2024-06-28_c2233de0da3a4e45aca46336b056abcc_avaddon

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-28_c2233de0da3a4e45aca46336b056abcc_avaddon
Size

34.1MB
MD5

c2233de0da3a4e45aca46336b056abcc
SHA1

74573d016ab93bed62767fa813a714324d69313d
SHA256

880064307450638e8e945896ee9ead1738927e9e6b3573b0e9740f17d9d271dc
SHA512

14a27aa9bb19275dd6142e116facbb4022a78250e84f9240e8b3f67a6ab36ad2fc195a6487e5918ac2a6763a35e03461e4d4f23d345696133d88b24511bad2cd
SSDEEP

196608:/Apa60UGeWFH/hYkVbJgIf9hrrTH3wwK7JZ7YLquEDn7SS+qBjVoEGsRWaOpGpbg:/A0b6WFH/JJ3X0Z7ttD+PqBTGb0psK18

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Files

2024-06-28_c2233de0da3a4e45aca46336b056abcc_avaddon
.exe windows:6 windows x64 arch:x64

64b9c7f429a9422fc07bd027191321ab

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:07:d4:0b:50:82:fe:aa:6e:0a:5e:92
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

13/07/2021, 08:55

Not After

10/10/2024, 08:23

Subject

SERIALNUMBER=1125476195459,CN=Atom Security LLC,O=Atom Security LLC,STREET=Prospect Akademika Koptyuga\, 4 office 158,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:9b:5a:01:32:cc:fe:ce:06:d6:2c:a7:26:67:29:fe:d6:a2:ac:5c:bf:bd:a4:a0:45:f9:82:fb:69:43:dc:9b
Signer

Actual PE Digest

12:9b:5a:01:32:cc:fe:ce:06:d6:2c:a7:26:67:29:fe:d6:a2:ac:5c:bf:bd:a4:a0:45:f9:82:fb:69:43:dc:9b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\BuildAgent\work\.build\agent_x64\relwithdebinfo64\vmnetdrv64.pdb

Imports

advapi32

GetLengthSid
OpenServiceW
StartServiceCtrlDispatcherW
RegOpenKeyExW
InitializeAcl
InitializeSecurityDescriptor
AddAce
RegSetValueExW
IsValidSid
GetSecurityDescriptorOwner
InitializeSid
CopySid
GetSecurityDescriptorControl
RegCreateKeyExW
GetSidLengthRequired
GetSidSubAuthority
GetSecurityDescriptorGroup
OpenSCManagerW
CloseServiceHandle
GetAclInformation
RegCloseKey
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
CryptGenRandom
CryptAcquireContextW
GetTokenInformation
RegQueryValueExW
LookupAccountSidW
OpenThreadToken
GetSecurityDescriptorLength
DuplicateTokenEx
CreateProcessAsUserW
OpenProcessToken
ConvertStringSidToSidW
SetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetAce
RegDeleteValueW
RegEnumKeyExW
DuplicateToken
SetThreadToken
ConvertSidToStringSidW
CreateWellKnownSid
RegGetValueW
RegLoadMUIStringW
RegNotifyChangeKeyValue
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
RegDisablePredefinedCache
MakeSelfRelativeSD
MakeAbsoluteSD
RegEnumValueW
ChangeServiceConfigW
QueryServiceConfigW
StartServiceW
EnumDependentServicesW
ControlService
DeleteService
ChangeServiceConfig2W
SetServiceStatus
QueryServiceStatus
CreateServiceW
RegisterServiceCtrlHandlerExW
RegDeleteKeyW
IsTextUnicode
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptSignHashW
CryptEnumProvidersW
SystemFunction036
RegOpenKeyW
RegEnumKeyW
CryptAcquireContextA
GetSidIdentifierAuthority
IsValidSecurityDescriptor
GetSidSubAuthorityCount

gdi32

DeleteObject
GetObjectW
GetEnhMetaFileBits
DeleteEnhMetaFile
CopyEnhMetaFileW
SetStretchBltMode
GetDIBits
StretchBlt
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
CreateFontW
CreateSolidBrush
SetBkColor
SetTextColor
GetDeviceCaps
SetDIBColorTable
CreateDIBSection
DeleteDC

kernel32

HeapSetInformation
ResetEvent
QueueUserAPC
GetLocalTime
SwitchToThread
GetThreadId
GetFileSize
GlobalMemoryStatusEx
FreeLibrary
CopyFileW
SleepEx
SystemTimeToTzSpecificLocalTime
CreateFileMappingW
CreateIoCompletionPort
MapViewOfFileEx
OpenThread
LoadLibraryExW
IsDebuggerPresent
ConnectNamedPipe
FlushFileBuffers
GetExitCodeProcess
FindFirstFileW
FindNextFileW
FindClose
QueryDosDeviceW
GetVolumeInformationW
GetLogicalDrives
FindFirstVolumeW
lstrlenW
DeviceIoControl
FindVolumeClose
FindNextVolumeW
GetDriveTypeW
CreateDirectoryW
GetTempPathW
GetDiskFreeSpaceW
MoveFileExW
VerSetConditionMask
VerifyVersionInfoW
OpenProcess
WaitForMultipleObjectsEx
SetWaitableTimer
CreateWaitableTimerW
CancelWaitableTimer
GetProcessTimes
GlobalSize
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetFileSizeEx
GetProcessId
Thread32Next
Thread32First
DuplicateHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetSystemDirectoryW
GetComputerNameW
SystemTimeToFileTime
TlsAlloc
TlsFree
FormatMessageA
TlsSetValue
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
TlsGetValue
RegisterWaitForSingleObject
UnregisterWaitEx
GetFileAttributesExW
GetVolumePathNamesForVolumeNameW
GetFullPathNameW
GetLocaleInfoW
GetUserDefaultLCID
MulDiv
GetVersionExW
GetSystemTime
WaitNamedPipeW
ReplaceFileA
GetFileAttributesExA
MoveFileA
RtlUnwind
CompareStringA
GetCurrentThreadId
LocalAlloc
WaitForSingleObject
SetStdHandle
IsValidCodePage
EnumSystemLocalesW
IsValidLocale
GetCommandLineA
SetConsoleCtrlHandler
ExitThread
RtlUnwindEx
QueryDepthSList
InterlockedFlushSList
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
UnhandledExceptionFilter
LCMapStringW
CompareStringW
GetCPInfo
GetStringTypeW
QueueUserWorkItem
RtlPcToFileHeader
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
LoadLibraryExA
VirtualQuery
VirtualProtect
PeekNamedPipe
GetEnvironmentVariableA
TerminateProcess
MoveFileExA
GetSystemDirectoryA
GetTempFileNameA
lstrlenA
CreateDirectoryA
FindFirstFileExA
lstrcmpW
ReleaseSemaphore
SetThreadAffinityMask
IsProcessorFeaturePresent
VirtualAlloc
GetThreadPriority
K32GetProcessImageFileNameW
GetConsoleOutputCP
InitializeCriticalSection
GetTimeZoneInformationForYear
GetDriveTypeA
WriteConsoleW
CreateThread
ExitProcess
CopyFileExW
GetFinalPathNameByHandleW
GetFileInformationByHandleEx
CreateMutexA
AcquireSRWLockShared
QueryPerformanceFrequency
WakeConditionVariable
SleepConditionVariableSRW
GetOverlappedResult
SetHandleInformation
SetFilePointerEx
SetFileInformationByHandle
GetCommandLineW
GetEnvironmentStringsW
RtlLookupFunctionEntry
RtlCaptureContext
SetThreadStackGuarantee
ReleaseSRWLockShared
FreeEnvironmentStringsW
AreFileApisANSI
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
CreateFileA
GetVersionExA
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryW
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
GetFileType
GetEnvironmentVariableW
GetStdHandle
RtlVirtualUnwind
CreateFiber
DeleteFiber
SwitchToFiber
GetComputerNameA
FindNextFileA
FindFirstFileA
GetCurrentDirectoryW
DeleteFileA
FindFirstFileExW
WTSGetActiveConsoleSessionId
GetComputerNameExW
GetTempFileNameW
GetFileAttributesW
GetFileInformationByHandle
MapViewOfFile
SetUnhandledExceptionFilter
QueryPerformanceCounter
K32GetModuleInformation
K32GetModuleBaseNameW
K32GetModuleFileNameExA
RtlCaptureStackBackTrace
GetModuleHandleExW
GetACP
GetSystemDefaultLCID
GetOEMCP
GetDateFormatW
CreateSemaphoreW
GetTimeFormatW
FileTimeToLocalFileTime
OpenEventW
K32EnumProcesses
K32GetModuleFileNameExW
GetCurrentProcess
SetLastError
HeapCreate
TryEnterCriticalSection
ReadFile
GetTickCount
GetSystemTimeAsFileTime
WideCharToMultiByte
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
LocalFree
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
CloseHandle
HeapReAlloc
DeleteFileW
InitializeCriticalSectionEx
RemoveDirectoryA
SetFilePointer
SetErrorMode
LeaveCriticalSection
SetEnvironmentVariableW
ExpandEnvironmentStringsW
WriteFile
EnterCriticalSection
HeapFree
SizeofResource
GetSystemInfo
WaitForSingleObjectEx
GetCurrentThread
FileTimeToSystemTime
SetEvent
GetTimeZoneInformation
CreateEventW
DisconnectNamedPipe
UnmapViewOfFile
ResumeThread
ReleaseMutex
CreateFileW
CreateMutexW
EnumResourceNamesW
SetEndOfFile
GetQueuedCompletionStatus
SetThreadPriority
WaitForMultipleObjects
CreateNamedPipeW
GetModuleFileNameW
VirtualFree
LockResource
RemoveDirectoryW
TerminateThread
GetLastError
FormatMessageW
Sleep
ProcessIdToSessionId
GetExitCodeThread
MultiByteToWideChar
PostQueuedCompletionStatus
CompareFileTime
HeapSize

ole32

WriteClassStg
CoCreateInstance
CoTaskMemFree
CoSetProxyBlanket
CoInitializeSecurity
StringFromGUID2
CoFreeUnusedLibraries
CreateBindCtx
PropVariantClear
CreatePointerMoniker
CoTaskMemAlloc
StgCreateDocfile
CLSIDFromString
CoUninitialize
CoInitialize
CoInitializeEx

oleaut32

VariantClear
SysFreeString
VariantChangeType
SysAllocString
VariantInit

user32

SetWindowPos
MonitorFromWindow
SetWindowLongPtrW
GetDlgItem
CreateDialogParamW
ShowWindow
IsDialogMessageW
GetClassLongPtrW
EnumWindows
VkKeyScanExW
GetDesktopWindow
GetWindow
GetWindowTextW
MessageBoxW
SetCapture
GetProcessWindowStation
EnumChildWindows
GetMessageW
DefWindowProcW
PostMessageW
CreateWindowExW
CreatePopupMenu
GetWindowLongW
GetWindowLongPtrW
RegisterClassExW
TrackPopupMenu
SystemParametersInfoW
GetForegroundWindow
SetFocus
DestroyWindow
GetUserObjectInformationW
LoadStringW
DispatchMessageW
SetTimer
DestroyIcon
DestroyMenu
TranslateMessage
LoadIconW
AppendMenuW
UnregisterClassW
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetParent
PostQuitMessage
GetClientRect
MapWindowPoints
IsWindowVisible
GetWindowTextLengthW
SetWindowsHookExW
UnhookWindowsHookEx
PostThreadMessageA
CallNextHookEx
GetLastInputInfo
SetClipboardData
GetClipboardSequenceNumber
LoadCursorW
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetPriorityClipboardFormat
CopyImage
GetClipboardOwner
CallWindowProcW
GetWindowThreadProcessId
SetDlgItemTextW
UnhookWinEvent
FlashWindow
MessageBeep
ExitWindowsEx
InvalidateRect
KillTimer
GetClassInfoExW
SetForegroundWindow
GetCursorPos
GetWindowRect
SetWindowTextW
GetMonitorInfoW
SetWinEventHook
PostThreadMessageW
GetSystemMetrics
SetDlgItemInt
GetKeyNameTextW
MapVirtualKeyExW
GetKeyState
GetGUIThreadInfo
GetClassNameW
GetKeyboardLayout
PeekMessageW
IsWindow
WindowFromPoint
MsgWaitForMultipleObjects
GetFocus
ActivateKeyboardLayout
ToUnicodeEx
GetKeyboardLayoutList
GetKeyboardLayoutNameW
IsIconic
SendMessageW
FindWindowExW
CharLowerBuffW
ReleaseDC
DrawIconEx
GetCursorInfo
GetIconInfo
GetDC
SendInput
mouse_event
LoadKeyboardLayoutW
SetWindowLongW
GetSysColor
GetDlgCtrlID
RedrawWindow
DdeFreeStringHandle
DdeDisconnect
DdeFreeDataHandle
DdeClientTransaction
DdeUninitialize
keybd_event
DdeInitializeW
DdeGetLastError
DdeConnect
DdeCreateStringHandleW
RegisterClassW
SetThreadDesktop
CloseDesktop
OpenInputDesktop
DdeAccessData
DdeUnaccessData
MapVirtualKeyW

winspool.drv

GetPrinterW
SetPrinterW
EnumPrintersW
FindFirstPrinterChangeNotification
OpenPrinterW
GetJobW
EnumPrintProcessorDatatypesW
FreePrinterNotifyInfo
SetJobW
FindClosePrinterChangeNotification
EnumJobsW
ClosePrinter
FindNextPrinterChangeNotification

ws2_32

ntohl
select
gethostbyname
WSASend
listen
WSAIoctl
accept
__WSAFDIsSet
gethostname
WSAWaitForMultipleEvents
WSASetLastError
WSAStringToAddressW
WSASocketW
getpeername
getsockname
ntohs
connect
WSAAddressToStringW
getservbyname
bind
WSARecv
getsockopt
htons
ioctlsocket
setsockopt
WSAGetLastError
htonl
WSACleanup
shutdown
WSAStartup
closesocket
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
inet_ntoa
send
recv
recvfrom
socket
inet_addr
getaddrinfo
freeaddrinfo
getnameinfo
sendto

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

dbghelp

MiniDumpWriteDump
ImageNtHeader

wldap32

ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143
ord26

nspr4

PR_Cleanup
PR_ErrorToString
PR_Init
PR_GetError

nss3

PORT_Free
CERT_ChangeCertTrust
NSS_Shutdown
NSS_Initialize
CERT_DestroyName
PK11_ImportCert
PORT_ZAlloc
NSS_NoDB_Init
PK11_FreeSlot
CERT_GetCommonName
CERT_AsciiToName
CERT_GetOrgName
CERT_DestroyCertificate
CERT_GetDefaultCertDB
PK11_FindCertFromDERCert
PK11_GetInternalKeySlot
CERT_DecodeTrustString

smime3

CERT_DecodeCertFromPackage

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathAppendW
PathStripPathW
PathMatchSpecW
SHCreateStreamOnFileEx
ord219
PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
SHDeleteKeyW
PathRemoveExtensionW
StrCmpIW
PathAddExtensionW
PathCanonicalizeW
StrToIntA
StrStrIW
PathCombineW
UrlEscapeA
StrToInt64ExA
PathStripPathA

userenv

DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
ExpandEnvironmentStringsForUserW

gdiplus

GdipGetImageHeight
GdipImageRotateFlip
GdipBitmapUnlockBits
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipGetImageWidth
GdiplusStartup
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipFree
GdiplusShutdown
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize

pdh

PdhCloseQuery
PdhAddCounterW
PdhLookupPerfNameByIndexW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhOpenQueryW
PdhCollectQueryData
PdhGetRawCounterValue

wtsapi32

WTSLogoffSession
WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationW

setupapi

CM_Get_Parent
CM_Get_DevNode_Registry_Property_ExW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
CM_Get_Parent_Ex
CMP_WaitNoPendingInstallEvents
CM_Disable_DevNode
CM_Get_Child
CM_Get_Device_ID_Size_Ex
CM_Get_Sibling
CM_Get_Device_ID_ExW
CM_Enable_DevNode
CM_Get_DevNode_Status
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

fltlib

FilterVolumeFindClose
FilterVolumeFindNext
FilterVolumeFindFirst
FilterGetDosName
FilterReplyMessage
FilterGetMessage
FilterSendMessage
FilterConnectCommunicationPort
FilterUnload
FilterLoad

activeds

ord9

oleacc

AccessibleChildren
AccessibleObjectFromWindow

wintrust

WinVerifyTrust

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer

netapi32

NetWkstaGetInfo
DsGetDcNameW
NetApiBufferFree
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CertAddEncodedCertificateToStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreA
CryptBinaryToStringA
CryptStringToBinaryA
PFXImportCertStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CryptDecodeObjectEx

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

Exports

Exports

AddInLog
GetMAPIModule

Sections

.text
Size: 21.6MB - Virtual size: 21.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10.5MB - Virtual size: 10.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 473KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64b9c7f429a9422fc07bd027191321ab

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

47:07:d4:0b:50:82:fe:aa:6e:0a:5e:92Certificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

12:9b:5a:01:32:cc:fe:ce:06:d6:2c:a7:26:67:29:fe:d6:a2:ac:5c:bf:bd:a4:a0:45:f9:82:fb:69:43:dc:9bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

gdi32

kernel32

ole32

oleaut32

user32

winspool.drv

ws2_32

rpcrt4

version

dbghelp

wldap32

nspr4

nss3

smime3

shlwapi

userenv

gdiplus

pdh

wtsapi32

setupapi

fltlib

activeds

oleacc

wintrust

secur32

netapi32

crypt32

bcrypt

Exports

Exports

Sections

.text Size: 21.6MB - Virtual size: 21.6MB

.rdata Size: 10.5MB - Virtual size: 10.5MB

.data Size: 473KB - Virtual size: 2.0MB

.pdata Size: 1.3MB - Virtual size: 1.3MB

.gehcont Size: 512B - Virtual size: 40B

.rsrc Size: 25KB - Virtual size: 25KB

.reloc Size: 182KB - Virtual size: 182KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

47:07:d4:0b:50:82:fe:aa:6e:0a:5e:92
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

12:9b:5a:01:32:cc:fe:ce:06:d6:2c:a7:26:67:29:fe:d6:a2:ac:5c:bf:bd:a4:a0:45:f9:82:fb:69:43:dc:9b
Signer

.text
Size: 21.6MB - Virtual size: 21.6MB

.rdata
Size: 10.5MB - Virtual size: 10.5MB

.data
Size: 473KB - Virtual size: 2.0MB

.pdata
Size: 1.3MB - Virtual size: 1.3MB

.gehcont
Size: 512B - Virtual size: 40B

.rsrc
Size: 25KB - Virtual size: 25KB

.reloc
Size: 182KB - Virtual size: 182KB