MDE_File_Sample_722e2e6d5e935496a0689d7e42d811e4432badab007611e34a3e0faf33076550[.]zip

Resubmissions

28-08-2023 20:09

230828-yxeehsfg45 1

28-08-2023 19:56

230828-ynqq7aff43 1

28-08-2023 19:48

230828-yh81ksae4t 1

Sharing

Copy URL

Twitter E-mail

General

Target

MDE_File_Sample_722e2e6d5e935496a0689d7e42d811e4432badab007611e34a3e0faf33076550.zip
Size

8.5MB
MD5

3d44c08fc53fb97803a913b44f9056bb
SHA1

433b3b4ba688e770e725b6f03051f0671bf8c365
SHA256

8c7b0609e49af07e1b60cdd0f2666dc922208521410dd603b457eb24cec94eef
SHA512

b77bbbdcec15712a4824be1ef168edf27029f017851033bf9b7840dfd0c31cd3dc982e459c54dc748f7c40644e1782644467f94ae8c601e361fb3f76833aa815
SSDEEP

196608:Xh4Fk7NIGdqmsVS4p9ESupzoARDzYjHbxBR55XXc2YNKPZLFi9p+z9uc:Xh4FiNIDmsVS4pySufQBRDnc2YNKk+zD

Score

1^/10

Malware Config

Signatures

Files

MDE_File_Sample_722e2e6d5e935496a0689d7e42d811e4432badab007611e34a3e0faf33076550.zip
.zip

Password: infected
winzip64.exe
.exe windows x64

Password: infected

a62a8448ce70bfdfd544fe8c1d525402

Code Sign

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14-05-2019 00:00

Not After

23-05-2022 23:59

Subject

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14-05-2019 00:00

Not After

23-05-2022 23:59

Subject

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1c:ba:9e:88:11:d9:7a:09:1a:a6:26:7e:17:b3:40:36:ef:62:5f:28:ed:59:b0:ad:44:af:d1:a0:77:f3:0b:1f
Signer

Actual PE Digest

1c:ba:9e:88:11:d9:7a:09:1a:a6:26:7e:17:b3:40:36:ef:62:5f:28:ed:59:b0:ad:44:af:d1:a0:77:f3:0b:1f

Digest Algorithm

sha256

PE Digest Matches

true

4a:4b:be:fe:91:72:f4:6b:5a:01:32:0c:90:16:eb:6f:59:78:43:b3
Signer

Actual PE Digest

4a:4b:be:fe:91:72:f4:6b:5a:01:32:0c:90:16:eb:6f:59:78:43:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wininet

InternetCanonicalizeUrlW
InternetCrackUrlA
InternetGetConnectedState
InternetAutodial
FtpCommandW
FtpCreateDirectoryW
InternetFindNextFileW
FtpOpenFileW
FtpDeleteFileW
InternetGetLastResponseInfoW
InternetWriteFile
InternetConnectW
InternetOpenW
InternetReadFile
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW
InternetCrackUrlW
InternetQueryOptionW
InternetSetOptionW
HttpSendRequestA
FtpGetCurrentDirectoryW
FtpSetCurrentDirectoryW
FtpFindFirstFileW
InternetCloseHandle

iphlpapi

GetAdaptersInfo

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

urlmon

RegisterBindStatusCallback
RevokeBindStatusCallback
CreateURLMonikerEx

msimg32

AlphaBlend

crypt32

CertNameToStrW
CryptProtectData
CertGetCertificateContextProperty
CryptUnprotectData
CertOpenStore
CertCloseStore
CertSetCertificateContextProperty
CertFreeCertificateContext
CertCreateCertificateContext
CertDuplicateCertificateContext
CryptDecodeObject
CertGetSubjectCertificateFromStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CryptEncodeObject
CryptMsgOpenToDecode
CryptMsgClose
CryptMsgUpdate
CryptMsgGetParam
CryptMsgControl
CryptSignMessage
CryptVerifyMessageSignature
CryptImportPublicKeyInfo
CryptVerifyDetachedMessageSignature
CryptEncryptMessage
CryptDecryptMessage

wzeay64

ord484
ord492
ord501
ord1882
ord67
ord943

shlwapi

ord176
PathIsUNCW
SHGetValueW
PathAppendW
StrCpyW
StrFormatByteSizeW
ord219
StrCmpLogicalW
PathIsDirectoryW
StrRetToStrW
SHStrDupW
PathCombineW
PathRemoveFileSpecW
PathAddBackslashW
PathFileExistsW

psapi

GetModuleFileNameExW
EnumProcessModules

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

advapi32

GetSidSubAuthority
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
CryptGetUserKey
CryptImportKey
CryptExportKey
CryptDestroyKey
CryptDeriveKey
CryptEnumProvidersA
CryptGetProvParam
CryptSignHashA
CryptSetHashParam
CryptGenRandom
CryptAcquireContextA
RegOpenKeyExA
GetUserNameA
RegEnumKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegSetValueW
RegQueryValueW
RegQueryInfoKeyW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
StartServiceW
QueryServiceStatus
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegCreateKeyExW
RegCreateKeyW
RegDeleteValueW
RegQueryValueExW
RegEnumValueW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExW
RegCloseKey
InitiateSystemShutdownW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetUserNameW
CryptVerifySignatureW
SetFileSecurityW
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHAddToRecentDocs
SHGetKnownFolderPath
ord28
SHEmptyRecycleBinW
ShellExecuteW
SHCreateDirectoryExW
SHParseDisplayName
FindExecutableW
ord727
DragQueryFileW
SHGetSpecialFolderPathW
ord21
ord152
ord18
ord155
SHCreateShellItem
SHChangeNotify
SHGetDesktopFolder
DragQueryPoint
DragFinish
SHFileOperationW
SHGetFileInfoW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFolderPathW
SHBindToParent
ShellExecuteExW

ole32

CoInitialize
CoUninitialize
CoTaskMemFree
IIDFromString
StringFromGUID2
CoTaskMemRealloc
ReleaseStgMedium
CoInitializeSecurity
CoSetProxyBlanket
DoDragDrop
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
CoCreateInstance
PropVariantClear
CoInitializeEx
CreateStreamOnHGlobal
CoTaskMemAlloc
CreateBindCtx
CoRegisterClassObject
CoRevokeClassObject
OleInitialize
OleUninitialize
CLSIDFromString
CoCreateGuid
CoGetClassObject
CLSIDFromProgID
OleLockRunning
PropVariantCopy
CoGetMalloc

oleaut32

SafeArrayCreateVector
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayDestroy
VarUI4FromStr
OleCreateFontIndirect
DispCallFunc
LoadTypeLi
SysStringLen
SysAllocStringLen
VariantCopy
VariantInit
VariantClear
SysFreeString
SysAllocString
LoadRegTypeLi

comctl32

ord412
ord413
ImageList_Create
ImageList_ReplaceIcon
ImageList_AddMasked
ord17
ImageList_SetBkColor
ImageList_GetIconSize
ImageList_Add
PropertySheetW
InitCommonControlsEx
_TrackMouseEvent
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ord410
ImageList_GetImageCount
ImageList_Destroy

msi

ord70
ord205

user32

DrawTextW
CreateIconIndirect
DestroyIcon
InvalidateRgn
GetSubMenu
GetCapture
SetDlgItemTextW
InflateRect
TrackPopupMenu
IsDialogMessageW
UnhookWindowsHook
SetWindowsHookW
RegisterClassExW
PostQuitMessage
BringWindowToTop
FindWindowW
EnumChildWindows
RedrawWindow
RegisterWindowMessageW
DestroyCursor
GetCursorPos
ReleaseCapture
SetCapture
GetAsyncKeyState
GetWindowLongW
GetActiveWindow
FlashWindow
SetWindowLongW
PtInRect
GetDlgCtrlID
GetClipboardFormatNameW
RegisterClipboardFormatW
GetSysColorBrush
ClientToScreen
GetWindowTextLengthW
TrackPopupMenuEx
InsertMenuW
DestroyMenu
CreatePopupMenu
IsClipboardFormatAvailable
GetClassInfoW
SetMenu
IsMenu
RemovePropW
GetPropW
SetPropW
EnableMenuItem
GetSystemMenu
EmptyClipboard
SetClipboardData
CopyRect
SetActiveWindow
GetDlgItemInt
GetMessagePos
GetScrollInfo
SetScrollInfo
CheckRadioButton
CheckDlgButton
SetRect
ValidateRect
GetForegroundWindow
CreateIconFromResourceEx
LookupIconIdFromDirectoryEx
EnumWindows
CloseClipboard
OpenClipboard
GetDlgItemTextA
SetDlgItemTextA
GetMenuItemInfoW
GetMenuItemCount
SetForegroundWindow
MsgWaitForMultipleObjects
GetCursorInfo
GetIconInfo
DrawIconEx
CallNextHookEx
AnimateWindow
MapWindowPoints
GetWindowThreadProcessId
GetWindowTextW
GetDesktopWindow
WindowFromPoint
GetWindowDC
TranslateAcceleratorW
IsZoomed
UpdateLayeredWindow
TranslateMessage
GetMessageW
MessageBeep
FindWindowExW
IsDlgButtonChecked
LoadCursorW
GetParent
GetWindowLongPtrW
FillRect
DrawFocusRect
GetSysColor
MessageBoxW
GetKeyState
GetFocus
SetLayeredWindowAttributes
IsChild
CreateWindowExW
RegisterClassW
DefWindowProcW
LoadStringW
SetCursor
ReleaseDC
GetDC
IsIconic
PeekMessageW
DispatchMessageW
SystemParametersInfoW
EnumDisplayDevicesW
EnumDisplaySettingsW
LoadImageW
LoadIconW
LoadBitmapW
GetWindow
FrameRect
GetMenuStringW
GetLastActivePopup
GetClassNameW
SetWindowLongPtrW
ScreenToClient
GetWindowRect
GetClientRect
SetWindowTextW
InvalidateRect
EndPaint
BeginPaint
UpdateWindow
GetSystemMetrics
IsWindowEnabled
EnableWindow
KillTimer
SetTimer
SetFocus
SendDlgItemMessageW
SetDlgItemInt
GetDlgItem
EndDialog
IsWindowVisible
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
IsWindow
UnregisterClassW
CallWindowProcW
PostMessageW
SendMessageW
CreateDialogIndirectParamW
TrackMouseEvent
CharToOemBuffW
CheckMenuItem
AppendMenuW
ModifyMenuW
DeleteMenu
SetMenuDefaultItem
CheckMenuRadioItem
WaitMessage
GetClassLongPtrW
GetMenuItemID
InsertMenuItemW
GetMenuDefaultItem
LoadStringA
GetWindowPlacement
MonitorFromPoint
GetMonitorInfoW
SetWindowPlacement
GetCursor
GetAncestor
IntersectRect
MapDialogRect
AdjustWindowRectEx
MonitorFromRect
LoadMenuW
CreateMenu
wsprintfW
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
DialogBoxParamW
DialogBoxIndirectParamW
DrawTextExW
CharNextW
GetDlgItemTextW
CharToOemA
OemToCharA
OemToCharBuffA
CharUpperW
CharLowerW
IsCharAlphaNumericA
IsCharAlphaNumericW
GetClassInfoExW
CreateAcceleratorTableW
DestroyAcceleratorTable
CreateDialogParamW
GetGestureInfo
SetGestureConfig
SetRectEmpty
SetParent
IsRectEmpty
SetClassLongPtrW
GetComboBoxInfo
SendDlgItemMessageA
GetClipboardData
MessageBoxIndirectW
UnhookWindowsHookEx
SetWindowsHookExW

kernel32

GetStdHandle
SetFileAttributesW
GetCurrentProcessId
OpenEventA
WaitForSingleObjectEx
ResetEvent
GetFileAttributesW
GetDriveTypeW
SetCurrentDirectoryW
GetACP
GetTickCount
GlobalMemoryStatusEx
OpenEventW
DeleteCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
RaiseException
DecodePointer
DeleteFileW
GetProcAddress
FreeLibrary
CreateEventA
SetEvent
InitializeCriticalSectionAndSpinCount
CloseHandle
GetModuleHandleExW
WriteConsoleW
GetFileAttributesExW
PeekNamedPipe
SetEnvironmentVariableW
GetConsoleMode
InterlockedPushEntrySList
GetTimeZoneInformation
GetCurrentThread
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
SetStdHandle
GetConsoleCP
FindFirstFileExW
IsValidCodePage
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
DuplicateHandle
CompareStringA
RtlUnwindEx
FoldStringW
AreFileApisANSI
IsDBCSLeadByte
SetThreadExecutionState
CreateSemaphoreW
GetProcessAffinityMask
SleepConditionVariableCS
VerSetConditionMask
GetModuleHandleW
GetLongPathNameW
CreateHardLinkW
SetWaitableTimer
VerifyVersionInfoW
ReleaseSemaphore
ReadConsoleW
GetModuleHandleA
CreateWaitableTimerA
OpenFileMappingW
InterlockedPopEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
GetLogicalDrives
GlobalMemoryStatus
RtlUnwind
ExitThread
FreeLibraryAndExitThread
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
RtlPcToFileHeader
CreateSemaphoreA
LocalFileTimeToFileTime
GetVersionExA
GetComputerNameA
LoadLibraryA
GetOEMCP
GetCurrentDirectoryA
GetComputerNameW
lstrcmpiW
GlobalHandle
SetThreadPriority
GetSystemInfo
lstrcmpW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
GetCPInfo
EncodePointer
FormatMessageA
GetTimeFormatA
GetDateFormatA
SetVolumeLabelW
DosDateTimeToFileTime
FileTimeToDosDateTime
QueryPerformanceFrequency
OutputDebugStringW
UnlockFile
SetFileTime
SetFilePointerEx
LockFile
GetFileType
GetFileInformationByHandle
TzSpecificLocalTimeToSystemTime
GetPrivateProfileIntW
GetSystemDirectoryW
GetTempPathW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SearchPathW
UnmapViewOfFile
FindResourceExW
CreateFileMappingW
MapViewOfFile
GetSystemDefaultUILanguage
LoadLibraryW
GetCompressedFileSizeW
GetFileSizeEx
GetWindowsDirectoryW
GetOverlappedResult
WaitNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
WriteFileEx
ReadFileEx
GetTempFileNameW
GetEnvironmentVariableW
FindResourceA
DeleteTimerQueueEx
CreateTimerQueueTimer
CreateTimerQueue
GetStringTypeW
ResumeThread
FlushFileBuffers
MultiByteToWideChar
FreeResource
GetExitCodeThread
GetExitCodeProcess
SetErrorMode
GetCurrentDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
EnumResourceNamesW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
WritePrivateProfileStringW
MoveFileW
GetPrivateProfileStringA
WriteProfileStringA
MulDiv
SetThreadUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetPrivateProfileStringW
TryEnterCriticalSection
GetDiskFreeSpaceW
ExitProcess
WideCharToMultiByte
GetShortPathNameW
LocalFree
LocalAlloc
EnterCriticalSection
DeviceIoControl
CopyFileW
lstrlenW
GetVersionExW
Sleep
FormatMessageW
SetLastError
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetCurrentProcess
GetSystemPowerStatus
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
CreateProcessW
GetFileTime
CompareFileTime
SetFilePointer
SetEndOfFile
FileTimeToSystemTime
MoveFileExW
GlobalFindAtomW
GlobalAddAtomW
GetVersion
GetCommandLineW
RtlCaptureStackBackTrace
GlobalSize
GetFullPathNameW
RemoveDirectoryW
GetVolumeInformationW
FileTimeToLocalFileTime
CopyFileExW
CreateEventW
WaitForMultipleObjectsEx
WaitForSingleObject
FindNextFileW
FindFirstFileW
FindClose
SystemTimeToFileTime
GetModuleFileNameW
GetSystemTime
GetProfileStringW
IsBadWritePtr
IsBadReadPtr
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
CreateDirectoryW
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalReAlloc
GlobalAlloc
InitializeCriticalSection
WriteFile
ReadFile
GetFileSize
CreateFileW
CreateThread
LeaveCriticalSection
GetCurrentThreadId

ws2_32

bind
__WSAFDIsSet
closesocket
WSAGetLastError
WSAStartup
gethostname
gethostbyname
socket
shutdown
setsockopt
connect
send
select
recv
ntohs
inet_ntoa
inet_addr
htons
getsockopt
getsockname
ioctlsocket

gdi32

CreatePatternBrush
CreateBitmap
Rectangle
SetViewportOrgEx
EndPage
StartPage
EndDoc
StartDocW
Escape
SetAbortProc
DPtoLP
GetTextExtentPointW
GetCurrentObject
SetBkMode
SetDCPenColor
SetDCBrushColor
RoundRect
Ellipse
GetPixel
GetDIBits
CreateDIBitmap
MoveToEx
SetPolyFillMode
PolyPolygon
LineTo
UpdateColors
SelectPalette
RealizePalette
GetBkColor
CreateCompatibleBitmap
BitBlt
GetObjectW
GetTextExtentPoint32W
CreateFontIndirectW
DeleteObject
CreateSolidBrush
SelectObject
SetBkColor
SetTextColor
TextOutW
Polyline
CreateCompatibleDC
CreateDCW
SetDIBits
PatBlt
RestoreDC
SaveDC
ExtTextOutW
CreatePalette
GetMapMode
SetMapMode
SetTextAlign
DeleteDC
GetDeviceCaps
GetStockObject
GetTextMetricsW
CreateDIBSection
CreatePen

comdlg32

CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW
PrintDlgW
PrintDlgExW
ChooseFontW

gdiplus

GdipCloneBrush
GdipDisposeImage
GdipGetImageGraphicsContext
GdipScaleWorldTransform
GdipDrawImageI
GdiplusStartup
GdipDeleteGraphics
GdipFillPolygonI
GdipFillRectangleI
GdipCreateFromHDC
GdipFlush
GdipCreateBitmapFromStream
GdipGetImageWidth
GdipCreateBitmapFromResource
GdipCreateHBITMAPFromBitmap
GdipCloneImage
GdipFree
GdipAlloc
GdiplusShutdown
GdipCreateBitmapFromScan0
GdipCreateLineBrushI
GdipCreateSolidFill
GdipDeleteBrush
GdipGetImageHeight

propsys

PSGetPropertyDescriptionListFromString
PSGetPropertyValue
PropVariantToStringVectorAlloc

winspool.drv

ord203

rpcrt4

UuidCreate

Sections

.text
Size: 8.5MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78.8MB - Virtual size: 78.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 291KB - Virtual size: 441KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 400KB - Virtual size: 399KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data_1
Size: 512B - Virtual size: 33B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13.0MB - Virtual size: 13.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

a62a8448ce70bfdfd544fe8c1d525402

Code Sign

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

1c:ba:9e:88:11:d9:7a:09:1a:a6:26:7e:17:b3:40:36:ef:62:5f:28:ed:59:b0:ad:44:af:d1:a0:77:f3:0b:1fSigner

4a:4b:be:fe:91:72:f4:6b:5a:01:32:0c:90:16:eb:6f:59:78:43:b3Signer

Headers

DLL Characteristics

File Characteristics

Imports

wininet

iphlpapi

setupapi

urlmon

msimg32

crypt32

wzeay64

shlwapi

psapi

version

advapi32

shell32

ole32

oleaut32

comctl32

msi

user32

kernel32

ws2_32

gdi32

comdlg32

gdiplus

propsys

winspool.drv

rpcrt4

Sections

.text Size: 8.5MB - Virtual size: 8.5MB

.rdata Size: 78.8MB - Virtual size: 78.8MB

.data Size: 291KB - Virtual size: 441KB

.pdata Size: 400KB - Virtual size: 399KB

_RDATA Size: 512B - Virtual size: 148B

.data_1 Size: 512B - Virtual size: 33B

.rsrc Size: 13.0MB - Virtual size: 13.0MB

.reloc Size: 64KB - Virtual size: 63KB

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

1c:ba:9e:88:11:d9:7a:09:1a:a6:26:7e:17:b3:40:36:ef:62:5f:28:ed:59:b0:ad:44:af:d1:a0:77:f3:0b:1f
Signer

4a:4b:be:fe:91:72:f4:6b:5a:01:32:0c:90:16:eb:6f:59:78:43:b3
Signer

.text
Size: 8.5MB - Virtual size: 8.5MB

.rdata
Size: 78.8MB - Virtual size: 78.8MB

.data
Size: 291KB - Virtual size: 441KB

.pdata
Size: 400KB - Virtual size: 399KB

_RDATA
Size: 512B - Virtual size: 148B

.data_1
Size: 512B - Virtual size: 33B

.rsrc
Size: 13.0MB - Virtual size: 13.0MB

.reloc
Size: 64KB - Virtual size: 63KB