4[.]7z | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

4.7z
Size

2.3MB
MD5

b330c2311212fa2495a06c74d99057fc
SHA1

e6a579013cd9618435a7a83ef0563dd99d93588c
SHA256

650957bed5d5a40da914d5e2d3c5dab5cd031d4d931ea7638f33fc65c2e8840b
SHA512

bc4a9b837fe6d26c13c61740d39b3881322367d8be84d0ac1e3bfcee3749786d5a2a44894b03afa786ce3502fc27f3e8d9d49e4d8ae46df8c6c61f6437f32864
SSDEEP

49152:jNHyB3E1a6kwpgMMmDu7Xp8BBoTlQTXQvE8s3JZeANmmVEwEjUiGlnlPB:jNSRVD9MM575UoTlNg3eANBI8ltB

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DAQDeviceControl.exe
unpack001/RBGUIFramework.dll

Files

4.7z
.7z
DAQDeviceControl.exe
.exe windows:6 windows x86 arch:x86

7dc2d630179462e2c40299b1aed7c454

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
OpenEventW
GetFileAttributesW
GetModuleFileNameW
lstrlenW
CreateFileW
SetFilePointerEx
WriteFile
GetTempPathW
WaitForSingleObject
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
GetExitCodeThread
CreateProcessW
VirtualAlloc
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
lstrcatW
K32GetModuleBaseNameW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapQueryInformation
HeapReAlloc
HeapSize
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetProcAddress
GetCurrentThreadId
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetACP
HeapValidate
GetSystemInfo
GetCurrentThread
GetFileType
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
OutputDebugStringA
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
DecodePointer

user32

CreateWindowExW
ShowWindow
DefWindowProcW
GetWindow
GetDesktopWindow
GetWindowTextA
PostMessageW
RegisterClassW

shell32

ShellExecuteW

shlwapi

PathFileExistsW

Sections

.text
Size: 673KB - Virtual size: 672KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 1024B - Virtual size: 829B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Version
Size: 1024B - Virtual size: 563B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Permissions.exe
.exe windows:5 windows x86 arch:x86

c0abd2a9ced2aff011b95e548be54599

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17-11-2006 00:00

Not After

16-07-2036 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:65:0e:12:20:7b:d6:9b:81:cd:54:b8:7f:2a:db:87
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

02-09-2015 00:00

Not After

01-09-2017 23:59

Subject

CN=Silhouette Research & Technology Ltd,O=Silhouette Research & Technology Ltd,L=Plymouth,ST=Devon,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:64:09:22:34:f2:5b:a6:ef:62:2b:36:e7:74:f7:9b:77:b4:a5:d1
Signer

Actual PE Digest

77:64:09:22:34:f2:5b:a6:ef:62:2b:36:e7:74:f7:9b:77:b4:a5:d1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\DevelBuildSlave\QuickStableVS\build\REALbasic\REALbasic Visual Studio\Release\GUIStubWin32.pdb

Imports

kernel32

FindResourceW
LoadResource
SetDllDirectoryW
LoadLibraryW
GetModuleFileNameW
MultiByteToWideChar
GetProcAddress
LoadLibraryA
LockResource
GetStringTypeW
LCMapStringW
GetLastError
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
EncodePointer
DecodePointer
HeapAlloc
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
RtlUnwind
IsProcessorFeaturePresent
HeapSize
HeapReAlloc

user32

MessageBoxA

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RBGUIFramework.dll
.dll windows:6 windows x86 arch:x86

3e834f4db3962679f0ce6d72c4cbd693

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineW
OutputDebugStringA
CloseHandle
GetLastError
WaitForSingleObject
CreateEventW
CreateThread
TerminateThread
GetLocalTime
GetNativeSystemInfo
SetUnhandledExceptionFilter
GetCurrentProcess
GetModuleHandleW
lstrcatW
K32GetModuleBaseNameW
CreateFileW
SetFilePointerEx
GetStringTypeW
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetCurrentThreadId
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
EncodePointer
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
HeapValidate
GetSystemInfo
GetCurrentThread
GetStdHandle
GetFileType
WriteFile
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetACP
HeapSize
HeapReAlloc
HeapQueryInformation
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
DecodePointer

user32

ShowWindow
DefWindowProcW
MessageBoxA
wsprintfW
RegisterClassW
CreateWindowExW

shell32

CommandLineToArgvW

Exports

Exports

AutoInitDate
BooleanToVariant
ConvertPtrToMemoryBlock
CreateArray
DateCompare
DateFinalizer
DragItemAddItem
DragItemConstructorWithRectControl
DragItemConstructorWithWindow
DragItemDestinationGetter
DragItemDrag
DragItemDragPictureGetter
DragItemDragPictureSetter
DragItemDropHeightSetter
DragItemDropLeftSetter
DragItemDropTopSetter
DragItemDropWidthSetter
DragItemFinalizer
DragItemFolderItemAvailable
DragItemGetMacData
DragItemInitializer
DragItemMacDataAvailable
DragItemMouseCursorGetter
DragItemMouseCursorSetter
DragItemNextItem
DragItemPictureAvailable
DragItemSetMacData
DragItemSetPrivateMacData
DragItemTextAvailable
MDBBooleanGetter
MDBBooleanSetter
MDBCaptionGetter
MDBCaptionSetter
MDButtonGetter
MDIconSetter
MainExport
MemoryBlockAddOperator
MemoryBlockCompareOperator
MemoryBlockFinalizer
MemoryBlockFromStringOperator
MemoryBlockInitializer
MemoryBlockLeftB
MemoryBlockLittleEndianGetter
MemoryBlockLittleEndianSetter
MemoryBlockMidB2
MemoryBlockMidB3
MemoryBlockRightB
MemoryBlockToStringOperator
MessageDialogExplanationGetter
MessageDialogExplanationSetter
MessageDialogFinalizer
MessageDialogIconGetter
MessageDialogInitializer
MessageDialogMessageGetter
MessageDialogMessageSetter
MessageDialogShowModal
MessageDialogShowModalWithin
MessageDialogTitleGetter
MessageDialogTitleSetter
RaiseNilObjectException
RegisterWeakRef
ResolveWeakRef
RuntimeAllocateAttributeTable
RuntimeBackgroundTask
RuntimeCheckCast
RuntimeCloseWindow
RuntimeControlArrayItemReference
RuntimeControlReference
RuntimeCreateDelegate
RuntimeCreateWindow
RuntimeExit
RuntimeHideWindow
RuntimeInit
RuntimeLockObject
RuntimeLockString
RuntimeLockUnlockObjects
RuntimeLockUnlockStrings
RuntimeNewClass
RuntimeNewObject
RuntimeNewVtable
RuntimeObjectIsa
RuntimeReraiseException
RuntimeShowModal
RuntimeShowModalWithinWindow
RuntimeShowWindow
RuntimeShowWithinWindow
RuntimeStackCheck
RuntimeUnlockObject
RuntimeUnlockString
RuntimeViewDestructor
StringToVariant
UnregisterWeakRef
VariantToString
WindowAddControl
WindowAddMenuHandler
WindowAllocateObject
WindowCompositeGetter
WindowCompositeSetter
WindowDefaultConstructor
WindowDockItemGetter
WindowFocusGetter
WindowFocusNext
WindowFocusPrevious
WindowFocusSetter
WindowForceUpdateFrontBuffer
WindowGetContentsChanged
WindowGetFrameBounds
WindowHandleGetter
WindowMacProcIDGetter
WindowMacProcIDSetter
WindowMaximize
WindowMenuBarGetter
WindowMenuBarSetter
WindowMinimize
WindowMinimizeButtonGetter
WindowMinimizeButtonSetter
WindowMouseCursorGetter
WindowMove
WindowRestore
WindowSetContentsChanged
WindowSetFrameBounds
WindowToWindowPtr
WindowVisibleGetter
WindowVisibleSetter
dateFieldGetter
dateFieldSetter
dateGMTOffsetGetter
dateGMTOffsetSetter
dateSQLDateGetter
dateSQLDateSetter
dateSQLDateTimeGetter
dateSQLDateTimeSetter
dateStringGetter
dateTotalSecondsGetter
dateTotalSecondsSetter
dictionaryConstructor
dictionaryDestructor
dictionaryHasKey
dictionaryKey
dictionaryRemove
dictionaryRemoveAll
dictionaryValueGetter
dragItemDropHeight
dragItemDropLeft
dragItemDropTop
dragItemDropWidth
dragItemFolderItemGetter
dragItemFolderItemSetter
dragItemGetHandle
dragItemPictureGetter
dragItemPictureSetter
dragItemTextGetter
dragItemTextSetter
formAcceptFileDrop
formAcceptMacDataDrop
formAcceptPictureDrop
formAcceptTextDrop
formDrawBackground
formDrawInto
formMouseCursorSetter
formRefresh
formRefreshRect
formSetFocus
memoryBlockGetPtr
memoryBlockGetSize
memoryBlockNewConstructor
memoryBlockSetSize
memoryGetBoolean
memoryGetByte
memoryGetCString
memoryGetColor
memoryGetCurrency
memoryGetDouble
memoryGetInt16
memoryGetInt64
memoryGetInt8
memoryGetLong
memoryGetPString
memoryGetPtr
memoryGetShort
memoryGetSingle
memoryGetString
memoryGetUInt16
memoryGetUInt32
memoryGetUInt64
memoryGetUInt8
memoryGetUShort
memoryGetWString
memorySetBoolean
memorySetByte
memorySetCString
memorySetColor
memorySetCurrency
memorySetDouble
memorySetInt16
memorySetInt64
memorySetInt8
memorySetLong
memorySetPString
memorySetPtr
memorySetShort
memorySetSingle
memorySetString
memorySetUInt16
memorySetUInt32
memorySetUInt64
memorySetUInt8
memorySetWString
windowBackColorGetter
windowBackColorSetter
windowBackdropGetter
windowBackdropSetter
windowCloseBoxGetter
windowCloseBoxSetter
windowControl
windowControlCountGetter
windowFrameGetter
windowFrameSetter
windowFullScreenGetter
windowFullScreenSetter
windowGraphicsGetter
windowGrowIconGetter
windowGrowIconSetter
windowHWNDGetter
windowHasBackColorGetter
windowHasBackColorSetter
windowLiveResizeGetter
windowLiveResizeSetter
windowMenusVisibleGetter
windowMenusVisibleSetter
windowMinMaxWidthHeightGetter
windowMinMaxWidthHeightSetter
windowMouseXGetter
windowMouseYGetter
windowPlacementGetter
windowPlacementSetter
windowPosGetter
windowPosSetter
windowTitleGetter
windowTitleSetter
windowWindowPtrGetter
windowZoomIconGetter
windowZoomIconSetter

Sections

.text
Size: 705KB - Virtual size: 705KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 806B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Transfer.exe
.exe windows:6 windows x86 arch:x86

862cdd542b2c508d29e672ca6eb2f235

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:5c:4d:f7:38:d9:91:d8:ce:03:ba:96:89:74:d9:a9
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14-06-2021 00:00

Not After

11-06-2024 23:59

Subject

CN=Nero AG,O=Nero AG,L=Karlsruhe,ST=Baden-Württemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:5c:4d:f7:38:d9:91:d8:ce:03:ba:96:89:74:d9:a9
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14-06-2021 00:00

Not After

11-06-2024 23:59

Subject

CN=Nero AG,O=Nero AG,L=Karlsruhe,ST=Baden-Württemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ec:09:91:3f:24:64:b0:b4:e3:fc:64:31:6c:d2:83:69:4f:d4:10:5b:9c:7e:f6:7c:54:00:c5:0f:c8:7a:71:a9
Signer

Actual PE Digest

ec:09:91:3f:24:64:b0:b4:e3:fc:64:31:6c:d2:83:69:4f:d4:10:5b:9c:7e:f6:7c:54:00:c5:0f:c8:7a:71:a9

Digest Algorithm

sha256

PE Digest Matches

true

7c:eb:a2:eb:ad:f2:dd:e9:24:5b:1e:9e:28:00:e0:04:51:f7:65:0a
Signer

Actual PE Digest

7c:eb:a2:eb:ad:f2:dd:e9:24:5b:1e:9e:28:00:e0:04:51:f7:65:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\builds\workspace\Applications\Transfer_green\src\Release\Transfer.pdb

Imports

comctl32

InitCommonControlsEx

kernel32

MoveFileExW
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleFileNameW
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Sleep
CloseHandle
DecodePointer
WriteConsoleW
SetFilePointerEx
GetConsoleMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
EncodePointer
RaiseException
GetLastError
SetLastError
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
WriteFile
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetFileType
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
CreateFileW

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 570KB - Virtual size: 569KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wwnotray.exe
.exe windows:5 windows x86 arch:x86

d30ea7988abeaf6b17489cf0a141fafd

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07-06-2005 08:09

Not After

30-05-2020 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

27-04-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-05-2019 00:00

Not After

30-05-2020 10:48

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

77:65:3a:70:d2:cd:7e:0b:cf:62:17:91:c0:67:d3:10
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27-12-2018 00:00

Not After

27-12-2022 23:59

Subject

CN=WordWeb Software,O=WordWeb Software,POSTALCODE=BN1 6EG,STREET=10 Southdown Avenue,L=Brighton,ST=East Sussex,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

10:81:92:30:e6:81:e1:b8:b8:78:7a:e7:0d:39:8b:2c:19:46:06:7c
Signer

Actual PE Digest

10:81:92:30:e6:81:e1:b8:b8:78:7a:e7:0d:39:8b:2c:19:46:06:7c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

Sleep
VirtualFree
VirtualAlloc
VirtualQuery
GetSystemInfo
GetVersion
SetThreadLocale
GetACP
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetCommandLineW
FreeLibrary
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
GetVersionExW
FreeLibrary

user32

CreateWindowExW
RegisterClassW
PostQuitMessage
LoadIconW
DefWindowProcW

wweb32

ShowModalWordWebWEx

Exports

Exports

__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 10KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 111B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7dc2d630179462e2c40299b1aed7c454

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

shlwapi

Sections

.text Size: 673KB - Virtual size: 672KB

.rdata Size: 149KB - Virtual size: 149KB

.data Size: 4KB - Virtual size: 10KB

.idata Size: 4KB - Virtual size: 4KB

.msvcjmc Size: 1024B - Virtual size: 829B

.Version Size: 1024B - Virtual size: 563B

.00cfg Size: 512B - Virtual size: 260B

.rsrc Size: 4.3MB - Virtual size: 4.3MB

.reloc Size: 35KB - Virtual size: 35KB

c0abd2a9ced2aff011b95e548be54599

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

52:65:0e:12:20:7b:d6:9b:81:cd:54:b8:7f:2a:db:87Certificate

Extended Key Usages

Key Usages

77:64:09:22:34:f2:5b:a6:ef:62:2b:36:e7:74:f7:9b:77:b4:a5:d1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

Sections

.text Size: 18KB - Virtual size: 18KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 291KB - Virtual size: 291KB

.reloc Size: 3KB - Virtual size: 2KB

3e834f4db3962679f0ce6d72c4cbd693

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

Exports

Exports

Sections

.text Size: 705KB - Virtual size: 705KB

.rdata Size: 156KB - Virtual size: 155KB

.data Size: 4KB - Virtual size: 9KB

.idata Size: 4KB - Virtual size: 3KB

.msvcjmc Size: 1024B - Virtual size: 648B

.00cfg Size: 512B - Virtual size: 260B

.rsrc Size: 1024B - Virtual size: 806B

.reloc Size: 24KB - Virtual size: 23KB

862cdd542b2c508d29e672ca6eb2f235

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

.text
Size: 673KB - Virtual size: 672KB

.rdata
Size: 149KB - Virtual size: 149KB

.data
Size: 4KB - Virtual size: 10KB

.idata
Size: 4KB - Virtual size: 4KB

.msvcjmc
Size: 1024B - Virtual size: 829B

.Version
Size: 1024B - Virtual size: 563B

.00cfg
Size: 512B - Virtual size: 260B

.rsrc
Size: 4.3MB - Virtual size: 4.3MB

.reloc
Size: 35KB - Virtual size: 35KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

52:65:0e:12:20:7b:d6:9b:81:cd:54:b8:7f:2a:db:87
Certificate

77:64:09:22:34:f2:5b:a6:ef:62:2b:36:e7:74:f7:9b:77:b4:a5:d1
Signer

.text
Size: 18KB - Virtual size: 18KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 291KB - Virtual size: 291KB

.reloc
Size: 3KB - Virtual size: 2KB

.text
Size: 705KB - Virtual size: 705KB

.rdata
Size: 156KB - Virtual size: 155KB

.data
Size: 4KB - Virtual size: 9KB

.idata
Size: 4KB - Virtual size: 3KB

.msvcjmc
Size: 1024B - Virtual size: 648B

.00cfg
Size: 512B - Virtual size: 260B

.rsrc
Size: 1024B - Virtual size: 806B

.reloc
Size: 24KB - Virtual size: 23KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0a:5c:4d:f7:38:d9:91:d8:ce:03:ba:96:89:74:d9:a9
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0a:5c:4d:f7:38:d9:91:d8:ce:03:ba:96:89:74:d9:a9
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

ec:09:91:3f:24:64:b0:b4:e3:fc:64:31:6c:d2:83:69:4f:d4:10:5b:9c:7e:f6:7c:54:00:c5:0f:c8:7a:71:a9
Signer

7c:eb:a2:eb:ad:f2:dd:e9:24:5b:1e:9e:28:00:e0:04:51:f7:65:0a
Signer

.text
Size: 52KB - Virtual size: 52KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 2KB - Virtual size: 4KB

.gfids
Size: 512B - Virtual size: 284B

.rsrc
Size: 570KB - Virtual size: 569KB

.reloc
Size: 4KB - Virtual size: 3KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

77:65:3a:70:d2:cd:7e:0b:cf:62:17:91:c0:67:d3:10
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

10:81:92:30:e6:81:e1:b8:b8:78:7a:e7:0d:39:8b:2c:19:46:06:7c
Signer

.text
Size: 20KB - Virtual size: 19KB

.itext
Size: 512B - Virtual size: 240B

.data
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 10KB

.idata
Size: 1KB - Virtual size: 1KB

.didata
Size: 512B - Virtual size: 152B

.edata
Size: 512B - Virtual size: 111B