General

Malware Config

Signatures

Files

• paint.net.5.0.3.install.anycpu.web.zip

  .zip
• paint.net.5.0.3.install.anycpu.web.exe

  .exe windows x86

  c1373dc39e6053e38570e95beb087bf4

  
  

  Code Sign

  87:3a:40:e7:ab:55:a6:56:d2:5d:8b:e8:74:ff:11:c7

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  23-08-2020 00:00

  Not After

  23-08-2023 23:59

  Subject

  CN=DOTPDN LLC,O=DOTPDN LLC,POSTALCODE=981541003,STREET=1001 4TH AVE STE 3200,L=SEATTLE,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  12-03-2019 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  9d:4d:fb:a7:4a:e7:72:84:22:28:f2:5e:ec:05:e7:a8:4c:25:e7:44:87:59:c6:ed:ed:00:a4:ac:9f:4c:e5:b8

  Signer

  Actual PE Digest

  9d:4d:fb:a7:4a:e7:72:84:22:28:f2:5e:ec:05:e7:a8:4c:25:e7:44:87:59:c6:ed:ed:00:a4:ac:9f:4c:e5:b8

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=DOTPDN LLC,O=DOTPDN LLC,POSTALCODE=981541003,STREET=1001 4TH AVE STE 3200,L=SEATTLE,ST=Washington,C=US

  29-03-2023 23:27

  Valid: true

  Chain 1

  CN=DOTPDN LLC,O=DOTPDN LLC,POSTALCODE=981541003,STREET=1001 4TH AVE STE 3200,L=SEATTLE,ST=Washington,C=US

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Chain 2

  CN=DOTPDN LLC,O=DOTPDN LLC,POSTALCODE=981541003,STREET=1001 4TH AVE STE 3200,L=SEATTLE,ST=Washington,C=US

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  comctl32

  InitCommonControlsEx

  kernel32

  GetSystemDirectoryW

  GetModuleHandleA

  lstrcatW

  GetProcAddress

  LoadLibraryExW

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  ReleaseSemaphore

  InitializeCriticalSection

  WaitForSingleObject

  GetLastError

  SetEvent

  CloseHandle

  ResetEvent

  CreateSemaphoreA

  CreateEventA

  WideCharToMultiByte

  MultiByteToWideChar

  AreFileApisANSI

  FreeLibrary

  LoadLibraryExA

  LoadLibraryA

  LoadLibraryW

  GetModuleFileNameA

  GetModuleFileNameW

  FormatMessageA

  FormatMessageW

  LocalFree

  GetWindowsDirectoryA

  GetWindowsDirectoryW

  GetSystemDirectoryA

  SetLastError

  CreateFileW

  SetFileTime

  SetFileAttributesA

  SetFileAttributesW

  RemoveDirectoryA

  RemoveDirectoryW

  MoveFileA

  MoveFileW

  GetModuleHandleW

  CreateDirectoryA

  CreateDirectoryW

  DeleteFileA

  DeleteFileW

  SetCurrentDirectoryA

  SetCurrentDirectoryW

  GetCurrentDirectoryA

  GetCurrentDirectoryW

  GetTempPathA

  GetTempPathW

  GetTickCount

  GetCurrentThreadId

  GetCurrentProcessId

  FindClose

  FindFirstFileA

  FindFirstFileW

  FindNextFileA

  FindNextFileW

  GetFileAttributesA

  GetFileAttributesW

  GetVersionExA

  FindFirstChangeNotificationA

  FindFirstChangeNotificationW

  GetLogicalDriveStringsA

  GetLogicalDriveStringsW

  CreateFileA

  GetFileSize

  SetFilePointer

  ReadFile

  WriteFile

  SetEndOfFile

  CompareFileTime

  GetProcessAffinityMask

  GetCurrentProcess

  GetSystemInfo

  GlobalMemoryStatus

  GetFileInformationByHandle

  GetStdHandle

  WaitForMultipleObjects

  Sleep

  GetCommandLineW

  CreateProcessA

  GetExitCodeProcess

  CompareStringOrdinal

  WriteConsoleW

  ReadConsoleW

  SetFilePointerEx

  GetFileSizeEx

  GetConsoleMode

  GetConsoleOutputCP

  FlushFileBuffers

  HeapSize

  SetConsoleCtrlHandler

  GetProcessHeap

  GetStringTypeW

  DecodePointer

  GetFileType

  SetStdHandle

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  FindFirstFileExW

  OutputDebugStringW

  HeapReAlloc

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  GetTimeFormatW

  GetDateFormatW

  GetCurrentThread

  HeapAlloc

  HeapFree

  ExitProcess

  GetModuleHandleExW

  FreeLibraryAndExitThread

  ResumeThread

  VirtualAlloc

  VirtualFree

  lstrlenW

  FindCloseChangeNotification

  ExitThread

  CreateThread

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  EncodePointer

  InterlockedFlushSList

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  RtlUnwind

  RaiseException

  InterlockedPushEntrySList

  user32

  ExitWindowsEx

  DestroyWindow

  LoadIconA

  EndDialog

  KillTimer

  SetTimer

  PostMessageA

  SendMessageA

  MessageBoxW

  CharPrevExA

  GetWindowTextW

  GetWindowTextLengthW

  SetWindowTextW

  CreateWindowExW

  RegisterClassW

  GetWindowTextA

  GetWindowTextLengthA

  SetWindowTextA

  CreateWindowExA

  RegisterClassA

  LoadStringW

  LoadStringA

  DialogBoxParamW

  CreateDialogParamW

  DialogBoxParamA

  CreateDialogParamA

  GetDialogBaseUnits

  MapDialogRect

  GetDlgItem

  GetWindowLongA

  SetWindowLongA

  ShowWindow

  MoveWindow

  ScreenToClient

  GetWindowRect

  CharUpperA

  CharUpperW

  SystemParametersInfoA

  advapi32

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  OpenProcessToken

  shell32

  ShellExecuteExA

  CommandLineToArgvW

  oleaut32

  VariantCopy

  VariantClear

  SysAllocString

  SysAllocStringLen

  SysStringLen

  Sections

  .text

  Size: 524KB - Virtual size: 523KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 71KB - Virtual size: 71KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 80KB - Virtual size: 80KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 20KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ