General

Malware Config

Signatures

Files

• DiscordSetup.exe

  .exe windows:5 windows x86 arch:x86

  d4242a1a467b37289efb62d259301b54

  
  

  Code Sign

  04:2a:b0:42:f4:27:0d:4b:cf:90:ec:03:3b:9a:1e:c5

  Certificate

  Issuer

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  28-01-2016 00:00

  Not After

  28-03-2018 12:00

  Subject

  SERIALNUMBER=5128862,CN=Hammer & Chisel Inc.,O=Hammer & Chisel Inc.,POSTALCODE=95008,STREET=Suite 1180+STREET=1901 So. Bascom Ave,L=Campbell,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

  Certificate

  Issuer

  CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2014 00:00

  Not After

  22-10-2024 00:00

  Subject

  CN=DigiCert Timestamp Responder,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  18-04-2012 12:00

  Not After

  18-04-2027 12:00

  Subject

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  10-11-2006 00:00

  Not After

  10-11-2021 00:00

  Subject

  CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageServerAuth

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  ExtKeyUsageEmailProtection

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  aa:44:7b:5e:f3:04:78:7e:f2:e0:e0:7b:e0:1c:63:89:c7:8a:cf:d0

  Signer

  Actual PE Digest

  aa:44:7b:5e:f3:04:78:7e:f2:e0:e0:7b:e0:1c:63:89:c7:8a:cf:d0

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\tmp\squirrel\-1240161847\src\Setup\bin\Release\Setup.pdb

  Imports

  kernel32

  InitializeCriticalSectionAndSpinCount

  FreeResource

  LoadResource

  FindResourceW

  SizeofResource

  LockResource

  CreateDirectoryW

  LocalFree

  CopyFileW

  GetFileAttributesW

  CreateFileW

  SetFilePointer

  ReadFile

  SystemTimeToFileTime

  GetCurrentDirectoryW

  MultiByteToWideChar

  LocalFileTimeToFileTime

  WideCharToMultiByte

  WriteFile

  SetFileTime

  CreateProcessW

  lstrcmpiW

  LeaveCriticalSection

  RaiseException

  EnterCriticalSection

  LoadLibraryExW

  GetCurrentThreadId

  DecodePointer

  FreeLibrary

  SetEndOfFile

  LCMapStringW

  CompareStringW

  LoadLibraryW

  GetCurrentProcess

  GetModuleFileNameW

  DeleteFileW

  CloseHandle

  GetExitCodeProcess

  WaitForSingleObject

  MoveFileW

  GetTempFileNameW

  GetLastError

  GetTempPathW

  lstrlenW

  DeleteCriticalSection

  GetModuleHandleW

  GetProcAddress

  VerSetConditionMask

  WriteConsoleW

  SetStdHandle

  GetStringTypeW

  ReadConsoleW

  SetEnvironmentVariableA

  SetFilePointerEx

  FlushFileBuffers

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  QueryPerformanceCounter

  GetConsoleMode

  GetConsoleCP

  GetCPInfo

  GetOEMCP

  GetACP

  OutputDebugStringW

  VerifyVersionInfoW

  IsDebuggerPresent

  IsProcessorFeaturePresent

  HeapFree

  HeapAlloc

  EncodePointer

  GetCommandLineW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  SetLastError

  Sleep

  TerminateProcess

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStdHandle

  GetFileType

  ExitProcess

  GetModuleHandleExW

  AreFileApisANSI

  RtlUnwind

  GetProcessHeap

  HeapSize

  HeapReAlloc

  IsValidCodePage

  user32

  CharNextW

  DestroyWindow

  LoadStringW

  ExitWindowsEx

  GetActiveWindow

  MessageBoxW

  wsprintfW

  advapi32

  RegCreateKeyExW

  RegDeleteValueW

  RegEnumKeyExW

  RegQueryInfoKeyW

  RegDeleteKeyW

  GetTokenInformation

  GetUserNameW

  RegCloseKey

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  AdjustTokenPrivileges

  OpenProcessToken

  LookupPrivilegeValueW

  RegSetValueExW

  RegQueryValueExW

  RegOpenKeyExW

  shell32

  SHGetFolderPathW

  ShellExecuteW

  ShellExecuteExW

  ole32

  CoTaskMemRealloc

  CoTaskMemAlloc

  CoInitialize

  CoUninitialize

  CoTaskMemFree

  CoCreateInstance

  oleaut32

  VariantInit

  VarUI4FromStr

  SysFreeString

  SysAllocString

  VariantClear

  urlmon

  URLDownloadToFileW

  comctl32

  InitCommonControlsEx

  Sections

  .text

  Size: 122KB - Virtual size: 121KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 43KB - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 46.1MB - Virtual size: 46.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ