Store-ind-10002[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Store-ind-10002.exe
Size

181.6MB
MD5

aa6c0f982ef38147d29a062f655c79e8
SHA1

3a7f6c67a3f292b17d047397cc6cae663758fb05
SHA256

727a20a3caeb6ba869ea392ebd7b29496fbc08f019b56ed959e48b903e6e14c6
SHA512

edf363155623e10697021b9d191d921d423026be1f537c47de879e97c76bb6b6644af41cdb87af0f6b3cfe0edb186ab056a0e20737220aed789ebb5dfcd8ddbb
SSDEEP

3145728:NkuGirATd5XXMWrjwCMS3JXJVhfSEx/aJjdsw7KwM8JiWb4URJE00cfAAerKzUOJ:airAj5Hwu3JThfhx/aVzo8AKfAAX/M2X

Score

1^/10

Malware Config

Signatures

Files

Store-ind-10002.exe
.exe windows:6 windows x64 arch:x64

449c057f558ec325809374cc9e347044

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:d6:9f:52:13:4b:dc:c3:5f:48:ef:cf:ea:d3:8e:48
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

19-06-2024 00:00

Not After

18-06-2027 23:59

Subject

CN=Lenovo (Beijing) Limited,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b1:73:44:b9:36:df:3d:78:7e:ae:6e:4b:70:ea:8d:93:ac:98:fb:69:ca:9b:c3:91:c1:af:eb:20:cc:db:9b:c9
Signer

Actual PE Digest

b1:73:44:b9:36:df:3d:78:7e:ae:6e:4b:70:ea:8d:93:ac:98:fb:69:ca:9b:c3:91:c1:af:eb:20:cc:db:9b:c9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\Jenkins\jobs\LenovoStore_x64\workspace\bin\x64\Release_Inst\StoreInstaller.pdb

Imports

kernel32

LockResource
SizeofResource
FindResourceW
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
FreeLibrary
GetModuleHandleW
CreateDirectoryW
CreateFileW
WriteFile
HeapAlloc
HeapDestroy
GetLastError
DecodePointer
CloseHandle
Sleep
FreeResource
LoadLibraryW
GetTempPathW
GetLocalTime
GetModuleFileNameW
FileTimeToLocalFileTime
GetDiskFreeSpaceExW
RaiseException
WaitForSingleObject
CreateEventW
GetProcessTimes
GetCurrentProcess
GetCurrentThreadId
SetThreadPriority
ResumeThread
GetTickCount64
VirtualProtect
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
OpenProcess
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
lstrcmpiW
LoadResource
lstrlenW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TryEnterCriticalSection
HeapCreate
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
LoadLibraryA
DeleteFileA
HeapCompact
UnlockFile
LockFileEx
CreateFileMappingW
MapViewOfFile
WriteConsoleW
SetEndOfFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetConsoleOutputCP
SetStdHandle
SetFilePointerEx
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FindResourceExW
HeapReAlloc
HeapFree
HeapSize
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTimeZoneInformation
SetConsoleCtrlHandler
GetProcessHeap
InitializeCriticalSectionEx
lstrcpyW
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
TlsFree
CreateMutexW
DeleteCriticalSection
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
RtlUnwindEx
RtlPcToFileHeader
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
DeleteFileW
GetACP
GetProcAddress
MulDiv
VerifyVersionInfoW
GetCurrentDirectoryW
GetFileSize
ReadFile
GetTickCount
GlobalUnlock
GlobalLock
lstrcmpW
ExitProcess
GetFileAttributesW
LocalFileTimeToFileTime
SetFilePointer
SetFileTime
LocalFree
FormatMessageW
InitializeCriticalSectionAndSpinCount
GlobalAlloc
lstrcpynW
GetEnvironmentVariableW
CreateDirectoryA
GetFileSizeEx
GetFileTime
RemoveDirectoryW
SetFileAttributesW
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryW
GetWindowsDirectoryW
DosDateTimeToFileTime
CopyFileW
MoveFileW
MoveFileExW
FileTimeToSystemTime
SetEnvironmentVariableW
GetStartupInfoW
GetProcessId
GetSystemInfo
GetSystemTimeAsFileTime
GetVersionExW
GetNativeSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
GlobalFree
LocalAlloc
WTSGetActiveConsoleSessionId
GetStdHandle
ReleaseMutex
GetPrivateProfileIntW
SetConsoleTextAttribute
InitializeCriticalSection
ProcessIdToSessionId
SetEvent
SetLastError
SetUnhandledExceptionFilter
CreateThread
GlobalMemoryStatusEx
GetSystemTime
GetPrivateProfileStringW
CreateFileA
GetFullPathNameW
lstrlenA
LoadLibraryExW
OutputDebugStringW
GetFileAttributesExW
GetSystemFirmwareTable
FlushFileBuffers
IsDebuggerPresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetStringTypeW
ReleaseSRWLockShared
AcquireSRWLockShared
SleepConditionVariableSRW
FormatMessageA
GetLocaleInfoEx
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
WakeConditionVariable
WakeAllConditionVariable
FindFirstFileExW
AreFileApisANSI
GetFileInformationByHandleEx
EncodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
LoadLibraryExA

user32

SendMessageW
PostQuitMessage
SetWindowPos
GetWindowThreadProcessId
SetForegroundWindow
GetForegroundWindow
IsIconic
ShowWindow
IsWindow
AttachThreadInput
FindWindowW
PostMessageW
MessageBoxW
GetWindowRect
GetClientRect
SetCursor
InflateRect
UnionRect
OffsetRect
LoadCursorW
GetDC
ReleaseDC
MonitorFromPoint
GetMessageW
TranslateMessage
DispatchMessageW
CreateWindowExW
DestroyWindow
IsWindowVisible
KillTimer
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
SetTimer
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
wsprintfW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
GetWindowLongPtrW
SetWindowLongPtrW
SetWindowRgn
UpdateLayeredWindow
CharPrevW
DrawTextW
FillRect
SetRect
DestroyIcon
DrawIconEx
GetIconInfo
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
UpdateWindow
IsWindowEnabled
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
MoveWindow
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
GetDesktopWindow
EnumWindows
SetProcessDPIAware
BringWindowToTop
GetCursorPos
IsZoomed

advapi32

RegOpenKeyExW
RegCreateKeyExW
OpenProcessToken
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
DuplicateTokenEx
FreeSid
RegCloseKey
LookupPrivilegeValueW
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ImpersonateLoggedOnUser
RevertToSelf
RegOpenCurrentUser
RegFlushKey
RegSetValueExW
RegGetValueW
SetEntriesInAclW
SetNamedSecurityInfoW
BuildExplicitAccessWithNameW

shell32

SHGetMalloc
DragQueryFileW
SHGetFolderPathW
SHCreateDirectoryExW
SHFileOperationW
CommandLineToArgvW
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetSpecialFolderPathA
SHGetPathFromIDListW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CoUninitialize
RegisterDragDrop
DoDragDrop
OleDuplicateData
ReleaseStgMedium
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CoInitializeSecurity
CoSetProxyBlanket
CoCreateGuid
CoInitialize

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

ws2_32

gethostbyname
gethostname
WSAStartup

crypt32

CertGetCertificateContextProperty
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose

shlwapi

PathAddExtensionW
PathRemoveExtensionW
StrCpyNW
PathIsDirectoryW
PathRemoveFileSpecW
PathIsDirectoryA
PathFindFileNameW
PathFileExistsW
PathFindExtensionW
PathAppendW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken

wininet

HttpSendRequestW
InternetAttemptConnect
InternetQueryDataAvailable
InternetReadFile
HttpQueryInfoW
HttpEndRequestW
HttpSendRequestExW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetSetOptionW
InternetGetConnectedStateExW
InternetQueryOptionW
InternetCloseHandle
InternetWriteFile
InternetConnectW
InternetOpenW

rpcrt4

RpcStringFreeA
UuidToStringA

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx

gdiplus

GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImageRectI
GdipFillPath
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipCreatePath
GdipDeletePath
GdipAddPathLine
GdipAddPathArc
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCreateTexture
GdipSetTextureTransform
GdipLoadImageFromFile
GdipGetImageThumbnail
GdipFillEllipseI
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipDrawString
GdipLoadImageFromStream
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipTranslateWorldTransform
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipCreateHBITMAPFromBitmap
GdipBitmapLockBits
GdipRotateWorldTransform
GdipBitmapUnlockBits
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipSetWorldTransform
GdipDrawRectangleI
GdipMeasureString
GdipSetPenMode
GdipStringFormatGetGenericTypographic
GdipDrawPath
GdipFillRectangleI

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

dxgi

CreateDXGIFactory1

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

pdh

PdhAddCounterW
PdhGetFormattedCounterValue
PdhCollectQueryData
PdhOpenQueryW

wintrust

WinVerifyTrust
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
VerSetConditionMask
RtlVirtualUnwind

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
EnumFontFamiliesExW
GetStockObject
AddFontMemResourceEx
RemoveFontMemResourceEx
GetDeviceCaps
RestoreDC
SaveDC
SelectObject
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
SetWindowOrgEx
CreateRoundRectRgn
CreateDIBSection
CombineRgn
CreateDCW
CreatePenIndirect
Rectangle
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetDIBits
GetTextExtentPoint32W
LineTo
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
GdiFlush
CreatePatternBrush
GetTextExtentPointA
GetBitmapBits
SetBitmapBits
GetObjectW

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 484KB - Virtual size: 483KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 178.8MB - Virtual size: 178.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

449c057f558ec325809374cc9e347044

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

04:d6:9f:52:13:4b:dc:c3:5f:48:ef:cf:ea:d3:8e:48Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

b1:73:44:b9:36:df:3d:78:7e:ae:6e:4b:70:ea:8d:93:ac:98:fb:69:ca:9b:c3:91:c1:af:eb:20:cc:db:9b:c9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

crypt32

shlwapi

wtsapi32

wininet

rpcrt4

comctl32

gdiplus

imm32

version

dxgi

iphlpapi

pdh

wintrust

ntdll

gdi32

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 484KB - Virtual size: 483KB

.data Size: 40KB - Virtual size: 60KB

.pdata Size: 92KB - Virtual size: 92KB

.rsrc Size: 178.8MB - Virtual size: 178.8MB

.reloc Size: 21KB - Virtual size: 20KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:d6:9f:52:13:4b:dc:c3:5f:48:ef:cf:ea:d3:8e:48
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b1:73:44:b9:36:df:3d:78:7e:ae:6e:4b:70:ea:8d:93:ac:98:fb:69:ca:9b:c3:91:c1:af:eb:20:cc:db:9b:c9
Signer

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 484KB - Virtual size: 483KB

.data
Size: 40KB - Virtual size: 60KB

.pdata
Size: 92KB - Virtual size: 92KB

.rsrc
Size: 178.8MB - Virtual size: 178.8MB

.reloc
Size: 21KB - Virtual size: 20KB