Setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Setup.exe
Size

3.3MB
MD5

63dca765b1a08d04e426024c2d80ffa7
SHA1

2f165b285953927862933d4f4b50642f06f13e44
SHA256

a7a970bfc032f37d917c7fac677ac3c02232445589696c677ac3b51e7b3ee2f5
SHA512

7cb16c9f989c7d9b7475f6f74b7f52d9a03c36b9da7d3e790af851da043628782687bf75f691cea0121d8ddc054e27f2502ae21d15caf75d8c43c127ef26512e
SSDEEP

49152:OiB2TU/SsqUrvI6qRtz4VcGxsyLs1wjLkHBRNzx/UbWhWpXBGEV5LG7jl1L8CUBC:O221OExDhWpUELQ78CwC

Score

1^/10

Malware Config

Signatures

Files

Setup.exe
.exe windows:5 windows x64 arch:x64

0e319b43d1813a34cd35e23db2470f2c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0c:d1:3b:35:b6:8d:d6:d2:92:db:a4:bd:79:cc:8b:82
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22/02/2022, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:3b:35:b6:8d:d6:d2:92:db:a4:bd:79:cc:8b:82
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22/02/2022, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Corel Corporation,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:c0:36:6e:71:04:8c:c4:e0:65:58:ca:0a:39:0f:3f:b3:0d:e5:b5:e2:f3:b9:b5:27:ce:d3:1a:45:cb:e1:0d
Signer

Actual PE Digest

61:c0:36:6e:71:04:8c:c4:e0:65:58:ca:0a:39:0f:3f:b3:0d:e5:b5:e2:f3:b9:b5:27:ce:d3:1a:45:cb:e1:0d

Digest Algorithm

sha256

PE Digest Matches

true

ff:98:39:13:8f:78:7f:51:3f:be:a4:f1:f8:5c:db:29:5c:89:7d:b2
Signer

Actual PE Digest

ff:98:39:13:8f:78:7f:51:3f:be:a4:f1:f8:5c:db:29:5c:89:7d:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Z:\bld\CDGS2022-CDGSSEV24-JOB1\src\x64\Release\Setup.pdb

Imports

gdiplus

GdipGetImageGraphicsContext
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipFree
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDisposeImage
GdipAlloc
GdipGetImagePixelFormat

setupxml

??0CXMLFileManagerInterface@@QEAA@XZ
?SetFeatureData@CXMLFileManagerInterface@@QEAA_NUCXML_FEATURE_DATA@@@Z
?GetFeatureData@CXMLFileManagerInterface@@QEAA_NPEB_WPEAUCXML_FEATURE_DATA@@@Z
?GetFeatureData@CXMLFileManagerInterface@@QEAA_NHPEAUCXML_FEATURE_DATA@@@Z
?ToggleCheck@CXMLFileManagerInterface@@QEAAXH_N@Z
?RemoveAll@CXMLFileManagerInterface@@QEAAJPEB_W@Z
?IsXMLLoaded@CXMLFileManagerInterface@@QEAA_NXZ
?GetAttributeSingleNode@CXMLFileManagerInterface@@QEAA?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEB_W0W4XMLFILENAMES@@@Z
?SetAttributeSingleNode@CXMLFileManagerInterface@@QEAA_NPEB_W00W4XMLFILENAMES@@@Z
?Select@CXMLFileManagerInterface@@QEAAJPEB_W@Z
?GetParentAttribute@CXMLFileManagerInterface@@QEAA?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEB_W@Z
GetOsLanguage
??0CXMLFileManagerInterface@@QEAA@AEBV0@@Z
?AddNodeAsChild@CXMLFileManagerInterface@@QEAA_NPEB_W@Z
??1CXMLFileManagerInterface@@UEAA@XZ
?GetAttributeBool@CXMLFileManagerInterface@@QEAA_NPEB_W@Z
?SetAttribute@CXMLFileManagerInterface@@QEAA_NPEB_W_N@Z
?AddNodeToEndOfList@CXMLFileManagerInterface@@QEAA_NPEB_W@Z
?SetAttribute@CXMLFileManagerInterface@@QEAA_NPEB_WI@Z
?CounterLast@CXMLFileManagerInterface@@QEAAJXZ
?GetAttribute@CXMLFileManagerInterface@@QEAA?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEB_W@Z
?CounterNext@CXMLFileManagerInterface@@QEAAJXZ
?SetAttribute@CXMLFileManagerInterface@@QEAA_NPEB_W0@Z
?Init@CXMLFileManagerInterface@@SAJPEB_W@Z
?UnInitialize@CXMLFileManagerInterface@@QEAAXXZ
?Saveit@CXMLFileManagerInterface@@QEAAJPEB_W_N@Z
?ToggleCheck@CXMLFileManagerInterface@@QEAAXPEB_W_N@Z
?SetFileIndex@CXMLFileManagerInterface@@QEAAXW4XMLFILENAMES@@@Z
?CreateXML@CXMLFileManagerInterface@@QEAAJPEB_W@Z

script

?OnSetupPrerequisites@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnAfterExecutePatches@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnBeforeExecutePatches@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnAfterExecuteChain@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnBeforeExecuteChain@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnSetupInitialization@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?ScheduleGAPost@CScript@@SAXPEAVCUtlXSetupEng@@@Z
?ScheduleTracking@CScript@@SAXPEAVCUtlXSetupEng@@@Z
?OnWizardCompleteSilent@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnWizardCompleteError@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnWizardCompleteSuccess@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnWizardCompleteReboot@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnWizardStart@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnWizardProgressStart@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnWizardInit@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnCustomCommandLine_S@CScript@@SAIPEAVCUtlXSetupEng@@@Z
?OnFeatureSelectionChanged@CScript@@SAIPEAVCUtlXSetupEng@@UCXML_FEATURE_DATA@@@Z

kernel32

GlobalGetAtomNameW
GetCurrentDirectoryW
CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
SetErrorMode
GetTickCount
GetWindowsDirectoryW
lstrcpyW
VerSetConditionMask
VerifyVersionInfoW
TlsFree
GetProfileIntW
SearchPathW
VirtualProtect
GetUserDefaultLCID
FindResourceExW
GetCommandLineW
GetSystemTimeAsFileTime
ExitProcess
AreFileApisANSI
IsDebuggerPresent
IsProcessorFeaturePresent
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
CreateThread
ExitThread
GetSystemInfo
VirtualAlloc
VirtualQuery
HeapQueryInformation
SetStdHandle
GetFileType
GetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetTimeZoneInformation
GetStringTypeW
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
OutputDebugStringW
GetDriveTypeW
WriteConsoleW
SetEnvironmentVariableA
GetNativeSystemInfo
GetUserGeoID
GetLongPathNameW
GetSystemTime
DeviceIoControl
lstrlenA
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
PeekNamedPipe
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GetThreadLocale
lstrcmpiW
DuplicateHandle
UnlockFile
SetFilePointer
SetEndOfFile
LocalReAlloc
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
GlobalFindAtomW
GetSystemDirectoryW
LeaveCriticalSection
EnterCriticalSection
EncodePointer
SystemTimeToFileTime
SetFileTime
SetFileAttributesW
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FileTimeToSystemTime
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
SetThreadPriority
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleHandleExW
OutputDebugStringA
GetCurrentProcessId
FreeResource
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
GetVersionExW
GetCurrentThreadId
GetCurrentThread
SetLastError
MulDiv
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
Process32NextW
Module32NextW
Module32FirstW
Process32FirstW
CreateToolhelp32Snapshot
GetExitCodeProcess
CreateProcessW
WaitForSingleObject
WriteFile
CreateFileW
LocalFree
FormatMessageW
CopyFileW
GetTempPathW
DeleteCriticalSection
DecodePointer
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
WideCharToMultiByte
CreateDirectoryW
lstrcmpW
GetModuleHandleW
GetDiskFreeSpaceExW
FreeLibrary
GetProcAddress
LoadLibraryW
MultiByteToWideChar
CopyFileExW
GetExitCodeThread
Sleep
SuspendThread
ResumeThread
GetCurrentProcess
GetLastError
CreateMutexW
RemoveDirectoryW
GetModuleFileNameW
SetEvent
DeleteFileW
CloseHandle
CreateEventW
FindResourceW
LoadResource
LockResource
SizeofResource
LocalAlloc
GlobalHandle
ReadFile
GlobalReAlloc
GetTempFileNameW

user32

GetMenuItemInfoW
DestroyMenu
LoadMenuW
SendDlgItemMessageA
FillRect
ClientToScreen
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
MapVirtualKeyW
GetKeyNameTextW
GetMonitorInfoW
MonitorFromWindow
GetScrollInfo
SetScrollInfo
UnhookWindowsHookEx
GetTopWindow
GetClassNameW
GetClassLongPtrW
PtInRect
EqualRect
CopyRect
GetSysColor
MapWindowPoints
AdjustWindowRectEx
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
GetForegroundWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
GetMessageTime
GetMessagePos
SetCursor
ShowOwnedPopups
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
CallNextHookEx
SetWindowsHookExW
ValidateRect
GetKeyState
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
SetWindowLongW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetFocus
TranslateMDISysAccel
GetDlgCtrlID
CheckDlgButton
MoveWindow
GetDesktopWindow
SetActiveWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
InflateRect
GetLastActivePopup
GetWindowLongW
IsWindowEnabled
MapDialogRect
SetWindowContextHelpId
PostQuitMessage
RemoveMenu
AppendMenuW
InsertMenuW
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
FrameRect
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
GetWindowThreadProcessId
GetWindow
EnumDesktopWindows
PostMessageW
ScreenToClient
GetCursorPos
EnableMenuItem
GetSystemMenu
MessageBoxW
GetDlgItem
DefWindowProcW
UpdateLayeredWindow
SetWindowPos
SetWindowLongPtrW
CharUpperBuffW
ModifyMenuW
SetMenuDefaultItem
CopyIcon
GetDoubleClickTime
SetClassLongPtrW
SetCursorPos
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
LockWindowUpdate
MapVirtualKeyExW
IsCharLowerW
GetWindowLongPtrW
CreateWindowExW
UnregisterClassW
GetKeyboardLayout
IsZoomed
GetComboBoxInfo
TrackMouseEvent
MonitorFromPoint
IsMenu
SetWindowRgn
DrawFrameControl
RegisterClassExW
LoadCursorW
SystemParametersInfoW
UpdateWindow
SetLayeredWindowAttributes
GetWindowRect
DrawIcon
GetClientRect
IsIconic
GetAsyncKeyState
LoadImageW
LoadIconW
wsprintfW
LoadBitmapW
GetParent
SendMessageW
EnableWindow
KillTimer
SetTimer
IsWindowVisible
SetForegroundWindow
ShowWindow
FindWindowW
ReleaseDC
GetDC
GetSystemMetrics
RegisterWindowMessageW
DrawEdge
DrawStateW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
CharUpperW
GetSysColorBrush
WaitMessage
SetCapture
ReleaseCapture
WindowFromPoint
CopyImage
DeleteMenu
RealChildWindowFromPoint
InvalidateRect
CharNextW
OffsetRect
CopyAcceleratorTableW
InvalidateRgn
SetRect
IntersectRect
IsRectEmpty
GetNextDlgGroupItem
MessageBeep
DestroyIcon
BringWindowToTop
LoadAcceleratorsW
TranslateAcceleratorW
CreatePopupMenu
InsertMenuItemW
SetRectEmpty
UnpackDDElParam
ReuseDDElParam
RegisterClipboardFormatW
GetMenuDefaultItem
DrawFocusRect
DrawIconEx
GetIconInfo
EnableScrollBar
HideCaret
GetWindowRgn
DestroyCursor
CreateMenu
SubtractRect
GetUpdateRect
IsWindow
IsClipboardFormatAvailable
PostThreadMessageW
SetParent
UnionRect
NotifyWinEvent
SetFocus
InvertRect
WinHelpW

gdi32

SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
RestoreDC
SetROP2
SetTextAlign
RectVisible
SetPolyFillMode
PtVisible
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectW
GetTextExtentPoint32W
GetBkColor
GetTextColor
GetRgnBox
GetTextMetricsW
CombineRgn
GetMapMode
SetRectRgn
DPtoLP
CreateCompatibleBitmap
CreatePalette
IntersectClipRect
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
EnumFontFamiliesW
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
Rectangle
EnumFontFamiliesExW
OffsetRgn
CreateRoundRectRgn
RoundRect
FrameRgn
PtInRegion
SetPixelV
ExtFloodFill
SetPaletteEntries
FillRgn
GetBoundsRect
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
GetTextFaceW
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
BitBlt
PatBlt
CreateRectRgnIndirect
GetTextCharsetInfo
LineTo
GetObjectW
SetTextColor
SetBkColor
CreateBitmap
CreateDCW
CopyMetaFileW
DeleteDC
DeleteObject
SelectObject
CreateCompatibleDC
GetNearestPaletteIndex
GetDeviceCaps

msimg32

TransparentBlt
AlphaBlend

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
InitiateSystemShutdownW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetFolderPathW
ShellExecuteW
SHGetFileInfoW
DragQueryFileW
SHAppBarMessage
SHGetDesktopFolder
SHGetSpecialFolderLocation
DragFinish

comctl32

InitCommonControlsEx
ImageList_AddMasked

shlwapi

PathFindFileNameW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathRemoveFileSpecW
PathCombineW
PathAddBackslashW
PathFindExtensionW
PathAppendW
PathFileExistsW

uxtheme

GetWindowTheme
GetThemeSysColor
IsAppThemed
GetThemePartSize
GetCurrentThemeName
GetThemeColor
CloseThemeData
OpenThemeData
DrawThemeParentBackground
IsThemeBackgroundPartiallyTransparent
DrawThemeBackground
DrawThemeText

ole32

StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
StringFromGUID2
CoCreateInstance
CLSIDFromProgID
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CoInitializeEx
CoRevokeClassObject
OleFlushClipboard
CoRegisterMessageFilter
CreateStreamOnHGlobal
OleIsCurrentClipboard
OleLockRunning
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CLSIDFromString
CoCreateGuid
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoUninitialize
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
CoSetProxyBlanket
DoDragDrop

oleaut32

OleCreateFontIndirect
VarBstrFromDate
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayDestroy
SafeArrayCreate
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
LoadTypeLi
DispCallFunc
LoadRegTypeLi
VariantCopy
VariantChangeType
SysFreeString
SysAllocString
VariantClear
SysAllocStringLen
VariantInit

oledlg

OleUIBusyW

msi

ord169
ord43
ord70
ord96
ord49
ord19
ord8
ord232
ord94
ord34
ord88
ord190
ord111
ord113
ord125
ord17
ord281
ord137
ord141
ord116
ord278
ord254
ord45
ord175
ord158
ord74
ord118
ord160
ord133
ord145
ord32
ord159

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundW

crypt32

CryptProtectData
CryptUnprotectData

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpenRequest
WinHttpOpen
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle

rpcrt4

UuidToStringW
RpcStringFreeW

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 810KB - Virtual size: 809KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e319b43d1813a34cd35e23db2470f2c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

0c:d1:3b:35:b6:8d:d6:d2:92:db:a4:bd:79:cc:8b:82Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:d1:3b:35:b6:8d:d6:d2:92:db:a4:bd:79:cc:8b:82Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

61:c0:36:6e:71:04:8c:c4:e0:65:58:ca:0a:39:0f:3f:b3:0d:e5:b5:e2:f3:b9:b5:27:ce:d3:1a:45:cb:e1:0dSigner

ff:98:39:13:8f:78:7f:51:3f:be:a4:f1:f8:5c:db:29:5c:89:7d:b2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

setupxml

script

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

msi

oleacc

imm32

winmm

crypt32

setupapi

winhttp

rpcrt4

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 810KB - Virtual size: 809KB

.data Size: 46KB - Virtual size: 110KB

.pdata Size: 98KB - Virtual size: 98KB

.rsrc Size: 148KB - Virtual size: 147KB

.reloc Size: 63KB - Virtual size: 62KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0c:d1:3b:35:b6:8d:d6:d2:92:db:a4:bd:79:cc:8b:82
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:d1:3b:35:b6:8d:d6:d2:92:db:a4:bd:79:cc:8b:82
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

61:c0:36:6e:71:04:8c:c4:e0:65:58:ca:0a:39:0f:3f:b3:0d:e5:b5:e2:f3:b9:b5:27:ce:d3:1a:45:cb:e1:0d
Signer

ff:98:39:13:8f:78:7f:51:3f:be:a4:f1:f8:5c:db:29:5c:89:7d:b2
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 810KB - Virtual size: 809KB

.data
Size: 46KB - Virtual size: 110KB

.pdata
Size: 98KB - Virtual size: 98KB

.rsrc
Size: 148KB - Virtual size: 147KB

.reloc
Size: 63KB - Virtual size: 62KB