General

Malware Config

Signatures

Files

• ba41f895977f86c441013636d14fb1f501c05e41e936b8368cfbef07ae898972

  .exe windows:6 windows x64 arch:x64

  c7b1299ce45fdfef467676bf0f5b9b71

  
  

  Code Sign

  33:00:00:04:0c:12:00:67:8b:16:b2:65:db:00:00:00:00:04:0c

  Certificate

  Issuer

  CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  05-01-2023 19:22

  Not After

  15-12-2023 19:22

  Subject

  CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:07:76:56:00:00:00:00:00:08

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  19-10-2011 18:41

  Not After

  19-10-2026 18:51

  Subject

  CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  d0:53:f6:5c:77:50:52:51:05:d2:3b:7d:7f:d0:a4:d4:14:50:05:68:e9:f4:6a:86:5d:e4:2a:5e:22:04:02:90

  Signer

  Actual PE Digest

  d0:53:f6:5c:77:50:52:51:05:d2:3b:7d:7f:d0:a4:d4:14:50:05:68:e9:f4:6a:86:5d:e4:2a:5e:22:04:02:90

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  AddVectoredExceptionHandler

  SetThreadStackGuarantee

  GetLastError

  HeapAlloc

  GetProcessHeap

  HeapFree

  HeapReAlloc

  GetModuleHandleA

  GetProcAddress

  GetCurrentThread

  TryAcquireSRWLockExclusive

  ReleaseSRWLockExclusive

  GetStdHandle

  GetConsoleMode

  WaitForSingleObject

  WriteConsoleW

  SetLastError

  GetCurrentDirectoryW

  WaitForSingleObjectEx

  LoadLibraryA

  CreateMutexA

  GetCurrentProcess

  ReleaseMutex

  GetEnvironmentVariableW

  GetCommandLineW

  GetModuleHandleW

  FormatMessageW

  GetModuleFileNameW

  CreateFileW

  GetFullPathNameW

  AcquireSRWLockExclusive

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  CompareStringOrdinal

  GetSystemDirectoryW

  GetWindowsDirectoryW

  CreateProcessW

  GetFileAttributesW

  DuplicateHandle

  CreateThread

  GetCurrentProcessId

  CreateNamedPipeW

  ReadFileEx

  SleepEx

  WriteFileEx

  RtlCaptureContext

  AcquireSRWLockShared

  ReleaseSRWLockShared

  RtlLookupFunctionEntry

  CloseHandle

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  IsProcessorFeaturePresent

  RtlVirtualUnwind

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  QueryPerformanceCounter

  advapi32

  SystemFunction036

  bcrypt

  BCryptGenRandom

  ntdll

  NtAllocateVirtualMemory

  NtTestAlert

  NtQueueApcThread

  NtWriteVirtualMemory

  vcruntime140

  memcmp

  memmove

  _CxxThrowException

  __C_specific_handler

  __current_exception

  __current_exception_context

  memset

  memcpy

  __CxxFrameHandler3

  api-ms-win-crt-runtime-l1-1-0

  _seh_filter_exe

  __p___argc

  __p___argv

  _cexit

  _c_exit

  _register_thread_local_exe_atexit_callback

  _initterm

  _get_initial_narrow_environment

  _exit

  _initialize_onexit_table

  _register_onexit_function

  _crt_atexit

  terminate

  _initialize_narrow_environment

  exit

  _set_app_type

  _configure_narrow_argv

  _initterm_e

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-stdio-l1-1-0

  __p__commode

  _set_fmode

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  api-ms-win-crt-heap-l1-1-0

  free

  _set_new_mode

  Sections

  .text

  Size: 214KB - Virtual size: 214KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 99KB - Virtual size: 99KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 744B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 279KB - Virtual size: 278KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ