2024-06-30_f59882a8d5917313b088e5047ee1c2f3_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-30_f59882a8d5917313b088e5047ee1c2f3_ryuk
Size

13.5MB
MD5

f59882a8d5917313b088e5047ee1c2f3
SHA1

1e145b1ea1989c1198414c4c5dd9098589681799
SHA256

ed17b1df47afab9aab02f4a43f47de355d779392bd89f1f2213a4e09cd9b8d01
SHA512

e7a9bea2805c552e3022ea96adcf946a36a20e48b2399ff18daabf735c54e2b8fe6be021610b338b5fc1e6ec2ca2377ab900f91c30244a6a12227e3141612773
SSDEEP

49152:AGo8DZyGRBmnGxV4IiwW4e0YSej1NLvZN8RVByazRmKcEbP/+l5C+GqtvmVP88pI:Aj4/WAzx0CEep3TV89KSG63j

Score

1^/10

Malware Config

Signatures

Files

2024-06-30_f59882a8d5917313b088e5047ee1c2f3_ryuk
.exe windows:6 windows x64 arch:x64

3d70d8f403509221d226cecf04859926

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18/10/2022, 00:00

Not After

15/10/2025, 23:59

Subject

CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6e:d3:10:16:1c:08:5c:21:c4:bd:be:61:ef:53:d4:02:03:f5:ed:95:2d:4a:48:f2:47:14:09:20:17:3e:76:63
Signer

Actual PE Digest

6e:d3:10:16:1c:08:5c:21:c4:bd:be:61:ef:53:d4:02:03:f5:ed:95:2d:4a:48:f2:47:14:09:20:17:3e:76:63

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\dvs\p4\build\sw\rel\gpu_drv\r555\r555_00\drivers\ui\Sedona\Sedona\x64\Release\bin\nvCplUI.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

rpcrt4

UuidFromStringW

gdiplus

GdipDrawImageRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFontFromLogfontW
GdipCreateFont
GdipDeleteFont
GdipGetLogFontW
GdipDrawString
GdipMeasureString
GdipCreateStringFormat
GdipSetTextRenderingHint
GdipSetStringFormatAlign
GdipGetDpiY
GdipGetFontHeightGivenDPI
GdipLoadImageFromStream
GdipCloneImage
GdipDisposeImage
GdiplusStartup
GdiplusShutdown
GdipGetFontHeight
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageDimension
GdipCreateSolidFill
GdipDeleteBrush
GdipFree
GdipCloneBrush
GdipDeleteStringFormat
GdipCreateBitmapFromScan0
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipAlloc

wtsapi32

WTSRegisterSessionNotification
WTSQueryUserToken
WTSUnRegisterSessionNotification

shlwapi

StrFormatKBSizeW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFileExistsW
SHSetValueW
SHGetValueW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx
ord17
ImageList_AddMasked
ImageList_Create
ImageList_Draw
ImageList_ReplaceIcon

msimg32

TransparentBlt
AlphaBlend

setupapi

SetupDiEnumDeviceInfo
CM_Get_Parent
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList

kernel32

UnlockFile
DuplicateHandle
MoveFileW
GetStringTypeExW
GlobalGetAtomNameW
lstrcmpA
CompareStringA
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
SearchPathW
GetTempPathW
GetProfileIntW
FileTimeToLocalFileTime
GetFileAttributesExW
GetVolumeInformationW
SystemTimeToTzSpecificLocalTime
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
CompareStringW
GetSystemDefaultUILanguage
GlobalFlags
VirtualProtect
lstrcpyW
GetCurrentDirectoryW
SetErrorMode
GetWindowsDirectoryW
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetFilePointer
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetShortPathNameW
GetFileSize
FlushFileBuffers
DeleteFileW
GetUserDefaultLCID
SystemTimeToFileTime
ReplaceFileW
SetFileTime
GetTempFileNameW
GetFileTime
GetDiskFreeSpaceW
ResumeThread
SetThreadPriority
CreateEventW
InitializeCriticalSectionAndSpinCount
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
GetModuleHandleExW
EncodePointer
OutputDebugStringA
CopyFileW
GlobalSize
LoadLibraryExA
ExpandEnvironmentStringsA
GetModuleFileNameA
CreateProcessW
GetFullPathNameW
SetEndOfFile
ReadFile
UnhandledExceptionFilter
LockFile
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
GetModuleHandleExA
OpenMutexW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
WideCharToMultiByte
GetSystemTimeAsFileTime
GetProcessTimes
CreateEventA
WaitForSingleObjectEx
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
WriteFile
GetFileSizeEx
ExpandEnvironmentStringsW
SetThreadUILanguage
SetThreadLocale
GetSystemDirectoryW
GetCurrentThread
GetCurrentProcess
DecodePointer
GetComputerNameW
GetLocalTime
CreateFileW
GetTickCount
CreateMutexW
ReleaseMutex
OutputDebugStringW
lstrcmpW
OpenEventW
WaitForSingleObject
GetFileAttributesW
FindFirstFileW
FindClose
GetEnvironmentVariableW
GlobalFree
GlobalLock
GlobalUnlock
GetStringTypeW
LCMapStringW
GetCPInfo
FormatMessageA
GlobalAlloc
lstrcatW
lstrlenW
MultiByteToWideChar
lstrcmpiW
MulDiv
LoadLibraryExW
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetCurrentThreadId
IsBadReadPtr
GetModuleHandleW
GetModuleFileNameW
GetUserDefaultUILanguage
LoadLibraryW
ProcessIdToSessionId
GetCurrentProcessId
CloseHandle
FileTimeToSystemTime
GetProcAddress
FreeLibrary
LocalAlloc
CreateThread
Sleep
GetThreadLocale
VerifyVersionInfoW
lstrcpynW
FreeResource
FindResourceExW
GetVersionExW
VerSetConditionMask
GetSystemDefaultLCID
GetUserDefaultLangID
GetLocaleInfoW
FormatMessageW
LocalFree
FindResourceW
SizeofResource
LockResource
LoadResource
SetLastError
GetLastError
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
SetFilePointerEx
DeviceIoControl
GetModuleHandleA
MoveFileExW
AreFileApisANSI
RtlUnwindEx
RtlPcToFileHeader
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
HeapQueryInformation
GetSystemInfo
VirtualQuery
SetStdHandle
GetFileType
GetStdHandle
ExitProcess
GetConsoleCP
GetConsoleMode
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
ReadConsoleW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
LocalFileTimeToFileTime
WriteConsoleW

user32

EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
GetAsyncKeyState
RealChildWindowFromPoint
UnionRect
LockWindowUpdate
MonitorFromPoint
MapDialogRect
SetWindowContextHelpId
RegisterClipboardFormatW
ShowOwnedPopups
PostQuitMessage
IsZoomed
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
CharUpperW
GetMessageW
GetIconInfo
CopyImage
GetNextDlgGroupItem
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
MapVirtualKeyW
GetKeyNameTextW
SendDlgItemMessageA
GetActiveWindow
CreateDialogIndirectParamW
CheckDlgButton
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetScrollInfo
GetLastActivePopup
GetTopWindow
EqualRect
MessageBoxW
AdjustWindowRectEx
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
ValidateRect
GetForegroundWindow
SetActiveWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetWindowPlacement
GetWindowPlacement
IsMenu
GetClassInfoExW
GetClassInfoW
GetMessageTime
GetMessagePos
GetMenuState
GetMenuStringW
SetRectEmpty
GetWindowThreadProcessId
GetShellWindow
PeekMessageW
DispatchMessageW
TranslateMessage
DrawFocusRect
GetUpdateRect
DestroyCursor
CallWindowProcW
SystemParametersInfoW
GetClassLongPtrW
GetDCEx
GetSystemMenu
ReleaseCapture
SetCapture
EndDeferWindowPos
BeginDeferWindowPos
LoadImageW
FillRect
DrawIcon
SetParent
EnumDisplayDevicesW
EnumWindows
DrawStateW
SetWindowTextW
SetForegroundWindow
IsIconic
OffsetRect
SetMenuDefaultItem
IsClipboardFormatAvailable
IsChild
GetClassNameW
GetKeyState
SetFocus
GetMenuItemInfoW
DeleteMenu
DestroyMenu
LoadMenuIndirectW
WindowFromPoint
ScreenToClient
EnumDisplayMonitors
EnumDisplaySettingsW
GetWindow
FindWindowW
GetDesktopWindow
SetRect
LockSetForegroundWindow
UpdateWindow
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
CreatePopupMenu
LoadMenuW
IsWindowEnabled
GetFocus
CharLowerW
GetNextDlgTabItem
CreateWindowExW
SendNotifyMessageW
wsprintfW
SetWindowLongW
GetWindowLongW
CopyRect
GetWindowTextLengthW
GetWindowTextW
DrawTextW
IsRectEmpty
EndPaint
BeginPaint
RegisterClassW
DefWindowProcW
GetParent
IntersectRect
SetCursor
TrackMouseEvent
WinHelpW
IsDialogMessageW
DestroyIcon
ReleaseDC
GetDC
GetSystemMetrics
CharNextW
GetDialogBaseUnits
CreateDialogParamW
DestroyWindow
UnregisterClassW
DrawIconEx
LoadCursorW
GetTabbedTextExtentW
MessageBeep
PostThreadMessageW
CopyAcceleratorTableW
InvalidateRgn
CreateMenu
GetMenuDefaultItem
HideCaret
InvertRect
NotifyWinEvent
SetClassLongPtrW
SetCursorPos
CopyIcon
FrameRect
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
PtInRect
ClientToScreen
RedrawWindow
SetWindowRgn
KillTimer
SetTimer
IsWindowVisible
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
GetWindowRgn
RegisterClassExW
DrawFrameControl
GetSysColorBrush
GetSysColor
DrawEdge
UpdateLayeredWindow
FindWindowExW
EnableScrollBar
LoadBitmapW
InvalidateRect
SetLayeredWindowAttributes
PostMessageW
RegisterWindowMessageW
GetMonitorInfoW
MonitorFromWindow
SetScrollInfo
SetWindowLongPtrW
GetWindowLongPtrW
SetScrollPos
ScrollWindow
EnableWindow
MoveWindow
GetClientRect
IsWindow
LoadIconW
MapWindowPoints
MessageBoxExW
GetWindowRect
GetDlgCtrlID
SendDlgItemMessageW
IsDlgButtonChecked
SetDlgItemTextW
GetDlgItem
EndDialog
DialogBoxParamW
SetWindowPos
ShowWindow
SendMessageW
GetDoubleClickTime
DestroyAcceleratorTable
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
CharUpperBuffW
MapVirtualKeyExW
IsCharLowerW
GetComboBoxInfo
WaitMessage
InflateRect
ModifyMenuW
GetCursorPos
CreateAcceleratorTableW
DeferWindowPos

gdi32

BitBlt
GetObjectW
SetTextColor
SetBkMode
SelectObject
ScaleViewportExtEx
CreateBitmap
CreateCompatibleDC
GetBitmapDimensionEx
GetDeviceCaps
StretchBlt
SetBitmapDimensionEx
GetTextExtentPoint32W
CombineRgn
CreateRectRgn
CreateRoundRectRgn
CreateSolidBrush
FrameRgn
GetRgnBox
ScaleWindowExtEx
SetRectRgn
GetBkColor
CreateEllipticRgn
Ellipse
LPtoDP
CreateFontW
GetCharWidthW
StretchDIBits
EndDoc
OffsetViewportOrgEx
EndPage
AbortDoc
SetAbortProc
GetViewportOrgEx
CreateDIBitmap
GetTextCharsetInfo
RealizePalette
SetPixel
SetDIBColorTable
Polygon
Polyline
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetWindowOrgEx
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
OffsetRgn
RoundRect
FillRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
SetWindowOrgEx
SetWindowExtEx
SetViewportExtEx
GetWindowExtEx
TextOutW
MoveToEx
StartDocW
SetTextAlign
SetStretchBltMode
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
GetStockObject
DeleteObject
LineTo
StartPage
CreateFontIndirectW
GetViewportExtEx
GetPixel
GetObjectType
GetCurrentPositionEx
ExcludeClipRect
Escape
CreatePatternBrush
CreateHatchBrush
CopyMetaFileW
DPtoLP
SetMapMode
SetBkColor
GetMapMode
CreateDIBSection
SetDIBitsToDevice
SetViewportOrgEx
Rectangle
PatBlt
CreatePen
CreateDCW
GetTextColor
ExtTextOutW
EnumFontFamiliesW
CreateRectRgnIndirect
OffsetWindowOrgEx
GetClipBox
GetTextFaceW
DeleteDC
CreateCompatibleBitmap
GetTextMetricsW
GetTextExtentPointW
GetCurrentObject
CreatePolygonRgn
IntersectClipRect

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW
GetJobW

advapi32

RegEnumKeyW
SetFileSecurityW
GetFileSecurityW
RegSetValueW
RegOpenKeyExA
RegQueryValueExA
RegOpenCurrentUser
EqualSid
TraceMessage
RegEnumValueW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
InitializeSecurityDescriptor
InitializeAcl
ImpersonateSelf
GetTokenInformation
GetLengthSid
FreeSid
AllocateAndInitializeSid
AddAccessAllowedAce
AccessCheck
OpenThreadToken
OpenProcessToken
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RevertToSelf
ImpersonateLoggedOnUser
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueW

shell32

SHGetFileInfoW
ShellExecuteExW
ExtractAssociatedIconW
ShellExecuteW
DragQueryFileW
DragFinish
SHAddToRecentDocs
ExtractIconW
SHGetFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
SHAppBarMessage
SHGetDesktopFolder
SHGetSpecialFolderLocation

ole32

OleLockRunning
OleDuplicateData
ReleaseStgMedium
StringFromCLSID
StringFromGUID2
CoRevokeClassObject
CoRegisterClassObject
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoGetMalloc
CoCreateInstance
CoDisconnectObject
RevokeDragDrop
RegisterDragDrop
CoUninitialize
CoInitializeEx
CoCreateGuid
CoInitialize
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CLSIDFromProgID
CoGetClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleGetClipboard
CoLockObjectExternal
DoDragDrop

oleaut32

VarBstrFromDate
VariantCopy
OleCreateFontIndirect
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantClear
VariantInit
UnRegisterTypeLi
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SysAllocStringLen
SafeArrayCreateVector
SafeArrayPutElement
SysAllocString

oledlg

OleUIBusyW

uiautomationcore

UiaHostProviderFromHwnd
UiaDisconnectProvider
UiaReturnRawElementProvider

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

uxtheme

CloseThemeData
DrawThemeBackground
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetWindowTheme
GetCurrentThemeName
GetThemeColor
DrawThemeText
DrawThemeParentBackground
IsAppThemed
OpenThemeData

winmm

PlaySoundW

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1011KB - Virtual size: 1010KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9.5MB - Virtual size: 9.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d70d8f403509221d226cecf04859926

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:baCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

6e:d3:10:16:1c:08:5c:21:c4:bd:be:61:ef:53:d4:02:03:f5:ed:95:2d:4a:48:f2:47:14:09:20:17:3e:76:63Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

rpcrt4

gdiplus

wtsapi32

shlwapi

comctl32

msimg32

setupapi

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

oledlg

uiautomationcore

oleacc

uxtheme

winmm

imm32

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 1011KB - Virtual size: 1010KB

.data Size: 53KB - Virtual size: 104KB

.pdata Size: 130KB - Virtual size: 129KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 9.5MB - Virtual size: 9.5MB

.reloc Size: 74KB - Virtual size: 73KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

6e:d3:10:16:1c:08:5c:21:c4:bd:be:61:ef:53:d4:02:03:f5:ed:95:2d:4a:48:f2:47:14:09:20:17:3e:76:63
Signer

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 1011KB - Virtual size: 1010KB

.data
Size: 53KB - Virtual size: 104KB

.pdata
Size: 130KB - Virtual size: 129KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 9.5MB - Virtual size: 9.5MB

.reloc
Size: 74KB - Virtual size: 73KB