3475514de962e1f5414df41e76ad2ffa902363407426ccc3271ade8e5262ccaa

Sharing

Copy URL Twitter E-mail

General

Target

3475514de962e1f5414df41e76ad2ffa902363407426ccc3271ade8e5262ccaa
Size

1.5MB
MD5

228a51ce51864e7e02052b5fb8381bff
SHA1

3c3215fe07624255e30113eb54a4c868b09d90c6
SHA256

3475514de962e1f5414df41e76ad2ffa902363407426ccc3271ade8e5262ccaa
SHA512

49fec1fa2ceef9ebad442e32d5cb9796249c22c8b19560cba2f8aecbb5317f5e0268b64d8d1e1dcfda7a1dc0d28eeda8cc48bbff5be4ce317dd7f6b381a6fb71
SSDEEP

24576:RYu0VFs/tcwMAGJF4Ml3oWuI3IhTk0GNaIr8IcyNw5hOicQl/IZlw:RYuJGJWMl4WT3STlGNdIIQD/EK

Score

1^/10

Malware Config

Signatures

Files

3475514de962e1f5414df41e76ad2ffa902363407426ccc3271ade8e5262ccaa
.exe windows:4 windows x86 arch:x86

1f5a529b7eacb21529f1300d187a1c90

Code Sign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3b:b9:14:cd:97:c4:c5:9c:8d:76:dd:dc:15:90:ff:58
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

16/11/2022, 13:28

Not After

15/11/2025, 13:28

Subject

CN=沈阳元微科技有限公司,O=沈阳元微科技有限公司,L=沈阳市,ST=辽宁省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dc:04:86:aa:6c:48:d7:71:8e:3a:0f:ab:40:3d:bf:be:49:71:d4:2a:db:0f:5e:36:36:c6:f0:b0:d0:42:fa:6e
Signer

Actual PE Digest

dc:04:86:aa:6c:48:d7:71:8e:3a:0f:ab:40:3d:bf:be:49:71:d4:2a:db:0f:5e:36:36:c6:f0:b0:d0:42:fa:6e

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
QueryDosDeviceW
IsBadWritePtr
HeapAlloc
GetProcessHeap
HeapFree
GetFileSizeEx
FileTimeToSystemTime
GetComputerNameA
GetSystemDirectoryW
GetDiskFreeSpaceExW
InterlockedCompareExchange
GetCurrentThread
VirtualFree
VirtualAlloc
VirtualProtect
ResumeThread
GetThreadContext
SetThreadContext
VirtualQuery
OpenMutexW
VerifyVersionInfoW
VerSetConditionMask
OpenEventW
TerminateProcess
WaitNamedPipeW
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
CreateDirectoryW
RemoveDirectoryW
OutputDebugStringA
FileTimeToLocalFileTime
GetFileTime
SetEndOfFile
SetFilePointerEx
Module32FirstW
TerminateThread
CreateThread
GetLogicalDriveStringsW
SetFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
GetExitCodeThread
FreeResource
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
QueryPerformanceCounter
GetCommandLineA
SystemTimeToFileTime
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
GetStdHandle
HeapCreate
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetStartupInfoW
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetThreadLocale
GetACP
IsProcessorFeaturePresent
LoadLibraryA
GetVersionExA
HeapSize
HeapReAlloc
HeapDestroy
GetLocaleInfoA
GetFileSize
MoveFileExW
CloseHandle
WaitForSingleObject
CreateProcessW
ReadFile
CreateFileW
WritePrivateProfileStringW
GetWindowsDirectoryW
GetTickCount
InterlockedExchange
lstrlenA
EnterCriticalSection
GetPrivateProfileStringW
DeleteCriticalSection
GetCurrentThreadId
GetLastError
MultiByteToWideChar
lstrlenW
FindResourceExW
GetPrivateProfileIntW
LoadResource
FlushInstructionCache
LockResource
GetCurrentProcess
OutputDebugStringW
SizeofResource
InitializeCriticalSection
LeaveCriticalSection
FindResourceW
GetModuleFileNameW
WideCharToMultiByte
GetModuleHandleW
FreeLibrary
InterlockedIncrement
GetVersionExW
SetLastError
LoadLibraryW
InterlockedDecrement
RaiseException
lstrcmpW
MulDiv
ReadProcessMemory
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
GetModuleFileNameA
SetFilePointer
CreateFileA
LocalAlloc
ReleaseMutex
CreateMutexW
LoadLibraryExW
ExitProcess
lstrcmpiW
FlushFileBuffers
WriteFile
LocalFree
ResetEvent
WaitForMultipleObjects
SetEvent
CopyFileW
Sleep
FindNextFileW
GlobalAlloc
GlobalLock
DeleteFileW
GlobalUnlock
GlobalFree
GetTempPathW
GetCommandLineW
OpenProcess
ProcessIdToSessionId
CreateEventW
GetFileAttributesW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
FindClose
GetEnvironmentStringsW
FindFirstFileW
GetProcAddress
GetLocalTime
GetModuleHandleA

user32

IsIconic
IntersectRect
SetCapture
LoadIconW
UnregisterClassA
EqualRect
SetTimer
GetDlgCtrlID
MoveWindow
CallWindowProcW
DestroyIcon
GetMonitorInfoW
ShowWindow
MonitorFromWindow
CreateWindowExW
GetDlgItem
GetClassNameW
SendMessageTimeoutW
GetSystemMetrics
EnumDisplayDevicesW
EnumDisplaySettingsW
DestroyAcceleratorTable
GetWindowTextLengthW
RedrawWindow
GetWindowTextW
InvalidateRgn
FillRect
CreateAcceleratorTableW
GetSysColor
GetWindowRect
SetForegroundWindow
GetActiveWindow
IsWindowEnabled
EnableWindow
GetWindowThreadProcessId
GetForegroundWindow
AttachThreadInput
SetActiveWindow
SetWindowTextW
PostThreadMessageW
LoadBitmapW
CreatePopupMenu
DestroyMenu
TrackPopupMenu
DrawFrameControl
IsWindowVisible
LoadImageW
wsprintfW
KillTimer
GetCursorPos
RegisterClassExW
SetWindowPos
InvalidateRect
ReleaseDC
PostMessageW
DrawTextW
GetDesktopWindow
GetClassInfoExW
GetDC
EndPaint
ClientToScreen
GetClientRect
BeginPaint
LoadCursorW
DestroyWindow
OffsetRect
FindWindowW
RegisterWindowMessageW
ScreenToClient
MapWindowPoints
CopyRect
DispatchMessageW
SystemParametersInfoW
DrawIconEx
PtInRect
TranslateMessage
GetWindow
IsDialogMessageW
IsRectEmpty
SendMessageW
SetWindowLongW
GetNextDlgTabItem
GetParent
IsChild
GetWindowLongW
SetCursor
UpdateLayeredWindow
GetFocus
DefWindowProcW
InflateRect
GetMessageW
SetFocus
IsWindow
SetRect
SetRectEmpty
WindowFromPoint
GetShellWindow
PeekMessageW
ReleaseCapture
AppendMenuW
MonitorFromPoint
PostQuitMessage
CharNextW
FindWindowExW

gdi32

CreateFontIndirectW
SelectObject
ExtTextOutW
SetTextColor
SetBkColor
SetBkMode
BitBlt
GetTextExtentPoint32W
DeleteObject
OffsetRgn
CreateRoundRectRgn
GetViewportOrgEx
CreateCompatibleDC
CreatePen
ExtSelectClipRgn
SetViewportOrgEx
RoundRect
CreateBitmap
LineTo
CreateRectRgnIndirect
GetTextColor
CreateRectRgn
GetClipRgn
TextOutW
CombineRgn
GetObjectW
GetDeviceCaps
GetStockObject
SelectClipRgn
RectInRegion
DeleteDC
RestoreDC
GetCurrentObject
CreateDIBSection
SaveDC
Rectangle
CreateCompatibleBitmap
StretchBlt
SetStretchBltMode
MoveToEx
CreateSolidBrush

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenCurrentUser
OpenProcessToken
RevertToSelf
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExA
RegQueryValueExA
GetUserNameW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyW
OpenSCManagerW
CloseServiceHandle
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenServiceW
QueryServiceStatusEx
SetEntriesInAclW
GetTokenInformation
DuplicateTokenEx
GetNamedSecurityInfoW
GetAce
DeleteAce
BuildExplicitAccessWithNameW
SetNamedSecurityInfoW
QueryServiceConfigW
ChangeServiceConfigW
CreateProcessAsUserW
ImpersonateLoggedOnUser

shell32

CommandLineToArgvW
SHCreateDirectoryExW
SHQueryRecycleBinW
SHGetPathFromIDListW
SHFileOperationW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHBindToParent
Shell_NotifyIconW
ShellExecuteW

ole32

CoCreateGuid
CoGetClassObject
CLSIDFromProgID
OleUninitialize
OleInitialize
StringFromGUID2
OleLockRunning
CLSIDFromString
CoUninitialize
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
CreateStreamOnHGlobal

oleaut32

SysAllocStringLen
OleCreateFontIndirect
LoadRegTypeLi
VariantClear
LoadTypeLi
SysStringLen
VariantInit
DispCallFunc
SysStringByteLen
VarUI4FromStr
SysFreeString
SysAllocString

shlwapi

PathFileExistsW
PathRemoveFileSpecW
StrToIntA
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
StrRetToBufW
PathAppendW
StrToIntW

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipCreateHBITMAPFromBitmap
GdipDrawImagePointsRectI
GdipGetImagePixelFormat
GdipLoadImageFromStream
GdipCloneBitmapArea
GdipImageRotateFlip
GdipFillRectangleI
GdipCreateStringFormat
GdipGetImageGraphicsContext
GdipDrawLinesI
GdipCreateLineBrushFromRectWithAngleI
GdipDeleteStringFormat
GdipSetInterpolationMode
GdipCreateBitmapFromStream
GdipDrawPath
GdipSetPixelOffsetMode
GdipTranslateWorldTransform
GdipSetStringFormatFlags
GdipDeletePath
GdipGetFamily
GdipAddPathPieI
GdipAddPathStringI
GdipSetStringFormatTrimming
GdipClosePathFigure
GdipSetPenDashStyle
GdipSetPenEndCap
GdipFillPath
GdipGetFontSize
GdipDrawImageRectRectI
GdipCreatePath
GdipAddPathArcI
GdipRotateWorldTransform
GdipSetStringFormatAlign
GdipResetWorldTransform
GdipSetStringFormatLineAlign
GdipSetPenStartCap
GdipSetTextRenderingHint
GdipGraphicsClear
GdipSetPenMode
GdipFree
GdipDrawString
GdipGetImageHeight
GdipDrawImageRectI
GdipAddPathRectangleI
GdipCloneBrush
GdipGetImageWidth
GdipDrawImageI
GdipDrawLine
GdipFillRectangle
GdipCreateImageAttributes
GdipAlloc
GdipCreateFont
GdipMeasureString
GdipDisposeImageAttributes
GdipDisposeImage
GdipDeleteBrush
GdipDrawRectangleI
GdipNewPrivateFontCollection
GdipSetSmoothingMode
GdipCloneImage
GdipCreateFromHDC
GdipDeletePrivateFontCollection
GdipSetClipPath
GdipSetCompositingQuality
GdipDeleteFont
GdipLoadImageFromFile
GdipDeleteGraphics
GdipPrivateAddFontFile
GdipCreateFontFromLogfontW
GdipSetImageAttributesColorMatrix
GdipCreatePen1
GdiplusShutdown
GdipGetFontCollectionFamilyCount
GdipCreateSolidFill
GdipGetFontCollectionFamilyList
GdipDeleteFontFamily
GdipCloneFontFamily
GdipDeletePen
GdiplusStartup
GdipCreateBitmapFromScan0
GdipDrawImageRectRect

ws2_32

ioctlsocket
select
__WSAFDIsSet
getaddrinfo
freeaddrinfo
WSASetLastError
socket
connect
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
WSACleanup
WSAStartup
closesocket
WSAGetLastError
recv

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

userenv

UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 304KB - Virtual size: 301KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1f5a529b7eacb21529f1300d187a1c90

Code Sign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

3b:b9:14:cd:97:c4:c5:9c:8d:76:dd:dc:15:90:ff:58Certificate

Extended Key Usages

Key Usages

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

dc:04:86:aa:6c:48:d7:71:8e:3a:0f:ab:40:3d:bf:be:49:71:d4:2a:db:0f:5e:36:36:c6:f0:b0:d0:42:fa:6eSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

ws2_32

version

psapi

wtsapi32

userenv

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 304KB - Virtual size: 301KB

.data Size: 28KB - Virtual size: 35KB

.rsrc Size: 12KB - Virtual size: 11KB

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

3b:b9:14:cd:97:c4:c5:9c:8d:76:dd:dc:15:90:ff:58
Certificate

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

dc:04:86:aa:6c:48:d7:71:8e:3a:0f:ab:40:3d:bf:be:49:71:d4:2a:db:0f:5e:36:36:c6:f0:b0:d0:42:fa:6e
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 304KB - Virtual size: 301KB

.data
Size: 28KB - Virtual size: 35KB

.rsrc
Size: 12KB - Virtual size: 11KB