GoodSync-vsub-Setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GoodSync-vsub-Setup.exe
Size

69.1MB
MD5

7c8ea1aa46907b26fb2f7a0cb58ceef1
SHA1

3c202a870aabde887cb3f8ce6c2e0ab8906e01f5
SHA256

f35f04a2d113793626846bf5b7e6951ebc0bfdcb8ddb531ac1553ba2e6377cee
SHA512

f22340e1f30470b2f52a208994e3d3cdfe12503bcdcdadcea13dc613d90a69ad01cf8376ab061b470b9a98d6b106ffc26b93f12462c66570609b67b684791e68
SSDEEP

1572864:KEScv1DPe7YZZ9h4qTERKRqXEHV5JXYQoidBlUbD/ypj5vPz:5v1LLCqTERKRqQp/fdBLr

Score

1^/10

Malware Config

Signatures

Files

GoodSync-vsub-Setup.exe
.exe windows:6 windows x86 arch:x86

67856265b1d43b772cfdbd9f0d3e7c3b

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

84:d5:73:3c:41:81:be:46:8c:d0:4d:b0:3f:50:71:88
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

04/01/2024, 00:00

Not After

03/01/2027, 23:59

Subject

CN=Siber Systems,O=Siber Systems,ST=Virginia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:f1:b5:18:55:59:fb:fc:cb:8d:f0:fa:2a:17:d4:b8:38:75:d8:50:a0:41:27:0e:4a:bf:4c:12:fa:e7:52:58
Signer

Actual PE Digest

eb:f1:b5:18:55:59:fb:fc:cb:8d:f0:fa:2a:17:d4:b8:38:75:d8:50:a0:41:27:0e:4a:bf:4c:12:fa:e7:52:58

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\p\goodsync\Win32\Release\gs-runner.pdb

Imports

kernel32

DeleteCriticalSection
GetCurrentThreadId
FreeLibrary
GetModuleHandleW
GetProcAddress
GetVersionExW
GetModuleFileNameW
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
LoadLibraryW
lstrcmpiW
lstrlenW
MultiByteToWideChar
CreateDirectoryW
CreateFileW
GetFileSize
SetFileTime
WriteFile
CloseHandle
GetSystemTimeAsFileTime
CreateFileMappingW
MapViewOfFile
InitializeCriticalSectionEx
lstrcpyW
GetSystemTimeAdjustment
GetThreadTimes
CreateFileMappingA
LeaveCriticalSection
EnterCriticalSection
SetErrorMode
SetLastError
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetStringTypeW
FlushFileBuffers
GetFileSizeEx
LCMapStringW
HeapReAlloc
HeapSize
SetConsoleCtrlHandler
FileTimeToSystemTime
GetLastError
RaiseException
DecodePointer
GetVolumeInformationW
GetLogicalDrives
UnmapViewOfFile
GetFileAttributesW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetConsoleOutputCP
SetFilePointerEx
SetStdHandle
GetCPInfo
FreeLibraryAndExitThread
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
VirtualAlloc
VirtualFree
GetFileInformationByHandle
ReadFile
SetEndOfFile
SetFilePointer
GetStdHandle
GetCurrentProcess
GetCurrentProcessId
GetSystemTime
GlobalAlloc
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalFree
lstrcpynW
CompareStringW
lstrcmpW
FormatMessageW
WideCharToMultiByte
GetLocaleInfoW
Sleep
GetVersionExA
FreeResource
LockResource
MulDiv
EnumSystemLanguageGroupsW
EnumLanguageGroupLocalesW
ExpandEnvironmentStringsW
SetCurrentDirectoryW
GetCurrentDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesExW
GetLongPathNameW
LockFile
RemoveDirectoryW
SetFileAttributesW
UnlockFile
GetTempPathW
DeviceIoControl
WaitForSingleObject
GetExitCodeProcess
CopyFileExW
MoveFileExW
GetConsoleMode
SetConsoleMode
GetTickCount
GetDriveTypeW
GetFullPathNameW
GetWindowsDirectoryW
GetCurrentThread
LocalAlloc
LocalFree
GetProcessTimes
OpenProcess
GlobalMemoryStatusEx
GetVersion
GetModuleHandleA
SleepEx
SetWaitableTimer
CancelWaitableTimer
CreateWaitableTimerW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
SetThreadPriority
ResumeThread
SetThreadExecutionState
InitializeCriticalSection
TryEnterCriticalSection
SetEvent
ResetEvent
ReleaseMutex
CreateMutexW
OpenMutexW
CreateEventW
WaitForMultipleObjects
OpenFileMappingW
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
GetModuleHandleExW
lstrlenA
GetLocalTime
LoadLibraryA
GetSystemDirectoryA
GetDateFormatA
SystemTimeToFileTime
GetACP
ExitProcess
SetFileValidData
CancelIo
ReadDirectoryChangesW
MapViewOfFileEx
IsDebuggerPresent
OutputDebugStringW
EncodePointer
HeapAlloc
HeapFree
GetProcessHeap
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetStartupInfoW
QueryPerformanceCounter
GetFileType
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
RtlUnwind
QueryPerformanceFrequency
CreateThread
ExitThread
GlobalMemoryStatus

msimg32

GradientFill
AlphaBlend

oleacc

CreateStdAccessibleObject
CreateStdAccessibleProxyW
LresultFromObject

wininet

HttpQueryInfoA
HttpEndRequestW
HttpQueryInfoW
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetGetLastResponseInfoA
InternetSetOptionExW
InternetSetOptionW
InternetQueryOptionW
InternetWriteFile
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestExA

secur32

GetUserNameExW

iphlpapi

GetBestInterfaceEx
GetAdaptersInfo
GetAdaptersAddresses
NotifyAddrChange
CancelIPChangeNotify
GetNetworkParams

ws2_32

WSAResetEvent
WSAAddressToStringA
getaddrinfo
freeaddrinfo
getnameinfo
WSACreateEvent

Sections

.text
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 79KB - Virtual size: 653KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 427KB - Virtual size: 426KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

67856265b1d43b772cfdbd9f0d3e7c3b

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

84:d5:73:3c:41:81:be:46:8c:d0:4d:b0:3f:50:71:88Certificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

eb:f1:b5:18:55:59:fb:fc:cb:8d:f0:fa:2a:17:d4:b8:38:75:d8:50:a0:41:27:0e:4a:bf:4c:12:fa:e7:52:58Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msimg32

oleacc

wininet

secur32

iphlpapi

ws2_32

Sections

.text Size: 7.2MB - Virtual size: 7.2MB

.rdata Size: 2.9MB - Virtual size: 2.9MB

.data Size: 79KB - Virtual size: 653KB

.rsrc Size: 427KB - Virtual size: 426KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

84:d5:73:3c:41:81:be:46:8c:d0:4d:b0:3f:50:71:88
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

eb:f1:b5:18:55:59:fb:fc:cb:8d:f0:fa:2a:17:d4:b8:38:75:d8:50:a0:41:27:0e:4a:bf:4c:12:fa:e7:52:58
Signer

.text
Size: 7.2MB - Virtual size: 7.2MB

.rdata
Size: 2.9MB - Virtual size: 2.9MB

.data
Size: 79KB - Virtual size: 653KB

.rsrc
Size: 427KB - Virtual size: 426KB