57b9e7b19066fd5e09dab995285f0e20N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

57b9e7b19066fd5e09dab995285f0e20N.exe
Size

2.1MB
MD5

57b9e7b19066fd5e09dab995285f0e20
SHA1

688b16ddf4675b737405d9695a070b760bf7eeaa
SHA256

909f8ba7ca89aa85bc186686d76dbdd84919c4e4f4ca6757c5d897ebcf8516c0
SHA512

d626ed44ffd8d7aa261722b40943b345b976011bad1e1f8a2b9158afb2d36f98a4def6f1f1053ba334290a9aac7da09b018a5ff907007066d9703a3c01e9f497
SSDEEP

49152:U+XFyL77+NQYAzny9UwSIA7PNLYxT+ICJfavwh4XEHoSxULqjtEkoP:U+XcLXiDYnwUFIcPNoTxCJfavw6UHxte

Score

1^/10

Malware Config

Signatures

Files

57b9e7b19066fd5e09dab995285f0e20N.exe
.exe windows:4 windows x86 arch:x86

61259b55b8912888e90f516ca08dc514

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/03/2022, 00:00

Not After

07/03/2025, 23:59

Subject

CN=SweetLabs Inc,O=SweetLabs Inc,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d7:8f:ad:9c:0f:89:80:97:c0:13:b8:48:42:15:65:47:e2:52:a2:9d:bf:a6:7d:fc:c6:49:a0:8a:82:9a:14:17
Signer

Actual PE Digest

d7:8f:ad:9c:0f:89:80:97:c0:13:b8:48:42:15:65:47:e2:52:a2:9d:bf:a6:7d:fc:c6:49:a0:8a:82:9a:14:17

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 180KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/03/2022, 00:00

Not After

07/03/2025, 23:59

Subject

CN=SweetLabs Inc,O=SweetLabs Inc,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2b:c6:51:36:86:23:02:c1:3a:97:86:7a:fb:16:ee:4c:9e:4a:a1:f4:d9:11:49:27:cc:e9:26:f1:14:65:36:79
Signer

Actual PE Digest

2b:c6:51:36:86:23:02:c1:3a:97:86:7a:fb:16:ee:4c:9e:4a:a1:f4:d9:11:49:27:cc:e9:26:f1:14:65:36:79

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

5e62e8e248e7364886b604bd1fcf4c13

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/03/2022, 00:00

Not After

07/03/2025, 23:59

Subject

CN=SweetLabs Inc,O=SweetLabs Inc,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

49:ea:7a:a0:68:e0:8a:fc:ab:62:45:2e:7a:d7:75:fe:96:be:3f:5d:1b:94:8a:3f:cb:6c:58:44:83:fb:2e:29
Signer

Actual PE Digest

49:ea:7a:a0:68:e0:8a:fc:ab:62:45:2e:7a:d7:75:fe:96:be:3f:5d:1b:94:8a:3f:cb:6c:58:44:83:fb:2e:29

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
GetUserNameW

kernel32

GlobalFree
GetVersion
GlobalAlloc
CloseHandle
GetModuleHandleA
GetLastError
GetCurrentProcess
GetCurrentThread
GetProcAddress
lstrcpynW

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 705B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/aetihlp.dll
.dll windows:6 windows x86 arch:x86

fafa6e561fb1cffa560a08ed73c13aba

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/03/2022, 00:00

Not After

07/03/2025, 23:59

Subject

CN=SweetLabs Inc,O=SweetLabs Inc,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c8:a4:de:6a:fb:7d:c6:dc:e8:4a:31:78:85:fb:8f:71:78:a9:51:9b:b3:47:b4:61:80:7d:a8:61:e5:22:8d:e8
Signer

Actual PE Digest

c8:a4:de:6a:fb:7d:c6:dc:e8:4a:31:78:85:fb:8f:71:78:a9:51:9b:b3:47:b4:61:80:7d:a8:61:e5:22:8d:e8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

aetihlp.pdb

Imports

comctl32

ord413
ord410
ord412

wldap32

ord79
ord35
ord33
ord32
ord27
ord30
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord143
ord200
ord301
ord26
ord217

normaliz

IdnToUnicode
IdnToAscii

ws2_32

htons
socket
getservbyport
select
WSACleanup
WSAStartup
ntohs
WSAGetLastError
recvfrom
WSASetLastError
closesocket
WSAWaitForMultipleEvents
WSAIoctl
WSAResetEvent
shutdown
getpeername
accept
bind
connect
getsockname
htonl
listen
recv
getaddrinfo
getservbyname
freeaddrinfo
sendto
gethostbyaddr
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
inet_ntoa
inet_addr
gethostbyname
setsockopt
gethostname
__WSAFDIsSet
ioctlsocket

netapi32

NetApiBufferFree
NetGetJoinInformation

kernel32

CreateFileW
GetFileSizeEx
ReadFile
SetFilePointer
SetEndOfFile
WriteFile
SetLastError
FindFirstFileW
GetFileAttributesW
DeleteFileW
FindNextFileW
FindClose
CreateProcessW
GetExitCodeProcess
Sleep
DecodePointer
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
MultiByteToWideChar
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
LoadLibraryA
MoveFileExA
WaitForSingleObjectEx
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
GetEnvironmentVariableW
GetConsoleMode
WaitForSingleObject
ReadConsoleA
ReadConsoleW
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
VirtualFree
GetACP
SwitchToFiber
DeleteFiber
CreateFiberEx
ConvertFiberToThread
ConvertThreadToFiberEx
LoadLibraryW
GetSystemTime
SystemTimeToFileTime
GetModuleHandleW
GetProcAddress
GetTickCount
Process32NextW
TerminateProcess
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
ProcessIdToSessionId
GetCurrentProcessId
SetEvent
CloseHandle
OpenEventW
CreateEventW
CreateEventA
LocalFree
FormatMessageA
LeaveCriticalSection
AreFileApisANSI
HeapCreate
GetDiskFreeSpaceW
LockFile
UnlockFileEx
CreateMutexW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
DeleteFileA
HeapCompact
UnlockFile
EnterCriticalSection
GetLastError
InitializeCriticalSectionEx
HeapDestroy
GetProcessHeap
SetConsoleMode
HeapFree
HeapReAlloc
HeapSize
FormatMessageW
WideCharToMultiByte
LockFileEx
CreateFileMappingW
MapViewOfFile
OutputDebugStringA
WriteConsoleW
GetCommandLineW
GetCommandLineA
FindNextFileA
FindFirstFileExA
GetOEMCP
IsValidCodePage
SetEnvironmentVariableA
GetTimeZoneInformation
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
GetModuleFileNameA
ExitProcess
SetConsoleCtrlHandler
SetFilePointerEx
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
GetDriveTypeW
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
OpenEventA
GetCPInfo
LCMapStringEx
EncodePointer
TryAcquireSRWLockExclusive
GetStringTypeW
RaiseException
IsDebuggerPresent
LoadLibraryExW
GetExitCodeThread
TerminateThread
CreateThread
TryEnterCriticalSection
InitializeCriticalSection
CreateMutexA
ReleaseMutex
QueryFullProcessImageNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileSize
LocalAlloc
CompareStringW
GlobalFree
ResetEvent
SetThreadLocale
GetThreadLocale
VirtualQuery
GetComputerNameW
GetSystemDirectoryW
GetVolumeInformationW
GetCurrentThread
OutputDebugStringW
SystemTimeToTzSpecificLocalTime
MoveFileExW
GetTempPathW
GetTempFileNameW
GetFileAttributesExW
FindFirstFileExW
CreateDirectoryW
ExpandEnvironmentStringsW
FindResourceW
SizeofResource
LockResource
LoadResource
FreeResource
GetModuleFileNameW
HeapAlloc
IsWow64Process
GetVersionExW
GetCurrentProcess
FileTimeToSystemTime
GetUserDefaultLCID
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
LCMapStringW
GetStringTypeExW
CreateHardLinkW
GetTickCount64
GetUserGeoID
GetGeoInfoW

user32

SetRect
GetWindowTextW
SetTimer
GetClientRect
SendMessageW
GetDlgItem
GetWindowRect
ScreenToClient
MoveWindow
UpdateWindow
GetDC
GetDlgItemTextW
DrawTextExW
SystemParametersInfoW
CopyRect
GetDesktopWindow
DestroyMenu
CreatePopupMenu
SetWindowTextW
wsprintfW
SetProcessDefaultLayout
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostMessageW
FindWindowW
GetWindowThreadProcessId
AllowSetForegroundWindow
LoadStringW
GetClassNameW
RedrawWindow
SetWindowPos
GetSysColor
SetParent
EnumChildWindows
LoadIconW
ShowWindow
GetSystemMetrics
IsWindow
PeekMessageW
DispatchMessageW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
GetParent

gdi32

SetBkMode
CreateSolidBrush
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateDIBSection
GetObjectW

advapi32

RegCloseKey
ReportEventW
CryptAcquireContextW
RegCreateKeyExW
GetUserNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCopyTreeW
RegFlushKey
ConvertSidToStringSidW
LookupAccountNameW
RegOpenKeyW
OpenThreadToken
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteTreeW
RegDeleteKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
CryptDestroyKey
RegDeleteValueW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
DeregisterEventSource
CryptSetHashParam
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
RegisterEventSourceW

ole32

PropVariantClear
CoTaskMemFree
CoInitializeEx
StringFromGUID2
CoUninitialize
CoInitializeSecurity
CoCreateInstance
CoCreateGuid

oleaut32

VariantCopy
SysAllocString
SysAllocStringLen
VariantClear
VariantInit
SysFreeString

gdiplus

GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipSetCompositingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipFlush
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdiplusStartup
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdiplusShutdown

bcrypt

BCryptGenRandom

msi

ord173
ord217

rpcrt4

RpcStringFreeW
UuidToStringW

wininet

DeleteUrlCacheEntryW
InternetQueryOptionW

winhttp

WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpOpen

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust

crypt32

CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertOpenStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertCloseStore
CertDuplicateCertificateContext

userenv

ExpandEnvironmentStringsForUserW

version

VerQueryValueW

shlwapi

SHRegDuplicateHKey
ord487
StrRetToBufW
ord176
PathFileExistsW

powrprof

GetPwrCapabilities

secur32

GetUserNameExW

shell32

SHBindToParent
SHGetDesktopFolder
SHGetKnownFolderPath
SHGetFolderPathW
SHFileOperationW
SHGetMalloc
ShellExecuteExW
SHCreateDirectoryExW

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 815KB - Virtual size: 815KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/unsettings.reg

Sharing

General

Malware Config

Signatures

Files

61259b55b8912888e90f516ca08dc514

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

d7:8f:ad:9c:0f:89:80:97:c0:13:b8:48:42:15:65:47:e2:52:a2:9d:bf:a6:7d:fc:c6:49:a0:8a:82:9a:14:17Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 180KB

.rsrc Size: 50KB - Virtual size: 50KB

fc0224e99e736751432961db63a41b76

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

2b:c6:51:36:86:23:02:c1:3a:97:86:7a:fb:16:ee:4c:9e:4a:a1:f4:d9:11:49:27:cc:e9:26:f1:14:65:36:79Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 120B

.reloc Size: 1024B - Virtual size: 662B

5e62e8e248e7364886b604bd1fcf4c13

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

d7:8f:ad:9c:0f:89:80:97:c0:13:b8:48:42:15:65:47:e2:52:a2:9d:bf:a6:7d:fc:c6:49:a0:8a:82:9a:14:17
Signer

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 180KB

.rsrc
Size: 50KB - Virtual size: 50KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

2b:c6:51:36:86:23:02:c1:3a:97:86:7a:fb:16:ee:4c:9e:4a:a1:f4:d9:11:49:27:cc:e9:26:f1:14:65:36:79
Signer

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 662B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

49:ea:7a:a0:68:e0:8a:fc:ab:62:45:2e:7a:d7:75:fe:96:be:3f:5d:1b:94:8a:3f:cb:6c:58:44:83:fb:2e:29
Signer

.text
Size: 1024B - Virtual size: 714B

.rdata
Size: 1024B - Virtual size: 705B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 512B - Virtual size: 240B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

c8:a4:de:6a:fb:7d:c6:dc:e8:4a:31:78:85:fb:8f:71:78:a9:51:9b:b3:47:b4:61:80:7d:a8:61:e5:22:8d:e8
Signer

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 815KB - Virtual size: 815KB

.data
Size: 35KB - Virtual size: 55KB

.rsrc
Size: 336KB - Virtual size: 335KB

.reloc
Size: 163KB - Virtual size: 162KB