03d647f66065d03b4b03c5965688c08853eb1542bca1d371d5a1e59f2183f3b7

Sharing

Copy URL

Twitter E-mail

General

Target

03d647f66065d03b4b03c5965688c08853eb1542bca1d371d5a1e59f2183f3b7
Size

1.4MB
MD5

9314d1bf968eb3529fc0048e9bd8cc6e
SHA1

33ed0954e05dd952f2b5ea4e0f3d54490cadcff8
SHA256

03d647f66065d03b4b03c5965688c08853eb1542bca1d371d5a1e59f2183f3b7
SHA512

12a6e12aca43fd731524f94fe0459c97f942befafc47299ba4acbafa1c46e1e92dc788a59df20b4f1924325fb74916bf2d6f95dc3d5fdf72c7626821231972c6
SSDEEP

24576:iDEhL47pTOAVjfhzsXBn6NjVpWBcXEDYVU85sqHLtFAWruNoWdj:NSiXBnAVpWBmFAWqNx

Score

1^/10

Malware Config

Signatures

Files

03d647f66065d03b4b03c5965688c08853eb1542bca1d371d5a1e59f2183f3b7
.dll windows:5 windows x86 arch:x86

2b1a302dde35b4126b2d064635672de2

Code Sign

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:cd:09:33:f3:bd:45:dd:95:d1:07:46:75:b8:11:e0
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

16-06-2022 00:00

Not After

16-06-2023 23:59

Subject

CN=南京和御嘉网络科技有限公司,O=南京和御嘉网络科技有限公司,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:cd:09:33:f3:bd:45:dd:95:d1:07:46:75:b8:11:e0
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

16-06-2022 00:00

Not After

16-06-2023 23:59

Subject

CN=南京和御嘉网络科技有限公司,O=南京和御嘉网络科技有限公司,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8e:4a:44:32:66:88:f7:f1:3e:49:01:82:98:d4:58:6d:73:7b:70:fb:f6:b0:05:82:dc:14:ec:f6:60:67:3f:5d
Signer

Actual PE Digest

8e:4a:44:32:66:88:f7:f1:3e:49:01:82:98:d4:58:6d:73:7b:70:fb:f6:b0:05:82:dc:14:ec:f6:60:67:3f:5d

Digest Algorithm

sha256

PE Digest Matches

false

d5:97:09:01:95:d5:ac:ea:0b:6b:3b:a0:98:fe:b1:82:59:62:af:35
Signer

Actual PE Digest

d5:97:09:01:95:d5:ac:ea:0b:6b:3b:a0:98:fe:b1:82:59:62:af:35

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\runtime\build_temp\pdb\Win32_release_static\KKRtNsisMiniExtend.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetOpenUrlA
HttpOpenRequestW
InternetOpenW
InternetSetFilePointer
HttpQueryInfoW
InternetOpenUrlW
InternetQueryOptionW
HttpAddRequestHeadersW
InternetReadFile
InternetSetOptionW
InternetConnectW
InternetCloseHandle
HttpSendRequestW
InternetOpenA
InternetSetOptionA

psapi

GetModuleFileNameExW
GetProcessImageFileNameW

netapi32

NetUserGetLocalGroups
NetApiBufferFree

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW

kernel32

GetLastError
DisableThreadLibraryCalls
GlobalAlloc
GlobalFree
GetCurrentProcessId
SystemTimeToFileTime
CreateProcessW
lstrcpyW
GetSystemTime
GetExitCodeProcess
InterlockedDecrement
GetVersionExW
GetSystemInfo
GetProcAddress
GetModuleHandleW
lstrcmpiW
HeapFree
SetPriorityClass
GetCurrentProcess
SetThreadPriority
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
GetCurrentThread
QueryPerformanceFrequency
GetThreadPriority
RaiseException
LoadLibraryW
HeapAlloc
DecodePointer
GetPriorityClass
IsProcessorFeaturePresent
DeleteCriticalSection
GetProcessHeap
GlobalMemoryStatusEx
QueryPerformanceCounter
FreeLibrary
WideCharToMultiByte
LocalFree
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
MoveFileExW
CopyFileW
GetDriveTypeW
GetModuleFileNameW
Module32FirstW
Module32NextW
GetTickCount
GetCurrentThreadId
ResumeThread
QueryDosDeviceW
GetLogicalDriveStringsW
GetFileSizeEx
SearchPathW
SetLastError
GetFullPathNameW
GetLongPathNameW
lstrlenW
DeviceIoControl
SetFileTime
GetTempPathW
CreateFileW
GetSystemDirectoryW
GetFileInformationByHandle
GetFileAttributesExW
GetCurrentDirectoryW
GetWindowsDirectoryW
SetCurrentDirectoryW
SystemTimeToTzSpecificLocalTime
MoveFileW
LoadLibraryExW
SizeofResource
WritePrivateProfileStringW
ExpandEnvironmentStringsW
WaitForSingleObject
Sleep
EnumResourceNamesW
FreeResource
GetVersion
LockResource
LoadResource
FindResourceW
WTSGetActiveConsoleSessionId
FormatMessageW
lstrcatW
GlobalLock
GlobalUnlock
ReadFile
WriteFile
SetFilePointer
SetEndOfFile
GetFileSize
GetFileTime
FindFirstFileW
FindNextFileW
FindClose
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleA
LocalAlloc
CreateProcessA
lstrcmpW
VerifyVersionInfoW
VerSetConditionMask
lstrcmpA
OutputDebugStringW
InterlockedPushEntrySList
RtlUnwind
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
CreateEventW
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
TerminateProcess
FileTimeToSystemTime
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
InterlockedFlushSList
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetACP
HeapReAlloc
GetPrivateProfileStringW
GetEnvironmentVariableW
OpenProcess
SetEnvironmentVariableW
lstrcpynW
GetStdHandle
GetFileType
GetTimeZoneInformation
SetConsoleCtrlHandler
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
HeapSize
SetStdHandle
WriteConsoleW
OutputDebugStringA
WaitForSingleObjectEx
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetTempFileNameW
VirtualQuery
GetUserDefaultLCID

user32

IsIconic
SetForegroundWindow
GetWindowTextW
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
LoadStringW
GetActiveWindow
ShowWindow
GetDlgItem
GetParent
PostMessageW
GetWindowRect
GetClassInfoW
IsWindowEnabled
EnumWindows
GetClassNameW
UnregisterClassW
GetSystemMetrics
GetWindowThreadProcessId
SendMessageTimeoutW
wsprintfW
GetDesktopWindow
IsZoomed
GetClientRect
GetForegroundWindow
AttachThreadInput
MapWindowPoints
IsChild
GetMonitorInfoW
GetShellWindow
SetWindowTextW
MonitorFromWindow
SetWindowPos
IsWindowVisible
GetWindow
GetWindowTextLengthW
GetWindowLongW

gdi32

CombineRgn
CreateRectRgn

comdlg32

GetOpenFileNameW

advapi32

GetFileSecurityW
GetLengthSid
LookupAccountNameW
GetTokenInformation
RegDeleteKeyW
BuildExplicitAccessWithNameW
SetEntriesInAclW
RegCreateKeyExW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegSaveKeyW
RegEnumKeyExW
RegSetValueExW
RegLoadKeyW
RegRestoreKeyW
RegDeleteValueW
GetUserNameW
RegEnumValueW
RegCloseKey
RegEnumKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
FreeSid
OpenProcessToken
CopySid
AllocateAndInitializeSid
EqualSid
GetAce
GetSecurityDescriptorDacl
AdjustTokenPrivileges
LookupPrivilegeValueW
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CheckTokenMembership

shell32

ShellExecuteExW
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
DragQueryFileW
SHGetSpecialFolderPathW
ord680
SHGetFileInfoW

ole32

CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitialize

oleaut32

CreateErrorInfo
SetErrorInfo
SysFreeString
VariantClear
GetErrorInfo
SysAllocStringLen
VariantInit
SysAllocString
VariantChangeType

shlwapi

PathCanonicalizeW

Exports

Exports

AddToFirewall
CheckInstallLimit
CheckSoftInstalled
ConvertSoftInstallTime
CreateSoftInstalltime
CryptSubChannel
Exec
ExecWait
ExecWaitHide
ForceDeleteFile
GetChannelFromName
GetDefaultBrowser
GetExeName
GetNameOption
GetOptions
GetParentFileName
GetParentPid
GetSoftPublicParam
GetSpecialBuild
GetSubChannel
GetSubfix
GetTime
GetType
PinToTaskbar
PrintDebugMessage
QueryIsShowUninstallAdvert
QueryUninstallAdvert
QueryUrl
SendExitInstallStatEx
SendUserQuestionStatEx
SetIEEmulation
TaskKill
TaskKillByHwnd
TaskKillByPath
UnPinFromTaskBar
UnPinFromTaskBar2
UrlEncode

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b1a302dde35b4126b2d064635672de2

Code Sign

01Certificate

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

30:cd:09:33:f3:bd:45:dd:95:d1:07:46:75:b8:11:e0Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

01Certificate

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

30:cd:09:33:f3:bd:45:dd:95:d1:07:46:75:b8:11:e0Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

8e:4a:44:32:66:88:f7:f1:3e:49:01:82:98:d4:58:6d:73:7b:70:fb:f6:b0:05:82:dc:14:ec:f6:60:67:3f:5dSigner

d5:97:09:01:95:d5:ac:ea:0b:6b:3b:a0:98:fe:b1:82:59:62:af:35Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

wininet

psapi

netapi32

setupapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 188KB - Virtual size: 187KB

.data Size: 10KB - Virtual size: 18KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 52KB - Virtual size: 52KB

01
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

30:cd:09:33:f3:bd:45:dd:95:d1:07:46:75:b8:11:e0
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

01
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

30:cd:09:33:f3:bd:45:dd:95:d1:07:46:75:b8:11:e0
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

8e:4a:44:32:66:88:f7:f1:3e:49:01:82:98:d4:58:6d:73:7b:70:fb:f6:b0:05:82:dc:14:ec:f6:60:67:3f:5d
Signer

d5:97:09:01:95:d5:ac:ea:0b:6b:3b:a0:98:fe:b1:82:59:62:af:35
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 188KB - Virtual size: 187KB

.data
Size: 10KB - Virtual size: 18KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 52KB - Virtual size: 52KB