HiJackThis[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

HiJackThis.zip
Size

4.2MB
MD5

449e261ac07b0226f45b7a18a9880b0d
SHA1

3843c4231927c630c463aedf02e3cde585b2e97c
SHA256

483bd7390f4b5a48497b6a1bba163c5b239f413b8fd8e9d901d0793c83b9be8e
SHA512

5ca0284f2af3a39f750a4d41b81103b105431d16f089eee60c8f4d2354740e7194ed239587e718ccebc50149c08cc0b39bc45e6a9ea813eed44d89e1b6682eb8
SSDEEP

98304:S5YRs1tfoSSk5/157izm5sfRgIyY7ZXog4MNoSKcWJxt:SuiFv59l9qfqIp7ZXhW5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/apps/abr.exe

Files

HiJackThis.zip
.zip
HiJackThis.exe
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

38ef218496020ac15f4828d0f55f3563

Code Sign

31:f8:f5:fb:79:0c:59:24:76:ce:0f:33:20:dc:4a:f1
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

24/07/2020, 00:00

Not After

23/07/2023, 23:59

Subject

CN=Stanislav Polshyn,O=Stanislav Polshyn,POSTALCODE=49000,L=Dnipro,C=UA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

31:f8:f5:fb:79:0c:59:24:76:ce:0f:33:20:dc:4a:f1
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

24/07/2020, 00:00

Not After

23/07/2023, 23:59

Subject

CN=Stanislav Polshyn,O=Stanislav Polshyn,POSTALCODE=49000,L=Dnipro,C=UA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:2d:82:2a:a9:7f:62:6b:4a:ce:ca:3c:6b:fe:cf:eb:0a:c9:d3:af:9b:ac:cb:7d:35:35:6c:3a:c2:d1:9f:32
Signer

Actual PE Digest

6a:2d:82:2a:a9:7f:62:6b:4a:ce:ca:3c:6b:fe:cf:eb:0a:c9:d3:af:9b:ac:cb:7d:35:35:6c:3a:c2:d1:9f:32

Digest Algorithm

sha256

PE Digest Matches

true

64:5c:50:cf:46:11:5b:64:42:f9:85:ce:73:71:7f:ed:c9:e6:31:ae
Signer

Actual PE Digest

64:5c:50:cf:46:11:5b:64:42:f9:85:ce:73:71:7f:ed:c9:e6:31:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

LoadStringW
PostMessageA

oleaut32

SysReAllocString
SysFreeString
SysAllocStringLen
SysAllocStringByteLen
SysStringLen

shell32

SHBindToParent
SHGetPathFromIDListA

kernel32

GetProcAddress
VirtualAlloc
VirtualProtect
GetCurrentProcess
RtlMoveMemory
WideCharToMultiByte
lstrcpynW
GetModuleHandleW
VirtualFree

msvbvm60

EVENT_SINK_GetIDsOfNames
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
__vbaNextEachAry
__vbaVargParmRef
_CIcos
_adj_fptan
__vbaVarMove
__vbaHresultCheck
__vbaStrI4
__vbaRedimPreserveVar
__vbaVarVargNofree
__vbaCyMul
__vbaAryMove
__vbaFreeVar
ord588
__vbaGosubReturn
__vbaLateIdCall
__vbaStrVarMove
__vbaLenBstr
ord696
__vbaVargObjAddref
__vbaEnd
__vbaVarIdiv
ord697
__vbaFreeVarList
_adj_fdiv_m64
EVENT_SINK_Invoke
__vbaVarIndexStore
__vbaRaiseEvent
ord621
__vbaNextEachVar
__vbaFreeObjList
ord516
ord517
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
__vbaCVarAryUdt
__vbaVarSetVarAddref
ord626
ord519
__vbaCopyBytes
__vbaResume
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
__vbaBoolErrVar
ord553
__vbaLsetFixstr
ord661
__vbaStrDate
__vbaSetSystemError
__vbaRecDestruct
ord662
__vbaLenBstrB
__vbaHresultCheckObj
ord556
ord557
__vbaVargVarCopy
ord558
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaAryVar
ord667
Zombie_GetTypeInfo
__vbaAryDestruct
__vbaCyErrVar
ord669
ord591
__vbaVarIndexLoadRefLock
__vbaLateMemSt
EVENT_SINK2_Release
ord592
__vbaStrBool
__vbaForEachCollObj
ord593
__vbaBoolStr
__vbaExitProc
__vbaFileCloseAll
ord594
ord595
__vbaStrLike
__vbaOnError
__vbaObjSet
ord596
_adj_fdiv_m16i
ord303
__vbaVarIndexStoreObj
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaForEachCollVar
ord705
__vbaBoolVar
__vbaStrFixstr
ord521
ord309
__vbaVargVar
__vbaRefVarAry
ord523
__vbaVarTstLt
__vbaBoolVarNull
_CIsin
ord709
ord631
__vbaErase
__vbaVarCmpGt
__vbaVargVarMove
__vbaNextEachCollObj
ord632
ord525
__vbaVarZero
__vbaChkstk
__vbaCyVar
__vbaGosubFree
__vbaFileClose
EVENT_SINK_AddRef
ord527
__vbaGet3
__vbaExitEachColl
__vbaCyI2
__vbaStrCmp
__vbaGet4
__vbaVarTstEq
__vbaAryConstruct2
__vbaPutOwner3
__vbaPutOwner4
ord560
__vbaCyI4
__vbaDateR8
__vbaNextEachCollVar
__vbaPrintObj
ord561
__vbaObjVar
ord562
DllFunctionCall
__vbaVarLateMemSt
__vbaVarOr
ord563
ord564
__vbaFpUI1
__vbaCastObjVar
__vbaStrR4
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaR4Cy
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaR8Cy
__vbaStrR8
__vbaRedim
__vbaUI1ErrVar
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
ord601
_CIsqrt
__vbaRedimVar
__vbaLateIdCallSt
__vbaVarAnd
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaVarMul
__vbaStr2Vec
__vbaFpCmpCy
ord710
__vbaExceptHandler
ord711
__vbaPrintFile
__vbaStrToUnicode
ord712
__vbaR4ErrVar
__vbaExitEachAry
ord713
__vbaDateStr
ord606
_adj_fprem
_adj_fdivr_m64
__vbaLateIdStAd
__vbaFailedFriend
__vbaGosub
__vbaVarDiv
ord607
__vbaI2Str
ord608
__vbaVarCmpLe
__vbaVargVarRef
ord716
__vbaFPException
__vbaStrCompVar
__vbaInStrVar
ord717
GetMem4
ord319
__vbaGetOwner3
__vbaStrVarVal
__vbaUbound
__vbaGetOwner4
__vbaVarCat
ord535
__vbaCheckType
__vbaDateVar
__vbaLsetFixstrFree
__vbaI2Var
__vbaFileSeek
ord537
__vbaStopExe
ord644
ord645
__vbaExitEachVar
ord538
_CIlog
ord539
__vbaFileOpen
ord570
__vbaR8Str
__vbaVar2Vec
__vbaVarLateMemCallLdRf
__vbaNew2
ord648
__vbaInStr
ord571
__vbaCyMulI2
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
EVENT_SINK2_AddRef
__vbaI4Str
ord681
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
ord576
_adj_fdivr_m32
__vbaR8Var
__vbaPowerR8
_adj_fdiv_r
ord578
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaForEachAry
__vbaVarCmpEq
__vbaFpCy
ord610
__vbaVarAdd
__vbaLateMemCall
__vbaAryLock
ord320
ord612
__vbaStrToAnsi
__vbaStrComp
__vbaVarDup
ord321
__vbaVerifyVarObj
__vbaFpI2
__vbaCheckTypeVar
__vbaVarTstGe
__vbaUnkVar
__vbaFpI4
__vbaVarLateMemCallLd
ord616
__vbaVarCopy
ord617
__vbaRecDestructAnsi
__vbaLateMemCallLd
_CIatan
ord618
__vbaStrMove
__vbaAryCopy
__vbaCastObj
ord619
__vbaR8IntI4
__vbaI4Cy
__vbaStrVarCopy
__vbaForEachVar
__vbaVarNeg
ord542
ord543
ord650
_allmul
__vbaFpCSngR4
ord651
ord544
__vbaLenVarB
__vbaLateIdSt
__vbaVarLateMemCallSt
ord652
__vbaAryRecCopy
ord545
__vbaLateMemCallSt
_CItan
ord546
__vbaNextEachCollAd
ord547
__vbaFPInt
__vbaAryUnlock
__vbaFpCSngR8
_CIexp
__vbaStrCy
__vbaMidStmtBstr
__vbaI4ErrVar
__vbaRecAssign
__vbaFreeStr
__vbaFreeObj
ord581

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
apps/VBCCR17.OCX
.dll regsvr32 windows:4 windows x86 arch:x86

a4289687aa943e89e935bb85ff4e8058

Code Sign

31:f8:f5:fb:79:0c:59:24:76:ce:0f:33:20:dc:4a:f1
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

24/07/2020, 00:00

Not After

23/07/2023, 23:59

Subject

CN=Stanislav Polshyn,O=Stanislav Polshyn,POSTALCODE=49000,L=Dnipro,C=UA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

31:f8:f5:fb:79:0c:59:24:76:ce:0f:33:20:dc:4a:f1
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

24/07/2020, 00:00

Not After

23/07/2023, 23:59

Subject

CN=Stanislav Polshyn,O=Stanislav Polshyn,POSTALCODE=49000,L=Dnipro,C=UA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cc:36:87:2c:ce:21:e3:fe:7b:1d:26:f6:74:5e:57:d2:67:fe:c1:b1:e7:24:8a:a7:61:50:6b:20:4f:d5:9a:27
Signer

Actual PE Digest

cc:36:87:2c:ce:21:e3:fe:7b:1d:26:f6:74:5e:57:d2:67:fe:c1:b1:e7:24:8a:a7:61:50:6b:20:4f:d5:9a:27

Digest Algorithm

sha256

PE Digest Matches

true

c2:f6:cf:c1:92:61:e3:73:5d:f9:e4:64:e1:41:96:69:89:f5:13:79
Signer

Actual PE Digest

c2:f6:cf:c1:92:61:e3:73:5d:f9:e4:64:e1:41:96:69:89:f5:13:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames
__vbaR8FixI4
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
__vbaI2Sgn
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaHresultCheck
__vbaVarVargNofree
__vbaFpCDblR4
__vbaFreeVar
__vbaAryMove
ord588
__vbaAptOffset
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
ord696
__vbaFreeVarList
_adj_fdiv_m64
ord698
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
__vbaR8Sgn
ord516
__vbaStrErrVarCopy
_adj_fprem1
__vbaVarSetVarAddref
__vbaI4Sgn
__vbaCopyBytes
__vbaVarCmpNe
__vbaForEachCollAd
__vbaStrCat
ord552
ord660
ord553
__vbaBoolErrVar
ord661
__vbaRecDestruct
__vbaSetSystemError
ord662
__vbaHresultCheckObj
__vbaLenBstrB
ord663
ord556
ord557
__vbaLenVar
ord665
__vbaVargVarCopy
ord558
_adj_fdiv_m32
__vbaAryVar
Zombie_GetTypeInfo
__vbaVarCmpGe
__vbaAryDestruct
__vbaLateMemSt
ord591
__vbaVarIndexLoadRefLock
ord669
EVENT_SINK2_Release
ord592
__vbaForEachCollObj
__vbaExitProc
__vbaI4Abs
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
ord702
_adj_fdivr_m16i
ord598
__vbaVarIndexLoad
__vbaCyStr
__vbaFpR4
ord705
__vbaForEachCollVar
__vbaBoolVar
ord521
__vbaVarTstLt
__vbaVargVar
__vbaBoolVarNull
__vbaRefVarAry
__vbaFpR8
_CIsin
__vbaErase
ord631
ord709
ord632
__vbaVarZero
__vbaVarCmpGt
__vbaNextEachCollObj
__vbaVargVarMove
__vbaLateMemStAd
ord525
__vbaChkstk
__vbaCyVar
EVENT_SINK_AddRef
ord527
__vbaGenerateBoundsError
__vbaExitEachColl
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaDateR8
ord560
__vbaR4Str
__vbaNextEachCollVar
ord561
__vbaObjVar
__vbaI2I4
ord562
DllFunctionCall
__vbaVarLateMemSt
__vbaVarOr
ord563
__vbaCySub
ord564
__vbaCastObjVar
__vbaStrR4
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaR4Var
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaStrR8
__vbaUI1ErrVar
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
__vbaVarAnd
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaVarMul
__vbaUI1I4
__vbaStr2Vec
__vbaExceptHandler
ord711
ord712
__vbaDateStr
ord606
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
__vbaI2Str
__vbaFailedFriend
ord607
ord715
__vbaVarCmpLe
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaStrCompVar
ord319
__vbaStrVarVal
__vbaUbound
ord534
__vbaVarCat
__vbaDateVar
__vbaCheckType
__vbaI2Var
ord537
ord644
ord538
_CIlog
__vbaErrorOverflow
ord539
__vbaVarLateMemCallLdRf
__vbaR8Str
__vbaNew2
__vbaInStr
__vbaVar2Vec
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
ord573
__vbaVarSetObj
__vbaStrCopy
EVENT_SINK2_AddRef
__vbaCySgn
__vbaI4Str
ord681
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
__vbaR8Var
__vbaPowerR8
_adj_fdiv_r
ord685
__vbaVarTstNe
ord101
__vbaVarSetVar
ord102
__vbaI4Var
ord103
__vbaVarLateMemStAd
__vbaVarCmpEq
ord104
ord610
ord105
__vbaLateMemCall
__vbaVarAdd
__vbaAryLock
ord320
ord612
__vbaFreeVarg
__vbaStrToAnsi
__vbaStrComp
__vbaVarDup
ord321
__vbaVerifyVarObj
__vbaFpI2
__vbaAryVarVarg
__vbaCheckTypeVar
__vbaVarTstGe
__vbaUnkVar
ord616
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaFpI4
ord617
__vbaLateMemCallLd
_CIatan
__vbaUI1Str
__vbaStrMove
ord618
__vbaCastObj
__vbaAryCopy
__vbaI4Cy
__vbaStrVarCopy
ord542
ord650
ord543
_allmul
__vbaLenVarB
ord544
__vbaLateIdSt
__vbaFpCSngR4
ord545
__vbaLateMemCallSt
_CItan
__vbaNextEachCollAd
__vbaFPInt
ord547
__vbaUI1Var
__vbaAryUnlock
__vbaFpCSngR8
_CIexp
__vbaMidStmtBstr
__vbaRecAssign
__vbaI4ErrVar
__vbaFreeObj
__vbaFreeStr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 600KB - Virtual size: 599KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 413KB - Virtual size: 413KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
apps/abr.exe
.exe windows:5 windows x86 arch:x86

3fb97b267a16c1108288a11d3e602f6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\DEN\abr\Release\abr.pdb

Imports

shlwapi

PathAppendW

user32

LoadStringW

advapi32

RegEnumKeyW
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
CreateServiceW
CloseServiceHandle
OpenProcessToken
DeleteService
OpenSCManagerW
StartServiceCtrlDispatcherW
OpenServiceW
RegCreateKeyW
RegQueryValueExW
RegSaveKeyW
LookupPrivilegeValueW
SetServiceStatus
RegEnumValueW
RegOpenKeyExW
RegisterServiceCtrlHandlerW

kernel32

HeapCreate
GetFileSize
FindFirstFileW
CreateProcessW
SystemTimeToFileTime
VerSetConditionMask
GetCurrentProcess
CreateDirectoryW
WaitForSingleObject
GetModuleHandleW
WriteFile
GetSystemDirectoryW
LoadLibraryW
Sleep
CopyFileW
FormatMessageW
GetVersionExW
GetExitCodeProcess
ReadFile
GetModuleFileNameW
CreateFileW
VerifyVersionInfoW
GetLastError
GetProcAddress
FindClose
GetLocalTime
RemoveDirectoryW
DeviceIoControl
FindNextFileW
CloseHandle
GetWindowsDirectoryW
DeleteFileW
GetSystemTime
SetFileAttributesW
ExpandEnvironmentStringsW
HeapFree
HeapAlloc
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
LCMapStringA
HeapSize
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateFileA

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

38ef218496020ac15f4828d0f55f3563

Code Sign

31:f8:f5:fb:79:0c:59:24:76:ce:0f:33:20:dc:4a:f1Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

31:f8:f5:fb:79:0c:59:24:76:ce:0f:33:20:dc:4a:f1Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

6a:2d:82:2a:a9:7f:62:6b:4a:ce:ca:3c:6b:fe:cf:eb:0a:c9:d3:af:9b:ac:cb:7d:35:35:6c:3a:c2:d1:9f:32Signer

64:5c:50:cf:46:11:5b:64:42:f9:85:ce:73:71:7f:ed:c9:e6:31:aeSigner

Headers

DLL Characteristics

File Characteristics

Imports

user32

oleaut32

shell32

kernel32

msvbvm60

Sections

.text Size: 4.8MB - Virtual size: 4.8MB

.data Size: 4KB - Virtual size: 49KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

a4289687aa943e89e935bb85ff4e8058

Code Sign

31:f8:f5:fb:79:0c:59:24:76:ce:0f:33:20:dc:4a:f1Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

31:f8:f5:fb:79:0c:59:24:76:ce:0f:33:20:dc:4a:f1Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

31:f8:f5:fb:79:0c:59:24:76:ce:0f:33:20:dc:4a:f1
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

31:f8:f5:fb:79:0c:59:24:76:ce:0f:33:20:dc:4a:f1
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

6a:2d:82:2a:a9:7f:62:6b:4a:ce:ca:3c:6b:fe:cf:eb:0a:c9:d3:af:9b:ac:cb:7d:35:35:6c:3a:c2:d1:9f:32
Signer

64:5c:50:cf:46:11:5b:64:42:f9:85:ce:73:71:7f:ed:c9:e6:31:ae
Signer

.text
Size: 4.8MB - Virtual size: 4.8MB

.data
Size: 4KB - Virtual size: 49KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

31:f8:f5:fb:79:0c:59:24:76:ce:0f:33:20:dc:4a:f1
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

31:f8:f5:fb:79:0c:59:24:76:ce:0f:33:20:dc:4a:f1
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

cc:36:87:2c:ce:21:e3:fe:7b:1d:26:f6:74:5e:57:d2:67:fe:c1:b1:e7:24:8a:a7:61:50:6b:20:4f:d5:9a:27
Signer

c2:f6:cf:c1:92:61:e3:73:5d:f9:e4:64:e1:41:96:69:89:f5:13:79
Signer

.text
Size: 4.3MB - Virtual size: 4.3MB

.data
Size: 512B - Virtual size: 161KB

.rsrc
Size: 600KB - Virtual size: 599KB

.reloc
Size: 413KB - Virtual size: 413KB

.text
Size: 82KB - Virtual size: 81KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 5KB - Virtual size: 40KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 5KB