2024-02-12_fd1700e2a9b161bffb10c86c04aefab6_avaddon

Sharing

Copy URL

Twitter E-mail

General

Target

2024-02-12_fd1700e2a9b161bffb10c86c04aefab6_avaddon
Size

31.2MB
MD5

fd1700e2a9b161bffb10c86c04aefab6
SHA1

909e1784f1176b2f17c758380b67d37afe984291
SHA256

802261512bbffb85beb0e543688a28f95f6dc545df774b42156da59e76ef2125
SHA512

b4eb70794bae438706f79b4e3dd4f5d984d96913aee9ea644854e6ca45d5f9ea27f898515c4dd4d64c3c5f8791e23e1a595ecf883ad7fc8d4536625087a75b0c
SSDEEP

393216:HY2QAVaZAWuutmFCsObRDZYwJzmISzzCdc3ZWUQQSGi:HtaZAWuuvsu9JSzuc3cUQQ6

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Files

2024-02-12_fd1700e2a9b161bffb10c86c04aefab6_avaddon
.exe windows:6 windows x64 arch:x64

42d6970d0159f3c1ad489c90c1355c5b

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:07:d4:0b:50:82:fe:aa:6e:0a:5e:92
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

13/07/2021, 08:55

Not After

10/10/2024, 08:23

Subject

SERIALNUMBER=1125476195459,CN=Atom Security LLC,O=Atom Security LLC,STREET=Prospect Akademika Koptyuga\, 4 office 158,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:a4:14:43:0a:41:4d:9a:e1:11:49:cc:1b:4c:6d:16:80:b9:c8:8d:43:7e:4d:b7:5b:a7:48:e2:35:11:2e:5c
Signer

Actual PE Digest

25:a4:14:43:0a:41:4d:9a:e1:11:49:cc:1b:4c:6d:16:80:b9:c8:8d:43:7e:4d:b7:5b:a7:48:e2:35:11:2e:5c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\BuildAgent\work\.build\agent_x64\relwithdebinfo64\vmnetdrv64.pdb

Imports

advapi32

GetLengthSid
OpenServiceW
StartServiceCtrlDispatcherW
RegOpenKeyExW
InitializeAcl
InitializeSecurityDescriptor
AddAce
RegSetValueExW
IsValidSid
GetSecurityDescriptorOwner
InitializeSid
CopySid
GetSecurityDescriptorControl
RegCreateKeyExW
GetSidLengthRequired
GetSidSubAuthority
GetSecurityDescriptorGroup
OpenSCManagerW
CloseServiceHandle
GetAclInformation
RegCloseKey
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
CryptGenRandom
CryptAcquireContextW
GetTokenInformation
MakeSelfRelativeSD
LookupAccountSidW
OpenThreadToken
GetSecurityDescriptorLength
RegQueryValueExW
CreateProcessAsUserW
OpenProcessToken
ConvertStringSidToSidW
SetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetAce
RegDeleteValueW
RegEnumKeyExW
DuplicateToken
SetThreadToken
ConvertSidToStringSidW
CreateWellKnownSid
RegNotifyChangeKeyValue
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
RegDisablePredefinedCache
IsValidSecurityDescriptor
GetSidIdentifierAuthority
CryptAcquireContextA
RegEnumKeyW
RegGetValueW
RegOpenKeyW
GetSidSubAuthorityCount
SystemFunction036
CryptEnumProvidersW
DuplicateTokenEx
MakeAbsoluteSD
RegEnumValueW
ChangeServiceConfigW
QueryServiceConfigW
StartServiceW
EnumDependentServicesW
ControlService
DeleteService
ChangeServiceConfig2W
SetServiceStatus
QueryServiceStatus
CreateServiceW
RegisterServiceCtrlHandlerExW
RegDeleteKeyW
IsTextUnicode
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptSignHashW

gdi32

GetObjectW
GetEnhMetaFileBits
DeleteEnhMetaFile
CopyEnhMetaFileW
SetStretchBltMode
GetDIBits
StretchBlt
DeleteDC
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
CreateFontW
CreateSolidBrush
SetBkColor
SetTextColor
GetDeviceCaps
CreateDIBSection
DeleteObject

kernel32

ResetEvent
QueueUserAPC
GetLocalTime
SwitchToThread
GetThreadId
GetFileSize
GlobalMemoryStatusEx
FreeLibrary
CopyFileW
SleepEx
SystemTimeToTzSpecificLocalTime
CreateFileMappingW
CreateIoCompletionPort
MapViewOfFileEx
OpenThread
LoadLibraryExW
IsDebuggerPresent
ConnectNamedPipe
FlushFileBuffers
GetExitCodeProcess
FindFirstFileW
FindNextFileW
FindClose
QueryDosDeviceW
GetVolumeInformationW
GetLogicalDrives
FindFirstVolumeW
lstrlenW
DeviceIoControl
FindVolumeClose
FindNextVolumeW
GetDriveTypeW
CreateDirectoryW
GetTempPathW
GetDiskFreeSpaceW
MoveFileExW
OpenEventW
VerSetConditionMask
VerifyVersionInfoW
OpenProcess
WaitForMultipleObjectsEx
SetWaitableTimer
CreateWaitableTimerW
CancelWaitableTimer
GetProcessTimes
GlobalSize
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetFileSizeEx
GetProcessId
Thread32Next
Thread32First
DuplicateHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetSystemDirectoryW
GetComputerNameW
SystemTimeToFileTime
TlsAlloc
TlsFree
FormatMessageA
TlsSetValue
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
TlsGetValue
RegisterWaitForSingleObject
UnregisterWaitEx
GetFileAttributesExW
GetVolumePathNamesForVolumeNameW
GetFullPathNameW
GetLocaleInfoW
GetUserDefaultLCID
MulDiv
GetVersionExW
GetSystemTime
GetModuleFileNameW
CreateTimerQueue
RtlUnwind
RemoveDirectoryA
ReplaceFileA
GetFileAttributesExA
MoveFileA
CompareStringA
RemoveDirectoryW
TerminateProcess
GetCurrentProcess
GetStartupInfoW
UnhandledExceptionFilter
LCMapStringW
CompareStringW
GetCPInfo
GetStringTypeW
QueueUserWorkItem
RtlPcToFileHeader
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
LoadLibraryExA
VirtualQuery
VirtualProtect
PeekNamedPipe
GetEnvironmentVariableA
CompareFileTime
MoveFileExA
GetSystemDirectoryA
GetTempFileNameA
lstrlenA
CreateDirectoryA
FindFirstFileExA
lstrcmpW
ReleaseSemaphore
SetThreadAffinityMask
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LockFileEx
CreateFileMappingA
UnlockFile
HeapCompact
GetVersionExA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnlockFileEx
GetFullPathNameA
GetSystemInfo
AreFileApisANSI
K32GetProcessImageFileNameW
GetConsoleOutputCP
InitializeCriticalSection
OutputDebugStringA
TzSpecificLocalTimeToSystemTime
GetDriveTypeA
WriteConsoleW
CreateThread
ExitProcess
GetFileInformationByHandleEx
CreateMutexA
AcquireSRWLockShared
QueryPerformanceFrequency
WakeConditionVariable
SleepConditionVariableSRW
GetOverlappedResult
SetHandleInformation
SetFilePointerEx
SetFileInformationByHandle
GetCommandLineW
GetEnvironmentStringsW
RtlLookupFunctionEntry
RtlCaptureContext
SetThreadStackGuarantee
ReleaseSRWLockShared
FreeEnvironmentStringsW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryW
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
GetFileType
GetEnvironmentVariableW
GetStdHandle
RtlVirtualUnwind
CreateFiber
DeleteFiber
SwitchToFiber
GetComputerNameA
FindNextFileA
FindFirstFileA
GetCurrentDirectoryW
DeleteFileA
FindFirstFileExW
WTSGetActiveConsoleSessionId
GetComputerNameExW
GetTempFileNameW
GetFileAttributesW
GetFileInformationByHandle
MapViewOfFile
SetUnhandledExceptionFilter
QueryPerformanceCounter
K32GetModuleInformation
K32GetModuleBaseNameW
K32GetModuleFileNameExA
RtlCaptureStackBackTrace
GetModuleHandleExW
GetACP
GetSystemDefaultLCID
GetOEMCP
GetDateFormatW
CreateSemaphoreW
GetTimeFormatW
FileTimeToLocalFileTime
K32EnumProcesses
K32GetModuleFileNameExW
SetLastError
HeapCreate
TryEnterCriticalSection
ReadFile
GetTickCount
GetSystemTimeAsFileTime
WideCharToMultiByte
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
LocalFree
SignalObjectAndWait
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
CloseHandle
HeapReAlloc
DeleteFileW
LockResource
TerminateThread
GetLastError
FormatMessageW
Sleep
ProcessIdToSessionId
GetExitCodeThread
MultiByteToWideChar
PostQueuedCompletionStatus
HeapSize
GetCurrentThreadId
LocalAlloc
WaitForSingleObject
InitializeCriticalSectionEx
SetFilePointer
SetErrorMode
LeaveCriticalSection
SetEnvironmentVariableW
ExpandEnvironmentStringsW
WriteFile
EnterCriticalSection
HeapFree
SizeofResource
HeapSetInformation
GetThreadPriority
WaitForSingleObjectEx
GetCurrentThread
FileTimeToSystemTime
SetEvent
GetTimeZoneInformation
CreateEventW
DisconnectNamedPipe
UnmapViewOfFile
ResumeThread
ReleaseMutex
CreateFileW
CreateMutexW
EnumResourceNamesW
SetEndOfFile
GetQueuedCompletionStatus
SetThreadPriority
WaitForMultipleObjects
LockFile
CreateNamedPipeW
WaitNamedPipeW
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
InterlockedFlushSList
QueryDepthSList
RtlUnwindEx
ExitThread
SetConsoleCtrlHandler
GetCommandLineA
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
SetStdHandle

ole32

CoInitializeEx
CLSIDFromString
WriteClassStg
StringFromGUID2
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoFreeUnusedLibraries
CoSetProxyBlanket
CoInitializeSecurity
StgCreateDocfile
CoInitialize
CoTaskMemAlloc
CreatePointerMoniker
PropVariantClear
CreateBindCtx

oleaut32

VariantChangeType
SysFreeString
VariantClear
VariantInit
SysAllocString

user32

DispatchMessageW
DestroyIcon
DestroyMenu
TranslateMessage
LoadIconW
AppendMenuW
GetClassInfoExW
SetForegroundWindow
GetCursorPos
GetWindowLongW
GetWindow
GetWindowRect
DestroyWindow
SetWindowPos
MonitorFromWindow
CreatePopupMenu
LoadStringW
PostMessageW
DefWindowProcW
GetMessageW
GetWindowTextW
SystemParametersInfoW
GetForegroundWindow
IsWindowVisible
GetWindowTextLengthW
SetWindowsHookExW
UnhookWindowsHookEx
PostThreadMessageA
SetWindowLongPtrW
SetWindowTextW
GetMonitorInfoW
CallNextHookEx
GetLastInputInfo
TrackPopupMenu
RegisterClassExW
CreateWindowExW
EnumChildWindows
SetDlgItemTextW
MapWindowPoints
GetClientRect
PostQuitMessage
KillTimer
SetClipboardData
GetClipboardSequenceNumber
LoadCursorW
GetClipboardData
EmptyClipboard
GetParent
RegisterDeviceNotificationW
CloseClipboard
SetTimer
OpenClipboard
GetPriorityClipboardFormat
UnregisterDeviceNotification
GetWindowLongPtrW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
UnregisterClassW
CopyImage
GetClipboardOwner
CallWindowProcW
GetWindowThreadProcessId
UnhookWinEvent
SetWinEventHook
PostThreadMessageW
GetSystemMetrics
CharLowerBuffW
GetKeyNameTextW
MapVirtualKeyExW
GetGUIThreadInfo
GetClassNameW
GetKeyboardLayout
PeekMessageW
CharUpperBuffW
IsWindow
WindowFromPoint
MsgWaitForMultipleObjects
GetFocus
GetKeyState
ActivateKeyboardLayout
ToUnicodeEx
GetKeyboardLayoutList
GetKeyboardLayoutNameW
IsIconic
SendMessageW
FindWindowExW
ReleaseDC
GetDC
SendInput
mouse_event
LoadKeyboardLayoutW
keybd_event
MapVirtualKeyW
VkKeyScanExW
EnumWindows
IsDialogMessageW
ShowWindow
CreateDialogParamW
GetDlgItem
GetDesktopWindow
SetCapture
GetIconInfo
SetThreadDesktop
CloseDesktop
GetCursorInfo
OpenInputDesktop
PrintWindow
DrawIconEx
DdeAccessData
DdeUnaccessData
DdeCreateStringHandleW
DdeConnect
DdeGetLastError
DdeInitializeW
DdeUninitialize
DdeClientTransaction
DdeFreeDataHandle
DdeDisconnect
DdeFreeStringHandle
RedrawWindow
GetDlgCtrlID
GetSysColor
SetWindowLongW
SetDlgItemInt
InvalidateRect
ExitWindowsEx
MessageBeep
FlashWindow
SetFocus

winspool.drv

OpenPrinterW
SetPrinterW
GetPrinterW
GetJobW
EnumPrintProcessorDatatypesW
FreePrinterNotifyInfo
SetJobW
FindClosePrinterChangeNotification
EnumJobsW
EnumPrintersW
FindNextPrinterChangeNotification
ClosePrinter
FindFirstPrinterChangeNotification

ws2_32

accept
bind
WSAIoctl
closesocket
WSASend
gethostbyname
select
ntohl
shutdown
listen
WSASetLastError
WSAStringToAddressW
WSASocketW
getpeername
ntohs
connect
WSAAddressToStringW
getservbyname
__WSAFDIsSet
WSARecv
gethostname
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
sendto
getnameinfo
freeaddrinfo
getaddrinfo
inet_addr
socket
recvfrom
recv
send
inet_ntoa
getsockopt
htons
setsockopt
WSAGetLastError
htonl
WSACleanup
WSAStartup
getsockname
ioctlsocket

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

dbghelp

ImageNtHeader
MiniDumpWriteDump

wldap32

ord26
ord35
ord41
ord50
ord45
ord22
ord27
ord33
ord60
ord211
ord46
ord79
ord30
ord200
ord301
ord32
ord143
ord217

nspr4

PR_GetError
PR_Cleanup
PR_Init
PR_ErrorToString

nss3

CERT_AsciiToName
CERT_GetCommonName
PK11_FreeSlot
PK11_ImportCert
CERT_DestroyCertificate
CERT_GetDefaultCertDB
PK11_FindCertFromDERCert
CERT_DecodeTrustString
NSS_NoDB_Init
PORT_ZAlloc
PK11_GetInternalKeySlot
CERT_DestroyName
NSS_Initialize
CERT_GetOrgName
CERT_ChangeCertTrust
PORT_Free
NSS_Shutdown

smime3

CERT_DecodeCertFromPackage

shlwapi

UrlEscapeA
PathFindFileNameW
PathFindExtensionW
StrCmpIW
PathAddExtensionW
PathIsDirectoryW
ord219
SHCreateStreamOnFileEx
PathMatchSpecW
PathStripPathW
PathCanonicalizeW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathStripPathA
StrToInt64ExA
PathCombineW
StrStrIW
StrToIntA
PathRemoveExtensionW
PathIsRootW
SHDeleteKeyW
PathStripToRootW
PathIsUNCW

userenv

UnloadUserProfile
CreateEnvironmentBlock
ExpandEnvironmentStringsForUserW
DestroyEnvironmentBlock

gdiplus

GdiplusShutdown
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdipGetImageHeight
GdipImageRotateFlip
GdipBitmapUnlockBits
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipGetImageWidth
GdiplusStartup
GdipGetImageEncoders

pdh

PdhOpenQueryW
PdhCloseQuery
PdhCollectQueryData
PdhRemoveCounter
PdhGetFormattedCounterValue
PdhGetRawCounterValue
PdhLookupPerfNameByIndexW
PdhAddCounterW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSEnumerateSessionsW
WTSLogoffSession
WTSQueryUserToken

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
CM_Get_DevNode_Status
CM_Enable_DevNode
SetupDiEnumDeviceInterfaces
CM_Get_Device_ID_ExW
CM_Get_Sibling
CM_Get_Device_ID_Size_Ex
CM_Get_Child
CM_Disable_DevNode
CMP_WaitNoPendingInstallEvents
CM_Get_Parent_Ex
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Registry_Property_ExW
CM_Get_Parent
SetupDiDestroyDeviceInfoList

fltlib

FilterGetMessage
FilterReplyMessage
FilterGetDosName
FilterVolumeFindNext
FilterSendMessage
FilterConnectCommunicationPort
FilterLoad
FilterVolumeFindClose
FilterVolumeFindFirst
FilterUnload

activeds

ord9

oleacc

AccessibleObjectFromWindow
AccessibleChildren

wintrust

WinVerifyTrust

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer

netapi32

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
NetApiBufferFree
NetWkstaGetInfo
DsGetDcNameW

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertAddEncodedCertificateToStore
CryptBinaryToStringA
CryptStringToBinaryA
CertFindExtension
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CryptDecodeObjectEx
CertAddCertificateContextToStore
PFXImportCertStore

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

Exports

Exports

AddInLog
GetMAPIModule

Sections

.text
Size: 19.4MB - Virtual size: 19.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10.0MB - Virtual size: 10.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 463KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42d6970d0159f3c1ad489c90c1355c5b

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

47:07:d4:0b:50:82:fe:aa:6e:0a:5e:92Certificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

25:a4:14:43:0a:41:4d:9a:e1:11:49:cc:1b:4c:6d:16:80:b9:c8:8d:43:7e:4d:b7:5b:a7:48:e2:35:11:2e:5cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

gdi32

kernel32

ole32

oleaut32

user32

winspool.drv

ws2_32

rpcrt4

version

dbghelp

wldap32

nspr4

nss3

smime3

shlwapi

userenv

gdiplus

pdh

wtsapi32

setupapi

fltlib

activeds

oleacc

wintrust

secur32

netapi32

crypt32

bcrypt

Exports

Exports

Sections

.text Size: 19.4MB - Virtual size: 19.4MB

.rdata Size: 10.0MB - Virtual size: 10.0MB

.data Size: 463KB - Virtual size: 2.0MB

.pdata Size: 1.2MB - Virtual size: 1.2MB

.gehcont Size: 512B - Virtual size: 40B

.rsrc Size: 25KB - Virtual size: 25KB

.reloc Size: 177KB - Virtual size: 177KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

47:07:d4:0b:50:82:fe:aa:6e:0a:5e:92
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

25:a4:14:43:0a:41:4d:9a:e1:11:49:cc:1b:4c:6d:16:80:b9:c8:8d:43:7e:4d:b7:5b:a7:48:e2:35:11:2e:5c
Signer

.text
Size: 19.4MB - Virtual size: 19.4MB

.rdata
Size: 10.0MB - Virtual size: 10.0MB

.data
Size: 463KB - Virtual size: 2.0MB

.pdata
Size: 1.2MB - Virtual size: 1.2MB

.gehcont
Size: 512B - Virtual size: 40B

.rsrc
Size: 25KB - Virtual size: 25KB

.reloc
Size: 177KB - Virtual size: 177KB