2024-05-30_c024ddaa9d2dd896f198049ade9aaebe_bkransomware

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-30_c024ddaa9d2dd896f198049ade9aaebe_bkransomware
Size

6.4MB
MD5

c024ddaa9d2dd896f198049ade9aaebe
SHA1

89da21a07d9b8595045c7cb89a6d155fa96915a1
SHA256

37336f3d108a03ab5e253f46af74238212270a8e14c10c47accc3e302e59ad68
SHA512

11c3dda88c6fb1c5df1e1a2ffead2841909f4fce62c342ee190cf2e56967216ad69e37efdd8985a7a8f419c0eaca5dc696ff1f234074df048ccf585e18213a3e
SSDEEP

196608:FLniaG+v7HjNrCeKQYJ7Btbl29bN2v4S/Pd2lLogyXs3C+n:ZiaNv7HjNrCeKQYJ7Pbl29bN2v4S/PC1

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Files

2024-05-30_c024ddaa9d2dd896f198049ade9aaebe_bkransomware
.exe windows:6 windows x86 arch:x86

63084c8957586d280525c441158f9500

Code Sign

01
Certificate

Issuer

CN=Gramblr CA,OU=Security,O=Gramblr Team,C=CA

Not Before

17/09/2015, 14:13

Not After

16/09/2020, 14:13

Subject

CN=Gramblr,OU=Security,O=Gramblr,L=Qubec,ST=Qubec,C=CA,1.2.840.113549.1.9.1=#0c10696e666f406772616d626c722e636f6d

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e3:cd:7a:2b:4d:6e:75:88:d7:e1:da:31:8a:2b:5e:8e:23:49:90:f9
Signer

Actual PE Digest

e3:cd:7a:2b:4d:6e:75:88:d7:e1:da:31:8a:2b:5e:8e:23:49:90:f9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetProcessMemoryInfo

advapi32

RegQueryValueExW
RegOpenKeyW
OpenSCManagerW
DeleteService
ControlService
StartServiceW
StartServiceCtrlDispatcherW
CloseServiceHandle
CreateServiceW
SetServiceStatus
OpenServiceW
QueryServiceStatus
RegisterServiceCtrlHandlerW
FreeSid
CheckTokenMembership
ChangeServiceConfig2W
AllocateAndInitializeSid
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
RegOpenKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegEnumValueW
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegDeleteValueW
RegSetValueExW
RegQueryInfoKeyW

user32

GetDesktopWindow
GetTopWindow
GetWindow
GetWindowThreadProcessId
MessageBoxA
GetSystemMetrics
CreateWindowExW
GetInputState
GetCaretPos
GetCursorPos
GetMessagePos
GetMessageTime
GetWindowLongA
SetWindowLongA
MsgWaitForMultipleObjectsEx
TranslateMessage
DispatchMessageW
RegisterClassW
PeekMessageW
SetTimer
PostMessageA
DefWindowProcA
PostThreadMessageW
KillTimer

ws2_32

setsockopt
WSASocketW
closesocket
recv
recvfrom
GetAddrInfoW
WSAStringToAddressW
FreeAddrInfoW
WSAAccept
WSAAsyncSelect
connect
send
bind
getsockname
WSAStartup
WSAGetLastError
sendto
listen
shutdown
WSAIoctl

ole32

CoUninitialize
CoInitialize
CoCreateInstance

shell32

ShellExecuteExW

kernel32

SuspendThread
GetThreadContext
MapViewOfFileEx
GetEnvironmentVariableA
RtlCaptureContext
CreatePipe
CreateProcessW
GetHandleInformation
SetHandleInformation
SwitchToThread
GetExitCodeThread
ExpandEnvironmentStringsW
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
lstrlenW
GetExitCodeProcess
GetModuleHandleA
SetEnvironmentVariableW
GetEnvironmentVariableW
CreateSemaphoreA
ReleaseSemaphore
MoveFileExW
ResumeThread
VirtualAlloc
VirtualFree
CopyFileW
QueryPerformanceFrequency
FindFirstFileW
FindClose
FindNextFileW
DuplicateHandle
WriteConsoleW
SetEnvironmentVariableA
GetStringTypeW
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
InterlockedCompareExchange
LCMapStringW
CompareStringW
SetFilePointerEx
ReadConsoleW
SetStdHandle
RaiseException
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetConsoleMode
GetCurrentProcessId
GetModuleFileNameW
CloseHandle
GlobalMemoryStatusEx
LocalFree
ResetEvent
GetSystemTimeAsFileTime
GetVersionExW
CreateWaitableTimerW
VerSetConditionMask
GetLastError
WaitForMultipleObjects
VerifyVersionInfoW
SetWaitableTimer
SetEvent
GetUserDefaultLangID
CreateDirectoryW
FormatMessageA
SetThreadExecutionState
GetCurrentProcess
CreateEventW
DeleteFileA
AreFileApisANSI
GetSystemTime
GetTempPathA
DeleteFileW
GetVersionExA
OutputDebugStringA
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingW
CreateFileMappingA
LoadLibraryA
GetDiskFreeSpaceW
LockFileEx
HeapSize
GetProcAddress
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
CreateFileW
ReadFile
GetFileAttributesW
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
FormatMessageW
Sleep
LoadLibraryW
WideCharToMultiByte
WriteFile
GetProcessHeap
UnlockFileEx
GetTickCount
OutputDebugStringW
WaitForSingleObjectEx
LockFile
FlushViewOfFile
UnlockFile
FileTimeToSystemTime
WaitForSingleObject
HeapFree
QueryPerformanceCounter
SystemTimeToFileTime
HeapAlloc
FreeLibrary
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
ReadFileEx
WriteFileEx
Heap32ListNext
Heap32First
CreateToolhelp32Snapshot
GlobalMemoryStatus
Heap32Next
Heap32ListFirst
Module32First
Module32Next
Thread32First
Thread32Next
Process32First
Process32Next
SetThreadPriority
GetCurrentThread
ReadDirectoryChangesW
RtlUnwind
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
CreateThread
ExitThread
LoadLibraryExW
SetConsoleCtrlHandler
SetFileAttributesW
GetFileType
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleCP

wsock32

accept
inet_ntoa
gethostbyaddr
gethostbyname
getpeername
socket
getprotobynumber
getprotobyname
getservbyport
getservbyname
ioctlsocket
inet_addr
WSACleanup
getsockopt

Exports

Exports

ARRAYID_PathProperties
BFID_GRAY_16
BFID_GRAY_8
BFID_MONOCHROME
BFID_RGBA_32
BFID_RGB_24
BFID_RGB_32
BFID_RGB_4
BFID_RGB_555
BFID_RGB_565
BFID_RGB_8
BHID_LinkTargetItem
BHID_SFObject
BHID_SFUIObject
BHID_SFViewObject
BHID_Storage
BHID_StorageEnum
BHID_Stream
CATID_BrowsableShellExt
CATID_BrowseInPlace
CATID_ClusCfgCapabilities
CATID_ClusCfgMemberSetChangeListener
CATID_ClusCfgResourceTypes
CATID_ClusCfgStartupListeners
CATID_CommBand
CATID_Control
CATID_DesignTimeUIActivatableControl
CATID_DeskBand
CATID_DocObject
CATID_EnumClusCfgManagedResources
CATID_InfoBand
CATID_Insertable
CATID_InternetAware
CATID_IsShortcut
CATID_MARSHALER
CATID_NeverShowExt
CATID_PersistsToFile
CATID_PersistsToMemory
CATID_PersistsToMoniker
CATID_PersistsToPropertyBag
CATID_PersistsToStorage
CATID_PersistsToStream
CATID_PersistsToStreamInit
CATID_Printable
CATID_Programmable
CATID_RequiresDataPathHost
CATID_SafeForInitializing
CATID_SafeForScripting
CGID_DocHostCommandHandler
CGID_DownloadHost
CGID_Explorer
CGID_ExplorerBarDoc
CGID_InternetExplorer
CGID_MSHTML
CGID_ShellDocView
CGID_ShellServiceObject
CGID_ShortCut
CLSID_1
CLSID_2
CLSID_3
CLSID_4
CLSID_5
CLSID_6
CLSID_7
CLSID_8
CLSID_9
CLSID_ACLCustomMRU
CLSID_ACLHistory
CLSID_ACLMRU
CLSID_ACLMulti
CLSID_ACListISF
CLSID_ADSystemInfo
CLSID_ADsDSOObject
CLSID_ADsSecurityUtility
CLSID_AboutProtocol
CLSID_AccessControlEntry
CLSID_AccessControlList
CLSID_AccountDiscovery
CLSID_ActiveDesktop
CLSID_AdapterInfo
CLSID_AddrControl
CLSID_AddressBarParser
CLSID_AlgSetup
CLSID_AllClasses
CLSID_AlphabeticalCategorizer
CLSID_AnchorClick
CLSID_AnimationComposerFactory
CLSID_AnimationComposerSiteFactory
CLSID_ApplicationGatewayServices
CLSID_AutoComplete
CLSID_AutoDiscoveryProvider
CLSID_AutoplayForSlideShow
CLSID_BackLink
CLSID_BackgroundCopyManager
CLSID_BackgroundCopyManager1_5
CLSID_BackgroundCopyQMgr
CLSID_BasicImageEffects
CLSID_BasicImageEffectsPP
CLSID_BlockFormats
CLSID_BridgeTerminal
CLSID_CAccPropServices
CLSID_CActiveIMM
CLSID_CAnchorBrowsePropertyPage
CLSID_CCheckBox
CLSID_CColorPropPage
CLSID_CCombobox
CLSID_CDBurn
CLSID_CDLAgent
CLSID_CDebugDocumentHelper
CLSID_CDeviceRect
CLSID_CDirect3DRM
CLSID_CDirect3DRMAnimation
CLSID_CDirect3DRMAnimationSet
CLSID_CDirect3DRMClippedVisual
CLSID_CDirect3DRMDevice
CLSID_CDirect3DRMFace
CLSID_CDirect3DRMFrame
CLSID_CDirect3DRMFrameInterpolator
CLSID_CDirect3DRMLight
CLSID_CDirect3DRMLightInterpolator
CLSID_CDirect3DRMMaterial
CLSID_CDirect3DRMMaterialInterpolato
CLSID_CDirect3DRMMesh
CLSID_CDirect3DRMMeshBuilder
CLSID_CDirect3DRMMeshInterpolator
CLSID_CDirect3DRMProgressiveMesh
CLSID_CDirect3DRMShadow
CLSID_CDirect3DRMTexture
CLSID_CDirect3DRMTextureInterpolator
CLSID_CDirect3DRMUserVisual
CLSID_CDirect3DRMViewport
CLSID_CDirect3DRMViewportInterpolato
CLSID_CDirect3DRMWrap
CLSID_CDirectXFile
CLSID_CDocBrowsePropertyPage
CLSID_CDownloadBehavior
CLSID_CEnroll
CLSID_CEventObj
CLSID_CFSIconOverlayManager
CLSID_CFontPropPage
CLSID_CHeaderFooter
CLSID_CHtmlArea
CLSID_CIEOptionElement
CLSID_CIESelectElement
CLSID_CImageBrowsePropertyPage
CLSID_CLayoutRect
CLSID_CMLangConvertCharset
CLSID_CMLangString
CLSID_CMimeTypes
CLSID_CMultiLanguage
CLSID_CNetCfg
CLSID_COpsProfile
CLSID_CPersistDataPeer
CLSID_CPersistHistory
CLSID_CPersistShortcut
CLSID_CPersistSnapshot
CLSID_CPersistUserData
CLSID_CPicturePropPage
CLSID_CPlugins
CLSID_CRadioButton
CLSID_CScriptErrorList
CLSID_CScrollBar
CLSID_CSliderBar
CLSID_CSpinButton
CLSID_CTemplatePrinter
CLSID_CURLSearchHook
CLSID_CUrlHistory
CLSID_CUtilityButton
CLSID_CaseIgnoreList
CLSID_CdlProtocol
CLSID_ChannelAgent
CLSID_ChannelMgr
CLSID_ClassInstallFilter
CLSID_ClientCaps
CLSID_ClusAppWiz
CLSID_ClusCfgAsyncEvictCleanup
CLSID_ClusCfgEvictCleanup
CLSID_ClusCfgResTypeGenScript
CLSID_ClusCfgResTypeMajorityNodeSet
CLSID_ClusCfgResTypeServices
CLSID_ClusCfgStartupNotify
CLSID_ClusCfgWizard
CLSID_ClusterConfigurationType
CLSID_CoDitherToRGB8
CLSID_CoMapMIMEToCLSID
CLSID_CoSniffStream
CLSID_ComBinding
CLSID_CommonQuery
CLSID_CompositePP
CLSID_ConnectionCommonUi
CLSID_ConnectionManager
CLSID_ConnectionManager2
CLSID_ControlPanel
CLSID_ConvertVBX
CLSID_ConvolvePP
CLSID_CrBarn
CLSID_CrBarnPP
CLSID_CrBlindPP
CLSID_CrBlinds
CLSID_CrBlur
CLSID_CrBlurPP
CLSID_CrEmboss
CLSID_CrEngrave
CLSID_CrInset
CLSID_CrIris
CLSID_CrIrisPP
CLSID_CrRadialWipe
CLSID_CrRadialWipePP
CLSID_CrSlide
CLSID_CrSlidePP
CLSID_CrSpiral
CLSID_CrSpiralPP
CLSID_CrStretch
CLSID_CrStretchPP
CLSID_CrWheel
CLSID_CrWheelPP
CLSID_CrZigzag
CLSID_CrZigzagPP
CLSID_CurrentUserClasses
CLSID_DAArray
CLSID_DABbox2
CLSID_DABbox3
CLSID_DABehavior
CLSID_DABoolean
CLSID_DACamera
CLSID_DAColor
CLSID_DADashStyle
CLSID_DAEndStyle
CLSID_DAEvent
CLSID_DAFontStyle
CLSID_DAGeometry
CLSID_DAImage
CLSID_DAImportationResult
CLSID_DAJoinStyle
CLSID_DALineStyle
CLSID_DAMatte
CLSID_DAMicrophone
CLSID_DAMontage
CLSID_DANumber
CLSID_DAPair
CLSID_DAPath2
CLSID_DAPickableResult
CLSID_DAPoint2
CLSID_DAPoint3
CLSID_DASound
CLSID_DAStatics
CLSID_DAString
CLSID_DATransform2
CLSID_DATransform3
CLSID_DATuple
CLSID_DAUserData
CLSID_DAVector2
CLSID_DAVector3
CLSID_DAView
CLSID_DAViewerControl
CLSID_DAViewerControlWindowed
CLSID_DCOMAccessControl
CLSID_DNWithBinary
CLSID_DNWithString
CLSID_DOMChildrenCollection
CLSID_DOMDocument
CLSID_DOMFreeThreadedDocument
CLSID_DWbemClassObject
CLSID_DWbemContext
CLSID_DWbemLocator
CLSID_DX2D
CLSID_DXFade
CLSID_DXGradient
CLSID_DXLUTBuilder
CLSID_DXRasterizer
CLSID_DXSurface
CLSID_DXSurfaceModifier
CLSID_DXTAlpha
CLSID_DXTAlphaImageLoader
CLSID_DXTAlphaImageLoaderPP
CLSID_DXTAlphaPP
CLSID_DXTBarn
CLSID_DXTBlinds
CLSID_DXTCheckerBoard
CLSID_DXTCheckerBoardPP
CLSID_DXTChroma
CLSID_DXTChromaPP
CLSID_DXTComposite
CLSID_DXTConvolution
CLSID_DXTDropShadow
CLSID_DXTDropShadowPP
CLSID_DXTFilter
CLSID_DXTFilterBehavior
CLSID_DXTFilterCollection
CLSID_DXTFilterFactory
CLSID_DXTGlow
CLSID_DXTGlowPP
CLSID_DXTGradientD
CLSID_DXTGradientWipe
CLSID_DXTICMFilter
CLSID_DXTICMFilterPP
CLSID_DXTInset
CLSID_DXTIris
CLSID_DXTLabel
CLSID_DXTLight
CLSID_DXTLightPP
CLSID_DXTMaskFilter
CLSID_DXTMatrix
CLSID_DXTMatrixPP
CLSID_DXTMetaBurnFilm
CLSID_DXTMetaCenterPeel
CLSID_DXTMetaColorFade
CLSID_DXTMetaFlowMotion
CLSID_DXTMetaGriddler
CLSID_DXTMetaGriddler2
CLSID_DXTMetaJaws
CLSID_DXTMetaLightWipe
CLSID_DXTMetaLiquid
CLSID_DXTMetaPageTurn
CLSID_DXTMetaPeelPiece
CLSID_DXTMetaPeelSmall
CLSID_DXTMetaPeelSplit
CLSID_DXTMetaRadialScaleWipe
CLSID_DXTMetaRipple
CLSID_DXTMetaRoll
CLSID_DXTMetaThreshold
CLSID_DXTMetaTwister
CLSID_DXTMetaVacuum
CLSID_DXTMetaWater
CLSID_DXTMetaWhiteOut
CLSID_DXTMetaWormHole
CLSID_DXTMotionBlur
CLSID_DXTMotionBlurPP
CLSID_DXTRadialWipe
CLSID_DXTRandomBars
CLSID_DXTRandomBarsPP
CLSID_DXTRandomDissolve
CLSID_DXTRedirect
CLSID_DXTRevealTrans
CLSID_DXTScale
CLSID_DXTShadow
CLSID_DXTShadowPP
CLSID_DXTSlide
CLSID_DXTSpiral
CLSID_DXTStretch
CLSID_DXTStrips
CLSID_DXTStripsPP
CLSID_DXTWave
CLSID_DXTWavePP
CLSID_DXTWipe
CLSID_DXTWipePP
CLSID_DXTZigzag
CLSID_DXTaskManager
CLSID_DXTransformFactory
CLSID_DarwinAppPublisher
CLSID_DataChannel
CLSID_DeCompMimeFilter
CLSID_DebugHelper
CLSID_DefaultDebugSessionProvider
CLSID_DirectDraw
CLSID_DirectDrawClipper
CLSID_DirectDrawFactory2
CLSID_DirectInput
CLSID_DirectInputDevice
CLSID_DirectMusic
CLSID_DirectMusicBand
CLSID_DirectMusicBandTrack
CLSID_DirectMusicChordMap
CLSID_DirectMusicChordMapTrack
CLSID_DirectMusicChordTrack
CLSID_DirectMusicCollection
CLSID_DirectMusicCommandTrack
CLSID_DirectMusicComposer
CLSID_DirectMusicGraph
CLSID_DirectMusicLoader
CLSID_DirectMusicMotifTrack
CLSID_DirectMusicMuteTrack
CLSID_DirectMusicPerformance
CLSID_DirectMusicSegment
CLSID_DirectMusicSegmentState
CLSID_DirectMusicSeqTrack
CLSID_DirectMusicSignPostTrack
CLSID_DirectMusicStyle
CLSID_DirectMusicStyleTrack
CLSID_DirectMusicSynth
CLSID_DirectMusicSysExTrack
CLSID_DirectMusicTempoTrack
CLSID_DirectMusicTimeSigTrack
CLSID_DirectPlay
CLSID_DirectPlayLobby
CLSID_DirectSound
CLSID_DirectSoundCapture
CLSID_DispatchMapper
CLSID_DocFileColumnProvider
CLSID_DocHostUIHandler
CLSID_DragDropHelper
CLSID_DriveSizeCategorizer
CLSID_DriveTypeCategorizer
CLSID_DsDisplaySpecifier
CLSID_DsDomainTreeBrowser
CLSID_DsFindAdvanced
CLSID_DsFindComputer
CLSID_DsFindContainer
CLSID_DsFindDomainController
CLSID_DsFindFrsMembers
CLSID_DsFindObjects
CLSID_DsFindPeople
CLSID_DsFindPrinter
CLSID_DsFindVolume
CLSID_DsFolderProperties
CLSID_DsPropertyPages
CLSID_DsQuery
CLSID_EAPOLManager
CLSID_EVENTQUEUE
CLSID_EXTENDEDERRORINFO
CLSID_Email
CLSID_EnumAdapterInfo
CLSID_FadePP
CLSID_FaxNumber
CLSID_FilePlaybackTerminal
CLSID_FileProtocol
CLSID_FileRecordingTerminal
CLSID_FileRecordingTrack
CLSID_FileSearchBand
CLSID_FileSysColumnProvider
CLSID_FileTerminal
CLSID_FolderShortcut
CLSID_FolderViewHost
CLSID_FontNames
CLSID_FramesCollection
CLSID_FreeSpaceCategorizer
CLSID_FtpProtocol
CLSID_GLOBAL_BROADCAST
CLSID_GblComponentCategoriesMgr
CLSID_GopherProtocol
CLSID_GradientPP
CLSID_HNetCfgMgr
CLSID_HTADocument
CLSID_HTCAttachBehavior
CLSID_HTCDefaultDispatch
CLSID_HTCDescBehavior
CLSID_HTCEventBehavior
CLSID_HTCMethodBehavior
CLSID_HTCPropertyBehavior
CLSID_HTMLAnchorElement
CLSID_HTMLAppBehavior
CLSID_HTMLApplication
CLSID_HTMLAreaElement
CLSID_HTMLAreasCollection
CLSID_HTMLAttributeCollection
CLSID_HTMLBGsound
CLSID_HTMLBRElement
CLSID_HTMLBaseElement
CLSID_HTMLBaseFontElement
CLSID_HTMLBlockElement
CLSID_HTMLBody
CLSID_HTMLButtonElement
CLSID_HTMLCommentElement
CLSID_HTMLCurrentStyle
CLSID_HTMLDDElement
CLSID_HTMLDListElement
CLSID_HTMLDOMAttribute
CLSID_HTMLDOMImplementation
CLSID_HTMLDOMTextNode
CLSID_HTMLDTElement
CLSID_HTMLDefaults
CLSID_HTMLDialog
CLSID_HTMLDivElement
CLSID_HTMLDivPosition
CLSID_HTMLDocument
CLSID_HTMLElementCollection
CLSID_HTMLEmbed
CLSID_HTMLFieldSetElement
CLSID_HTMLFontElement
CLSID_HTMLFormElement
CLSID_HTMLFrameBase
CLSID_HTMLFrameElement
CLSID_HTMLFrameSetSite
CLSID_HTMLGenericElement
CLSID_HTMLHRElement
CLSID_HTMLHeadElement
CLSID_HTMLHeaderElement
CLSID_HTMLHistory
CLSID_HTMLHtmlElement
CLSID_HTMLIFrame
CLSID_HTMLImageElementFactory
CLSID_HTMLImg
CLSID_HTMLInputButtonElement
CLSID_HTMLInputElement
CLSID_HTMLInputFileElement
CLSID_HTMLInputImage
CLSID_HTMLInputTextElement
CLSID_HTMLIsIndexElement
CLSID_HTMLLIElement
CLSID_HTMLLabelElement
CLSID_HTMLLegendElement
CLSID_HTMLLinkElement
CLSID_HTMLListElement
CLSID_HTMLLoadOptions
CLSID_HTMLLocation
CLSID_HTMLMapElement
CLSID_HTMLMarqueeElement
CLSID_HTMLMetaElement
CLSID_HTMLNamespace
CLSID_HTMLNamespaceCollection

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 255KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.7MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

._deh
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.minfo
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63084c8957586d280525c441158f9500

Code Sign

01Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

e3:cd:7a:2b:4d:6e:75:88:d7:e1:da:31:8a:2b:5e:8e:23:49:90:f9Signer

Headers

DLL Characteristics

File Characteristics

Imports

psapi

advapi32

user32

ws2_32

ole32

shell32

kernel32

wsock32

Exports

Exports

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.rdata Size: 255KB - Virtual size: 255KB

.data Size: 1.7MB - Virtual size: 1.8MB

.tls Size: 5KB - Virtual size: 5KB

._deh Size: 512B - Virtual size: 8B

.minfo Size: 2KB - Virtual size: 2KB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 249KB - Virtual size: 248KB

01
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

e3:cd:7a:2b:4d:6e:75:88:d7:e1:da:31:8a:2b:5e:8e:23:49:90:f9
Signer

.text
Size: 4.2MB - Virtual size: 4.2MB

.rdata
Size: 255KB - Virtual size: 255KB

.data
Size: 1.7MB - Virtual size: 1.8MB

.tls
Size: 5KB - Virtual size: 5KB

._deh
Size: 512B - Virtual size: 8B

.minfo
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 249KB - Virtual size: 248KB