Windscribe_2[.]5[.]18[.]exe

Resubmissions

12-04-2023 13:34

230412-qt4w1aea81 10

12-04-2023 13:31

230412-qscq5acf39 6

Sharing

Copy URL

Twitter E-mail

General

Target

Windscribe_2.5.18.exe
Size

18.8MB
MD5

5729d7f8fff698e46f35abc7d904ece9
SHA1

7017eb70ff16eeaf91e9e9f7d60b938f83fb0169
SHA256

a58515e3c3b350de864bfd41ebd570724efdffe44e17de571f78da74b5ef7475
SHA512

e7d7c26484daf285cdc0d436ba2e9298cb9594a32181fffc62ce3f2d5bfc894445417e28fd2af8e9c1558d15540be61f8154ac70f275fdec827db881201eace7
SSDEEP

393216:aaeuojgBv0B53Y6dwzrR0ncZutc6RDHqgu3LO4QK+N2ubT1EPIg9z5sc:aaHHBMB5I62inUbgua1jN201tksc

Score

1^/10

Malware Config

Signatures

Files

Windscribe_2.5.18.exe
.exe windows x64

7a732d9ad9717304f63be8c36d161af9

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:5e:e4:3b:ee:a5:0e:d5:f0:ec:76:5b:f6:5b:13:50
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03-02-2021 00:00

Not After

05-03-2024 23:59

Subject

CN=Windscribe Limited,O=Windscribe Limited,L=Richmond Hill,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

17:30:b4:0e:ee:cd:38:94:1c:c8:c6:08:dc:9e:db:a8:a7:5c:27:e0:00:94:3b:ad:35:5d:88:37:37:0b:38:96
Signer

Actual PE Digest

17:30:b4:0e:ee:cd:38:94:1c:c8:c6:08:dc:9e:db:a8:a7:5c:27:e0:00:94:3b:ad:35:5d:88:37:37:0b:38:96

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Windscribe Limited,O=Windscribe Limited,L=Richmond Hill,ST=Ontario,C=CA

07-12-2022 16:36
Valid: true

Chain 1

CN=Windscribe Limited,O=Windscribe Limited,L=Richmond Hill,ST=Ontario,C=CA

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FindFirstFileW
FindNextFileW
FindClose
WaitForSingleObject
OpenProcess
CloseHandle
GetLocalTime
SetConsoleCtrlHandler
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
SetDefaultDllDirectories
GetCommandLineW
QueryFullProcessImageNameW
GetSystemDirectoryW
OutputDebugStringW
GetFullPathNameW
TerminateProcess
CreateProcessW
GetExitCodeProcess
CreateDirectoryW
SetLastError
Wow64DisableWow64FsRedirection
WriteConsoleW
SetEndOfFile
CreateFileW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
SleepEx
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
FlushFileBuffers
HeapReAlloc
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
WriteFile
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
ReadFile
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlPcToFileHeader
DeleteFileW
lstrcmpW
lstrcmpiW
lstrlenW
MoveFileExW
RemoveDirectoryW
GetTickCount
Sleep
FreeLibrary
LoadLibraryW
GetProcAddress
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
VerifyVersionInfoW
VerSetConditionMask
GetLastError
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
FreeResource
SizeofResource
AreFileApisANSI
GetACP
GetFileAttributesW
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
LCMapStringEx
EncodePointer
GetModuleHandleW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStringTypeW
MultiByteToWideChar
GetExitCodeThread
WaitForSingleObjectEx
GetCurrentThreadId
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock

user32

PostQuitMessage
IsZoomed
SetCapture
LoadIconW
AdjustWindowRect
ClientToScreen
PtInRect
GetWindowInfo
ShowWindow
GetWindowLongPtrW
GetSystemMetrics
SetWindowRgn
SetWindowLongPtrW
ReleaseCapture
MessageBoxW
EqualRect
SetWindowPos
DestroyWindow
GetWindowTextW
RedrawWindow
SetWindowTextW
RegisterWindowMessageW
EnumWindows
GetWindowThreadProcessId
WaitForInputIdle
DefWindowProcW
UpdateWindow
InvalidateRect
SetTimer
SetCursor
MonitorFromWindow
KillTimer
GetWindowRect
GetDC
CreateWindowExW
SendMessageW
ScreenToClient
GetClientRect
RegisterClassExW
TrackMouseEvent
LoadCursorW
GetMonitorInfoW
ReleaseDC
TranslateMessage
DispatchMessageW
PostMessageW
GetMessageW
EndPaint
BeginPaint

gdi32

SetTextColor
SetBkMode
CreateRectRgnIndirect
AddFontMemResourceEx
DeleteObject
CreateFontIndirectW
CreateCompatibleDC
GetDeviceCaps
DeleteDC
GetStockObject

advapi32

CloseServiceHandle
OpenSCManagerW
ControlService
OpenServiceW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey

shell32

SHBrowseForFolderW
SHAppBarMessage
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHChangeNotify
SHGetKnownFolderPath
CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

ole32

CoInitialize
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoTaskMemFree
CreateStreamOnHGlobal
CoInitializeEx

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

gdiplus

GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateFromHDC
GdipFree
GdipCreateImageAttributes
GdipSetSmoothingMode
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipDisposeImageAttributes
GdipAlloc
GdipSetImageAttributesColorMatrix
GdipGetImageHeight
GdipDeleteStringFormat
GdipDrawImage
GdipCloneBrush
GdipDrawString
GdipClosePathFigure
GdipFillRectangle
GdipDrawImageI
GdipFillPath
GdipCreateSolidFill
GdipSetStringFormatLineAlign
GdipCreatePath
GdipDeletePath
GdipDeleteBrush
GdipAddPathArcI
GdipCreateStringFormat
GdipSetStringFormatAlign
GdipPrivateAddMemoryFont
GdipDeletePrivateFontCollection
GdipCloneFontFamily
GdipNewPrivateFontCollection
GdipDeleteFont
GdipGetFontCollectionFamilyList
GdipCreateFont
GdipDeleteFontFamily
GdipCreatePen1
GdipDeletePen
GdipDrawArcI
GdipDrawImageRectRectI
GdiplusStartup
GdipGetImageWidth
GdiplusShutdown
GdipAddPathLineI
GdipCloneImage
GdipMeasureString
GdipDrawImageRectI
GdipLoadImageFromStream
GdipFillRectangleI

dwmapi

DwmIsCompositionEnabled
DwmExtendFrameIntoClientArea
DwmSetWindowAttribute

shlwapi

PathIsPrefixW
PathIsDirectoryEmptyW
PathRemoveBackslashW
PathIsRootW
PathAppendW

uxtheme

IsThemeActive

setupapi

SetupDiEnumDeviceInfo
SetupDiSetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW

Sections

.text
Size: 369KB - Virtual size: 368KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18.3MB - Virtual size: 18.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

7a732d9ad9717304f63be8c36d161af9

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0f:5e:e4:3b:ee:a5:0e:d5:f0:ec:76:5b:f6:5b:13:50Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

17:30:b4:0e:ee:cd:38:94:1c:c8:c6:08:dc:9e:db:a8:a7:5c:27:e0:00:94:3b:ad:35:5d:88:37:37:0b:38:96Signer

Signature Validations

Verification

07-12-2022 16:36 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

dwmapi

shlwapi

uxtheme

setupapi

Sections

.text Size: 369KB - Virtual size: 368KB

.rdata Size: 120KB - Virtual size: 120KB

.data Size: 7KB - Virtual size: 23KB

.pdata Size: 15KB - Virtual size: 15KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 18.3MB - Virtual size: 18.3MB

.reloc Size: 3KB - Virtual size: 2KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0f:5e:e4:3b:ee:a5:0e:d5:f0:ec:76:5b:f6:5b:13:50
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

17:30:b4:0e:ee:cd:38:94:1c:c8:c6:08:dc:9e:db:a8:a7:5c:27:e0:00:94:3b:ad:35:5d:88:37:37:0b:38:96
Signer

07-12-2022 16:36
Valid: true

.text
Size: 369KB - Virtual size: 368KB

.rdata
Size: 120KB - Virtual size: 120KB

.data
Size: 7KB - Virtual size: 23KB

.pdata
Size: 15KB - Virtual size: 15KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 18.3MB - Virtual size: 18.3MB

.reloc
Size: 3KB - Virtual size: 2KB