General

Malware Config

Signatures

Files

• 03246cda354d8efbc9e22057c.exe

  .exe windows x86

  6d316a43050170ce1b1c32ae694d931c

  
  

  Code Sign

  35:e2:8f:98:ab:f9:6c:90:49:19:20:f7:66:9f:83:4c

  Certificate

  Issuer

  CN=HIGXIQOKZYNZPSSLPH

  Not Before

  30-05-2019 07:37

  Not After

  31-12-2039 23:59

  Subject

  CN=HIGXIQOKZYNZPSSLPH

  Extended Key Usages

  ExtKeyUsageCodeSigning

  42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

  Certificate

  Issuer

  CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

  Not Before

  07-06-2005 08:09

  Not After

  30-05-2020 10:48

  Subject

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  27-04-2011 00:00

  Not After

  30-05-2020 10:48

  Subject

  CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

  Certificate

  Issuer

  CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  02-05-2019 00:00

  Not After

  30-05-2020 10:48

  Subject

  CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  ce:dd:15:07:20:29:0a:ce:c5:18:17:01:77:e8:21:62:31:1c:9b:30

  Signer

  Actual PE Digest

  ce:dd:15:07:20:29:0a:ce:c5:18:17:01:77:e8:21:62:31:1c:9b:30

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFilePointerEx

  SetLastError

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  UnhandledExceptionFilter

  VirtualQuery

  WaitForSingleObject

  WideCharToMultiByte

  WriteConsoleW

  WriteFile

  VirtualAlloc

  SetErrorMode

  GetStringTypeW

  GetStringTypeA

  LCMapStringW

  LCMapStringA

  GetLocaleInfoA

  HeapSize

  SetEvent

  HeapReAlloc

  HeapAlloc

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  LoadLibraryA

  EnterCriticalSection

  LeaveCriticalSection

  HeapFree

  VirtualFree

  HeapCreate

  InterlockedDecrement

  TlsFree

  TlsSetValue

  TlsAlloc

  TlsGetValue

  DeleteCriticalSection

  SetHandleCount

  GetEnvironmentStrings

  FreeEnvironmentStringsA

  GetModuleFileNameA

  ExitProcess

  GetCommandLineA

  SetEnvironmentVariableW

  QueryPerformanceCounter

  OpenEventW

  MultiByteToWideChar

  LocalFree

  LocalAlloc

  LoadLibraryW

  IsDebuggerPresent

  InterlockedIncrement

  InterlockedExchange

  InterlockedCompareExchange

  InitializeCriticalSectionAndSpinCount

  GetVolumeInformationW

  GetTimeZoneInformation

  GetTimeFormatW

  GetTickCount

  GetSystemTimeAsFileTime

  GetStdHandle

  GetStartupInfoA

  GetProcAddress

  GetPrivateProfileStringA

  GetModuleHandleW

  GetModuleHandleA

  GetModuleFileNameW

  GetLastError

  GetEnvironmentStringsW

  GetFileType

  GetDateFormatW

  GetCurrentThreadId

  GetCurrentProcessId

  GetCurrentProcess

  GetCommandLineW

  GetAtomNameA

  FreeLibrary

  FreeEnvironmentStringsW

  FormatMessageW

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  ExpandEnvironmentStringsW

  CreateThread

  CreateMutexW

  CreateHardLinkA

  CreateEventW

  RtlUnwind

  CloseHandle

  user32

  LoadCursorW

  LoadIconA

  keybd_event

  UnregisterHotKey

  UnhookWindowsHookEx

  ShowCaret

  SetWindowsHookExW

  SetProcessDefaultLayout

  SetKeyboardState

  SetForegroundWindow

  SetDeskWallpaper

  SendDlgItemMessageW

  RegisterWindowMessageW

  RegisterHotKey

  PostMessageW

  OemToCharW

  MapVirtualKeyExA

  LoadStringW

  IsCharAlphaNumericA

  InvertRect

  InvalidateRect

  GetWindowThreadProcessId

  GetWindowRgn

  GetUpdateRect

  GetMonitorInfoW

  GetMenuState

  GetLastActivePopup

  GetKeyState

  GetForegroundWindow

  GetDlgItemTextW

  GetDlgItem

  GetClipboardSequenceNumber

  GetAsyncKeyState

  EnumDisplayMonitors

  EndDialog

  EnableWindow

  DlgDirListW

  DialogBoxParamW

  DestroyIcon

  CharUpperW

  CallNextHookEx

  AttachThreadInput

  wsprintfW

  gdi32

  SetDIBitsToDevice

  SetDCPenColor

  SetDCBrushColor

  STROBJ_bGetAdvanceWidths

  RoundRect

  Polyline

  PolyTextOutA

  Pie

  GetWinMetaFileBits

  GetMetaFileW

  GetMetaFileA

  GetLogColorSpaceA

  GetDIBits

  GetDCBrushColor

  GetArcDirection

  GdiPlayEMF

  GdiEntry16

  GdiConvertEnhMetaFile

  ExcludeClipRect

  EngDeleteSemaphore

  EngComputeGlyphSet

  EngCheckAbort

  DeviceCapabilitiesExW

  DeleteObject

  CreateColorSpaceA

  SetFontEnumeration

  advapi32

  StartServiceCtrlDispatcherW

  SetServiceStatus

  RegisterServiceCtrlHandlerExW

  RegSetValueExW

  RegQueryValueExW

  RegQueryInfoKeyW

  RegOpenKeyW

  RegOpenKeyExW

  RegEnumValueW

  RegConnectRegistryW

  RegCloseKey

  OpenServiceW

  OpenSCManagerW

  OpenProcessToken

  ControlService

  CloseServiceHandle

  RegOpenKeyExA

  shell32

  SHGetFolderPathW

  SHGetFileInfoW

  ExtractIconExW

  CommandLineToArgvW

  ShellExecuteExW

  Sections

  .text

  Size: 47KB - Virtual size: 47KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1004KB - Virtual size: 1004KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 27KB - Virtual size: 1011KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ