PWRISOVM[.]EXE

Sharing

Copy URL Twitter E-mail

General

Target

PWRISOVM.EXE
Size

452KB
MD5

b9e3a3d2a59693b08cc500068aa57035
SHA1

2577a8b66c35fb36aa3e7b7a8e4cc487b80c1b7f
SHA256

606a015016eeb8f9c795b75b3ac7f081fd6c0979aa6b6568ba39e0de058fd94f
SHA512

2beb90e9d34d79ea1e3a00327d2354806da12b16f9506d14a441814d03ac398792bd375cf5894f9bfa0ab967c34fe2eb564f04fe4c187ebae596592d62815120
SSDEEP

6144:Yjdmxz8S9uk3F7yY7GvY8l673Ivaufi9HpRTwugGSxgYvnEDAuEA:Yjdmxz8S4k17L7GJSaXSJtKtbnEDAuEA

Score

1^/10

Malware Config

Signatures

Files

PWRISOVM.EXE
.exe windows:4 windows x64 arch:x64

022c402ae019a280b7ab516c9cca994a

Code Sign

20:45:6e:ff:67:25:04:b0:d5:ff:21:fa:45:55:82:65
Certificate

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09/03/2023, 04:13

Not After

08/03/2026, 04:13

Subject

CN=Power Software Limited,O=Power Software Limited,L=Sheung Wan,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

64:33:51:d3:c7:38:9f:08
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

24/06/2016, 20:44

Not After

24/06/2031, 20:44

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09/12/2022, 18:30

Not After

06/12/2032, 18:30

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13/11/2019, 18:50

Not After

12/11/2034, 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:45:6e:ff:67:25:04:b0:d5:ff:21:fa:45:55:82:65
Certificate

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09/03/2023, 04:13

Not After

08/03/2026, 04:13

Subject

CN=Power Software Limited,O=Power Software Limited,L=Sheung Wan,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

64:33:51:d3:c7:38:9f:08
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

24/06/2016, 20:44

Not After

24/06/2031, 20:44

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09/12/2022, 18:30

Not After

06/12/2032, 18:30

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13/11/2019, 18:50

Not After

12/11/2034, 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:e7:df:8b:a8:b1:96:8b:f3:70:3d:fa:3d:e2:71:59:77:6e:93:6e:40:18:48:b4:fe:d4:e8:52:7f:ba:86:f4
Signer

Actual PE Digest

41:e7:df:8b:a8:b1:96:8b:f3:70:3d:fa:3d:e2:71:59:77:6e:93:6e:40:18:48:b4:fe:d4:e8:52:7f:ba:86:f4

Digest Algorithm

sha256

PE Digest Matches

true

fb:60:8a:c0:dc:23:23:61:d6:2d:f7:88:f1:87:8b:99:03:15:a8:bc
Signer

Actual PE Digest

fb:60:8a:c0:dc:23:23:61:d6:2d:f7:88:f1:87:8b:99:03:15:a8:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetPrivateProfileIntW
DeleteFileW
GetPrivateProfileStringW
FormatMessageW
LocalFree
MulDiv
FindNextFileW
FindClose
GetSystemDefaultLangID
GetModuleHandleW
GetCurrentProcess
GetVersionExW
GetModuleFileNameW
FindFirstFileW
ReadFile
WriteFile
GetFileSize
SetFilePointer
CloseHandle
CreateThread
lstrcmpiW
GetLastError
QueryDosDeviceW
DefineDosDeviceW
DeviceIoControl
GetLogicalDrives
lstrcpynW
CreateDirectoryW
GetFileAttributesW
SetLastError
MultiByteToWideChar
WideCharToMultiByte
CreateEventW
CreateProcessW
Sleep
WaitForSingleObject
CreateFileW
GetVersion
LoadLibraryW
GetProcAddress
GetTickCount
ExitProcess
LoadLibraryA
SetStdHandle
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GlobalDeleteAtom
GlobalAlloc
lstrcmpW
GlobalLock
lstrlenW
GetCurrentThread
lstrlenA
GetVersionExA
lstrcatW
FreeLibrary
GetModuleHandleA
GlobalFindAtomW
GlobalAddAtomW
FreeResource
LockResource
LoadResource
FindResourceW
GlobalUnlock
GlobalFree
WritePrivateProfileStringW
lstrcpyW
GlobalFlags
LocalAlloc
LeaveCriticalSection
GlobalReAlloc
GlobalHandle
EnterCriticalSection
TlsGetValue
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GetProcessVersion
SetErrorMode
FlushFileBuffers
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
RtlUnwindEx
RaiseException
RtlPcToFileHeader
HeapReAlloc
HeapSize
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapSetInformation
HeapCreate
LCMapStringA
LCMapStringW
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
GetLocaleInfoA

user32

UnhookWindowsHookEx
SetCursor
IsWindowEnabled
GetLastActivePopup
MessageBoxW
PeekMessageW
ValidateRect
GetKeyState
DispatchMessageW
TranslateMessage
GetMessageW
GetActiveWindow
CallNextHookEx
SetWindowsHookExW
LoadBitmapW
GetMenuCheckMarkDimensions
GetMenuState
GetNextDlgTabItem
GetFocus
SetMenuItemBitmaps
GetWindow
GetWindowPlacement
IsIconic
SystemParametersInfoA
SetWindowPos
CallWindowProcW
GetDlgCtrlID
GetWindowTextLengthW
GetDlgItem
RegisterClassW
GetClassInfoW
wsprintfW
AdjustWindowRectEx
GetMenu
UpdateWindow
MapWindowPoints
SetActiveWindow
GetForegroundWindow
DestroyWindow
TrackPopupMenu
GetTopWindow
SetWindowLongPtrW
PostQuitMessage
GetMessageTime
GetWindowLongPtrW
SetFocus
IsWindow
SendDlgItemMessageA
SendDlgItemMessageW
RemovePropW
GetPropW
SetPropW
CreateWindowExW
WinHelpW
GetCapture
TabbedTextOutW
GrayStringW
BeginPaint
EndPaint
DestroyMenu
EndDialog
CreateDialogIndirectParamW
GetSubMenu
IsDialogMessageW
MoveWindow
ShowWindow
LoadStringW
GetSysColorBrush
InsertMenuW
GetMenuItemInfoW
GetMenuStringW
GetMenuItemID
GetMenuItemCount
ModifyMenuW
LoadCursorW
LoadIconW
MessageBoxA
DefWindowProcW
PostMessageW
FindWindowW
CopyRect
UnregisterClassW
GetDC
GetMessagePos
GetWindowTextW
SetWindowTextW
SendMessageW
KillTimer
SetTimer
GetClassNameW
IsWindowVisible
GetClientRect
PtInRect
BroadcastSystemMessage
SetMenuItemInfoW
EnableMenuItem
CreatePopupMenu
RegisterWindowMessageW
DestroyIcon
GetSystemMetrics
LoadImageW
GetCursorPos
EnableWindow
CheckMenuItem
ScreenToClient
ClientToScreen
GetDesktopWindow
GetWindowRect
DrawTextW
SystemParametersInfoW
MessageBoxIndirectW
EnumWindows
GetParent
GetWindowLongW
SetForegroundWindow
GetSysColor
LoadMenuW
RemoveMenu
ReleaseDC

advapi32

RegEnumValueW
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegSetValueExW

shell32

SHGetSpecialFolderPathW
Shell_NotifyIconW
SHChangeNotify
ShellExecuteExW

gdi32

DeleteDC
GetStockObject
CreateCompatibleBitmap
DeleteObject
GetTextExtentPoint32W
Rectangle
CreateSolidBrush
CreatePen
SetStretchBltMode
BitBlt
StretchBlt
SetPixel
GetPixel
SelectObject
CreateCompatibleDC
CreateBitmap
GetDeviceCaps
SetBkMode
SetMapMode
RestoreDC
SaveDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
MoveToEx
LineTo
GetObjectW
SetBkColor
SetTextColor
GetClipBox

comdlg32

GetOpenFileNameW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

comctl32

ord17

wininet

InternetConnectW
InternetOpenW
InternetCloseHandle
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetReadFile
HttpQueryInfoW
InternetAttemptConnect

Sections

.text
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

022c402ae019a280b7ab516c9cca994a

Code Sign

20:45:6e:ff:67:25:04:b0:d5:ff:21:fa:45:55:82:65Certificate

Extended Key Usages

Key Usages

64:33:51:d3:c7:38:9f:08Certificate

Extended Key Usages

Key Usages

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4bCertificate

Extended Key Usages

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

20:45:6e:ff:67:25:04:b0:d5:ff:21:fa:45:55:82:65Certificate

Extended Key Usages

Key Usages

64:33:51:d3:c7:38:9f:08Certificate

Extended Key Usages

Key Usages

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4bCertificate

Extended Key Usages

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

41:e7:df:8b:a8:b1:96:8b:f3:70:3d:fa:3d:e2:71:59:77:6e:93:6e:40:18:48:b4:fe:d4:e8:52:7f:ba:86:f4Signer

fb:60:8a:c0:dc:23:23:61:d6:2d:f7:88:f1:87:8b:99:03:15:a8:bcSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

gdi32

comdlg32

winspool.drv

comctl32

wininet

Sections

.text Size: 151KB - Virtual size: 151KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 13KB - Virtual size: 62KB

.pdata Size: 13KB - Virtual size: 12KB

.rsrc Size: 194KB - Virtual size: 193KB

20:45:6e:ff:67:25:04:b0:d5:ff:21:fa:45:55:82:65
Certificate

64:33:51:d3:c7:38:9f:08
Certificate

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

20:45:6e:ff:67:25:04:b0:d5:ff:21:fa:45:55:82:65
Certificate

64:33:51:d3:c7:38:9f:08
Certificate

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

41:e7:df:8b:a8:b1:96:8b:f3:70:3d:fa:3d:e2:71:59:77:6e:93:6e:40:18:48:b4:fe:d4:e8:52:7f:ba:86:f4
Signer

fb:60:8a:c0:dc:23:23:61:d6:2d:f7:88:f1:87:8b:99:03:15:a8:bc
Signer

.text
Size: 151KB - Virtual size: 151KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 13KB - Virtual size: 62KB

.pdata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 194KB - Virtual size: 193KB