unlocker1[.]9[.]0-portable[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

unlocker1.9.0-portable.zip
Size

111KB
MD5

8f7da0d01afd03a1e366a72c231fb3fc
SHA1

e8abf005d2f7658f81b1ed29a0c426f9a63637f2
SHA256

7fb45b8ac6971cbe98d6935203e956865cd258ba02a1ac20bce07adab8dbe582
SHA512

10c23d8f13c0931470fbed337ba4a29588a71ce4b22e5f5c8a62e8af8c55d50f0568e85bd812fffad4b1bc745cf06db1d58d84199f5ac00028bdd24510262a86
SSDEEP

1536:JanPPVYDlENY/fdyCDYmnhNfjmp6+/DybLW7LrOpF2eV1WEg9DFSoOOAP1oDByds:JmPCCk1yFsquiGV1WEu7TeWDBy4cVAG8

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/x64/UnlockerInject32.exe
unpack001/x86/Unlocker.exe
unpack001/x86/UnlockerAssistant.exe
unpack001/x86/UnlockerDriver5.sys
unpack001/x86/UnlockerHook.dll

Files

unlocker1.9.0-portable.zip
.zip
README.TXT
x64/Unlocker.exe
.exe windows:4 windows x64 arch:x64

c22b69072d35c97328e5010541f8ad8b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:61:c7:1c:9d:3a:68:32:e7:81:55:53:27:42:8b:e5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

29/06/2010, 00:00

Not After

29/06/2011, 23:59

Subject

CN=Empty Loop,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Empty Loop,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9a:c0:3a:4f:4b:fb:a1:18:43:5a:3f:b2:17:79:99:f9:d8:a1:18:e4
Signer

Actual PE Digest

9a:c0:3a:4f:4b:fb:a1:18:43:5a:3f:b2:17:79:99:f9:d8:a1:18:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\Documents\Sources\Visual Studio Projects\Unlocker\Release64\Unlocker.pdb

Imports

psapi

GetModuleFileNameExW
GetModuleBaseNameW
EnumProcessModules

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Create
ImageList_SetBkColor

ws2_32

recv
send
connect
htons
gethostbyname
socket
WSAStartup

shlwapi

StrStrA
PathRemoveExtensionW
PathStripPathW
SHDeleteKeyA
PathSkipRootW
StrToIntA
PathStripToRootW
PathRemoveFileSpecW
wvnsprintfA
PathFindExtensionW
StrStrW
PathIsDirectoryW

kernel32

Module32NextW
GetModuleFileNameW
Module32FirstW
Process32NextW
CreateThread
ExitProcess
CreateFileA
QueryDosDeviceA
CreateToolhelp32Snapshot
lstrcmpiW
GetCommandLineW
lstrlenW
GetFileAttributesW
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
GetShortPathNameW
lstrcpyW
MoveFileW
GlobalFree
GlobalUnlock
GlobalLock
GlobalReAlloc
GlobalAlloc
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
CloseHandle
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
lstrcpyA
GetProcAddress
WriteProcessMemory
VirtualAllocEx
GetModuleHandleA
OpenProcess
LocalFree
LoadLibraryA
ReadFile
lstrcmpA
GetLongPathNameW
CreateFileW
WriteFile
MultiByteToWideChar
GetVersionExA
lstrlenA
MoveFileExW
DuplicateHandle
GetCurrentProcess
TerminateProcess
OutputDebugStringA
Process32FirstW

user32

DialogBoxParamA
SendDlgItemMessageA
UpdateWindow
InvalidateRect
ShowWindow
GetSysColor
MoveWindow
GetClientRect
GetDlgItemTextW
GetDlgItem
wsprintfA
CharUpperW
CallWindowProcA
DestroyCursor
SetWindowLongPtrA
SetCapture
SetCursor
LoadCursorA
PtInRect
ReleaseCapture
GetSystemMetrics
LoadIconA
DestroyIcon
SetDlgItemTextA
SetDlgItemTextW
SetWindowTextA
PostMessageA
GetWindowRect
GetWindowPlacement
EndDialog
SetWindowPlacement
GetDC
SendMessageA
DrawTextA
MessageBoxA
wsprintfW
ClientToScreen

gdi32

GetObjectA
CreateFontIndirectA
SelectObject

comdlg32

GetSaveFileNameW

advapi32

SetNamedSecurityInfoW
RegSetValueExW
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
FreeSid
SetEntriesInAclA
AllocateAndInitializeSid
RegSetValueExA

shell32

CommandLineToArgvW
ShellExecuteA
ExtractIconExW
ShellExecuteExW
SHGetMalloc
SHBrowseForFolderW
SHFileOperationW
SHGetPathFromIDListW

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.CRT
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
x64/UnlockerDriver5.sys
.sys windows:4 windows x64 arch:x64

2a015bf36d12492d1085356809814d9d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:61:c7:1c:9d:3a:68:32:e7:81:55:53:27:42:8b:e5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

29/06/2010, 00:00

Not After

29/06/2011, 23:59

Subject

CN=Empty Loop,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Empty Loop,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

89:65:01:16:e0:82:cc:41:fe:d0:20:af:a7:0d:72:a2:27:8b:bb:3b
Signer

Actual PE Digest

89:65:01:16:e0:82:cc:41:fe:d0:20:af:a7:0d:72:a2:27:8b:bb:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

IofCompleteRequest
MmMapLockedPagesSpecifyCache
ObfDereferenceObject
ExFreePool
ObQueryNameString
ExAllocatePoolWithTag
ObReferenceObjectByHandle
IoFileObjectType
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 774B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 299B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 850B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
x64/UnlockerInject32.exe
.exe windows:4 windows x86 arch:x86

28c87b74b850b535682af01742c40837

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntW

kernel32

OpenProcess
ExitProcess
CloseHandle
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
lstrcpyW
lstrcpyA
GetProcAddress
WriteProcessMemory
VirtualAllocEx
GetModuleHandleA
GetCommandLineW
LoadLibraryA
GlobalAlloc
lstrcmpiW

user32

MessageBoxW

shell32

CommandLineToArgvW

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
x86/Unlocker.exe
.exe windows:4 windows x86 arch:x86

180da66498d17cf39dc4660da43dee0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetModuleFileNameExW
GetModuleBaseNameW
EnumProcessModules

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Create
ImageList_SetBkColor

ws2_32

send
recv
connect
htons
gethostbyname
socket
WSAStartup

shlwapi

StrStrA
PathRemoveExtensionW
PathStripPathW
SHDeleteKeyA
StrToIntA
wvnsprintfA
PathStripToRootW
PathIsDirectoryW
PathFindExtensionW
StrStrW
PathSkipRootW
PathRemoveFileSpecW

kernel32

Module32NextW
GetModuleFileNameW
Module32FirstW
Process32NextW
CreateThread
ExitProcess
CreateFileA
QueryDosDeviceA
CreateToolhelp32Snapshot
lstrcmpiW
GetCommandLineW
lstrlenW
lstrcpyA
LocalFree
GetProcAddress
LoadLibraryA
lstrcpyW
GetLongPathNameW
CloseHandle
ReadFile
CreateFileW
WriteFile
GetModuleHandleA
MultiByteToWideChar
GlobalAlloc
GlobalFree
lstrcmpA
GetFileAttributesW
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
GetShortPathNameW
MoveFileW
GetVersionExA
GlobalUnlock
GlobalLock
GlobalReAlloc
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
lstrlenA
MoveFileExW
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
DuplicateHandle
GetCurrentProcess
TerminateProcess
Process32FirstW

user32

GetDlgItemTextW
DialogBoxParamA
wsprintfA
CharUpperW
SendDlgItemMessageA
UpdateWindow
InvalidateRect
ShowWindow
LoadIconA
MoveWindow
GetClientRect
ClientToScreen
GetDlgItem
CallWindowProcA
DestroyCursor
SetWindowLongA
SetCapture
SetCursor
LoadCursorA
PtInRect
ReleaseCapture
GetSystemMetrics
DestroyIcon
SetDlgItemTextA
SetDlgItemTextW
SetWindowTextA
PostMessageA
GetWindowRect
GetWindowPlacement
EndDialog
SetWindowPlacement
GetDC
SendMessageA
DrawTextA
MessageBoxA
wsprintfW
GetSysColor

gdi32

GetObjectA
CreateFontIndirectA
SelectObject

comdlg32

GetSaveFileNameW

advapi32

SetNamedSecurityInfoW
RegSetValueExW
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
FreeSid
SetEntriesInAclA
AllocateAndInitializeSid
RegSetValueExA

shell32

CommandLineToArgvW
ShellExecuteA
ExtractIconExW
SHFileOperationW
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
x86/UnlockerAssistant.exe
.exe windows:4 windows x86 arch:x86

a510baa3ecd268c6c6bb7d395fef0aad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

shlwapi

StrToIntA
wvnsprintfA

kernel32

lstrcmpA
lstrcmpW
GetCommandLineW
GetModuleFileNameA
GetProcAddress
LoadLibraryA
ExitProcess
lstrlenA
lstrcpyA
GetModuleHandleA

user32

PostQuitMessage
DestroyWindow
PostMessageA
GetWindowTextA
DestroyIcon
DispatchMessageA
TranslateMessage
GetMessageA
GetCursorPos
CreateDialogParamA
RegisterWindowMessageA
EnumWindows
SetForegroundWindow
TrackPopupMenu
DestroyMenu
wsprintfA
MessageBoxA
CreatePopupMenu
LoadIconA
EnableMenuItem
InsertMenuA

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey

shell32

CommandLineToArgvW
Shell_NotifyIconA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
x86/UnlockerDriver5.sys
.sys windows:4 windows x86 arch:x86

2a015bf36d12492d1085356809814d9d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
MmMapLockedPagesSpecifyCache
ObfDereferenceObject
ExFreePool
ObQueryNameString
ExAllocatePoolWithTag
ObReferenceObjectByHandle
IoFileObjectType
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice

Sections

PAGE
Size: 1024B - Virtual size: 689B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 562B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 126B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/UnlockerHook.dll
.dll windows:4 windows x86 arch:x86

f4d093db5e466a48d555b9ceadb39dab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathStripPathW
PathRemoveFileSpecW

kernel32

GetModuleHandleA
lstrcpyW
GetModuleFileNameW
GetLastError
lstrcmpA
CloseHandle
WriteProcessMemory
FlushInstructionCache
ReadProcessMemory
GetCurrentProcess
VirtualProtect
GetProcAddress
lstrlenW
lstrcmpiW
DisableThreadLibraryCalls

user32

CallNextHookEx
PostMessageA
UnhookWindowsHookEx
EnumWindows
wsprintfW
SetWindowsHookExA
GetWindowTextA

shell32

ShellExecuteExW

Exports

Exports

HookInstall
HookUninstall

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 242B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c22b69072d35c97328e5010541f8ad8b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

59:61:c7:1c:9d:3a:68:32:e7:81:55:53:27:42:8b:e5Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

9a:c0:3a:4f:4b:fb:a1:18:43:5a:3f:b2:17:79:99:f9:d8:a1:18:e4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

comctl32

ws2_32

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 114KB - Virtual size: 113KB

.data Size: 512B - Virtual size: 25KB

.pdata Size: 1024B - Virtual size: 900B

.CRT Size: 512B - Virtual size: 40B

.rsrc Size: 4KB - Virtual size: 3KB

2a015bf36d12492d1085356809814d9d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

59:61:c7:1c:9d:3a:68:32:e7:81:55:53:27:42:8b:e5Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

89:65:01:16:e0:82:cc:41:fe:d0:20:af:a7:0d:72:a2:27:8b:bb:3bSigner

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 1024B - Virtual size: 836B

PAGE Size: 1024B - Virtual size: 774B

INIT Size: 512B - Virtual size: 299B

.rdata Size: 1024B - Virtual size: 850B

.data Size: - Virtual size: 16B

.pdata Size: 512B - Virtual size: 144B

.rsrc Size: 512B - Virtual size: 432B

28c87b74b850b535682af01742c40837

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

59:61:c7:1c:9d:3a:68:32:e7:81:55:53:27:42:8b:e5
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

9a:c0:3a:4f:4b:fb:a1:18:43:5a:3f:b2:17:79:99:f9:d8:a1:18:e4
Signer

.text
Size: 114KB - Virtual size: 113KB

.data
Size: 512B - Virtual size: 25KB

.pdata
Size: 1024B - Virtual size: 900B

.CRT
Size: 512B - Virtual size: 40B

.rsrc
Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

59:61:c7:1c:9d:3a:68:32:e7:81:55:53:27:42:8b:e5
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

89:65:01:16:e0:82:cc:41:fe:d0:20:af:a7:0d:72:a2:27:8b:bb:3b
Signer

.text
Size: 1024B - Virtual size: 836B

PAGE
Size: 1024B - Virtual size: 774B

INIT
Size: 512B - Virtual size: 299B

.rdata
Size: 1024B - Virtual size: 850B

.data
Size: - Virtual size: 16B

.pdata
Size: 512B - Virtual size: 144B

.rsrc
Size: 512B - Virtual size: 432B

.text
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 176B

.text
Size: 86KB - Virtual size: 86KB

.data
Size: 512B - Virtual size: 22KB

.rsrc
Size: 4KB - Virtual size: 3KB

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

PAGE
Size: 1024B - Virtual size: 689B

INIT
Size: 512B - Virtual size: 244B

.rdata
Size: 1024B - Virtual size: 562B

.data
Size: - Virtual size: 8B

.reloc
Size: 512B - Virtual size: 126B

.text
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 8B

.reloc
Size: 512B - Virtual size: 242B