APOConfig[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
APOConfig.exe
Size 196KB
Sample260809-ryzcrazdkc
SHA256 d0666f91e134e6522150a46dbe521479993cd708492f090b72940ba050d1a68a
MD5 6dea0364646c299c12239e7402c28e7c
SHA1 a801c2b7c49dcd6e2f8c33b59a2e1ca8c70adb21
SHA512 b3030b301e571649892aa2c081c254eb293520e0bbe3a4df1522d70cbe35661485e1bc7688d8413d88e298ef3463e3542e4bede73ab1b3adfbfc4b76bdd99b21
SSDEEP 6144:lXtzpxJqoyk6H9APPQZLFlejj85JL7guX:PpPK9A8LH5N7gM
TLSH
T11A146D25BDC2D073E666093069E8CA759A29F8B10F609CDB73840FFA4D346D19735B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

APOConfig.exe

.exe 196KB

APOConfig.exe

IMPHASH a3867a6612c34ced3e91ca9ea263265b
SHA256 d0666f91e134e6522150a46dbe521479993cd708492f090b72940ba050d1a68a
MD5 6dea0364646c299c12239e7402c28e7c
SHA1 a801c2b7c49dcd6e2f8c33b59a2e1ca8c70adb21
SHA512 b3030b301e571649892aa2c081c254eb293520e0bbe3a4df1522d70cbe35661485e1bc7688d8413d88e298ef3463e3542e4bede73ab1b3adfbfc4b76bdd99b21
SSDEEP 6144:lXtzpxJqoyk6H9APPQZLFlejj85JL7guX:PpPK9A8LH5N7gM
TLSH
T11A146D25BDC2D073E666093069E8CA759A29F8B10F609CDB73840FFA4D346D19735B3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

66:bf:e7:81:83:0a:34:70:ed:de:2a:5d:35:66:e2:5c:3e:87:42:8e:b4:b9:72:11:a0:ac:58:ba:ef:97:1c:2f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,L=Sofia,C=BG

Chains

Jul 29, 2026

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,L=Sofia,C=BG

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,L=Sofia,C=BG

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,L=Sofia,C=BG

Serial Number

53:76:34:0a:02:d7:1b:41:2c:8e:8e:b9:41:7d:44:1c

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2024 - Jun 11, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

31737

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Bobo\GIT\APOConfig\Release\APOConfig.pdb

shlwapi

PathRemoveFileSpecW PathFileExistsW

kernel32

CreateFileW FormatMessageW MultiByteToWideChar GetProcessHeap LocalFree HeapAlloc LocalAlloc GetCurrentProcess HeapFree GetModuleFileNameW HeapSize WriteConsoleW GetStartupInfoW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetFileType CloseHandle WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapReAlloc FindClose

advapi32

FreeSid LookupPrivilegeValueW SetSecurityDescriptorDacl AdjustTokenPrivileges GetSecurityDescriptorDacl RegGetKeySecurity RegCloseKey RegDeleteKeyExW RegQueryInfoKeyW SetSecurityDescriptorOwner AllocateAndInitializeSid SetEntriesInAclW RegCreateKeyExW RegQueryValueExW RegDeleteValueW RegOpenKeyExW InitializeSecurityDescriptor RegSetKeySecurity OpenProcessToken RegSetValueExW RegEnumKeyExW

shell32

ShellExecuteW

ole32

CoUninitialize CLSIDFromString StringFromCLSID CoTaskMemFree CoCreateInstance CoInitializeEx PropVariantClear

Name

.text

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

APOConfig.exe

shlwapi

kernel32

advapi32

shell32

ole32

generic