General

Malware Config

Signatures

Files

• d620b2d4891c3396a68c371391bf3a24ec7819f1f0484b9123f1fe0eb45b4998

  .zip

  Password: infected

• 4fccd38f504290cf5c70e7336071a90a064303c7fdf5c17f7c38001768bce115.exe

  .exe windows:5 windows x86 arch:x86

  53654c59ffb323a249342d35a6b65745

  
  

  Code Sign

  e5:73:d9:c8:b4:03:c4:1b:d5:9f:fa:0a:8e:fd:41:68

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  15-07-2019 00:00

  Not After

  27-06-2020 23:59

  Subject

  CN=\"VERONIKA 2\" OOO,O=\"VERONIKA 2\" OOO,POSTALCODE=125130,STREET=Ulitsa Priorova Stroenie 2 Dom 24 Pomeschenie 18a,L=Moscow,C=RU

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  01-02-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  1b:02:70:d6:94:66:e4:a0:9d:ab:7b:73:47:0c:11:63:9c:9d:68:c2

  Signer

  Actual PE Digest

  1b:02:70:d6:94:66:e4:a0:9d:ab:7b:73:47:0c:11:63:9c:9d:68:c2

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  UmHeTMEQeq.pdb

  Imports

  msvcrt

  iswupper

  kernel32

  Module32Next

  WritePrivateProfileStringA

  LeaveCriticalSection

  OpenFileMappingA

  GetCurrentProcess

  GetCommandLineA

  LoadLibraryA

  CloseHandle

  GetProcessVersion

  rpcrt4

  RpcBindingFree

  urlmon

  CreateURLMoniker

  psapi

  GetModuleFileNameExW

  crypt32

  CertDeleteCertificateFromStore

  setupapi

  SetupDiSelectBestCompatDrv

  powrprof

  CanUserWritePwrScheme

  shlwapi

  ord29

  winspool.drv

  GetPrinterDriverW

  user32

  IsWindowVisible

  IsZoomed

  GetShellWindow

  AdjustWindowRect

  GrayStringA

  GetDoubleClickTime

  GetCaretPos

  SetCapture

  oleaut32

  VarDecFromR8

  Sections

  .text

  Size: 16KB - Virtual size: 12KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  xUwGZ

  Size: 4KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  xUwGZ

  Size: 4KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  SM

  Size: 132KB - Virtual size: 128KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 68KB - Virtual size: 67KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  CODE

  Size: 4KB - Virtual size: 276B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ