Setup[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Setup.rar
Size

19.4MB
MD5

244cfc8eea22cfd4e9e62a1aed06cee0
SHA1

2221ee0f5de9540107b0f9023e5511c3b13cf6cd
SHA256

b42e80d3b206570fea04e454a9f7edead48f37f0e26e913ed9a2f58803d1099d
SHA512

115ffe23dcd45744c54eb333803eb4ae475c62a2525ad031734e7f2a8cb9f7087b6656b122dc2afd5f38f7e652e49a9e9d1b3874214d4dfcfdd5557224956771
SSDEEP

393216:kR8+eZMkr8ExXbFEvm0GTD0+0OwOyqEV/f8D/XqTFYx4pKaEVJoVub+hdDGv:kmtuEha4D0RAyrXFYx4ajlbADGv

Score

1^/10

Malware Config

Signatures

Files

Setup.rar
.rar
DotHelp.dll
Loader.exe
.exe windows:6 windows x64 arch:x64

f0ea7b7844bbc5bfa9bb32efdcea957c

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

12:1c:77:48:63:e3:ba:8e:7b:8b:f7:55:97:87:47:ae
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

06/09/2022, 00:00

Not After

05/09/2025, 23:59

Subject

CN=BLACKBIRD SECURE BROWSING LTD,O=BLACKBIRD SECURE BROWSING LTD,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:a4:fa:54:20:3d:5d:0e:43:56:6c:e3:04:f4:3c:36:85:0a:41:fd:4f:13:56:4b:7e:a0:84:4c:d8:fc:a9:81
Signer

Actual PE Digest

29:a4:fa:54:20:3d:5d:0e:43:56:6c:e3:04:f4:3c:36:85:0a:41:fd:4f:13:56:4b:7e:a0:84:4c:d8:fc:a9:81

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Sections

.text
Size: 21.0MB - Virtual size: 21.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26.6MB - Virtual size: 26.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.0MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 512B - Virtual size: 295B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/32
Size: 614KB - Virtual size: 614KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/46
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/65
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/78
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/90
Size: 425KB - Virtual size: 425KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 8.5MB - Virtual size: 8.5MB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OPEN SETUP.txt
Patch.css
Settings/Environment.ini
Settings/Net_Framework_4.8.16.exe
.exe windows:5 windows x86 arch:x86

9b2f6a441f9ff8df98ae6e9e6b5d4271

Code Sign

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:f8:97:e7:60:fb:03:a3:90:c1:00:00:00:00:00:f8
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2018, 20:20

Not After

23/11/2019, 20:20

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:c4:14:71:51:60:46:e6:05:3a:14:69:74:84:56:eb:85:52:ba:7d:9a:70:b1:7c:1c:b8:b6:77:ee:73:0a:4d
Signer

Actual PE Digest

d0:c4:14:71:51:60:46:e6:05:3a:14:69:74:84:56:eb:85:52:ba:7d:9a:70:b1:7c:1c:b8:b6:77:ee:73:0a:4d

Digest Algorithm

sha256

PE Digest Matches

true

f0:3e:80:e5:63:5b:c3:18:22:45:35:62:7c:4b:b2:90:ef:bb:7a:ba
Signer

Actual PE Digest

f0:3e:80:e5:63:5b:c3:18:22:45:35:62:7c:4b:b2:90:ef:bb:7a:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb

Imports

advapi32

CreateWellKnownSid
InitializeSecurityDescriptor
SetEntriesInAclW
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
DecryptFileW

kernel32

GetTickCount
SetEnvironmentVariableW
GetLastError
ExpandEnvironmentStringsW
CreateProcessW
Sleep
WaitForSingleObject
GetExitCodeProcess
CloseHandle
SetFileAttributesW
InitializeCriticalSection
CreateEventW
GetEnvironmentVariableW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetCommandLineW
lstrlenW
CompareStringW
LocalFree
CreateDirectoryW
QueryDosDeviceW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
CreateFileW
DeviceIoControl
SetErrorMode
RemoveDirectoryW
MoveFileExW
GetProcAddress
GetSystemDirectoryW
LoadLibraryW
GetModuleHandleW
CreateThread
LocalAlloc
RaiseException
ExitThread
WaitForMultipleObjects
ResetEvent
CreateEventA
GetSystemInfo
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetModuleHandleA
GetVersionExA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetEndOfFile
DuplicateHandle
ReadFile
SetFilePointerEx
GlobalFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
LCMapStringW
FreeLibrary
InterlockedExchange
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetStringTypeW
HeapSize
HeapReAlloc
IsProcessorFeaturePresent
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileA
GetLocalTime
GetComputerNameW
lstrlenA
FormatMessageW
GetSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
DeleteFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcessHeap
GlobalAlloc
LoadLibraryA

comctl32

ord17

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

shell32

CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW
GetTopWindow
GetWindowThreadProcessId
GetWindow
SendMessageW
PostMessageW
DialogBoxParamW
GetDlgItem
SetWindowTextW
EndDialog
PostQuitMessage
LoadStringW
SetWindowLongW
GetWindowLongW
CharUpperW

oleaut32

SysAllocString
VariantClear

Exports

Exports

?dwPlaceholder@@3PAEA
_DecodePointerInternal@4
_EncodePointerInternal@4

Sections

.text
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.boxld01
Size: 512B - Virtual size: 182B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Settings/RLSettings.json
libGLESv2.dll
opengl32.dll
.dll windows:10 windows x64 arch:x64

9fb39f6af91d482e4fc0097e85d02280

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a3:9d:1d:73:b9:20:2e:e2:ed:fc:61:9f:14:db:38:1b:de:af:bb:d9:cb:da:88:fe:1b:cf:8f:66:2b:87:dd:12
Signer

Actual PE Digest

a3:9d:1d:73:b9:20:2e:e2:ed:fc:61:9f:14:db:38:1b:de:af:bb:d9:cb:da:88:fe:1b:cf:8f:66:2b:87:dd:12

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

MpSvc.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

terminate
abort
_initialize_onexit_table
_initialize_narrow_environment
_execute_onexit_table
_beginthreadex
_seh_filter_dll
_initterm_e
_initterm
_cexit
_configure_narrow_argv
_crt_atexit
_invalid_parameter_noinfo_noreturn
_errno
_register_onexit_function
_invalid_parameter_noinfo

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s
fgetc
ungetc
fflush
setvbuf
fsetpos
_fseeki64
fgetpos
fwrite
_wfsopen
fseek
fputc
fread
_get_stream_buffer_pointers
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vswscanf
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vsnwprintf_s
fclose

api-ms-win-crt-string-l1-1-0

iswdigit
islower
iswlower
wcscpy_s
iswspace
wmemmove_s
wcsncmp
strcspn
_wcsicmp
wcsnlen
tolower
towlower
towupper
toupper
iswalpha
isdigit
_wcsnicmp
strncmp
strcpy_s
isspace
iswxdigit
wcspbrk
_wcsdup
isupper
__strncnt
_isctype_l
strnlen
iswupper
wcscmp

advapi32

SetThreadToken
GetFileSecurityW
InitializeSecurityDescriptor
InitializeAcl
SetSecurityInfo
GetKernelObjectSecurity
SetKernelObjectSecurity
AddAccessAllowedAceEx
DuplicateTokenEx
TraceMessage
QueryServiceConfig2W
EventWriteTransfer
EventUnregister
CloseServiceHandle
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryValueExW
RegCloseKey
ConvertSidToStringSidW
CheckTokenMembership
ConvertStringSidToSidW
AllocateAndInitializeSid
OpenSCManagerW
QueryServiceStatus
NotifyServiceStatusChangeW
StartServiceW
QueryServiceStatusEx
OpenServiceW
EventRegister
LookupAccountSidW
LookupAccountNameW
GetTokenInformation
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegUnLoadKeyW
RegLoadKeyW
RegDeleteValueW
RegEnumValueW
OpenProcessToken
RegisterServiceCtrlHandlerExW
CreateServiceW
SetServiceStatus
DeleteService
StartServiceCtrlDispatcherW
MakeAbsoluteSD
EventActivityIdControl
QueryServiceConfigW
RegOpenKeyExW
ChangeServiceConfigW
ControlService
EqualSid
IsValidSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetLengthSid
DuplicateToken
OpenThreadToken
CreateWellKnownSid
RegGetKeySecurity
StopTraceW
StartTraceW
CreateProcessAsUserW
RegCopyTreeW
AdjustTokenPrivileges
LookupPrivilegeValueW
ChangeServiceConfig2W
ImpersonateLoggedOnUser
RevertToSelf
GetSecurityDescriptorOwner
DeleteAce
GetNamedSecurityInfoW
CopySid
SetNamedSecurityInfoW
GetAce
SetSecurityDescriptorOwner
SetFileSecurityW
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
LsaNtStatusToWinError
IsWellKnownSid
LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
FreeSid
InitiateSystemShutdownExW

crypt32

CryptStringToBinaryW
CryptBinaryToStringW
CertVerifyCertificateChainPolicy

kernel32

GetProcessTimes
CopyFileW
CreateDirectoryW
GetFileInformationByHandleEx
GetFileAttributesExW
GetDiskFreeSpaceExW
CopyFileExW
GetDriveTypeW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
LocalFree
SleepEx
GetFileSizeEx
ReadFile
TryAcquireSRWLockExclusive
TryEnterCriticalSection
InitializeCriticalSection
LCMapStringW
SwitchToThread
UnregisterWaitEx
GetEnvironmentVariableW
ExpandEnvironmentStringsW
lstrcmpW
MapViewOfFile
CreateFileMappingW
FindClose
FindNextFileW
CreateProcessW
GetModuleFileNameW
UnmapViewOfFile
DeleteFiber
FindFirstFileW
RemoveDirectoryW
SetFileAttributesW
GetVolumePathNameW
CreateFiberEx
SwitchToFiber
ConvertThreadToFiber
IsThreadAFiber
ConvertFiberToThread
SystemTimeToFileTime
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolThreadMaximum
CreateThreadpool
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpool
FlushFileBuffers
QueryFullProcessImageNameW
CreateMutexW
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
ReadProcessMemory
DuplicateHandle
QueryDosDeviceW
K32GetProcessMemoryInfo
SetEnvironmentVariableA
GetFileInformationByHandle
FindCloseChangeNotification
GetTempFileNameW
FindNextChangeNotification
FindFirstChangeNotificationW
GetSystemTime
InitializeSRWLock
WaitForMultipleObjects
FindStringOrdinal
lstrcmpiW
K32GetModuleInformation
K32GetModuleBaseNameW
VirtualQuery
FindResourceW
LoadResource
LockResource
SizeofResource
CreateThread
LoadLibraryW
GetLogicalDrives
OpenProcess
ProcessIdToSessionId
WideCharToMultiByte
MultiByteToWideChar
OpenThread
ReleaseSRWLockShared
AcquireSRWLockShared
GetExitCodeProcess
CreateHardLinkW
MoveFileExW
GetTempPathW
SetEnvironmentVariableW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
RtlCompareMemory
SystemTimeToTzSpecificLocalTime
GetTickCount64
CompareStringEx
WaitForMultipleObjectsEx
GetCPInfo
LCMapStringEx
DecodePointer
SleepConditionVariableSRW
DeleteFileW
WakeConditionVariable
WakeAllConditionVariable
GetTickCount
CompareFileTime
GetPackagesByPackageFamily
PackageIdFromFullName
GetStringTypeW
InitOnceBeginInitialize
InitOnceComplete
GetLocaleInfoEx
CreateFileW
GetFinalPathNameByHandleW
DeviceIoControl
LoadLibraryExA
GetTimeFormatW
VirtualProtect
GetExitCodeThread
GetDateFormatW
ConvertDefaultLocale
GetLocaleInfoW
GetComputerNameExW
QueryPerformanceFrequency
FormatMessageA
SetThreadPriority
GetCurrentThread
GetThreadPriority
GetSystemPowerStatus
GetSystemWindowsDirectoryW
CreateSemaphoreW
LoadLibraryExW
RtlUnwind
InitializeCriticalSectionEx
EncodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapSetInformation
GetNativeSystemInfo
GetSystemDirectoryW
OpenEventW
SetFilePointerEx
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
ChangeTimerQueueTimer
InterlockedPushEntrySList
RtlUnwindEx
InitializeSListHead
QueryPerformanceCounter
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
SetErrorMode
DeleteTimerQueueTimer
FreeLibrary
Sleep
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
GetProcAddress
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
OutputDebugStringW
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
GetFileAttributesW
InitializeConditionVariable
CreateTimerQueueTimer
WriteFile
RegisterWaitForSingleObject
GetSystemInfo
CreateJobObjectW

rpcrt4

RpcImpersonateClient
RpcRevertToSelf
UuidCompare
NdrServerCall2
NdrServerCallAll
UuidFromStringW
RpcServerUnregisterIf
RpcEpUnregister
RpcBindingVectorFree
RpcServerRegisterIfEx
RpcEpRegisterW
RpcServerInqBindings
RpcServerUseProtseqEpW
RpcServerUseProtseqW
RpcServerRegisterAuthInfoW
RpcStringFreeW
RpcBindingInqAuthClientW
RpcStringBindingParseW
RpcBindingToStringBindingW
UuidCreate
UuidHash

wintrust

WTHelperGetProvSignerFromChain
CryptCATAdminCalcHashFromFileHandle
WTHelperProvDataFromStateData
WinVerifyTrust
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext

urlmon

MkParseDisplayNameEx

api-ms-win-core-job-l2-1-0

SetInformationJobObject
QueryInformationJobObject
AssignProcessToJobObject

ntdll

RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
NtQueryInformationProcess
RtlTimeToTimeFields

mpclient

MpConfigDelValue
MpConfigInitialize
MpConfigOpen
MpHandleClose
MpConfigIteratorEnum
MpManagerOpen
MpConfigIteratorClose
MpConfigClose
MpManagerVersionQuery
MpConfigSetValue
MpAllocMemory
MpConfigRegisterForNotifications
MpConfigUnregisterNotifications
MpConfigIteratorOpen
MpConfigUninitialize
MpNotificationRegister
MpThreatLocalizedInfoQuery
MpUpdateStart
MpUpdateControl
MpQueryEngineConfigDword
MpScanStart
MpScanControl
MpConveySampleSubmissionResult
MpThreatOpen
MpConfigGetValueAlloc
MpConfigGetValue
MpThreatEnumerate
MpDynamicSignatureOpen
MpFreeMemory
MpClientUtilExportFunctions
MpDynamicSignatureEnumerate
MpUtilsExportFunctions
MpDebugExportFunctions
MpManagerStatusQueryEx
MpIsRtpAutoEnable
MpAddDynamicSignatureFile
MpErrorMessageFormat

api-ms-win-crt-heap-l1-1-0

_realloc_base
malloc
_free_base
_calloc_base
_malloc_base
_callnewh
calloc
realloc
free

api-ms-win-crt-convert-l1-1-0

atol
_wcstod_l
_ui64tow_s
_i64tow_s
_ui64toa_s
_i64toa_s
wcstoul
wcstol
wcstoll
wcstoull
_wtol
_wtoi
_itow_s
wcstoumax
strtod
strtof

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-locale-l1-1-0

_create_locale
___lc_codepage_func
localeconv
___lc_collate_cp_func
_free_locale
_unlock_locales
_lock_locales
setlocale
___mb_cur_max_func
___lc_locale_name_func
__pctype_func

api-ms-win-crt-math-l1-1-0

frexp
pow
ldexp
ceilf
powf

api-ms-win-crt-time-l1-1-0

_Getdays
_Strftime
_W_Getmonths
_Gettnames
_W_Gettnames
_Wcsftime
_Getmonths
_W_Getdays

userenv

ExpandEnvironmentStringsForUserW
CreateEnvironmentBlock
DestroyEnvironmentBlock

bcrypt

BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptFinishHash

api-ms-win-service-private-l1-1-0

SubscribeServiceChangeNotifications
UnsubscribeServiceChangeNotifications

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

Exports

Exports

ServiceCrtMain
ValidateDrop

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 844KB - Virtual size: 841KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0ea7b7844bbc5bfa9bb32efdcea957c

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

12:1c:77:48:63:e3:ba:8e:7b:8b:f7:55:97:87:47:aeCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

29:a4:fa:54:20:3d:5d:0e:43:56:6c:e3:04:f4:3c:36:85:0a:41:fd:4f:13:56:4b:7e:a0:84:4c:d8:fc:a9:81Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 21.0MB - Virtual size: 21.0MB

.rdata Size: 26.6MB - Virtual size: 26.6MB

.data Size: 1.0MB - Virtual size: 1.4MB

/4 Size: 512B - Virtual size: 295B

/19 Size: 1.7MB - Virtual size: 1.7MB

/32 Size: 614KB - Virtual size: 614KB

/46 Size: 512B - Virtual size: 48B

/65 Size: 4.9MB - Virtual size: 4.9MB

/78 Size: 1.7MB - Virtual size: 1.7MB

/90 Size: 425KB - Virtual size: 425KB

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 189KB - Virtual size: 189KB

.symtab Size: 8.5MB - Virtual size: 8.5MB

9b2f6a441f9ff8df98ae6e9e6b5d4271

Code Sign

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1Certificate

Extended Key Usages

33:00:00:00:f8:97:e7:60:fb:03:a3:90:c1:00:00:00:00:00:f8Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

d0:c4:14:71:51:60:46:e6:05:3a:14:69:74:84:56:eb:85:52:ba:7d:9a:70:b1:7c:1c:b8:b6:77:ee:73:0a:4dSigner

f0:3e:80:e5:63:5b:c3:18:22:45:35:62:7c:4b:b2:90:ef:bb:7a:baSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

comctl32

rpcrt4

shell32

shlwapi

user32

oleaut32

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 156KB

.data Size: 5KB - Virtual size: 13KB

.idata Size: 4KB - Virtual size: 4KB

.boxld01 Size: 512B - Virtual size: 182B

.rsrc Size: 8KB - Virtual size: 7KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

12:1c:77:48:63:e3:ba:8e:7b:8b:f7:55:97:87:47:ae
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

29:a4:fa:54:20:3d:5d:0e:43:56:6c:e3:04:f4:3c:36:85:0a:41:fd:4f:13:56:4b:7e:a0:84:4c:d8:fc:a9:81
Signer

.text
Size: 21.0MB - Virtual size: 21.0MB

.rdata
Size: 26.6MB - Virtual size: 26.6MB

.data
Size: 1.0MB - Virtual size: 1.4MB

/4
Size: 512B - Virtual size: 295B

/19
Size: 1.7MB - Virtual size: 1.7MB

/32
Size: 614KB - Virtual size: 614KB

/46
Size: 512B - Virtual size: 48B

/65
Size: 4.9MB - Virtual size: 4.9MB

/78
Size: 1.7MB - Virtual size: 1.7MB

/90
Size: 425KB - Virtual size: 425KB

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 189KB - Virtual size: 189KB

.symtab
Size: 8.5MB - Virtual size: 8.5MB

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

33:00:00:00:f8:97:e7:60:fb:03:a3:90:c1:00:00:00:00:00:f8
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

d0:c4:14:71:51:60:46:e6:05:3a:14:69:74:84:56:eb:85:52:ba:7d:9a:70:b1:7c:1c:b8:b6:77:ee:73:0a:4d
Signer

f0:3e:80:e5:63:5b:c3:18:22:45:35:62:7c:4b:b2:90:ef:bb:7a:ba
Signer

.text
Size: 156KB - Virtual size: 156KB

.data
Size: 5KB - Virtual size: 13KB

.idata
Size: 4KB - Virtual size: 4KB

.boxld01
Size: 512B - Virtual size: 182B

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 10KB - Virtual size: 10KB

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

a3:9d:1d:73:b9:20:2e:e2:ed:fc:61:9f:14:db:38:1b:de:af:bb:d9:cb:da:88:fe:1b:cf:8f:66:2b:87:dd:12
Signer

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 844KB - Virtual size: 841KB

.data
Size: 60KB - Virtual size: 85KB

.pdata
Size: 128KB - Virtual size: 124KB

.didat
Size: 4KB - Virtual size: 496B

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 20KB - Virtual size: 17KB