General

Malware Config

Signatures

Files

• 502f0acf8edf3c880a94fe5670458f022b6f87f26c47f9a0c6b7f35b984210b3

  .zip

  Password: infected

• 0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe

  .exe windows:5 windows x86 arch:x86

  4233d97404e1fecedef6a46e0f7c09b9

  
  

  Code Sign

  0c:48:73:28:73:ac:8c:ce:ba:f8:f0:e1:e8:32:9c:ec

  Certificate

  Issuer

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  13-04-2021 00:00

  Not After

  14-04-2022 23:59

  Subject

  SERIALNUMBER=HE 419469,CN=Hermetica Digital Ltd,O=Hermetica Digital Ltd,L=Nicosia,C=CY,1.3.6.1.4.1.311.60.2.1.3=#13024359,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  18-04-2012 12:00

  Not After

  18-04-2027 12:00

  Subject

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  e0:71:1b:51:ca:fc:5e:0b:87:8a:c5:8b:d8:2f:a5:34:56:08:04:26

  Signer

  Actual PE Digest

  e0:71:1b:51:ca:fc:5e:0b:87:8a:c5:8b:d8:2f:a5:34:56:08:04:26

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  shlwapi

  StrStrW

  StrRChrW

  StrChrW

  StrToIntW

  PathAddExtensionW

  PathFindExtensionW

  PathFileExistsW

  StrCatBuffW

  PathAddBackslashW

  PathAppendW

  StrStrIW

  StrCmpNW

  wnsprintfW

  StrStrA

  lz32

  LZClose

  LZCopy

  LZOpenFileW

  msvcrt

  towupper

  wcsncpy

  memcpy

  _except_handler3

  memset

  kernel32

  HeapAlloc

  GetProcessHeap

  DeviceIoControl

  GetLastError

  HeapReAlloc

  HeapFree

  lstrcmpA

  GetSystemTimeAsFileTime

  CreateFileW

  CloseHandle

  SetFilePointerEx

  ReadFile

  GetDiskFreeSpaceW

  lstrlenW

  WriteFile

  FlushFileBuffers

  CreateThread

  WaitForMultipleObjects

  GetModuleHandleW

  GetProcAddress

  GetCurrentProcess

  VerSetConditionMask

  VerifyVersionInfoW

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  GetSystemDirectoryW

  Sleep

  WaitForSingleObject

  SetThreadPriority

  FindFirstFileW

  FindNextFileW

  FindClose

  GetLogicalDriveStringsW

  SetLastError

  GetCommandLineW

  GetModuleFileNameW

  CreateEventW

  SetEvent

  ExitProcess

  GetCurrentProcessId

  GetFileInformationByHandle

  DeleteFileW

  user32

  wsprintfW

  CharLowerW

  advapi32

  InitiateSystemShutdownExW

  ControlService

  CloseServiceHandle

  DeleteService

  StartServiceW

  ChangeServiceConfigW

  QueryServiceStatus

  CreateServiceW

  OpenServiceW

  OpenSCManagerW

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  OpenProcessToken

  RegDeleteKeyW

  CryptReleaseContext

  CryptGenRandom

  CryptAcquireContextW

  RegQueryInfoKeyW

  RegEnumKeyExW

  RegOpenKeyW

  RegCloseKey

  RegSetValueExW

  shell32

  CommandLineToArgvW

  Sections

  .text

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 900B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 87KB - Virtual size: 86KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 912B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ