소방외부망연결[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

소방외부망연결.exe
Size

535KB
MD5

e0d65297833461da23808df8581d988e
SHA1

a4d29ea57733c7602a50f3447053c7a9c5888a85
SHA256

9cd18354d4587d38fd064accb89e49ce1d51f171b98f22b5baadd770fcaee53b
SHA512

e7e8a0bbf5dc4fe2f1a354c1419b18a1760551b6646230b8577fe42e937d54f43e67d882c17f0e1657913c863c96b77cc713968427cbefdc7fd13fb19dcc3591
SSDEEP

12288:ti6QQqdhT/FSR2gKaUdK6gMNhYs5Lcatw5DT0TD7BMDdbB:U6fqfFS8rdK6PNhuaC530jSDX

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/version.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/version.dll	upx

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/version.dll
unpack002/out.upx
unpack001/$TEMP/certadm.dll
unpack001/$TEMP/certutil.exe
unpack001/$TEMP/cryptnet.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

소방외부망연결.exe
.exe windows:4 windows x86 arch:x86

1c042238f43557c055fca8642de8a074

Code Sign

32:4f:72:fd:9d:c9:f2:76:15:7e:91:5f:b4:2c:6b:c9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/10/2017, 00:00

Not After

16/01/2019, 23:59

Subject

CN=SOMANSA Co.\,Ltd.,O=SOMANSA Co.\,Ltd.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:4f:72:fd:9d:c9:f2:76:15:7e:91:5f:b4:2c:6b:c9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/10/2017, 00:00

Not After

16/01/2019, 23:59

Subject

CN=SOMANSA Co.\,Ltd.,O=SOMANSA Co.\,Ltd.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

13:ca:dc:87:b3:3b:36:cd:b7:af:fd:8d:46:85:d7:ef:0a:18:5c:0c:0f:92:fb:52:d2:93:3d:2a:da:ad:0e:d5
Signer

Actual PE Digest

13:ca:dc:87:b3:3b:36:cd:b7:af:fd:8d:46:85:d7:ef:0a:18:5c:0c:0f:92:fb:52:d2:93:3d:2a:da:ad:0e:d5

Digest Algorithm

sha256

PE Digest Matches

true

84:2b:50:61:42:bd:cc:0f:c1:02:34:14:4f:71:d5:75:79:e4:dc:68
Signer

Actual PE Digest

84:2b:50:61:42:bd:cc:0f:c1:02:34:14:4f:71:d5:75:79:e4:dc:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
MulDiv
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
RegisterClassA
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
EmptyClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetForegroundWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

d83f71e61ee459ee63ca3e829966a9dc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
lstrcpyA
lstrcpynA
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
PeekNamedPipe
GetTickCount
CreateProcessA
GetStartupInfoA
CreatePipe
GetVersionExA
GetModuleHandleA
DeleteFileA
lstrcmpiA
lstrlenA
lstrcatA
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
GetProcAddress
GlobalLock
GetCurrentProcess

user32

SendMessageA
OemToCharBuffA
CharNextA
wsprintfA
CharPrevA
FindWindowExA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 410B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/version.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetWindowsVersion
IsWindows2000
IsWindows2003
IsWindows31
IsWindows95
IsWindows98
IsWindows98orLater
IsWindowsME
IsWindowsNT351
IsWindowsNT40
IsWindowsPlatform9x
IsWindowsPlatformNT
IsWindowsXP

Sections

UPX0
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 454B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/CertSetup.bat
$TEMP/ca.der
$TEMP/certadm.dll
.dll regsvr32 windows:5 windows x86 arch:x86

9def81300d9f42cc672af7d7039eb19e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

certadm.pdb

Imports

msvcrt

_adjust_fdiv
_initterm
wcscat
wcscmp
_wtoi
wcschr
wcsrchr
wcstoul
_purecall
wcscpy
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
free
malloc
iswalpha
_wcsnicmp
_except_handler3

atl

ord22
ord18
ord21
ord16
ord32
ord15

certcli

ord251
ord249
ord211
ord203
ord260
ord254
ord207
ord256
ord205
ord206
ord215

kernel32

FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
DisableThreadLibraryCalls
InitializeCriticalSection
VirtualFree
LocalAlloc
DeleteCriticalSection
LocalFree
lstrcmpiW
GetModuleFileNameW
GetModuleHandleW
GetCurrentProcess
GetPrivateProfileStringW
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetLastError
lstrlenW
VirtualAlloc
GetVersionExW
SetLastError
CompareStringW
WritePrivateProfileStringW
GetComputerNameW
FileTimeToSystemTime
GetSystemTime
SystemTimeToFileTime
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetComputerNameExW

advapi32

RegEnumValueW
RegQueryInfoKeyW
RegConnectRegistryW
RegCreateKeyW
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

user32

wsprintfW
LoadStringW

ole32

CoInitialize
CoInitializeEx
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstanceEx
CoSetProxyBlanket
CoUninitialize

oleaut32

SafeArrayGetDim
SafeArrayGetUBound
VariantInit
SetErrorInfo
CreateErrorInfo
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayPutElement
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayGetLBound
SysAllocString
SysFreeString
SysAllocStringByteLen
SysStringByteLen
VariantClear
LoadRegTypeLi

crypt32

CryptDecodeObjectEx

Exports

Exports

CertSrvBackupClose
CertSrvBackupEnd
CertSrvBackupFree
CertSrvBackupGetBackupLogsW
CertSrvBackupGetDatabaseNamesW
CertSrvBackupGetDynamicFileListW
CertSrvBackupOpenFileW
CertSrvBackupPrepareW
CertSrvBackupRead
CertSrvBackupTruncateLogs
CertSrvIsServerOnlineW
CertSrvRestoreEnd
CertSrvRestoreGetDatabaseLocationsW
CertSrvRestorePrepareW
CertSrvRestoreRegisterComplete
CertSrvRestoreRegisterThroughFile
CertSrvRestoreRegisterW
CertSrvServerControlW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/certutil.exe
.exe windows:5 windows x86 arch:x86

c74ec1242c5a191987c2a2004b210f4f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

certutil.pdb

Imports

msvcrt

__wgetmainargs
memmove
wcscat
wcscpy
gmtime
_errno
vfwprintf
fwrite
ftell
fgetc
_wfopen
fgetws
free
malloc
wcschr
_fgetwchar
fflush
_iob
wcsspn
wcscmp
wcsstr
_snwprintf
wcscspn
_except_handler3
_wsetlocale
_setmode
iswdigit
_strnicmp
swscanf
_stricmp
_wtoi
??3@YAXPAX@Z
_wcsicmp
sprintf
isdigit
atol
strncmp
fclose
strcspn
fseek
fputs
strstr
strchr
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
wcslen
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_ultow
_purecall
??2@YAPAXI@Z
wcsncpy
_wcsnicmp
wcsrchr
swprintf
fprintf
_strlwr
qsort
_swab
fopen
fgets

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCreateKeyExW
RegConnectRegistryW
LsaRetrievePrivateData
LsaStorePrivateData
AddAccessDeniedObjectAce
AddAccessAllowedObjectAce
CryptSignHashW
CryptSetProvParam
CryptDuplicateHash
CryptExportKey
LsaOpenPolicy
LsaFreeMemory
LsaClose
OpenThreadToken
LookupAccountNameW
RegOpenKeyW
RegEnumKeyExW
CryptVerifySignatureW
CryptGetDefaultProviderW
CryptGetKeyParam
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyW
IsValidSecurityDescriptor
GetSecurityDescriptorLength
RegOpenKeyExW
RegCreateKeyW
GetSecurityDescriptorDacl
AddAce
InitializeAcl
GetAclInformation
GetAce
SetNamedSecurityInfoW
AddAccessAllowedAce
AddAccessDeniedAce
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
RevertToSelf
ImpersonateSelf
CryptDestroyKey
CryptGetUserKey
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptEncrypt
CryptDuplicateKey
CryptDecrypt
CryptImportKey
CryptGenKey
CryptSetKeyParam
CopySid
GetLengthSid
GetTokenInformation
LookupAccountSidW
CryptEnumProvidersA
CryptGetProvParam
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegEnumValueW

kernel32

LeaveCriticalSection
GetVersionExW
GetComputerNameExW
SetConsoleCtrlHandler
CreateFileW
GetFileSize
SetFilePointer
ReadFile
QueryPerformanceCounter
EnterCriticalSection
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
GetComputerNameW
GetFileAttributesExW
GetEnvironmentVariableW
GetTempFileNameW
GetTickCount
OpenEventW
PulseEvent
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
LocalReAlloc
GetLastError
InitializeCriticalSection
DeleteCriticalSection
GetSystemDefaultLangID
FormatMessageW
DeleteFileW
lstrcmpiW
GetModuleHandleW
GetProcAddress
SetLastError
GetStdHandle
GetFileType
GetConsoleMode
SetConsoleMode
CreateThread
WaitForSingleObject
GetExitCodeThread
CloseHandle
GetSystemTime
SystemTimeToFileTime
lstrcmpW
CompareFileTime
LocalAlloc
GetSystemTimeAsFileTime
LocalFree
GetFileAttributesW
WriteFile
FreeLibrary
LoadLibraryW
FileTimeToSystemTime
LocalFileTimeToFileTime
GetTimeFormatW
GetDateFormatW
GetFullPathNameW
FindClose
FindNextFileW
FindFirstFileW
RemoveDirectoryW
CreateDirectoryW
FoldStringW
GetCurrentThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetSystemInfo
CompareStringW
FileTimeToLocalFileTime
GetEnvironmentVariableA
WideCharToMultiByte
GetACP
WriteConsoleW
MultiByteToWideChar
VirtualAlloc
VirtualFree
GetWindowsDirectoryA
lstrlenW
CreateEventW
ResetEvent
InterlockedIncrement
SetEvent
InterlockedDecrement
GetProfileStringA
LoadLibraryExW
GetCurrentProcess

certadm

ord22
ord20
ord12
ord8
ord7
ord9
ord11
ord5
ord10
ord17
ord6
ord13
ord18
ord14
ord21
ord15
ord16
ord19

certcli

ord211
ord242
CAAddCACertificateType
CARemoveCACertificateType
CAGetCAExpiration
CACountCertTypes
ord218
ord256
CAAccessCheck
CAFindByCertType
CAFindByName
CAGetCAProperty
ord208
CAEnumNextCA
CACloseCA
CAEnumCertTypesForCA
CAEnumCertTypes
CACertTypeAccessCheck
CAEnumNextCertType
CAGetCertTypeFlagsEx
CAGetCertTypePropertyEx
CAGetCertTypeKeySpec
CAGetCertTypeExpiration
CAGetCertTypeExtensions
CAFreeCertTypeExtensions
ord258
CAFindCertTypeByName
ord252
ord255
ord253
ord205
ord215
ord260
ord203
ord210
CAGetCACertificate
CACreateNewCA
CASetCAProperty
CASetCAFlags
CASetCACertificate
CASetCASecurity
CAUpdateCA
ord217
CAEnumFirstCA
CAFreeCAProperty
CACountCAs
CAGetCertTypeProperty
CAFreeCertTypeProperty
CACloseCertType
ord213
ord206
ord207
ord246
ord223
ord225
ord247
ord254

comctl32

InitCommonControlsEx

comdlg32

CommDlgExtendedError
GetSaveFileNameW
GetOpenFileNameW

crypt32

CryptExportPublicKeyInfo
CertSetStoreProperty
CertComparePublicKeyInfo
CertEnumCTLsInStore
CertDeleteCertificateFromStore
CertGetNameStringW
CertFindExtension
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCloseStore
CryptMsgClose
CertGetCTLContextProperty
CertEnumCTLContextProperties
CertEnumCRLContextProperties
CertEnumCertificateContextProperties
CertControlStore
CertAddCTLContextToStore
CertDeleteCRLFromStore
CertDuplicateCRLContext
CryptImportPublicKeyInfo
CertAddCRLContextToStore
CertVerifyRevocation
CertVerifyTimeValidity
CertVerifyCRLTimeValidity
CertVerifySubjectCertificateContext
CryptVerifyCertificateSignatureEx
CryptSignAndEncodeCertificate
CryptEncryptMessage
CryptFindOIDInfo
CryptDecryptMessage
CertStrToNameW
CertNameToStrW
CertGetEnhancedKeyUsage
CertVerifyCertificateChainPolicy
CertGetIntendedKeyUsage
CertAddCertificateLinkToStore
PFXExportCertStore
PFXExportCertStoreEx
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSignCertificate
CryptEncodeObjectEx
CryptDecodeObjectEx
CertSaveStore
CertCreateCertificateContext
CertOpenStore
CertSetCertificateContextProperty
CertFindCertificateInStore
CertFreeCRLContext
CertEnumCRLsInStore
CertCreateCRLContext
CryptDecodeObject
CertCompareCertificateName
CryptFormatObject
CertGetPublicKeyLength
CertEnumCertificatesInStore
CertAddEncodedCertificateToStore
CryptFindCertificateKeyProvInfo
CryptAcquireCertificatePrivateKey
CryptHashPublicKeyInfo
CertGetCRLContextProperty
CryptMsgGetParam
CryptMsgControl
CryptMsgGetAndVerifySigner
PFXIsPFXBlob
CertAddCertificateContextToStore
CryptVerifyCertificateSignature
CertDuplicateCertificateContext
CertFreeCTLContext
CertCreateCTLContext
CertFreeCertificateChain
CertGetCertificateChain
PFXImportCertStore

cryptnet

CryptRetrieveObjectByUrlW
CryptGetObjectUrl

cryptui

CryptUIDlgViewCertificateW
CryptUIDlgFreeCAContext
CryptUIDlgSelectCertificateW
CryptUIDlgViewCRLW

gdi32

GetStockObject

netapi32

NetApiBufferFree
NetUserGetGroups
DsGetDcNameW

ntdll

iswspace
_snprintf
isxdigit
__isascii
iswalpha
_wtol
iswxdigit
atoi
_alldiv
wcstoul
wcsncmp
sscanf
strspn
strpbrk
RtlTimeToSecondsSince1970
NtQuerySystemTime
_itoa

ntdsapi

DsBindW
DsFreeNameResultW
DsUnBindW
DsFreeDomainControllerInfoW
DsGetDomainControllerInfoW
DsCrackNamesW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree
StringFromCLSID
CLSIDFromProgID
CoCreateInstanceEx
CoSetProxyBlanket
CoTaskMemAlloc

oleaut32

VariantClear
SysAllocStringLen
VariantInit
SysAllocString
VariantTimeToSystemTime
SystemTimeToVariantTime
SetErrorInfo
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysStringLen
CreateErrorInfo

rpcrt4

UuidCreate

secur32

GetComputerObjectNameW
GetUserNameExW
TranslateNameW

setupapi

SetupGetStringFieldW
SetupGetIntField
SetupCloseInfFile
SetupOpenInfFileW
SetupFindFirstLineW
SetupGetLineCountW
SetupFindNextLine
SetupGetFieldCount

user32

PostQuitMessage
DispatchMessageW
wsprintfW
TranslateMessage
GetMessageW
PostMessageW
UpdateWindow
CreateWindowExW
RegisterClassW
LoadCursorW
LoadIconW
SendMessageW
MessageBoxW
GetWindowTextW
EnableWindow
GetDlgItem
SetDlgItemTextW
SetCursor
SetDlgItemInt
CheckDlgButton
SendDlgItemMessageA
EndDialog
GetDlgItemInt
GetDlgItemTextW
IsDlgButtonChecked
DialogBoxParamW
SetWindowTextW
CallWindowProcW
GetWindowLongW
ShowWindow
SetWindowLongW
SetFocus
LoadStringW
DefWindowProcW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

FindNextUrlCacheGroup
DeleteUrlCacheGroup
FindCloseUrlCache
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
InternetQueryDataAvailable
InternetReadFile
FindFirstUrlCacheGroup
HttpQueryInfoW
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetCanonicalizeUrlW
InternetCreateUrlW
InternetCrackUrlW
GetUrlCacheEntryInfoW

wldap32

ord127
ord41
ord167
ord142
ord79
ord140
ord224
ord113
ord27
ord26
ord36
ord210
ord155
ord65
ord208
ord73
ord14
ord145
ord13
ord203
ord12
ord18
ord16
ord147

winscard

SCardGetCardTypeProviderNameW
SCardListCardsW
SCardEstablishContext
SCardReleaseContext
SCardFreeMemory
SCardGetStatusChangeW
SCardListReadersW

Sections

.text
Size: 464KB - Virtual size: 464KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/cryptnet.dll
.dll regsvr32 windows:6 windows x86 arch:x86

829cf4f283f23c97d5d0040ce892f9ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cryptnet.pdb

Imports

msvcrt

_except_handler4_common
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
_ultow
wcstoul
iswspace
wcsstr
printf
wcschr
_wtol
_ltoa
wcstok
iswalnum
wcsncmp
strrchr
_vsnprintf
memset
memcpy
atol

advapi32

ImpersonateSelf
RevertToSelf
RegOpenKeyA
MD5Init
MD5Update
MD5Final
RegOpenKeyExW
RegQueryValueExW
OpenThreadToken
SetThreadToken
RegOpenKeyExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetAce
AllocateAndInitializeSid
EqualSid
FreeSid
RegQueryValueExA
RegCloseKey

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
Sleep
InterlockedExchange
CompareStringA
CompareStringW
WriteFile
LocalReAlloc
LocalAlloc
FileTimeToSystemTime
GlobalFree
LoadLibraryExA
FormatMessageW
LocalFree
ReadFile
GetFileAttributesExW
CreateFileW
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
SetFilePointer
GetModuleFileNameA
MultiByteToWideChar
CreateEventA
CreateThread
GetCurrentThread
CloseHandle
ResumeThread
WaitForSingleObjectEx
SetEvent
FreeLibraryAndExitThread
ExitThread
OutputDebugStringA
GetModuleFileNameW
LoadLibraryExW
DeleteCriticalSection
GetSystemTimeAsFileTime
GetLastError
GetSystemTime
SystemTimeToFileTime
SetLastError
EnterCriticalSection
LeaveCriticalSection
CompareFileTime
LoadLibraryA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
GetEnvironmentVariableA
DelayLoadFailureHook
DeleteFileW
GetFileSize
SetEndOfFile
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
ExpandEnvironmentStringsW
SetFileAttributesW
CreateDirectoryW
InitializeCriticalSection

crypt32

CryptStringToBinaryW
CryptGetOIDFunctionValue
CertDeleteCTLFromStore
CertFindCertificateInStore
CertGetCRLFromStore
CryptSignAndEncodeCertificate
CryptMemRealloc
CertEnumCRLsInStore
CertDeleteCRLFromStore
CertDeleteCertificateFromStore
CryptQueryObject
CertGetCRLContextProperty
CertGetCTLContextProperty
CryptMsgGetParam
CryptMsgControl
I_CertDiagControl
CertCreateCRLContext
CryptBinaryToStringW
CertEnumCertificatesInStore
CertAddEncodedCertificateToStore
CertAddStoreToCollection
CertDuplicateStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CryptVerifyCertificateSignatureEx
CertVerifyTimeValidity
CertGetEnhancedKeyUsage
CryptHashCertificate
CryptEncodeObjectEx
CertNameToStrW
CryptUnregisterDefaultOIDFunction
CryptUnregisterOIDFunction
CryptRegisterDefaultOIDFunction
CryptRegisterOIDFunction
I_CryptDetachTls
CryptInitOIDFunctionSet
CryptInstallOIDFunctionAddress
I_CryptAllocTls
I_CryptFreeTls
I_CryptSetTls
I_CryptCreateLruCache
I_CryptCreateLruEntry
CertSetCertificateContextProperty
CryptDecodeObjectEx
I_CryptFlushLruCache
I_CryptFindLruEntry
I_CryptGetLruEntryData
I_CryptEnumMatchingLruEntries
I_CryptReleaseLruEntry
I_CryptTouchLruEntry
I_CryptRemoveLruEntry
I_CryptInsertLruEntry
I_CryptFreeLruCache
CryptGetOIDFunctionAddress
CryptFreeOIDFunctionAddress
I_CryptGetTls
CryptMemFree
CryptMemAlloc
I_CertUpdateStore
CertFindCertificateInCRL
CertIsValidCRLForCertificate
CertDuplicateCRLContext
CertFindCRLInStore
CertEnumCTLsInStore
CertGetCertificateContextProperty
CertFreeCRLContext
CertCompareCertificateName
CertGetIssuerCertificateFromStore
CertFindExtension
CryptDecodeObject
CertFindCTLInStore
CertDuplicateCTLContext
CertFindSubjectInCTL
CertDuplicateCertificateContext
CertFreeCertificateContext
CertAddCTLContextToStore
CertFreeCTLContext
CertCloseStore
CertOpenStore
CryptMsgGetAndVerifySigner

wldap32

ord157
ord147
ord12
ord46
ord27
ord166
ord79
ord141
ord126
ord26
ord146
ord136
ord73
ord88
ord211
ord145
ord41
ord208
ord210
ord18

sensapi

IsNetworkAlive

shlwapi

StrStrIW
UrlUnescapeW
UrlGetPartW

Exports

Exports

CertDllVerifyCTLUsage
CertDllVerifyRevocation
CryptCancelAsyncRetrieval
CryptFlushTimeValidObject
CryptGetObjectUrl
CryptGetTimeValidObject
CryptInstallCancelRetrieval
CryptRetrieveObjectByUrlA
CryptRetrieveObjectByUrlW
CryptUninstallCancelRetrieval
DllRegisterServer
DllUnregisterServer
I_CryptNetEnumUrlCacheEntry
I_CryptNetGetHostNameFromUrl
I_CryptNetGetUserDsStoreUrl
I_CryptNetIsConnected
I_CryptNetSetUrlCacheFlushInfo
I_CryptNetSetUrlCachePreFetchInfo
LdapProvOpenStore

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c042238f43557c055fca8642de8a074

Code Sign

32:4f:72:fd:9d:c9:f2:76:15:7e:91:5f:b4:2c:6b:c9Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

32:4f:72:fd:9d:c9:f2:76:15:7e:91:5f:b4:2c:6b:c9Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

13:ca:dc:87:b3:3b:36:cd:b7:af:fd:8d:46:85:d7:ef:0a:18:5c:0c:0f:92:fb:52:d2:93:3d:2a:da:ad:0e:d5Signer

84:2b:50:61:42:bd:cc:0f:c1:02:34:14:4f:71:d5:75:79:e4:dc:68Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 156KB

.ndata Size: - Virtual size: 44KB

.rsrc Size: 16KB - Virtual size: 16KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

d83f71e61ee459ee63ca3e829966a9dc

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

32:4f:72:fd:9d:c9:f2:76:15:7e:91:5f:b4:2c:6b:c9
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

32:4f:72:fd:9d:c9:f2:76:15:7e:91:5f:b4:2c:6b:c9
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

13:ca:dc:87:b3:3b:36:cd:b7:af:fd:8d:46:85:d7:ef:0a:18:5c:0c:0f:92:fb:52:d2:93:3d:2a:da:ad:0e:d5
Signer

84:2b:50:61:42:bd:cc:0f:c1:02:34:14:4f:71:d5:75:79:e4:dc:68
Signer

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 156KB

.ndata
Size: - Virtual size: 44KB

.rsrc
Size: 16KB - Virtual size: 16KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 410B

UPX0
Size: - Virtual size: 36KB

UPX1
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

CODE
Size: 5KB - Virtual size: 4KB

DATA
Size: 512B - Virtual size: 144B

BSS
Size: - Virtual size: 1KB

.idata
Size: 512B - Virtual size: 454B

.edata
Size: 512B - Virtual size: 376B

.reloc
Size: 1024B - Virtual size: 536B

.rsrc
Size: 512B - Virtual size: 512B

.text
Size: 65KB - Virtual size: 65KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 7KB - Virtual size: 6KB