41dc561d9c32e58dcc94f823eb6c21f0[.]tar

Sharing

Copy URL

Twitter E-mail

General

Target

41dc561d9c32e58dcc94f823eb6c21f0.tar
Size

3.3MB
MD5

41dc561d9c32e58dcc94f823eb6c21f0
SHA1

59482d930af6715d5b98c5a2a1bfb5d703dbd5bb
SHA256

66b7d6a454320a3f7f9cae8910c0ea2824075536b689635417d79b022a1d933c
SHA512

bd03a3adca8294322a92bdbcce53cdcc3e4e8edd48fcd97dfbba8a06e3c8e36e11be7966dd865e60d312b66cc23b1c30c8edfc78700c96ea7a2fa1e61d1bc6d3
SSDEEP

98304:lfqQdtSn7BTTVT1GSulcPCfN1qsMeNKm5cClcmu+JRGPo:lzdQntv+lc0MuVlc5+LGw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/Comunicado Judicial Proferido del Código penal. Articulo 287/Doc 0020939 Judicial Proferido del Código penal. Articulo 287.exe

Files

41dc561d9c32e58dcc94f823eb6c21f0.tar
.rar

Password: 02165
Comunicado Judicial Proferido del Código penal. Articulo 287/Doc 0020939 Judicial Proferido del Código penal. Articulo 287.exe
.exe windows:6 windows x86 arch:x86

Password: 02165

885464c6d2b0dfce344b261817a07181

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

K32GetProcessMemoryInfo
K32GetModuleFileNameExW
K32GetModuleBaseNameW
K32EnumProcessModules
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetSystemDefaultUILanguage
WideCharToMultiByte
MultiByteToWideChar
GetTimeZoneInformation
FileTimeToSystemTime
MoveFileW
CopyFileW
GetDllDirectoryW
SetDllDirectoryW
LocalFree
LocalAlloc
GlobalLock
GlobalUnlock
LoadLibraryW
GetProcAddress
GetModuleFileNameW
FreeLibrary
DeleteTimerQueue
DeleteTimerQueueTimer
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
GetStdHandle
FreeConsole
AttachConsole
WriteConsoleA
WriteConsoleW
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
ReadConsoleOutputCharacterA
ExitProcess
MulDiv
GetCommandLineW
GlobalAlloc
GlobalSize
GlobalHandle
GlobalFree
SetErrorMode
GetSystemTimeAsFileTime
RaiseException
CreateMutexW
SetThreadPriority
TerminateThread
GetExitCodeThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FormatMessageW
SetCurrentDirectoryW
GetFileAttributesW
GetFileType
WriteFile
SetHandleInformation
CreatePipe
SetNamedPipeHandleState
PeekNamedPipe
SetEvent
CreateEventW
WaitForMultipleObjects
CreateProcessW
GetFileSize
GetLongPathNameW
GetTempFileNameW
GetModuleHandleW
GetEnvironmentVariableW
IsDebuggerPresent
GetNativeSystemInfo
LoadResource
LockResource
SizeofResource
FindResourceW
GetComputerNameW
K32GetProcessImageFileNameW
QueryPerformanceCounter
QueryPerformanceFrequency
GetACP
GetLocaleInfoW
IsBadReadPtr
IsBadStringPtrA
GetSystemDirectoryA
LoadLibraryA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
InitializeSListHead
RtlUnwind
LoadLibraryExW
GetFullPathNameW
SetEnvironmentVariableW
GetCurrentDirectoryW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
GetModuleHandleExW
ExitThread
FreeLibraryAndExitThread
MoveFileExW
SetStdHandle
FlushFileBuffers
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SetFilePointerEx
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
HeapReAlloc
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEndOfFile
FindFirstFileExW
GetCommandLineA
HeapSize
CreateTimerQueueTimer
CreateTimerQueue
GetVersionExW
GetSystemDirectoryW
GetTickCount
GetSystemTime
OpenProcess
GetProcessId
GetCurrentThreadId
GetCurrentThread
CreateThread
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeviceIoControl
GetProcessHeap
HeapFree
HeapAlloc
SetLastError
GetLastError
CloseHandle
OutputDebugStringW
GetTempPathW
RemoveDirectoryW
ReadFile
QueryDosDeviceW
GetVolumeInformationW
GetLogicalDriveStringsW
GetFileTime
GetFileAttributesExW
GetDriveTypeW
GetDriveTypeA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
DeleteFileW
CreateFileW
CreateDirectoryW
IsValidCodePage
ExpandEnvironmentStringsW

user32

CreateAcceleratorTableW
DestroyAcceleratorTable
TranslateAcceleratorW
GetDoubleClickTime
GetCaretBlinkTime
GetMenuState
CreateMenu
CreatePopupMenu
DestroyMenu
GetSubMenu
InsertMenuW
ModifyMenuW
RemoveMenu
SetMenuInfo
InsertMenuItemW
SetMenuItemInfoW
MessageBeep
DrawEdge
DrawFrameControl
CheckMenuItem
GetMenuItemID
GetSysColorBrush
CheckMenuRadioItem
GetMessageW
PostThreadMessageW
ValidateRect
GetWindowDC
BeginPaint
EndPaint
UnionRect
GetDesktopWindow
ValidateRgn
IsRectEmpty
IsClipboardFormatAvailable
wsprintfW
ChangeDisplaySettingsExW
EnumDisplaySettingsW
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
EnumDisplayMonitors
WaitForInputIdle
MsgWaitForMultipleObjects
SetTimer
KillTimer
DdePostAdvise
DdeNameService
DdeCreateDataHandle
DdeGetData
DdeQueryStringW
LoadBitmapW
GetScrollInfo
SetScrollInfo
IsDialogMessageW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetParent
GetParent
PtInRect
InflateRect
FillRect
GetSysColor
ChildWindowFromPointEx
WindowFromPoint
MapWindowPoints
ScreenToClient
ClientToScreen
GetCursorPos
SetCursorPos
GetClientRect
EnableScrollBar
GetComboBoxInfo
RedrawWindow
InvalidateRect
GetUpdateRgn
DestroyCursor
SetRect
GetMenuItemCount
GetSystemMetrics
IsWindowEnabled
ReleaseCapture
SetCapture
MapVirtualKeyW
VkKeyScanW
GetAsyncKeyState
GetActiveWindow
SetFocus
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
MoveWindow
AnimateWindow
IsWindow
CreateWindowExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
GetMessageTime
GetMessagePos
UnregisterHotKey
RegisterHotKey
PeekMessageW
DispatchMessageW
TranslateMessage
LoadCursorW
GetProcessDefaultLayout
UnregisterClassW
RegisterClassW
SystemParametersInfoW
HideCaret
SetCursor
SetWindowTextW
keybd_event
GetKeyState
GetFocus
DestroyWindow
IsMenu
GetWindowRect
SetMenu
PostMessageW
RegisterWindowMessageW
SendMessageW
AttachThreadInput
ShowWindow
SetWindowPos
IsWindowVisible
BringWindowToTop
OpenClipboard
CloseClipboard
GetClipboardData
GetCapture
EmptyClipboard
EnableWindow
SetActiveWindow
GetSystemMenu
AppendMenuW
UpdateWindow
GetForegroundWindow
SetForegroundWindow
GetDC
ReleaseDC
GetWindowTextA
GetWindowTextW
GetWindowTextLengthW
MessageBoxW
GetWindowLongW
SetWindowLongW
FindWindowW
ChildWindowFromPoint
GetClipboardFormatNameW
RegisterClipboardFormatW
OffsetRect
CopyRect
ScrollWindow
SetRectEmpty
DrawStateW
FindWindowExW
EnumWindows
GetClassNameW
DrawIconEx
DrawFocusRect
DrawTextW
EnableMenuItem
DrawMenuBar
GetDialogBaseUnits
CreateDialogIndirectParamW
IsZoomed
GetIconInfo
DdeFreeStringHandle
DdeCreateStringHandleW
DdeGetLastError
DdeFreeDataHandle
IsIconic
FlashWindowEx
SetLayeredWindowAttributes
GetWindowPlacement
SetWindowRgn
GetDlgItem
CreateDialogParamW
DestroyIcon
TrackPopupMenu
CreateIconIndirect
LoadImageW
GetMenuItemInfoW
GetWindowThreadProcessId
GetWindow
DdeInitializeW
LoadIconW
DdeUninitialize
DdeConnect
DdeDisconnect
DdeClientTransaction
DdeAccessData
DdeUnaccessData

gdi32

CreateRectRgn
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
CreateRectRgnIndirect
GetCharABCWidthsW
GetTextExtentExPointW
CreateDIBitmap
GetDIBits
CreateDIBSection
GetDIBColorTable
SetDIBColorTable
CreateICW
GetSystemPaletteEntries
CreateDCW
EnumFontFamiliesExW
SetViewportOrgEx
ExcludeClipRect
RectInRegion
SelectObject
SelectPalette
GetTextMetricsW
SetBrushOrgEx
GdiFlush
DeleteObject
GetObjectW
CreateCompatibleDC
DeleteDC
StretchBlt
PtInRegion
GetRgnBox
EqualRgn
CombineRgn
GetTextExtentPoint32W
MoveToEx
LineTo
GetBkColor
SetWindowOrgEx
SetWindowExtEx
SetViewportExtEx
PolyBezier
Polyline
Polygon
LPtoDP
SetStretchBltMode
CreateFontIndirectW
GetOutlineTextMetricsW
ExtCreateRegion
GetRegionData
OffsetRgn
SetBkColor
BitBlt
CreateBitmap
CreateBitmapIndirect
DPtoLP
CreatePolygonRgn
ExtTextOutW
ModifyWorldTransform
SetWorldTransform
GetDeviceCaps
GetStockObject
SetBkMode
SetTextColor
GetWorldTransform
SetROP2
StretchDIBits
SetPolyFillMode
SetPixel
GetLayout
SetLayout
SetMapMode
SetGraphicsMode
ExtSelectClipRgn
SelectClipRgn
RoundRect
Rectangle
PolyPolygon
Pie
MaskBlt
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetGraphicsMode
GetClipBox
CreateCompatibleBitmap
ExtFloodFill
Ellipse
Arc
ExtCreatePen
CreatePen
CreateSolidBrush
CreatePatternBrush
RealizePalette
EndPage
StartPage
EndDoc
StartDocW
SetAbortProc
PlayEnhMetaFile
GetEnhMetaFileHeader
GetEnhMetaFileW
DeleteEnhMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
CreateHatchBrush

advapi32

DuplicateToken
RegEnumKeyW
GetUserNameW
OpenProcessToken
OpenThreadToken
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
FreeSid
AccessCheck
AllocateAndInitializeSid
AddAccessAllowedAce

shell32

ord6
SHGetFileInfoW
CommandLineToArgvW
ExtractIconExW
ExtractIconW
DragAcceptFiles
DragFinish
DragQueryPoint
DragQueryFileW
ShellExecuteW
SHFileOperationW
ShellExecuteExW
Shell_NotifyIconW
SHGetPathFromIDListW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHGetFolderPathW

shlwapi

UrlCanonicalizeW
AssocQueryStringW
SHAutoComplete
StrToIntW

wininet

InternetReadFile
InternetQueryDataAvailable
FindNextUrlCacheEntryW
InternetSetOptionW
InternetOpenUrlW
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW
FindFirstUrlCacheEntryW
FindCloseUrlCache
InternetConnectW
InternetCloseHandle
HttpOpenRequestW
InternetOpenW
InternetQueryOptionW

ws2_32

WSACleanup
WSAAsyncSelect
WSAStartup
ioctlsocket
WSAGetLastError
WSASetLastError
getservbyname
getservbyport
gethostbyname
__WSAFDIsSet
accept
bind
closesocket
connect
getsockname
getsockopt
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
htonl
htons
inet_addr
inet_ntoa
ntohl
ntohs
gethostbyaddr

crypt32

CertFreeCertificateContext
CertOpenStore
CertCloseStore
CertGetNameStringW
CertGetCertificateContextProperty
CertFindCertificateInStore
CertVerifySubjectCertificateContext

winspool.drv

DocumentPropertiesW
ClosePrinter
GetPrinterW
OpenPrinterW

comdlg32

GetSaveFileNameW
GetOpenFileNameW
PageSetupDlgW
PrintDlgW
CommDlgExtendedError
ChooseFontW

ole32

RevokeDragDrop
OleInitialize
CoTaskMemFree
OleSetContainedObject
OleUninitialize
OleLockRunning
CoLockObjectExternal
RegisterDragDrop
ReleaseStgMedium
CoCreateInstance
OleRun
CoTaskMemAlloc
OleSetClipboard
OleGetClipboard
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

SafeArrayPtrOfIndex
SafeArrayDestroy
SafeArrayCreate
SysFreeString
VariantInit
SysAllocString
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayGetVartype
VarBstrFromCy
SafeArrayLock
SafeArrayUnlock
VariantClear
SysStringLen

rpcrt4

UuidToStringW
RpcStringFreeW

oleacc

LresultFromObject

comctl32

ord17
ImageList_Replace
ImageList_GetIconSize
ImageList_GetImageInfo
ImageList_Draw
ord16
ImageList_Create
ImageList_Destroy
ImageList_GetImageCount
ImageList_Add
ImageList_SetBkColor

Exports

Exports

pcre2_code_copy_16
pcre2_code_copy_with_tables_16
pcre2_code_free_16
pcre2_compile_16
pcre2_compile_context_copy_16
pcre2_compile_context_create_16
pcre2_compile_context_free_16
pcre2_config_16
pcre2_convert_context_copy_16
pcre2_convert_context_create_16
pcre2_convert_context_free_16
pcre2_general_context_copy_16
pcre2_general_context_create_16
pcre2_general_context_free_16
pcre2_get_error_message_16
pcre2_get_mark_16
pcre2_get_match_data_size_16
pcre2_get_ovector_count_16
pcre2_get_ovector_pointer_16
pcre2_get_startchar_16
pcre2_jit_compile_16
pcre2_jit_free_unused_memory_16
pcre2_jit_match_16
pcre2_jit_stack_assign_16
pcre2_jit_stack_create_16
pcre2_jit_stack_free_16
pcre2_match_16
pcre2_match_context_copy_16
pcre2_match_context_create_16
pcre2_match_context_free_16
pcre2_match_data_create_16
pcre2_match_data_create_from_pattern_16
pcre2_match_data_free_16
pcre2_set_bsr_16
pcre2_set_callout_16
pcre2_set_character_tables_16
pcre2_set_compile_extra_options_16
pcre2_set_compile_recursion_guard_16
pcre2_set_depth_limit_16
pcre2_set_glob_escape_16
pcre2_set_glob_separator_16
pcre2_set_heap_limit_16
pcre2_set_match_limit_16
pcre2_set_max_pattern_length_16
pcre2_set_newline_16
pcre2_set_offset_limit_16
pcre2_set_parens_nest_limit_16
pcre2_set_recursion_limit_16
pcre2_set_recursion_memory_management_16
pcre2_set_substitute_callout_16

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Comunicado Judicial Proferido del Código penal. Articulo 287/Oficio Judicial Proferido del Código penal. Articulo 287.exe
.exe windows:4 windows x86 arch:x86

Password: 02165

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

c8:a7:9a:cf:a2:0c:a4:15:09:24:5c:1f:7f:64:ff:c4
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

24-05-2021 00:00

Not After

23-08-2024 23:59

Subject

CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c8:a7:9a:cf:a2:0c:a4:15:09:24:5c:1f:7f:64:ff:c4
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

24-05-2021 00:00

Not After

23-08-2024 23:59

Subject

CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4f:a0:c6:05:4d:c2:68:f3:b6:0b:00:87:50:3c:fc:22:0d:86:a3:12:12:36:78:3e:13:23:5a:cb:0d:2b:66:95
Signer

Actual PE Digest

4f:a0:c6:05:4d:c2:68:f3:b6:0b:00:87:50:3c:fc:22:0d:86:a3:12:12:36:78:3e:13:23:5a:cb:0d:2b:66:95

Digest Algorithm

sha256

PE Digest Matches

false

de:17:fd:95:27:18:0a:b6:44:df:6f:c4:cf:04:dc:15:e8:0a:d8:7a
Signer

Actual PE Digest

de:17:fd:95:27:18:0a:b6:44:df:6f:c4:cf:04:dc:15:e8:0a:d8:7a

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 02165

Password: 02165

885464c6d2b0dfce344b261817a07181

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

wininet

ws2_32

crypt32

winspool.drv

comdlg32

ole32

oleaut32

rpcrt4

oleacc

comctl32

Exports

Exports

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 63KB - Virtual size: 251KB

.rsrc Size: 1.0MB - Virtual size: 1.0MB

Password: 02165

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

c8:a7:9a:cf:a2:0c:a4:15:09:24:5c:1f:7f:64:ff:c4Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

c8:a7:9a:cf:a2:0c:a4:15:09:24:5c:1f:7f:64:ff:c4Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

4f:a0:c6:05:4d:c2:68:f3:b6:0b:00:87:50:3c:fc:22:0d:86:a3:12:12:36:78:3e:13:23:5a:cb:0d:2b:66:95Signer

de:17:fd:95:27:18:0a:b6:44:df:6f:c4:cf:04:dc:15:e8:0a:d8:7aSigner

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rsrc Size: 21KB - Virtual size: 21KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 63KB - Virtual size: 251KB

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

c8:a7:9a:cf:a2:0c:a4:15:09:24:5c:1f:7f:64:ff:c4
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

c8:a7:9a:cf:a2:0c:a4:15:09:24:5c:1f:7f:64:ff:c4
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

4f:a0:c6:05:4d:c2:68:f3:b6:0b:00:87:50:3c:fc:22:0d:86:a3:12:12:36:78:3e:13:23:5a:cb:0d:2b:66:95
Signer

de:17:fd:95:27:18:0a:b6:44:df:6f:c4:cf:04:dc:15:e8:0a:d8:7a
Signer

.text
Size: 3.3MB - Virtual size: 3.3MB

.rsrc
Size: 21KB - Virtual size: 21KB

.reloc
Size: 512B - Virtual size: 12B