2023-08-26_9ad01ba8d3612865c9bc700db107c027_mafia_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2023-08-26_9ad01ba8d3612865c9bc700db107c027_mafia_JC.exe
Size

2.3MB
MD5

9ad01ba8d3612865c9bc700db107c027
SHA1

c734ded84b373b54b151a55d7cd62ca6e537b957
SHA256

3e4064e3d18abee070e759de5e45fede4f97605d27009bc07aed82de28963634
SHA512

dfcf71b7df4921aa3b7ea486d13ab4df14de16d1eef47316697d8c7e9e2a1c33867268a890b957162f8402d6ba41663c5511f5f4a3f77b85553d05aa935db6cc
SSDEEP

49152:AbS+7k28rdK3vXDwJ71Dbvo7awwscYbsXjJ7mpXWmmCkt1s0hoA7fjNzCxV:sSO8rdKfXM71DbvozcssXN7EXWmmBRhs

Score

1^/10

Malware Config

Signatures

Files

2023-08-26_9ad01ba8d3612865c9bc700db107c027_mafia_JC.exe
.exe windows:5 windows x86

fd58b3083e4ebe4d5ccfd4764ddeb01f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/02/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f3:79:b0:00:46:ba:7f:6c:67:79:e9:da:bf:78:70:fd:a1:65:bf:1e:72:52:11:8d:0d:9e:5f:52:85:56:d8:38
Signer

Actual PE Digest

f3:79:b0:00:46:ba:7f:6c:67:79:e9:da:bf:78:70:fd:a1:65:bf:1e:72:52:11:8d:0d:9e:5f:52:85:56:d8:38

Digest Algorithm

sha256

PE Digest Matches

false

c6:69:78:88:a9:9e:46:82:00:ab:52:6f:9b:5b:bb:00:d7:1d:34:8d
Signer

Actual PE Digest

c6:69:78:88:a9:9e:46:82:00:ab:52:6f:9b:5b:bb:00:d7:1d:34:8d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpynA
MulDiv
GlobalAlloc
ActivateActCtx
DeactivateActCtx
SetLastError
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetTempFileNameA
MoveFileA
GlobalLock
GlobalUnlock
WriteFile
SetFileTime
GetCurrentDirectoryA
GetFileAttributesA
GetCurrentDirectoryW
LocalFileTimeToFileTime
lstrcpyA
lstrlenA
lstrcatA
SystemTimeToFileTime
ReadFile
SetFilePointer
GetCurrentThreadId
GetSystemInfo
DeleteFileA
CreateFileA
UnmapViewOfFile
CloseHandle
FindFirstFileA
FindClose
GetLastError
FindFirstFileExA
GetDriveTypeA
CreateDirectoryA
GetFileInformationByHandle
GetTempPathA
GetTickCount
MultiByteToWideChar
lstrlenW
LocalFree
FormatMessageA
GlobalSize
CopyFileA
GlobalFree
ReplaceFileA
GetFileTime
GetFullPathNameA
GetDiskFreeSpaceA
GetStringTypeExA
GetThreadLocale
lstrcmpiA
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
GetVolumeInformationA
GetModuleFileNameA
GetShortPathNameA
lstrcmpW
LoadLibraryW
CompareStringA
FreeLibrary
GetVersionExA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
FreeResource
FindResourceA
ReleaseActCtx
GetModuleFileNameW
GetCurrentProcessId
GetModuleHandleW
lstrcmpA
InterlockedExchange
GetLocaleInfoA
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GetCurrentThread
SetThreadPriority
ResumeThread
WaitForSingleObject
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetProfileIntA
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesExA
GetFileSizeEx
GlobalFlags
GetCPInfo
GetOEMCP
GetACP
GetWindowsDirectoryA
GetNumberFormatA
InitializeCriticalSectionAndSpinCount
Sleep
VirtualProtect
SearchPathA
FindResourceExW
RtlUnwind
EncodePointer
DecodePointer
ExitProcess
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
VirtualAlloc
VirtualQuery
HeapReAlloc
ExitThread
CreateThread
HeapQueryInformation
HeapSize
SetStdHandle
GetFileType
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
IsValidCodePage
LCMapStringW
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStartupInfoW
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeW
GetTimeZoneInformation
CompareStringW
WriteConsoleW
CreateFileW
GetProcessHeap
SetEnvironmentVariableA
SleepEx
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
SizeofResource
GetDriveTypeW

user32

WinHelpA
LoadIconA
LoadIconW
RegisterWindowMessageA
GetMenuItemInfoA
DestroyMenu
DestroyCursor
LoadCursorW
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
GetActiveWindow
BringWindowToTop
TranslateMDISysAccel
RedrawWindow
GetDesktopWindow
IntersectRect
CreatePopupMenu
InsertMenuItemA
GetWindowThreadProcessId
DestroyIcon
LoadImageA
LoadMenuA
ReuseDDElParam
UnpackDDElParam
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
PostQuitMessage
ValidateRect
TranslateMessage
GetMessageA
ShowOwnedPopups
LoadAcceleratorsW
MapDialogRect
SetWindowContextHelpId
IsZoomed
GetKeyNameTextA
MapVirtualKeyA
IsRectEmpty
DeleteMenu
GetSystemMenu
SetParent
WindowFromPoint
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
SetCursorPos
GetSysColorBrush
RealChildWindowFromPoint
DrawIcon
SetWindowRgn
CopyAcceleratorTableA
CreateMenu
PostThreadMessageA
GetTabbedTextExtentW
EnumDisplayMonitors
SetLayeredWindowAttributes
UnionRect
EndDeferWindowPos
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
GetDCEx
LockWindowUpdate
GetMenuDefaultItem
InvertRect
NotifyWinEvent
GetIconInfo
CopyImage
DrawIconEx
WaitMessage
DrawEdge
DrawFrameControl
MonitorFromPoint
UpdateLayeredWindow
IsMenu
SetClassLongA
DestroyAcceleratorTable
ToAsciiEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableA
RegisterClipboardFormatA
LoadImageW
IsCharLowerA
MapVirtualKeyExA
GetCapture
SetMenuDefaultItem
CopyIcon
GetDoubleClickTime
GetUpdateRect
CharUpperBuffA
SubtractRect
FrameRect
GetWindowRgn
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
RemoveMenu
GetSubMenu
LoadMenuW
ClientToScreen
GetParent
EnableWindow
GetTopWindow
GetMessageTime
GetMessagePos
PeekMessageA
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
GetFocus
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
PtInRect
SetWindowPlacement
GetWindowPlacement
DefWindowProcA
GetMenu
IsIconic
AdjustWindowRectEx
CharUpperA
GetWindowTextLengthA
SetFocus
SetWindowPos
IsWindowEnabled
ShowWindow
MoveWindow
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SendDlgItemMessageA
PostMessageA
CheckDlgButton
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuA
EnableMenuItem
UpdateWindow
wsprintfA
GetSystemMetrics
SystemParametersInfoA
ReleaseDC
GetDC
InflateRect
OffsetRect
IsWindowVisible
GetWindowRect
RemovePropA
SetWindowLongA
GetPropA
UnhookWindowsHookEx
CallWindowProcA
CallNextHookEx
GetClassLongA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
CheckMenuItem
DestroyWindow
IsChild
CharNextA
SetRectEmpty
GetClipboardData
EmptyClipboard
SetClipboardData
CloseClipboard
GetKeyState
OpenClipboard
SetCapture
SetTimer
IsClipboardFormatAvailable
ReleaseCapture
GetCursorPos
LoadCursorA
SetCursor
IsWindow
EnableScrollBar
KillTimer
ScreenToClient
TranslateAcceleratorA
LoadAcceleratorsA
GetDlgItem
CreateCaret
GetAsyncKeyState
ShowCaret
HideCaret
SetCaretPos
DrawFocusRect
GetWindowTextA
SetPropA
GetWindowLongA
GetClassNameA
SetWindowsHookExA
GetSysColor
InvalidateRect
FillRect
SetRect
CopyRect
DrawStateA
SendMessageA
GetClientRect

gdi32

CopyMetaFileA
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
SetTextAlign
MoveToEx
SetLayout
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetStockObject
PatBlt
Rectangle
GetViewportOrgEx
EndDoc
AbortDoc
LineTo
GetLayout
SetPixelV
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
SetPaletteEntries
ExtFloodFill
EnumFontFamiliesExA
OffsetRgn
StretchBlt
SetDIBColorTable
CreateRoundRectRgn
Polygon
Polyline
CreatePolygonRgn
GetSystemPaletteEntries
RealizePalette
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
GetRgnBox
GetTextCharsetInfo
EnumFontFamiliesA
CreateDIBitmap
DeleteDC
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetPixel
SetPixel
CreatePen
CreateSolidBrush
RoundRect
GetTextExtentPoint32A
CreateFontIndirectA
GetObjectA
GetDeviceCaps
GetWindowOrgEx
GetTextExtentPoint32W
GetTextExtentPointA
GetTextFaceA
SetAbortProc
EndPage
StartPage
StartDocA
DPtoLP
ExtTextOutA
SetBkColor
SetTextColor
CreateBitmap
CreateDCA
DeleteObject
GetTextAlign
GetTextColor
GetStretchBltMode
GetROP2
GetPolyFillMode
GetBkMode
GetNearestColor
CreateDIBSection
Ellipse
LPtoDP
CreateEllipticRgn
GetBkColor
GetMapMode
CombineRgn
SetRectRgn
CreateRectRgnIndirect
StretchDIBits
CreateFontA
GetCharWidthA
GetTextMetricsA
CreateHatchBrush
GetObjectType
SelectPalette
CreatePatternBrush
ExtSelectClipRgn
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape

shell32

SHBrowseForFolderA
SHAppBarMessage
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetDesktopFolder
ExtractIconA
SHAddToRecentDocs
DragQueryFileA
DragFinish
SHGetFileInfoA
ShellExecuteA

msimg32

AlphaBlend
TransparentBlt

comctl32

_TrackMouseEvent
ImageList_GetIconSize

shlwapi

PathStripToRootA
PathFindExtensionA
PathFindFileNameA
PathRemoveFileSpecW
PathIsUNCA

oledlg

ord8

wldap32

ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord50
ord60
ord143
ord211
ord22

ws2_32

WSACleanup
WSAStartup
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
recv
WSAIoctl
setsockopt
ntohl
htonl
gethostname
ioctlsocket
listen
accept
recvfrom
sendto
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
send

crypt32

CertFreeCertificateContext

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

gdiplus

GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdiplusShutdown
GdipDrawImageI

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundA

winspool.drv

OpenPrinterA
GetJobA
ClosePrinter
DocumentPropertiesA

comdlg32

GetFileTitleA

advapi32

RegSetValueExA
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegSetValueA
SetFileSecurityA
GetFileSecurityA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegEnumValueA

ole32

OleGetClipboard
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CoRegisterMessageFilter
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
StringFromCLSID
CoTaskMemFree
OleLockRunning
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoInitialize
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
CoInitializeEx
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
SysAllocStringByteLen
VarBstrFromDate
VariantChangeType
VariantInit
SysAllocStringLen
SysStringLen
VariantCopy
OleCreateFontIndirect
SysAllocString
VariantClear
SafeArrayDestroy

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 361KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 157KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd58b3083e4ebe4d5ccfd4764ddeb01f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5aCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

f3:79:b0:00:46:ba:7f:6c:67:79:e9:da:bf:78:70:fd:a1:65:bf:1e:72:52:11:8d:0d:9e:5f:52:85:56:d8:38Signer

c6:69:78:88:a9:9e:46:82:00:ab:52:6f:9b:5b:bb:00:d7:1d:34:8dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

msimg32

comctl32

shlwapi

oledlg

wldap32

ws2_32

crypt32

oleacc

gdiplus

imm32

winmm

winspool.drv

comdlg32

advapi32

ole32

oleaut32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 361KB - Virtual size: 360KB

.data Size: 27KB - Virtual size: 66KB

.reloc Size: 186KB - Virtual size: 185KB

.rsrc Size: 157KB - Virtual size: 160KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

f3:79:b0:00:46:ba:7f:6c:67:79:e9:da:bf:78:70:fd:a1:65:bf:1e:72:52:11:8d:0d:9e:5f:52:85:56:d8:38
Signer

c6:69:78:88:a9:9e:46:82:00:ab:52:6f:9b:5b:bb:00:d7:1d:34:8d
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 361KB - Virtual size: 360KB

.data
Size: 27KB - Virtual size: 66KB

.reloc
Size: 186KB - Virtual size: 185KB

.rsrc
Size: 157KB - Virtual size: 160KB