Setup[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Setup.exe
Size

687.3MB
MD5

08cee67d858b9f0410092d412c0150bf
SHA1

0ab78e3e2386aed96ca73788168c6b15574a60e2
SHA256

2506b94636c56b559f6510dc58826662f02d3fb93ee5a0c204b29a2b2dea4547
SHA512

e01da0b41b6457c47ebd5fd28713ed6e47cbd1fc43670675066bc0156b5229023022b9bbd3376db76aede4ad5ce84936c49ea366759218b0f4c1a55eac989941
SSDEEP

98304:aXLztzBrR37IDnL9Uz6wcHtiOunBD+VTo+g3XIQQfcs3cI4A3BR6++au1izRl:SVzBtsLL4cE508+gnjUccAAxZ+n1iX

Score

1^/10

Malware Config

Signatures

Files

Setup.exe
.exe windows:4 windows x86 arch:x86

daa934ba7d92eabb25773283aa1f7b96

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18-03-2022 00:00

Not After

02-04-2025 23:59

Subject

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18-03-2022 00:00

Not After

02-04-2025 23:59

Subject

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24-12-1999 17:50

Not After

24-07-2029 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22-07-2015 19:02

Not After

22-06-2029 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

19-01-2024 16:46

Not After

01-06-2029 00:00

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d8:32:f1:4f:d4:eb:b5:c7:c4:ca:23:12:ee:99:90:05:9e:43:61:de:d8:9f:f2:bb:92:4f:c4:a2:3c:db:0b:0a
Signer

Actual PE Digest

d8:32:f1:4f:d4:eb:b5:c7:c4:ca:23:12:ee:99:90:05:9e:43:61:de:d8:9f:f2:bb:92:4f:c4:a2:3c:db:0b:0a

Digest Algorithm

sha256

PE Digest Matches

false

a5:5c:23:5c:c5:57:81:6e:76:10:29:f1:29:21:2d:5d:fa:75:1c:c2
Signer

Actual PE Digest

a5:5c:23:5c:c5:57:81:6e:76:10:29:f1:29:21:2d:5d:fa:75:1c:c2

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\sourcecode\deskfx\release\DeskFX.pdb

Imports

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW

kernel32

FindNextFileW
HeapAlloc
DisconnectNamedPipe
GetCurrentProcess
ResetEvent
FindFirstFileW
GlobalSize
LeaveCriticalSection
DeleteCriticalSection
GlobalUnlock
InterlockedIncrement
OpenProcess
InitializeCriticalSection
InterlockedExchangeAdd
WaitForSingleObject
VerifyVersionInfoW
InterlockedDecrement
FreeLibrary
SetEvent
LocalFree
GetProcessHeap
GlobalFree
DeleteFileW
CreateEventW
MultiByteToWideChar
SetFilePointerEx
GlobalLock
HeapFree
RemoveDirectoryW
GetTickCount
GetTempPathW
FlushFileBuffers
MoveFileW
UnmapViewOfFile
MulDiv
FindClose
GetFileTime
MapViewOfFile
LocalAlloc
EnterCriticalSection
WideCharToMultiByte
GetModuleHandleW
GetCurrentThreadId
WriteFile
CreateProcessW
TerminateProcess
CreateDirectoryW
VerSetConditionMask
SetThreadPriority
ReadFile
GetFileAttributesW
CreateFileW
CopyFileW
GetFileSizeEx
OpenFileMappingW
ResumeThread
SetFilePointer
CreateMutexW
GetDiskFreeSpaceExW
RtlCaptureContext
GetCommandLineW
MoveFileExW
FileTimeToSystemTime
GetCurrentDirectoryA
InterlockedExchange
GetVersionExA
GetPrivateProfileSectionNamesW
Sleep
GetModuleFileNameW
GetPrivateProfileStringW
GetShortPathNameW
VirtualQuery
GetSystemInfo
SetFileAttributesW
GetStdHandle
CreateFileMappingW
SetLastError
GetACP
GetFileSize
CreateThread
lstrcpyW
GetProcAddress
GetVersionExW
lstrlenA
SetCurrentDirectoryW
GetDriveTypeW
GetSystemTime
GlobalMemoryStatusEx
GetLocaleInfoW
GlobalAlloc
LoadLibraryExW
GetLogicalDriveStringsW
SetUnhandledExceptionFilter
GetCurrentProcessId
SetEndOfFile
SuspendThread
SystemTimeToTzSpecificLocalTime
GetModuleFileNameA
DeviceIoControl
GetStartupInfoW
GetEnvironmentVariableA
ConnectNamedPipe
QueryPerformanceFrequency
GetComputerNameW
CreatePipe
GetOverlappedResult
LoadLibraryW
WaitForMultipleObjects
CancelIo
LockResource
GetExitCodeProcess
WaitNamedPipeW
GetThreadPriority
FreeResource
QueryPerformanceCounter
SetEnvironmentVariableW
GetCurrentDirectoryW
GetPrivateProfileIntW
GetCurrentThread
ExitProcess
ReleaseMutex
SizeofResource
FileTimeToLocalFileTime
ReadProcessMemory
LoadResource
GetEnvironmentVariableW
CreateNamedPipeW
GetThreadContext
GetTimeZoneInformation
CreateToolhelp32Snapshot
Process32NextW
GlobalHandle
Process32FirstW
FindResourceW
PeekNamedPipe
DuplicateHandle
GetUserDefaultLCID
ProcessIdToSessionId
GetLastError
LoadLibraryA
CloseHandle
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringA
CreateFileA
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
RtlUnwind
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RaiseException
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
LCMapStringW
HeapSize
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
HeapDestroy

advapi32

GetLengthSid
RegSetKeySecurity
GetSidSubAuthority
RegEnumKeyW
InitializeAcl
GetAce
InitializeSid
CheckTokenMembership
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumValueW
ConvertSidToStringSidW
AddAccessAllowedAce
SetFileSecurityW
GetSidLengthRequired
RegOpenKeyW
DuplicateTokenEx
GetTokenInformation
RegCreateKeyExW
RegQueryValueExW
QueryServiceStatusEx
OpenProcessToken
ControlService
CloseServiceHandle
OpenServiceW
BuildTrusteeWithSidW
GetUserNameW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
SetEntriesInAclW
AdjustTokenPrivileges
StartServiceW
OpenSCManagerW
RegCloseKey
LookupAccountSidW
FreeSid
RegDeleteValueW
EnumDependentServicesW
SetSecurityInfo
PrivilegeCheck
LookupPrivilegeValueW
RegSetValueExW
InitializeSecurityDescriptor
GetSecurityInfo
RegOpenKeyExW

comctl32

PropertySheetW
ImageList_DrawEx
ImageList_Destroy
ord17
ImageList_GetIconSize
_TrackMouseEvent

comdlg32

GetSaveFileNameW
GetOpenFileNameW

gdi32

GetDIBits
TextOutW
Polygon
SetViewportExtEx
GetTextMetricsA
IntersectClipRect
BitBlt
CreateDIBitmap
CreateDIBSection
GetTextExtentPoint32W
SetTextAlign
SetWindowExtEx
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
SetStretchBltMode
GetViewportExtEx
CreateRectRgnIndirect
ExtTextOutW
SetDIBits
SetBkColor
SetPixel
PolyPolyline
SelectClipRgn
SetBrushOrgEx
SetDCBrushColor
Polyline
DeleteDC
GetWindowExtEx
CreatePatternBrush
GetObjectA
GetCurrentObject
DeleteObject
PolyDraw
CreatePen
LineTo
SelectObject
CreateFontIndirectW
SetTextColor
SetBkMode
MoveToEx
CreateFontW
GetTextMetricsW
CreateSolidBrush
GetDeviceCaps
StretchBlt
GetObjectW
CreateBrushIndirect
SetViewportOrgEx

msacm32

acmStreamConvert
acmStreamClose
acmStreamSize
acmStreamOpen
acmStreamUnprepareHeader
acmStreamPrepareHeader

ole32

CoInitializeSecurity
CoRegisterClassObject
CoSetProxyBlanket
CoRevokeClassObject
CoResumeClassObjects
CreateStreamOnHGlobal
CoUninitialize
PropVariantClear
CoTaskMemFree
CoCreateInstance
StringFromCLSID
CoInitialize
CoTaskMemAlloc
CoAddRefServerProcess

oleaut32

SysFreeString
SysStringByteLen
OleLoadPicture
SysAllocString
VariantInit
SysAllocStringLen
SysAllocStringByteLen
OleLoadPicturePath
VariantClear

shell32

ord190
ShellExecuteW
Shell_NotifyIconW
ord155
SHBrowseForFolderW
ord680
SHGetMalloc
CommandLineToArgvW
SHGetPathFromIDListW
SHChangeNotify
ShellExecuteExW
SHGetDesktopFolder
SHGetFolderPathW
ShellExecuteA
SHParseDisplayName
SHCreateShellItem
SHOpenFolderAndSelectItems

shlwapi

SHDeleteKeyW
PathCompactPathExW
SHDeleteEmptyKeyW

user32

GetSubMenu
SetMenu
SystemParametersInfoW
GetParent
RemoveMenu
InvalidateRect
SendMessageW
GetWindowRect
EndMenu
MonitorFromPoint
GetNextDlgGroupItem
AllowSetForegroundWindow
GetAncestor
TranslateMessage
GetUpdateRect
DrawIconEx
GetSysColor
GetIconInfo
EnumChildWindows
IsCharAlphaW
GetWindowTextLengthW
InsertMenuW
InsertMenuItemW
SetForegroundWindow
MsgWaitForMultipleObjects
keybd_event
EnableMenuItem
DrawFocusRect
GetScrollBarInfo
GetComboBoxInfo
DrawStateW
GetDlgItemTextW
GetClassInfoW
SetDlgItemTextW
SetScrollInfo
IsWindowVisible
MessageBoxW
GetDesktopWindow
GetMessageW
IsWindow
EndDialog
GetSystemMetrics
DialogBoxParamW
InflateRect
wsprintfW
WindowFromPoint
GetClassNameW
MapVirtualKeyW
SetLayeredWindowAttributes
LoadImageW
MapDialogRect
SetWindowPlacement
OffsetRect
MonitorFromWindow
WindowFromDC
GetCapture
SetPropW
RegisterClassW
GetMenuInfo
CallNextHookEx
CreatePopupMenu
CallWindowProcW
GetWindowDC
MonitorFromRect
GetMonitorInfoW
GetScrollInfo
GetPropW
GetMenuItemInfoW
GetFocus
GetMenuBarInfo
GetKeyNameTextW
IsWindowEnabled
SetClassLongW
DispatchMessageW
GetKeyboardState
GetWindow
SetClipboardData
GetClassNameA
EnableWindow
DialogBoxIndirectParamW
GetWindowTextW
FindWindowW
CheckDlgButton
SetWindowPos
RedrawWindow
PeekMessageW
PtInRect
EnumDisplaySettingsW
LoadStringW
IsDlgButtonChecked
IsClipboardFormatAvailable
NotifyWinEvent
SetMenuItemInfoW
ShowScrollBar
GetDlgCtrlID
SendDlgItemMessageW
MapWindowPoints
FlashWindowEx
GetWindowThreadProcessId
FindWindowExW
GetSysColorBrush
IsDialogMessageW
SetMenuInfo
GetForegroundWindow
EnumDisplayDevicesW
DrawEdge
FillRect
GetCursor
SetCapture
EndPaint
RegisterWindowMessageW
CheckMenuRadioItem
IsIconic
GetCursorInfo
GetWindowLongW
DefWindowProcW
AppendMenuW
SetMenuDefaultItem
DeleteMenu
GetMenu
SetFocus
GetActiveWindow
SetTimer
OpenClipboard
CheckMenuItem
DestroyWindow
LoadCursorW
SetCursor
ReleaseDC
BeginPaint
GetDlgItem
PostMessageW
GetKeyState
UpdateWindow
MoveWindow
SetActiveWindow
GetDC
SetWindowTextW
CreateWindowExW
ClientToScreen
GetWindowPlacement
EmptyClipboard
ShowWindow
DestroyMenu
CloseClipboard
GetClipboardData
DrawTextW
TrackPopupMenu
KillTimer
CreateDialogIndirectParamW
GetAsyncKeyState
ScrollWindowEx
SetWindowLongW
ReleaseCapture
GetClientRect
ModifyMenuW
IsZoomed
WaitForInputIdle
RemovePropW
SetWindowsHookExW
FrameRect
PostQuitMessage
UnhookWindowsHookEx
ScreenToClient
DestroyIcon
GetMenuItemCount

winmm

waveOutPrepareHeader
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPause
waveOutReset
waveOutGetNumDevs
waveOutSetVolume

ws2_32

gethostbyname
ioctlsocket
connect
select
WSAGetLastError
__WSAFDIsSet
recv
WSAStartup
ntohs
send
setsockopt
htons
closesocket
inet_addr
socket
gethostname

rpcrt4

UuidCreate
UuidFromStringW
RpcStringFreeW
UuidToStringW

netapi32

NetUserGetInfo
NetApiBufferFree

msimg32

AlphaBlend
GradientFill

gdiplus

GdipMultiplyWorldTransform
GdipStringFormatGetGenericTypographic
GdipDrawImageRectRect
GdipDeleteStringFormat
GdipMeasureCharacterRanges
GdipSaveImageToStream
GdipGetImageHeight
GdipSetImageAttributesWrapMode
GdipGetPointCount
GdipDisposeImage
GdipCreateLineBrush
GdipGetImageEncoders
GdipGetEmHeight
GdipGetPropertyItemSize
GdipBitmapLockBits
GdipSetPathGradientCenterColor
GdipScaleWorldTransform
GdipDrawString
GdipGetSolidFillColor
GdipSetPenLineJoin
GdipGetPropertyCount
GdipAddPathEllipse
GdipCloneStringFormat
GdipSetPenDashOffset
GdipCreateBitmapFromHICON
GdipAddPathPath
GdipSetStringFormatAlign
GdipSetPathGradientPresetBlend
GdipGetMatrixElements
GdipAddPathStringI
GdipAddPathBezier
GdipGetDC
GdipGetWorldTransform
GdipImageGetFrameDimensionsList
GdipAddPathString
GdipSetWorldTransform
GdipSetPenEndCap
GdipGetImagePixelFormat
GdipSetPenMiterLimit
GdipGetFontSize
GdipGraphicsClear
GdipCreateMatrix
GdipImageGetFrameCount
GdipGetBrushType
GdipGetImageHorizontalResolution
GdipBitmapUnlockBits
GdipRotateWorldTransform
GdipCreateFontFromLogfontA
GdipDrawPath
GdipGetRegionBounds
GdipCloneImage
GdipAddPathArc
GdipGetClip
GdipSetPenDashCap197819
GdipSetImageAttributesColorMatrix
GdipCreateFontFromDC
GdiplusShutdown
GdipGetPathWorldBounds
GdipSetPageUnit
GdipCreateRegion
GdipGetPropertyIdList
GdipCreateBitmapFromHBITMAP
GdipMeasureString
GdipGetClipBoundsI
GdipCreateBitmapFromScan0
GdipImageSelectActiveFrame
GdipCreateFromHDC
GdipCombineRegionPath
GdipSetStringFormatLineAlign
GdipClonePath
GdipGetPathPoints
GdipSetPenDashArray
GdipSetPenDashStyle
GdipSetPathGradientTransform
GdipGetPropertyItem
GdipImageGetFrameDimensionsCount
GdipDisposeImageAttributes
GdipSetStringFormatHotkeyPrefix
GdipSetPathFillMode
GdipSetLineTransform
GdipAddPathLine2
GdipSetPathGradientWrapMode
GdipCreateStringFormat
GdipGetPathGradientPointCount
GdipFillPath
GdipCreateBitmapFromStream
GdipGetImageEncodersSize
GdipGetPathLastPoint
GdiplusStartup
GdipGetFontStyle
GdipGetImageVerticalResolution
GdipDeleteMatrix
GdipCreateMatrix2
GdipGetStringFormatFlags
GdipSetLineWrapMode
GdipGetFamily
GdipSetPenStartCap
GdipSetStringFormatMeasurableCharacterRanges
GdipDeleteBrush
GdipGetTextRenderingHint
GdipCreateRegionRect
GdipCreateFontFamilyFromName
GdipDeleteRegion
GdipResetClip
GdipDeletePath
GdipStartPathFigure
GdipFillRectangle
GdipAddPathRectangle
GdipClosePathFigure
GdipDeleteGraphics
GdipTranslateWorldTransform
GdipCreateSolidFill
GdipSetSmoothingMode
GdipRestoreGraphics
GdipSetPathGradientCenterPoint
GdipSetLinePresetBlend
GdipBitmapSetResolution
GdipCreateImageAttributes
GdipGetImageGraphicsContext
GdipReleaseDC
GdipSetInterpolationMode
GdipSetPathGradientSurroundColorsWithCount
GdipGetImageWidth
GdipCreatePathGradientFromPath
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipGetCellAscent
GdipDeleteFont
GdipDeleteFontFamily
GdipCreatePen2
GdipCreateFont
GdipAddPathLine
GdipCloneBrush
GdipDrawEllipse
GdipResetPath
GdipCreatePath
GdipDrawRectangle
GdipSetTextRenderingHint
GdipFillEllipse
GdipDrawLine
GdipDeletePen
GdipSetClipRegion
GdipSetSolidFillColor
GdipFlattenPath
GdipGetGenericFontFamilySansSerif
GdipSaveGraphics

iphlpapi

GetAdaptersAddresses
GetIpAddrTable

wininet

InternetGetConnectedState
InternetQueryOptionA

secur32

EncryptMessage
DeleteSecurityContext
InitializeSecurityContextW
FreeCredentialsHandle
AcquireCredentialsHandleW
QueryContextAttributesW
DecryptMessage
FreeContextBuffer
ApplyControlToken

crypt32

CertFreeCertificateContext
CertVerifySubjectCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptQueryObject

wintrust

WinVerifyTrust

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 359KB - Virtual size: 358KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 547KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 3B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

daa934ba7d92eabb25773283aa1f7b96

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1Certificate

Extended Key Usages

Key Usages

38:63:de:f8Certificate

Key Usages

58:da:13:ff:00:00:00:00:51:ce:0d:f7Certificate

Extended Key Usages

Key Usages

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04Certificate

Extended Key Usages

Key Usages

d8:32:f1:4f:d4:eb:b5:c7:c4:ca:23:12:ee:99:90:05:9e:43:61:de:d8:9f:f2:bb:92:4f:c4:a2:3c:db:0b:0aSigner

a5:5c:23:5c:c5:57:81:6e:76:10:29:f1:29:21:2d:5d:fa:75:1c:c2Signer

Headers

File Characteristics

PDB Paths

Imports

setupapi

kernel32

advapi32

comctl32

comdlg32

gdi32

msacm32

ole32

oleaut32

shell32

shlwapi

user32

winmm

ws2_32

rpcrt4

netapi32

msimg32

gdiplus

iphlpapi

wininet

secur32

crypt32

wintrust

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 359KB - Virtual size: 358KB

.data Size: 15KB - Virtual size: 547KB

.tls Size: 512B - Virtual size: 3B

.rsrc Size: 1.7MB - Virtual size: 1.7MB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1
Certificate

38:63:de:f8
Certificate

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Certificate

d8:32:f1:4f:d4:eb:b5:c7:c4:ca:23:12:ee:99:90:05:9e:43:61:de:d8:9f:f2:bb:92:4f:c4:a2:3c:db:0b:0a
Signer

a5:5c:23:5c:c5:57:81:6e:76:10:29:f1:29:21:2d:5d:fa:75:1c:c2
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 359KB - Virtual size: 358KB

.data
Size: 15KB - Virtual size: 547KB

.tls
Size: 512B - Virtual size: 3B

.rsrc
Size: 1.7MB - Virtual size: 1.7MB