General

Malware Config

Signatures

Files

• 3092939bde0ec7e9306daeb85977ba60N.exe

  .exe windows:6 windows x64 arch:x64

  04ca5b7722129c0fdf64a07d0a134bc5

  
  

  Code Sign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  ce:48:4b:b2:9d:d5:f2:46:f7:95:c8:5f:d4:65:37:42

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  14-04-2022 00:00

  Not After

  01-04-2023 23:59

  Subject

  CN=Art Hard s.r.o.,O=Art Hard s.r.o.,ST=Praha\, Hlavní město,C=CZ

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  1d:a4:34:0a:ab:0a:c7:a5:c8:82:0a:ca:46:f2:bd:5b:69:63:31:f1:76:00:cf:88:34:fe:63:5c:6a:8c:4d:25

  Signer

  Actual PE Digest

  1d:a4:34:0a:ab:0a:c7:a5:c8:82:0a:ca:46:f2:bd:5b:69:63:31:f1:76:00:cf:88:34:fe:63:5c:6a:8c:4d:25

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  advapi32

  RegCloseKey

  RegOpenKeyExW

  RegQueryValueExW

  kernel32

  AddVectoredExceptionHandler

  CloseHandle

  CompareStringA

  CompareStringW

  CreateDirectoryA

  CreateEventW

  CreateFileA

  CreateFileW

  CreateMutexA

  CreateSemaphoreA

  CreateThread

  DeleteCriticalSection

  DeleteFileA

  DuplicateHandle

  EnterCriticalSection

  EnumCalendarInfoW

  EnumSystemLocalesW

  ExitProcess

  ExitThread

  FindClose

  FindFirstFileW

  FindResourceA

  FormatMessageW

  FreeEnvironmentStringsA

  FreeLibrary

  FreeResource

  GetACP

  GetCPInfo

  GetCPInfoExW

  GetCommandLineA

  GetCommandLineW

  GetConsoleWindow

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetDateFormatW

  GetDiskFreeSpaceW

  GetEnvironmentStrings

  GetExitCodeThread

  GetFileAttributesA

  GetFileAttributesW

  GetFileSize

  GetFileType

  GetFullPathNameW

  GetLastError

  GetLocalTime

  GetLocaleInfoA

  GetLocaleInfoW

  GetModuleFileNameA

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleW

  GetOEMCP

  GetProcAddress

  GetProcessHeap

  GetStartupInfoA

  GetStartupInfoW

  GetStdHandle

  GetStringTypeA

  GetStringTypeW

  GetSystemDefaultLangID

  GetSystemDefaultUILanguage

  GetSystemInfo

  GetSystemTimeAsFileTime

  GetThreadLocale

  GetThreadPriority

  GetTickCount

  GetTimeZoneInformation

  GetUserDefaultLCID

  GetUserDefaultUILanguage

  GetVersion

  GetVersionExA

  GetVersionExW

  HeapAlloc

  HeapCreate

  HeapDestroy

  HeapFree

  InitializeCriticalSection

  IsDBCSLeadByteEx

  IsDebuggerPresent

  IsValidLocale

  LCMapStringA

  LCMapStringW

  LeaveCriticalSection

  LoadLibraryA

  LoadLibraryExW

  LoadLibraryW

  LoadResource

  LocalAlloc

  LocalFileTimeToFileTime

  LocalFree

  LockResource

  MultiByteToWideChar

  QueryPerformanceCounter

  QueryPerformanceFrequency

  RaiseException

  ReadFile

  ReleaseMutex

  ReleaseSemaphore

  RemoveDirectoryA

  RemoveVectoredExceptionHandler

  ResetEvent

  ResumeThread

  RtlCaptureContext

  RtlUnwind

  SetConsoleCtrlHandler

  SetEndOfFile

  SetEvent

  SetFilePointer

  SetFileTime

  SetHandleCount

  SetLastError

  SetThreadLocale

  SetThreadPriority

  Sleep

  SuspendThread

  SwitchToThread

  SystemTimeToFileTime

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  UnhandledExceptionFilter

  VerSetConditionMask

  VerifyVersionInfoW

  VirtualAlloc

  VirtualFree

  VirtualQuery

  VirtualQueryEx

  WaitForSingleObject

  WaitForSingleObjectEx

  WideCharToMultiByte

  WriteFile

  lstrlenW

  RtlRestoreContext

  RtlUnwindEx

  user32

  CharLowerBuffA

  CharLowerBuffW

  CharNextW

  CharUpperBuffA

  CharUpperBuffW

  CharUpperW

  EnumThreadWindows

  GetSystemMetrics

  LoadStringW

  MessageBoxW

  MsgWaitForMultipleObjects

  PeekMessageW

  ShowWindow

  wsprintfA

  oleaut32

  SafeArrayCreate

  SafeArrayGetLBound

  SafeArrayGetUBound

  SafeArrayPtrOfIndex

  SysAllocStringLen

  SysFreeString

  SysReAllocStringLen

  VariantChangeType

  VariantClear

  VariantCopy

  VariantInit

  Exports

  Exports

  __CPPdebugHook

  __setRaiseListFuncAddr

  Sections

  .text

  Size: 956KB - Virtual size: 955KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rodata

  Size: 514KB - Virtual size: 514KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 3.1MB - Virtual size: 3.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 168KB - Virtual size: 168KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 40B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didata

  Size: 512B - Virtual size: 452B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 111B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 63KB - Virtual size: 63KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ