_Getintopc[.]com_VNC_Connect_Enterprise_6[.]10[.]rar

Resubmissions

22/02/2024, 22:54

240222-2vwskagf33 8

Sharing

Copy URL Twitter E-mail

General

Target

_Getintopc.com_VNC_Connect_Enterprise_6.10.rar
Size

20.1MB
MD5

c725da21d2c286632ed3f39e6ace7579
SHA1

f69081ae5329bc2c3862b7d49c81fe515a791d37
SHA256

75659ba1ac6056944e98005a0cfe3c7769402fd56a6b3f5409e676d2dbc8744d
SHA512

ca163d74da8f3304aa81d4fb65c9e2af2fbf0bac2ae305370235cfc645bbeaf048da86fb56ccf79fcf5dd6f1121eca694760b15b1a5762480c5bddac68b36f7e
SSDEEP

393216:otQVaNQRkeeQQj031B3QFhJ6fwc+wpZeKKSP+Pv8qx/dxe1X1J8S6o2UJi3YfPgT:owwbjMQFhMGwAeG3/d014EnJiIXkpZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack003/Patch.exe

Files

_Getintopc.com_VNC_Connect_Enterprise_6.10.rar
.rar

Password: 123
Password 123.txt
VNC_Connect_Enterprise_6.10/VNC-Server-6.10.0-Windows.exe
.exe windows:6 windows x86 arch:x86

Password: 123

3c623eca49adc29b86a567a8debea4f8

Code Sign

06:0c:43:c8:90:48:4c:a5:e4:e0:35:62:6c:80:87:35
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16/10/2020, 00:00

Not After

24/10/2023, 23:59

Subject

CN=RealVNC Ltd,O=RealVNC Ltd,L=Cambridge,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:0c:43:c8:90:48:4c:a5:e4:e0:35:62:6c:80:87:35
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16/10/2020, 00:00

Not After

24/10/2023, 23:59

Subject

CN=RealVNC Ltd,O=RealVNC Ltd,L=Cambridge,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b8:57:14:c7:d3:20:f3:0e:b7:21:5c:04:b8:bc:fc:c0:7f:bb:df:1e:2f:bb:37:6f:37:78:cb:66:e6:a9:db:92
Signer

Actual PE Digest

b8:57:14:c7:d3:20:f3:0e:b7:21:5c:04:b8:bc:fc:c0:7f:bb:df:1e:2f:bb:37:6f:37:78:cb:66:e6:a9:db:92

Digest Algorithm

sha256

PE Digest Matches

true

a6:90:c6:50:fb:e5:bd:0d:67:4d:63:be:f0:99:09:b7:8a:c1:9d:5b
Signer

Actual PE Digest

a6:90:c6:50:fb:e5:bd:0d:67:4d:63:be:f0:99:09:b7:8a:c1:9d:5b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\ent-slave-root\workspace\VNCConnect\Builds\Clients\VNC_6.10.x\label\con-windows-64\bld32\RelWithDebInfo\installers\server_bootstrap.pdb

Imports

ws2_32

WSAEnumNetworkEvents
WSAEventSelect
WSAIoctl
accept
bind
closesocket
ioctlsocket
getsockopt
setsockopt
socket
htons
WSAStartup
WSASetLastError
getservbyname
getservbyport
gethostbyname
gethostbyaddr
ntohs
ntohl
inet_ntoa
inet_addr
WSAGetLastError
htonl
getsockname
getpeername
WSASocketW
WSADuplicateSocketW
WSAConnect

comctl32

_TrackMouseEvent
InitCommonControlsEx
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon
ImageList_Add

kernel32

GetProcAddress
LoadLibraryW
WaitForSingleObject
GetExitCodeProcess
ResetEvent
CreateEventW
GetComputerNameW
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetSystemTimeAsFileTime
GetModuleHandleW
ExpandEnvironmentStringsW
RtlCaptureStackBackTrace
GetModuleHandleExW
GetStdHandle
GetFileType
AllocConsole
FreeConsole
GetConsoleMode
ReadConsoleW
WriteConsoleW
WaitForMultipleObjects
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetHandleInformation
SetHandleInformation
GetTimeFormatW
GetDateFormatW
GetSystemDirectoryA
GetVersionExW
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
GlobalSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
DecodePointer
HeapReAlloc
SetEnvironmentVariableW
GetFileSizeEx
FlushFileBuffers
SetConsoleCtrlHandler
GetConsoleOutputCP
SetFilePointerEx
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
HeapFree
HeapAlloc
GetCurrentThread
DuplicateHandle
WriteFile
ExitProcess
ReadFile
LoadLibraryExW
EncodePointer
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
SetEvent
InitializeCriticalSectionAndSpinCount
ReOpenFile
LocalAlloc
MultiByteToWideChar
SetErrorMode
FindNextFileW
FindFirstFileW
FindClose
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
QueryFullProcessImageNameW
GetModuleFileNameW
CreateFileW
SearchPathW
OutputDebugStringW
GetThreadTimes
GetCurrentProcess
GetCurrentProcessId
SetStdHandle
FindResourceW
SizeofResource
LockResource
LoadResource
GetUserDefaultLCID
GetLocaleInfoW
CreateProcessW
GetCommandLineW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetSystemInfo
WideCharToMultiByte
GetTempPathW
MoveFileW
LocalFree
SetLastError
SetFilePointer
SetEndOfFile
RemoveDirectoryW
GetFileAttributesExW
GetFileAttributesW
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
FormatMessageW
FreeLibrary
GetSystemDirectoryW
GetProcessId
GetLastError
CloseHandle
GetStringTypeW
GetProcessHeap
HeapSize
ConnectNamedPipe
CreateNamedPipeW
GetOverlappedResult
CancelIo
OpenProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateThread
TerminateThread
ResumeThread
LoadLibraryA

user32

IsWindowVisible
EnumDisplaySettingsW
GetNextDlgTabItem
DefWindowProcW
ScrollWindowEx
RedrawWindow
KillTimer
SetTimer
DefDlgProcW
IsIconic
DestroyWindow
CreateWindowExW
ScreenToClient
RegisterClipboardFormatW
ChangeDisplaySettingsExW
GetMessagePos
GetDoubleClickTime
CreateMenu
SetMenu
SetMenuDefaultItem
SetMenuItemInfoW
InsertMenuItemW
TrackPopupMenu
DeleteMenu
GetMenuItemCount
CheckMenuItem
DestroyMenu
CreatePopupMenu
GetMenuState
GetKeyboardLayout
GetWindowThreadProcessId
GetOpenClipboardWindow
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
IsDialogMessageW
DestroyIcon
EnumChildWindows
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxParamW
CreateDialogParamW
SetParent
GetClassNameW
IsWindowEnabled
PostMessageW
GetCursor
GetScrollInfo
SetScrollInfo
OffsetRect
AdjustWindowRectEx
GetCursorPos
InvalidateRect
GetWindowTextLengthW
GetWindowTextW
GetKeyState
GetClipboardData
LoadIconW
GetDesktopWindow
SetWindowLongW
MapWindowPoints
ClientToScreen
GetWindowRect
EndPaint
BeginPaint
SetForegroundWindow
EnableMenuItem
GetSystemMenu
EnableWindow
ReleaseCapture
SetCapture
GetDlgCtrlID
GetWindowPlacement
SetWindowPos
ShowWindow
IsChild
GetMessageW
GetComboBoxInfo
GetWindowDC
GetAncestor
SystemParametersInfoW
GetWindowLongW
InflateRect
FrameRect
FillRect
DrawFocusRect
GetSysColorBrush
GetSysColor
SetCursor
GetClientRect
DrawTextW
GetFocus
SendMessageW
DrawFrameControl
SetFocus
LoadCursorW
MsgWaitForMultipleObjects
PeekMessageW
GetSystemMetrics
ReleaseDC
GetDC
DispatchMessageW
TranslateMessage
MonitorFromRect
MonitorFromWindow
GetMonitorInfoW
EnumDisplayMonitors
ToUnicodeEx
GetKeyboardLayoutList
GetAsyncKeyState
ToAsciiEx
VkKeyScanExA
VkKeyScanExW
keybd_event
MapVirtualKeyW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
WindowFromPoint
CreateIconIndirect
GetParent
CallWindowProcW
UnregisterClassW
RegisterClassExW

gdi32

ExcludeClipRect
GetDeviceCaps
GetStockObject
SelectObject
SetBkMode
SetTextColor
GetCharWidthW
CreateSolidBrush
DeleteObject
CreatePen
LineTo
SetBkColor
MoveToEx
CreateCompatibleBitmap
DeleteDC
BitBlt
CreateCompatibleDC
CreateDCW
GetClipBox
StretchBlt
SetWindowOrgEx
CreateBitmap
GdiAlphaBlend
CreateDIBSection
SetDIBColorTable
CreateFontIndirectW
GetTextExtentPoint32W
SetMapMode
GetDIBits
GetObjectW
PatBlt
GetTextMetricsW
GetPixel

shell32

SHFileOperationW
ShellExecuteW
SHGetKnownFolderPath
SHGetFileInfoW
ord74

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree
OleInitialize
RegisterDragDrop
DoDragDrop
ReleaseStgMedium
CoTaskMemAlloc
CoTaskMemRealloc
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
OleUninitialize

oleaut32

SysAllocString
SysFreeString

advapi32

GetUserNameW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
CreateProcessWithLogonW
LogonUserW
SetSecurityInfo
SetNamedSecurityInfoW
GetSecurityInfo
GetNamedSecurityInfoW
SetSecurityDescriptorSacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
SetSecurityDescriptorControl
MakeSelfRelativeSD
MakeAbsoluteSD
InitializeSecurityDescriptor
GetSecurityDescriptorLength
GetSecurityDescriptorControl
SetEntriesInAclW
InitializeAcl
GetAclInformation
ConvertStringSidToSidW
ConvertSidToStringSidW
LookupAccountNameW
LookupAccountSidW
IsValidSid
GetTokenInformation
GetSidIdentifierAuthority
CreateProcessAsUserW
OpenProcessToken
AllocateAndInitializeSid
CopySid
EqualSid
FreeSid
GetLengthSid

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 268KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18.7MB - Virtual size: 18.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VNC_Connect_Enterprise_6.10/crack.zip
.zip

Password: 123
Patch.exe
.exe windows:6 windows x64 arch:x64

Password: 123

5fe90d34ee8a9c2207896176e1120d21

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\User\Downloads\AppTools\AppActivator\x64\Release\Activator.pdb

Imports

kernel32

InitOnceComplete
InitOnceBeginInitialize
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
RtlUnwind
GetLocaleInfoEx
CompareStringEx
LCMapStringEx
CreateProcessW
SetHandleInformation
CreatePipe
WriteConsoleW
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetFileType
SetStdHandle
QueryPerformanceFrequency
VirtualQuery
VirtualAlloc
GetSystemInfo
HeapQueryInformation
FreeLibraryAndExitThread
ExitThread
GetCommandLineW
GetCommandLineA
ExitProcess
InterlockedPushEntrySList
RtlPcToFileHeader
RtlUnwindEx
OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
ResetEvent
FindResourceExW
GetUserDefaultLCID
GetTempFileNameW
GetWindowsDirectoryW
SearchPathW
GetProfileIntW
GetTickCount
Sleep
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
SetErrorMode
FileTimeToSystemTime
VirtualProtect
GlobalGetAtomNameW
lstrcmpiW
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
FindFirstFileW
FindClose
GetTempPathW
SetFilePointer
GetFileSize
GetFileAttributesW
CreateFileW
DeleteFileW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetCurrentDirectoryW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
CopyFileW
FormatMessageW
MulDiv
LocalFree
GlobalSize
CompareStringW
GlobalFindAtomW
GetSystemDirectoryW
EncodePointer
GetCurrentProcessId
GlobalAddAtomW
ResumeThread
SetThreadPriority
CreateEventW
SetEvent
CloseHandle
VerifyVersionInfoW
VerSetConditionMask
GlobalFree
GlobalUnlock
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleW
GetProcAddress
lstrcpyW
WideCharToMultiByte
MultiByteToWideChar
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GlobalLock
GetModuleFileNameA
GlobalAlloc
LoadLibraryW
LoadLibraryExW
GetModuleHandleExW
FreeLibrary
GetVersionExW
GetCurrentThreadId
GetCurrentThread
SetLastError
OutputDebugStringA
GetModuleFileNameW
ExpandEnvironmentStringsW
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
ExpandEnvironmentStringsA
WaitForSingleObject
CreateThread
GetLastError
FindResourceW
LoadResource
LockResource
SizeofResource

user32

SetTimer
RealChildWindowFromPoint
DeleteMenu
CopyImage
WindowFromPoint
ReleaseCapture
SetCapture
WaitMessage
SendDlgItemMessageA
ClientToScreen
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuState
GetMenuStringW
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
ShowWindow
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
UnhookWindowsHookEx
GetWindow
GetTopWindow
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
PtInRect
EqualRect
KillTimer
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
InvertRect
DrawIcon
DestroyCursor
MessageBoxA
EnableWindow
GetClientRect
LoadImageW
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
IsZoomed
CharUpperW
GetAsyncKeyState
LoadMenuW
GetWindowRgn
GetSystemMenu
MessageBeep
NotifyWinEvent
SetCursorPos
SetRect
UnionRect
BringWindowToTop
CreatePopupMenu
IntersectRect
GetCapture
SetFocus
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DestroyIcon
SetParent
MonitorFromPoint
ScreenToClient
TrackMouseEvent
SendMessageW
LoadIconW
UnregisterClassW
PostMessageW
PostQuitMessage
RegisterWindowMessageW
DrawEdge
DrawFrameControl
IsWindowVisible
GetFocus
GetSystemMetrics
DrawStateW
SetWindowRgn
RedrawWindow
GetWindowRect
MapWindowPoints
GetSysColor
GetSysColorBrush
DrawFocusRect
FillRect
InflateRect
OffsetRect
IsRectEmpty
GetParent
DrawIconEx
IsWindow
DestroyWindow
CreateDialogIndirectParamW
EndDialog
GetDlgItem
GetNextDlgTabItem
GetActiveWindow
IsWindowEnabled
SetActiveWindow
LockWindowUpdate
DestroyMenu
EnableScrollBar
GetWindowLongW
GetDesktopWindow
DefWindowProcW
GetClassInfoW
SetLayeredWindowAttributes
SetRectEmpty
CopyRect
LoadCursorW
SystemParametersInfoW
GetMonitorInfoW
EnumDisplayMonitors
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
ShowOwnedPopups
SetCursor
MessageBoxW
GetWindowThreadProcessId
GetLastActivePopup
UpdateWindow
InvalidateRect
GetClassNameW
GetKeyNameTextW
MapVirtualKeyW
GetDC
ReleaseDC
GetMessagePos
GetMessageTime
CallWindowProcW
RegisterClassW
GetClassInfoExW
CreateWindowExW
IsMenu
IsChild
SetWindowPos
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsIconic
GetDoubleClickTime
GetIconInfo
CopyIcon
GetMenuItemInfoW
GetMenuDefaultItem
SetMenuDefaultItem
ModifyMenuW
DestroyAcceleratorTable
SetClassLongPtrW
GetUpdateRect
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
LoadAcceleratorsW
CreateAcceleratorTableW
CopyAcceleratorTableW
MapDialogRect
UpdateLayeredWindow
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
SubtractRect
RegisterClipboardFormatW
CharUpperBuffW
FrameRect
IsClipboardFormatAvailable
PostThreadMessageW
GetNextDlgGroupItem
IsCharLowerW
MapVirtualKeyExW
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
GetComboBoxInfo
CreateMenu
GetDlgCtrlID
HideCaret

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectW
CreatePen
CreatePatternBrush
DeleteObject
EnumFontFamiliesW
GetDeviceCaps
GetStockObject
GetTextCharsetInfo
GetObjectW
CreateBitmap
SetBkColor
SetTextColor
CreateDCW
Escape
ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
BitBlt
MoveToEx
TextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
SetRectRgn
DPtoLP
RealizePalette
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateRoundRectRgn
Rectangle
GetRgnBox
OffsetRgn
RoundRect
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExW
LPtoDP
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
GetTextFaceW
GetTextMetricsW
Polyline
Polygon
CreatePolygonRgn
ExtTextOutW
PatBlt
GetTextExtentPoint32W
GetTextColor
DeleteDC
CombineRgn
CreateEllipticRgn
CreateHatchBrush
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
Ellipse
GetBkColor
CopyMetaFileW

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

SHGetFileInfoW
ShellExecuteW
DragFinish
DragQueryFileW
SHGetDesktopFolder
SHAppBarMessage
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc

comctl32

InitCommonControlsEx

shlwapi

StrFormatKBSizeW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
PathFileExistsA
PathRemoveFileSpecW

uxtheme

GetCurrentThemeName
CloseThemeData
DrawThemeBackground
GetThemeColor
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetWindowTheme
DrawThemeText
IsAppThemed
DrawThemeParentBackground
OpenThemeData

ole32

CoInitializeEx
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
CoInitializeSecurity
CoSetProxyBlanket
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
StringFromGUID2
CoDisconnectObject
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize

oleaut32

VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
LoadTypeLi
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocString

gdiplus

GdipDrawImageRectI
GdiplusShutdown
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipFree
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdiplusStartup

oleacc

LresultFromObject
CreateStdAccessibleObject
AccessibleObjectFromWindow

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 737KB - Virtual size: 736KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
evbda.sys
.sys windows:10 windows x64 arch:x64

752e719aa44f97eb2df9211e258bb0c4

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:4b:02:4d:00:31:6d:8f:c0:98:64:64:88:82:86:61:7c:a9:b2:99:41:c3:d2:be:48:15:6c:b1:36:bc:d7:48
Signer

Actual PE Digest

c6:4b:02:4d:00:31:6d:8f:c0:98:64:64:88:82:86:61:7c:a9:b2:99:41:c3:d2:be:48:15:6c:b1:36:bc:d7:48

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

evbda.pdb

Imports

ntoskrnl.exe

RtlAppendUnicodeToString
KeInitializeEvent
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
MmUnmapIoSpace
MmMapIoSpaceEx
IoAllocateIrp
IofCallDriver
IoFreeIrp
IoGetDeviceProperty
IoInvalidateDeviceState
ZwClose
ZwOpenKey
ZwEnumerateKey
ZwQueryValueKey
ZwSetValueKey
strrchr
RtlQueryRegistryValues
MmGetSystemRoutineAddress
RtlWriteRegistryValue
KeLowerIrql
KfRaiseIrql
KeInitializeDpc
KeInsertQueueDpc
KeSetImportanceDpc
KeResetEvent
KeSetPriorityThread
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeInitializeTimer
KeCancelTimer
KeSetTimer
KeInitializeSpinLock
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
ExAcquireFastMutexUnsafe
RtlCheckRegistryKey
PsCreateSystemThread
IoBuildDeviceIoControlRequest
IoConnectInterrupt
IoGetDmaAdapter
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateKey
_vsnwprintf
PsThreadType
PsTerminateSystemThread
RtlIsNtDdiVersionAvailable
PsGetVersion
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
IoAllocateWorkItem
IoFreeWorkItem
IoRaiseInformationalHardError
IoSetThreadHardErrorMode
KeNumberProcessors
RtlCompareMemory
KeDelayExecutionThread
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
IoDisconnectInterrupt
IoFreeMdl
MmGetPhysicalMemoryRanges
memcpy_s
DbgPrint
RtlUnicodeStringToInteger
RtlInitUnicodeString
RtlIntegerToUnicodeString
wcsstr
RtlCopyUnicodeString
_vsnprintf
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwQuerySystemInformation
KeSetEvent
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
ExReleaseFastMutexUnsafe
wcsrchr

hal

KeStallExecutionProcessor
KeQueryPerformanceCounter

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionBindClass
WdfVersionUnbindClass

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
readme.txt

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: 123

Password: 123

3c623eca49adc29b86a567a8debea4f8

Code Sign

06:0c:43:c8:90:48:4c:a5:e4:e0:35:62:6c:80:87:35Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

06:0c:43:c8:90:48:4c:a5:e4:e0:35:62:6c:80:87:35Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

b8:57:14:c7:d3:20:f3:0e:b7:21:5c:04:b8:bc:fc:c0:7f:bb:df:1e:2f:bb:37:6f:37:78:cb:66:e6:a9:db:92Signer

a6:90:c6:50:fb:e5:bd:0d:67:4d:63:be:f0:99:09:b7:8a:c1:9d:5bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

comctl32

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 268KB - Virtual size: 267KB

.data Size: 19KB - Virtual size: 27KB

.rsrc Size: 18.7MB - Virtual size: 18.7MB

.reloc Size: 62KB - Virtual size: 61KB

Password: 123

Password: 123

5fe90d34ee8a9c2207896176e1120d21

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

06:0c:43:c8:90:48:4c:a5:e4:e0:35:62:6c:80:87:35
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

06:0c:43:c8:90:48:4c:a5:e4:e0:35:62:6c:80:87:35
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

b8:57:14:c7:d3:20:f3:0e:b7:21:5c:04:b8:bc:fc:c0:7f:bb:df:1e:2f:bb:37:6f:37:78:cb:66:e6:a9:db:92
Signer

a6:90:c6:50:fb:e5:bd:0d:67:4d:63:be:f0:99:09:b7:8a:c1:9d:5b
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 268KB - Virtual size: 267KB

.data
Size: 19KB - Virtual size: 27KB

.rsrc
Size: 18.7MB - Virtual size: 18.7MB

.reloc
Size: 62KB - Virtual size: 61KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 737KB - Virtual size: 736KB

.data
Size: 55KB - Virtual size: 92KB

.pdata
Size: 129KB - Virtual size: 128KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 2.9MB - Virtual size: 2.9MB

.reloc
Size: 65KB - Virtual size: 65KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

c6:4b:02:4d:00:31:6d:8f:c0:98:64:64:88:82:86:61:7c:a9:b2:99:41:c3:d2:be:48:15:6c:b1:36:bc:d7:48
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 49KB - Virtual size: 208KB

.pdata
Size: 23KB - Virtual size: 22KB

.gfids
Size: 512B - Virtual size: 4B

PAGE
Size: 512B - Virtual size: 396B

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 11KB - Virtual size: 11KB

.reloc
Size: 1KB - Virtual size: 1KB