General

Malware Config

Signatures

Files

• Sig.exe

  .exe windows:5 windows x86 arch:x86

  9e06a884a787798c5a0284c5a9621007

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  61:1c:b2:8a:00:00:00:00:00:26

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-04-2011 19:41

  Not After

  15-04-2021 19:51

  Subject

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  05:30:8b:76:ac:2e:15:b2:97:20:fb:43:95:f6:5f:38

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  19-03-2019 00:00

  Not After

  23-03-2022 12:00

  Subject

  CN=Oracle Corporation,OU=Virtualbox,O=Oracle Corporation,L=Redwood Shores,ST=CA,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  06:4b:33:30:a9:7d:03:a0:b4:51:59:1d:a8:68:7f:72

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  18-03-2019 00:00

  Not After

  18-03-2021 23:59

  Subject

  CN=Oracle Corporation,OU=VirtualBox,O=Oracle Corporation,L=Redwood City,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  61:19:93:e4:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  22-02-2011 19:25

  Not After

  22-02-2021 19:35

  Subject

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  49:52:d6:7a:bf:c0:26:b1:ec:04:e6:4e:e0:fa:da:86:f5:9b:9e:cc:75:b1:1c:cb:32:db:c5:4e:69:d1:fc:53

  Signer

  Actual PE Digest

  49:52:d6:7a:bf:c0:26:b1:ec:04:e6:4e:e0:fa:da:86:f5:9b:9e:cc:75:b1:1c:cb:32:db:c5:4e:69:d1:fc:53

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  9e:9d:97:bb:3d:02:2e:07:1b:4f:c6:41:ff:fd:29:05:11:79:86:81

  Signer

  Actual PE Digest

  9e:9d:97:bb:3d:02:2e:07:1b:4f:c6:41:ff:fd:29:05:11:79:86:81

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\vmagent_new\bin\joblist\772492\out\Release\360TsLiveUpd.pdb

  Imports

  ws2_32

  gethostbyname

  inet_ntoa

  kernel32

  CreateToolhelp32Snapshot

  LocalFree

  LocalAlloc

  GetExitCodeThread

  GetSystemInfo

  GetModuleHandleA

  GetModuleHandleExW

  WideCharToMultiByte

  ResetEvent

  SetLastError

  GetCurrentThreadId

  InterlockedCompareExchange

  QueryDosDeviceW

  GetLogicalDriveStringsW

  ExpandEnvironmentStringsW

  GetExitCodeProcess

  TerminateProcess

  OpenProcess

  InterlockedDecrement

  GetShortPathNameW

  GetVersion

  GetPrivateProfileIntW

  WritePrivateProfileStringW

  HeapFree

  HeapAlloc

  GetProcessHeap

  GetTickCount

  lstrcmpiW

  GetComputerNameW

  GetBinaryTypeW

  WaitForMultipleObjects

  CreateEventW

  GetModuleFileNameW

  SetFileTime

  SystemTimeToFileTime

  GetSystemTime

  GetPrivateProfileStringW

  GetWindowsDirectoryW

  CreateProcessW

  GetFileAttributesExW

  GetSystemDefaultUILanguage

  GetUserDefaultUILanguage

  GetOverlappedResult

  CreateThread

  ExpandEnvironmentStringsA

  FileTimeToSystemTime

  CompareFileTime

  GetSystemTimeAsFileTime

  CreateRemoteThread

  CopyFileW

  lstrcmpiA

  lstrlenA

  Module32NextW

  Module32FirstW

  MoveFileW

  CreateDirectoryW

  GetLocalTime

  FreeConsole

  ReleaseSemaphore

  GetTempPathW

  GlobalFree

  GetTimeZoneInformation

  OpenMutexW

  GetCommandLineW

  Process32FirstW

  CreateSemaphoreW

  WritePrivateProfileSectionW

  GetProcessTimes

  CreateMutexA

  FlushInstructionCache

  InterlockedIncrement

  GetCurrentProcessId

  WTSGetActiveConsoleSessionId

  GetSystemWindowsDirectoryW

  GetDiskFreeSpaceExW

  UnmapViewOfFile

  lstrcmpA

  SetEnvironmentVariableA

  CompareStringW

  CompareStringA

  SetStdHandle

  WriteConsoleW

  GetConsoleOutputCP

  WriteConsoleA

  InitializeCriticalSectionAndSpinCount

  GetLocaleInfoW

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  IsValidLocale

  EnumSystemLocalesA

  CreateMutexW

  GetUserDefaultLCID

  GetDateFormatA

  GetTimeFormatA

  GetConsoleMode

  GetConsoleCP

  GetStartupInfoA

  GetFileType

  SetHandleCount

  SetConsoleCtrlHandler

  GetStringTypeA

  ExitProcess

  FatalAppExitA

  HeapCreate

  GetModuleFileNameA

  GetStdHandle

  GetCurrentThread

  IsValidCodePage

  GetOEMCP

  GetACP

  GetStringTypeW

  LCMapStringW

  LCMapStringA

  GetStartupInfoW

  ExitThread

  RtlUnwind

  GetCPInfo

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  TlsFree

  TlsAlloc

  HeapWalk

  HeapLock

  OpenThread

  HeapUnlock

  TlsSetValue

  OutputDebugStringW

  GetFullPathNameW

  Process32NextW

  GetFileSize

  CreateFileMappingW

  MapViewOfFileEx

  SetEndOfFile

  FlushFileBuffers

  SetFilePointer

  WriteFile

  ReadFile

  FreeResource

  InterlockedExchange

  LoadLibraryExW

  LoadLibraryW

  GetCurrentProcess

  GetSystemPowerStatus

  GlobalMemoryStatusEx

  HeapDestroy

  GlobalMemoryStatus

  Sleep

  ProcessIdToSessionId

  LoadLibraryA

  FreeLibrary

  GetSystemDirectoryW

  GetDriveTypeW

  CreateFileW

  DeviceIoControl

  DeleteFileW

  GetFileAttributesW

  RemoveDirectoryW

  SetFileAttributesW

  MoveFileExW

  TerminateThread

  ReadDirectoryChangesW

  MultiByteToWideChar

  FindFirstFileW

  FindNextFileW

  FindClose

  ResumeThread

  SetEvent

  WaitForSingleObject

  lstrlenW

  CloseHandle

  UnlockFile

  LockFile

  GetLastError

  FindResourceExW

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  DeleteCriticalSection

  InitializeCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  RaiseException

  GetVersionExW

  GetModuleHandleW

  GetProcAddress

  GetLocaleInfoA

  HeapReAlloc

  HeapSize

  ReleaseMutex

  FileTimeToLocalFileTime

  IsProcessorFeaturePresent

  VirtualFree

  VirtualAlloc

  CreateFileA

  LocalFileTimeToFileTime

  SetFilePointerEx

  GetFileSizeEx

  TlsGetValue

  user32

  MonitorFromWindow

  MonitorFromPoint

  SetFocus

  SetActiveWindow

  SetForegroundWindow

  AttachThreadInput

  GetForegroundWindow

  GetSystemMetrics

  ExitWindowsEx

  IsWindowVisible

  GetWindowThreadProcessId

  EnumWindows

  UnregisterClassA

  AllowSetForegroundWindow

  keybd_event

  GetKeyboardState

  MonitorFromRect

  GetWindowRect

  SetWindowPos

  GetWindowLongW

  UpdateWindow

  InvalidateRect

  SetWindowRgn

  WaitForInputIdle

  LoadStringW

  PostMessageW

  IsWindow

  FindWindowW

  SendMessageW

  SendMessageTimeoutW

  RegisterWindowMessageW

  EnumDisplaySettingsW

  DefWindowProcW

  GetClassInfoW

  RegisterClassW

  CreateDialogParamW

  CharNextW

  PeekMessageW

  GetMessageW

  TranslateMessage

  DispatchMessageW

  IsDialogMessageW

  SetWindowLongW

  PostQuitMessage

  LoadImageW

  GetParent

  GetWindow

  LoadIconW

  GetClientRect

  MapWindowPoints

  KillTimer

  SetTimer

  DestroyWindow

  GetDesktopWindow

  WindowFromPoint

  GetActiveWindow

  MessageBoxW

  GetMonitorInfoW

  gdi32

  CreatePolygonRgn

  advapi32

  LookupPrivilegeValueW

  RegEnumKeyExA

  RegQueryInfoKeyW

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  CreateServiceW

  OpenServiceW

  OpenSCManagerW

  DeleteService

  CloseServiceHandle

  ChangeServiceConfigW

  ControlService

  StartServiceW

  QueryServiceStatusEx

  QueryServiceStatus

  GetNamedSecurityInfoW

  SetEntriesInAclW

  SetNamedSecurityInfoW

  RegCreateKeyA

  RegEnumValueW

  RegNotifyChangeKeyValue

  ConvertSidToStringSidW

  LookupAccountSidW

  RegUnLoadKeyW

  RegLoadKeyW

  RegDeleteKeyW

  ConvertStringSidToSidW

  GetLengthSid

  SetTokenInformation

  CreateProcessAsUserW

  RegDeleteValueW

  AllocateAndInitializeSid

  EqualSid

  CryptImportKey

  RegCreateKeyW

  GetSidSubAuthority

  DuplicateTokenEx

  GetTokenInformation

  RegOpenKeyW

  OpenEventLogW

  ReadEventLogW

  CloseEventLog

  OpenProcessToken

  AdjustTokenPrivileges

  FreeSid

  CryptAcquireContextW

  CryptGetKeyParam

  CryptDecrypt

  CryptEncrypt

  CryptDestroyHash

  CryptDestroyKey

  CryptReleaseContext

  RegSetValueExW

  RegCreateKeyExW

  RegEnumKeyExW

  RegOpenKeyExW

  RegQueryValueExW

  RegCloseKey

  RegQueryValueExA

  RegOpenKeyExA

  shell32

  ord680

  ord165

  ShellExecuteW

  CommandLineToArgvW

  SHParseDisplayName

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetSpecialFolderPathW

  ShellExecuteExW

  SHBindToParent

  SHGetDataFromIDListW

  ExtractIconExW

  SHGetFileInfoW

  SHGetFolderPathW

  Shell_NotifyIconW

  ole32

  CoTaskMemRealloc

  CoTaskMemAlloc

  CoSetProxyBlanket

  CoInitializeSecurity

  CoInitializeEx

  CoTaskMemFree

  CoInitialize

  CoUninitialize

  CLSIDFromProgID

  CoCreateInstance

  oleaut32

  VariantInit

  GetErrorInfo

  VariantChangeType

  SetErrorInfo

  CreateErrorInfo

  SysFreeString

  VarUI4FromStr

  VariantClear

  SysAllocString

  shlwapi

  StrCmpNIW

  PathRemoveFileSpecW

  PathFindFileNameW

  PathIsDirectoryW

  PathRemoveExtensionW

  AssocQueryStringW

  PathUnquoteSpacesW

  StrChrW

  StrCmpNW

  PathAddBackslashW

  StrStrIA

  SHSetValueA

  SHDeleteValueA

  StrCmpW

  PathStripPathW

  PathStripToRootW

  ord437

  StrCpyW

  StrCatW

  SHGetValueA

  PathFindExtensionW

  StrCmpIW

  PathAppendW

  PathFileExistsW

  SHDeleteValueW

  StrToIntExW

  SHSetValueW

  SHGetValueW

  wnsprintfW

  StrStrIW

  PathCombineW

  SHDeleteKeyW

  comctl32

  InitCommonControlsEx

  psapi

  EnumProcesses

  EnumProcessModules

  GetModuleFileNameExW

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  wininet

  HttpQueryInfoW

  InternetReadFile

  InternetGetConnectedState

  InternetCloseHandle

  InternetOpenUrlW

  InternetQueryOptionW

  DeleteUrlCacheEntryW

  InternetOpenW

  InternetSetOptionW

  powrprof

  GetPwrCapabilities

  wintrust

  WTHelperProvDataFromStateData

  WinVerifyTrust

  wtsapi32

  WTSFreeMemory

  WTSQuerySessionInformationW

  userenv

  GetUserProfileDirectoryW

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  crypt32

  CryptProtectData

  CryptUnprotectData

  CertGetNameStringW

  Sections

  .text

  Size: 1.3MB - Virtual size: 1.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 170KB - Virtual size: 172KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 82KB - Virtual size: 104KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 770KB - Virtual size: 770KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ