLibraryAndExitThread

  VirtualProtect

  ExitThread

  GetConsoleMode

  ReadConsoleW

  GetConsoleOutputCP

  CreateTimerQueueTimer

  ExitProcess

  GetOEMCP

  EnumSystemLocalesW

  CompareStringW

  SetStdHandle

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  VirtualQuery

  WaitForThreadpoolTimerCallbacks

  GetLocalTime

  ws2_32

  WSAStartup

  WSACleanup

  FreeAddrInfoW

  GetAddrInfoW

  setupapi

  SetupIterateCabinetW

  gdiplus

  GdipCreateSolidFill

  GdipGetImageGraphicsContext

  GdipGetImageWidth

  GdipGetImageHeight

  GdipCreateBitmapFromScan0

  GdipDisposeImage

  GdipCloneImage

  GdipDeleteBrush

  GdipFree

  GdipLoadImageFromStream

  GdipDrawImageRectI

  GdiplusStartup

  GdipDrawImageRectRectI

  GdipDeleteGraphics

  GdipCreateFromHDC

  GdipCloneBrush

  GdipFillRectangleI

  GdipAlloc

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1.8MB - Virtual size: 1.8MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 190KB - Virtual size: 259KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 374KB - Virtual size: 373KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ