51340187adce4b0b5d7260eb68192755f6cc0e053708ea4ea170985c8e54e765

Sharing

Copy URL Twitter E-mail

General

Target

51340187adce4b0b5d7260eb68192755f6cc0e053708ea4ea170985c8e54e765
Size

2.9MB
MD5

31a993dc3e658ffc882c5d7277d4854c
SHA1

40793c29d36379f68719ed772b7a3c10ab2821d6
SHA256

51340187adce4b0b5d7260eb68192755f6cc0e053708ea4ea170985c8e54e765
SHA512

b6794f92e84df18fca133548c0b251b76a0378b848fc307116d27471a1844f08fbd17d9fbb343f134716bae2cb699582648c3e847288a18f96c2ffb5610acc38
SSDEEP

49152:exPP8y6Ydb/yGVkDy3HdKCZsnCGKVydm9r5ZSEys5gOxoILHkly9d3OnqikCin:euatyG2rCZWRKVy8ZSEzWOxoIyy9luqv

Score

1^/10

Malware Config

Signatures

Files

51340187adce4b0b5d7260eb68192755f6cc0e053708ea4ea170985c8e54e765
.zip
cacert.pem
coodesker-x64.exe
.exe windows:6 windows x64 arch:x64

24aaf77e12a74001f0814f79f9dfa655

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:1e:42:57:7b:04:aa:2d:c2:67:b7:c2:43:e9:17:4c
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

12/07/2023, 00:00

Not After

11/07/2024, 23:59

Subject

SERIALNUMBER=91110400MACB3C7M2E,CN=Beijing Coodesker Technology Co.\, Ltd.,O=Beijing Coodesker Technology Co.\, Ltd.,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:1e:42:57:7b:04:aa:2d:c2:67:b7:c2:43:e9:17:4c
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

12/07/2023, 00:00

Not After

11/07/2024, 23:59

Subject

SERIALNUMBER=91110400MACB3C7M2E,CN=Beijing Coodesker Technology Co.\, Ltd.,O=Beijing Coodesker Technology Co.\, Ltd.,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d1:7b:90:62:e7:f2:81:74:5e:5d:e6:cf:fb:a7:82:62:2f:11:cf:31:41:49:70:ab:ef:96:41:57:70:fe:c8:88
Signer

Actual PE Digest

d1:7b:90:62:e7:f2:81:74:5e:5d:e6:cf:fb:a7:82:62:2f:11:cf:31:41:49:70:ab:ef:96:41:57:70:fe:c8:88

Digest Algorithm

sha256

PE Digest Matches

true

40:36:e8:14:72:3f:aa:75:92:06:e5:a8:3f:21:6e:82:2d:a2:b0:56
Signer

Actual PE Digest

40:36:e8:14:72:3f:aa:75:92:06:e5:a8:3f:21:6e:82:2d:a2:b0:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\Tools\Future\coodesker\bin\coodesker-x64.pdb

Imports

version

VerQueryValueW

kernel32

GetTickCount64
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
GetLastError
DeleteCriticalSection
SetThreadPriority
CreateSemaphoreA
GetVolumeInformationW
GetStdHandle
GetVersionExW
UnmapViewOfFile
GetVersion
GetSystemInfo
CreateFileMappingW
MapViewOfFile
VirtualQuery
ReadFile
GetCurrentDirectoryW
HeapAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
GetFileSize
GetModuleHandleA
GetEnvironmentVariableW
GetStringTypeW
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
GetLocaleInfoW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
RtlCaptureContext
GetProcessHeap
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetModuleHandleW
IsProcessorFeaturePresent
ResetEvent
GetStartupInfoW
GetFileType
GetCurrentThreadId
MulDiv
VerSetConditionMask
VerifyVersionInfoW
GetTickCount
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetEnvironmentVariableA
MoveFileExW
SetNamedPipeHandleState
RtlUnwindEx
FreeLibraryAndExitThread
VirtualProtect
GetFileAttributesExW
WriteConsoleW
ExitProcess
CloseHandle
SetConsoleCtrlHandler
GetDriveTypeW
CreateFileA
GetTimeZoneInformation
IsValidLocale
EnumSystemLocalesW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetConsoleCP
GetFullPathNameW
FormatMessageW
ExpandEnvironmentStringsW
HeapDestroy
HeapReAlloc
HeapSize
CreateMutexW
TerminateProcess
GetUserDefaultLCID
GetCommandLineW
LoadLibraryExW
RaiseException
DecodePointer
Sleep
GetModuleFileNameW
TerminateThread
CreateSemaphoreW
WaitForMultipleObjects
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
SetUnhandledExceptionFilter
GetCurrentProcess
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceW
CancelIo
ReadDirectoryChangesW
ExitThread
SetEvent
SleepEx
SetErrorMode
CreateEventW
CreateThread
FreeLibrary
LoadLibraryW
MultiByteToWideChar
GetFileInformationByHandle
LocalFree
GetFileSizeEx
GetTimeFormatW
GetDateFormatW
DeleteFileW
FlushFileBuffers
SetFilePointer
SetEndOfFile
SetFilePointerEx
WriteFile
CreateFileW
FindNextFileW
lstrcmpiW
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
CreateSemaphoreExW
CreateMutexExW
GetCurrentProcessId
OpenSemaphoreW
WaitForSingleObject
WaitForSingleObjectEx
GetSystemDirectoryW
FileTimeToSystemTime
LCMapStringW
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
GetProcAddress
FindFirstFileW
FindClose
CompareFileTime
GlobalAlloc
GlobalLock
GlobalSize
GlobalUnlock
GlobalFree
IsDebuggerPresent
OutputDebugStringW
SetLastError
ReleaseSemaphore
ReleaseMutex
GetSystemTime
RtlUnwind
PeekNamedPipe
CompareStringW

user32

GetAsyncKeyState
GetProcessWindowStation
GetUpdateRect
GetPropW
SetPropW
LoadImageW
RegisterClassW
SetWindowRgn
IsZoomed
GetUserObjectInformationW
IsIconic
CharUpperW
SetActiveWindow
AttachThreadInput
EnumWindows
BringWindowToTop
GetClassNameW
GetDesktopWindow
DrawTextW
MonitorFromWindow
MonitorFromPoint
ClipCursor
SetCursor
ReleaseCapture
GetCapture
SetCapture
GetFocus
GetParent
UpdateLayeredWindow
RedrawWindow
BeginPaint
EndPaint
SetWindowTextW
GetKeyNameTextW
ScreenToClient
WindowFromPoint
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageW
UnhookWinEvent
SetWinEventHook
GetSysColor
FindWindowExW
GetDlgItem
UpdateWindow
SetParent
GetForegroundWindow
ChangeClipboardChain
SetClipboardViewer
SystemParametersInfoW
PostQuitMessage
GetWindowRect
InvalidateRect
MoveWindow
GetCursorPos
GetDoubleClickTime
UnionRect
PrivateExtractIconsW
ShowWindow
SetMenuItemBitmaps
AppendMenuW
SetWindowLongPtrW
IntersectRect
InflateRect
PtInRect
SetRectEmpty
IsRectEmpty
IsWindowVisible
CallWindowProcW
MapVirtualKeyW
SetForegroundWindow
SetWindowLongW
GetWindowLongW
SetFocus
EnableWindow
GetWindow
LoadCursorW
GetClassInfoExW
FindWindowW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
UnregisterClassW
SetTimer
KillTimer
EqualRect
OffsetRect
EnumDisplayMonitors
GetSystemMetrics
CharLowerW
GetMonitorInfoW
PostMessageW
ClientToScreen
GetWindowThreadProcessId
MessageBoxW
wsprintfW
GetWindowTextW
GetWindowTextLengthW
SetWindowPos
MapWindowPoints
GetClientRect
DeleteMenu
GetMenuItemInfoW
EnableMenuItem
SetMenuItemInfoW
InsertMenuItemW
GetMenuItemCount
DestroyIcon
GetIconInfo
GetDC
ReleaseDC
GetKeyState
GetClipboardData
IsClipboardFormatAvailable
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
SendMessageW
DestroyMenu
TrackPopupMenu
CreatePopupMenu
RegisterClipboardFormatW
DestroyWindow
GetWindowLongPtrW
DefWindowProcW
RegisterClassExW
CreateWindowExW
IsWindow
SendMessageTimeoutW

gdi32

ExtSelectClipRgn
GetDeviceCaps
StretchBlt
SaveDC
RestoreDC
GetWindowOrgEx
SetWindowOrgEx
CreateCompatibleBitmap
SetBkMode
SetBkColor
SetTextColor
SetWorldTransform
SetGraphicsMode
CreateRectRgn
CreateRectRgnIndirect
GetClipRgn
SelectClipRgn
PatBlt
BitBlt
GetBitmapBits
GetObjectW
SetViewportOrgEx
GetViewportOrgEx
CreateFontIndirectW
DeleteDC
CreateCompatibleDC
DeleteObject
GetDIBits
CreateDIBSection
SelectObject
CreateRoundRectRgn
GetStockObject
SetStretchBltMode
GetObjectA

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegEnumKeyExW
CryptAcquireContextW
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
RegCreateKeyExW
RegCloseKey
IsValidSid
GetLengthSid
CopySid
RegDeleteValueW
RegQueryInfoKeyW
RegDeleteKeyW
CreateProcessAsUserW
DuplicateTokenEx
DeleteService
ControlService
CloseServiceHandle
StartServiceW
QueryServiceStatus
ChangeServiceConfig2W
OpenServiceW
CreateServiceW
OpenSCManagerW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
RegNotifyChangeKeyValue

shell32

SHGetDesktopFolder
ShellExecuteExW
ShellExecuteW
SHBindToObject
SHBrowseForFolderW
ord88
ord18
SHCreateShellItemArrayFromIDLists
DragQueryFileW
ord190
SHOpenFolderAndSelectItems
SHCreateShellItem
ord155
SHGetPathFromIDListW
ord165
SHGetSpecialFolderLocation
ord68
ord25
ord727
SHGetSpecialFolderPathW
SHGetFolderLocation
ord19
SHBindToParent
SHParseDisplayName
SHGetFileInfoW
CommandLineToArgvW
ord75
SHCreateItemFromIDList
SHGetFolderPathW

ole32

CoTaskMemFree
RevokeDragDrop
RegisterDragDrop
CoInitializeEx
OleUninitialize
CoTaskMemRealloc
OleInitialize
CoUninitialize
CoInitialize
StringFromCLSID
CreateStreamOnHGlobal
CoTaskMemAlloc
OleGetClipboard
OleSetClipboard
CoCreateInstance
ReleaseStgMedium
CoCreateFreeThreadedMarshaler

oleaut32

VarUI4FromStr
SysAllocString
VariantInit
SysFreeString

shlwapi

PathCombineW
PathAppendW
PathStripPathW
StrCmpLogicalW
PathFindFileNameW
PathFileExistsW
PathRemoveFileSpecW
PathFindExtensionW
PathIsDirectoryW
ord176
PathIsRootW
StrCmpIW
SHDeleteValueW
StrStrIW
SHDeleteKeyW
StrRetToBufW
PathIsRelativeW
SHGetValueW
PathAddBackslashW

comctl32

ord17
ord410
ord412
_TrackMouseEvent
InitCommonControlsEx
ord413

gdiplus

GdipGetPenStartCap
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenColor
GdipGetPenWidth
GdipSetPenWidth
GdipClonePen
GdipImageRotateFlip
GdipDrawImageRect
GdipSetWorldTransform
GdipRotateMatrix
GdipTranslateMatrix
GdipCreatePen2
GdipSetLineBlend
GdipCreateLineBrushFromRect
GdipDrawArc
GdipResetPath
GdipDeleteMatrix
GdipCreateMatrix
GdipSetPathFillMode
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipImageSelectActiveFrame
GdipDrawPath
GdipDrawImageRectRect
GdipGetPathFillMode
GdipSetEffectParameters
GdipDeleteEffect
GdipCreateEffect
GdipReleaseDC
GdipGetDC
GdipAddPathLine
GdipAddPathArc
GdipAddPathRectangle
GdipClosePathFigure
GdipAddPathLineI
GdipAddPathArcI
GdipAddPathRectangleI
GdipStartPathFigure
GdipAddPathLine2I
GdipAddPathBezierI
GdipAddPathCurveI
GdipResetClip
GdipSetClipPath
GdipFillRectangleI
GdipCreateBitmapFromHBITMAP
GdipBitmapGetPixel
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromHICON
GdipSetImageAttributesColorMatrix
GdipGetPenDashCap197819
GdipCreateImageAttributes
GdipGetPenLineJoin
GdipDeletePen
GdipCreatePen1
GdipFillRectangle
GdipFillPath
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipAddPathLine2
GdipDeletePath
GdipCreatePath
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipCreateFromHDC
GdipSaveImageToFile
GdipDrawImageRectRectI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdiplusShutdown
GdipDisposeImage
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipLoadImageFromFile
GdipFree
GdipAlloc
GdiplusStartup
GdipAddPathEllipseI
GdipAddPathPieI
GdipAddPathPolygonI
GdipGetPathWorldBoundsI
GdipIsVisiblePathPointI
GdipIsOutlineVisiblePathPointI
GdipTransformPath
GdipDrawLineI
GdipDrawBezierI
GdipDrawRectangleI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipGetPenEndCap
GdipDisposeImageAttributes
GdipSetStringFormatLineAlign
GdipDrawString
GdipDrawEllipseI
GdipFillEllipseI
GdipSetPenLineJoin
GdipSetPenDashStyle
GdipGetPenDashStyle
GdipCreateTexture
GdipDrawRectangle
GdipClonePath
GdipMeasureString
GdipBitmapApplyEffect
GdipScaleMatrix

msimg32

AlphaBlend

winmm

timeBeginPeriod
timeSetEvent
timeKillEvent
timeEndPeriod

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile

crypt32

CertGetIntendedKeyUsage
CertGetCertificateContextProperty
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertOpenSystemStoreW
CertGetEnhancedKeyUsage
CertFreeCertificateContext

ws2_32

htons
getpeername
WSAWaitForMultipleEvents
WSAResetEvent
socket
WSAEnumNetworkEvents
select
WSACreateEvent
WSACloseEvent
getsockopt
shutdown
WSAIoctl
setsockopt
listen
connect
closesocket
bind
accept
WSASetLastError
send
recv
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
ntohs
gethostname
getsockname
ioctlsocket
recvfrom
WSAEventSelect
sendto
htonl
__WSAFDIsSet

wtsapi32

WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSFreeMemory
WTSQueryUserToken

msi

ord217
ord173

iphlpapi

GetAdaptersInfo

bcrypt

BCryptGenRandom

wldap32

ord145
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord133
ord147
ord301
ord219

Exports

Exports

getopt_a
getopt_long_a
getopt_long_only_a
getopt_long_only_w
getopt_long_w
getopt_w
optarg_a
optarg_w
opterr
optind
optopt

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 77KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 537KB - Virtual size: 537KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
licenses/CURL
licenses/OPENSSL
uninst.exe
.exe windows:6 windows x86 arch:x86

1dedfd798361ade4356cff835d278e72

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:1e:42:57:7b:04:aa:2d:c2:67:b7:c2:43:e9:17:4c
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

12/07/2023, 00:00

Not After

11/07/2024, 23:59

Subject

SERIALNUMBER=91110400MACB3C7M2E,CN=Beijing Coodesker Technology Co.\, Ltd.,O=Beijing Coodesker Technology Co.\, Ltd.,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:1e:42:57:7b:04:aa:2d:c2:67:b7:c2:43:e9:17:4c
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

12/07/2023, 00:00

Not After

11/07/2024, 23:59

Subject

SERIALNUMBER=91110400MACB3C7M2E,CN=Beijing Coodesker Technology Co.\, Ltd.,O=Beijing Coodesker Technology Co.\, Ltd.,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:f5:08:11:e3:da:e2:58:d4:58:3d:4c:b6:b2:4d:86:da:3a:a4:79:b5:ff:6b:3d:3d:ab:d5:dd:bc:ea:cf:ff
Signer

Actual PE Digest

bc:f5:08:11:e3:da:e2:58:d4:58:3d:4c:b6:b2:4d:86:da:3a:a4:79:b5:ff:6b:3d:3d:ab:d5:dd:bc:ea:cf:ff

Digest Algorithm

sha256

PE Digest Matches

true

9c:bc:50:9d:86:5a:85:ac:8c:04:68:4b:cf:de:c8:31:8a:a3:f7:65
Signer

Actual PE Digest

9c:bc:50:9d:86:5a:85:ac:8c:04:68:4b:cf:de:c8:31:8a:a3:f7:65

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Tools\Future\coodesker\bin\uninst.pdb

Imports

comctl32

ord17
InitCommonControlsEx
_TrackMouseEvent

kernel32

FindResourceW
LoadResource
MultiByteToWideChar
GetTempPathW
GetModuleFileNameW
GetCommandLineW
SizeofResource
GetCurrentProcessId
CloseHandle
DeleteFileW
Sleep
OpenProcess
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
GetProcAddress
InitializeCriticalSectionEx
LoadLibraryExA
VirtualProtect
WriteConsoleW
SetEndOfFile
FlushFileBuffers
GetConsoleCP
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentStringsW
GetCommandLineA
LocalFree
GetModuleHandleW
FreeLibrary
CopyFileW
lstrcmpiW
GetOEMCP
LoadLibraryExW
GetACP
IsValidCodePage
FindNextFileW
GetCurrentThreadId
SetLastError
GetStdHandle
SetErrorMode
CreateFileW
UnmapViewOfFile
CreateToolhelp32Snapshot
Process32NextW
OutputDebugStringW
LockResource
GlobalAlloc
Process32FirstW
GlobalFree
GetSystemInfo
LoadLibraryW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
VirtualQuery
VerifyVersionInfoW
VerSetConditionMask
GetTickCount
GlobalSize
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
GetSystemDirectoryW
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
MulDiv
GetFileAttributesW
SetFilePointer
ReadFile
SystemTimeToFileTime
LocalFileTimeToFileTime
WriteFile
GetFileSize
GetFileSizeEx
GetEnvironmentVariableW
GetStringTypeW
EncodePointer
GetCPInfo
CompareStringW
LCMapStringW
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
InitializeSListHead
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
FindClose
FindFirstFileExW

user32

GetDesktopWindow
GetMonitorInfoW
IsWindow
ShowWindow
GetSystemMetrics
MonitorFromWindow
InflateRect
GetWindowRect
MonitorFromPoint
ReleaseDC
LoadCursorW
RegisterClassW
GetClassInfoExW
RegisterClassExW
SetWindowLongW
CreateWindowExW
GetWindowLongW
IsIconic
SetWindowPos
LoadImageW
CallWindowProcW
SetForegroundWindow
GetPropW
GetDC
SetWindowTextW
InvalidateRect
ScreenToClient
GetKeyState
GetCursorPos
GetFocus
SetCapture
ReleaseCapture
BeginPaint
EndPaint
MoveWindow
GetUpdateRect
GetClientRect
IsRectEmpty
IntersectRect
UpdateLayeredWindow
PtInRect
OffsetRect
UnionRect
SetCursor
IsZoomed
SetWindowRgn
MessageBoxW
IsWindowVisible
ClientToScreen
GetSysColor
GetAsyncKeyState
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
MapWindowPoints
GetParent
DrawTextW
SendMessageW
PostMessageW
GetWindowThreadProcessId
SystemParametersInfoW
FindWindowW
DefWindowProcW
DestroyWindow
SetPropW
TranslateMessage
GetWindow
SetFocus
PostQuitMessage
EnableWindow
GetMessageW
DispatchMessageW
PeekMessageW
CharNextW

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW

shell32

ShellExecuteExW
SHGetFolderPathW
SHFileOperationW
CommandLineToArgvW
ShellExecuteW

ole32

CoTaskMemFree
OleInitialize
CoTaskMemAlloc
CoInitialize
OleUninitialize
CoInitializeEx
CreateStreamOnHGlobal
CoCreateInstance
CoUninitialize
CoTaskMemRealloc

oleaut32

SysAllocString
SysFreeString
VarUI4FromStr

winmm

timeSetEvent
timeKillEvent

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

gdi32

SelectObject
DeleteObject
CreateFontIndirectW
GetStockObject
GetObjectW
BitBlt
CreateRoundRectRgn
CreateDIBSection
StretchBlt
CreateCompatibleDC
DeleteDC
SaveDC
RestoreDC
GetWindowOrgEx
SetWindowOrgEx
GetDeviceCaps
SetStretchBltMode
ExtSelectClipRgn
CreateRectRgnIndirect
GetObjectA
SetBkMode
SetBkColor
SetTextColor

Exports

Exports

getopt_a
getopt_long_a
getopt_long_only_a
getopt_long_only_w
getopt_long_w
getopt_w
optarg_a
optarg_w
opterr
optind
optopt

Sections

.text
Size: 596KB - Virtual size: 595KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

24aaf77e12a74001f0814f79f9dfa655

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

52:1e:42:57:7b:04:aa:2d:c2:67:b7:c2:43:e9:17:4cCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

52:1e:42:57:7b:04:aa:2d:c2:67:b7:c2:43:e9:17:4cCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

d1:7b:90:62:e7:f2:81:74:5e:5d:e6:cf:fb:a7:82:62:2f:11:cf:31:41:49:70:ab:ef:96:41:57:70:fe:c8:88Signer

40:36:e8:14:72:3f:aa:75:92:06:e5:a8:3f:21:6e:82:2d:a2:b0:56Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

msimg32

winmm

imm32

userenv

crypt32

ws2_32

wtsapi32

msi

iphlpapi

bcrypt

wldap32

Exports

Exports

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 77KB - Virtual size: 99KB

.pdata Size: 144KB - Virtual size: 143KB

.rsrc Size: 537KB - Virtual size: 537KB

.reloc Size: 40KB - Virtual size: 40KB

1dedfd798361ade4356cff835d278e72

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

52:1e:42:57:7b:04:aa:2d:c2:67:b7:c2:43:e9:17:4c
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

52:1e:42:57:7b:04:aa:2d:c2:67:b7:c2:43:e9:17:4c
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

d1:7b:90:62:e7:f2:81:74:5e:5d:e6:cf:fb:a7:82:62:2f:11:cf:31:41:49:70:ab:ef:96:41:57:70:fe:c8:88
Signer

40:36:e8:14:72:3f:aa:75:92:06:e5:a8:3f:21:6e:82:2d:a2:b0:56
Signer

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 77KB - Virtual size: 99KB

.pdata
Size: 144KB - Virtual size: 143KB

.rsrc
Size: 537KB - Virtual size: 537KB

.reloc
Size: 40KB - Virtual size: 40KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

52:1e:42:57:7b:04:aa:2d:c2:67:b7:c2:43:e9:17:4c
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

52:1e:42:57:7b:04:aa:2d:c2:67:b7:c2:43:e9:17:4c
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

bc:f5:08:11:e3:da:e2:58:d4:58:3d:4c:b6:b2:4d:86:da:3a:a4:79:b5:ff:6b:3d:3d:ab:d5:dd:bc:ea:cf:ff
Signer

9c:bc:50:9d:86:5a:85:ac:8c:04:68:4b:cf:de:c8:31:8a:a3:f7:65
Signer

.text
Size: 596KB - Virtual size: 595KB

.rdata
Size: 151KB - Virtual size: 150KB

.data
Size: 13KB - Virtual size: 17KB

.rsrc
Size: 96KB - Virtual size: 95KB

.reloc
Size: 33KB - Virtual size: 32KB