certreq[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

certreq.exe
Size

510KB
MD5

7d99c3b2eef43ca0548ff13d2d4a1ce8
SHA1

4c0a33bbe4d2ba923689c40e7a05a6e6a171b72f
SHA256

4065fb5985adbbc7ebaf8a366b231c92f951eebf5c65b95483d7e6167788aee6
SHA512

6694737b5223dee8a08c11b727fece18de51b99e1fd86eb616b85f2b0b04eb8ce12dde49820213bb9a6ac396fedaa272621a4ab6e33e0ac3a6428687bcc90171
SSDEEP

6144:M62AdniOoa+LXUHicxKwmiduCNsjFC0bQxJoKMncc5FtgTRjF/Q:L2KniOlKCxxEidxsjFLyyVnd5OzY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
certreq.exe

Files

certreq.exe
.exe windows x64

229aac8c84dbf30e51cda201437dc2c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptReleaseContext
CryptGenKey
CryptAcquireContextW
RevertToSelf
CryptDestroyKey
LogonUserExW
WaitServiceState

kernel32

DelayLoadFailureHook
ResolveDelayLoadedAPI
LocalAlloc
lstrcmpW
GetTickCount
GetSystemTimeAsFileTime
GetTempFileNameW
LocalFree
DecodePointer
RaiseException
DeleteFileW
GetFileAttributesW
EncodePointer

msvcrt

memcpy
memcmp
__iob_func
__C_specific_handler
_vsnwprintf
ferror
fflush
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_wcmdln
_wfopen_s
memset
memmove
_itoa_s
bsearch
memcpy_s
wcscpy_s
_stricmp
towupper
iswlower
iswupper
sscanf_s
strpbrk
strcmp
strcat_s
fclose
iswdigit
strcpy_s
strspn
_fileno
_setmode
getenv
fwrite
ftell
wcsstr
_swab
_wcsnicmp
wcsrchr
_wgetenv
_errno
fopen
wcscspn
strcspn
wcsncmp
free
malloc
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
strncmp
atoi
strchr
isdigit
qsort
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
towlower
_callnewh
_wcsicmp
_CxxThrowException
vfwprintf
_XcptFilter
_amsg_exit
__wgetmainargs
fprintf
fgets
__set_app_type
fgetws
fseek
exit
_exit
_cexit
__setusermatherr
_initterm
feof
fgetc
wcschr
wcscmp
_vsnprintf
fputws
__CxxFrameHandler3
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
iswspace
iswxdigit
_wtoi
gmtime
_wsetlocale
iswalpha
_wfopen

certcli

ord261
ord360
ord207
ord254
ord220
ord256
ord366
ord252
ord260
ord246
ord356
CAFindCertTypeByName
CACloseCertType
ord213
ord219
ord221
ord357
ord223
ord373
ord358
ord225
ord205
ord203
CAGetCertTypeProperty
CAFreeCertTypeProperty
ord359

gdi32

GetStockObject

ncrypt

NCryptFreeBuffer
NCryptSetProperty
NCryptOpenKey
NCryptFreeObject
NCryptGetProperty
NCryptOpenStorageProvider
NCryptIsKeyHandle
NCryptEnumStorageProviders

normaliz

IdnToUnicode

ntdll

NtQuerySystemTime
RtlGetPersistedStateLocation
RtlTimeToSecondsSince1970
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNtStatusToDosError
EtwTraceMessage

setupapi

SetupGetIntField
SetupGetStringFieldW
SetupFindNextLine
SetupGetFieldCount
SetupFindFirstLineW
SetupGetLineCountW
SetupOpenInfFileW
SetupCloseInfFile

profapi

ord104

wldap32

ord12
ord167
ord147
ord127
ord210
ord13
ord142
ord41
ord140
ord79
ord26
ord203
ord224
ord18
ord16

crypt32

CertFreeCRLContext
CertFreeCertificateContext
CertFindAttribute
CryptMsgUpdate
CryptMsgGetAndVerifySigner
CryptMsgClose
CryptDecodeObject
CryptHashPublicKeyInfo
CertEnumCRLsInStore
CryptMsgOpenToDecode
CryptMsgControl
CryptFindCertificateKeyProvInfo
CryptSignAndEncodeCertificate
CertEnumCertificatesInStore
CryptAcquireCertificatePrivateKey
CertDuplicateCertificateContext
CertCloseStore
CertGetCertificateChain
CryptFindOIDInfo
CryptMsgGetParam
CertFreeCertificateChain
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertVerifySubjectCertificateContext
CertFindExtension
CryptEncodeObjectEx
CryptDecodeObjectEx
CryptStringToBinaryW
CertGetNameStringW
CryptExportPublicKeyInfoEx
CryptSignCertificate
CertNameToStrW
CryptHashCertificate
CertSetStoreProperty
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertAddCertificateLinkToStore
CryptEnumOIDInfo
CryptFormatObject
CryptSignMessage
CertStrToNameW
CryptMsgOpenToEncode
CryptBinaryToStringW
CertCreateCertificateContext

ole32

CoTaskMemAlloc
CoInitialize
CoUninitialize
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CLSIDFromProgID
CLSIDFromString

oleaut32

SysAllocStringLen
VariantCopyInd
CreateErrorInfo
SetErrorInfo
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantInit
SysFreeString
SysStringByteLen
VariantClear
SysStringLen
SysAllocStringByteLen
SafeArrayGetElement
SysAllocString

rpcrt4

RpcStringBindingComposeW
NdrClientCall3
RpcExceptionFilter
RpcBindingFromStringBindingW
UuidToStringW
RpcStringFreeW
UuidIsNil
UuidFromStringW
RpcBindingFree
UuidCreate
RpcEpResolveBinding
RpcBindingSetAuthInfoExW
I_RpcMapWin32Status
I_RpcExceptionFilter

secur32

GetUserNameExW
GetComputerObjectNameW

user32

PostMessageW
UpdateWindow
CreateWindowExW
RegisterClassW
GetMessageW
DefWindowProcW
PostQuitMessage
LoadCursorW
SetCursor
LoadStringW
CharLowerW
MessageBoxW
GetDesktopWindow
TranslateMessage
LoadIconW
DispatchMessageW

wininet

InternetCrackUrlW
InternetCanonicalizeUrlW
InternetCreateUrlW

shlwapi

PathFindFileNameW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentThread
GetStartupInfoW
OpenThreadToken
OpenProcessToken
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadResource
FindResourceExW
LockResource
FreeLibrary
GetModuleHandleW
LoadLibraryExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalReAlloc

api-ms-win-core-file-l1-1-0

CreateFileW
FileTimeToLocalFileTime
SetEndOfFile
GetFileSize
CompareFileTime
LocalFileTimeToFileTime
WriteFile
SetFilePointer
GetFullPathNameW
GetFileType

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapSetInformation
HeapAlloc

api-ms-win-core-string-l1-1-0

FoldStringW
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
CompareStringEx

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTime
GetComputerNameExW
GetLocalTime
GetVersionExW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-security-cryptoapi-l1-1-0

CryptSetProvParam
CryptEnumProvidersA
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptGetProvParam

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
WriteConsoleW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetStdHandle
GetCommandLineW
GetEnvironmentVariableW
SearchPathW

api-ms-win-core-localization-l1-2-0

GetACP
GetLocaleInfoW
FormatMessageW

api-ms-win-core-registry-l1-1-0

RegOpenCurrentUser
RegUnLoadKeyW
RegLoadKeyW
RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
CreateWellKnownSid
FreeSid
CheckTokenMembership
EqualSid
GetTokenInformation
AllocateAndInitializeSid
DuplicateToken

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

K32GetProcessImageFileNameW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatA
GetTimeFormatA
GetDateFormatW

api-ms-win-core-synch-l1-1-0

SetEvent
CreateEventW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WaitForSingleObjectEx

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-privateprofile-l1-1-0

GetProfileStringA

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
GetSystemDefaultUILanguage

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
StartServiceW
CloseServiceHandle

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
ChangeServiceConfigW

api-ms-win-service-winsvc-l1-1-0

ControlService

Sections

.text
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

229aac8c84dbf30e51cda201437dc2c8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

certcli

gdi32

ncrypt

normaliz

ntdll

setupapi

profapi

wldap32

crypt32

ole32

oleaut32

rpcrt4

secur32

user32

wininet

shlwapi

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-winsvc-l1-1-0

Sections

.text Size: 332KB - Virtual size: 332KB

.rdata Size: 143KB - Virtual size: 142KB

.data Size: 15KB - Virtual size: 20KB

.pdata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 312B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 332KB - Virtual size: 332KB

.rdata
Size: 143KB - Virtual size: 142KB

.data
Size: 15KB - Virtual size: 20KB

.pdata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 312B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 5KB - Virtual size: 4KB