Pwi_Arc2Setup[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Pwi_Arc2Setup.exe
Size

846KB
MD5

2a61bbd26b662e01a404586d324fc599
SHA1

2942de4fc14f68397395d76d0f25efbfce6c4678
SHA256

d0239547edb8aacdf37d48d2b452660f39d6092c140018e8b55bf9fa8c460cb3
SHA512

d42a00088ec415b9efbfb84239305f144c584ac55b97a9f13b9463c223f8af3eb50cef7cde6fe5a93c1b0412008c8496ded09f6b0bb31942171129f127cc3d90
SSDEEP

12288:aJO7BYgeaVVth6bXn4u8Kouj3HNJ8oJIB91v7EYPsMXgi+aZGuivHX0u3FJzP0:aSzenX4u8vujHHfJIB91wC6i+LJQ

Score

1^/10

Malware Config

Signatures

Files

Pwi_Arc2Setup.exe
.exe windows x86

0e41110de7a0328760a0edaf27d55886

Code Sign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-12-2014 00:00

Not After

02-12-2029 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d2:d1:61:f1:bf:22:2e:b8:83:43:e8:03:27:bc:57:61
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16-03-2021 00:00

Not After

16-03-2023 23:59

Subject

SERIALNUMBER=C4294399,CN=Perfect World Entertainment\, Inc.,O=Perfect World Entertainment\, Inc.,POSTALCODE=94065,STREET=100 Redwood Shores,L=Redwood City,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:e1:3d:56:0c:ef:21:2b:ed:0a:d0:2d:47:b2:50:ce:7b:84:f5:0b:6d:67:cf:12:cf:fa:83:3c:3a:a2:0c:64
Signer

Actual PE Digest

48:e1:3d:56:0c:ef:21:2b:ed:0a:d0:2d:47:b2:50:ce:7b:84:f5:0b:6d:67:cf:12:cf:fa:83:3c:3a:a2:0c:64

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

gdiplus

GdipFree

user32

GetDC

gdi32

PatBlt

msimg32

AlphaBlend

winspool.drv

OpenPrinterW

advapi32

RegCloseKey

shell32

DragFinish

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCW

uxtheme

IsAppThemed

ole32

DoDragDrop

oleaut32

SysFreeString

wintrust

WinVerifyTrust

crypt32

CryptMsgClose

winhttp

WinHttpOpen

oleacc

LresultFromObject

imm32

ImmGetContext

winmm

PlaySoundW

Exports

Exports

HttpDownCreateTask
HttpDownDestoryTask
HttpDownGetLimitSpeed
HttpDownGetTotalSpeed
HttpDownInitialize
HttpDownSetLimitSpeed
HttpDownUninitialize

Sections

.MPRESS1
Size: 729KB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0e41110de7a0328760a0edaf27d55886

Code Sign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

d2:d1:61:f1:bf:22:2e:b8:83:43:e8:03:27:bc:57:61Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

48:e1:3d:56:0c:ef:21:2b:ed:0a:d0:2d:47:b2:50:ce:7b:84:f5:0b:6d:67:cf:12:cf:fa:83:3c:3a:a2:0c:64Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdiplus

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

wintrust

crypt32

winhttp

oleacc

imm32

winmm

Exports

Exports

Sections

.MPRESS1 Size: 729KB - Virtual size: 2.3MB

.MPRESS2 Size: 4KB - Virtual size: 4KB

.rsrc Size: 102KB - Virtual size: 101KB

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

d2:d1:61:f1:bf:22:2e:b8:83:43:e8:03:27:bc:57:61
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

48:e1:3d:56:0c:ef:21:2b:ed:0a:d0:2d:47:b2:50:ce:7b:84:f5:0b:6d:67:cf:12:cf:fa:83:3c:3a:a2:0c:64
Signer

.MPRESS1
Size: 729KB - Virtual size: 2.3MB

.MPRESS2
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 102KB - Virtual size: 101KB