General

Malware Config

Signatures

Files

• b7d91f0e15cf0258fc857699171b6627337d511ecca9ab22adf668e0918eec50

  .zip
• Bitdefender/USOPrivate.dat
• Bitdefender/USOPrivate.exe

  .exe windows:6 windows x64 arch:x64

  3414cc03f06274508830a4fda02b2309

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:09:12:80:3c:c1:89:44:65:87:4f:1a:f1:22:63:cb

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-04-2018 00:00

  Not After

  16-04-2019 12:00

  Subject

  CN=Bitdefender SRL,OU=DEVSUP CL,O=Bitdefender SRL,L=Bucharest,C=RO

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  61:1c:b2:8a:00:00:00:00:00:26

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-04-2011 19:41

  Not After

  15-04-2021 19:51

  Subject

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:a8:b3:e2:48:f7:a1:6b:4f:9e:5a:6c:b6:7e:76:d6

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-04-2018 00:00

  Not After

  16-04-2019 12:00

  Subject

  CN=Bitdefender SRL,OU=DEVSUP CL,O=Bitdefender SRL,L=Bucharest,C=RO

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:1c:b2:8a:00:00:00:00:00:26

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-04-2011 19:41

  Not After

  15-04-2021 19:51

  Subject

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  ab:4b:26:3e:5f:b8:df:c7:58:07:a6:f3:f6:c1:f9:4d:d5:98:96:2f:87:1c:42:f9:47:7a:f8:79:e8:09:21:f1

  Signer

  Actual PE Digest

  ab:4b:26:3e:5f:b8:df:c7:58:07:a6:f3:f6:c1:f9:4d:d5:98:96:2f:87:1c:42:f9:47:7a:f8:79:e8:09:21:f1

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  eb:42:8a:18:53:b8:6a:51:7f:8c:ea:02:23:7d:ff:5d:9f:45:1a:13

  Signer

  Actual PE Digest

  eb:42:8a:18:53:b8:6a:51:7f:8c:ea:02:23:7d:ff:5d:9f:45:1a:13

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  D:\bamboo\home\xml-data\build-dir\CODRU-CM-SOURCES\bin\x64\Release\BdServiceHost.pdb

  Imports

  kernel32

  AllocConsole

  FreeConsole

  GetTickCount

  CreateFileW

  MultiByteToWideChar

  FormatMessageA

  SetEvent

  GetProcessHeap

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetOEMCP

  IsValidCodePage

  CreateEventW

  LocalFree

  SetCurrentDirectoryW

  GetCommandLineW

  CreateThread

  DecodePointer

  GetModuleHandleW

  InitializeCriticalSectionEx

  GetLastError

  RaiseException

  FreeLibrary

  GetProcAddress

  LoadLibraryW

  GetModuleFileNameW

  DeleteCriticalSection

  CloseHandle

  SetStdHandle

  Sleep

  HeapSize

  ReadFile

  GetConsoleCP

  FlushFileBuffers

  WideCharToMultiByte

  GetStringTypeW

  FormatMessageW

  FindClose

  FindFirstFileExW

  FindNextFileW

  GetFileAttributesExW

  SetEndOfFile

  SetFilePointerEx

  EnterCriticalSection

  LeaveCriticalSection

  EncodePointer

  SetLastError

  InitializeCriticalSectionAndSpinCount

  SwitchToThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  LCMapStringW

  GetLocaleInfoW

  GetCPInfo

  IsDebuggerPresent

  OutputDebugStringW

  ResetEvent

  WaitForSingleObjectEx

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  InitializeSListHead

  RtlUnwindEx

  RtlPcToFileHeader

  LoadLibraryExW

  ExitProcess

  GetModuleHandleExW

  GetStdHandle

  WriteFile

  GetACP

  HeapFree

  HeapAlloc

  HeapReAlloc

  GetFileType

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetConsoleMode

  GetNumberOfConsoleInputEvents

  PeekConsoleInputA

  ReadConsoleW

  ReadConsoleInputW

  SetConsoleMode

  WriteConsoleW

  user32

  MsgWaitForMultipleObjectsEx

  GetMessageW

  UnregisterPowerSettingNotification

  RegisterPowerSettingNotification

  DispatchMessageW

  advapi32

  RegDeleteKeyW

  ChangeServiceConfig2W

  ChangeServiceConfigW

  StartServiceW

  ControlService

  QueryServiceStatus

  DeleteService

  CreateServiceW

  OpenServiceW

  OpenSCManagerW

  CloseServiceHandle

  RegisterServiceCtrlHandlerExW

  SetServiceStatus

  StartServiceCtrlDispatcherW

  RegCloseKey

  RegOpenKeyExW

  shell32

  CommandLineToArgvW

  SHGetKnownFolderPath

  ole32

  CoTaskMemFree

  winmm

  timeGetTime

  Sections

  .text

  Size: 272KB - Virtual size: 272KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 122KB - Virtual size: 121KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 7KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 313KB - Virtual size: 313KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Bitdefender/log.dll

  .dll windows:5 windows x64 arch:x64

  39e783c98fd544d72601d6ff47fd3317

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:09:12:80:3c:c1:89:44:65:87:4f:1a:f1:22:63:cb

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-04-2018 00:00

  Not After

  16-04-2019 12:00

  Subject

  CN=Bitdefender SRL,OU=DEVSUP CL,O=Bitdefender SRL,L=Bucharest,C=RO

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  61:1c:b2:8a:00:00:00:00:00:26

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-04-2011 19:41

  Not After

  15-04-2021 19:51

  Subject

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:a8:b3:e2:48:f7:a1:6b:4f:9e:5a:6c:b6:7e:76:d6

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-04-2018 00:00

  Not After

  16-04-2019 12:00

  Subject

  CN=Bitdefender SRL,OU=DEVSUP CL,O=Bitdefender SRL,L=Bucharest,C=RO

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:1c:b2:8a:00:00:00:00:00:26

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-04-2011 19:41

  Not After

  15-04-2021 19:51

  Subject

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  95:50:d6:d2:f3:cb:ef:cd:36:0b:e4:a6:00:fe:c8:0b:06:77:56:0c:fe:61:6d:8a:4c:05:92:6c:d7:dd:64:f8

  Signer

  Actual PE Digest

  95:50:d6:d2:f3:cb:ef:cd:36:0b:e4:a6:00:fe:c8:0b:06:77:56:0c:fe:61:6d:8a:4c:05:92:6c:d7:dd:64:f8

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  4a:66:a2:6e:e2:36:63:c1:05:11:cc:37:05:e3:0b:91:60:8d:08:2d

  Signer

  Actual PE Digest

  4a:66:a2:6e:e2:36:63:c1:05:11:cc:37:05:e3:0b:91:60:8d:08:2d

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  Imports

  kernel32

  FreeLibrary

  GetCurrentProcess

  WaitForSingleObject

  Sleep

  lstrlenW

  GetLastError

  GetProcAddress

  DisableThreadLibraryCalls

  LoadLibraryA

  CloseHandle

  CreateThread

  GetThreadContext

  HeapReAlloc

  SetThreadContext

  HeapAlloc

  HeapFree

  GetModuleHandleW

  Thread32First

  HeapDestroy

  HeapCreate

  Thread32Next

  FlushInstructionCache

  OpenThread

  VirtualProtect

  CreateToolhelp32Snapshot

  GetCurrentThreadId

  GetCurrentProcessId

  SuspendThread

  ResumeThread

  VirtualQuery

  VirtualFree

  VirtualAlloc

  GetSystemInfo

  FlsSetValue

  GetCommandLineA

  RtlUnwindEx

  EncodePointer

  FlsGetValue

  FlsFree

  SetLastError

  FlsAlloc

  ExitProcess

  DecodePointer

  SetHandleCount

  GetStdHandle

  InitializeCriticalSectionAndSpinCount

  GetFileType

  GetStartupInfoW

  DeleteCriticalSection

  GetModuleFileNameA

  FreeEnvironmentStringsW

  WideCharToMultiByte

  GetEnvironmentStringsW

  HeapSetInformation

  GetVersion

  QueryPerformanceCounter

  GetTickCount

  GetSystemTimeAsFileTime

  TerminateProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  LeaveCriticalSection

  EnterCriticalSection

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  LoadLibraryW

  WriteFile

  GetModuleFileNameW

  LCMapStringW

  MultiByteToWideChar

  GetStringTypeW

  HeapSize

  Sections

  .text

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 436B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 474B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ