DesktopOK[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

DesktopOK.exe
Size

858KB
MD5

dd1cc2380333b8433dcc20af264adaea
SHA1

602e47298160fe681251c0a209780117240d7ae7
SHA256

8264ed31a727bcc5724b4d78dc979828abd5d40d52d03af97ac3f3aa4d830d28
SHA512

65e3103f974ea261a0ed9e74a3b9cc025d30cf7b800d039b96e137dbaaa6bcd36fefcb6530c35ba887e374954264a4f436b014c307a41e74df5d580f48a38621
SSDEEP

12288:Y974pBYaNEB4fswn9SQFagbnCatdxmzWvCNjuXQ9YZH8vgNUB4gM79yk:Y96YiW4fn9XFvr5v0oj8zq79F

Score

1^/10

Malware Config

Signatures

Files

DesktopOK.exe
.exe windows:4 windows x86 arch:x86

79deb108485263c702fce28883598d47

Code Sign

81:4e:42:3e:c4:8e:b1:e0:d2:fd:e2:e3:00:1d:34:80
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

19/06/2024, 03:25

Not After

28/07/2038, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:86:27:71:6a:10:c6:eb:d3:64:86:32
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

24/07/2024, 05:16

Not After

27/08/2026, 09:33

Subject

SERIALNUMBER=2016,CN=Nenad Hrg,O=Nenad Hrg,STREET=Edelweissstr. 104,L=Taufkirchen,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c16737570706f727440736f6674776172656f6b2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130b546175666b69726368656e,1.3.6.1.4.1.311.60.2.1.2=#130642617965726e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b8:5d:48:fc:88:a0:e6:bb:f2:ce:78:c4:be:73:aa:02:dd:bd:dd:36:17:22:17:d6:48:12:61:88:37:e6:0f:b7
Signer

Actual PE Digest

b8:5d:48:fc:88:a0:e6:bb:f2:ce:78:c4:be:73:aa:02:dd:bd:dd:36:17:22:17:d6:48:12:61:88:37:e6:0f:b7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MulDiv
VirtualAlloc
VirtualFree
VirtualAllocEx
VirtualFreeEx
WriteProcessMemory
ReadProcessMemory
CreateProcessW
lstrcpynW
GetExitCodeProcess
ExitProcess
WaitForSingleObject
FindFirstFileW
InterlockedExchange
SetEnvironmentVariableA
GetOEMCP
GetACP
SetEndOfFile
RaiseException
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
FormatMessageW
LCMapStringW
LCMapStringA
LoadLibraryA
CompareStringW
CompareStringA
SetFilePointer
HeapSize
IsBadWritePtr
HeapCreate
GetEnvironmentVariableA
GetModuleFileNameA
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCommandLineA
GetCommandLineW
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetSystemTimeAsFileTime
TerminateProcess
RtlUnwind
GetSystemTime
HeapReAlloc
HeapAlloc
HeapFree
GetVersion
GetStartupInfoW
GetModuleHandleA
LocalFree
GlobalSize
GetCurrentDirectoryW
GetFileAttributesW
GetLogicalDriveStringsW
GetDriveTypeW
RemoveDirectoryW
SetFileAttributesW
GlobalMemoryStatus
lstrcmpiW
OpenProcess
GetWindowsDirectoryW
GetComputerNameW
CreateDirectoryW
GetUserDefaultLangID
GetPrivateProfileStringW
WritePrivateProfileStringW
GetTimeFormatW
GetDateFormatW
GetUserDefaultLCID
EnumDateFormatsW
EnumTimeFormatsW
GetLocaleInfoW
SystemTimeToFileTime
FileTimeToSystemTime
DeleteFileW
GetFileSize
ReadFile
lstrcatW
CopyFileW
CreateFileW
WriteFile
WideCharToMultiByte
GetModuleFileNameW
GlobalReAlloc
SizeofResource
FreeLibrary
GetModuleHandleW
GetVersionExA
OutputDebugStringW
HeapDestroy
CreateMutexW
GetLastError
CloseHandle
LoadLibraryW
GetProcAddress
GetLocalTime
CreateThread
Sleep
TerminateThread
GetVersionExW
GetCurrentProcessId
GetCurrentProcess
FlushInstructionCache
InitializeCriticalSection
DeleteCriticalSection
lstrcmpW
GetCurrentThreadId
GlobalLock
GlobalUnlock
EnterCriticalSection
LeaveCriticalSection
GlobalAlloc
FindResourceW
LoadResource
LockResource
GlobalHandle
GlobalFree
FreeResource
lstrcpyW
MultiByteToWideChar
lstrlenA
InterlockedDecrement
lstrlenW
GetTempPathW
InterlockedIncrement
GetCPInfo
GetTimeZoneInformation

user32

SetDlgItemInt
RegisterClipboardFormatW
EmptyClipboard
MoveWindow
LoadIconW
GetForegroundWindow
IsZoomed
SetWindowPlacement
EnableMenuItem
DrawIconEx
GetClassLongW
GetSystemMenu
InsertMenuW
DeleteMenu
CheckMenuItem
EnableWindow
SetActiveWindow
SetForegroundWindow
CascadeWindows
TileWindows
GetCursor
GetAsyncKeyState
DialogBoxParamW
LoadMenuW
EnumDisplaySettingsW
FindWindowW
CopyIcon
SetCursor
keybd_event
SendDlgItemMessageW
SetDlgItemTextW
EnumDisplayMonitors
CopyRect
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
ClientToScreen
GetDlgItem
GetParent
EndDialog
SetWindowPos
MapWindowPoints
GetWindowPlacement
FindWindowExW
EnumChildWindows
CreatePopupMenu
AppendMenuW
GetCursorPos
TrackPopupMenu
CreateDialogParamW
EnumWindows
GetMessageW
TranslateMessage
DispatchMessageW
MessageBoxW
SetRect
SendMessageTimeoutW
LoadStringW
SwitchDesktop
CreateDesktopW
OpenDesktopW
GetUserObjectInformationW
GetDlgItemInt
GetDlgItemTextW
DrawAnimatedRects
GetKeyboardState
SetCursorPos
SetPropW
GetThreadDesktop
GetClientRect
SystemParametersInfoW
GetWindowRect
GetWindow
GetWindowLongW
SendMessageW
ReleaseDC
GetDC
LoadBitmapW
ShowWindow
KillTimer
IsRectEmpty
RedrawWindow
SetTimer
SetWindowLongW
SetParent
SetWindowTextW
MonitorFromPoint
GetMonitorInfoW
TrackPopupMenuEx
ModifyMenuW
OffsetRect
GetSysColorBrush
GetSubMenu
PeekMessageW
PtInRect
CallNextHookEx
GetSystemMetrics
GetWindowDC
DrawTextW
GetMessagePos
WindowFromPoint
ScreenToClient
UpdateWindow
GetKeyState
GetActiveWindow
GetWindowThreadProcessId
CharLowerW
LoadImageW
PostQuitMessage
IsDialogMessageW
IsChild
GetFocus
CreateDialogIndirectParamW
RegisterClassExW
LoadCursorW
GetClassInfoExW
RegisterWindowMessageW
DefWindowProcW
GetWindowTextW
GetWindowTextLengthW
GetSysColor
SetFocus
CallWindowProcW
EndPaint
FillRect
BeginPaint
IsWindow
GetDesktopWindow
CreateAcceleratorTableW
ReleaseCapture
SetCapture
InvalidateRect
InvalidateRgn
DestroyWindow
GetClassNameW
wsprintfW
CreateWindowExW
CharNextW
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
MessageBeep
PostMessageW
UnhookWindowsHookEx
SetWindowsHookExW
IsWindowVisible
DestroyMenu

gdi32

SetDIBitsToDevice
SetStretchBltMode
StretchBlt
Rectangle
GetCurrentObject
GetPixel
CreatePen
SetROP2
RestoreDC
SaveDC
GetTextExtentPointW
Ellipse
OffsetWindowOrgEx
MoveToEx
LineTo
CreateBitmap
CreatePatternBrush
SetTextColor
SetBkMode
GetStockObject
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
GetObjectW
CreateDIBSection
CreateCompatibleDC
SelectObject
SetBkColor
ExtTextOutW
CreateDCW
CreateEnhMetaFileW
CloseEnhMetaFile
SelectPalette
RealizePalette
GetClipBox
GetDIBits
SetPixel
DeleteObject
PatBlt
CreateFontIndirectW
BitBlt
DeleteDC

comdlg32

ChooseColorW
ChooseFontW
GetSaveFileNameW
GetOpenFileNameW

advapi32

RegDeleteValueW
CryptCreateHash
CryptAcquireContextW
CryptDestroyHash
CryptReleaseContext
CryptHashData
CryptGetHashParam
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyW
GetTokenInformation
RegEnumKeyExW
RegDeleteKeyW
GetUserNameW
OpenProcessToken
RegQueryValueExW

shell32

SHGetMalloc
SHGetFileInfoW
ord25
SHFileOperationW
SHGetDesktopFolder
SHGetSpecialFolderLocation
ord155
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHGetSettings
ShellExecuteExW
Shell_NotifyIconW
ShellExecuteW
SHAppBarMessage

ole32

CoSetProxyBlanket
OleLockRunning
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoInitialize
ReleaseStgMedium
CoInitializeSecurity
CoInitializeEx
CoUninitialize

oleaut32

SysAllocStringLen
SysAllocString
VariantClear
SysStringLen
OleCreateFontIndirect
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
VariantInit
SafeArrayDestroy
DispCallFunc
VarRound
SysFreeString

comctl32

ImageList_GetImageCount
ImageList_Draw
InitCommonControlsEx
ord17
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Create
ImageList_LoadImageW

gdiplus

GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateHICONFromBitmap
GdipDisposeImage
GdipFree
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromScan0
GdiplusStartup
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipGetImageHeight

winmm

mixerClose
mixerGetNumDevs
waveOutOpen
mixerGetID
waveOutClose
PlaySoundW
timeGetTime
mixerOpen
mixerGetLineInfoW
mixerGetLineControlsW
mixerGetControlDetailsW
mixerSetControlDetails

Sections

.text
Size: 328KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 300KB - Virtual size: 486KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79deb108485263c702fce28883598d47

Code Sign

81:4e:42:3e:c4:8e:b1:e0:d2:fd:e2:e3:00:1d:34:80Certificate

Extended Key Usages

Key Usages

68:86:27:71:6a:10:c6:eb:d3:64:86:32Certificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

b8:5d:48:fc:88:a0:e6:bb:f2:ce:78:c4:be:73:aa:02:dd:bd:dd:36:17:22:17:d6:48:12:61:88:37:e6:0f:b7Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

gdiplus

winmm

Sections

.text Size: 328KB - Virtual size: 325KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 300KB - Virtual size: 486KB

.rsrc Size: 196KB - Virtual size: 195KB

81:4e:42:3e:c4:8e:b1:e0:d2:fd:e2:e3:00:1d:34:80
Certificate

68:86:27:71:6a:10:c6:eb:d3:64:86:32
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

b8:5d:48:fc:88:a0:e6:bb:f2:ce:78:c4:be:73:aa:02:dd:bd:dd:36:17:22:17:d6:48:12:61:88:37:e6:0f:b7
Signer

.text
Size: 328KB - Virtual size: 325KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 300KB - Virtual size: 486KB

.rsrc
Size: 196KB - Virtual size: 195KB