c900638bd863ffa641b1fa77df432d9c85faeca2a20914fd1fc8247a6653a7b3[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

c900638bd863ffa641b1fa77df432d9c85faeca2a20914fd1fc8247a6653a7b3.zip
Size

1.3MB
MD5

0bfbbff8e9c6a6a506199fc1d01ba0f0
SHA1

340a0093745328a28eb2476b6f6472202f7b9290
SHA256

c900638bd863ffa641b1fa77df432d9c85faeca2a20914fd1fc8247a6653a7b3
SHA512

d4cf5cd0e54dd8bebc3e119a772fd429543ad6acc9ebfea13360a9956f1f44a0be3bb41652e28819b134f117264bbcff9b65e05cd39c73b75deeb78a4b53ee6a
SSDEEP

24576:1KmFHFOsTXoEhmjDHCre5XiQ6OOLCTj8Y8qoFiWimInX9Mrl4:1KmFHYwoBjLCrlQ6OOLCTj8liWoX9MrW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Lightshot.dll

Files

c900638bd863ffa641b1fa77df432d9c85faeca2a20914fd1fc8247a6653a7b3.zip
.zip
DXGIODScreenshot.dll
.dll windows:5 windows x86 arch:x86

8e55ea89e532d567e141d1a61186f294

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:34:23:ce:0c:60:66:67
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

30/05/2019, 00:39

Not After

30/05/2022, 00:39

Subject

CN=Kilonova LLC,O=Kilonova LLC,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4e:3f:00:ce:85:7a:2a:56:69:b5:87:89:a1:67:b2:fc:df:98:2e:e6:d3:4a:06:34:8e:11:9e:cd:b1:47:7d:72
Signer

Actual PE Digest

4e:3f:00:ce:85:7a:2a:56:69:b5:87:89:a1:67:b2:fc:df:98:2e:e6:d3:4a:06:34:8e:11:9e:cd:b1:47:7d:72

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\skillbrains\lightshot-windows-app\Screenshot\StandAloneApp\Release\DXGIODScreenshot.pdb

Imports

kernel32

HeapAlloc
DecodePointer
GetProcAddress
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
SetLastError
GetCurrentProcess
FindClose
MultiByteToWideChar
FreeLibrary
VerSetConditionMask
VerifyVersionInfoW
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
RaiseException
CloseHandle
HeapReAlloc
GetLastError
HeapSize
GetCurrentThreadId
CreateFileW
InitializeCriticalSectionAndSpinCount
WriteFile
HeapFree
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
GetFileType
GetStdHandle
GetACP
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
RtlUnwind
InterlockedFlushSList
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent

user32

CopyRect
ReleaseDC
GetWindowDC
EnumDisplayMonitors

gdi32

CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
EqualRgn
DeleteDC
CreateRectRgnIndirect
CombineRgn
DeleteObject
BitBlt

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

Exports

Exports

TakeScreenshotExp

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lightbase.dll
.dll windows:5 windows x86 arch:x86

6a76fa6ec8daa78854b0e42a457b5f9e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:34:23:ce:0c:60:66:67
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

30/05/2019, 00:39

Not After

30/05/2022, 00:39

Subject

CN=Kilonova LLC,O=Kilonova LLC,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:2d:69:7f:6c:bf:47:69:d9:4f:2f:1d:57:b5:a2:f7:48:24:17:9d:f6:bf:5c:1d:20:7d:40:59:b6:eb:71:c5
Signer

Actual PE Digest

0d:2d:69:7f:6c:bf:47:69:d9:4f:2f:1d:57:b5:a2:f7:48:24:17:9d:f6:bf:5c:1d:20:7d:40:59:b6:eb:71:c5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\skillbrains\lightshot-windows-app\Screenshot\StandAloneApp\Release\Lightshot.pdb

Imports

gdiplus

GdipCreateBitmapFromScan0
GdipGetImageWidth
GdipDeleteGraphics
GdipCreatePen1
GdipDrawImageRectRectI
GdipDeletePen
GdipCreateFromHDC
GdipReleaseDC
GdipGetDC
GdipDrawRectangleI
GdipDrawLinesI
GdipFillEllipse
GdipCreateStringFormat
GdipDeleteFontFamily
GdipSetCompositingQuality
GdipCreateFontFamilyFromName
GdipDeleteBrush
GdipCreateFont
GdipSetInterpolationMode
GdipCreateSolidFill
GdipSetPixelOffsetMode
GdipGetGenericFontFamilySansSerif
GdipDrawString
GdipCloneBrush
GdipMeasureString
GdipDeleteStringFormat
GdipDeleteFont
GdipSetStringFormatAlign
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromStream
GdipDrawImageRectI
GdipDrawEllipseI
GdipSetSmoothingMode
GdipSaveImageToFile
GdipSetPenColor
GdipSetPenStartCap
GdipSetPenWidth
GdipSetPenLineJoin
GdipSetPenEndCap
GdipCreateAdjustableArrowCap
GdipSetPenCustomEndCap
GdipDeleteCustomLineCap
GdipDrawLineI
GdipGetImageHeight
GdipSetImageAttributesColorMatrix
GdipGetImageEncoders
GdipDrawImageRectRect
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipDisposeImageAttributes
GdipDeletePath
GdipDisposeImage
GdipCreatePath
GdipResetPath
GdipFillPath
GdipGetImagePixelFormat
GdipCreateHBITMAPFromBitmap
GdipSetPageUnit
GdipClosePathFigure
GdipCreateImageAttributes
GdipFree
GdipGetImageGraphicsContext
ord1
GdipGetImageEncodersSize

kernel32

EncodePointer
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
SetEvent
SizeofResource
HeapFree
InitializeCriticalSectionAndSpinCount
HeapSize
GetLastError
LockResource
HeapReAlloc
RaiseException
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
GetProcAddress
DeleteCriticalSection
ResetEvent
GetProcessHeap
FreeLibrary
VerifyVersionInfoW
WriteFile
CreateMutexW
CreateFileW
GetCurrentThreadId
ReleaseMutex
CloseHandle
GetModuleHandleW
WideCharToMultiByte
SetLastError
GetCurrentProcess
GetModuleFileNameW
GetTempPathW
FindClose
MultiByteToWideChar
GetTempFileNameW
EnterCriticalSection
LeaveCriticalSection
MulDiv
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
QueryPerformanceCounter
CreateDirectoryW
lstrcmpiW
LoadLibraryExW
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetCurrentProcessId
GetSystemTimeAsFileTime
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW
VerSetConditionMask

user32

TrackPopupMenu
CreatePopupMenu
MonitorFromPoint
CreateDialogParamW
IntersectRect
OffsetRect
GetCursorInfo
DrawIcon
GetIconInfo
GetDesktopWindow
DestroyWindow
CharNextW
UpdateWindow
ShowWindow
DestroyMenu
IsRectEmpty
DialogBoxParamW
MoveWindow
GetDlgItem
BeginPaint
EndPaint
GetActiveWindow
InflateRect
GetWindowTextLengthW
PostMessageW
GetDC
FillRect
SetWindowTextW
RegisterClassExW
IsWindow
GetAsyncKeyState
RedrawWindow
CreateCaret
GetMonitorInfoW
SetCapture
SetCursor
DrawTextW
ShowCaret
GetClassInfoExW
ReleaseCapture
InvalidateRect
GetWindowTextW
GetWindowLongW
DefWindowProcW
CallWindowProcW
GetWindowRect
SetWindowLongW
RegisterWindowMessageW
SetWindowPos
CreateWindowExW
ScreenToClient
ClientToScreen
SetRectEmpty
GetParent
GetCursorPos
EqualRect
UnionRect
TrackMouseEvent
GetWindowDC
SetRect
ReleaseDC
EnumDisplayMonitors
CopyRect
SendMessageW
FindWindowW
UnregisterClassW
SetFocus
AppendMenuW
EnableMenuItem
PtInRect
SetForegroundWindow
EndDialog
MessageBeep
OpenClipboard
CloseClipboard
EmptyClipboard
LoadCursorW
SetClipboardData
GetSystemMetrics

gdi32

GetTextMetricsW
CreateDIBSection
EqualRgn
RectInRegion
SetTextColor
StartPage
StretchBlt
EndDoc
StartDocW
CreateRectRgnIndirect
EndPage
SetBkMode
SetBkColor
ExtTextOutW
CreateCompatibleBitmap
BitBlt
SelectObject
CreateCompatibleDC
CreateFontW
GetStockObject
GetDeviceCaps
CreatePen
Rectangle
CreateSolidBrush
CreateBitmap
CombineRgn
GetObjectW
DeleteObject
GetDIBits
DeleteDC

comdlg32

GetSaveFileNameW
PrintDlgExW
GetOpenFileNameW
ChooseColorW

advapi32

RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW

shell32

SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc

oleaut32

VarUI4FromStr

shlwapi

PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
PathAddBackslashW
PathCombineW

comctl32

InitCommonControlsEx

Exports

Exports

DeinitLightshot
InitLightshot
MakeScreenshot
MakeScreenshotByCommand
SetTranslations

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 247KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lightshot.dll
.dll windows:6 windows x86 arch:x86

7f737654202df3caad6fbc2347630fdc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathFileExistsW

kernel32

GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLocalTime
LocalFree
FileTimeToSystemTime
SystemTimeToFileTime
CreateDirectoryW
LoadLibraryW
lstrlenW
GetCommandLineA
CreateProcessW
GetModuleFileNameW
GetLastError
WaitForSingleObject
CloseHandle
GetTempPathW
GetOEMCP
GetACP
IsValidCodePage
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
HeapReAlloc
ReadConsoleW
FreeEnvironmentStringsW
GetModuleFileNameA
GetCommandLineW
Sleep
EncodePointer
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
GetLocaleInfoEx
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetFilePointerEx
DecodePointer
LCMapStringEx
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RaiseException
RtlUnwind
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
GetEnvironmentStringsW

user32

MessageBoxW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree
CoInitializeEx
CoInitializeSecurity
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

advapi32

RegCreateKeyA
RegCloseKey
RegOpenKeyA

Exports

Exports

DeinitLightshot
InitLightshot
MakeScreenshot
MakeScreenshotByCommand
SetTranslations

Sections

.text
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lightshot.exe
.exe windows:5 windows x86 arch:x86

2f0381ca527366dde0bbef4148ecb54a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:34:23:ce:0c:60:66:67
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

30/05/2019, 00:39

Not After

30/05/2022, 00:39

Subject

CN=Kilonova LLC,O=Kilonova LLC,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c3:fc:67:ca:51:64:9a:12:d3:21:53:24:a7:c3:2f:99:d2:65:bd:2d:9f:8a:30:54:6a:18:a4:10:53:5b:54:5c
Signer

Actual PE Digest

c3:fc:67:ca:51:64:9a:12:d3:21:53:24:a7:c3:2f:99:d2:65:bd:2d:9f:8a:30:54:6a:18:a4:10:53:5b:54:5c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Dev\skillbrains\lightshot-windows-app\Screenshot\StandAloneApp\Release\Lightshot_exe.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

FreeLibrary
FindFirstFileW
SetLastError
FindNextFileW
GetCurrentProcess
GetModuleFileNameW
FindClose
MultiByteToWideChar
GetTickCount
CompareStringW
lstrlenW
GetVersionExW
GetLocalTime
lstrcmpiW
MulDiv
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
GetComputerNameW
LCMapStringW
GetStringTypeW
GetFileType
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
QueryPerformanceFrequency
LoadLibraryW
RtlUnwind
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
EncodePointer
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GlobalFree
ResetEvent
SetEvent
CreateEventW
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetConsoleCP
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
GetModuleHandleW
GetFileSize
GetProcAddress
FindResourceW
LoadResource
FindResourceExW
LockResource
ReleaseMutex
GetCurrentThreadId
CreateFileW
CreateMutexW
WriteFile
SizeofResource
ReadFile
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
CreateThread
RaiseException
CloseHandle
HeapReAlloc
TerminateThread
GetLastError
HeapSize
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
HeapFree
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW

user32

PostQuitMessage
DialogBoxParamW
SetTimer
MoveWindow
PostMessageW
RegisterWindowMessageW
GetMessageW
DispatchMessageW
TranslateMessage
KillTimer
MapVirtualKeyW
RemoveMenu
LoadIconW
DestroyMenu
GetKeyNameTextW
EnableWindow
GetAsyncKeyState
GetWindowLongW
GetWindowTextLengthW
DefWindowProcW
CallWindowProcW
GetWindow
GetWindowRect
RegisterHotKey
DestroyIcon
GetActiveWindow
GetSubMenu
TrackPopupMenu
MonitorFromPoint
LoadMenuW
UnregisterHotKey
GetClassInfoExW
RegisterWindowMessageA
RegisterClassExW
MessageBoxW
GetFocus
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
FillRect
CreateWindowExW
ScreenToClient
EndDialog
SetWindowTextW
IsWindow
OffsetRect
GetCapture
GetMonitorInfoW
GetDlgCtrlID
MapWindowPoints
DrawFocusRect
GetSysColor
IsWindowEnabled
SetFocus
CharNextW
LoadCursorW
GetClassNameW
SetCapture
SetCursor
SetRectEmpty
SetWindowLongW
GetClientRect
GetDlgItem
DrawTextW
SystemParametersInfoW
GetParent
PtInRect
UpdateWindow
ReleaseCapture
InvalidateRect
GetCursorPos
BeginPaint
EndPaint
GetWindowTextW
InsertMenuItemW
SetMenuItemInfoW
TrackMouseEvent
ReleaseDC
GetSystemMetrics
GetWindowDC
SendMessageW
UnregisterClassW
SetForegroundWindow

gdi32

SelectObject
CreateFontW
GetDeviceCaps
DeleteObject
GetObjectW
CreateFontIndirectW
CreateSolidBrush
SetBkColor
SetBkMode
GetStockObject
SetTextColor

advapi32

RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
CryptDestroyKey
CryptEncrypt
CryptDecrypt
CryptSetKeyParam
CryptImportKey
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegDeleteValueW
RegEnumValueW
RegCloseKey

shell32

ShellExecuteW
Shell_NotifyIconW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CoInitialize
StringFromGUID2
CoCreateGuid
CoCreateInstance

oleaut32

VarUI4FromStr
SysFreeString
SysAllocString

shlwapi

PathFileExistsW
PathCanonicalizeW
PathAppendW
PathRemoveFileSpecW
PathAddBackslashW
PathIsDirectoryW

comctl32

DestroyPropertySheetPage
PropertySheetW
CreatePropertySheetPageW

wininet

InternetQueryOptionW

Sections

.text
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
learnmore.url
learnmore_ru.url
locales/ar.txt
locales/be.txt
locales/bg.txt
locales/bn-BD.txt
locales/bs.txt
locales/ca.txt
locales/cs.txt
locales/da.txt
locales/de.txt
locales/el.txt
locales/en.txt
locales/es.txt
locales/et.txt
locales/fa.txt
locales/fi.txt
locales/fr.txt
locales/gl.txt
locales/he.txt
locales/hr.txt
locales/hu.txt
locales/hy.txt
locales/id.txt
locales/is.txt
locales/it.txt
locales/ja.txt
locales/ka.txt
locales/ko.txt
locales/ku.txt
locales/lt.txt
locales/lv.txt
locales/mk.txt
locales/nb-NO.txt
locales/nl.txt
locales/pl.txt
locales/pt-PT.txt
locales/pt-br.txt
locales/ro.txt
locales/ru.txt
locales/sk.txt
locales/sl.txt
locales/sq.txt
locales/sr-Cyrl.txt
locales/sr.txt
locales/sv.txt
locales/th.txt
locales/tr.txt
locales/uk.txt
locales/ur.txt
locales/vi.txt
locales/zh-CN.txt
locales/zh-TW.txt
sqlite3.dll
uploader.dll
.dll windows:5 windows x86 arch:x86

3f0ea857b844fec98c79341d21783cfa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:34:23:ce:0c:60:66:67
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

30/05/2019, 00:39

Not After

30/05/2022, 00:39

Subject

CN=Kilonova LLC,O=Kilonova LLC,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

60:52:b7:c6:7b:f9:96:b1:a4:b6:08:a4:35:b1:26:67:8c:8a:d2:a1:c0:14:c2:18:db:e2:2e:53:f7:40:e0:2e
Signer

Actual PE Digest

60:52:b7:c6:7b:f9:96:b1:a4:b6:08:a4:35:b1:26:67:8c:8a:d2:a1:c0:14:c2:18:db:e2:2e:53:f7:40:e0:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\skillbrains\lightshot-windows-app\Screenshot\StandAloneApp\Release\curl_uploader.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

FindResourceW
GetProcAddress
GetModuleHandleW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
CreateEventW
SetEvent
ResetEvent
GlobalFree
LoadLibraryW
FreeLibrary
SetLastError
GetCurrentProcess
GetModuleFileNameW
FindClose
MultiByteToWideChar
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
DeleteFileW
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
LoadLibraryExW
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadResource
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
FindFirstFileExA
LCMapStringW
GetStringTypeW
GetFileType
GetStdHandle
GetACP
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
QueryPerformanceFrequency
InterlockedFlushSList
RtlUnwind
FindNextFileA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FindResourceExW
LockResource
GetCurrentThreadId
CreateFileW
WriteFile
SizeofResource
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
CreateThread
RaiseException
CloseHandle
HeapReAlloc
TerminateThread
GetLastError
HeapSize
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
HeapFree
SetFilePointerEx
FlushFileBuffers
WriteConsoleW
InitializeSListHead
GetConsoleMode
GetConsoleCP
SetStdHandle
FreeEnvironmentStringsW

user32

CharNextW
KillTimer
SetTimer
FlashWindow
SetWindowPos
SetFocus
PostMessageW
MessageBoxW
GetWindowLongW
GetWindowTextLengthW
GetWindowTextW
SystemParametersInfoW
SetWindowTextW
MoveWindow
GetDlgItem
GetDC
GetMessageW
DestroyWindow
ShowWindow
DispatchMessageW
IsDialogMessageW
TranslateMessage
SetWindowLongW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ReleaseDC
GetSystemMetrics
GetWindowDC
SendMessageW
FindWindowW
UnregisterClassW
CreateDialogParamW

advapi32

RegDeleteKeyW
RegEnumKeyExW
CryptDestroyKey
CryptEncrypt
CryptDecrypt
CryptSetKeyParam
CryptImportKey
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegQueryInfoKeyW

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
StringFromGUID2
CoCreateGuid
CoTaskMemFree

shell32

ShellExecuteW

oleaut32

VarUI4FromStr
SysFreeString
SysAllocString

shlwapi

PathAddBackslashW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW

gdi32

GetDeviceCaps

wininet

InternetQueryOptionW

Exports

Exports

SetLocaleString
UploadImage

Sections

.text
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8e55ea89e532d567e141d1a61186f294

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

c9:34:23:ce:0c:60:66:67Certificate

Extended Key Usages

Key Usages

4e:3f:00:ce:85:7a:2a:56:69:b5:87:89:a1:67:b2:fc:df:98:2e:e6:d3:4a:06:34:8e:11:9e:cd:b1:47:7d:72Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

d3d11

dxgi

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 51KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 2KB - Virtual size: 5KB

.gfids Size: 512B - Virtual size: 216B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

6a76fa6ec8daa78854b0e42a457b5f9e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

c9:34:23:ce:0c:60:66:67Certificate

Extended Key Usages

Key Usages

0d:2d:69:7f:6c:bf:47:69:d9:4f:2f:1d:57:b5:a2:f7:48:24:17:9d:f6:bf:5c:1d:20:7d:40:59:b6:eb:71:c5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

Exports

Exports

Sections

.text Size: 167KB - Virtual size: 166KB

.rdata Size: 51KB - Virtual size: 51KB

.data Size: 5KB - Virtual size: 9KB

.gfids Size: 512B - Virtual size: 276B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 247KB - Virtual size: 246KB

.reloc Size: 11KB - Virtual size: 11KB

7f737654202df3caad6fbc2347630fdc

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07
Certificate

c9:34:23:ce:0c:60:66:67
Certificate

4e:3f:00:ce:85:7a:2a:56:69:b5:87:89:a1:67:b2:fc:df:98:2e:e6:d3:4a:06:34:8e:11:9e:cd:b1:47:7d:72
Signer

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 2KB - Virtual size: 5KB

.gfids
Size: 512B - Virtual size: 216B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07
Certificate

c9:34:23:ce:0c:60:66:67
Certificate

0d:2d:69:7f:6c:bf:47:69:d9:4f:2f:1d:57:b5:a2:f7:48:24:17:9d:f6:bf:5c:1d:20:7d:40:59:b6:eb:71:c5
Signer

.text
Size: 167KB - Virtual size: 166KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 5KB - Virtual size: 9KB

.gfids
Size: 512B - Virtual size: 276B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 247KB - Virtual size: 246KB

.reloc
Size: 11KB - Virtual size: 11KB

.text
Size: 214KB - Virtual size: 213KB

.rdata
Size: 54KB - Virtual size: 53KB

.data
Size: 6KB - Virtual size: 9KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 9KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07
Certificate

c9:34:23:ce:0c:60:66:67
Certificate

c3:fc:67:ca:51:64:9a:12:d3:21:53:24:a7:c3:2f:99:d2:65:bd:2d:9f:8a:30:54:6a:18:a4:10:53:5b:54:5c
Signer

.text
Size: 226KB - Virtual size: 225KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 6KB - Virtual size: 9KB

.gfids
Size: 512B - Virtual size: 308B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 172KB - Virtual size: 171KB

.reloc
Size: 13KB - Virtual size: 13KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07
Certificate

c9:34:23:ce:0c:60:66:67
Certificate