General

Malware Config

Signatures

Files

• 48605846c229a73a9695d0a6567982bb558e5108b2251b74ad2cdba66e332632.exe

  .exe windows:4 windows x86 arch:x86

  7eb97a34a6bb717777a9007e42e5c399

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-05-2019 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

  Certificate

  Issuer

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  11-05-2022 00:00

  Not After

  10-08-2033 23:59

  Subject

  CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  03:cf:15:4a:d4:c3:4e:db:a5:81:85:4d:9f:75:0f:2d

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  16-12-2022 00:00

  Not After

  08-01-2026 23:59

  Subject

  CN=Chengdu XiaoShanHu Information Technology Co.\,Ltd.,O=Chengdu XiaoShanHu Information Technology Co.\,Ltd.,L=Chengdu,ST=Sichuan,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  03:cf:15:4a:d4:c3:4e:db:a5:81:85:4d:9f:75:0f:2d

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  16-12-2022 00:00

  Not After

  08-01-2026 23:59

  Subject

  CN=Chengdu XiaoShanHu Information Technology Co.\,Ltd.,O=Chengdu XiaoShanHu Information Technology Co.\,Ltd.,L=Chengdu,ST=Sichuan,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

  Certificate

  Issuer

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  11-05-2022 00:00

  Not After

  10-08-2033 23:59

  Subject

  CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-05-2019 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  cc:31:2c:c2:1b:00:be:9e:e5:46:2f:f3:3d:53:b5:e8:94:70:ef:9e:c1:c5:78:3f:14:2c:c2:f3:e8:2b:61:d6

  Signer

  Actual PE Digest

  cc:31:2c:c2:1b:00:be:9e:e5:46:2f:f3:3d:53:b5:e8:94:70:ef:9e:c1:c5:78:3f:14:2c:c2:f3:e8:2b:61:d6

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  8f:2c:d7:63:d9:4d:b7:51:96:49:23:57:b8:fc:1a:fd:f5:df:6d:a1

  Signer

  Actual PE Digest

  8f:2c:d7:63:d9:4d:b7:51:96:49:23:57:b8:fc:1a:fd:f5:df:6d:a1

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  advapi32

  RegCloseKey

  RegOpenKeyExA

  RegOpenKeyW

  RegQueryValueExA

  RegQueryValueExW

  comctl32

  _TrackMouseEvent

  comdlg32

  CommDlgExtendedError

  GetOpenFileNameW

  GetSaveFileNameW

  gdi32

  Arc

  BitBlt

  CombineRgn

  CreateBitmap

  CreateCompatibleBitmap

  CreateCompatibleDC

  CreateDCA

  CreateDIBSection

  CreateFontA

  CreatePalette

  CreatePen

  CreatePolygonRgn

  CreateRectRgn

  CreateSolidBrush

  DPtoLP

  DeleteDC

  DeleteObject

  EnumFontFamiliesW

  EqualRgn

  ExtCreatePen

  ExtCreateRegion

  GdiFlush

  GetCharacterPlacementW

  GetDIBits

  GetDeviceCaps

  GetEnhMetaFileHeader

  GetGlyphOutlineW

  GetRgnBox

  GetStockObject

  GetTextExtentPoint32W

  GetTextMetricsA

  GetWorldTransform

  LPtoDP

  LineTo

  ModifyWorldTransform

  MoveToEx

  Pie

  PlayEnhMetaFile

  PolyPolygon

  Polygon

  Polyline

  RealizePalette

  RectInRegion

  RestoreDC

  SaveDC

  SelectClipRgn

  SelectObject

  SelectPalette

  SetBkMode

  SetDIBitsToDevice

  SetPixel

  SetTextAlign

  SetTextColor

  SetWorldTransform

  StretchDIBits

  TextOutW

  UpdateColors

  kernel32

  AddVectoredExceptionHandler

  CloseHandle

  CreateEventA

  CreateProcessA

  CreateSemaphoreA

  DeleteCriticalSection

  DuplicateHandle

  EnterCriticalSection

  EnumResourceLanguagesA

  EnumSystemLocalesA

  ExitProcess

  FileTimeToSystemTime

  FindClose

  FindFirstFileW

  FindNextFileW

  FormatMessageA

  GetACP

  GetComputerNameA

  GetCurrentDirectoryA

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetFileAttributesA

  GetHandleInformation

  GetLastError

  GetLocaleInfoA

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetProcessAffinityMask

  GetProcessTimes

  GetStartupInfoA

  GetSystemInfo

  GetSystemTimeAdjustment

  GetSystemTimeAsFileTime

  GetThreadContext

  GetThreadLocale

  GetThreadPriority

  GetThreadTimes

  GetTickCount

  GetTimeZoneInformation

  GetVersionExA

  GlobalAlloc

  GlobalLock

  GlobalUnlock

  InitializeCriticalSection

  IsDBCSLeadByteEx

  IsDebuggerPresent

  LeaveCriticalSection

  LoadLibraryA

  LocalFree

  MoveFileExA

  MulDiv

  MultiByteToWideChar

  OpenProcess

  OutputDebugStringA

  QueryPerformanceCounter

  QueryPerformanceFrequency

  RaiseException

  ReleaseSemaphore

  RemoveVectoredExceptionHandler

  ResetEvent

  ResumeThread

  SetCurrentDirectoryA

  SetEvent

  SetFileAttributesA

  SetLastError

  SetProcessAffinityMask

  SetSystemTime

  SetThreadContext

  SetThreadPriority

  SetUnhandledExceptionFilter

  Sleep

  SuspendThread

  TerminateProcess

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TryEnterCriticalSection

  UnhandledExceptionFilter

  VirtualProtect

  VirtualQuery

  WaitForMultipleObjects

  WaitForSingleObject

  WideCharToMultiByte

  lstrcmpiA

  msvcrt

  __doserrno

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p___argv

  __p__acmdln

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _beginthreadex

  _cexit

  _endthreadex

  _environ

  _errno

  _execvp

  _filelengthi64

  _fileno

  _findclose

  _fstat64

  _fstati64

  _fullpath

  _initterm

  _iob

  _lock

  _lseeki64

  _onexit

  _putenv

  _setjmp3

  _stati64

  _strdup

  _stricmp

  _strnicmp

  _ultoa

  _unlock

  _vsnprintf

  _waccess

  _wchmod

  _wfopen

  _wgetcwd

  _wgetenv

  _wmkdir

  _wopen

  _wrename

  _wrmdir

  _wunlink

  abort

  acos

  atof

  atoi

  atol

  bsearch

  calloc

  exit

  fclose

  feof

  ferror

  fflush

  fgetpos

  fgets

  fopen

  fprintf

  fputc

  fputs

  fread

  free

  frexp

  fscanf

  fseek

  fsetpos

  ftell

  fwrite

  getc

  getenv

  getwc

  isalnum

  isalpha

  iscntrl

  islower

  isprint

  ispunct

  isspace

  isupper

  iswctype

  isxdigit

  localeconv

  malloc

  memchr

  memcmp

  memcpy

  memmove

  memset

  localtime

  gmtime

  difftime

  perror

  printf

  putc

  putwc

  qsort

  raise

  rand

  realloc

  remove

  rename

  rewind

  setlocale

  setvbuf

  signal

  sprintf

  sscanf

  strcat

  strchr

  strcmp

  strcoll

  strcpy

  strcspn

  strerror

  strftime

  strlen

  strncmp

  strncpy

  strrchr

  strstr

  strtol

  strtoul

  strxfrm

  system

  tolower

  toupper

  towlower

  towupper

  ungetc

  ungetwc

  vfprintf

  time

  wcscoll

  wcscpy

  wcsftime

  wcslen

  wcsncpy

  wcstombs

  wcsxfrm

  _wstat

  _ftime

  _findnext

  _findfirst

  longjmp

  _write

  _unlink

  _strdup

  _read

  _open

  _mkdir

  _getpid

  _getcwd

  _fileno

  _fdopen

  _close

  _chmod

  ole32

  DoDragDrop

  OleInitialize

  OleUninitialize

  RegisterDragDrop

  ReleaseStgMedium

  shell32

  DragQueryFileW

  SHBrowseForFolderW

  SHGetMalloc

  SHGetPathFromIDListA

  SHGetPathFromIDListW

  ShellExecuteA

  user32

  AdjustWindowRectEx

  BringWindowToTop

  CallWindowProcA

  ChangeClipboardChain

  ClientToScreen

  CloseClipboard

  CopyIcon

  CreateIconIndirect

  CreateWindowExA

  CreateWindowExW

  DefWindowProcA

  DefWindowProcW

  DestroyIcon

  DestroyWindow

  DispatchMessageW

  EmptyClipboard

  FillRect

  GetAsyncKeyState

  GetClipboardData

  GetClipboardOwner

  GetCursorPos

  GetDC

  GetForegroundWindow

  GetKeyState

  GetKeyboardLayout

  GetParent

  GetSysColor

  GetSystemMetrics

  GetUpdateRgn

  GetWindow

  GetWindowLongA

  GetWindowLongW

  GetWindowRect

  InvalidateRect

  IsClipboardFormatAvailable

  IsIconic

  IsWindow

  KillTimer

  LoadCursorA

  LoadIconA

  MapWindowPoints

  MessageBeep

  MessageBoxA

  MsgWaitForMultipleObjects

  OpenClipboard

  OpenIcon

  PeekMessageA

  PeekMessageW

  PostMessageA

  PostThreadMessageA

  RegisterClassExA

  RegisterClassExW

  RegisterWindowMessageW

  ReleaseCapture

  ReleaseDC

  SendMessageA

  SendMessageW

  SetActiveWindow

  SetCapture

  SetClipboardData

  SetClipboardViewer

  SetCursor

  SetFocus

  SetForegroundWindow

  SetRect

  SetTimer

  SetWindowLongA

  SetWindowPos

  SetWindowRgn

  SetWindowTextW

  ShowWindow

  SystemParametersInfoA

  TranslateMessage

  ValidateRgn

  WindowFromPoint

  winmm

  timeBeginPeriod

  timeEndPeriod

  ws2_32

  WSACleanup

  WSAGetLastError

  WSASetLastError

  WSASocketA

  WSAStartup

  __WSAFDIsSet

  accept

  bind

  closesocket

  connect

  gethostbyname

  gethostname

  getservbyname

  getservbyport

  getsockname

  getsockopt

  htonl

  htons

  inet_addr

  inet_ntoa

  ioctlsocket

  listen

  ntohl

  ntohs

  recv

  recvfrom

  select

  send

  sendto

  setsockopt

  shutdown

  socket

  Sections

  .text

  Size: 2.1MB - Virtual size: 2.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 135KB - Virtual size: 135KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 14KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.7MB - Virtual size: 1.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE