SecuriteInfo[.]com[.]Trojan[.]MSIL[.]Krypt[.]13987[.]3473[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Trojan.MSIL.Krypt.13987.3473.exe
Size

8.7MB
MD5

3b384a3b2b0f5050e1a558d3142fb2bf
SHA1

83993ad0c2e5761113949855f1c2dc26db367536
SHA256

0566cddbc7c0c84c721964f61e7816f2adf558b1dc455a97ca40f1ed73ffc256
SHA512

916b4cbb7eed5a12b845cc3c3d2cbfbd62ffd50838e5b105d49c73b6f23b37c8b5fdbd3e52eae24e15155e04516d8a6cda69906f5dad52875fca24bb98e53b79
SSDEEP

98304:z5Bun/nnQXhFtISpjgJtOeYYq+lvrifFWL8WMGw2z4FxF7ufYYxoMulPsmVy/+SS:z5Bun/QXhFtIu4qE2TxFyfYJd0+7IqAM

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/ChilkatDotNet45.dll
unpack001/DOMView.dll
unpack001/Extensions.dll
unpack001/Extras.dll
unpack001/PDFImage.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

SecuriteInfo.com.Trojan.MSIL.Krypt.13987.3473.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:17:d9:2b:50:1f:6e:ec:5a:f7:ce:5a:b4:1d:ef:b1
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

07/03/2023, 00:00

Not After

06/03/2026, 23:59

Subject

CN=Aimco Software,O=Aimco Software,ST=Wales,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ca:03:3a:fe:8b:17:06:7d:15:a5:16:46:28:4f:7d:79:89:23:ea:6b
Signer

Actual PE Digest

ca:03:3a:fe:8b:17:06:7d:15:a5:16:46:28:4f:7d:79:89:23:ea:6b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/FindProcDLL.dll
.dll windows:4 windows x86 arch:x86

8df26927f8978d4eb40ff179c0aa961b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
lstrcmpA
OpenProcess
lstrcpyA
LoadLibraryA
CloseHandle
FreeLibrary
GetVersionExA
lstrlenA
GlobalFree

user32

wsprintfA

Exports

Exports

FindProc

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/INetC.dll
.dll windows:4 windows x86 arch:x86

8e4c63f70f7cc6490634d743e795c93e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateThread
CreateThread
LocalAlloc
lstrcpyA
WaitForSingleObject
MulDiv
ReadFile
GetModuleHandleA
SleepEx
lstrcatA
GetTickCount
CreateFileA
GetFileSize
DeleteFileA
lstrcmpA
lstrcmpiA
SetFilePointer
WriteFile
GetProcAddress
CloseHandle
lstrlenA
LoadLibraryA
lstrcpynA
LocalFree
GlobalAlloc
GlobalFree
GetLastError
WideCharToMultiByte

user32

LoadIconA
SystemParametersInfoA
GetWindowLongA
GetParent
MessageBoxA
DispatchMessageA
SetWindowLongA
KillTimer
PostMessageA
IsWindow
GetWindowTextA
ShowWindow
SendDlgItemMessageA
TranslateMessage
IsDialogMessageA
CreateDialogParamA
SetDlgItemTextA
GetWindowRect
SetWindowPos
SetTimer
SendMessageA
RedrawWindow
GetClientRect
EnableWindow
FindWindowExA
UpdateWindow
GetMessageA
GetDlgItem
wsprintfA
DestroyWindow
SetWindowTextA
IsWindowVisible

comctl32

ord17

wininet

InternetSetOptionA
InternetQueryOptionA
FtpCreateDirectoryA
InternetConnectA
InternetWriteFile
FtpOpenFileA
InternetSetFilePointer
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetGetLastResponseInfoA
InternetOpenA
InternetCrackUrlA
HttpOpenRequestA
HttpSendRequestExA
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetErrorDlg

Exports

Exports

get
head
post
put

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$_2_/Layouts/01 per sheet A4 Portrait.pl3
$_2_/Layouts/02 per sheet A4 Portrait.pl3
$_2_/Layouts/04 per sheet Landscape.pl3
$_2_/Layouts/08 per sheet A4 Portrait.pl3
$_2_/Layouts/14 per sheet A4 Portrait.pl3
$_2_/Layouts/21 per sheet A4 Portrait.pl3
$_2_/Layouts/Sample CN22 Invoice.pl3
$_2_/Layouts/Single A Bottom.pl3
$_2_/Layouts/Single A Top.pl3
$_2_/Layouts/Single B Bottom.pl3
$_2_/Layouts/Single B Top.pl3
$_2_/Layouts/Single C Bottom.pl3
$_2_/Layouts/Single C Top.pl3
$_2_/Templates/Cheap Integrated/D1 Bottom.pt3
$_2_/Templates/Cheap Integrated/D1 Top.pt3
$_2_/Templates/Cheap Integrated/D8 Bottom.pt3
$_2_/Templates/Cheap Integrated/S1 Bottom.pt3
$_2_/Templates/Cheap Integrated/S1 Top.pt3
$_2_/Templates/Cheap Integrated/S11 Bottom.pt3
$_2_/Templates/Cheap Integrated/S11 Top.pt3
$_2_/Templates/Cheap Integrated/S12 Bottom.pt3
$_2_/Templates/Cheap Integrated/S12 Top.pt3
$_2_/Templates/Cheap Integrated/S14 Top.pt3
$_2_/Templates/Cheap Integrated/S15 Bottom.pt3
$_2_/Templates/Cheap Integrated/S15 Top.pt3
$_2_/Templates/Cheap Integrated/S2 Bottom.pt3
$_2_/Templates/Cheap Integrated/S2 Top.pt3
$_2_/Templates/Cheap Integrated/S3 Bottom.pt3
$_2_/Templates/Cheap Integrated/S3 Top.pt3
$_2_/Templates/Cheap Integrated/S4 Bottom.pt3
$_2_/Templates/Cheap Integrated/S4 Top.pt3
$_2_/Templates/Cheap Integrated/S6 Bottom.pt3
$_2_/Templates/Cheap Integrated/S6 Top.pt3
$_2_/Templates/Cheap Integrated/S7 Bottom.pt3
$_2_/Templates/Cheap Integrated/S7 Top.pt3
$_2_/Templates/Cheap Integrated/S8 Bottom for Carrier Label.pt3
$_2_/Templates/Cheap Integrated/S8 Bottom.pt3
$_2_/Templates/Cheap Integrated/T3 Bottom.pt3
$_2_/Templates/Delivery and Invoice/2 per A4 portrait.pt3
$_2_/Templates/Delivery and Invoice/Delivery Note A4.pt3
$_2_/Templates/Delivery and Invoice/Invoice A4.pt3
$_2_/Templates/FormsPlus/FPD-1 Bottom.pt3
$_2_/Templates/FormsPlus/FPD-1 Top.pt3
$_2_/Templates/FormsPlus/FPS-1 Bottom.pt3
$_2_/Templates/FormsPlus/FPS-1 Top.pt3
$_2_/Templates/FormsPlus/FPS-2 Bottom.pt3
$_2_/Templates/FormsPlus/FPS-2 Top.pt3
$_2_/Templates/FormsPlus/FPS-3 Bottom.pt3
$_2_/Templates/FormsPlus/FPS-3 Top.pt3
$_2_/Templates/FormsPlus/FPS-4 Bottom.pt3
$_2_/Templates/FormsPlus/FPS-4 Top.pt3
$_2_/Templates/FormsPlus/FPS-5 Bottom.pt3
$_2_/Templates/FormsPlus/FPS-5 Top.pt3
$_2_/Templates/PickitPackit/Stock Label 1 Bottom.pt3
$_2_/Templates/PickitPackit/Stock Label 1 Top.pt3
$_2_/Templates/PickitPackit/Stock Label 2 Bottom.pt3
$_2_/Templates/PickitPackit/Stock Label 2 Top.pt3
$_2_/Templates/PickitPackit/Stock Label 5 Bottom.pt3
$_2_/Templates/PickitPackit/Stock Label 5 Top.pt3
$_2_/Templates/PickitPackit/Stock Label 6 Bottom.pl3
$_2_/Templates/PickitPackit/Stock Label 6 Bottom.pt3
$_2_/Templates/PickitPackit/Stock Label 6 Top.pt3
$_2_/Templates/Priory Direct/Double A Bottom.pt3
$_2_/Templates/Priory Direct/Double A Top.pt3
$_2_/Templates/Priory Direct/Double C Bottom.pt3
$_2_/Templates/Priory Direct/Double C Top.pt3
$_2_/Templates/Priory Direct/Double E Bottom.pt3
$_2_/Templates/Priory Direct/Single A Bottom.pt3
$_2_/Templates/Priory Direct/Single A Top.pt3
$_2_/Templates/Priory Direct/Single B Bottom.pt3
$_2_/Templates/Priory Direct/Single B Top.pt3
$_2_/Templates/Priory Direct/Single C Bottom.pt3
$_2_/Templates/Priory Direct/Single C Top.pt3
$_2_/Templates/Priory Direct/Single D Bottom.pt3
$_2_/Templates/Priory Direct/Single D Top.pt3
$_2_/Templates/Priory Direct/Single F Bottom.pt3
$_2_/Templates/Priory Direct/Single F Top.pt3
$_2_/Templates/Priory Direct/Single G Bottom.pt3
$_2_/Templates/Priory Direct/Single G Top.pt3
$_2_/Templates/Priory Direct/Single H Bottom.pt3
$_2_/Templates/Sheet Labels/01 per sheet A4 portrait.pt3
$_2_/Templates/Sheet Labels/02 per sheet A4 portrait.pt3
$_2_/Templates/Sheet Labels/04 per sheet A4 landscape.pt3
$_2_/Templates/Sheet Labels/04 per sheet A4 portrait.pt3
$_2_/Templates/Sheet Labels/04 per sheet portrait.pt3
$_2_/Templates/Sheet Labels/08 per sheet A4 portrait.pt3
$_2_/Templates/Sheet Labels/10 per sheet A4 portrait.pt3
$_2_/Templates/Sheet Labels/12 per sheet A4 portrait.pt3
$_2_/Templates/Sheet Labels/14 per sheet A4 portrait.pt3
$_2_/Templates/Sheet Labels/16 per sheet A4 portrait.pt3
$_2_/Templates/Sheet Labels/18 per sheet A4 portrait.pt3
$_2_/Templates/Sheet Labels/21 per sheet A4 portrait.pt3
$_2_/Templates/Sheet Labels/24 per sheet A4 portrait.pt3
$_2_/Templates/Thermal/Address 101x54.pt3
$_2_/Templates/Thermal/Large 89x36.pt3
$_2_/Templates/Thermal/Standard 89x28.pt3
$_2_/_mail/Order despatched.eml
.eml
email-plain-1.txt
.html
$_2_/_mail/Order processing.eml
.eml
email-html-2.txt
.html
email-plain-1.txt
$_2_/_mail/Retail Invoice.eml
.eml
email-plain-1.txt
.html
$_2_/_mail/Tax Invoice.eml
.eml
email-plain-1.txt
.html
$_2_/_mail/Your order has been despatched.eml
.eml
email-html-2.txt
.html
email-plain-1.txt
$_2_/_mail/Your order is being processed.eml
.eml
email-html-2.txt
.html
email-plain-1.txt
$_2_/_resource/Commercial_64.pl3
$_2_/_resource/Commercial_A4.pl3
ChilkatDotNet45.dll
.dll windows:6 windows x86 arch:x86

ea826cbd8aaa155576c306a3e31092f7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr110

_onexit
__dllonexit
_calloc_crt
_unlock
_lock
?terminate@@YAXXZ
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_initterm_e
_initterm
_malloc_crt
_amsg_exit
__CppXcptFilter
??1type_info@@UAE@XZ
srand
towlower
towupper
isalnum
fwrite
_fseeki64
ftell
fseek
fread
_fileno
fflush
ferror
_telli64
_filelengthi64
_filelength
_chsize_s
_atoi64
fgets
_mktime64
_localtime64_s
_tzset
_get_timezone
??2@YAPAXI@Z
__clean_type_info_names_internal
_except_handler4_common
__FrameUnwindFilter
_cexit
??_V@YAXPAX@Z
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
_get_daylight
realloc
malloc
free
strtol
_dupenv_s
atoi
atof
strnlen
_time64
fopen_s
fprintf
fclose
wcsstr
memmove
memchr
memcpy
strstr
_strnicmp
strncmp
_stricmp
tolower
toupper
memset
__CxxFrameHandler3
strchr
??3@YAXPAX@Z

kernel32

CreateFileMappingA
IsBadReadPtr
WideCharToMultiByte
UnmapViewOfFile
MapViewOfFile
DisableThreadLibraryCalls
GetCurrentProcessId
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
lstrcpyW
SetLastError
LocalFileTimeToFileTime
CreateSemaphoreA
WaitForSingleObject
ReleaseSemaphore
GetComputerNameA
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetVersionExA
GetCurrentThreadId
WriteFile
SetFileTime
SetEndOfFile
ReadFile
GetFileTime
GetFileSize
MoveFileExW
MoveFileW
CopyFileW
GetTempPathA
GetModuleFileNameW
GetTempPathW
SetFilePointer
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetLastError
QueryPerformanceCounter
Sleep
GetSystemTimeAsFileTime
GetTickCount
GetModuleFileNameA
FormatMessageA
GetComputerNameW
GetACP
GetOEMCP
CompareFileTime
GetSystemTime
GetLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
CloseHandle
CreateThread
GetProcAddress
LoadLibraryW
GetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFullPathNameW
RemoveDirectoryW
SetFileAttributesW
GetModuleHandleA

ws2_32

WSAIoctl
WSAGetLastError
WSAStartup
gethostname
gethostbyname
socket
shutdown
setsockopt
sendto
send
select
recv
ntohs
listen
inet_ntoa
inet_addr
htons
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet

advapi32

RegQueryValueExA
RegCloseKey
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptSetHashParam
CryptAcquireContextW
CryptEnumProvidersA
CryptGetUserKey
CryptGetProvParam
CryptGetKeyParam
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyExA
GetUserNameA
CryptGenRandom
CryptDestroyKey
CryptDeriveKey
CryptExportKey
CryptImportKey
CryptHashData
CryptGenKey

mscoree

_CorDllMain

Sections

.text
Size: 6.7MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 261KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 309KB - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DOMView.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 437KB - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Extensions.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\DevWin10\Projects\_.NET Projects\AiMCo Packing Partner\Packing Partner V4.0\Extension\obj\x86\Release\Extensions.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Extras.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

F>7 (
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Font/3of9.vbf
Font/3of9.z
Font/arialn.z
Font/arialnb.z
Font/helvetica.vbf
Font/helveticab.vbf
Font/helveticabi.vbf
Font/helveticai.vbf
Font/techncln.vbf
Font/techncln.z
Font/times.vbf
PDFImage.dll
.dll .js windows:4 windows x86 arch:x86 polyglot

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\DevWin10\Projects\_.NET Projects\Aimco DOMView\V112\PDFImage\obj\Release\PDFImage.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Packing Partner Backup.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

d7:58:45:a4:63:9e:9c:ca:90:63:bf:47:e1:4e:e0:0c
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/04/2020, 00:00

Not After

28/04/2023, 23:59

Subject

CN=Aimco Software,O=Aimco Software,POSTALCODE=SA48 8EZ,STREET=Pen Y Graig,L=Cwmann,ST=Carmarthenshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

86:6f:6f:b2:ee:0f:75:97:7b:b5:c6:c7:bd:b2:fc:10:0b:27:49:f0
Signer

Actual PE Digest

86:6f:6f:b2:ee:0f:75:97:7b:b5:c6:c7:bd:b2:fc:10:0b:27:49:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

P:\Public\Apps\_.NET Projects\AiMCo Packing Partner\Backup\obj\x86\Release\Packing Partner Backup.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Packing Partner Print.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

d7:58:45:a4:63:9e:9c:ca:90:63:bf:47:e1:4e:e0:0c
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/04/2020, 00:00

Not After

28/04/2023, 23:59

Subject

CN=Aimco Software,O=Aimco Software,POSTALCODE=SA48 8EZ,STREET=Pen Y Graig,L=Cwmann,ST=Carmarthenshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c0:87:bb:22:55:2d:ae:f1:a8:fa:b2:47:8a:6a:8e:3f:e1:0f:8b:04
Signer

Actual PE Digest

c0:87:bb:22:55:2d:ae:f1:a8:fa:b2:47:8a:6a:8e:3f:e1:0f:8b:04

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\DevWin10\Projects\_.NET Projects\AiMCo Packing Partner\Packing Partner V4.0\ExtPrint\obj\Release\Packing Partner Print.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Packing Partner V3.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:17:d9:2b:50:1f:6e:ec:5a:f7:ce:5a:b4:1d:ef:b1
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

07/03/2023, 00:00

Not After

06/03/2026, 23:59

Subject

CN=Aimco Software,O=Aimco Software,ST=Wales,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0b:04:a2:64:65:56:8e:bd:fd:89:48:3b:aa:57:51:0d:ef:d8:4d:46
Signer

Actual PE Digest

0b:04:a2:64:65:56:8e:bd:fd:89:48:3b:aa:57:51:0d:ef:d8:4d:46

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Packing Partner V3.exe.config
.xml
Packing Station.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:17:d9:2b:50:1f:6e:ec:5a:f7:ce:5a:b4:1d:ef:b1
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

07/03/2023, 00:00

Not After

06/03/2026, 23:59

Subject

CN=Aimco Software,O=Aimco Software,ST=Wales,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9d:22:8d:4b:96:ef:a5:62:33:ab:4f:be:c2:bf:ea:be:d9:12:74:9d
Signer

Actual PE Digest

9d:22:8d:4b:96:ef:a5:62:33:ab:4f:be:c2:bf:ea:be:d9:12:74:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Packing Station.exe.config
.xml

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

ef:17:d9:2b:50:1f:6e:ec:5a:f7:ce:5a:b4:1d:ef:b1Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

ca:03:3a:fe:8b:17:06:7d:15:a5:16:46:28:4f:7d:79:89:23:ea:6bSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 52KB - Virtual size: 52KB

8df26927f8978d4eb40ff179c0aa961b

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 104B

8e4c63f70f7cc6490634d743e795c93e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

comctl32

wininet

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 13KB

.data Size: 2KB - Virtual size: 15KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 1KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

ef:17:d9:2b:50:1f:6e:ec:5a:f7:ce:5a:b4:1d:ef:b1
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

ca:03:3a:fe:8b:17:06:7d:15:a5:16:46:28:4f:7d:79:89:23:ea:6b
Signer

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 52KB - Virtual size: 52KB

.text
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 104B

.text
Size: 14KB - Virtual size: 13KB

.data
Size: 2KB - Virtual size: 15KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 6.7MB - Virtual size: 6.7MB

.rdata
Size: 2.3MB - Virtual size: 2.3MB

.data
Size: 261KB - Virtual size: 284KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 309KB - Virtual size: 309KB

.text
Size: 437KB - Virtual size: 436KB

.rsrc
Size: 1024B - Virtual size: 1004B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 160KB - Virtual size: 160KB

.rsrc
Size: 1024B - Virtual size: 996B

.reloc
Size: 512B - Virtual size: 12B

F>7 (
Size: 25KB - Virtual size: 25KB

.text
Size: 57KB - Virtual size: 57KB

.rsrc
Size: 1024B - Virtual size: 812B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 2.7MB - Virtual size: 2.7MB

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 512B - Virtual size: 12B

d7:58:45:a4:63:9e:9c:ca:90:63:bf:47:e1:4e:e0:0c
Certificate