General

Malware Config

Signatures

Files

• 28c9f8f1536eaf9512b4444f36ff3292530d420568e15a21df04c748978fd014

  .exe windows:4 windows x64 arch:x64

  80382c38f99812138b9f690d1324956c

  
  

  Code Sign

  4e:a8:b2:70

  Certificate

  Issuer

  CN=www.microsoft.com,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

  Not Before

  15-10-2020 19:25

  Not After

  13-01-2021 19:25

  Subject

  CN=www.microsoft.com,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

  bd:5f:69:e5:24:c2:af:f6:2f:ec:55:50:69:35:98:87:91:d7:45:33:66:49:db:12:c3:0c:a4:b8:eb:c4:0c:5a

  Signer

  Actual PE Digest

  bd:5f:69:e5:24:c2:af:f6:2f:ec:55:50:69:35:98:87:91:d7:45:33:66:49:db:12:c3:0c:a4:b8:eb:c4:0c:5a

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  CloseHandle

  ConnectNamedPipe

  CreateFileA

  CreateNamedPipeA

  CreateThread

  DeleteCriticalSection

  EnterCriticalSection

  GetLastError

  GetStartupInfoA

  GetTickCount

  HeapAlloc

  HeapCreate

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  MultiByteToWideChar

  ReadFile

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  WriteFile

  msvcrt

  __C_specific_handler

  ___lc_codepage_func

  ___mb_cur_max_func

  __getmainargs

  __initenv

  __iob_func

  __lconv_init

  __set_app_type

  __setusermatherr

  _acmdln

  _amsg_exit

  _cexit

  _commode

  _errno

  _fmode

  _initterm

  _onexit

  abort

  calloc

  exit

  fprintf

  fputc

  free

  fwrite

  localeconv

  malloc

  memcpy

  memset

  signal

  strerror

  strlen

  strncmp

  vfprintf

  wcslen

  Sections

  .text

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 104B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE