NPE[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

NPE.exe
Size

16.2MB
MD5

ddfc82cf4eab81965e3ec8ca8915b00a
SHA1

1e5b94be6922e6198afe39a7fc695db291bffcf6
SHA256

4819d87fe9d0d0485fe85a3843a3e3ecd61ebe50a115dad01ec10275272be82a
SHA512

ac08fa6aa1e55a653ad48305bf19c346d0a82a30830ae5b8c84d557e44c57511e39c68deb786044481074fb694d3827f66cb66862ac52fb4437663e82d64ba42
SSDEEP

196608:dm9mJUAMfMvgTz2ENNFV8pYrqNpEdYo1NTXPJb:sCMfMQz2Ev8+rqNp1yXPJb

Score

1^/10

Malware Config

Signatures

Files

NPE.exe
.exe windows:6 windows x64 arch:x64

6e0dcaca7f0e80510d06b4087b95e6f7

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:be:91:35:61:37:61:3e:57:68:3e:60:3e:c5:38:bd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

17-05-2021 00:00

Not After

21-05-2024 23:59

Subject

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:17:85:6e:8e:34:bc:b7:30:de:59:cc:d4:ea:5a:b7:45:6e:72:07:67:c5:ed:d1:57:b8:38:9c:88:67:4c:8e
Signer

Actual PE Digest

5d:17:85:6e:8e:34:bc:b7:30:de:59:cc:d4:ea:5a:b7:45:6e:72:07:67:c5:ed:d1:57:b8:38:9c:88:67:4c:8e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins\workspace\SNaPE\NortonPowerEraser\Builds\npe_release_build\SNaPE\NPE\bin\bin64.iru\NPE.pdb

Imports

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteExW
ShellExecuteW
SHBrowseForFolderW
SHFileOperationW
SHGetPathFromIDListW
ord74
DragQueryFileW
SHGetFileInfoW
ord727
ord190
ord155
SHOpenFolderAndSelectItems
SHGetKnownFolderPath
CommandLineToArgvW

rpcrt4

UuidToStringW
UuidCreate
UuidCompare
RpcStringFreeW
UuidFromStringW

psapi

EnumProcesses
GetModuleFileNameExW
GetProcessImageFileNameW

ws2_32

WSAGetLastError
inet_addr
WSAAddressToStringW
socket
htonl
htons
bind
closesocket
listen
ntohs
gethostbyname
inet_ntoa
accept
setsockopt
connect
select
recv
send
shutdown
gethostname
ioctlsocket
freeaddrinfo
getaddrinfo
__WSAFDIsSet
gethostbyaddr
getservbyport
getservbyname
WSASetLastError
WSAStartup
WSACleanup
WSAStringToAddressW

kernel32

lstrcmpW
OutputDebugStringW
WaitForMultipleObjectsEx
CreateSemaphoreA
Module32FirstW
Module32NextW
CreateMutexW
IsDebuggerPresent
FindFirstVolumeW
FindVolumeClose
GetVolumePathNamesForVolumeNameW
GetFileType
FindNextVolumeW
GetVolumeInformationByHandleW
GetFileSize
SetEndOfFile
OpenMutexW
ReleaseMutex
TryEnterCriticalSection
CreateThread
TerminateThread
SetThreadPriority
GetThreadPriority
ExitThread
lstrlenW
GetSystemDefaultUILanguage
GetCommandLineW
lstrcpyW
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
CreateEventW
OpenEventW
SetEvent
ResetEvent
GetProcessTimes
RtlCaptureContext
CreateWaitableTimerW
CancelWaitableTimer
SetWaitableTimer
RegisterWaitForSingleObject
UnregisterWaitEx
lstrlenA
GlobalSize
WaitForMultipleObjects
CreateSemaphoreW
ReadProcessMemory
VirtualQuery
SetUnhandledExceptionFilter
SetFilePointerEx
LCMapStringW
TlsFree
GetCPInfo
RtlLookupFunctionEntry
RtlVirtualUnwind
DuplicateHandle
TerminateProcess
GetBinaryTypeW
GetUserGeoID
GetNumberFormatW
GetGeoInfoW
GetSystemWindowsDirectoryW
GetComputerNameW
LoadLibraryW
GetEnvironmentVariableW
SetEnvironmentVariableW
SetDllDirectoryW
FlushFileBuffers
SystemTimeToTzSpecificLocalTime
GetLocalTime
GetTimeZoneInformation
GetUserDefaultUILanguage
GetFileTime
GetDriveTypeW
GetWindowsDirectoryW
GetCurrentDirectoryW
SetFilePointer
WriteFile
GetLongPathNameW
GetFullPathNameW
ReadFile
CompareStringW
InitializeCriticalSectionAndSpinCount
GetCurrentThread
GetTempPathW
QueryDosDeviceW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SetSystemTime
CreatePipe
MulDiv
GetModuleHandleExW
GetDiskFreeSpaceExW
GetDateFormatW
GetTimeFormatW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileSectionNamesW
InitializeCriticalSection
SetLastError
GetVolumeInformationW
GetSystemDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MoveFileExW
DeviceIoControl
GlobalMemoryStatusEx
GetCurrentProcess
GetExitCodeProcess
GetSystemTimeAsFileTime
GetUserDefaultLCID
GetLocaleInfoW
GetSystemInfo
ResumeThread
GetSystemDefaultLCID
ExpandEnvironmentStringsW
OpenProcess
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
WTSGetActiveConsoleSessionId
GetCurrentProcessId
ProcessIdToSessionId
WideCharToMultiByte
RemoveDirectoryW
GetFileSizeEx
GetSystemTime
SystemTimeToFileTime
CreateDirectoryW
WaitForSingleObject
FormatMessageW
LocalAlloc
CopyFileW
GetFileAttributesExW
FindNextFileW
FindFirstFileW
FindClose
GetFileAttributesW
GetTickCount
MultiByteToWideChar
lstrcmpiW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetErrorMode
RaiseException
DecodePointer
FileTimeToSystemTime
GetModuleHandleW
FileTimeToLocalFileTime
CompareFileTime
MoveFileW
CreateProcessW
CloseHandle
SetFileInformationByHandle
SetFileAttributesW
DeleteFileW
CreateFileW
GetModuleFileNameW
Sleep
WaitForSingleObjectEx
ReleaseSemaphore
LocalFree
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
TlsSetValue
TlsGetValue
TlsAlloc
FlushInstructionCache
QueueUserWorkItem
IsProcessorFeaturePresent
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
GetStringTypeW
lstrcmpA
LCMapStringA
WritePrivateProfileSectionW
UnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
FormatMessageA
CreateTimerQueue
SignalObjectAndWait
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
GetTempPathA
GetTempFileNameA
GetLogicalDriveStringsW
GetPrivateProfileSectionW
BackupWrite
BackupRead
GetLocaleInfoA
GetSystemDirectoryA
LoadLibraryA
DeleteVolumeMountPointW
MapViewOfFileEx
GetVolumeNameForVolumeMountPointW
CreateProcessA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
QueryPerformanceFrequency
QueryPerformanceCounter
EncodePointer
RtlPcToFileHeader
LoadLibraryExA
VirtualProtect
GetFileInformationByHandle
EnumSystemLocalesW
IsValidLocale
WriteConsoleW
SetStdHandle
GetACP
GetStdHandle
GetConsoleCP
ReadConsoleW
GetConsoleMode
RtlUnwindEx
ExitProcess
GetCurrencyFormatW
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
LocalSize
CompareStringA
GetUserDefaultLangID
GetModuleFileNameA
AllocConsole

user32

EmptyClipboard
SetClipboardData
CloseClipboard
PostThreadMessageW
CharPrevW
MsgWaitForMultipleObjectsEx
IsWindowUnicode
GetMessageA
GetMessageW
DispatchMessageA
PeekMessageW
LoadIconW
IsCharAlphaNumericW
UnregisterClassW
CharNextW
LoadImageW
GetMenuItemCount
EnableMenuItem
GetSystemMenu
GetSystemMetrics
ShowWindow
DestroyWindow
IsWindow
PostMessageW
SendMessageW
wsprintfW
GetClipboardSequenceNumber
GetClipboardData
IsClipboardFormatAvailable
EnumClipboardFormats
CountClipboardFormats
RegisterClipboardFormatW
UpdateLayeredWindow
SetCaretPos
CreateCaret
GetKeyboardLayout
DestroyCaret
LoadStringW
RedrawWindow
RegisterClassW
BeginPaint
EndPaint
SetParent
AllowSetForegroundWindow
MessageBeep
DestroyIcon
DrawIconEx
GetIconInfo
CreateIconIndirect
GetSysColor
SetScrollInfo
DeferWindowPos
GetScrollInfo
WindowFromPoint
SetClassLongW
BeginDeferWindowPos
GetAsyncKeyState
GetCapture
IsChild
GetDoubleClickTime
MoveWindow
MessageBoxW
IsRectEmpty
SetCapture
EndDeferWindowPos
EnumThreadWindows
GetClassLongW
ReleaseCapture
InvalidateRect
EnumDisplayMonitors
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowPlacement
MonitorFromPoint
DeleteMenu
TrackPopupMenuEx
GetMenuItemID
KillTimer
IsZoomed
GetKeyState
GetWindowTextW
OffsetRect
EqualRect
GetLayeredWindowAttributes
GetFocus
GetAncestor
CreateWindowExW
IsMenu
GetMenuState
FlashWindowEx
UpdateWindow
EnableWindow
SetWindowTextW
SetTimer
NotifyWinEvent
GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
AdjustWindowRectEx
WaitMessage
GetActiveWindow
GetWindowDC
SetFocus
PostQuitMessage
AnimateWindow
SetWindowLongW
RegisterClassExW
GetClassInfoExW
GetWindow
EnumDisplayDevicesW
LoadCursorFromFileA
DestroyCursor
SendMessageTimeoutW
CopyRect
SetCursor
SetClassLongPtrW
LoadCursorW
PtInRect
ScreenToClient
GetCursorPos
RegisterWindowMessageW
OpenClipboard
SetActiveWindow
SetWindowPos
SetForegroundWindow
GetForegroundWindow
FlashWindow
IsIconic
IsWindowVisible
FindWindowW
GetWindowLongW
FindWindowExW
AttachThreadInput
GetWindowThreadProcessId
MonitorFromWindow
ReleaseDC
ClientToScreen
GetDC
GetDesktopWindow
SystemParametersInfoW
DispatchMessageW
GetMessageTime
CallWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
DefWindowProcW
TranslateMessage

gdi32

SaveDC
GetClipBox
RestoreDC
BitBlt
GetFontUnicodeRanges
EnumFontFamiliesExW
GetObjectA
GetGlyphIndicesW
SetViewportOrgEx
GetDeviceCaps
GetObjectW
SetLayout
GetStockObject
CreateBitmap
AddFontMemResourceEx
CreateCompatibleDC
CreateDIBSection
SelectObject
StartPage
EndDoc
CreateDCW
SetMapMode
StartDocW
EndPage
GetLayout
DeleteDC
DeleteObject
GetDIBits
CreateFontW

advapi32

AddAce
AccessCheck
SetThreadToken
EnableTraceEx
RegNotifyChangeKeyValue
DeleteService
ControlService
RegUnLoadKeyW
RegLoadKeyW
CloseEncryptedFileRaw
WriteEncryptedFileRaw
ReadEncryptedFileRaw
OpenEncryptedFileRawW
LookupAccountSidW
GetKernelObjectSecurity
ChangeServiceConfigW
QueryServiceConfigW
SetKernelObjectSecurity
LookupPrivilegeNameW
QueryServiceStatusEx
CloseServiceHandle
MakeAbsoluteSD
RegOpenKeyW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
ImpersonateSelf
RegEnumValueW
RegQueryValueExW
InitiateSystemShutdownW
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
CreateWellKnownSid
InitializeSecurityDescriptor
SetSecurityDescriptorGroup
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
OpenThreadToken
ConvertSidToStringSidW
CreateProcessAsUserW
SetTokenInformation
StartServiceW
OpenServiceW
OpenSCManagerW
InitiateSystemShutdownExW
RegDisablePredefinedCache
QueryServiceStatus
MapGenericMask
SetSecurityInfo
GetSecurityInfo
DuplicateToken
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
GetSecurityDescriptorControl
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetAce
GetAclInformation
RegEnumKeyW
InitializeAcl
EqualSid
IsValidSid
GetLengthSid
CopySid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RevertToSelf
ImpersonateLoggedOnUser
DuplicateTokenEx
OpenProcessToken
EnumerateTraceGuids
QueryTraceW
FlushTraceW
StopTraceW
EnableTrace
StartTraceW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
ControlTraceW
TraceMessage
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
ConvertStringSidToSidW
CreateServiceW
GetUserNameW

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateGuid
StringFromGUID2
CoInitialize
CoUninitialize
CoInitializeSecurity
RevokeDragDrop
RegisterDragDrop
ReleaseStgMedium
DoDragDrop
CoTaskMemAlloc
PropVariantCopy
PropVariantClear
StgCreateStorageEx
StgOpenStorageEx
StringFromIID
CoInitializeEx
CoSetProxyBlanket
CLSIDFromString
CreateStreamOnHGlobal
CoCreateInstance
CoTaskMemRealloc
OleRun
IIDFromString

oleaut32

SafeArrayCopy
SafeArrayCreateVector
SafeArrayRedim
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayUnlock
SafeArrayCreate
VariantCopyInd
SysStringByteLen
SysAllocStringByteLen
VarBstrFromDate
VariantChangeType
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetVartype
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocStringLen
SysStringLen
VariantClear
VariantInit
SysAllocString
SysFreeString
VarUI4FromStr
GetErrorInfo
SafeArrayDestroy

shlwapi

PathAddBackslashW
PathMatchSpecW
PathFileExistsW
UrlCanonicalizeW
UrlEscapeW
ord12
PathCombineW
PathFindOnPathW
PathFindExtensionW
PathFindFileNameW
PathAppendW
PathIsUNCServerW
SHDeleteKeyW
PathSkipRootW
PathIsUNCW
PathIsURLW
PathRemoveFileSpecW

imm32

ImmAssociateContextEx
ImmIsIME
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
ImmNotifyIME

gdiplus

GdipGetClipBoundsI
GdipSetPenLineJoin
GdipBitmapLockBits
GdipTranslateMatrix
GdipDrawString
GdipDrawPath
GdipFree
GdipCreateImageAttributes
GdipGetSmoothingMode
GdipTransformPoints
GdipClosePathFigure
GdipSetClipRectI
GdipSetPageUnit
GdipAddPathEllipse
GdipFillRectangle
GdipSetPixelOffsetMode
GdipDrawRectangle
GdipAddPathLineI
GdipDrawLine
GdipCreateFromHWND
GdipSetPenDashStyle
GdipGraphicsClear
GdipMultiplyWorldTransform
GdipSetPenDashArray
GdipGetPathWorldBounds
GdipFillPath
GdipShearMatrix
GdipFillPie
GdipSetStringFormatTrimming
GdipResetPath
GdipGetFontStyle
GdipCreateSolidFill
GdipSetPathGradientWrapMode
GdipGetCellDescent
GdipCreateFromHDC
GdipSetLinePresetBlend
GdipSetPenMiterLimit
GdipSetStringFormatLineAlign
GdipCreatePath
GdipCreateLineBrush
GdipSetPenEndCap
GdipBeginContainer2
GdipCreateTexture
GdipSetTextRenderingHint
GdipGetCellAscent
GdipDrawEllipse
GdipRestoreGraphics
GdipCloneBrush
GdipSetPenDashOffset
GdipMeasureString
GdipGetFontHeightGivenDPI
GdipGetImageGraphicsContext
GdipDrawPie
GdipFillRectangleI
GdipAddPathArc
GdipDeleteGraphics
GdipClonePath
GdipDrawArc
GdipDeleteStringFormat
GdipStartPathFigure
GdipGetFontSize
GdipGetImageWidth
GdipTranslateWorldTransform
GdipDeletePen
GdipCreateBitmapFromScan0
GdipAddPathString
GdipSetPathFillMode
GdipCreatePen1
GdipEndContainer
GdipSetSmoothingMode
GdipSetStringFormatAlign
GdipSetInterpolationMode
GdipDisposeImage
GdipCreateMatrix
GdipCreatePathGradientFromPath
GdipDeletePath
GdipDisposeImageAttributes
GdipAddPathBezier
GdipCreateMatrix2
GdipAlloc
GdipScaleMatrix
GdipRotateMatrix
GdipIsVisiblePathPoint
GdipDeleteBrush
GdipBitmapUnlockBits
GdipSetPenStartCap
GdipCloneImage
GdipDeleteMatrix
GdipFillRectanglesI
GdipSetPathGradientCenterPoint
GdipSetClipRect
GdipSetPathGradientTransform
GdipSetLineWrapMode
GdipDrawImageRectRect
GdipSaveGraphics
GdipAddPathArcI
GdipGetEmHeight
GdipAddPathRectangleI
GdipDrawDriverString
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromGraphics
GdipDrawImageI
GdiplusStartup
GdiplusShutdown
GdipCreateFontFromLogfontA
GdipGetLineSpacing
GdipCreateFontFromDC
GdipDeleteFont
GdipAddPathLine
GdipMultiplyLineTransform
GdipCreateStringFormat
GdipDeleteFontFamily
GdipSetPathGradientPresetBlend
GdipGetImageHeight
GdipSetImageAttributesColorMatrix
GdipSetCompositingQuality
GdipGetFamily
GdipFillEllipse
GdipCreatePen2

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW

msi

ord205

comdlg32

GetSaveFileNameW
CommDlgExtendedError
PrintDlgW
GetOpenFileNameW

Sections

.text
Size: 8.5MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

IPPCODE
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 269KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 349KB - Virtual size: 348KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e0dcaca7f0e80510d06b4087b95e6f7

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0b:be:91:35:61:37:61:3e:57:68:3e:60:3e:c5:38:bdCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

5d:17:85:6e:8e:34:bc:b7:30:de:59:cc:d4:ea:5a:b7:45:6e:72:07:67:c5:ed:d1:57:b8:38:9c:88:67:4c:8eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

rpcrt4

psapi

ws2_32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

imm32

gdiplus

setupapi

msi

comdlg32

Sections

.text Size: 8.5MB - Virtual size: 8.5MB

IPPCODE Size: 114KB - Virtual size: 114KB

.rdata Size: 3.0MB - Virtual size: 3.0MB

.data Size: 269KB - Virtual size: 323KB

.pdata Size: 349KB - Virtual size: 348KB

.rsrc Size: 3.9MB - Virtual size: 3.9MB

.reloc Size: 93KB - Virtual size: 93KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0b:be:91:35:61:37:61:3e:57:68:3e:60:3e:c5:38:bd
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

5d:17:85:6e:8e:34:bc:b7:30:de:59:cc:d4:ea:5a:b7:45:6e:72:07:67:c5:ed:d1:57:b8:38:9c:88:67:4c:8e
Signer

.text
Size: 8.5MB - Virtual size: 8.5MB

IPPCODE
Size: 114KB - Virtual size: 114KB

.rdata
Size: 3.0MB - Virtual size: 3.0MB

.data
Size: 269KB - Virtual size: 323KB

.pdata
Size: 349KB - Virtual size: 348KB

.rsrc
Size: 3.9MB - Virtual size: 3.9MB

.reloc
Size: 93KB - Virtual size: 93KB