Windscribe_2[.]4[.]exe

Resubmissions

09/10/2024, 15:44

241009-s6jspsyarp 10

09/10/2024, 15:41

241009-s42whayaqk 3

Sharing

Copy URL Twitter E-mail

General

Target

Windscribe_2.4.exe
Size

18.2MB
MD5

93f3733adab15b441472dcd88a8c22b6
SHA1

c1b743648784d5b633b08ecd5ad6fce764711d5c
SHA256

4f222f9377b00e7c9b05d64d5e92a3cdb9fbff1b3eee88078eda6114b4aa80b0
SHA512

4544817365d468a7e7e10992612e590c9313a027c13f4a0586b6e09f3468d306de507b8d030ed5ffba85c58b1ca7e0c34d13dfc966c90884d0b32e62eff0d394
SSDEEP

393216:KLPrkfv3zI+/YfhQX79C/+P0sXgtal2GwtuQwNCmug9z5sa:KLTgMOYf+X79CmP0s/pQwN3tsa

Score

1^/10

Malware Config

Signatures

Files

Windscribe_2.4.exe
.exe windows:6 windows x86 arch:x86

0e30b3af7146cf176d6a60c4234d4aa6

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:5e:e4:3b:ee:a5:0e:d5:f0:ec:76:5b:f6:5b:13:50
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/02/2021, 00:00

Not After

05/03/2024, 23:59

Subject

CN=Windscribe Limited,O=Windscribe Limited,L=Richmond Hill,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

8f:59:7b:42:88:a3:89:8b:81:63:12:4e:a8:bf:b3:55:f9:0a:5b:b0
Signer

Actual PE Digest

8f:59:7b:42:88:a3:89:8b:81:63:12:4e:a8:bf:b3:55:f9:0a:5b:b0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\ws-user\Downloads\builds\Yaf9kHcX\0\ws\client\desktop\client-desktop-public\temp\installer\installer\windows\installer\release-32\installer.pdb

Imports

kernel32

GetSystemWow64DirectoryW
lstrlenW
lstrcmpiW
lstrcmpW
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
WaitForSingleObject
OpenProcess
FindFirstFileW
FindNextFileW
FindClose
GetLocalTime
SetConsoleCtrlHandler
GetCommandLineW
GetSystemDirectoryW
OutputDebugStringW
CopyFileW
GetFullPathNameW
CreateProcessW
GetExitCodeProcess
CreateDirectoryW
SetLastError
WriteConsoleW
SetEndOfFile
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetTickCount
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
FlushFileBuffers
HeapReAlloc
GetFileSizeEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetStdHandle
ExitProcess
GetModuleHandleExW
ExitThread
ReadFile
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameW
Sleep
MoveFileExW
CloseHandle
DeleteFileW
CreateFileW
GetTempPathW
WriteFile
FreeLibrary
GetProcAddress
GlobalFree
LoadLibraryW
GlobalUnlock
GlobalLock
GlobalAlloc
GetLastError
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
FreeResource
SizeofResource
AreFileApisANSI
GetOEMCP
GetFileAttributesW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetStringTypeW
MultiByteToWideChar
GetExitCodeThread
GetCurrentThread
SwitchToThread
GetCurrentProcess
WaitForSingleObjectEx
DuplicateHandle
GetCurrentThreadId
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection

user32

GetWindowInfo
ShowWindow
GetSystemMetrics
SetWindowRgn
MonitorFromWindow
MessageBoxW
EqualRect
SetCursor
SetCapture
SendMessageW
ClientToScreen
DefWindowProcW
GetWindowRect
GetMonitorInfoW
SetWindowPos
DestroyWindow
GetWindowLongW
GetWindowTextW
RedrawWindow
SetWindowTextW
RegisterWindowMessageW
FindWindowW
AdjustWindowRect
PtInRect
LoadIconW
ScreenToClient
SetWindowLongW
IsZoomed
PostQuitMessage
UpdateWindow
ReleaseCapture
InvalidateRect
KillTimer
SetTimer
GetClientRect
ReleaseDC
BeginPaint
EndPaint
GetMessageW
LoadCursorW
PostMessageW
DispatchMessageW
TranslateMessage
GetDC
RegisterClassExW
TrackMouseEvent
CreateWindowExW

gdi32

SetTextColor
SetBkMode
CreateRectRgnIndirect
AddFontMemResourceEx
DeleteObject
CreateFontIndirectW
CreateCompatibleDC
GetDeviceCaps
DeleteDC
GetStockObject

advapi32

CloseServiceHandle
OpenSCManagerW
ControlService
OpenServiceW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey

shell32

SHGetKnownFolderPath
CommandLineToArgvW
SHChangeNotify
SHCreateDirectoryExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHAppBarMessage
ShellExecuteW
SHGetMalloc
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitialize
CreateStreamOnHGlobal
CoInitializeEx

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

gdiplus

GdipAlloc
GdipCloneImage
GdipSetImageAttributesColorMatrix
GdipGetImageHeight
GdipDeleteStringFormat
GdipDrawImage
GdipCloneBrush
GdipDrawString
GdiplusShutdown
GdipCreateFromHDC
GdipFillRectangle
GdipDisposeImage
GdipFillPath
GdipCreateSolidFill
GdipSetStringFormatLineAlign
GdipCreatePath
GdipDeletePath
GdipDeleteBrush
GdipAddPathArcI
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipGetImageWidth
GdipCreateBitmapFromScan0
GdipDrawImageRectRectI
GdipDisposeImageAttributes
GdipSetSmoothingMode
GdipAddPathLineI
GdipFree
GdipClosePathFigure
GdiplusStartup
GdipMeasureString
GdipDrawImageRectI
GdipLoadImageFromStream
GdipFillRectangleI
GdipDrawArcI
GdipDeletePen
GdipCreatePen1
GdipDeleteFontFamily
GdipCreateFont
GdipGetFontCollectionFamilyList
GdipDeleteFont
GdipNewPrivateFontCollection
GdipCloneFontFamily
GdipDeletePrivateFontCollection
GdipPrivateAddMemoryFont
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipDrawImageI
GdipCreateImageAttributes

shlwapi

PathAppendW
PathRemoveBackslashW
PathIsDirectoryEmptyW

uxtheme

IsThemeActive

dwmapi

DwmSetWindowAttribute
DwmExtendFrameIntoClientArea
DwmIsCompositionEnabled

wininet

InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetReadFile
HttpQueryInfoA

setupapi

InstallHinfSectionW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiSetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

Sections

.text
Size: 518KB - Virtual size: 517KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17.5MB - Virtual size: 17.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

0e30b3af7146cf176d6a60c4234d4aa6

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0f:5e:e4:3b:ee:a5:0e:d5:f0:ec:76:5b:f6:5b:13:50Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

8f:59:7b:42:88:a3:89:8b:81:63:12:4e:a8:bf:b3:55:f9:0a:5b:b0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

uxtheme

dwmapi

wininet

setupapi

Sections

.text Size: 518KB - Virtual size: 517KB

.rdata Size: 137KB - Virtual size: 136KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 17.5MB - Virtual size: 17.5MB

.reloc Size: 27KB - Virtual size: 26KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0f:5e:e4:3b:ee:a5:0e:d5:f0:ec:76:5b:f6:5b:13:50
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

8f:59:7b:42:88:a3:89:8b:81:63:12:4e:a8:bf:b3:55:f9:0a:5b:b0
Signer

.text
Size: 518KB - Virtual size: 517KB

.rdata
Size: 137KB - Virtual size: 136KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 17.5MB - Virtual size: 17.5MB

.reloc
Size: 27KB - Virtual size: 26KB