KillSwitch[.]exe

Resubmissions

12-12-2023 15:36

231212-s186eafeeq 6

10-12-2023 06:20

231210-g351zscdel 1

Sharing

Copy URL

Twitter E-mail

General

Target

KillSwitch.exe
Size

10.2MB
MD5

eb5e6f08ea123485628b79aa3f9a8303
SHA1

90a309f958d08af33a4f58a48d0722fe9c28ce4e
SHA256

7a66771776dd0e6fd9b20cd89f9123767b8cf77a6a8cd037739b4b1a8640fa8b
SHA512

38e8a7754a807df703e3f9bfbc8666a738dfb8b70bc2c2d77c4fc3ddd39b0c8dc2ed493a35d433e2c0880bbb85e462a9e812047bcd4ae4be1ccfac3ade13cee6
SSDEEP

98304:QN0b3PASX7LP4wg3kjQrvhyihjrsHuPGnd7udCo2JkR3+CJoai:QNSFX1QrvhcOPgFP3C6

Score

1^/10

Malware Config

Signatures

Files

KillSwitch.exe
.exe windows:5 windows x64 arch:x64

d0fb0ca9069b699c4f8b7cc993aeccf6

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16-04-2020 18:36

Not After

16-04-2045 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:2f:2c:a9:5d:d6:d6:16:14:5e:7c:00:00:00:00:2f:2c
Certificate

Issuer

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Not Before

18-10-2023 13:28

Not After

21-10-2023 13:28

Subject

CN=Comodo Security Solutions Inc.,O=Comodo Security Solutions Inc.,L=Bloomfield,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:2f:2c:a9:5d:d6:d6:16:14:5e:7c:00:00:00:00:2f:2c
Certificate

Issuer

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Not Before

18-10-2023 13:28

Not After

21-10-2023 13:28

Subject

CN=Comodo Security Solutions Inc.,O=Comodo Security Solutions Inc.,L=Bloomfield,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13-04-2021 17:31

Not After

13-04-2026 17:31

Subject

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01-04-2021 20:05

Not After

01-04-2036 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19-11-2020 20:32

Not After

19-11-2035 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2e:30:2b:14:37:07:50:ad:83:00:00:00:00:00:2e
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

15-06-2023 19:38

Not After

14-06-2024 19:38

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:C392-9641-4540,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:73:4d:11:1b:4b:5c:87:9b:bd:5a:8c:49:ab:2a:90
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

07-12-2021 00:00

Not After

06-12-2024 23:59

Subject

SERIALNUMBER=0400751588,CN=Comodo Security Solutions\, Inc,O=Comodo Security Solutions\, Inc,ST=New Jersey,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a4e6577204a6572736579,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:39:02:78:ea:d6:0f:0c:14:01:80:4b:7b:70:cf:bf:74:c6:1b:51:fc:c6:29:11:d8:22:39:00:e7:58:db:00
Signer

Actual PE Digest

3d:39:02:78:ea:d6:0f:0c:14:01:80:4b:7b:70:cf:bf:74:c6:1b:51:fc:c6:29:11:d8:22:39:00:e7:58:db:00

Digest Algorithm

sha256

PE Digest Matches

true

3d:39:02:78:ea:d6:0f:0c:14:01:80:4b:7b:70:cf:bf:74:c6:1b:51:fc:c6:29:11:d8:22:39:00:e7:58:db:00
Signer

Actual PE Digest

3d:39:02:78:ea:d6:0f:0c:14:01:80:4b:7b:70:cf:bf:74:c6:1b:51:fc:c6:29:11:d8:22:39:00:e7:58:db:00

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtCreateDebugObject
NtProtectVirtualMemory
RtlIpv4AddressToStringW
RtlSecondsSince1970ToTime
NtCreateJobObject
RtlInitUnicodeString
NtSuspendThread
NtResumeThread
NtGetContextThread
NtQueryInformationThread
NtTerminateThread
NtTerminateProcess
NtFreeVirtualMemory
NtWriteVirtualMemory
NtResumeProcess
NtSuspendProcess
NtSetInformationProcess
NtInitiatePowerAction
NtOpenProcess
NtOpenThread
RtlEqualUnicodeString
RtlPrefixUnicodeString
NtQueryDirectoryObject
NtOpenDirectoryObject
NtUnloadDriver
RtlCreateUserThread
NtWaitForSingleObject
RtlSubAuthoritySid
NtQueryObject
NtUnmapViewOfSection
NtQueryVirtualMemory
NtReadVirtualMemory
NtDeviceIoControlFile
NtAssignProcessToJobObject
strchr
_local_unwind
strrchr
NtClose
NtAdjustPrivilegesToken
RtlVirtualUnwind
RtlCaptureContext
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
NtQueryPerformanceCounter
NtOpenProcessToken
NtQueryInformationToken
NtQuerySystemInformation
NtDuplicateObject
NtQueryInformationProcess
RtlIpv6AddressToStringW
RtlNtStatusToDosError
NtOpenSection
NtSetContextThread
NtDebugActiveProcess
NtAllocateVirtualMemory
NtQueryInformationJobObject
VerSetConditionMask
NtTerminateJobObject

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

winsta

WinStationSendMessageW
WinStationQueryInformationW
WinStationReset
WinStationGetAllProcesses
WinStationEnumerateW
WinStationFreeMemory
WinStationDisconnect

iphlpapi

GetIfEntry
GetAdaptersInfo

rpcrt4

UuidFromStringW

mprapi

MprConfigGetFriendlyName
MprConfigServerConnect

kernel32

GetModuleFileNameA
GetACP
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetDriveTypeW
OutputDebugStringW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineW
WriteConsoleW
GetDiskFreeSpaceExW
GetStdHandle
CreateMutexW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindResourceA
SetThreadLocale
GetPrivateProfileSectionNamesW
ReleaseMutex
GetSystemDefaultLangID
GetExitCodeThread
SwitchToThread
lstrcpynW
LocalSize
OpenProcess
LoadLibraryExA
GetModuleHandleA
EnumResourceLanguagesW
EnumResourceNamesW
EnumResourceTypesW
QueryPerformanceFrequency
HeapQueryInformation
VirtualQuery
GetSystemInfo
GetFileType
RemoveDirectoryW
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
GetModuleHandleW
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
GetLastError
HeapReAlloc
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ReleaseSemaphore
WaitForSingleObject
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
SearchPathW
GetProfileIntW
GetTempPathW
VerifyVersionInfoW
GetCurrentDirectoryW
lstrcpyW
SetErrorMode
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GlobalFlags
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
FindNextFileW
GlobalGetAtomNameW
GetUserDefaultLCID
ReplaceFileW
GetTempFileNameW
GetDiskFreeSpaceW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CompareStringA
GetCurrentThread
GetVersionExW
GetThreadLocale
GetStringTypeExW
lstrcmpiW
DuplicateHandle
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetShortPathNameW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
SetFileTime
SetFileAttributesW
LocalFileTimeToFileTime
GetFileAttributesExW
SuspendThread
lstrcmpA
CompareStringW
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
CreateEventW
Sleep
TerminateThread
SetStdHandle
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
GetModuleHandleExW
EncodePointer
OutputDebugStringA
MulDiv
GlobalSize
SetLastError
LoadLibraryA
FormatMessageW
FreeResource
RaiseException
DecodePointer
lstrlenW
CopyFileW
MoveFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateProcessW
CreateRemoteThread
GetFileSizeEx
LoadLibraryExW
VirtualFree
VirtualAlloc
SystemTimeToFileTime
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetSystemTime
GetFileAttributesW
ExpandEnvironmentStringsW
SystemTimeToTzSpecificLocalTime
GetFileTime
GetThreadPriority
SetThreadPriority
LocalFree
GetCurrentProcess
QueryDosDeviceW
LoadLibraryW
InitializeCriticalSection
GetCurrentThreadId
GetModuleFileNameW
FreeLibrary
GetLocalTime
ExitProcess
GetCurrentProcessId
CreateDirectoryW
CreateThread
GetWindowsDirectoryW
GetSystemDirectoryW
DeleteFileW
CloseHandle
WriteFile
CreateFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
WideCharToMultiByte
MultiByteToWideChar
CreateSemaphoreW
WaitForMultipleObjects
FindResourceExW
GetTickCount
ResumeThread
SetEnvironmentVariableA

user32

DrawIconEx
DrawFocusRect
GetMenuDefaultItem
GetSystemMenu
UnionRect
GetNextDlgGroupItem
IsRectEmpty
InvalidateRgn
CopyAcceleratorTableW
CharNextW
SetRect
MessageBeep
GetTabbedTextExtentW
IsClipboardFormatAvailable
TrackMouseEvent
GetAsyncKeyState
CopyImage
RealChildWindowFromPoint
GetSysColorBrush
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
WaitMessage
MapDialogRect
SetWindowContextHelpId
RegisterClipboardFormatW
ShowOwnedPopups
MapVirtualKeyW
GetKeyNameTextW
LoadMenuW
FillRect
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
IntersectRect
SetRectEmpty
SendDlgItemMessageA
CharUpperW
GetMessageW
SystemParametersInfoW
GetMenuItemInfoW
DestroyMenu
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
WinHelpW
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetLastActivePopup
GetTopWindow
GetClassLongPtrW
GetWindowLongPtrW
PtInRect
EqualRect
MapWindowPoints
AdjustWindowRectEx
RemovePropW
GetPropW
SetPropW
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
EndPaint
BeginPaint
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenuEx
SetMenu
GetMenu
GetCapture
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
DestroyWindow
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
DefWindowProcW
GetMessageTime
GetMessagePos
IsDialogMessageW
GetWindow
MessageBoxW
EnumWindows
GetClassNameW
GetDC
PostQuitMessage
ToUnicodeEx
IsWindowEnabled
SetFocus
GetDlgCtrlID
IsDlgButtonChecked
CheckDlgButton
HideCaret
SetDlgItemTextW
GetDlgItem
MoveWindow
ShowWindow
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
RemoveMenu
InsertMenuW
GetMenuState
GetMenuStringW
InvertRect
LoadBitmapW
GetMenuItemCount
GetMenuItemID
UnregisterClassW
SetWindowLongPtrW
CallWindowProcW
CheckMenuItem
GetIconInfo
SendMessageTimeoutW
GetWindowTextW
RedrawWindow
GetWindowDC
SetMenuDefaultItem
TrackPopupMenu
AppendMenuW
CreatePopupMenu
IsZoomed
BringWindowToTop
SetLayeredWindowAttributes
ExitWindowsEx
SetParent
GetSysColor
DispatchMessageW
TranslateMessage
UpdateLayeredWindow
LoadCursorW
SetCursor
ReleaseDC
GetFocus
GetGuiResources
PeekMessageW
GetWindowTextLengthW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
GetMonitorInfoW
MonitorFromWindow
MonitorFromPoint
CopyRect
WindowFromPoint
ScreenToClient
ClientToScreen
GetCursorPos
GetWindowThreadProcessId
CloseWindowStation
EnumWindowStationsW
OpenWindowStationW
GetThreadDesktop
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
GetDoubleClickTime
ModifyMenuW
CharUpperBuffW
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
RegisterClassExW
FindWindowW
LoadStringW
NotifyWinEvent
CloseDesktop
SetThreadDesktop
EnumDesktopWindows
EnumDesktopsW
OpenDesktopW
LoadImageW
EnumDisplayMonitors
SetClassLongPtrW
SetWindowRgn
DrawStateW
DrawEdge
DrawFrameControl
SetCursorPos
CopyIcon
FrameRect
DrawIcon
GetDCEx
LockWindowUpdate
GetComboBoxInfo
GetKeyboardLayout
IsCharLowerW
EnableScrollBar
DestroyIcon
LoadIconW
GetDesktopWindow
InvalidateRect
CreateIconFromResourceEx
CreateIconIndirect
GetClipboardData
LoadMenuIndirectW
LookupIconIdFromDirectoryEx
mouse_event
GetKeyboardLayoutList
IsWindowUnicode
GetWindowLongPtrA
SetWindowLongPtrA
DefWindowProcA
CallWindowProcA
RegisterClassA
DefDlgProcA
DefDlgProcW
AdjustWindowRect
DefFrameProcA
DefMDIChildProcA
GetCursor
MapVirtualKeyExW
ShowCaret
GetClassLongW
GetTabbedTextExtentA
wsprintfW
SetWindowTextW
SendMessageW
EnableWindow
PostMessageW
ShowWindowAsync
IsIconic
LockWorkStation
EnableMenuItem
GetSubMenu
SetForegroundWindow
GetClientRect
GetParent
PostThreadMessageW
InflateRect
OffsetRect
SetTimer
KillTimer
DeleteMenu
IsWindowVisible
SetWindowPos
GetWindowLongW
SetWindowLongW
SetCapture
ReleaseCapture
IsWindow
RegisterWindowMessageW
GetKeyState
GetSystemMetrics
ShowScrollBar
GetWindowRect

gdi32

StartDocW
MoveToEx
TextOutW
PolyBezierTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetTextMetricsW
GetCharWidthW
GetTextColor
SetStretchBltMode
CreateFontW
StretchDIBits
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetDIBits
StretchBlt
SetDIBColorTable
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
OffsetRgn
GetCurrentObject
RoundRect
FillRgn
FrameRgn
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetROP2
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextFaceW
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SelectPalette
ExtSelectClipRgn
SelectClipRgn
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetCurrentPositionEx
GetClipRgn
GetClipBox
ExcludeClipRect
Escape
CreateHatchBrush
DPtoLP
SetRectRgn
PatBlt
GetMapMode
CreateRectRgnIndirect
CreatePatternBrush
CombineRgn
ExtTextOutW
CreateFontIndirectW
SetTextColor
SetBkColor
CreateBitmap
GetBoundsRect
CreateDCW
CopyMetaFileW
GetBkColor
BitBlt
GetObjectW
GetTextExtentPoint32W
CreateRectRgn
SetROP2
SaveDC
RestoreDC
Rectangle
GetBitmapDimensionEx
SetBrushOrgEx
ExtCreateRegion
GetBitmapBits
GetTextExtentPoint32A
BeginPath
CloseFigure
EndPath
FillPath
StrokeAndFillPath
StrokePath
SetTextAlign
GetBkMode
GetStockObject
CreatePen
CreateDIBSection
SelectObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SetPixel
GetDeviceCaps
DeleteObject
GetRgnBox
GetObjectType
CreateSolidBrush

msimg32

AlphaBlend
TransparentBlt

winspool.drv

ClosePrinter
DocumentPropertiesW
GetJobW
OpenPrinterW

advapi32

RegUnLoadKeyW
CheckTokenMembership
FreeSid
StartTraceW
ControlTraceW
OpenTraceW
ProcessTrace
CloseTrace
RegQueryValueExW
ChangeServiceConfigW
CloseServiceHandle
ControlService
DeleteService
EnumServicesStatusExW
OpenSCManagerW
OpenServiceW
QueryServiceConfig2W
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx
InitializeAcl
GetLengthSid
InitializeSid
GetUserNameW
ConvertStringSidToSidW
CreateServiceW
AllocateAndInitializeSid
RegLoadKeyW
LookupPrivilegeValueW
LookupAccountSidW
AdjustTokenPrivileges
OpenProcessToken
RegFlushKey
SetFileSecurityW
GetFileSecurityW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegSetValueW
QueryServiceStatus
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
LsaLookupPrivilegeDisplayName
LsaLookupPrivilegeName
LsaLookupSids
LsaOpenPolicy
LsaFreeMemory
QueryServiceConfigW
ConvertSidToStringSidW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
StartServiceW

shell32

SHAppBarMessage
SHGetMalloc
SHGetDesktopFolder
SHGetSpecialFolderLocation
ExtractIconW
DragFinish
DragQueryFileW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
Shell_NotifyIconW
SHGetFolderPathW
ShellExecuteW
SHGetFileInfoW
ExtractIconExW

comctl32

ImageList_Destroy
ImageList_Add
ImageList_AddMasked
ImageList_DrawEx
ImageList_GetIconSize
ImageList_GetImageInfo
FlatSB_GetScrollProp
ImageList_Draw
ImageList_GetBkColor
ImageList_DrawIndirect
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_GetIcon
InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathAppendW
PathRemoveBackslashW
PathIsDirectoryW
PathAddBackslashW
SHDeleteKeyW
StrFormatKBSizeW
PathRemoveFileSpecW
PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
StrCatW

uxtheme

DrawThemeText
DrawThemeBackground
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
OpenThemeData
CloseThemeData
GetThemeColor
GetCurrentThemeName
GetThemePartSize
GetWindowTheme
IsAppThemed
GetThemeSysColor

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemRealloc
CoInitializeSecurity
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleRun
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoGetClassObject
CoDisconnectObject
CLSIDFromProgID
CLSIDFromString
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoCreateGuid
CoInitializeEx
ReleaseStgMedium
OleDuplicateData
CoSetProxyBlanket
CoTaskMemAlloc
StringFromCLSID
CreateStreamOnHGlobal
StringFromGUID2
CoTaskMemFree

oleaut32

SysStringLen
VariantClear
VariantInit
VarBstrFromDate
SafeArrayDestroy
VarUdateFromDate
SafeArrayGetDim
OleCreateFontIndirect
VariantTimeToSystemTime
VariantChangeTypeEx
LoadTypeLi
SysAllocStringLen
SysAllocStringByteLen
VariantChangeType
SysStringByteLen
SysAllocString
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SystemTimeToVariantTime
SysFreeString
SafeArrayAccessData
SafeArrayUnaccessData
VariantCopy
VarDateFromStr
VarUI4FromStr
OleLoadPicturePath
VarCmp

oledlg

OleUIAddVerbMenuW
OleUIBusyW

ws2_32

WSAStartup
WSASetLastError
WSACleanup

gdiplus

GdipBitmapUnlockBits
GdipSetInterpolationMode
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipDrawRectangleI
GdipGetImagePaletteSize
GdiplusStartup
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawLineI
GdipDrawLinesI
GdipGraphicsClear
GdipFillRectangle
GdipFillRectangleI
GdipFillPolygonI
GdipDrawImageRectI
GdipDeleteFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipSetLinePresetBlend
GdipGetImageHeight
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesOutputChannel
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipSetWorldTransform
GdipResetWorldTransform
GdipGetWorldTransform
GdipDrawImageI
GdipDrawImageRectRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipCloneFont
GdipSetStringFormatHotkeyPrefix
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathBezierI
GdipReleaseDC
GdipSetSmoothingMode
GdipDrawPath
GdipFillPath
GdipMeasureString
GdipLoadImageFromStream
GdipGetImageThumbnail
GdipDrawImageRectRect
GdipCreateHICONFromBitmap
GdipCreateLineBrushI
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipCreateLineBrushFromRectWithAngleI
GdipGetImageWidth

dbghelp

ImageRvaToVa
ImageDirectoryEntryToData

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

wininet

InternetCloseHandle
HttpSendRequestW
HttpQueryInfoW
InternetReadFile
InternetSetOptionW
InternetQueryDataAvailable
HttpOpenRequestW
InternetOpenW
InternetConnectW

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundW

crypt32

CryptProtectData
CryptUnprotectData

winhttp

WinHttpOpenRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpOpen
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpCloseHandle
WinHttpSetOption
WinHttpQueryDataAvailable

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 101KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

d0fb0ca9069b699c4f8b7cc993aeccf6

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99Certificate

Key Usages

33:00:00:2f:2c:a9:5d:d6:d6:16:14:5e:7c:00:00:00:00:2f:2cCertificate

Extended Key Usages

Key Usages

33:00:00:2f:2c:a9:5d:d6:d6:16:14:5e:7c:00:00:00:00:2f:2cCertificate

Extended Key Usages

Key Usages

33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05Certificate

Key Usages

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07Certificate

Key Usages

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

33:00:00:00:2e:30:2b:14:37:07:50:ad:83:00:00:00:00:00:2eCertificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

1f:73:4d:11:1b:4b:5c:87:9b:bd:5a:8c:49:ab:2a:90Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

3d:39:02:78:ea:d6:0f:0c:14:01:80:4b:7b:70:cf:bf:74:c6:1b:51:fc:c6:29:11:d8:22:39:00:e7:58:db:00Signer

3d:39:02:78:ea:d6:0f:0c:14:01:80:4b:7b:70:cf:bf:74:c6:1b:51:fc:c6:29:11:d8:22:39:00:e7:58:db:00Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

version

winsta

iphlpapi

rpcrt4

mprapi

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

ws2_32

gdiplus

dbghelp

wtsapi32

wininet

oleacc

imm32

winmm

crypt32

winhttp

Sections

.text Size: 4.8MB - Virtual size: 4.8MB

.rdata Size: 2.1MB - Virtual size: 2.1MB

.data Size: 101KB - Virtual size: 154KB

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

33:00:00:2f:2c:a9:5d:d6:d6:16:14:5e:7c:00:00:00:00:2f:2c
Certificate

33:00:00:2f:2c:a9:5d:d6:d6:16:14:5e:7c:00:00:00:00:2f:2c
Certificate

33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05
Certificate

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:2e:30:2b:14:37:07:50:ad:83:00:00:00:00:00:2e
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

1f:73:4d:11:1b:4b:5c:87:9b:bd:5a:8c:49:ab:2a:90
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

3d:39:02:78:ea:d6:0f:0c:14:01:80:4b:7b:70:cf:bf:74:c6:1b:51:fc:c6:29:11:d8:22:39:00:e7:58:db:00
Signer

3d:39:02:78:ea:d6:0f:0c:14:01:80:4b:7b:70:cf:bf:74:c6:1b:51:fc:c6:29:11:d8:22:39:00:e7:58:db:00
Signer

.text
Size: 4.8MB - Virtual size: 4.8MB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 101KB - Virtual size: 154KB

.pdata
Size: 248KB - Virtual size: 247KB

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

.reloc
Size: 153KB - Virtual size: 152KB