privateloader | adawarewebinstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

adawarewebinstaller.exe
Size

17.1MB
MD5

28114037a9500deeec18776ee840af24
SHA1

99648492534b7d3974a902c029090b2485c4d30e
SHA256

27838443cae09f1248527a0be125cbf8d642ae795d47ba7b5ed14884dae70669
SHA512

04a6dc8ad8130f564df335a7f72d324ed70e2227bb308d9efdc2115c317de98ef3577515d6faa8d4f8511e6cc9e2e8589c421722c7c9c29cb6f470705255125f
SSDEEP

393216:p8QiCzAhRWaxasbpnpnEc/v+crqNSLlx2qm:ppALW+B+

Score

10^/10

privateloader

Malware Config

Signatures

Privateloader family
privateloader

Files

adawarewebinstaller.exe
.exe windows:6 windows x86 arch:x86

9823f91be043fdb5059be7ad31e108a2

Code Sign

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/07/2009, 17:25

Not After

07/12/2030, 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 15:43

Not After

07/11/2030, 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 19:19

Not After

29/12/2040, 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:34:0e:15:d4:84:d8:71:43:7a:e7:1e:b7:ee:5a:b1
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

19/07/2022, 19:29

Not After

19/07/2023, 19:29

Subject

SERIALNUMBER=727035-6,CN=Adaware Software (7270356 CANADA INC.),O=Adaware Software (7270356 CANADA INC.),L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:a6:28:5d:10:f4:88:f8:dd:11:ff:9c:47:f6:9d:85:67:7c:ad:34:89:e0:b5:1e:54:e7:11:b5:5e:de:cb:7a
Signer

Actual PE Digest

0b:a6:28:5d:10:f4:88:f8:dd:11:ff:9c:47:f6:9d:85:67:7c:ad:34:89:e0:b5:1e:54:e7:11:b5:5e:de:cb:7a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\buildbot\workers\adaware_antivirus\adaware_antivirus_builder\build\_build\bin\Win32\Release\AdAwareWebInstaller.pdb

Imports

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
OpenThreadToken
AdjustTokenPrivileges
GetTokenInformation
RevertToSelf
LookupPrivilegeValueW
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextA
LookupAccountSidW
ReportEventA
RegisterEventSourceA
DeregisterEventSource
SetThreadToken
ImpersonateNamedPipeClient
ControlService
SetNamedSecurityInfoW
CryptGetHashParam
CryptHashData
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
AddAce
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
IsValidSid
CopySid
InitializeAcl
GetLengthSid
QueryServiceStatusEx
DeleteService
StartServiceW
ChangeServiceConfig2W
OpenServiceW
CreateServiceW
CloseServiceHandle
OpenSCManagerW
FreeSid
SetFileSecurityW
SetEntriesInAclW
AllocateAndInitializeSid
CryptGetUserKey

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW
DragQueryFileW
SHGetSpecialFolderPathW
SHBrowseForFolderW
ord74
ord727
SHGetFileInfoW
ShellExecuteExW
Shell_NotifyIconW
SHGetPathFromIDListW

kernel32

FlushFileBuffers
ReadFile
WriteFile
SetLastError
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
WaitNamedPipeW
GetNamedPipeHandleStateW
GetCurrentThread
QueueUserWorkItem
CreateNamedPipeA
GetFileSize
SetEndOfFile
SetFilePointer
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
ExitProcess
GetFileAttributesW
FreeLibrary
GetCPInfo
GetModuleHandleW
GlobalAlloc
GlobalFree
LocalAlloc
LocalSize
FormatMessageW
lstrlenW
GetEnvironmentVariableW
HeapReAlloc
CreateThread
SetThreadPriority
WriteConsoleInputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleScreenBufferInfo
GetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleCursorInfo
SetConsoleTextAttribute
GetNumberOfConsoleInputEvents
ReadConsoleW
ReadConsoleInputW
SetConsoleMode
WriteConsoleW
SetConsoleCtrlHandler
GetCurrentDirectoryW
TerminateProcess
GetExitCodeProcess
CreateProcessW
OpenProcess
UnregisterWaitEx
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
LCMapStringW
CreateDirectoryW
GetFileInformationByHandle
RemoveDirectoryW
SetFilePointerEx
SetFileTime
DeviceIoControl
MoveFileExW
CreateHardLinkW
GetLongPathNameW
GetShortPathNameW
ReadDirectoryChangesW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetTempPathW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DecodePointer
RaiseException
CreateFileW
GetLogicalDriveStringsW
GetVolumeInformationW
GetStdHandle
GetStartupInfoW
LoadLibraryW
VirtualAlloc
VirtualFree
lstrcmpW
GetThreadPriority
GetTickCount
GetVersionExW
VirtualProtect
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetSystemTimeAsFileTime
GetFileTime
HeapDestroy
HeapSize
UnregisterWait
RegisterWaitForSingleObject
CancelIo
SetHandleInformation
GetConsoleMode
GetFileType
LoadLibraryA
GetFileSizeEx
CreateWaitableTimerW
GetSystemDirectoryA
TerminateThread
QueueUserAPC
SleepEx
GetOverlappedResult
LockFileEx
UnlockFile
HeapCompact
DeleteFileA
GetFileAttributesA
GetDiskFreeSpaceA
HeapValidate
CreateMutexW
UnlockFileEx
GetFullPathNameA
LockFile
GetDiskFreeSpaceW
HeapCreate
OutputDebugStringA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
FindFirstFileExW
EnumSystemLocalesW
IsValidLocale
GetACP
VirtualQuery
GetConsoleCP
SetStdHandle
GetModuleHandleExW
ExitThread
GetCommandLineA
RtlUnwind
GetStringTypeExA
LCMapStringA
GetStringTypeExW
FoldStringW
EnumSystemLocalesA
GetLocaleInfoA
IsDBCSLeadByteEx
IsValidCodePage
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
FreeLibraryAndExitThread
GetThreadTimes
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
SignalObjectAndWait
CreateTimerQueue
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
CreateWaitableTimerA
GetLogicalProcessorInformation
SetWaitableTimer
OpenEventA
WaitForMultipleObjectsEx
SleepConditionVariableSRW
WakeAllConditionVariable
AreFileApisANSI
CreateDirectoryExW
SetFileAttributesW
GetDiskFreeSpaceExW
InitializeCriticalSectionAndSpinCount
GetNativeSystemInfo
GetExitCodeThread
EncodePointer
GetStringTypeW
DeleteFileW
GetFileAttributesExW
GetWindowsDirectoryW
IsWow64Process
CreateSemaphoreA
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetUserDefaultLocaleName
GetSystemDirectoryW
ExpandEnvironmentStringsW
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
SetErrorMode
DebugBreak
LoadLibraryExA
GetModuleFileNameA
AllocConsole
GlobalLock
GlobalUnlock
GlobalSize
GetProcessHeap
HeapFree
HeapAlloc
GetCommandLineW
GetTempFileNameA
GetTempPathA
MulDiv
OutputDebugStringW
FindNextFileW
FindFirstFileW
FindClose
GetUserDefaultLCID
GetSystemDefaultLCID
GetCurrencyFormatW
GetNumberFormatW
CompareStringW
VerifyVersionInfoW
GetComputerNameW
QueryPerformanceFrequency
GetFullPathNameW
VerSetConditionMask
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
CreateSemaphoreW
WaitForMultipleObjects
CreateEventW
WaitForSingleObject
ReleaseSemaphore
ResetEvent
TryEnterCriticalSection
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToSystemTime
GetLocalTime
GetSystemTime
LoadLibraryExW
MultiByteToWideChar
GetModuleHandleA
GetProcAddress
CreateFileA
MapViewOfFileEx
CreateFileMappingA
UnmapViewOfFile
GetCurrentProcess
DuplicateHandle
Sleep
SwitchToThread
LocalFree
FormatMessageA
GetLastError
GetCurrentProcessId
QueryPerformanceCounter
GetSystemInfo
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
SetUnhandledExceptionFilter
CreateEventA
WideCharToMultiByte
CloseHandle
WaitForSingleObjectEx
SetEvent
GetCurrentThreadId
CopyFileW
GetModuleFileNameW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetTickCount64
ExpandEnvironmentStringsA
VerifyVersionInfoA
GlobalMemoryStatus
FlushConsoleInputBuffer
ReadConsoleInputA
InitializeCriticalSectionEx

user32

GetWindowRect
IsWindow
ShowWindow
PostMessageW
ExitWindowsEx
LoadStringA
GetWindowThreadProcessId
LoadIconW
CreateWindowExW
GetWindowLongW
SystemParametersInfoW
GetClassInfoExW
RegisterClassExW
UpdateWindow
SetWindowLongW
DefWindowProcW
DestroyWindow
SetForegroundWindow
IsIconic
SetWindowTextW
RegisterWindowMessageW
SendMessageW
DialogBoxIndirectParamW
EndDialog
SetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
GetSystemMenu
TrackPopupMenu
ScreenToClient
GetMessageW
TranslateMessage
SetWindowPos
PostQuitMessage
GetDC
ReleaseDC
GetSysColor
LoadCursorW
LoadCursorFromFileA
DestroyCursor
GetKeyState
EnumDisplayDevicesW
EnumDisplayMonitors
MessageBoxA
PeekMessageW
GetMessageTime
GetMessageExtraInfo
IsChild
MoveWindow
GetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsWindowVisible
CallMsgFilterW
SetFocus
GetActiveWindow
GetFocus
GetAsyncKeyState
GetCapture
SetCapture
ReleaseCapture
SetTimer
KillTimer
IsWindowUnicode
EnableWindow
GetSystemMetrics
GetUpdateRect
InvalidateRect
GetDesktopWindow
DispatchMessageW
GetQueueStatus
GetWindowTextW
AdjustWindowRectEx
SetCursor
GetCursorPos
ClientToScreen
WindowFromPoint
IsRectEmpty
GetClassLongW
SetClassLongW
EnumThreadWindows
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetScrollInfo
GetScrollInfo
MonitorFromPoint
NotifyWinEvent
GetDoubleClickTime
MessageBeep
RegisterClassW
AnimateWindow
IsWindowEnabled
GetForegroundWindow
BeginPaint
EndPaint
RedrawWindow
DestroyIcon
DrawIconEx
CreateIconIndirect
GetIconInfo
LoadStringW
SetActiveWindow
MessageBoxW
GetKeyboardLayout
CreateCaret
DestroyCaret
SetCaretPos
FindWindowW
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
SetClipboardData
GetClipboardData
RegisterClipboardFormatW
CountClipboardFormats
EnumClipboardFormats
EmptyClipboard
IsClipboardFormatAvailable
MapVirtualKeyW
SetWinEventHook
UpdateLayeredWindow
PostThreadMessageW
MsgWaitForMultipleObjects
GetParent
SendMessageA
FindWindowA
GetProcessWindowStation
GetUserObjectInformationW

gdi32

AddFontMemResourceEx
GetDeviceCaps
GetFontUnicodeRanges
GetObjectA
StretchDIBits
GetClipBox
GetDIBits
SelectObject
GetObjectW
BitBlt
CreateCompatibleDC
DeleteObject
SetMapMode
CreateDIBSection
StartDocW
EndDoc
StartPage
EndPage
CreateSolidBrush
GetStockObject
SetLayout
CreateBitmap
CreateDCW
DeleteDC
SetViewportOrgEx
CreateFontW
GetGlyphIndicesW
SaveDC
RestoreDC
EnumFontFamiliesExW

winspool.drv

ord203

comdlg32

CommDlgExtendedError
PrintDlgW
GetSaveFileNameW
GetOpenFileNameW

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
OleInitialize
CoCreateInstance
CoTaskMemFree
OleUninitialize
RegisterDragDrop
RevokeDragDrop
DoDragDrop
ReleaseStgMedium
CreateStreamOnHGlobal
CoTaskMemAlloc
CoFreeUnusedLibraries
CoInitialize
CoInitializeEx
CoCreateGuid

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
VariantCopy
SysStringByteLen
SysStringLen
VariantClear
VariantInit

gdiplus

GdipGetFamily
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipGetLineSpacing
GdipGetCellAscent
GdipGetEmHeight
GdipDeleteFontFamily
GdiplusShutdown
GdiplusStartup
GdipEndContainer
GdipBeginContainer2
GdipRestoreGraphics
GdipSaveGraphics
GdipGetClipBoundsI
GdipSetClipRectI
GdipSetClipRect
GdipDrawImageRectRect
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillRectanglesI
GdipFillRectangleI
GdipFillRectangle
GdipGraphicsClear
GdipDrawPath
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipGetFontSize
GdipDrawLine
GdipTransformPoints
GdipSetPageUnit
GdipGetWorldTransform
GdipTranslateWorldTransform
GdipMultiplyWorldTransform
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipDrawDriverString
GdipDeleteGraphics
GdipCreateFromHWNDICM
GdipCreateFromHWND
GdipCreateFromHDC
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipSetLineWrapMode
GdipSetLinePresetBlend
GdipCreateLineBrush
GdipCreateSolidFill
GdipCreateTexture
GdipDeleteBrush
GdipCloneBrush
GdipGetMatrixElements
GdipShearMatrix
GdipRotateMatrix
GdipCreateBitmapFromGraphics
GdipCreateHBITMAPFromBitmap
GdipDrawArc
GdipDrawImageI
GdipAddPathLineI
GdipAddPathEllipse
GdipSetPenDashOffset
GdipSetPenDashStyle
GdipSetPenMiterLimit
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipClosePathFigure
GdipStartPathFigure
GdipSetPathFillMode
GdipResetPath
GdipDeletePath
GdipClonePath
GdipCreatePath
GdipFree
GdipSetPenLineJoin
GdipSetPenEndCap
GdipSetPenStartCap
GdipDeletePen
GdipCreatePen2
GdipSetPenDashArray
GdipCreatePathGradientFromPath
GdipAlloc
GdipSetCompositingQuality
GdipSetPathGradientCenterPoint
GdipSetPathGradientPresetBlend
GdipSetPathGradientWrapMode
GdipSetPathGradientTransform
GdipCreatePen1
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipMultiplyLineTransform
GdipScaleMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix2
GdipCreateMatrix
GdipIsVisiblePathPoint
GdipGetPathWorldBounds
GdipAddPathRectangleI
GdipAddPathArcI

uxtheme

SetWindowTheme
IsThemeBackgroundPartiallyTransparent
CloseThemeData
GetThemePartSize
DrawThemeBackground
OpenThemeData

urlmon

FindMimeFromData

shlwapi

PathIsRelativeW
PathFileExistsW

winmm

timeEndPeriod
timeKillEvent
timeGetTime
timeBeginPeriod
timeSetEvent

oleacc

AccessibleObjectFromWindow
LresultFromObject

comctl32

ImageList_DrawEx
ImageList_GetIconSize
ImageList_Destroy

imm32

ImmGetContext
ImmReleaseContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmNotifyIME
ImmSetCandidateWindow
ImmIsIME

usp10

ScriptBreak
ScriptApplyDigitSubstitution
ScriptFreeCache
ScriptItemize
ScriptShape
ScriptPlace

wininet

InternetConnectA
InternetOpenA
InternetCloseHandle
InternetOpenW
InternetReadFile
InternetQueryOptionW
InternetSetOptionW
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoW
InternetErrorDlg
InternetConnectW
HttpOpenRequestW
HttpSendRequestW

ws2_32

WSACleanup
send
recvfrom
ntohs
WSAStartup
gethostname
select
WSARecvFrom
htonl
freeaddrinfo
connect
socket
WSASetLastError
shutdown
listen
getsockname
accept
htons
closesocket
getsockopt
setsockopt
WSAGetLastError
sendto
bind
ioctlsocket
getpeername
gethostbyname
getservbyname
getaddrinfo
FreeAddrInfoW
__WSAFDIsSet
GetAddrInfoW
WSASocketW
WSASend
WSARecv
WSAIoctl
recv
WSADuplicateSocketW

crypt32

CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext

wldap32

ord143
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord46

Sections

.text
Size: 8.9MB - Virtual size: 8.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 466KB - Virtual size: 542KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 217B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 542KB - Virtual size: 541KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9823f91be043fdb5059be7ad31e108a2

Code Sign

4a:53:8c:28Certificate

Key Usages

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7fCertificate

Extended Key Usages

Key Usages

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2bCertificate

Extended Key Usages

Key Usages

7e:34:0e:15:d4:84:d8:71:43:7a:e7:1e:b7:ee:5a:b1Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0b:a6:28:5d:10:f4:88:f8:dd:11:ff:9c:47:f6:9d:85:67:7c:ad:34:89:e0:b5:1e:54:e7:11:b5:5e:de:cb:7aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

shell32

kernel32

user32

gdi32

winspool.drv

comdlg32

ole32

oleaut32

gdiplus

uxtheme

urlmon

shlwapi

winmm

oleacc

comctl32

imm32

usp10

wininet

ws2_32

crypt32

wldap32

Sections

.text Size: 8.9MB - Virtual size: 8.9MB

.rdata Size: 2.1MB - Virtual size: 2.1MB

.data Size: 466KB - Virtual size: 542KB

.tls Size: 512B - Virtual size: 217B

.gfids Size: 4KB - Virtual size: 3KB

.rsrc Size: 5.2MB - Virtual size: 5.2MB

.reloc Size: 542KB - Virtual size: 541KB

4a:53:8c:28
Certificate

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

7e:34:0e:15:d4:84:d8:71:43:7a:e7:1e:b7:ee:5a:b1
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0b:a6:28:5d:10:f4:88:f8:dd:11:ff:9c:47:f6:9d:85:67:7c:ad:34:89:e0:b5:1e:54:e7:11:b5:5e:de:cb:7a
Signer

.text
Size: 8.9MB - Virtual size: 8.9MB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 466KB - Virtual size: 542KB

.tls
Size: 512B - Virtual size: 217B

.gfids
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 5.2MB - Virtual size: 5.2MB

.reloc
Size: 542KB - Virtual size: 541KB