NRnR[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NRnR.exe
Size

12.7MB
MD5

541dd092bf8b272e3b0044cc9034bb0c
SHA1

482adc889414fb81146a6f83ae2b60b967061708
SHA256

1d8d9397969265c0c909bba8d4e41629b65a25511d937502961597153182c276
SHA512

52b673c5fd1753749656286f815b8b3e74d59c535d3eaead2ac8520142fdd457d753757d7acbb4d363077a286a74f66f702d847ce8d7a7e2bc20158d9aa1dc2f
SSDEEP

393216:Jg2NkvVHHRrqNjG7s2C93Px5Uc5+T2Uhs5CGXlP46phY7:JXMH5X

Score

1^/10

Malware Config

Signatures

Files

NRnR.exe
.exe windows x86

f6e67c2c281ab3ac4a7e5002404317d7

Code Sign

05:a7:d5:72:24:e9:12:c4:31:99:24:0e:9f:64:7a:4a
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

29/11/2023, 23:59

Subject

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:be:91:35:61:37:61:3e:57:68:3e:60:3e:c5:38:bd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

17/05/2021, 00:00

Not After

21/05/2024, 23:59

Subject

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c9:c7:25:c5:db:4e:d7:c2:5e:d8:9f:52:72:de:a3:ea:5e:d6:38:3b:e8:6c:09:55:76:a6:72:34:3f:9b:e7:4f
Signer

Actual PE Digest

c9:c7:25:c5:db:4e:d7:c2:5e:d8:9f:52:72:de:a3:ea:5e:d6:38:3b:e8:6c:09:55:76:a6:72:34:3f:9b:e7:4f

Digest Algorithm

sha256

PE Digest Matches

true

dd:7c:0d:8e:d3:89:af:c9:09:7a:18:9e:15:2e:35:6f:d2:e0:59:1f
Signer

Actual PE Digest

dd:7c:0d:8e:d3:89:af:c9:09:7a:18:9e:15:2e:35:6f:d2:e0:59:1f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wintrust

CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
WinVerifyTrust
WintrustGetRegPolicyFlags

winhttp

WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpSetOption
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpSetCredentials
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
WinHttpSetStatusCallback
WinHttpQueryOption

kernel32

GetFileAttributesW
RemoveDirectoryW
DeviceIoControl
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
OpenProcess
FreeLibrary
LoadLibraryExW
CopyFileW
MoveFileExW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalFree
GetPrivateProfileIntW
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
ExpandEnvironmentStringsW
ProcessIdToSessionId
FormatMessageW
WTSGetActiveConsoleSessionId
CreateFileW
GetProcAddress
SetEvent
CreateEventW
GetModuleHandleW
LoadLibraryW
MulDiv
GetCurrentProcessId
GetCurrentThreadId
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
GetEnvironmentVariableW
SetCurrentDirectoryW
CompareFileTime
CreateDirectoryW
GetTempFileNameW
ResetEvent
WaitForMultipleObjects
GetCurrentThread
OpenThread
GetModuleFileNameW
GetUserDefaultLangID
GetLocalTime
lstrcmpiW
SetDllDirectoryW
GetTempPathW
GetSystemDirectoryW
GetSystemDefaultLangID
GetCommandLineW
GetDiskFreeSpaceExW
LocalFileTimeToFileTime
QueryDosDeviceW
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
FileTimeToSystemTime
SystemTimeToFileTime
CompareStringW
GetLocaleInfoW
GetLocaleInfoA
GetUserDefaultLCID
VerSetConditionMask
VerifyVersionInfoW
GetSystemTime
FormatMessageA
GetFileSize
ReadFile
SetFilePointer
ReadProcessMemory
VirtualQuery
GetLongPathNameW
lstrlenW
lstrcmpA
lstrcmpW
CreateEventA
WaitForSingleObjectEx
InterlockedIncrement
InterlockedDecrement
CreateWaitableTimerW
SetWaitableTimer
FindNextFileW
CreateMutexW
ReleaseMutex
SetFilePointerEx
GetFileSizeEx
SetEndOfFile
WriteFile
FlushFileBuffers
GetFileInformationByHandle
LoadResource
CreateSemaphoreW
ReleaseSemaphore
GetTimeFormatW
GetDateFormatW
GetSystemInfo
GetFileAttributesExW
GetCurrentDirectoryW
GetFileType
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
AreFileApisANSI
CreateWaitableTimerA
GetLogicalProcessorInformation
OpenEventA
FindResourceExW
DeleteCriticalSection
SetErrorMode
FlushInstructionCache
FindFirstFileW
WritePrivateProfileStringW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
GetVersionExA
CreateFileA
ExitProcess
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetThreadLocale
GetTimeZoneInformation
FileTimeToLocalFileTime
CompareStringA
GetModuleHandleExW
GetModuleFileNameA
DeleteTimerQueueTimer
CreateTimerQueueTimer
AllocConsole
GetComputerNameW
GetCurrencyFormatW
GetNumberFormatW
GetVolumeInformationW
OutputDebugStringA
GetTempFileNameA
FindClose
DeleteFileW
GetTickCount
Sleep
GetCurrentProcess
SetLastError
CloseHandle
LocalFree
GetTempPathA
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
LocalAlloc
FindResourceW
SizeofResource
CancelWaitableTimer
LockResource
GetProcessHeap
HeapSize
UnhandledExceptionFilter
GetLogicalDriveStringsW
GetModuleHandleA
GetVersionExW
SetFileTime
GetThreadContext
SetUnhandledExceptionFilter
TerminateProcess
GlobalAlloc
GlobalUnlock
GlobalSize
GlobalLock
lstrlenA
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SetFileAttributesW
WaitForMultipleObjectsEx
ExitThread
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetEnvironmentVariableA
SetEnvironmentVariableW
GetStdHandle
GetACP
GetPrivateProfileSectionW
IsValidLocale
EnumSystemLocalesW
SetStdHandle
WriteConsoleW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetThreadPriority
SetThreadPriority
TerminateThread
ResumeThread
CreateThread
GetProcessTimes
OpenEventW
GetWindowsDirectoryW
GetShortPathNameW
lstrcpyW
VirtualFree
VirtualAlloc
OutputDebugStringW
IsDebuggerPresent
QueryPerformanceFrequency
QueryPerformanceCounter
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DuplicateHandle
TryEnterCriticalSection
EncodePointer
GetStringTypeW
LoadLibraryExA
VirtualProtect

user32

GetWindowTextW
OffsetRect
EqualRect
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
GetLayeredWindowAttributes
GetFocus
IsWindowVisible
GetAncestor
CreateWindowExW
GetScrollInfo
DeferWindowPos
SetScrollInfo
GetSysColor
CreateIconIndirect
GetIconInfo
DrawIconEx
LoadImageW
MessageBeep
AllowSetForegroundWindow
SetParent
EndPaint
BeginPaint
RegisterClassW
RedrawWindow
SetActiveWindow
LoadStringW
GetKeyState
GetKeyboardLayout
CreateCaret
SetCaretPos
UpdateLayeredWindow
RegisterClipboardFormatW
CountClipboardFormats
EnumClipboardFormats
IsClipboardFormatAvailable
GetClipboardData
GetClipboardSequenceNumber
DestroyWindow
FlashWindowEx
IsZoomed
IsIconic
KillTimer
GetMenuState
GetMenuItemID
GetMenuItemCount
TrackPopupMenuEx
UpdateWindow
EnableWindow
AnimateWindow
FlashWindow
SetWindowTextW
SetTimer
NotifyWinEvent
GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
AdjustWindowRectEx
WaitMessage
DeleteMenu
MonitorFromPoint
GetActiveWindow
GetWindowDC
EnumDisplayDevicesW
GetWindowPlacement
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
EnumDisplayMonitors
GetDCEx
InvalidateRect
ReleaseCapture
GetClassLongW
EnumThreadWindows
WindowFromPoint
EndDeferWindowPos
SetCapture
IsRectEmpty
GetMessageTime
MoveWindow
GetDoubleClickTime
ValidateRect
IsChild
GetCapture
GetAsyncKeyState
BeginDeferWindowPos
DestroyCaret
SystemParametersInfoW
CharPrevW
wsprintfW
EnableMenuItem
GetSystemMenu
CharNextW
FindWindowW
ExitWindowsEx
LoadStringA
UnregisterClassW
GetWindowThreadProcessId
GetForegroundWindow
SetFocus
AttachThreadInput
MonitorFromWindow
DestroyIcon
LoadIconW
GetDesktopWindow
ReleaseDC
GetDC
SetForegroundWindow
GetSystemMetrics
SetWindowPos
ShowWindow
IsWindow
PostMessageW
SendMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
PostQuitMessage
RegisterClassExW
GetClassInfoExW
GetWindow
LoadCursorFromFileA
DestroyCursor
SendMessageTimeoutW
CopyRect
SetCursor
SetClassLongW
LoadCursorW
ClientToScreen
PtInRect
ScreenToClient
GetCursorPos
RegisterWindowMessageW
CallWindowProcW
SetWindowLongW
GetWindowLongW
DefWindowProcW
CharUpperW
DispatchMessageA
GetMessageW
GetMessageA
IsWindowUnicode
MsgWaitForMultipleObjectsEx
IsMenu

gdi32

GetStockObject
SetLayout
GetObjectA
CreateFontW
EnumFontFamiliesExW
GetFontUnicodeRanges
StartDocW
CreateBitmap
StartPage
EndPage
EndDoc
GetClipBox
SaveDC
SetViewportOrgEx
RestoreDC
GetGlyphIndicesW
AddFontMemResourceEx
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
GetLayout
DeleteObject
GetDIBits
SetMapMode
CreateDCW
GetDeviceCaps
GetObjectW

ole32

DoDragDrop
ReleaseStgMedium
OleInitialize
RevokeDragDrop
StringFromGUID2
CoCreateGuid
RegisterDragDrop
OleUninitialize
PropVariantClear
CoInitializeEx
CoUninitialize
CLSIDFromString
StringFromIID
IIDFromString
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoInitialize

oleaut32

VariantCopy
SysFreeString
VarUI4FromStr
SysAllocString
SysAllocStringLen
SysStringLen
VariantInit
SafeArrayDestroy
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
SysStringByteLen
VariantCopyInd
VarBstrCat
VariantClear
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayUnlock
SafeArrayCreate
SysAllocStringByteLen

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSQueryUserToken

imagehlp

MapFileAndCheckSumW

psapi

GetModuleFileNameExW

oleacc

LresultFromObject
AccessibleObjectFromWindow

imm32

ImmReleaseContext
ImmNotifyIME
ImmAssociateContextEx
ImmSetCandidateWindow
ImmGetContext
ImmIsIME
ImmGetCompositionStringW

winmm

PlaySoundW

urlmon

FindMimeFromData

iphlpapi

IpReleaseAddress
IpRenewAddress
GetInterfaceInfo
GetAdaptersInfo
FlushIpNetTable

dnsapi

DnsQuery_W

uxtheme

GetThemePartSize
DrawThemeBackground
CloseThemeData
OpenThemeData
SetWindowTheme
IsThemeBackgroundPartiallyTransparent

usp10

ScriptPlace
ScriptShape
ScriptBreak
ScriptItemize
ScriptApplyDigitSubstitution
ScriptFreeCache

gdiplus

GdipSetPenDashArray
GdipSetPenDashStyle
GdipSetPenMiterLimit
GdipSetPenLineJoin
GdipSetPenStartCap
GdipSetPenEndCap
GdipCreatePen2
GdipGetFontStyle
GdipAddPathString
GdipDrawString
GdipGetCellDescent
GdipMeasureString
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCreateFromHDC
GdipCreateFromHWND
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdipSetCompositingQuality
GdipSetPageUnit
GdipAddPathBezier
ord1
GdipSetPathFillMode
GdipClosePathFigure
GdipAddPathLine
GdipStartPathFigure
GdipIsVisiblePathPoint
GdipResetPath
GdipDrawRectangle
GdipFillRectangle
GdipDrawPie
GdipFillPie
GdipDrawEllipse
GdipFillEllipse
GdipCreateTexture
GdipShearMatrix
GdipScaleMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix
GdipMultiplyWorldTransform
GdipTransformPoints
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipEndContainer
GdipCreateBitmapFromGraphics
GdipDeleteGraphics
GdipGetImageWidth
GdipGetImageHeight
GdipAddPathRectangleI
GdipSetClipRect
GdipClonePath
GdipGetPathWorldBounds
GdipGraphicsClear
GdipGetImageGraphicsContext
GdipBeginContainer2
GdipRestoreGraphics
GdipSaveGraphics
GdipGetSmoothingMode
GdipTranslateWorldTransform
GdipSetClipRectI
GdipDrawLine
GdipFillRectanglesI
GdipDrawPath
GdipDeletePen
GdipCreatePen1
GdipSetPathGradientTransform
GdipSetPathGradientCenterPoint
GdipSetPathGradientWrapMode
GdipSetPathGradientPresetBlend
GdipCreatePathGradientFromPath
GdipAddPathEllipse
GdipSetLineWrapMode
GdipSetLinePresetBlend
GdipCreateMatrix2
GdipMultiplyLineTransform
GdipCreateLineBrush
GdipGetClipBoundsI
GdipFillPath
GdipAddPathLineI
GdipAddPathArcI
GdipDeletePath
GdipCreatePath
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipBitmapLockBits
GdiplusStartup
GdiplusShutdown
GdipDeleteFontFamily
GdipGetFamily
GdipCreateFontFromLogfontA
GdipGetEmHeight
GdipGetLineSpacing
GdipDrawImageI
GdipCreateHBITMAPFromBitmap
GdipDrawDriverString
GdipSetSmoothingMode
GdipGetFontSize
GdipDeleteFont
GdipGetCellAscent
GdipFree
GdipCreateFontFromDC
GdipAlloc
GdipGetFontHeightGivenDPI

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError
PrintDlgW

comctl32

ImageList_GetIconSize
ImageList_DrawEx
ImageList_Destroy

Sections

.text
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 315KB - Virtual size: 355KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 133B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 357KB - Virtual size: 357KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6e67c2c281ab3ac4a7e5002404317d7

Code Sign

05:a7:d5:72:24:e9:12:c4:31:99:24:0e:9f:64:7a:4aCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0b:be:91:35:61:37:61:3e:57:68:3e:60:3e:c5:38:bdCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

c9:c7:25:c5:db:4e:d7:c2:5e:d8:9f:52:72:de:a3:ea:5e:d6:38:3b:e8:6c:09:55:76:a6:72:34:3f:9b:e7:4fSigner

dd:7c:0d:8e:d3:89:af:c9:09:7a:18:9e:15:2e:35:6f:d2:e0:59:1fSigner

Headers

DLL Characteristics

File Characteristics

Imports

wintrust

winhttp

kernel32

user32

gdi32

ole32

oleaut32

wtsapi32

imagehlp

psapi

oleacc

imm32

winmm

urlmon

iphlpapi

dnsapi

uxtheme

usp10

gdiplus

winspool.drv

comdlg32

comctl32

Sections

.text Size: 4.9MB - Virtual size: 4.9MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 315KB - Virtual size: 355KB

.gfids Size: 4KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 133B

.rsrc Size: 6.0MB - Virtual size: 6.0MB

.reloc Size: 357KB - Virtual size: 357KB

05:a7:d5:72:24:e9:12:c4:31:99:24:0e:9f:64:7a:4a
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0b:be:91:35:61:37:61:3e:57:68:3e:60:3e:c5:38:bd
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

c9:c7:25:c5:db:4e:d7:c2:5e:d8:9f:52:72:de:a3:ea:5e:d6:38:3b:e8:6c:09:55:76:a6:72:34:3f:9b:e7:4f
Signer

dd:7c:0d:8e:d3:89:af:c9:09:7a:18:9e:15:2e:35:6f:d2:e0:59:1f
Signer

.text
Size: 4.9MB - Virtual size: 4.9MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 315KB - Virtual size: 355KB

.gfids
Size: 4KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 133B

.rsrc
Size: 6.0MB - Virtual size: 6.0MB

.reloc
Size: 357KB - Virtual size: 357KB