mimikatz | 53b78fa733ae10dd1f2f066f12523cb3_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

53b78fa733ae10dd1f2f066f12523cb3_JaffaCakes118
Size

904KB
MD5

53b78fa733ae10dd1f2f066f12523cb3
SHA1

ebabab9c5b723df0fde7fe02dc22145e39ba0502
SHA256

d19bf611356d319e792ac04e4bc986aa01c8282d942e9de0ae568b0a7d15dc24
SHA512

e95b83e99414159a7ad4bf8bfb3702e0504744b744f157ff4355108e2490b1ccdf9ab0b136197d86f4560a69699d6ec61e8073aa6267b9a750f23096edd54ee4
SSDEEP

24576:Ig2RaZQf/7pQLzMAssYp4iubjlM6rlzd5oQ/mxhG:cRaWYui26rhdyQ/mq

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 6 IoCs

resource	yara_rule
static1/unpack001/Win32/mimidrv.sys	mimikatz
static1/unpack001/Win32/mimikatz.exe	mimikatz
static1/unpack001/Win32/mimilib.dll	mimikatz
static1/unpack001/x64/mimidrv.sys	mimikatz
static1/unpack001/x64/mimikatz.exe	mimikatz
static1/unpack001/x64/mimilib.dll	mimikatz

Files

53b78fa733ae10dd1f2f066f12523cb3_JaffaCakes118
.zip
README.md
Win32/mimidrv.sys
.sys windows:6 windows x86 arch:x86

25862203800205f80fd8b3a6634ea1c6

Code Sign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:69:41:7a:1c:3e:f4:6a:30:1f:99:38:5f:50:68:0f:a0
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

28-06-2011 09:46

Not After

28-06-2014 09:46

Subject

CN=Benjamin Delpy,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0b:7f:6b:00:00:00:00:00:19
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:00

Not After

23-05-2016 17:10

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f7:73:bc:fc:7e:ae:8a:1c:1b:90:c7:75:f1:fb:63:c7:a6:40:31:c3
Signer

Actual PE Digest

f7:73:bc:fc:7e:ae:8a:1c:1b:90:c7:75:f1:fb:63:c7:a6:40:31:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\security\mimikatz\mimidrv\objfre_wnet_x86\i386\mimidrv.pdb

Imports

ntoskrnl.exe

NtBuildNumber
IofCompleteRequest
KeBugCheck
IoCreateSymbolicLink
IoCreateDevice
PsInitialSystemProcess
ObfDereferenceObject
PsLookupProcessByProcessId
PsGetProcessImageFileName
PsGetProcessId
ZwClose
ZwSetInformationProcess
ZwDuplicateToken
ObOpenObjectByPointer
PsProcessType
RtlInitUnicodeString
PsReferencePrimaryToken
IoGetCurrentProcess
RtlCompareMemory
ZwOpenProcessTokenEx
ExFreePoolWithTag
ExAllocatePoolWithTag
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
memcpy
KeServiceDescriptorTable
IoEnumerateRegisteredFiltersList
KeTickCount
MmGetSystemRoutineAddress
IoDeleteSymbolicLink
IoDeleteDevice
memset
PsDereferencePrimaryToken
_vsnwprintf
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
RtlUnwind
KeBugCheckEx

fltmgr.sys

FltGetFilterInformation
FltEnumerateInstances
FltGetVolumeFromInstance
FltObjectDereference
FltEnumerateFilters

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1024B - Virtual size: 614B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win32/mimikatz.exe
.exe windows:5 windows x86 arch:x86

c90f45c0d58dfcf861da592a1c318252

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

05-12-2018 07:15

Not After

05-12-2019 07:15

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08-03-2016 13:10

Not After

30-05-2027 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

05-12-2018 07:15

Not After

05-12-2019 07:15

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08-03-2016 13:10

Not After

30-05-2027 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:08:a1:4b:26:3d:2c:a2:78:37:91:ea:9b:64:8d:c3:20:07:5a:f7:2d:b4:f9:1e:b7:8f:4c:59:1a:47:56:61
Signer

Actual PE Digest

02:08:a1:4b:26:3d:2c:a2:78:37:91:ea:9b:64:8d:c3:20:07:5a:f7:2d:b4:f9:1e:b7:8f:4c:59:1a:47:56:61

Digest Algorithm

sha256

PE Digest Matches

true

7b:72:16:6c:ba:be:8f:b4:26:e8:84:6c:b7:72:7e:4c:49:a4:23:e6
Signer

Actual PE Digest

7b:72:16:6c:ba:be:8f:b4:26:e8:84:6c:b7:72:7e:4c:49:a4:23:e6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptSetHashParam
CryptGetHashParam
CryptExportKey
CryptAcquireContextW
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptDuplicateKey
CryptAcquireContextA
CryptGetProvParam
CryptImportKey
SystemFunction007
CryptEncrypt
CryptCreateHash
CryptGenKey
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
CopySid
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
CreateWellKnownSid
CreateProcessWithLogonW
CreateProcessAsUserW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
SystemFunction032
ConvertSidToStringSidW
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
SetServiceObjectSecurity
OpenServiceW
BuildSecurityDescriptorW
QueryServiceObjectSecurity
StartServiceW
AllocateAndInitializeSid
QueryServiceStatusEx
FreeSid
ControlService
IsTextUnicode
OpenProcessToken
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
DuplicateTokenEx
CheckTokenMembership
CryptSetProvParam
CryptEnumProvidersW
ConvertStringSidToSidW
LsaFreeMemory
SetThreadToken
CryptEnumProviderTypesW
SystemFunction006
CryptGetUserKey
OpenEventLogW
GetNumberOfEventLogRecords
ClearEventLogW
SystemFunction001
CryptDeriveKey
SystemFunction005
LsaQueryTrustedDomainInfoByName
CryptSignHashW
LsaOpenSecret
LsaQuerySecret
SystemFunction013
LsaRetrievePrivateData
LsaEnumerateTrustedDomainsEx
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
IsValidSid
LookupPrivilegeNameW
OpenThreadToken
CredFree
CredEnumerateW
GetSidSubAuthority
GetSidSubAuthorityCount
SystemFunction025
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction024
CredIsMarshaledCredentialW
CredUnmarshalCredentialW
A_SHAFinal
A_SHAInit
A_SHAUpdate

cabinet

ord11
ord14
ord10
ord13

crypt32

CryptEncodeObject
CertEnumSystemStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertGetNameStringW
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertSetCertificateContextProperty
PFXExportCertStoreEx
CryptUnprotectData
CryptBinaryToStringW
CryptStringToBinaryW
CryptExportPublicKeyInfo
CryptAcquireCertificatePrivateKey
CertNameToStrW
CertFindCertificateInStore
CertGetCertificateContextProperty
CryptSignAndEncodeCertificate
CryptProtectData

cryptdll

MD5Init
MD5Update
MD5Final
CDLocateCSystem
CDGenerateRandomBits
CDLocateCheckSum

dnsapi

DnsFree
DnsQuery_A

fltlib

FilterFindFirst
FilterFindNext

netapi32

NetServerGetInfo
NetStatisticsGet
NetShareEnum
DsEnumerateDomainTrustsW
DsGetDcNameW
NetApiBufferFree
NetRemoteTOD
NetSessionEnum
NetWkstaUserEnum
I_NetServerAuthenticate2
I_NetServerTrustPasswordsGet
I_NetServerReqChallenge

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

VariantInit
SysFreeString
SysAllocString

rpcrt4

RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqBegin
I_RpcGetCurrentCallHandle
NdrClientCall2
RpcMgmtEpEltInqDone
RpcBindingFromStringBindingW
RpcStringBindingComposeW
MesEncodeIncrementalHandleCreate
RpcBindingSetAuthInfoExW
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcImpersonateClient
RpcBindingFree
RpcStringFreeW
RpcRevertToSelf
MesDecodeIncrementalHandleCreate
MesHandleFree
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeFree2
NdrMesTypeEncode2
RpcServerUnregisterIfEx
I_RpcBindingInqSecurityContext
RpcServerInqBindings
RpcServerListen
RpcMgmtWaitServerListen
RpcEpRegisterW
RpcMgmtStopServerListening
RpcBindingToStringBindingW
RpcServerRegisterIf2
RpcServerRegisterAuthInfoW
RpcBindingVectorFree
UuidToStringW
RpcServerUseProtseqEpW
RpcEpUnregister
NdrServerCall2
RpcEpResolveBinding
UuidCreate

shlwapi

PathIsDirectoryW
PathCanonicalizeW
PathCombineW
PathFindFileNameW
PathIsRelativeW

samlib

SamEnumerateGroupsInDomain
SamiChangePasswordUser
SamSetInformationUser
SamGetGroupsForUser
SamConnect
SamGetMembersInGroup
SamRidToSid
SamGetMembersInAlias
SamEnumerateAliasesInDomain
SamGetAliasMembership
SamOpenGroup
SamQueryInformationUser
SamCloseHandle
SamEnumerateDomainsInSamServer
SamFreeMemory
SamEnumerateUsersInDomain
SamOpenUser
SamLookupDomainInSamServer
SamLookupNamesInDomain
SamLookupIdsInDomain
SamOpenDomain
SamOpenAlias

secur32

QueryContextAttributesW
FreeContextBuffer
LsaDeregisterLogonProcess
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer
LsaCallAuthenticationPackage
LsaConnectUntrusted
FreeCredentialsHandle
EnumerateSecurityPackagesW
AcquireCredentialsHandleW
InitializeSecurityContextW
DeleteSecurityContext

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW
GetKeyboardLayout
DispatchMessageW
DefWindowProcW
SetClipboardViewer
SendMessageW
GetClipboardSequenceNumber
OpenClipboard
CreateWindowExW
ChangeClipboardChain
GetClipboardData
RegisterClassExW
TranslateMessage
EnumClipboardFormats
PostMessageW
UnregisterClassW
GetMessageW
CloseClipboard
DestroyWindow

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

hid

HidD_GetAttributes
HidD_GetHidGuid
HidD_GetPreparsedData
HidD_GetFeature
HidP_GetCaps
HidD_FreePreparsedData
HidD_SetFeature

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

winscard

SCardControl
SCardTransmit
SCardDisconnect
SCardGetAttrib
SCardEstablishContext
SCardFreeMemory
SCardListReadersW
SCardReleaseContext
SCardGetCardTypeProviderNameW
SCardListCardsW
SCardConnectW

winsta

WinStationCloseServer
WinStationOpenServerW
WinStationFreeMemory
WinStationConnectW
WinStationQueryInformationW
WinStationEnumerateW

wldap32

ord203
ord140
ord122
ord14
ord157
ord88
ord133
ord27
ord147
ord167
ord127
ord96
ord304
ord309
ord54
ord142
ord77
ord13
ord208
ord145
ord36
ord79
ord41
ord73
ord310
ord139
ord97
ord223
ord12
ord113
ord301
ord224
ord26
ord69

msasn1

ASN1_CreateModule
ASN1BERDotVal2Eoid
ASN1_CloseEncoder
ASN1_CreateDecoder
ASN1_FreeEncoded
ASN1_CloseModule
ASN1_CreateEncoder
ASN1_CloseDecoder

ntdll

RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlDowncaseUnicodeString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlEqualUnicodeString
NtQueryObject
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
NtQuerySystemInformation
RtlGetCurrentPeb
NtQueryInformationProcess
RtlCreateUserThread
RtlGUIDFromString
RtlStringFromGUID
NtCompareTokens
RtlGetNtVersionNumbers
RtlEqualString
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
RtlAnsiStringToUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
NtResumeProcess
RtlAdjustPrivilege
NtSuspendProcess
NtTerminateProcess
NtQuerySystemEnvironmentValueEx
NtSetSystemEnvironmentValueEx
NtEnumerateSystemEnvironmentValuesEx
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW

kernel32

GetFileSize
CreateMutexW
GetFullPathNameA
GetFullPathNameW
GetTimeFormatW
WideCharToMultiByte
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetDateFormatW
LoadLibraryA
InterlockedExchange
GetProcessId
lstrlenW
PurgeComm
ClearCommError
CreateRemoteThread
WaitForSingleObject
SetLastError
CreateProcessW
SetConsoleOutputCP
GetConsoleOutputCP
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
WriteProcessMemory
VirtualProtect
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
ReadProcessMemory
VirtualFreeEx
VirtualQueryEx
VirtualFree
VirtualQuery
GetComputerNameExW
DeviceIoControl
DuplicateHandle
OpenProcess
GetCurrentProcess
ExpandEnvironmentStringsW
FindNextFileW
FindClose
GetCurrentDirectoryW
GetFileSizeEx
FlushFileBuffers
GetFileAttributesW
FindFirstFileW
DeleteFileA
GetTempPathA
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCurrentDirectoryA
GetTempFileNameA
SetFilePointer
CreateFileA
FileTimeToDosDateTime
CreateThread
LocalFree
CloseHandle
LocalAlloc
GetLastError
CreateFileW
ReadFile
Sleep
TerminateThread
WriteFile
FileTimeToSystemTime
TryEnterCriticalSection
SetEndOfFile
HeapAlloc
QueryPerformanceCounter
HeapFree
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
FormatMessageA
InitializeCriticalSection
FormatMessageW
GetVersionExW
HeapDestroy
HeapCompact
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
MultiByteToWideChar
GetTempPathW
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
CreateFileMappingA
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetSystemTime
AreFileApisANSI
ExitProcess
RaiseException
SetConsoleCtrlHandler
SetConsoleTitleW
lstrlenA
FreeLibrary
LoadLibraryW
GetProcAddress
GlobalSize
GetModuleHandleW
SetHandleInformation
CreatePipe
SetEvent
CreateEventW
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersion
GetModuleHandleA
GetCurrentThreadId
HeapReAlloc
GetSystemDirectoryW
SetConsoleCursorPosition
GetTimeZoneInformation
GetStdHandle
FillConsoleOutputCharacterW
GetComputerNameW
ProcessIdToSessionId
GetCurrentThread
SetCurrentDirectoryW
IsWow64Process
GetConsoleScreenBufferInfo

msvcrt

calloc
__set_app_type
isdigit
_read
_lseeki64
mbtowc
__mb_cur_max
isleadbyte
isxdigit
localeconv
_snprintf
_itoa
wctomb
ferror
iswctype
wcstombs
_write
_isatty
ungetc
?terminate@@YAXXZ
_controlfp
__badioinfo
__pioinfo
__p__fmode
isspace
_wcsicmp
__p__commode
__setusermatherr
_amsg_exit
_initterm
_errno
free
_wcsdup
_vsnprintf
strrchr
_except_handler3
vfwprintf
_vscwprintf
fflush
_wfopen
wprintf
_fileno
_iob
vwprintf
_setmode
fclose
_stricmp
wcsrchr
wcschr
strtoul
_wcsnicmp
wcsstr
gmtime
memmove
strncmp
malloc
_msize
strftime
strcspn
realloc
fgetws
wcstoul
wcstol
towupper
_wpgmptr
strstr
strchr
_wcstoui64
wcsncmp
getchar
memset
memcpy
__wgetmainargs
_cexit
_exit
_XcptFilter
exit

Sections

.text
Size: 456KB - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 270KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win32/mimilib.dll
.dll windows:5 windows x86 arch:x86

f9c08077ec0126532e2897217c9bcfbe

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

05-12-2018 07:15

Not After

05-12-2019 07:15

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08-03-2016 13:10

Not After

30-05-2027 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

05-12-2018 07:15

Not After

05-12-2019 07:15

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08-03-2016 13:10

Not After

30-05-2027 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e2:8e:df:c1:da:63:36:02:a7:ad:21:3a:74:ad:fc:21:aa:0c:85:a0:ba:fa:02:97:52:15:1e:22:fd:18:e4:ac
Signer

Actual PE Digest

e2:8e:df:c1:da:63:36:02:a7:ad:21:3a:74:ad:fc:21:aa:0c:85:a0:ba:fa:02:97:52:15:1e:22:fd:18:e4:ac

Digest Algorithm

sha256

PE Digest Matches

true

7e:2d:d4:cf:f2:21:78:7f:b7:cc:06:a9:c9:f1:65:6d:51:1b:b7:9d
Signer

Actual PE Digest

7e:2d:d4:cf:f2:21:78:7f:b7:cc:06:a9:c9:f1:65:6d:51:1b:b7:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

CreateRestrictedToken
CreateProcessAsUserW
ConvertSidToStringSidA
IsTextUnicode
OpenProcessToken

ntdll

RtlStringFromGUID
RtlEqualString
RtlFreeUnicodeString

rpcrt4

MesDecodeIncrementalHandleCreate
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeFree2
MesHandleFree

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
GetCurrentProcess
CloseHandle
FreeLibrary
LoadLibraryW
lstrlenW
GetProcAddress
LocalAlloc
LocalFree
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
RaiseException
InterlockedExchange
GetLastError
LoadLibraryA
RtlUnwind
QueryPerformanceCounter

msvcrt

_wfopen
fclose
_stricmp
fflush
memset
memcpy
_XcptFilter
malloc
free
_initterm
_amsg_exit
vfwprintf
_except_handler3

Exports

Exports

DhcpNewPktHook
DhcpServerCalloutEntry
DnsPluginCleanup
DnsPluginInitialize
DnsPluginQuery
ExtensionApiVersion
InitializeChangeNotify
Msv1_0SubAuthenticationFilter
Msv1_0SubAuthenticationRoutine
PasswordChangeNotify
SpLsaModeInitialize
WinDbgExtensionDllInit
coffee
mimikatz
startW

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win32/mimilove.exe
.exe windows:5 windows x86 arch:x86

4e1492696c43305d97c6c6a4e8958cdf

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

05-12-2018 07:15

Not After

05-12-2019 07:15

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08-03-2016 13:10

Not After

30-05-2027 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

05-12-2018 07:15

Not After

05-12-2019 07:15

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08-03-2016 13:10

Not After

30-05-2027 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c7:eb:8b:db:ac:a7:d5:69:bc:d3:3b:be:06:38:44:7d:c0:0b:d0:28:86:93:7b:53:50:f9:18:63:5d:e1:c0:03
Signer

Actual PE Digest

c7:eb:8b:db:ac:a7:d5:69:bc:d3:3b:be:06:38:44:7d:c0:0b:d0:28:86:93:7b:53:50:f9:18:63:5d:e1:c0:03

Digest Algorithm

sha256

PE Digest Matches

true

81:28:45:c5:14:54:9c:fc:1a:93:83:1a:ca:36:79:f7:71:cf:e9:48
Signer

Actual PE Digest

81:28:45:c5:14:54:9c:fc:1a:93:83:1a:ca:36:79:f7:71:cf:e9:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

IsTextUnicode
ConvertSidToStringSidW

user32

IsCharAlphaNumericW

ntdll

RtlEqualUnicodeString
NtQueryInformationProcess
RtlInitUnicodeString
NtQuerySystemInformation
RtlEqualString
RtlRunDecodeUnicodeString

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetCurrentProcessId
GetLastError
LocalAlloc
DeviceIoControl
CloseHandle
LocalFree
SetFilePointer
WriteFile
ReadProcessMemory
ReadFile
WriteProcessMemory
UnmapViewOfFile
GetCurrentProcess
GetDateFormatW
GetSystemTimeAsFileTime
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
OpenProcess
GetVersionExW

msvcrt

vfwprintf
fflush
_iob
wcsrchr
memset
memcpy
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
vwprintf

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kiwi_passwords.yar
mimicom.idl
x64/mimidrv.sys
.sys windows:6 windows x64 arch:x64

a63c276e82b09fa57509d7958aa9d208

Code Sign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:69:41:7a:1c:3e:f4:6a:30:1f:99:38:5f:50:68:0f:a0
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

28-06-2011 09:46

Not After

28-06-2014 09:46

Subject

CN=Benjamin Delpy,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0b:7f:6b:00:00:00:00:00:19
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:00

Not After

23-05-2016 17:10

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:73:2d:18:a7:d8:80:f0:50:54:33:a0:da:0e:10:0d:a0:e1:c3:a3
Signer

Actual PE Digest

0e:73:2d:18:a7:d8:80:f0:50:54:33:a0:da:0e:10:0d:a0:e1:c3:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\security\mimikatz\mimidrv\objfre_wnet_amd64\amd64\mimidrv.pdb

Imports

ntoskrnl.exe

KeBugCheck
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
PsProcessType
PsGetProcessImageFileName
PsLookupProcessByProcessId
PsReferencePrimaryToken
ZwOpenProcessTokenEx
IoGetCurrentProcess
ZwSetInformationProcess
ZwClose
ZwDuplicateToken
PsInitialSystemProcess
_vsnwprintf
ObfDereferenceObject
ObOpenObjectByPointer
PsGetProcessId
PsDereferencePrimaryToken
ExAllocatePoolWithTag
ExFreePoolWithTag
IoFreeMdl
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
ZwUnloadKey
IoEnumerateRegisteredFiltersList
KeBugCheckEx
MmGetSystemRoutineAddress
IoDeleteDevice
RtlInitUnicodeString
NtBuildNumber
RtlCompareMemory
IoDeleteSymbolicLink
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
RtlUnwindEx

fltmgr.sys

FltGetFilterInformation
FltEnumerateInstances
FltEnumerateFilters
FltObjectDereference
FltGetVolumeFromInstance

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1024B - Virtual size: 651B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/mimikatz.exe
.exe windows:5 windows x64 arch:x64

d6babc3862261c87ce2d504a3eb31724

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

05-12-2018 07:15

Not After

05-12-2019 07:15

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08-03-2016 13:10

Not After

30-05-2027 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

05-12-2018 07:15

Not After

05-12-2019 07:15

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08-03-2016 13:10

Not After

30-05-2027 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:61:14:4e:02:af:20:d2:d5:2c:31:db:ee:65:e2:7c:2f:dd:dc:a9:75:67:48:05:ca:54:85:2f:ea:a4:61:cc
Signer

Actual PE Digest

09:61:14:4e:02:af:20:d2:d5:2c:31:db:ee:65:e2:7c:2f:dd:dc:a9:75:67:48:05:ca:54:85:2f:ea:a4:61:cc

Digest Algorithm

sha256

PE Digest Matches

true

c8:8e:9d:b8:5b:44:52:15:ab:c0:aa:8f:33:7e:91:f4:75:f2:a9:22
Signer

Actual PE Digest

c8:8e:9d:b8:5b:44:52:15:ab:c0:aa:8f:33:7e:91:f4:75:f2:a9:22

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptSetHashParam
CryptGetHashParam
CryptExportKey
CryptAcquireContextW
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptDuplicateKey
CryptAcquireContextA
CryptGetProvParam
CryptImportKey
SystemFunction007
CryptEncrypt
CryptCreateHash
CryptGenKey
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
CopySid
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
CreateWellKnownSid
CreateProcessWithLogonW
CreateProcessAsUserW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
SystemFunction032
ConvertSidToStringSidW
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
SetServiceObjectSecurity
OpenServiceW
BuildSecurityDescriptorW
QueryServiceObjectSecurity
StartServiceW
AllocateAndInitializeSid
QueryServiceStatusEx
FreeSid
ControlService
IsTextUnicode
OpenProcessToken
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
DuplicateTokenEx
CheckTokenMembership
CryptSetProvParam
CryptEnumProvidersW
ConvertStringSidToSidW
LsaFreeMemory
SetThreadToken
CryptEnumProviderTypesW
SystemFunction006
CryptGetUserKey
OpenEventLogW
GetNumberOfEventLogRecords
ClearEventLogW
SystemFunction001
CryptDeriveKey
SystemFunction005
LsaQueryTrustedDomainInfoByName
CryptSignHashW
LsaOpenSecret
LsaQuerySecret
SystemFunction013
LsaRetrievePrivateData
LsaEnumerateTrustedDomainsEx
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
IsValidSid
LookupPrivilegeNameW
OpenThreadToken
CredFree
CredEnumerateW
GetSidSubAuthority
GetSidSubAuthorityCount
SystemFunction025
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction024
CredIsMarshaledCredentialW
CredUnmarshalCredentialW
A_SHAFinal
A_SHAInit
A_SHAUpdate

cabinet

ord11
ord14
ord10
ord13

crypt32

CryptEncodeObject
CertEnumSystemStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertGetNameStringW
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertSetCertificateContextProperty
PFXExportCertStoreEx
CryptUnprotectData
CryptBinaryToStringW
CryptStringToBinaryW
CryptExportPublicKeyInfo
CryptAcquireCertificatePrivateKey
CertNameToStrW
CertFindCertificateInStore
CertGetCertificateContextProperty
CryptSignAndEncodeCertificate
CryptProtectData

cryptdll

CDLocateCSystem
MD5Final
MD5Init
CDLocateCheckSum
CDGenerateRandomBits
MD5Update

dnsapi

DnsFree
DnsQuery_A

fltlib

FilterFindFirst
FilterFindNext

netapi32

NetServerGetInfo
NetStatisticsGet
NetShareEnum
DsEnumerateDomainTrustsW
DsGetDcNameW
NetApiBufferFree
NetRemoteTOD
NetSessionEnum
NetWkstaUserEnum
I_NetServerTrustPasswordsGet
I_NetServerReqChallenge
I_NetServerAuthenticate2

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

VariantInit
SysFreeString
SysAllocString

rpcrt4

RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqBegin
I_RpcGetCurrentCallHandle
NdrClientCall2
RpcMgmtEpEltInqDone
RpcBindingFromStringBindingW
RpcStringBindingComposeW
MesEncodeIncrementalHandleCreate
RpcBindingSetAuthInfoExW
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcImpersonateClient
RpcBindingFree
RpcStringFreeW
RpcRevertToSelf
MesDecodeIncrementalHandleCreate
MesHandleFree
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeFree2
NdrMesTypeEncode2
RpcServerUnregisterIfEx
I_RpcBindingInqSecurityContext
RpcServerInqBindings
RpcServerListen
RpcMgmtWaitServerListen
RpcEpRegisterW
RpcMgmtStopServerListening
RpcBindingToStringBindingW
RpcServerRegisterIf2
RpcServerRegisterAuthInfoW
RpcBindingVectorFree
UuidToStringW
RpcServerUseProtseqEpW
RpcEpUnregister
NdrServerCall2
RpcEpResolveBinding
UuidCreate

shlwapi

PathIsDirectoryW
PathCanonicalizeW
PathCombineW
PathFindFileNameW
PathIsRelativeW

samlib

SamEnumerateGroupsInDomain
SamiChangePasswordUser
SamSetInformationUser
SamGetGroupsForUser
SamConnect
SamGetMembersInGroup
SamRidToSid
SamGetMembersInAlias
SamEnumerateAliasesInDomain
SamGetAliasMembership
SamOpenGroup
SamQueryInformationUser
SamCloseHandle
SamEnumerateDomainsInSamServer
SamFreeMemory
SamEnumerateUsersInDomain
SamOpenUser
SamLookupDomainInSamServer
SamLookupNamesInDomain
SamLookupIdsInDomain
SamOpenDomain
SamOpenAlias

secur32

QueryContextAttributesW
FreeContextBuffer
LsaDeregisterLogonProcess
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer
DeleteSecurityContext
LsaConnectUntrusted
FreeCredentialsHandle
EnumerateSecurityPackagesW
AcquireCredentialsHandleW
InitializeSecurityContextW
LsaCallAuthenticationPackage

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW
GetKeyboardLayout
DispatchMessageW
DefWindowProcW
SetClipboardViewer
SendMessageW
GetClipboardSequenceNumber
OpenClipboard
CreateWindowExW
ChangeClipboardChain
GetClipboardData
RegisterClassExW
TranslateMessage
EnumClipboardFormats
PostMessageW
UnregisterClassW
GetMessageW
CloseClipboard
DestroyWindow

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

hid

HidD_GetAttributes
HidD_GetHidGuid
HidD_GetPreparsedData
HidD_GetFeature
HidP_GetCaps
HidD_FreePreparsedData
HidD_SetFeature

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

winscard

SCardFreeMemory
SCardListCardsW
SCardControl
SCardGetCardTypeProviderNameW
SCardReleaseContext
SCardListReadersW
SCardEstablishContext
SCardConnectW
SCardTransmit
SCardDisconnect
SCardGetAttrib

winsta

WinStationCloseServer
WinStationOpenServerW
WinStationFreeMemory
WinStationConnectW
WinStationQueryInformationW
WinStationEnumerateW

wldap32

ord122
ord14
ord88
ord157
ord133
ord27
ord147
ord167
ord26
ord127
ord224
ord113
ord309
ord54
ord142
ord77
ord13
ord208
ord145
ord36
ord79
ord41
ord73
ord310
ord203
ord69
ord139
ord97
ord223
ord304
ord12
ord96
ord301
ord140

msasn1

ASN1_CreateModule
ASN1_CloseEncoder
ASN1_CreateDecoder
ASN1_FreeEncoded
ASN1_CloseModule
ASN1_CreateEncoder
ASN1_CloseDecoder
ASN1BERDotVal2Eoid

ntdll

wcsncmp
_wcstoui64
strchr
strstr
wcstol
wcstoul
strcspn
strncmp
memmove
wcsstr
_wcsnicmp
strtoul
wcschr
wcsrchr
_stricmp
_vscwprintf
_wcsicmp
strrchr
_vsnprintf
__chkstk
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlDowncaseUnicodeString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlEqualUnicodeString
NtQueryObject
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
NtQuerySystemInformation
RtlGetCurrentPeb
NtQueryInformationProcess
RtlCreateUserThread
RtlGUIDFromString
RtlStringFromGUID
NtCompareTokens
RtlGetNtVersionNumbers
RtlEqualString
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
RtlAnsiStringToUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
NtResumeProcess
RtlAdjustPrivilege
NtSuspendProcess
NtTerminateProcess
NtQuerySystemEnvironmentValueEx
NtSetSystemEnvironmentValueEx
NtEnumerateSystemEnvironmentValuesEx
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
towupper
memcmp

kernel32

GetFullPathNameA
HeapReAlloc
GetTimeFormatW
WideCharToMultiByte
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetDateFormatW
lstrlenW
PurgeComm
RtlVirtualUnwind
LoadLibraryA
GetProcessId
ClearCommError
CreateRemoteThread
WaitForSingleObject
SetLastError
CreateProcessW
SetConsoleOutputCP
GetConsoleOutputCP
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
WriteProcessMemory
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
ReadProcessMemory
VirtualFreeEx
VirtualQueryEx
VirtualFree
VirtualQuery
GetComputerNameExW
DeviceIoControl
DuplicateHandle
OpenProcess
GetCurrentProcess
ExpandEnvironmentStringsW
FindNextFileW
FindClose
GetCurrentDirectoryW
GetFileSizeEx
FlushFileBuffers
GetFileAttributesW
FindFirstFileW
DeleteFileA
GetTempPathA
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCurrentDirectoryA
GetTempFileNameA
SetFilePointer
CreateFileA
FileTimeToDosDateTime
CreateThread
LocalFree
CloseHandle
LocalAlloc
GetLastError
CreateFileW
ReadFile
TerminateThread
WriteFile
FileTimeToSystemTime
Sleep
VirtualProtect
CreateMutexW
HeapCompact
TryEnterCriticalSection
SetEndOfFile
HeapAlloc
QueryPerformanceCounter
HeapFree
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
FormatMessageA
InitializeCriticalSection
FormatMessageW
GetVersionExW
HeapDestroy
GetFileSize
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
MultiByteToWideChar
GetTempPathW
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
CreateFileMappingA
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetSystemTime
AreFileApisANSI
ExitProcess
RaiseException
SetConsoleCtrlHandler
SetConsoleTitleW
lstrlenA
FreeLibrary
LoadLibraryW
GetProcAddress
GlobalSize
GetModuleHandleW
SetHandleInformation
CreatePipe
SetEvent
CreateEventW
GetSystemDirectoryW
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
GetFullPathNameW
SetConsoleCursorPosition
GetTimeZoneInformation
GetStdHandle
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
GetComputerNameW
ProcessIdToSessionId
GetCurrentThread
SetCurrentDirectoryW

msvcrt

isdigit
isspace
__set_app_type
mbtowc
__mb_cur_max
isleadbyte
isxdigit
localeconv
_snprintf
_itoa
calloc
wctomb
ferror
iswctype
wcstombs
?terminate@@YAXXZ
__badioinfo
__pioinfo
_read
_lseeki64
_write
_isatty
ungetc
fgetws
_fmode
realloc
strftime
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
__C_specific_handler
memset
_msize
memcpy
getchar
_errno
free
_wcsdup
vfwprintf
fflush
_wfopen
wprintf
_fileno
_iob
vwprintf
_setmode
fclose
gmtime
malloc
_wpgmptr

Sections

.text
Size: 601KB - Virtual size: 601KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 309KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/mimilib.dll
.dll windows:5 windows x64 arch:x64

3d70e62c24b8064ab851b1ade44d97a6

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

05-12-2018 07:15

Not After

05-12-2019 07:15

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08-03-2016 13:10

Not After

30-05-2027 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

05-12-2018 07:15

Not After

05-12-2019 07:15

Subject

CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08-03-2016 13:10

Not After

30-05-2027 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ec:88:01:bb:87:b6:f4:de:a6:69:fb:28:76:e8:0d:d1:a7:5c:67:f4:38:9a:ef:33:d4:d3:76:d7:44:d7:31:3a
Signer

Actual PE Digest

ec:88:01:bb:87:b6:f4:de:a6:69:fb:28:76:e8:0d:d1:a7:5c:67:f4:38:9a:ef:33:d4:d3:76:d7:44:d7:31:3a

Digest Algorithm

sha256

PE Digest Matches

true

5c:bf:7b:87:71:fb:c1:43:ad:ba:9f:1c:0c:c8:8a:53:05:da:07:dc
Signer

Actual PE Digest

5c:bf:7b:87:71:fb:c1:43:ad:ba:9f:1c:0c:c8:8a:53:05:da:07:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

CreateRestrictedToken
CreateProcessAsUserW
ConvertSidToStringSidA
IsTextUnicode
OpenProcessToken

ntdll

_stricmp
RtlFreeUnicodeString
RtlStringFromGUID
RtlEqualString
memcmp

rpcrt4

NdrMesTypeFree2
NdrMesTypeDecode2
MesHandleFree
MesDecodeIncrementalHandleCreate
MesIncrementalHandleReset

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
Sleep
GetCurrentProcess
CloseHandle
FreeLibrary
LoadLibraryW
lstrlenW
GetProcAddress
LocalAlloc
LocalFree
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
RaiseException
GetLastError
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter

msvcrt

_wfopen
fclose
vfwprintf
fflush
memcpy
memset
__C_specific_handler
_XcptFilter
malloc
_initterm
free
_amsg_exit

Exports

Exports

DhcpNewPktHook
DhcpServerCalloutEntry
DnsPluginCleanup
DnsPluginInitialize
DnsPluginQuery
ExtensionApiVersion
InitializeChangeNotify
Msv1_0SubAuthenticationFilter
Msv1_0SubAuthenticationRoutine
PasswordChangeNotify
SpLsaModeInitialize
WinDbgExtensionDllInit
coffee
mimikatz
startW

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 286B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25862203800205f80fd8b3a6634ea1c6

Code Sign

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:69:41:7a:1c:3e:f4:6a:30:1f:99:38:5f:50:68:0f:a0Certificate

Extended Key Usages

Key Usages

61:0b:7f:6b:00:00:00:00:00:19Certificate

Key Usages

f7:73:bc:fc:7e:ae:8a:1c:1b:90:c7:75:f1:fb:63:c7:a6:40:31:c3Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

fltmgr.sys

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 5KB - Virtual size: 4KB

PAGE Size: 1024B - Virtual size: 614B

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

c90f45c0d58dfcf861da592a1c318252

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bcCertificate

Extended Key Usages

Key Usages

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70Certificate

Extended Key Usages

Key Usages

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bcCertificate

Extended Key Usages

Key Usages

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70Certificate

Extended Key Usages

Key Usages

02:08:a1:4b:26:3d:2c:a2:78:37:91:ea:9b:64:8d:c3:20:07:5a:f7:2d:b4:f9:1e:b7:8f:4c:59:1a:47:56:61Signer

7b:72:16:6c:ba:be:8f:b4:26:e8:84:6c:b7:72:7e:4c:49:a4:23:e6Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

cabinet

crypt32

cryptdll

dnsapi

fltlib

netapi32

ole32

oleaut32

rpcrt4

shlwapi

samlib

secur32

shell32

user32

userenv

version

hid

setupapi

winscard

winsta

wldap32

msasn1

ntdll

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:69:41:7a:1c:3e:f4:6a:30:1f:99:38:5f:50:68:0f:a0
Certificate

61:0b:7f:6b:00:00:00:00:00:19
Certificate

f7:73:bc:fc:7e:ae:8a:1c:1b:90:c7:75:f1:fb:63:c7:a6:40:31:c3
Signer

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 5KB - Virtual size: 4KB

PAGE
Size: 1024B - Virtual size: 614B

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

02:08:a1:4b:26:3d:2c:a2:78:37:91:ea:9b:64:8d:c3:20:07:5a:f7:2d:b4:f9:1e:b7:8f:4c:59:1a:47:56:61
Signer

7b:72:16:6c:ba:be:8f:b4:26:e8:84:6c:b7:72:7e:4c:49:a4:23:e6
Signer

.text
Size: 456KB - Virtual size: 456KB

.rdata
Size: 270KB - Virtual size: 270KB

.data
Size: 14KB - Virtual size: 16KB

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 26KB - Virtual size: 25KB

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

e2:8e:df:c1:da:63:36:02:a7:ad:21:3a:74:ad:fc:21:aa:0c:85:a0:ba:fa:02:97:52:15:1e:22:fd:18:e4:ac
Signer

7e:2d:d4:cf:f2:21:78:7f:b7:cc:06:a9:c9:f1:65:6d:51:1b:b7:9d
Signer

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

5c:d5:1f:a1:78:42:d6:ed:bd:70:f5:9a:28:8b:30:bc
Certificate

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

c7:eb:8b:db:ac:a7:d5:69:bc:d3:3b:be:06:38:44:7d:c0:0b:d0:28:86:93:7b:53:50:f9:18:63:5d:e1:c0:03
Signer

81:28:45:c5:14:54:9c:fc:1a:93:83:1a:ca:36:79:f7:71:cf:e9:48
Signer