certreq[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

certreq.exe
Size

492KB
MD5

3eccb3e97c435181e85928a17fd06ff9
SHA1

c5e67fc533524e44230ebed82eb73cf3974020e6
SHA256

02c0dc20d55afde8293cd048a2bdb82528b0322fdd954ca975d896a4cae51c4f
SHA512

fd28131efba5b2066e21aae0daa54cacbcaca14baf51c06fd9fcaa120ca2f282c5c2372db78979684bdcb8e6eefa49601521627dfab24d0b8eb4b733ea389212
SSDEEP

12288:YtjUewAu+sImH77h1rmsMopuLu2TDwga9IytZAIYqajuROz:YtjURAu+sImH77h1rmsMopuLu2TUVIy1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
certreq.exe

Files

certreq.exe
.exe windows:10 windows x64 arch:x64

6a0f86aa44f988073c05e0ee40f2bd02

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

certreq.pdb

Imports

advapi32

CryptGenKey
CryptAcquireContextW
RevertToSelf
CryptDestroyKey
WaitServiceState
CryptReleaseContext

kernel32

EncodePointer
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetFileAttributesW
lstrcmpW
GetTickCount
GetSystemTimeAsFileTime
GetTempFileNameW
LocalFree
DecodePointer
RaiseException
DeleteFileW
LocalAlloc

msvcrt

memcmp
__iob_func
__C_specific_handler
wcscspn
_XcptFilter
memset
__wgetmainargs
__set_app_type
exit
strcmp
?terminate@@YAXXZ
wcsrchr
_wcsnicmp
_amsg_exit
_swab
_onexit
__dllonexit
_unlock
_lock
??3@YAXPEAX@Z
??1type_info@@UEAA@XZ
_callnewh
?what@exception@@UEBAPEBDXZ
wcsstr
wcschr
iswdigit
_vsnprintf
fputws
fclose
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
memmove
memcpy
_CxxThrowException
_itoa_s
wcscpy_s
_stricmp
towupper
iswlower
iswupper
sscanf_s
wcscmp
strpbrk
strcat_s
strcpy_s
strspn
_fileno
_setmode
getenv
_commode
fwrite
ftell
_wgetenv
_errno
fopen
strcspn
_wfopen_s
wcsncmp
_fmode
_wcmdln
strncmp
atoi
strchr
_initterm
__setusermatherr
isdigit
qsort
towlower
free
malloc
_cexit
_purecall
_exit
_wcsicmp
vfwprintf
fprintf
fflush
ferror
_vsnwprintf
__CxxFrameHandler3
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
iswspace
iswxdigit
_wtoi
gmtime
_wsetlocale
iswalpha
_wfopen
fgetc
feof
fseek
fgetws
fgets

certcli

ord261
ord207
ord360
ord254
ord358
ord219
ord213
ord357
ord223
ord373
ord225
ord205
ord359
ord220
ord203
ord221
CAGetCertTypeProperty
CAFreeCertTypeProperty
CACloseCertType
CAFindCertTypeByName
ord356
ord246
ord252
ord366
ord260
ord256

gdi32

GetStockObject

ncrypt

NCryptOpenKey
NCryptFreeObject
NCryptIsKeyHandle
NCryptSetProperty
NCryptFreeBuffer
NCryptEnumStorageProviders
NCryptOpenStorageProvider
NCryptGetProperty

normaliz

IdnToUnicode

ntdll

RtlTimeToSecondsSince1970
NtQuerySystemTime
EtwTraceMessage
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

setupapi

SetupOpenInfFileW
SetupGetLineCountW
SetupFindFirstLineW
SetupGetIntField
SetupCloseInfFile
SetupGetFieldCount
SetupFindNextLine
SetupGetStringFieldW

profapi

ord104

wldap32

ord12
ord18
ord167
ord147
ord13
ord142
ord41
ord140
ord79
ord26
ord203
ord224
ord127
ord16
ord210

crypt32

CryptDecodeObject
CryptMsgClose
CryptMsgUpdate
CertGetCertificateChain
CertFreeCRLContext
CertEnumCRLsInStore
CertFindAttribute
CryptFindOIDInfo
CryptMsgGetAndVerifySigner
CryptAcquireCertificatePrivateKey
CryptMsgOpenToDecode
CryptMsgControl
CryptFindCertificateKeyProvInfo
CryptSignAndEncodeCertificate
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertCloseStore
CryptHashPublicKeyInfo
CertFreeCertificateContext
CryptMsgGetParam
CertFreeCertificateChain
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertVerifySubjectCertificateContext
CertFindExtension
CryptEncodeObjectEx
CryptDecodeObjectEx
CryptStringToBinaryW
CertGetNameStringW
CryptExportPublicKeyInfoEx
CryptSignCertificate
CertNameToStrW
CryptHashCertificate
CertSetStoreProperty
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertAddCertificateLinkToStore
CryptEnumOIDInfo
CryptFormatObject
CryptSignMessage
CertStrToNameW
CryptMsgOpenToEncode
CertCreateCertificateContext

ole32

CoUninitialize
CoCreateInstance
StringFromCLSID
CoInitialize
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree

oleaut32

SysAllocStringLen
VariantCopyInd
CreateErrorInfo
SetErrorInfo
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantInit
SysFreeString
SysStringByteLen
SysAllocString
SysAllocStringByteLen
SafeArrayGetElement
VariantClear
SysStringLen

rpcrt4

NdrClientCall3
RpcExceptionFilter
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingFree
RpcEpResolveBinding
RpcBindingSetAuthInfoExW
UuidCreate

secur32

GetComputerObjectNameW
GetUserNameExW

user32

DispatchMessageW
PostMessageW
TranslateMessage
GetMessageW
UpdateWindow
CreateWindowExW
RegisterClassW
LoadIconW
DefWindowProcW
PostQuitMessage
LoadCursorW
SetCursor
LoadStringW
GetDesktopWindow
MessageBoxW
CharLowerW

wininet

InternetCrackUrlW
InternetCreateUrlW
InternetCanonicalizeUrlW

shlwapi

PathFindFileNameW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
OpenThreadToken
GetStartupInfoW
GetCurrentThread
GetCurrentThreadId
OpenProcessToken

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FindResourceExW
FreeLibrary
GetModuleHandleW
GetProcAddress
LockResource
LoadResource

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalReAlloc

api-ms-win-core-file-l1-1-0

GetFileSize
WriteFile
CreateFileW
LocalFileTimeToFileTime
GetFullPathNameW
SetEndOfFile
CompareFileTime
GetFileType
SetFilePointer
FileTimeToLocalFileTime

api-ms-win-core-heap-l1-1-0

HeapSetInformation
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW
FoldStringW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTime
GetComputerNameExW
GetLocalTime
GetSystemDirectoryW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-security-cryptoapi-l1-1-0

CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptSetProvParam
CryptEnumProvidersA
CryptGetProvParam

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
WriteConsoleW

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
ExpandEnvironmentStringsW
SearchPathW
GetCommandLineW
GetEnvironmentVariableW

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
GetACP
FormatMessageW
GetLocaleInfoEx

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey

api-ms-win-security-base-l1-1-0

CheckTokenMembership
FreeSid
ImpersonateLoggedOnUser
AllocateAndInitializeSid
CreateWellKnownSid
EqualSid
GetTokenInformation
DuplicateToken

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

K32GetProcessImageFileNameW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-security-logon-l1-1-0

LogonUserExW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatA
GetDateFormatA
GetDateFormatW
GetTimeFormatW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
SetEvent
InitializeCriticalSection
WaitForSingleObjectEx
LeaveCriticalSection
DeleteCriticalSection
CreateEventW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-privateprofile-l1-1-0

GetProfileStringA

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
GetSystemDefaultUILanguage

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
StartServiceW
OpenServiceW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
ChangeServiceConfigW

api-ms-win-service-winsvc-l1-1-0

ControlService

Sections

.text
Size: 336KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a0f86aa44f988073c05e0ee40f2bd02

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

certcli

gdi32

ncrypt

normaliz

ntdll

setupapi

profapi

wldap32

crypt32

ole32

oleaut32

rpcrt4

secur32

user32

wininet

shlwapi

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-logon-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-localization-l1-2-2

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-winsvc-l1-1-0

Sections

.text Size: 336KB - Virtual size: 333KB

.rdata Size: 112KB - Virtual size: 109KB

.data Size: 16KB - Virtual size: 20KB

.pdata Size: 12KB - Virtual size: 8KB

.didat Size: 4KB - Virtual size: 352B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 336KB - Virtual size: 333KB

.rdata
Size: 112KB - Virtual size: 109KB

.data
Size: 16KB - Virtual size: 20KB

.pdata
Size: 12KB - Virtual size: 8KB

.didat
Size: 4KB - Virtual size: 352B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 3KB