2024-04-27_b74d265a15fee18bd0ac8b94fa1213c3_avaddon

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-27_b74d265a15fee18bd0ac8b94fa1213c3_avaddon
Size

32.0MB
MD5

b74d265a15fee18bd0ac8b94fa1213c3
SHA1

47af924ecb373debc41d9b72ad364ec9e199952c
SHA256

b52a13b4e8fca07f2a7922d359385ddd14c6dc7aad50bbe97c45b0cacef61379
SHA512

abf8824a3afbc83b1e31f85067efa796a2013d0637b78332110fda3857faec198ceb492b7ad604a522598fb7e3e4a8cbf0986b4b6217251b9bb05c044dea522b
SSDEEP

393216:ixF0Ue+CHkX5JsoaqQ/X5zH4o6nsPsedt8d6TqCJhErIH:iqKJsoaxfKoSLUOrC3ErA

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Files

2024-04-27_b74d265a15fee18bd0ac8b94fa1213c3_avaddon
.exe windows:6 windows x64 arch:x64

98f6567eb1664638c252343031228514

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:07:d4:0b:50:82:fe:aa:6e:0a:5e:92
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

13/07/2021, 08:55

Not After

10/10/2024, 08:23

Subject

SERIALNUMBER=1125476195459,CN=Atom Security LLC,O=Atom Security LLC,STREET=Prospect Akademika Koptyuga\, 4 office 158,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:92:94:ba:8d:43:4b:25:4e:c2:f4:f1:e0:4d:2d:55:99:1f:76:94:c2:6c:f6:13:9e:be:de:35:5e:58:a6:d0
Signer

Actual PE Digest

43:92:94:ba:8d:43:4b:25:4e:c2:f4:f1:e0:4d:2d:55:99:1f:76:94:c2:6c:f6:13:9e:be:de:35:5e:58:a6:d0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\BuildAgent\work\.build\agent_x64\relwithdebinfo64\vmnetdrv64.pdb

Imports

advapi32

GetLengthSid
OpenServiceW
StartServiceCtrlDispatcherW
RegOpenKeyExW
InitializeAcl
InitializeSecurityDescriptor
AddAce
RegSetValueExW
IsValidSid
GetSecurityDescriptorOwner
InitializeSid
CopySid
GetSecurityDescriptorControl
RegCreateKeyExW
GetSidLengthRequired
GetSidSubAuthority
GetSecurityDescriptorGroup
OpenSCManagerW
CloseServiceHandle
GetAclInformation
RegCloseKey
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
CryptGenRandom
CryptAcquireContextW
GetTokenInformation
MakeSelfRelativeSD
LookupAccountSidW
OpenThreadToken
GetSecurityDescriptorLength
RegQueryValueExW
CreateProcessAsUserW
OpenProcessToken
ConvertStringSidToSidW
SetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetAce
RegDeleteValueW
RegEnumKeyExW
DuplicateToken
SetThreadToken
ConvertSidToStringSidW
CreateWellKnownSid
RegNotifyChangeKeyValue
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
RegDisablePredefinedCache
IsValidSecurityDescriptor
GetSidIdentifierAuthority
CryptAcquireContextA
RegEnumKeyW
RegGetValueW
RegOpenKeyW
GetSidSubAuthorityCount
SystemFunction036
CryptEnumProvidersW
DuplicateTokenEx
MakeAbsoluteSD
RegEnumValueW
ChangeServiceConfigW
QueryServiceConfigW
StartServiceW
EnumDependentServicesW
ControlService
DeleteService
ChangeServiceConfig2W
SetServiceStatus
QueryServiceStatus
CreateServiceW
RegisterServiceCtrlHandlerExW
RegDeleteKeyW
IsTextUnicode
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptSignHashW

gdi32

GetObjectW
GetEnhMetaFileBits
DeleteEnhMetaFile
CopyEnhMetaFileW
SetStretchBltMode
GetDIBits
StretchBlt
DeleteDC
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
CreateFontW
CreateSolidBrush
SetBkColor
SetTextColor
GetDeviceCaps
SetDIBColorTable
CreateDIBSection
DeleteObject

kernel32

ResetEvent
QueueUserAPC
GetLocalTime
SwitchToThread
GetThreadId
GetFileSize
GlobalMemoryStatusEx
FreeLibrary
CopyFileW
SleepEx
SystemTimeToTzSpecificLocalTime
CreateFileMappingW
CreateIoCompletionPort
MapViewOfFileEx
OpenThread
LoadLibraryExW
IsDebuggerPresent
ConnectNamedPipe
FlushFileBuffers
GetExitCodeProcess
FindFirstFileW
FindNextFileW
FindClose
QueryDosDeviceW
GetVolumeInformationW
GetLogicalDrives
FindFirstVolumeW
lstrlenW
DeviceIoControl
FindVolumeClose
FindNextVolumeW
GetDriveTypeW
CreateDirectoryW
GetTempPathW
GetDiskFreeSpaceW
MoveFileExW
OpenEventW
VerSetConditionMask
VerifyVersionInfoW
OpenProcess
WaitForMultipleObjectsEx
SetWaitableTimer
CreateWaitableTimerW
CancelWaitableTimer
GetProcessTimes
GlobalSize
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetFileSizeEx
GetProcessId
Thread32Next
Thread32First
DuplicateHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetSystemDirectoryW
GetComputerNameW
SystemTimeToFileTime
TlsAlloc
TlsFree
FormatMessageA
TlsSetValue
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
TlsGetValue
RegisterWaitForSingleObject
UnregisterWaitEx
GetFileAttributesExW
GetVolumePathNamesForVolumeNameW
GetFullPathNameW
GetLocaleInfoW
GetUserDefaultLCID
MulDiv
GetVersionExW
GetSystemTime
RemoveDirectoryW
CreateTimerQueue
RtlUnwind
RemoveDirectoryA
ReplaceFileA
GetFileAttributesExA
MoveFileA
CompareStringA
TerminateProcess
GetCurrentProcess
SetLastError
GetStartupInfoW
UnhandledExceptionFilter
LCMapStringW
CompareStringW
GetCPInfo
GetStringTypeW
QueueUserWorkItem
RtlPcToFileHeader
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
LoadLibraryExA
VirtualQuery
VirtualProtect
PeekNamedPipe
GetEnvironmentVariableA
CompareFileTime
MoveFileExA
GetSystemDirectoryA
GetTempFileNameA
lstrlenA
CreateDirectoryA
FindFirstFileExA
lstrcmpW
ReleaseSemaphore
SetThreadAffinityMask
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LockFileEx
CreateFileMappingA
UnlockFile
HeapCompact
GetVersionExA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnlockFileEx
GetFullPathNameA
GetSystemInfo
AreFileApisANSI
K32GetProcessImageFileNameW
GetConsoleOutputCP
InitializeCriticalSection
OutputDebugStringA
GetTimeZoneInformationForYear
GetDriveTypeA
WriteConsoleW
CreateThread
ExitProcess
GetFileInformationByHandleEx
CreateMutexA
AcquireSRWLockShared
QueryPerformanceFrequency
WakeConditionVariable
SleepConditionVariableSRW
GetOverlappedResult
SetHandleInformation
SetFilePointerEx
SetFileInformationByHandle
GetCommandLineW
GetEnvironmentStringsW
RtlLookupFunctionEntry
RtlCaptureContext
SetThreadStackGuarantee
ReleaseSRWLockShared
FreeEnvironmentStringsW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryW
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
GetFileType
GetEnvironmentVariableW
GetStdHandle
RtlVirtualUnwind
CreateFiber
DeleteFiber
SwitchToFiber
GetComputerNameA
FindNextFileA
FindFirstFileA
GetCurrentDirectoryW
DeleteFileA
FindFirstFileExW
WTSGetActiveConsoleSessionId
GetComputerNameExW
GetTempFileNameW
GetFileAttributesW
GetFileInformationByHandle
MapViewOfFile
SetUnhandledExceptionFilter
QueryPerformanceCounter
K32GetModuleInformation
K32GetModuleBaseNameW
K32GetModuleFileNameExA
RtlCaptureStackBackTrace
GetModuleHandleExW
GetACP
GetSystemDefaultLCID
GetOEMCP
GetDateFormatW
CreateSemaphoreW
GetTimeFormatW
FileTimeToLocalFileTime
K32EnumProcesses
K32GetModuleFileNameExW
HeapCreate
TryEnterCriticalSection
ReadFile
GetTickCount
GetSystemTimeAsFileTime
WideCharToMultiByte
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
LocalFree
GetProcAddress
SignalObjectAndWait
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
CloseHandle
HeapReAlloc
DeleteFileW
LockResource
TerminateThread
GetLastError
FormatMessageW
Sleep
ProcessIdToSessionId
GetExitCodeThread
MultiByteToWideChar
PostQueuedCompletionStatus
HeapSize
GetCurrentThreadId
LocalAlloc
WaitForSingleObject
InitializeCriticalSectionEx
SetFilePointer
SetErrorMode
LeaveCriticalSection
SetEnvironmentVariableW
ExpandEnvironmentStringsW
WriteFile
EnterCriticalSection
HeapFree
SizeofResource
HeapSetInformation
GetThreadPriority
WaitForSingleObjectEx
GetCurrentThread
FileTimeToSystemTime
SetEvent
GetTimeZoneInformation
CreateEventW
DisconnectNamedPipe
UnmapViewOfFile
ResumeThread
ReleaseMutex
CreateFileW
CreateMutexW
EnumResourceNamesW
SetEndOfFile
GetQueuedCompletionStatus
SetThreadPriority
WaitForMultipleObjects
CreateNamedPipeW
LockFile
GetModuleFileNameW
WaitNamedPipeW
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
InterlockedFlushSList
QueryDepthSList
RtlUnwindEx
ExitThread
SetConsoleCtrlHandler
GetCommandLineA
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
SetStdHandle

ole32

CoInitializeEx
CLSIDFromString
WriteClassStg
StringFromGUID2
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoFreeUnusedLibraries
CoSetProxyBlanket
CoInitializeSecurity
StgCreateDocfile
CoInitialize
CoTaskMemAlloc
CreatePointerMoniker
PropVariantClear
CreateBindCtx

oleaut32

VariantChangeType
SysFreeString
VariantClear
VariantInit
SysAllocString

user32

DispatchMessageW
DestroyIcon
DestroyMenu
TranslateMessage
LoadIconW
AppendMenuW
GetClassInfoExW
SetForegroundWindow
GetCursorPos
GetWindowLongW
GetWindow
GetWindowRect
DestroyWindow
SetWindowPos
MonitorFromWindow
CreatePopupMenu
LoadStringW
PostMessageW
DefWindowProcW
GetMessageW
GetWindowTextW
SystemParametersInfoW
GetForegroundWindow
IsWindowVisible
GetWindowTextLengthW
SetWindowsHookExW
UnhookWindowsHookEx
PostThreadMessageA
SetWindowLongPtrW
SetWindowTextW
GetMonitorInfoW
CallNextHookEx
GetLastInputInfo
TrackPopupMenu
RegisterClassExW
CreateWindowExW
EnumChildWindows
SetDlgItemTextW
MapWindowPoints
GetClientRect
PostQuitMessage
KillTimer
SetClipboardData
GetClipboardSequenceNumber
LoadCursorW
GetClipboardData
EmptyClipboard
GetParent
RegisterDeviceNotificationW
CloseClipboard
SetTimer
OpenClipboard
GetPriorityClipboardFormat
UnregisterDeviceNotification
GetWindowLongPtrW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
UnregisterClassW
CopyImage
GetClipboardOwner
CallWindowProcW
GetWindowThreadProcessId
UnhookWinEvent
SetWinEventHook
PostThreadMessageW
GetSystemMetrics
CharLowerBuffW
GetKeyNameTextW
MapVirtualKeyExW
GetGUIThreadInfo
GetClassNameW
GetKeyboardLayout
PeekMessageW
CharUpperBuffW
IsWindow
WindowFromPoint
MsgWaitForMultipleObjects
GetFocus
GetKeyState
ActivateKeyboardLayout
ToUnicodeEx
GetKeyboardLayoutList
GetKeyboardLayoutNameW
IsIconic
SendMessageW
FindWindowExW
ReleaseDC
DrawIconEx
GetCursorInfo
GetIconInfo
GetDC
SendInput
mouse_event
LoadKeyboardLayoutW
keybd_event
MapVirtualKeyW
VkKeyScanExW
EnumWindows
GetClassLongPtrW
IsDialogMessageW
ShowWindow
RegisterClassW
SetThreadDesktop
CloseDesktop
OpenInputDesktop
DdeAccessData
DdeUnaccessData
DdeCreateStringHandleW
DdeConnect
DdeGetLastError
DdeInitializeW
DdeUninitialize
DdeClientTransaction
DdeFreeDataHandle
DdeDisconnect
DdeFreeStringHandle
RedrawWindow
GetDlgCtrlID
GetSysColor
SetWindowLongW
SetDlgItemInt
InvalidateRect
ExitWindowsEx
MessageBeep
FlashWindow
SetFocus
SetCapture
GetDesktopWindow
GetDlgItem
CreateDialogParamW

winspool.drv

OpenPrinterW
SetPrinterW
GetPrinterW
GetJobW
EnumPrintProcessorDatatypesW
FreePrinterNotifyInfo
SetJobW
FindClosePrinterChangeNotification
EnumJobsW
EnumPrintersW
FindNextPrinterChangeNotification
ClosePrinter
FindFirstPrinterChangeNotification

ws2_32

accept
bind
WSAIoctl
closesocket
WSASend
gethostbyname
select
ntohl
shutdown
listen
WSASetLastError
WSAStringToAddressW
WSASocketW
getpeername
ntohs
connect
WSAAddressToStringW
getservbyname
__WSAFDIsSet
WSARecv
gethostname
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
sendto
getnameinfo
freeaddrinfo
getaddrinfo
inet_addr
socket
recvfrom
recv
send
inet_ntoa
getsockopt
htons
setsockopt
WSAGetLastError
htonl
WSACleanup
WSAStartup
getsockname
ioctlsocket

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

dbghelp

ImageNtHeader
MiniDumpWriteDump

wldap32

ord26
ord35
ord41
ord50
ord45
ord22
ord27
ord33
ord60
ord211
ord46
ord79
ord30
ord200
ord301
ord32
ord143
ord217

nspr4

PR_GetError
PR_Cleanup
PR_Init
PR_ErrorToString

nss3

CERT_AsciiToName
CERT_GetCommonName
PK11_FreeSlot
PK11_ImportCert
CERT_DestroyCertificate
CERT_GetDefaultCertDB
PK11_FindCertFromDERCert
CERT_DecodeTrustString
NSS_NoDB_Init
PORT_ZAlloc
PK11_GetInternalKeySlot
CERT_DestroyName
NSS_Initialize
CERT_GetOrgName
CERT_ChangeCertTrust
PORT_Free
NSS_Shutdown

smime3

CERT_DecodeCertFromPackage

shlwapi

UrlEscapeA
PathFindFileNameW
PathFindExtensionW
StrCmpIW
PathAddExtensionW
PathIsDirectoryW
ord219
SHCreateStreamOnFileEx
PathMatchSpecW
PathStripPathW
PathCanonicalizeW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathStripPathA
StrToInt64ExA
PathCombineW
StrStrIW
StrToIntA
PathRemoveExtensionW
PathIsRootW
SHDeleteKeyW
PathStripToRootW
PathIsUNCW

userenv

UnloadUserProfile
CreateEnvironmentBlock
ExpandEnvironmentStringsForUserW
DestroyEnvironmentBlock

gdiplus

GdiplusShutdown
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdipGetImageHeight
GdipImageRotateFlip
GdipBitmapUnlockBits
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipGetImageWidth
GdiplusStartup
GdipGetImageEncoders

pdh

PdhOpenQueryW
PdhCloseQuery
PdhCollectQueryData
PdhRemoveCounter
PdhGetFormattedCounterValue
PdhGetRawCounterValue
PdhLookupPerfNameByIndexW
PdhAddCounterW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSEnumerateSessionsW
WTSLogoffSession
WTSQueryUserToken

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
CM_Get_DevNode_Status
CM_Enable_DevNode
SetupDiEnumDeviceInterfaces
CM_Get_Device_ID_ExW
CM_Get_Sibling
CM_Get_Device_ID_Size_Ex
CM_Get_Child
CM_Disable_DevNode
CMP_WaitNoPendingInstallEvents
CM_Get_Parent_Ex
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Registry_Property_ExW
CM_Get_Parent
SetupDiDestroyDeviceInfoList

fltlib

FilterGetMessage
FilterReplyMessage
FilterGetDosName
FilterVolumeFindNext
FilterSendMessage
FilterConnectCommunicationPort
FilterLoad
FilterVolumeFindClose
FilterVolumeFindFirst
FilterUnload

activeds

ord9

oleacc

AccessibleObjectFromWindow
AccessibleChildren

wintrust

WinVerifyTrust

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer

netapi32

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
NetApiBufferFree
NetWkstaGetInfo
DsGetDcNameW

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertAddEncodedCertificateToStore
CryptBinaryToStringA
CryptStringToBinaryA
CertFindExtension
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CryptDecodeObjectEx
CertAddCertificateContextToStore
PFXImportCertStore

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

Exports

Exports

AddInLog
GetMAPIModule

Sections

.text
Size: 20.0MB - Virtual size: 20.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10.2MB - Virtual size: 10.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 469KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98f6567eb1664638c252343031228514

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

47:07:d4:0b:50:82:fe:aa:6e:0a:5e:92Certificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

43:92:94:ba:8d:43:4b:25:4e:c2:f4:f1:e0:4d:2d:55:99:1f:76:94:c2:6c:f6:13:9e:be:de:35:5e:58:a6:d0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

gdi32

kernel32

ole32

oleaut32

user32

winspool.drv

ws2_32

rpcrt4

version

dbghelp

wldap32

nspr4

nss3

smime3

shlwapi

userenv

gdiplus

pdh

wtsapi32

setupapi

fltlib

activeds

oleacc

wintrust

secur32

netapi32

crypt32

bcrypt

Exports

Exports

Sections

.text Size: 20.0MB - Virtual size: 20.0MB

.rdata Size: 10.2MB - Virtual size: 10.2MB

.data Size: 469KB - Virtual size: 2.0MB

.pdata Size: 1.2MB - Virtual size: 1.2MB

.gehcont Size: 512B - Virtual size: 40B

.rsrc Size: 25KB - Virtual size: 25KB

.reloc Size: 179KB - Virtual size: 179KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

47:07:d4:0b:50:82:fe:aa:6e:0a:5e:92
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

43:92:94:ba:8d:43:4b:25:4e:c2:f4:f1:e0:4d:2d:55:99:1f:76:94:c2:6c:f6:13:9e:be:de:35:5e:58:a6:d0
Signer

.text
Size: 20.0MB - Virtual size: 20.0MB

.rdata
Size: 10.2MB - Virtual size: 10.2MB

.data
Size: 469KB - Virtual size: 2.0MB

.pdata
Size: 1.2MB - Virtual size: 1.2MB

.gehcont
Size: 512B - Virtual size: 40B

.rsrc
Size: 25KB - Virtual size: 25KB

.reloc
Size: 179KB - Virtual size: 179KB