General

Malware Config

Signatures

Files

• 68222440e7fab33d7b5ec1b6e2672962

  .exe windows:4 windows x86 arch:x86

  4e0230218d44198d72f8950221b8a209

  
  

  Code Sign

  01:5d:2b:ad:01:e2:8a:76:fb:78:47:0f:3c:d8:a5:d3

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  03-02-2018 00:00

  Not After

  14-04-2021 12:00

  Subject

  CN=Eclipse.org Foundation\, Inc.,OU=IT,O=Eclipse.org Foundation\, Inc.,L=Nepean,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  10-11-2006 00:00

  Not After

  10-11-2031 00:00

  Subject

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-05-2019 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

  Certificate

  Issuer

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  23-10-2020 00:00

  Not After

  22-01-2032 23:59

  Subject

  CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  40:96:be:f4:43:a8:bb:3d:d5:8f:43:56:b1:a9:0f:73:3e:26:05:2b

  Signer

  Actual PE Digest

  40:96:be:f4:43:a8:bb:3d:d5:8f:43:56:b1:a9:0f:73:3e:26:05:2b

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetProcAddress

  RtlMoveMemory

  GetModuleHandleW

  WriteFile

  RtlFillMemory

  msvbvm60

  __vbaVarSub

  _CIcos

  _adj_fptan

  __vbaVarMove

  __vbaStrI4

  __vbaVarVargNofree

  __vbaFreeVar

  __vbaAryMove

  __vbaStrVarMove

  __vbaLenBstr

  __vbaFreeVarList

  _adj_fdiv_m64

  ord698

  __vbaFreeObjList

  __vbaStrErrVarCopy

  _adj_fprem1

  __vbaStrCat

  __vbaSetSystemError

  __vbaHresultCheckObj

  __vbaLenVar

  _adj_fdiv_m32

  __vbaAryDestruct

  ord595

  __vbaObjSet

  _adj_fdiv_m16i

  __vbaObjSetAddref

  _adj_fdivr_m16i

  __vbaVarTstLt

  __vbaRefVarAry

  __vbaBoolVarNull

  _CIsin

  ord631

  __vbaChkstk

  ord526

  EVENT_SINK_AddRef

  ord528

  __vbaAryConstruct2

  ord638

  __vbaVarLikeVar

  DllFunctionCall

  _adj_fpatan

  __vbaRedim

  EVENT_SINK_Release

  __vbaNew

  _CIsqrt

  EVENT_SINK_QueryInterface

  __vbaExceptHandler

  __vbaStrToUnicode

  ord606

  _adj_fprem

  _adj_fdivr_m64

  ord607

  __vbaFPException

  ord717

  __vbaStrVarVal

  __vbaUbound

  __vbaVarCat

  ord644

  ord537

  _CIlog

  __vbaNew2

  __vbaR8Str

  __vbaVar2Vec

  _adj_fdiv_m32i

  _adj_fdivr_m32i

  __vbaStrCopy

  __vbaI4Str

  __vbaFreeStrList

  _adj_fdivr_m32

  _adj_fdiv_r

  ord100

  __vbaI4Var

  __vbaAryLock

  __vbaVarAdd

  __vbaStrToAnsi

  __vbaVarDup

  __vbaVarCopy

  ord617

  _CIatan

  __vbaStrMove

  __vbaCastObj

  _allmul

  _CItan

  __vbaAryUnlock

  _CIexp

  __vbaFreeStr

  __vbaFreeObj

  Sections

  .text

  Size: 2.6MB - Virtual size: 2.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ