General

Malware Config

Signatures

Files

• a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe

  .exe windows:6 windows x86 arch:x86

  82e1d16074a85963dac6668cfee776c1

  
  

  Code Sign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  6a:d9:43:81:15:e1:71:7c:d5:5b:8b:d8:76:c8:9c:cd

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  26-05-2023 00:00

  Not After

  25-05-2026 23:59

  Subject

  CN=SIA Circle Solutions,O=SIA Circle Solutions,ST=Rīga,C=LV

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-05-2019 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

  Certificate

  Issuer

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  03-05-2023 00:00

  Not After

  02-08-2034 23:59

  Subject

  CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  6a:d9:43:81:15:e1:71:7c:d5:5b:8b:d8:76:c8:9c:cd

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  26-05-2023 00:00

  Not After

  25-05-2026 23:59

  Subject

  CN=SIA Circle Solutions,O=SIA Circle Solutions,ST=Rīga,C=LV

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

  Certificate

  Issuer

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  03-05-2023 00:00

  Not After

  02-08-2034 23:59

  Subject

  CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-05-2019 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  8b:ea:a6:53:f7:90:5a:e3:33:81:23:f4:1e:15:ae:11:4a:a1:b0:4c:d4:dc:e8:a2:20:b1:cb:9b:35:4a:40:1e

  Signer

  Actual PE Digest

  8b:ea:a6:53:f7:90:5a:e3:33:81:23:f4:1e:15:ae:11:4a:a1:b0:4c:d4:dc:e8:a2:20:b1:cb:9b:35:4a:40:1e

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  69:fa:c7:2b:97:ed:96:0e:7a:c0:1d:f2:94:95:69:ba:fe:28:c6:98

  Signer

  Actual PE Digest

  69:fa:c7:2b:97:ed:96:0e:7a:c0:1d:f2:94:95:69:ba:fe:28:c6:98

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  ws2_32

  getnameinfo

  gethostname

  ioctlsocket

  inet_ntoa

  recvfrom

  freeaddrinfo

  getaddrinfo

  listen

  htonl

  accept

  select

  __WSAFDIsSet

  WSACleanup

  WSAIoctl

  WSASetLastError

  socket

  setsockopt

  ntohs

  htons

  getsockopt

  getsockname

  getpeername

  connect

  bind

  recv

  WSAGetLastError

  closesocket

  WSAWaitForMultipleEvents

  WSAResetEvent

  WSAEventSelect

  WSAEnumNetworkEvents

  WSACreateEvent

  WSACloseEvent

  send

  WSAStartup

  gethostbyname

  sendto

  shutdown

  crypt32

  CertDuplicateCertificateContext

  CertFreeCertificateContext

  CertOpenStore

  CertGetCertificateContextProperty

  CertCloseStore

  CertEnumCertificatesInStore

  CertOpenSystemStoreW

  CertGetIntendedKeyUsage

  CertFindCertificateInStore

  CertGetEnhancedKeyUsage

  wldap32

  ord26

  ord27

  ord127

  ord167

  ord145

  ord142

  ord79

  ord133

  ord147

  ord301

  ord117

  ord41

  ord208

  ord216

  ord14

  ord46

  ord219

  kernel32

  WaitForSingleObject

  CreateEventW

  Sleep

  RaiseException

  HeapDestroy

  HeapAlloc

  HeapReAlloc

  HeapFree

  HeapSize

  GetProcessHeap

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  GetExitCodeProcess

  CreateFileW

  SetEndOfFile

  SetFilePointer

  GetTickCount

  ExpandEnvironmentStringsW

  CreateDirectoryW

  DeleteFileW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetFileAttributesW

  GetFileSizeEx

  RemoveDirectoryW

  GetTempPathW

  SetErrorMode

  CreatePipe

  CreateMutexW

  GetCurrentProcess

  GetCurrentProcessId

  TerminateProcess

  CreateProcessW

  OpenProcess

  GetVersionExW

  IsWow64Process

  GetModuleFileNameW

  GetModuleHandleW

  LocalFree

  FormatMessageW

  lstrlenW

  MultiByteToWideChar

  WideCharToMultiByte

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  GetCommandLineW

  GetDiskFreeSpaceExW

  GetLocaleInfoW

  GetCurrentThreadId

  IsBadWritePtr

  GetSystemTime

  SetEvent

  GetSystemDefaultUILanguage

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  FindResourceExW

  GlobalAlloc

  GlobalUnlock

  GlobalLock

  MulDiv

  lstrcmpW

  DecodePointer

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  GlobalHandle

  GlobalFree

  lstrcmpiW

  VerSetConditionMask

  lstrcpynW

  VerifyVersionInfoW

  VirtualFree

  VirtualAlloc

  ReleaseSRWLockExclusive

  AcquireSRWLockExclusive

  InitializeCriticalSectionEx

  SleepEx

  QueryPerformanceFrequency

  GetSystemDirectoryW

  LoadLibraryW

  QueryPerformanceCounter

  MoveFileExW

  WaitForSingleObjectEx

  CompareFileTime

  GetSystemTimeAsFileTime

  GetEnvironmentVariableA

  GetStdHandle

  GetFileType

  PeekNamedPipe

  WaitForMultipleObjects

  GetModuleHandleA

  SetConsoleMode

  GetEnvironmentVariableW

  ReadConsoleA

  GetConsoleMode

  ReadConsoleW

  TlsSetValue

  TlsAlloc

  TlsGetValue

  TlsFree

  GetModuleHandleExW

  DeleteFiber

  SwitchToFiber

  CreateFiber

  ConvertFiberToThread

  ConvertThreadToFiber

  LoadLibraryA

  SystemTimeToFileTime

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetStartupInfoW

  InitializeSListHead

  WriteConsoleW

  CreateNamedPipeW

  DisconnectNamedPipe

  ConnectNamedPipe

  GetLastError

  CloseHandle

  WriteFile

  ReadFile

  FindResourceW

  SizeofResource

  LockResource

  LoadResource

  TerminateThread

  CreateThread

  SetFileAttributesW

  GetTimeZoneInformation

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetOEMCP

  GetACP

  IsValidCodePage

  FindFirstFileExW

  GetFullPathNameW

  GetCurrentDirectoryW

  FlushFileBuffers

  EnumSystemLocalesW

  SetStdHandle

  OutputDebugStringW

  EncodePointer

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  FlushInstructionCache

  LoadLibraryExA

  LCMapStringEx

  GetStringTypeW

  GetCPInfo

  RtlUnwind

  ResetEvent

  GetFileAttributesExW

  GetDriveTypeW

  GetFileInformationByHandle

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  ExitThread

  FreeLibraryAndExitThread

  SetFilePointerEx

  SetConsoleCtrlHandler

  ExitProcess

  GetConsoleOutputCP

  GetDateFormatW

  GetTimeFormatW

  CompareStringW

  LCMapStringW

  IsValidLocale

  GetOverlappedResult

  GetUserDefaultLCID

  user32

  SetWindowContextHelpId

  GetWindowRect

  GetWindowTextLengthW

  GetWindowTextW

  SetWindowTextW

  RedrawWindow

  InvalidateRgn

  GetCursorPos

  EndPaint

  BeginPaint

  TrackPopupMenu

  AppendMenuW

  DestroyMenu

  CreatePopupMenu

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  KillTimer

  ReleaseCapture

  SetCapture

  GetFocus

  SetFocus

  CharNextW

  GetDlgItem

  DrawFocusRect

  LoadImageW

  ClientToScreen

  IsWindow

  GetClassInfoExW

  RegisterClassExW

  CallWindowProcW

  PostQuitMessage

  DefWindowProcW

  RegisterWindowMessageW

  PostThreadMessageW

  PeekMessageW

  SendMessageW

  SystemParametersInfoW

  GetDesktopWindow

  MessageBoxW

  GetClientRect

  ReleaseDC

  GetDC

  SetWindowPos

  ShowWindow

  DestroyWindow

  CreateWindowExW

  SetForegroundWindow

  UnregisterClassW

  AllowSetForegroundWindow

  ScreenToClient

  MapWindowPoints

  GetSysColor

  FillRect

  GetWindowLongW

  SetWindowLongW

  GetParent

  GetClassNameW

  GetWindow

  LoadBitmapW

  WindowFromPoint

  SetCursor

  DrawStateW

  IsChild

  LoadCursorW

  IsDialogMessageW

  GetUserObjectInformationW

  GetProcessWindowStation

  GetIconInfo

  DestroyCursor

  OffsetRect

  InflateRect

  CopyRect

  MoveWindow

  FrameRect

  DrawTextW

  GetCapture

  GetActiveWindow

  GetDlgCtrlID

  GetWindowThreadProcessId

  EnumWindows

  CreateDialogIndirectParamW

  DispatchMessageW

  TranslateMessage

  GetMessageW

  GetMonitorInfoW

  MonitorFromWindow

  MonitorFromPoint

  EndDialog

  MapDialogRect

  InvalidateRect

  gdi32

  ExtTextOutW

  MoveToEx

  SetTextColor

  SetBkMode

  SetBkColor

  LineTo

  CreatePen

  CreateBitmap

  GetObjectW

  SelectObject

  GetStockObject

  GetDeviceCaps

  DeleteObject

  DeleteDC

  CreateSolidBrush

  CreateFontW

  CreateCompatibleDC

  CreateCompatibleBitmap

  BitBlt

  ChoosePixelFormat

  SetPixelFormat

  advapi32

  RegDeleteValueW

  CryptDestroyKey

  CryptGetUserKey

  CryptEnumProvidersW

  CryptDecrypt

  CryptExportKey

  CryptSetHashParam

  CryptSignHashW

  CryptGetProvParam

  DeregisterEventSource

  RegisterEventSourceW

  ReportEventW

  CryptDestroyHash

  CryptHashData

  CryptCreateHash

  CryptGetHashParam

  RegQueryInfoKeyW

  RegEnumKeyExW

  RegEnumValueW

  StartServiceW

  OpenProcessToken

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCloseKey

  RegCreateKeyExW

  RegDeleteKeyW

  CryptAcquireContextW

  RegEnumKeyW

  RegOpenKeyExW

  RegQueryValueExW

  RegSetValueExW

  QueryServiceStatusEx

  OpenServiceW

  OpenSCManagerW

  EnumDependentServicesW

  CloseServiceHandle

  DeleteService

  ControlService

  CryptReleaseContext

  shell32

  CommandLineToArgvW

  SHGetSpecialFolderPathW

  Shell_NotifyIconW

  SHBrowseForFolderW

  SHGetSpecialFolderLocation

  SHGetPathFromIDListW

  SHFileOperationW

  ShellExecuteExW

  ShellExecuteW

  ole32

  OleLockRunning

  OleUninitialize

  OleInitialize

  CoTaskMemAlloc

  StringFromGUID2

  CoGetClassObject

  CoTaskMemRealloc

  CoUninitialize

  OleRun

  CoTaskMemFree

  CLSIDFromProgID

  CLSIDFromString

  CoCreateInstance

  CoInitialize

  CreateStreamOnHGlobal

  oleaut32

  DispCallFunc

  LoadRegTypeLi

  LoadTypeLi

  SysStringLen

  VariantChangeType

  VariantClear

  VariantInit

  SysAllocStringByteLen

  SysStringByteLen

  SysAllocStringLen

  SysAllocString

  SysFreeString

  VarUI4FromStr

  GetErrorInfo

  OleCreateFontIndirect

  shlwapi

  AssocQueryStringW

  PathCombineW

  comctl32

  ImageList_GetIcon

  InitCommonControlsEx

  opengl32

  glGetString

  wglDeleteContext

  wglMakeCurrent

  wglCreateContext

  wininet

  InternetReadFile

  HttpQueryInfoW

  HttpSendRequestW

  HttpOpenRequestW

  InternetSetOptionW

  InternetQueryOptionW

  InternetConnectW

  InternetCloseHandle

  InternetOpenW

  psapi

  GetModuleBaseNameW

  GetModuleFileNameExW

  GetProcessImageFileNameW

  EnumProcesses

  bcrypt

  BCryptGenRandom

  Sections

  .text

  Size: 2.6MB - Virtual size: 2.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 715KB - Virtual size: 714KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 25KB - Virtual size: 51KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.4MB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 104KB - Virtual size: 104KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ