d432de7b32ff2a7c8ada49b2c8c97982a0d0dd5ad3ae7fe1f5949e233c78b165

Sharing

Copy URL Twitter E-mail

General

Target

d432de7b32ff2a7c8ada49b2c8c97982a0d0dd5ad3ae7fe1f5949e233c78b165
Size

3.1MB
MD5

a001b7b3f5e8a34100f6a668905d1926
SHA1

4ff6ab56d97d52577c938835ef667df4cdcac03a
SHA256

d432de7b32ff2a7c8ada49b2c8c97982a0d0dd5ad3ae7fe1f5949e233c78b165
SHA512

f79e1fa2076faaec95b17d8a674038177f0f7a58cd12e18e0042a711e49db3483d791e75c70d1e73148b53c38f5f25e03e2c444da0f44e6eb952a76ce7a1b762
SSDEEP

49152:2ur6ufMjhnCBj5I+IOmmY/+Xn1wHngS4H7gM:2urRfMN+j3n1kegM

Score

1^/10

Malware Config

Signatures

Files

d432de7b32ff2a7c8ada49b2c8c97982a0d0dd5ad3ae7fe1f5949e233c78b165
.exe windows:6 windows x86 arch:x86

736bfd4299f665319991e00351115043

Code Sign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/01/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:2e:e3:fd:7c:dc:52:09:7c:1d:a6:af:a8:7c:74:5e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/05/2023, 00:00

Not After

06/05/2026, 23:59

Subject

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,ST=Baden-Württemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:d5:5b:44:f4:6d:f9:df:e4:f8:da:64:1e:c7:69:08:f5:c8:67:01:e8:9e:7e:cd:87:9a:48:50:93:cf:60:dc
Signer

Actual PE Digest

55:d5:5b:44:f4:6d:f9:df:e4:f8:da:64:1e:c7:69:08:f5:c8:67:01:e8:9e:7e:cd:87:9a:48:50:93:cf:60:dc

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\jenkins\FCT0\GIT_CLONE_PARENT\FortiClientHS\service\FortiTray\Win32\Release\FortiTray.pdb

Imports

comctl32

_TrackMouseEvent

winmm

PlaySoundW

crypt32

CertVerifyTimeValidity
CryptProtectData
CryptUnprotectData
CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertEnumPhysicalStore
CertOpenSystemStoreW
CryptAcquireCertificatePrivateKey
CertNameToStrW
CertGetNameStringW

wininet

InternetQueryOptionW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

SHDeleteKeyW
SHEnumKeyExW
SHCopyKeyW
StrStrIW

psapi

GetModuleFileNameExW

ws2_32

htonl
ioctlsocket
connect
closesocket
__WSAFDIsSet
freeaddrinfo
getaddrinfo
getservbyport
inet_addr
select
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
htons
socket
WSAAddressToStringW
inet_ntoa
ntohs
shutdown

rasapi32

RasGetProjectionInfoW
RasEnumConnectionsW
RasGetEntryPropertiesW

wtsapi32

WTSRegisterSessionNotification

iphlpapi

GetAdaptersInfo
NotifyRouteChange
CancelIPChangeNotify
NotifyAddrChange

kernel32

SetEnvironmentVariableA
ExitProcess
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
DeleteFileW
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetSystemDirectoryW
GetVersion
GetUserDefaultUILanguage
SetThreadLocale
GetACP
SetDllDirectoryW
SetCurrentDirectoryW
GetCurrentThread
IsBadWritePtr
IsBadReadPtr
VerifyVersionInfoW
VerSetConditionMask
CreatePipe
WaitForMultipleObjectsEx
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
OutputDebugStringW
FlushFileBuffers
DuplicateHandle
lstrcatW
lstrcpyW
WinExec
GetWindowsDirectoryW
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
GetTickCount64
TerminateThread
OpenEventW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetConsoleCtrlHandler
LoadLibraryW
FreeLibrary
ProcessIdToSessionId
CreateProcessW
GetExitCodeProcess
TerminateProcess
CreateWaitableTimerW
WaitForMultipleObjects
SetWaitableTimer
CreateMutexW
ReleaseMutex
ResetEvent
GetTempPathW
GetTempFileNameW
GetDriveTypeW
FindNextFileW
CompareFileTime
GetModuleFileNameW
GetCommandLineW
lstrlenW
lstrcpynW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
SetDefaultDllDirectories
MapViewOfFile
OpenFileMappingW
OpenMutexW
GetOverlappedResult
SetNamedPipeHandleState
WriteFile
GetModuleHandleW
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
GetLocaleInfoW
GetTimeFormatW
GetTimeFormatA
GetDateFormatW
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
InitializeCriticalSectionAndSpinCount
FindClose
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalFree
OpenProcess
ReadFile
GetLongPathNameW
CreateFileW
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetTickCount
GetLocalTime
GetSystemTimeAsFileTime
GetCurrentThreadId
CreateThread
GetCurrentProcessId
GetCurrentProcess
Sleep
CreateEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
SetLastError
SetUnhandledExceptionFilter
CloseHandle
OutputDebugStringA
DeleteFileA
CreateFileA
ExpandEnvironmentStringsA
GetStdHandle
CreateHardLinkW
MoveFileExW
FindFirstFileW
CopyFileW
CreateDirectoryExW
LoadLibraryA
SetSearchPathMode
IsProcessorFeaturePresent
UnmapViewOfFile
UnhandledExceptionFilter
DeviceIoControl
AreFileApisANSI
SetFileTime
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceExW
FindFirstFileExW
CreateDirectoryW
GetCurrentDirectoryW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
WaitForSingleObjectEx

user32

wvsprintfW
EnableWindow
CreateWindowExW
IsWindow
MoveWindow
SetWindowPos
GetWindowPlacement
DialogBoxParamW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetClientRect
GetWindowRect
MessageBoxW
GetWindowLongW
SetWindowLongW
GetAncestor
UnhookWinEvent
SetWinEventHook
GetLastInputInfo
EnumDesktopWindows
EnumDesktopsW
OpenDesktopW
GetThreadDesktop
CloseDesktop
OpenInputDesktop
SetMenuDefaultItem
SendMessageW
SetWindowTextW
DefWindowProcW
GetDlgItemTextW
GetDlgItem
EndDialog
LoadStringW
GetDoubleClickTime
LockWindowUpdate
GetFocus
FindWindowExW
UpdateWindow
RegisterClassW
GetDesktopWindow
TranslateMessage
DispatchMessageW
PostMessageW
ShowWindow
IsWindowVisible
SetTimer
KillTimer
LoadMenuW
EnumThreadWindows
MsgWaitForMultipleObjects
PostThreadMessageW
MessageBeep
GetWindowThreadProcessId
GetForegroundWindow
AttachThreadInput
SystemParametersInfoW
CopyIcon
LoadCursorW
PtInRect
SetCursor
GetDC
DestroyIcon
GetSysColor
SetForegroundWindow
SetActiveWindow
SetMenuItemBitmaps
DeleteMenu
AppendMenuW
InsertMenuW
CheckMenuItem
GetMenuState
BringWindowToTop
IsIconic
PeekMessageW
ModifyMenuW
FindWindowW
GetSystemMetrics
CreateDialogParamW
DestroyWindow
PostQuitMessage
GetMessageW
RegisterWindowMessageW
GetUserObjectInformationW
GetProcessWindowStation
LoadImageW
DestroyCursor
RemoveMenu
GetWindowInfo
LoadIconW
GetWindow
GetClassNameW
GetParent
GetClassLongW
OffsetRect
UnionRect
InflateRect
SetRect
GetSysColorBrush
GetWindowTextW
RedrawWindow
InvalidateRect
ReleaseDC
GetWindowDC
GetIconInfo
CreateIconIndirect
FillRect
GetCursorPos
SetPropW
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
UnregisterClassW

advapi32

OpenSCManagerW
RegCloseKey
RegOpenKeyA
RegQueryValueExA
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf
RegOpenCurrentUser
RegCreateKeyW
RegDeleteValueW
RegOpenKeyW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ChangeServiceConfigW
OpenServiceW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
LookupPrivilegeValueW
MapGenericMask
ImpersonateSelf
AdjustTokenPrivileges
AccessCheck
OpenThreadToken
RegDeleteKeyW
IsValidSid
FreeSid
EqualSid
DuplicateToken
CheckTokenMembership
AllocateAndInitializeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
RegQueryValueW
StartServiceW
QueryServiceStatus
CloseServiceHandle

ole32

CoInitialize
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket
StringFromGUID2
CoCreateGuid
CoTaskMemFree
CoUninitialize

shell32

CommandLineToArgvW
SHOpenFolderAndSelectItems
ord190
ord155
ShellExecuteW
SHGetPathFromIDListW
ord2
ord4
Shell_NotifyIconW
ShellExecuteExW
SHGetKnownFolderPath
SHGetFolderPathW
SHGetSpecialFolderLocation

oleaut32

GetErrorInfo
SysAllocStringByteLen
SysStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantCopy
VariantClear
VariantInit
SysAllocString
SysFreeString
SetErrorInfo
CreateErrorInfo

gdi32

GetTextExtentPoint32W
GetStockObject
CreateFontIndirectW
CreatePolygonRgn
GetObjectW
SetRectRgn
FillRgn
CreateRectRgnIndirect
CreateRectRgn
CombineRgn
SelectObject
GetDIBits
DeleteObject
CreateSolidBrush
CreatePatternBrush
CreateCompatibleDC
BitBlt
DeleteDC

gdiplus

GdiplusShutdown

oleacc

AccessibleObjectFromEvent
GetRoleTextW

Exports

Exports

??0CSslvpnAgent@@QAE@ABV0@@Z
??0CSslvpnInfoXml@@QAE@ABV0@@Z
??4COptionOp@@QAEAAV0@ABV0@@Z
??4CSslvpnAgent@@QAEAAV0@ABV0@@Z
??4CSslvpnInfoXml@@QAEAAV0@ABV0@@Z
??_7CSslvpnAgent@@6B@
??_7CSslvpnInfoXml@@6B@
?CancelGetTokenCode@CSslvpnBase@@UAEXXZ
?GetHostCheckInterval@CSslvpnBase@@QAEHXZ
?GetSessionTimeout@CSslvpnInfoXml@@QAEKXZ
?IsEnabled@CSslvpnInfoXml@@QBE_NXZ
?IsProxyAuthDlgCancelClicked@CFortiTraySslvpn@@UAEHXZ
?IsShadowMode@CSslvpnBase@@UAEHAAK@Z
?IsTunnelConnectWithoutReauthentication@CSslvpnInfoXml@@QBE_NXZ
?SetHWND@CSslvpnBase@@QAEXPAUHWND__@@@Z
?SetProxyAuthDlgCancelClicked@CFortiTraySslvpn@@UAEXH@Z
?SetTunnelConnectWithoutReauthentication@CSslvpnInfoXml@@QAEXH@Z
OPENSSL_Applink

Sections

.text
Size: 783KB - Virtual size: 784KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 286KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

736bfd4299f665319991e00351115043

Code Sign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

06:2e:e3:fd:7c:dc:52:09:7c:1d:a6:af:a8:7c:74:5eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

55:d5:5b:44:f4:6d:f9:df:e4:f8:da:64:1e:c7:69:08:f5:c8:67:01:e8:9e:7e:cd:87:9a:48:50:93:cf:60:dcSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

winmm

crypt32

wininet

version

shlwapi

psapi

ws2_32

rasapi32

wtsapi32

iphlpapi

kernel32

user32

advapi32

ole32

shell32

oleaut32

gdi32

gdiplus

oleacc

Exports

Exports

Sections

.text Size: 783KB - Virtual size: 784KB

.rdata Size: 286KB - Virtual size: 288KB

.data Size: 10KB - Virtual size: 220KB

.didat Size: 512B - Virtual size: 4KB

.rsrc Size: 2.0MB - Virtual size: 2.0MB

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

06:2e:e3:fd:7c:dc:52:09:7c:1d:a6:af:a8:7c:74:5e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

55:d5:5b:44:f4:6d:f9:df:e4:f8:da:64:1e:c7:69:08:f5:c8:67:01:e8:9e:7e:cd:87:9a:48:50:93:cf:60:dc
Signer

.text
Size: 783KB - Virtual size: 784KB

.rdata
Size: 286KB - Virtual size: 288KB

.data
Size: 10KB - Virtual size: 220KB

.didat
Size: 512B - Virtual size: 4KB

.rsrc
Size: 2.0MB - Virtual size: 2.0MB