2024-08-09_a2327312dd067607ff0593d3df1d012f_avaddon_avoslocker_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-09_a2327312dd067607ff0593d3df1d012f_avaddon_avoslocker_revil
Size

28.7MB
MD5

a2327312dd067607ff0593d3df1d012f
SHA1

49edda77c802d23afa397e520d50cdec11ae4ae1
SHA256

c2b8ef10a88e95fc757b6722bf258b268d948444f0d55e02222819c97fb8097c
SHA512

46bb256aafe566f47e5da648b4c57533249037541b83a98ae6ff2593cfbbfb8d20a187b377991ac6ffb1fce04a85372c52cdb7e8c48b7097b27ee798aa5a3b00
SSDEEP

393216:u+kbDckMuBn0MiytTQaSMs5Z5Z5Z5ZGmGmGmGmDjDjDjDjQwQwQwQwd9d9d9d96e:lkHQaDDz3Dat+ZOkySQEPpmz7SFSTJYK

Score

1^/10

Malware Config

Signatures

Files

2024-08-09_a2327312dd067607ff0593d3df1d012f_avaddon_avoslocker_revil
.exe windows:6 windows x86 arch:x86

91264b848406afb9e8f38e8fbeb4e75c

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:07:d4:0b:50:82:fe:aa:6e:0a:5e:92
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

13/07/2021, 08:55

Not After

10/10/2024, 08:23

Subject

SERIALNUMBER=1125476195459,CN=Atom Security LLC,O=Atom Security LLC,STREET=Prospect Akademika Koptyuga\, 4 office 158,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:f7:5a:5a:07:01:3f:62:81:2f:57:34:6f:3f:b6:96:4e:a2:38:e5:28:ed:03:ca:6f:9a:e7:90:bc:15:81:d8
Signer

Actual PE Digest

63:f7:5a:5a:07:01:3f:62:81:2f:57:34:6f:3f:b6:96:4e:a2:38:e5:28:ed:03:ca:6f:9a:e7:90:bc:15:81:d8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\GitLab-Runner\builds\cjN5cVL4\0\windows\windows-agent\.build\agent_x32\relwithdebinfo\vmnetdrv32.pdb

Imports

advapi32

GetLengthSid
OpenServiceW
StartServiceCtrlDispatcherW
RegOpenKeyExW
InitializeAcl
InitializeSecurityDescriptor
AddAce
RegSetValueExW
IsValidSid
GetSecurityDescriptorOwner
InitializeSid
CopySid
GetSecurityDescriptorControl
RegCreateKeyExW
GetSidLengthRequired
GetSidSubAuthority
GetSecurityDescriptorGroup
OpenSCManagerW
CloseServiceHandle
GetAclInformation
RegCloseKey
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
CryptGenRandom
CryptAcquireContextW
GetTokenInformation
RegQueryValueExW
LookupAccountSidW
OpenThreadToken
GetSecurityDescriptorLength
DuplicateTokenEx
CreateProcessAsUserW
OpenProcessToken
ConvertStringSidToSidW
SetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetAce
RegDeleteValueW
RegEnumKeyExW
DuplicateToken
SetThreadToken
ConvertSidToStringSidW
CreateWellKnownSid
RegGetValueW
RegLoadMUIStringW
RegNotifyChangeKeyValue
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
RegDisablePredefinedCache
MakeSelfRelativeSD
MakeAbsoluteSD
RegEnumValueW
ChangeServiceConfigW
QueryServiceConfigW
StartServiceW
EnumDependentServicesW
ControlService
DeleteService
ChangeServiceConfig2W
SetServiceStatus
QueryServiceStatus
CreateServiceW
RegisterServiceCtrlHandlerExW
RegDeleteKeyW
IsTextUnicode
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptSignHashW
CryptEnumProvidersW
SystemFunction036
RegOpenKeyW
RegEnumKeyW
CryptAcquireContextA
GetSidIdentifierAuthority
IsValidSecurityDescriptor
GetSidSubAuthorityCount

gdi32

DeleteObject
GetObjectW
GetEnhMetaFileBits
DeleteEnhMetaFile
CopyEnhMetaFileW
SetStretchBltMode
GetDIBits
StretchBlt
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
CreateFontW
CreateSolidBrush
SetBkColor
SetTextColor
GetDeviceCaps
SetDIBColorTable
CreateDIBSection
DeleteDC

kernel32

HeapSetInformation
ResetEvent
QueueUserAPC
GetLocalTime
SwitchToThread
GetThreadId
GetFileSize
GlobalMemoryStatusEx
FreeLibrary
CopyFileW
SleepEx
SystemTimeToTzSpecificLocalTime
CreateFileMappingW
CreateIoCompletionPort
MapViewOfFileEx
OpenThread
LoadLibraryExW
IsDebuggerPresent
ConnectNamedPipe
FlushFileBuffers
GetExitCodeProcess
FindFirstFileW
FindNextFileW
FindClose
QueryDosDeviceW
GetVolumeInformationW
GetLogicalDrives
FindFirstVolumeW
lstrlenW
DeviceIoControl
FindVolumeClose
FindNextVolumeW
GetDriveTypeW
CreateDirectoryW
GetTempPathW
GetDiskFreeSpaceW
MoveFileExW
VerSetConditionMask
VerifyVersionInfoW
OpenProcess
WaitForMultipleObjectsEx
SetWaitableTimer
CreateWaitableTimerW
CancelWaitableTimer
GetProcessTimes
GlobalSize
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetFileSizeEx
GetProcessId
Thread32Next
Thread32First
DuplicateHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetSystemDirectoryW
GetComputerNameW
SystemTimeToFileTime
TlsAlloc
TlsFree
FormatMessageA
TlsSetValue
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
TlsGetValue
RegisterWaitForSingleObject
UnregisterWaitEx
GetFileAttributesExW
GetVolumePathNamesForVolumeNameW
GetFullPathNameW
GetLocaleInfoW
GetUserDefaultLCID
MulDiv
GetVersionExW
GetSystemTime
WaitNamedPipeW
ReplaceFileA
GetFileAttributesExA
MoveFileA
CompareStringA
LocalAlloc
WaitForSingleObject
InitializeCriticalSectionEx
SetStdHandle
IsValidCodePage
EnumSystemLocalesW
IsValidLocale
GetCommandLineA
SetConsoleCtrlHandler
ExitThread
RtlUnwind
QueryDepthSList
InterlockedFlushSList
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
UnhandledExceptionFilter
LCMapStringW
CompareStringW
GetCPInfo
GetStringTypeW
QueueUserWorkItem
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
LoadLibraryExA
VirtualQuery
VirtualProtect
PeekNamedPipe
GetEnvironmentVariableA
TerminateProcess
MoveFileExA
GetSystemDirectoryA
GetTempFileNameA
lstrlenA
CreateDirectoryA
FindFirstFileExA
lstrcmpW
ReleaseSemaphore
SetThreadAffinityMask
IsProcessorFeaturePresent
VirtualAlloc
GetThreadPriority
K32GetProcessImageFileNameW
GetConsoleOutputCP
InitializeCriticalSection
GetTimeZoneInformationForYear
GetDriveTypeA
WriteConsoleW
CreateThread
ExitProcess
CopyFileExW
GetFinalPathNameByHandleW
GetFileInformationByHandleEx
CreateMutexA
AcquireSRWLockShared
QueryPerformanceFrequency
WakeConditionVariable
SleepConditionVariableSRW
GetOverlappedResult
SetHandleInformation
SetFilePointerEx
SetFileInformationByHandle
GetCommandLineW
GetEnvironmentStringsW
RtlCaptureContext
SetThreadStackGuarantee
ReleaseSRWLockShared
FreeEnvironmentStringsW
AreFileApisANSI
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
CreateFileA
GetVersionExA
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryW
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
GetFileType
GetEnvironmentVariableW
GetStdHandle
CreateFiber
DeleteFiber
SwitchToFiber
GetComputerNameA
FindNextFileA
FindFirstFileA
GetCurrentDirectoryW
DeleteFileA
FindFirstFileExW
WTSGetActiveConsoleSessionId
GetComputerNameExW
GetTempFileNameW
GetFileAttributesW
GetFileInformationByHandle
MapViewOfFile
SetUnhandledExceptionFilter
QueryPerformanceCounter
K32GetModuleInformation
K32GetModuleBaseNameW
K32GetModuleFileNameExA
RtlCaptureStackBackTrace
GetModuleHandleExW
GetACP
GetSystemDefaultLCID
GetOEMCP
GetDateFormatW
CreateSemaphoreW
GetTimeFormatW
FileTimeToLocalFileTime
OpenEventW
K32EnumProcesses
K32GetModuleFileNameExW
SetLastError
HeapCreate
TryEnterCriticalSection
ReadFile
GetTickCount
GetSystemTimeAsFileTime
WideCharToMultiByte
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
LocalFree
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
CloseHandle
HeapReAlloc
DeleteFileW
LockResource
SetFilePointer
SetErrorMode
RemoveDirectoryA
LeaveCriticalSection
SetEnvironmentVariableW
ExpandEnvironmentStringsW
WriteFile
GetCurrentProcess
EnterCriticalSection
HeapFree
SizeofResource
GetSystemInfo
WaitForSingleObjectEx
GetCurrentThread
FileTimeToSystemTime
SetEvent
GetTimeZoneInformation
CreateEventW
DisconnectNamedPipe
UnmapViewOfFile
ResumeThread
ReleaseMutex
CreateFileW
CreateMutexW
EnumResourceNamesW
SetEndOfFile
GetQueuedCompletionStatus
SetThreadPriority
WaitForMultipleObjects
CreateNamedPipeW
GetModuleFileNameW
VirtualFree
TerminateThread
RemoveDirectoryW
GetLastError
FormatMessageW
Sleep
ProcessIdToSessionId
GetExitCodeThread
MultiByteToWideChar
PostQueuedCompletionStatus
HeapSize
CompareFileTime
GetCurrentThreadId

ole32

WriteClassStg
CoCreateInstance
CoTaskMemFree
CoSetProxyBlanket
CoInitializeSecurity
CLSIDFromString
CoFreeUnusedLibraries
CoInitialize
CreateBindCtx
PropVariantClear
CreatePointerMoniker
CoTaskMemAlloc
CoInitializeEx
StringFromGUID2
CoUninitialize
StgCreateDocfile

oleaut32

VariantClear
SysFreeString
VariantChangeType
SysAllocString
VariantInit

user32

SetFocus
SetCapture
SetWindowPos
GetDesktopWindow
GetDlgItem
CreateDialogParamW
ShowWindow
IsDialogMessageW
EnumWindows
GetClassLongW
FlashWindow
GetWindowTextW
GetMessageW
DefWindowProcW
PostMessageW
DestroyWindow
EnumChildWindows
CreateWindowExW
GetUserObjectInformationW
MessageBoxW
CreatePopupMenu
RegisterClassExW
GetWindowLongW
TrackPopupMenu
LoadStringW
DispatchMessageW
SetTimer
DestroyIcon
GetForegroundWindow
IsWindowVisible
GetWindowRect
GetWindow
GetProcessWindowStation
DestroyMenu
TranslateMessage
LoadIconW
AppendMenuW
KillTimer
GetClassInfoExW
UnregisterClassW
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetParent
PostQuitMessage
GetClientRect
SetWindowLongW
GetWindowTextLengthW
SetWindowsHookExW
UnhookWindowsHookEx
PostThreadMessageA
CallNextHookEx
GetLastInputInfo
SetClipboardData
GetClipboardSequenceNumber
LoadCursorW
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetPriorityClipboardFormat
CopyImage
GetClipboardOwner
CallWindowProcW
GetWindowThreadProcessId
UnhookWinEvent
MapWindowPoints
SetWinEventHook
MessageBeep
ExitWindowsEx
InvalidateRect
SetDlgItemInt
SetForegroundWindow
GetCursorPos
SystemParametersInfoW
MonitorFromWindow
SetWindowTextW
GetMonitorInfoW
SetDlgItemTextW
PostThreadMessageW
GetSystemMetrics
GetSysColor
GetKeyNameTextW
MapVirtualKeyExW
GetKeyState
GetGUIThreadInfo
GetClassNameW
GetKeyboardLayout
PeekMessageW
IsWindow
WindowFromPoint
MsgWaitForMultipleObjects
GetFocus
ActivateKeyboardLayout
ToUnicodeEx
GetKeyboardLayoutList
GetKeyboardLayoutNameW
IsIconic
SendMessageW
FindWindowExW
CharLowerBuffW
ReleaseDC
DrawIconEx
GetCursorInfo
GetIconInfo
GetDC
SendInput
mouse_event
LoadKeyboardLayoutW
keybd_event
GetDlgCtrlID
RedrawWindow
DdeFreeStringHandle
DdeDisconnect
DdeFreeDataHandle
DdeClientTransaction
DdeUninitialize
DdeInitializeW
MapVirtualKeyW
DdeGetLastError
DdeConnect
DdeCreateStringHandleW
DdeUnaccessData
DdeAccessData
RegisterClassW
SetThreadDesktop
CloseDesktop
OpenInputDesktop
VkKeyScanExW

winspool.drv

GetPrinterW
SetPrinterW
EnumPrintersW
EnumJobsW
OpenPrinterW
GetJobW
EnumPrintProcessorDatatypesW
FreePrinterNotifyInfo
SetJobW
FindClosePrinterChangeNotification
FindFirstPrinterChangeNotification
ClosePrinter
FindNextPrinterChangeNotification

ws2_32

ntohl
select
gethostbyname
WSASend
listen
WSAIoctl
bind
__WSAFDIsSet
gethostname
WSAWaitForMultipleEvents
WSASetLastError
WSAStringToAddressW
WSASocketW
getpeername
getsockname
ntohs
connect
WSAAddressToStringW
getservbyname
accept
WSARecv
getsockopt
htons
ioctlsocket
setsockopt
WSAGetLastError
htonl
WSACleanup
shutdown
WSAStartup
closesocket
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
inet_ntoa
send
recv
recvfrom
socket
inet_addr
getaddrinfo
freeaddrinfo
getnameinfo
sendto

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

dbghelp

ImageNtHeader
MiniDumpWriteDump

wldap32

ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143
ord26

nspr4

PR_GetError
PR_Cleanup
PR_Init
PR_ErrorToString

nss3

CERT_GetOrgName
PORT_Free
CERT_ChangeCertTrust
NSS_Shutdown
NSS_Initialize
CERT_DestroyCertificate
PK11_GetInternalKeySlot
PK11_FreeSlot
CERT_GetCommonName
CERT_AsciiToName
PK11_ImportCert
CERT_GetDefaultCertDB
PK11_FindCertFromDERCert
PORT_ZAlloc
CERT_DecodeTrustString
CERT_DestroyName
NSS_NoDB_Init

smime3

CERT_DecodeCertFromPackage

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathAppendW
PathStripPathW
PathMatchSpecW
SHCreateStreamOnFileEx
ord219
PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathRemoveExtensionW
UrlEscapeA
StrCmpIW
PathAddExtensionW
PathCanonicalizeW
StrToIntA
SHDeleteKeyW
StrStrIW
PathCombineW
StrToInt64ExA
PathStripPathA

userenv

DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
ExpandEnvironmentStringsForUserW

gdiplus

GdipGetImageHeight
GdipImageRotateFlip
GdipBitmapUnlockBits
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipGetImageWidth
GdiplusStartup
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdiplusShutdown
GdipSaveImageToFile
GdipCreateBitmapFromScan0

pdh

PdhOpenQueryW
PdhCloseQuery
PdhAddCounterW
PdhLookupPerfNameByIndexW
PdhGetRawCounterValue
PdhRemoveCounter
PdhCollectQueryData
PdhGetFormattedCounterValue

wtsapi32

WTSLogoffSession
WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationW

setupapi

CM_Get_Parent
CM_Get_DevNode_Registry_Property_ExW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
CM_Get_Parent_Ex
CMP_WaitNoPendingInstallEvents
CM_Disable_DevNode
CM_Get_Child
CM_Get_Device_ID_Size_Ex
CM_Get_Sibling
CM_Get_Device_ID_ExW
CM_Enable_DevNode
CM_Get_DevNode_Status
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

fltlib

FilterVolumeFindClose
FilterVolumeFindNext
FilterVolumeFindFirst
FilterGetDosName
FilterReplyMessage
FilterGetMessage
FilterSendMessage
FilterConnectCommunicationPort
FilterUnload
FilterLoad

activeds

ord9

oleacc

AccessibleObjectFromWindow
AccessibleChildren

wintrust

WinVerifyTrust

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer

netapi32

NetApiBufferFree
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
NetWkstaGetInfo
DsGetDcNameW

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CertAddEncodedCertificateToStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreA
CryptBinaryToStringA
CryptStringToBinaryA
PFXImportCertStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CryptDecodeObjectEx

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

Exports

Exports

AddInLog
GetMAPIModule

Sections

.text
Size: 20.9MB - Virtual size: 20.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 393KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91264b848406afb9e8f38e8fbeb4e75c

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

47:07:d4:0b:50:82:fe:aa:6e:0a:5e:92Certificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

63:f7:5a:5a:07:01:3f:62:81:2f:57:34:6f:3f:b6:96:4e:a2:38:e5:28:ed:03:ca:6f:9a:e7:90:bc:15:81:d8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

gdi32

kernel32

ole32

oleaut32

user32

winspool.drv

ws2_32

rpcrt4

version

dbghelp

wldap32

nspr4

nss3

smime3

shlwapi

userenv

gdiplus

pdh

wtsapi32

setupapi

fltlib

activeds

oleacc

wintrust

secur32

netapi32

crypt32

bcrypt

Exports

Exports

Sections

.text Size: 20.9MB - Virtual size: 20.9MB

.rdata Size: 6.1MB - Virtual size: 6.1MB

.data Size: 393KB - Virtual size: 1.8MB

.rsrc Size: 25KB - Virtual size: 25KB

.reloc Size: 1.3MB - Virtual size: 1.3MB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

47:07:d4:0b:50:82:fe:aa:6e:0a:5e:92
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

63:f7:5a:5a:07:01:3f:62:81:2f:57:34:6f:3f:b6:96:4e:a2:38:e5:28:ed:03:ca:6f:9a:e7:90:bc:15:81:d8
Signer

.text
Size: 20.9MB - Virtual size: 20.9MB

.rdata
Size: 6.1MB - Virtual size: 6.1MB

.data
Size: 393KB - Virtual size: 1.8MB

.rsrc
Size: 25KB - Virtual size: 25KB

.reloc
Size: 1.3MB - Virtual size: 1.3MB