NPE[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NPE.exe
Size

12.8MB
MD5

e736652d1fdb84ee3d11870e6422457d
SHA1

4542923765d79d5dcc50d1ba7df0123fe586ff19
SHA256

81936f96faceecb40c6fbf91e00e1a60cab112571944157b00726d586d422d64
SHA512

540ddcf75ec92719b437d6df5563aefe16bad095318786417b7c8bc48f31085dc1d20fc1ad35ca9f59ab3591b67870fed4b90a69bef072df0375120e9279bdf6
SSDEEP

196608:1Pc6p0IHMDJa7E1/Ygmqyp3XsCTtAWFxrqN9HxbJsm5:1Pcu0IHME7tx30IxrqN9H1Jsc

Score

1^/10

Malware Config

Signatures

Files

NPE.exe
.exe windows:6 windows x86 arch:x86

a0ace36f6e5c8b28aa2dcb2f4f701d55

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:be:91:35:61:37:61:3e:57:68:3e:60:3e:c5:38:bd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

17/05/2021, 00:00

Not After

21/05/2024, 23:59

Subject

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c1:5a:6e:34:ba:3c:85:84:21:b5:ae:ad:45:1d:d0:d7:9f:58:ff:07:77:6d:f1:62:97:64:a5:64:31:5d:0a:8f
Signer

Actual PE Digest

c1:5a:6e:34:ba:3c:85:84:21:b5:ae:ad:45:1d:d0:d7:9f:58:ff:07:77:6d:f1:62:97:64:a5:64:31:5d:0a:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\jenkins\workspace\SNaPE\NortonPowerEraser\Builds\npe_release_build\SNaPE\NPE\bin\bin.iru\NPE.pdb

Imports

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteExW
ShellExecuteW
SHGetPathFromIDListW
SHFileOperationW
SHBrowseForFolderW
ord74
DragQueryFileW
SHGetFileInfoW
ord727
ord190
ord155
SHOpenFolderAndSelectItems
SHGetKnownFolderPath
CommandLineToArgvW

rpcrt4

UuidToStringW
UuidCreate
UuidCompare
RpcStringFreeW
UuidFromStringW

psapi

EnumProcesses
GetModuleFileNameExW
GetProcessImageFileNameW

ws2_32

WSAAddressToStringW
WSAStringToAddressW
WSAGetLastError
socket
htonl
htons
bind
closesocket
listen
ntohs
gethostbyname
inet_ntoa
accept
setsockopt
connect
select
recv
send
shutdown
gethostname
ioctlsocket
freeaddrinfo
getaddrinfo
__WSAFDIsSet
gethostbyaddr
getservbyport
getservbyname
WSASetLastError
WSAStartup
WSACleanup
inet_addr

kernel32

lstrcmpW
OutputDebugStringW
WaitForMultipleObjectsEx
CreateSemaphoreA
Module32FirstW
Module32NextW
CreateMutexW
IsDebuggerPresent
FindFirstVolumeW
FindVolumeClose
GetVolumePathNamesForVolumeNameW
GetFileType
FindNextVolumeW
GetVolumeInformationByHandleW
GetFileSize
SetEndOfFile
OpenMutexW
ReleaseMutex
TryEnterCriticalSection
CreateThread
TerminateThread
SetThreadPriority
GetThreadPriority
ExitThread
lstrlenW
GetSystemDefaultUILanguage
GetCommandLineW
lstrcpyW
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
CreateEventW
OpenEventW
SetEvent
ResetEvent
GetProcessTimes
CreateWaitableTimerW
CancelWaitableTimer
SetWaitableTimer
RegisterWaitForSingleObject
UnregisterWaitEx
lstrlenA
GlobalSize
WaitForMultipleObjects
CreateSemaphoreW
ReadProcessMemory
VirtualQuery
SetUnhandledExceptionFilter
SetFilePointerEx
GetFileInformationByHandle
GetStartupInfoW
InitializeSListHead
DuplicateHandle
TerminateProcess
GetBinaryTypeW
GetUserGeoID
GetNumberFormatW
GetGeoInfoW
GetSystemWindowsDirectoryW
GetComputerNameW
LoadLibraryW
GetEnvironmentVariableW
SetEnvironmentVariableW
SetDllDirectoryW
FlushFileBuffers
SystemTimeToTzSpecificLocalTime
GetLocalTime
GetTimeZoneInformation
GetUserDefaultUILanguage
GetFileTime
GetDriveTypeW
GetWindowsDirectoryW
GetCurrentDirectoryW
SetFilePointer
WriteFile
GetLongPathNameW
GetFullPathNameW
ReadFile
CompareStringW
InitializeCriticalSectionAndSpinCount
GetCurrentThread
GetTempPathW
QueryDosDeviceW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CreatePipe
SetSystemTime
MulDiv
GetModuleHandleExW
GetDiskFreeSpaceExW
GetDateFormatW
GetTimeFormatW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileSectionNamesW
InitializeCriticalSection
SetLastError
GetVolumeInformationW
GetSystemDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MoveFileExW
DeviceIoControl
GlobalMemoryStatusEx
GetCurrentProcess
GetExitCodeProcess
GetSystemTimeAsFileTime
GetUserDefaultLCID
GetLocaleInfoW
GetSystemInfo
GetThreadContext
ResumeThread
GetSystemDefaultLCID
ExpandEnvironmentStringsW
OpenProcess
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
WTSGetActiveConsoleSessionId
GetCurrentProcessId
ProcessIdToSessionId
WideCharToMultiByte
RemoveDirectoryW
GetFileSizeEx
GetSystemTime
SystemTimeToFileTime
CreateDirectoryW
WaitForSingleObject
FormatMessageW
LocalAlloc
CopyFileW
GetFileAttributesExW
FindNextFileW
FindFirstFileW
FindClose
GetFileAttributesW
GetTickCount
DecodePointer
GetCurrentThreadId
SetErrorMode
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
RaiseException
LeaveCriticalSection
lstrcmpiW
MultiByteToWideChar
GetProcAddress
FreeLibrary
LoadLibraryExW
CompareFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleHandleW
CreateProcessW
SetFileInformationByHandle
MoveFileW
CloseHandle
CreateFileW
DeleteFileW
SetFileAttributesW
GetModuleFileNameW
Sleep
WaitForSingleObjectEx
ReleaseSemaphore
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
LocalFree
GetLastError
UnhandledExceptionFilter
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
FlushInstructionCache
TlsAlloc
QueueUserWorkItem
IsProcessorFeaturePresent
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
lstrcmpA
LCMapStringA
WritePrivateProfileSectionW
GetPrivateProfileSectionW
FormatMessageA
CreateTimerQueue
SignalObjectAndWait
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
GetTempPathA
GetTempFileNameA
GetLogicalDriveStringsW
GetCurrencyFormatW
AllocConsole
GetModuleFileNameA
BackupWrite
BackupRead
GetLocaleInfoA
GetSystemDirectoryA
LoadLibraryA
InterlockedExchange
DeleteVolumeMountPointW
MapViewOfFileEx
InterlockedDecrement
InterlockedIncrement
GetVolumeNameForVolumeMountPointW
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetStringTypeW
QueryPerformanceFrequency
QueryPerformanceCounter
EncodePointer
LoadLibraryExA
VirtualProtect
LCMapStringW
SetStdHandle
EnumSystemLocalesW
IsValidLocale
GetStdHandle
GetConsoleCP
ReadConsoleW
GetConsoleMode
RtlUnwind
GetUserDefaultLangID
ExitProcess
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
LocalSize
CompareStringA

user32

SetClipboardData
CloseClipboard
PostThreadMessageW
CharPrevW
MsgWaitForMultipleObjectsEx
IsWindowUnicode
OpenClipboard
GetMessageA
GetMessageW
DispatchMessageA
PeekMessageW
LoadIconW
IsCharAlphaNumericW
UnregisterClassW
CharNextW
DestroyWindow
LoadImageW
ShowWindow
EnableMenuItem
GetMenuItemCount
GetSystemMenu
GetSystemMetrics
IsWindow
SendMessageW
PostMessageW
wsprintfW
GetClipboardSequenceNumber
GetClipboardData
IsClipboardFormatAvailable
EnumClipboardFormats
CountClipboardFormats
RegisterClipboardFormatW
UpdateLayeredWindow
SetCaretPos
CreateCaret
GetKeyboardLayout
DestroyCaret
LoadStringW
RedrawWindow
RegisterClassW
BeginPaint
EndPaint
SetParent
AllowSetForegroundWindow
MessageBeep
DestroyIcon
DrawIconEx
GetIconInfo
CreateIconIndirect
GetSysColor
SetScrollInfo
DeferWindowPos
GetScrollInfo
WindowFromPoint
BeginDeferWindowPos
GetAsyncKeyState
GetCapture
IsChild
GetDoubleClickTime
MoveWindow
GetMessageTime
MessageBoxW
SetCapture
EndDeferWindowPos
EnumThreadWindows
GetClassLongW
ReleaseCapture
InvalidateRect
EnumDisplayMonitors
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowPlacement
MonitorFromPoint
DeleteMenu
TrackPopupMenuEx
GetMenuItemID
KillTimer
IsZoomed
GetKeyState
GetWindowTextW
OffsetRect
EqualRect
GetLayeredWindowAttributes
GetFocus
GetAncestor
CreateWindowExW
IsMenu
GetMenuState
FlashWindowEx
UpdateWindow
EnableWindow
SetWindowTextW
SetTimer
NotifyWinEvent
GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
AdjustWindowRectEx
WaitMessage
GetActiveWindow
GetWindowDC
SetFocus
PostQuitMessage
AnimateWindow
RegisterClassExW
GetClassInfoExW
GetWindow
EnumDisplayDevicesW
LoadCursorFromFileA
DestroyCursor
SendMessageTimeoutW
CopyRect
SetCursor
SetClassLongW
LoadCursorW
ClientToScreen
PtInRect
GetCursorPos
RegisterWindowMessageW
CallWindowProcW
SetWindowLongW
EmptyClipboard
SetActiveWindow
SetWindowPos
SetForegroundWindow
GetForegroundWindow
FlashWindow
IsIconic
IsWindowVisible
FindWindowW
GetWindowLongW
FindWindowExW
AttachThreadInput
GetWindowThreadProcessId
MonitorFromWindow
ScreenToClient
ReleaseDC
GetDC
GetDesktopWindow
SystemParametersInfoW
DispatchMessageW
IsRectEmpty
DefWindowProcW
TranslateMessage

gdi32

SaveDC
SetViewportOrgEx
RestoreDC
BitBlt
GetFontUnicodeRanges
CreateFontW
GetObjectA
GetGlyphIndicesW
GetClipBox
GetStockObject
CreateBitmap
GetDeviceCaps
GetObjectW
SetLayout
AddFontMemResourceEx
CreateCompatibleDC
CreateDIBSection
SelectObject
StartPage
EndDoc
CreateDCW
SetMapMode
StartDocW
EndPage
GetLayout
DeleteDC
DeleteObject
GetDIBits
EnumFontFamiliesExW

advapi32

EqualSid
AccessCheck
SetThreadToken
EnableTraceEx
RegNotifyChangeKeyValue
DeleteService
ControlService
RegUnLoadKeyW
RegLoadKeyW
CloseEncryptedFileRaw
WriteEncryptedFileRaw
ReadEncryptedFileRaw
OpenEncryptedFileRawW
LookupAccountSidW
GetKernelObjectSecurity
SetKernelObjectSecurity
LookupPrivilegeNameW
QueryServiceStatusEx
CloseServiceHandle
MakeAbsoluteSD
RegOpenKeyW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
ImpersonateSelf
RegEnumValueW
RegQueryValueExW
InitiateSystemShutdownW
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
CreateWellKnownSid
InitializeSecurityDescriptor
SetSecurityDescriptorGroup
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
OpenThreadToken
ConvertSidToStringSidW
CreateProcessAsUserW
SetTokenInformation
StartServiceW
OpenServiceW
OpenSCManagerW
InitiateSystemShutdownExW
RegDisablePredefinedCache
QueryServiceStatus
MapGenericMask
SetSecurityInfo
GetSecurityInfo
DuplicateToken
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
GetSecurityDescriptorControl
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetAce
GetAclInformation
AddAce
InitializeAcl
RegEnumKeyW
IsValidSid
GetLengthSid
CopySid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RevertToSelf
ImpersonateLoggedOnUser
DuplicateTokenEx
OpenProcessToken
EnumerateTraceGuids
QueryTraceW
FlushTraceW
StopTraceW
EnableTrace
StartTraceW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
ControlTraceW
TraceMessage
SetNamedSecurityInfoW
SetEntriesInAclW
ConvertStringSidToSidW
GetNamedSecurityInfoW
ChangeServiceConfigW
QueryServiceConfigW
CreateServiceW
GetUserNameW

ole32

CoCreateInstance
OleInitialize
OleUninitialize
CoCreateGuid
StringFromGUID2
CoInitialize
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
RevokeDragDrop
RegisterDragDrop
CoTaskMemRealloc
DoDragDrop
OleRun
PropVariantCopy
PropVariantClear
StgCreateStorageEx
StgOpenStorageEx
StringFromIID
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
ReleaseStgMedium
IIDFromString

oleaut32

SafeArrayCopy
SafeArrayCreateVector
SafeArrayRedim
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayUnlock
SafeArrayCreate
VariantCopyInd
SysStringByteLen
SysAllocStringByteLen
VarBstrFromDate
VariantChangeType
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetVartype
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocStringLen
SysStringLen
VariantClear
VariantInit
SysAllocString
SysFreeString
VarUI4FromStr
GetErrorInfo
SafeArrayDestroy

shlwapi

PathAddBackslashW
PathMatchSpecW
PathFileExistsW
PathRemoveFileSpecW
UrlEscapeW
ord12
PathCombineW
PathFindOnPathW
PathFindExtensionW
PathFindFileNameW
PathAppendW
PathIsUNCServerW
SHDeleteKeyW
PathSkipRootW
PathIsUNCW
PathIsURLW
UrlCanonicalizeW

imm32

ImmAssociateContextEx
ImmIsIME
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
ImmNotifyIME

gdiplus

GdipDrawPath
GdipFillRectanglesI
GdipDrawLine
GdipSetClipRectI
GdipTranslateWorldTransform
GdipGetSmoothingMode
GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer2
GdipGetImageGraphicsContext
GdipGraphicsClear
GdipGetPathWorldBounds
GdipClonePath
GdipSetClipRect
GdipAddPathRectangleI
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteGraphics
GdipSetSmoothingMode
GdipEndContainer
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRect
GdipTransformPoints
GdipMultiplyWorldTransform
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipScaleMatrix
GdipShearMatrix
GdipCreateTexture
GdipFillEllipse
GdipDrawEllipse
GdipFillPie
GdipSetPathGradientTransform
GdipSetPathGradientCenterPoint
GdipSetPathGradientWrapMode
GdipSetPathGradientPresetBlend
GdipCreatePathGradientFromPath
GdipAddPathEllipse
GdipSetLineWrapMode
GdipDeletePen
GdipCreateMatrix2
GdipMultiplyLineTransform
GdipCreateLineBrush
GdipGetClipBoundsI
GdipFillPath
GdipAddPathLineI
GdipAddPathArcI
GdipDeletePath
GdipCreatePath
GdipFillRectangleI
GdipDeleteBrush
GdipCreateSolidFill
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipDeleteFontFamily
GdipFree
GdipAlloc
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipDrawPie
GdipDrawArc
GdipFillRectangle
GdipDrawRectangle
GdipResetPath
GdipIsVisiblePathPoint
GdipStartPathFigure
GdipAddPathLine
GdipClosePathFigure
GdipSetPathFillMode
GdipAddPathArc
GdipAddPathBezier
GdipSetPageUnit
GdipSetCompositingQuality
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipCreateFromHWND
GdipCreateFromHDC
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetLinePresetBlend
GdipSetStringFormatTrimming
GdipGetFontHeightGivenDPI
GdipMeasureString
GdipDrawDriverString
GdipCreateHBITMAPFromBitmap
GdipDrawImageI
GdipCreateBitmapFromGraphics
GdiplusStartup
GdiplusShutdown
GdipCreateFontFromLogfontA
GdipGetLineSpacing
GdipCreateFontFromDC
GdipDeleteFont
GdipSetPenDashOffset
GdipSetPenDashArray
GdipSetPenDashStyle
GdipSetPenMiterLimit
GdipSetPenLineJoin
GdipSetPenStartCap
GdipSetPenEndCap
GdipCreatePen2
GdipGetFontStyle
GdipAddPathString
GdipDrawString
GdipGetCellDescent
GdipGetEmHeight
GdipGetFontSize
GdipGetCellAscent
GdipGetFamily
GdipCreatePen1
GdipCloneBrush

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW

msi

ord205

comdlg32

GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError
PrintDlgW

Sections

.text
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

IPPCODE
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 221KB - Virtual size: 257KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 479KB - Virtual size: 479KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0ace36f6e5c8b28aa2dcb2f4f701d55

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0b:be:91:35:61:37:61:3e:57:68:3e:60:3e:c5:38:bdCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

c1:5a:6e:34:ba:3c:85:84:21:b5:ae:ad:45:1d:d0:d7:9f:58:ff:07:77:6d:f1:62:97:64:a5:64:31:5d:0a:8fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

rpcrt4

psapi

ws2_32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

imm32

gdiplus

setupapi

msi

comdlg32

Sections

.text Size: 6.5MB - Virtual size: 6.5MB

IPPCODE Size: 60KB - Virtual size: 59KB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 221KB - Virtual size: 257KB

.rsrc Size: 3.9MB - Virtual size: 3.9MB

.reloc Size: 479KB - Virtual size: 479KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0b:be:91:35:61:37:61:3e:57:68:3e:60:3e:c5:38:bd
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

c1:5a:6e:34:ba:3c:85:84:21:b5:ae:ad:45:1d:d0:d7:9f:58:ff:07:77:6d:f1:62:97:64:a5:64:31:5d:0a:8f
Signer

.text
Size: 6.5MB - Virtual size: 6.5MB

IPPCODE
Size: 60KB - Virtual size: 59KB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 221KB - Virtual size: 257KB

.rsrc
Size: 3.9MB - Virtual size: 3.9MB

.reloc
Size: 479KB - Virtual size: 479KB