setup_epagesaferrt[.]exe

resource
unpack001/$SYSDIR/$R0
unpack001/$TEMP/markany_ImageSafer.exe
unpack003/$WINDIR/ImageSAFERSvc.exe
unpack003/$WINDIR/system32/$R0

resource
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/MaImgsfCheck.dll
unpack001/$PLUGINSDIR/MaPlugins.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsJSON.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack002/$PLUGINSDIR/MaPlugins.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsProcess.dll
unpack003/$PLUGINSDIR/MaPlugins.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/nsProcess.dll
unpack003/$WINDIR/system32/ImageSAFERFilter.dll
unpack003/$WINDIR/system32/ImageSAFERMessage.exe
unpack003/$WINDIR/system32/ImageSAFERProcMon.dll
unpack003/$WINDIR/system32/ImageSAFERRecovery.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$TEMP/Inst_MaEPSBroker.exe	nsis_installer_1
static1/unpack001/$TEMP/Inst_MaEPSBroker.exe	nsis_installer_2

setup_epagesaferrt.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 1678ef389ee9cd52c5101e8bad489623e01d0882948bac8b93b79456825e34c8
MD5 c8b32f8be71666614f6117fd8d651dc6
SHA1 68c2e3523dd18b62297a79ebd9ddf77a2d520126
SHA512 5c319cd753ac96f1becea0c451d0cfd1219e387e6d8199072a19d9ca67ba40aff5e20b3667451b4f70aa9f33ff20579facaa6041c360c16903c11ce17694e37a
SSDEEP 393216:1TA+FnP7yRgvy6hwaiVVIxqotIh9cjk7ND3EbPL+xgNATAbrOJXRQ:RAwnP76T6+aiV49tIncKND0bPL+iBOJi
TLSH
T1D82733478964BB63DA025939537077FB9FA3CC03E624D467E7ED3B11DA200BA1BE0691
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

d0:50:00:47:fb:d2:2b:40:c8:98:20:e1:fc:16:a6:8b:69:dc:ed:49:d6:a5:ad:d9:7f:a0:9f:ab:9f:a1:83:bb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 14, 2022

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

b2:d1:25:b6:c5:cd:c1:03:7c:5a:cd:96:4a:f0:2a:9e:97:11:ba:93

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 14, 2022

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

07:b8:14:87:41:fc:84:53:9b:db:20:75:90:e3:a9:50

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2021 - Apr 30, 2024

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 9, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 153027ec3b10bcea606b777657dd3402
SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
MD5 99f345cf51b6c3c317d20a81acb11012
SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
TLSH
T10881C5436B102FBBC0880630358E7D1E64FA49A8536E00BFD786A98E3DD62D4F170367
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/MaImgsfCheck.dll

IMPHASH e6aba0589b3fc0814152fdc5f764763d
SHA256 88fad6fbb302770211fd4427864d9158b89825504bc77a396529c80e9fab5156
MD5 cb6b37ed77a1010ea087edbaaa9355f6
SHA1 d55a3d539d64c501233abfbebbbe9dd5f1e004cb
SHA512 53eda5c4e9d41a9e7cbb01e77387df501159e1e8520be030e0d956527e11edb2ca25bab167da50837ff105ac30a0d562d8b940833be4b311baec7a69e24ca7df
SSDEEP 384:iK68saljcAmJNSVgVWyQ6tXldqZJ50WVrBWgBZDJJ3Nq7Y1KQ5:iK6da5cAIxv3bSJSevHDH387qKQ5
TLSH
T132A26B225F1940B3D65E0474BA75FF2F0A397E011FE029CBABD71DF52D660871939A22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

14397

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Users\mkSong\Documents\Visual Studio 2008\Projects\VSBuild\MaImgsfCheck\Release\MaImgsfCheck.pdb

kernel32

OpenProcess VerifyVersionInfoA GetSystemDirectoryA GetLastError GetProcAddress LoadLibraryA CreateFileMappingW QueryFullProcessImageNameA GetModuleHandleA CreateMutexA OutputDebugStringA ReleaseMutex CloseHandle LocalFree lstrcpyA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObject GetCurrentProcess VerSetConditionMask UnmapViewOfFile OpenFileMappingW MapViewOfFile TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime QueryPerformanceCounter

user32

GetWindowThreadProcessId IsWindow

advapi32

RegOpenKeyExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegCloseKey

msvcr90

_adjust_fdiv __CppXcptFilter _crt_debugger_hook __clean_type_info_names_internal _amsg_exit __dllonexit _lock _onexit _except_handler4_common _initterm_e _initterm _decode_pointer _encoded_null _malloc_crt _encode_pointer ??2@YAPAXI@Z ??3@YAXPAX@Z _unlock strcpy_s _itoa strchr sprintf free malloc memset memcpy __CxxFrameHandler3 _vsnprintf floor

msvcp90

??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z

shlwapi

PathAppendA PathFileExistsA PathFindFileNameA

$PLUGINSDIR/MaPlugins.dll

IMPHASH ccb5551397ee1b5618670144128fb2dd
SHA256 45d24ca2fd9a0f6603365001e770a5e1d0103caa32d9667dec55d26f3598d110
MD5 5450157ded399912b02d03aaf03053c2
SHA1 4f7b7f20256fb5b98cdc75e7ae892600f8232383
SHA512 41d59ab9ceb0fd7350569c72170614c874bc2c72cde7f77311337969f85ff47da9f9f193e729aa6082da330956c9ec19a58a66747711ddc6eff4a7aa7e39ffa5
SSDEEP 24:e1GSL7WM7UllAlopjYOvf3pApRlaMAHy0WVFGh5U8:SLv7UkWjYOnpuRwMAKP8
TLSH
T1DD92023763B08EF1D40A1B7614470DA662EF963813F1100D9D59642B6E706BBED38F01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4306

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 5d4664902ad2851d5bdf85ad6040d2083b251b45a15e5bd497ef1af445678022
MD5 3ea89ccb97ad9adefa56ca94336a3a6d
SHA1 8fe664983b137501d41fb1a7025307050435e8e8
SHA512 78c28c58adf4b5d1447d39bef042f4b4d2a9836eec8b6c5da57c81c05e1fc3ad630ce005f0dddb642f784c354dccf6c94dbcbb777e32f97e3dd9e5a420224d72
SSDEEP 384:C7RogTxHj8wXNMJhJ263le4w0+aR0Df9cPntutcjNeZ:2RogTxHowXghJRle71D1c/icJeZ
TLSH
T1AAB2D7239822D7504D9CBF971F6589ED2833EFAB9828634E9F5DB1C18E7B3C604705A0
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsJSON.dll

IMPHASH 67cfa491a15c2e6ae037612d4a7ef727
SHA256 6785ab17a6c27be18072aa1c274078321b4ea27bfa752d3c882ec3093dc4637b
MD5 c8222584e91b74c47f5ce2a84d1cdc4f
SHA1 750359dd536c840b1d4016826af7f34a8562e242
SHA512 a89f0083c791e7d4d54fd728e848e44bd44ef9e11c799a48ab95a48d3c4e02e68699e28818c1232b694120973ac0c3e418740759830ef70d328d7ef9e5789f51
SSDEEP 384:qdctoQMA9RtBHo45eqtTv/lddWUn89tNj5AYXqUYevrTZg9MyhTZrdSw:qFqRtBneqtTXldBn+tNDqqz1mMIrn
TLSH
T15AA25C56A17068F1F92614B5B9926E232F7EFA083475989BCF23196D7950823BF3D302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

11692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
TLSH
T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$SYSDIR/$R0

IMPHASH 21abfb077456312be06cf37a274cc881
SHA256 ac660ed059b42d0c63ef2b3b84437035ecacaccf011b70ceccc91bafcfea5c3f
MD5 36870ea9f9e91dfe5c13f45e8f54053d
SHA1 880779c2b78e5dbf99ad127c4a1f06c713de7fc0
SHA512 100075b8a978cf046054253229e3738a8a03a999606ebb4f9695c81adc0e5faf733b358fb8b304d870dcdbc1bc0117a701d01bbb9f3b213f8bb8799f80ef4625
SSDEEP 3072:TpVyUJciZgllNpSDoTacb/E5TBfnd77g51roWgWR:NVRJciZgllNaopb/E5TBvd7402
TLSH
T1F7249D01B640C573D4AB053C44A9CBFA5A7AB13943B8D8C3B7887FB66E953D066352CE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
NSIS installer

installer

Digest

d3:74:31:77:d7:62:ad:8f:d6:83:b2:a1:c8:e3:72:27:81:53:46:c3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074a756e672d6775,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Oct 24, 2018

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074a756e672d6775,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074a756e672d6775,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Serial Number

42:de:91:b4:0d:81:43:94:45:7c:14:ba:d1:72:ea:83

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 24, 2018 - Jan 2, 2022

Minor OS version

0

Major OS version

5

Entry point

65953

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

StrStrIA PathFileExistsA

ws2_32

ntohl

kernel32

WideCharToMultiByte LocalAlloc FormatMessageA GetLastError Process32Next MultiByteToWideChar CreateToolhelp32Snapshot GetProcessHeap WriteConsoleW GetConsoleOutputCP WriteConsoleA IsBadCodePtr ExitProcess LocalFree CreateFileA ReadFile lstrcmpiA GetSystemDirectoryA lstrlenA lstrcpyA GetCurrentProcess GetVersionExA GetModuleHandleA FreeLibrary LoadLibraryA GetProcAddress CloseHandle Process32First SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW HeapFree HeapReAlloc HeapAlloc RtlUnwind GetModuleHandleW Sleep EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetCommandLineA HeapCreate HeapDestroy VirtualFree DeleteCriticalSection VirtualAlloc WriteFile GetStdHandle GetModuleFileNameA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode SetHandleCount GetFileType GetStartupInfoA HeapSize FlushFileBuffers SetFilePointer InitializeCriticalSectionAndSpinCount SetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings GetSystemTimeAsFileTime

user32

wsprintfA MessageBoxA GetActiveWindow DrawTextA GetSystemMetrics

gdi32

MoveToEx LineTo CreateFontIndirectA CreateCompatibleBitmap GetStockObject Rectangle CreatePen CreateSolidBrush GetClipBox SetPixel SetTextColor SetBkMode DeleteObject CreateDCA CreateCompatibleDC SelectObject GetDIBits DeleteDC BitBlt

winspool.drv

GetPrinterA EnumPrintersA

advapi32

RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegCloseKey

ole32

StringFromGUID2 CoCreateInstance CoGetObject

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdA SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA

$TEMP/Inst_MaEPSBroker.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 92610b0132612e462f58dc17751cfc3d30d79ae5165ceb50f8a8b190019ce063
MD5 c5f3f1102c090da7e8661878db34074e
SHA1 91e68b8cce2cefb493edeba65dc2234030eb6bfa
SHA512 fe6c782cd796b253f47b1dea8712f4e44e87697ea0161438b9d78afe856a213ae78bb10367cf3308f76c2a346b73c4290e559c5d767d5ea70d667d86ef1e020f
SSDEEP 98304:r/x5Xl1jcl7mFsE8Nj/7T7UA1gdgmsQcEr/1D:r/x5V1I9gbE/UGgdJsQ/rd
TLSH
T12B1633476614D61AFF02663C32705D7BCF8728196280C58E5A0B426BBDD16BA8FEF0D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

6e:48:34:69:dc:b2:2a:38:4e:95:48:a8:74:a1:1b:ef:a9:a0:02:1f:b2:d9:08:74:3d:dc:cb:05:80:ef:ef:cf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 27, 2022

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

33:80:94:f1:b9:5a:ce:c8:42:e0:0a:3a:c8:91:bd:6f:8a:fa:c3:ab

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 27, 2022

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

07:b8:14:87:41:fc:84:53:9b:db:20:75:90:e3:a9:50

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2021 - Apr 30, 2024

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 9, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Minor OS version

0

Major OS version

4

Entry point

12812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/MaPlugins.dll

IMPHASH 6e49e7de735ce0e12d20ca1bb0162ee0
SHA256 2493fb5701a61ef0614756f3729b1637b61ed1ae194aa1972b7fd5b1381f1f81
MD5 c29d7c5e69585ee986e4bcbbad015ef8
SHA1 99990898e13fcc8416e2a47a121570c0debe47d3
SHA512 0b251fee20fbc853309540e17c252854c3fb98fd96c8c8f343f26702e0d6dc03e9498c2fb12cf9781cd20cb82b0219c6708f28849de82f389f2911c59ea559f3
SSDEEP 192:gXNDM6uB3FxUXt1R4urF1TO53X+Eq2EO87a:gNuB1xWR4eTOFuG78O
TLSH
T1AE120939EBD74062F66A0EF2AF9242D60BBC291337E6207BFB4104D90DD0684D8B0332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

5992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Users\mkSong\Desktop\MaPlugins\Release\MaPlugins.pdb

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
TLSH
T107324A5503604AF3E986843C086A3BBF6F796B2196F04E53DFA384C0EE6D5C96D78352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
TLSH
T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$R0

IMPHASH a997524d9ef4d7c2dd2c4e244d6458a2
SHA256 f50a2c5085cd68384352ffd51ad145d0af20b80d4ac7009c4ff5dcb5ec6508c7
MD5 605bf1f41579ad3216cc4e91e6b0792f
SHA1 546ff35f38d7ac57fb168e53dd016a16aed91ceb
SHA512 171e27ae3cf06e9b3f51483f543fe2c2dbcff4d72960f225e68e02736b8899dab3f88ba270d22628a06cad3bc766a9f27783f7869844d680184d2a7e341a698e
SSDEEP 49152:G2rzC5pfufEi9kRB/5glPrMESpeLGTSSDaDHQiiqpYdNfhQGQLA88pF/N:G2rGXf0RWRp5oBS9TSXFiJtZQM
TLSH
T19AF59D21D7018836F5A705B1447E877F6928BE301364E0C3E3C87DAA55F66E27A3AB47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
NSIS installer

installer

Digest

50:7a:7a:7a:23:5e:47:b3:05:a5:42:d1:9c:a9:44:57:c4:96:cd:a1:2a:b7:41:f4:5d:61:52:b9:fa:ba:76:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 27, 2022

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

f8:71:e3:ea:08:d1:fb:c9:74:20:6f:7c:8e:57:05:74:d6:a9:89:89

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 27, 2022

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

07:b8:14:87:41:fc:84:53:9b:db:20:75:90:e3:a9:50

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2021 - Apr 30, 2024

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 9, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Minor OS version

0

Major OS version

5

Entry point

2239651

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

h:\02.Dev\broker\MaEPSBroker\XHRSample\bin\MaEPSBroker.pdb

wininet

InternetQueryOptionA InternetCloseHandle InternetOpenA HttpSendRequestA HttpOpenRequestA InternetSetOptionA InternetReadFile InternetQueryDataAvailable InternetConnectA HttpQueryInfoA

ws2_32

getsockopt connect gethostname getsockname ntohs WSACreateEvent WSAEventSelect gethostbyname WSACloseEvent setsockopt WSAIoctl inet_ntoa ioctlsocket WSAWaitForMultipleEvents WSAResetEvent WSAEnumNetworkEvents WSASetEvent select shutdown getaddrinfo freeaddrinfo send recv getprotobyname __WSAFDIsSet closesocket accept listen socket bind WSAStartup inet_addr WSAGetLastError htons WSACleanup WSASetLastError

shell32

ShellExecuteExA SHGetFolderPathA SHGetSpecialFolderPathA

crypt32

CryptQueryObject CertFindCertificateInStore CertCloseStore CertGetNameStringA CryptMsgGetParam CryptMsgClose CertCreateCertificateContext CertGetCertificateContextProperty CryptDecodeObject CertNameToStrW CertOpenStore CertEnumCertificatesInStore CertDuplicateCertificateContext CertFreeCertificateContext CertSetCertificateContextProperty

shlwapi

StrStrIA PathFileExistsA PathAppendA PathFindFileNameA

user32

PostQuitMessage LoadIconA CreateWindowExA DefWindowProcA DispatchMessageA LoadCursorA RegisterClassA MessageBoxA GetMessageA GetUserObjectInformationW GetProcessWindowStation

ole32

CoInitializeEx CoUninitialize CoCreateInstance

kernel32

CopyFileA GetPrivateProfileStringA LoadLibraryA Process32Next LocalAlloc WritePrivateProfileStringA CreateToolhelp32Snapshot OutputDebugStringA CloseHandle LocalFree GetLocalTime GetCurrentThreadId CreateFileA SetUnhandledExceptionFilter GetCurrentProcess GetFileAttributesW GetModuleHandleA GetVersionExA GetCurrentProcessId Process32First WaitForMultipleObjects GlobalAlloc GlobalFree GetVersion WriteFile GetFileType GetStdHandle GetTickCount QueryPerformanceCounter GlobalMemoryStatus FlushConsoleInputBuffer SetLastError SystemTimeToFileTime GetProcAddress GetSystemTimeAsFileTime GetFileSize CreateFileW SetFilePointer ReadFile InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap FreeLibrary GetFullPathNameW GetFullPathNameA GetCurrentDirectoryA GetCurrentDirectoryW DeleteFileW DeleteFileA GetLastError CreateDirectoryA lstrlenW MultiByteToWideChar GetFileAttributesA GetSystemTime WideCharToMultiByte CreateThread CompareFileTime GetACP GetOEMCP GetComputerNameW FormatMessageA GetStartupInfoA SetFileAttributesA TerminateProcess UnhandledExceptionFilter IsDebuggerPresent SetFileAttributesW ExitProcess

advapi32

RegQueryValueExA CryptGenRandom CryptReleaseContext CryptAcquireContextA GetUserNameA CryptSignHashA CryptDestroyHash CryptSetHashParam CryptGetProvParam CryptEnumProvidersA CryptExportKey CryptGetUserKey CryptDestroyKey CryptCreateHash RegOpenKeyExA RegCloseKey DeregisterEventSource ReportEventA RegisterEventSourceA

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

wintrust

WinVerifyTrust

gdi32

GetStockObject

msvcr90

atol strcat_s _vscprintf fclose ??2@YAPAXI@Z _beginthreadex strncpy fprintf strcpy_s sscanf strchr _purecall strpbrk isspace strtok_s perror __iob_func exit strerror memcpy memset memmove strcmp qsort strtoul getenv wcsstr _exit raise _localtime64 strcspn realloc isdigit _errno _wfopen ferror fflush _setmode _fileno ftell feof fseek fgets isxdigit _strnicmp tolower strncmp isupper _gmtime64_s fputs signal _getch abort rand ___lc_codepage_func ___lc_handle_func strlen __CxxFrameHandler3 _CxxThrowException setlocale __uncaught_exception __crtLCMapStringA __pctype_func _calloc_crt islower _free_locale _stricmp _itoa memcmp strcpy toupper srand _tzset _mktime64 towlower towupper _telli64 _fseeki64 _filelengthi64 strcat ?terminate@@YAXXZ _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer _amsg_exit __getmainargs _cexit _XcptFilter _ismbblead _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler4_common _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ _invoke_watson _controlfp_s strrchr fwrite memcpy_s _vsnprintf fread ??_V@YAXPAX@Z fopen printf _invalid_parameter_noinfo vsprintf_s remove localeconv atoi memchr strstr malloc wprintf_s free ceil sprintf_s ??0exception@std@@QAE@ABV01@@Z ??0exception@std@@QAE@ABQBD@Z ??0exception@std@@QAE@XZ ??1exception@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ ??0bad_cast@std@@QAE@ABV01@@Z ??0bad_cast@std@@QAE@PBD@Z ??1bad_cast@std@@UAE@XZ sprintf memmove_s ??3@YAXPAX@Z _stat64i32 isalnum _time64

$TEMP/markany_ImageSafer.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 5d594159e5d235c5c84076e4d5fd0ebcb5c8d13fc613b840add27301a75c96db
MD5 b67266afbfe12eb465f014c09b562798
SHA1 8dbe1c2105228dc5755efd7b00d4444cf4c51203
SHA512 3e915a5b7cea594749272945e9a392ffa15f8c4bf313183fd1ad3c6b505ff1b36e46fe5ab8c0e4c51965db031f463774fc64997008a820e75ac3ec099f667491
SSDEEP 98304:npVZKBwnLNMBL9lv/qmES3jJ8itWLgY43FX20lWhad:npVZPMBnv/EsJ8itXFX20UI
TLSH
T1B92633017524AAB7D46976338D2BFB492E1BB9A32E91B81BC3CF9C22DD13241D21CD75
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
NSIS installer

installer

Digest

c1:25:d8:ed:66:46:be:82:5a:3c:06:14:fc:fe:39:28:38:3c:df:c2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 21, 2022

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

07:b8:14:87:41:fc:84:53:9b:db:20:75:90:e3:a9:50

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2021 - Apr 30, 2024

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Minor OS version

0

Major OS version

4

Entry point

13509

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/MaPlugins.dll

IMPHASH 9e313197693c09ccbc364fe3ad562a6d
SHA256 379a34474a239a118746a67170aa9c3aa22c86ac5b646ed58f2f3023639cc137
MD5 72d4d22b2f59af9e40333c6c35cd9da0
SHA1 4ae18123f36e08430de0d8cc934eb45ec4231ea3
SHA512 ed723e38a1fbe722c216cfbfa94bd8c956ac4e336edc00721adbbec9a015b1bf044121c5f2ea4e84873790e21ee22abdb327b7ed157a6f0d0730adcc56cc4d38
SSDEEP 96:XZ2XBx18a7e9itv2tgKN5zPdqc5lGm5DNQPBTI3XAp+RqR1xQj8OC7tCETP/z:J2XBx1B69i4ge8cymA5M3X+EqRO87TP
TLSH
T1DB12D728A6870126F65A0FF2BE9382964BBD7A1333E6207FF74501991DD0641E8B0776
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

5547

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Users\mkSong\Documents\Visual Studio 2008\Projects\VSBuild\MaPlugins\Release\MaPlugins.pdb

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
TLSH
T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
TLSH
T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$WINDIR/ImageSAFERSvc.exe

IMPHASH b7595e2389d64616ef929b1110bf24a1
SHA256 4574fbdb2cd737eea7299dc98653ed4acb07d710100ffd573c1b6e570a1aabb4
MD5 3b2955aac1d9fa353e2fe678ef0e1be4
SHA1 7c9018541e696ce6f1995a945009ca25aa915f9c
SHA512 ed42410b965e9635648af6df68f711fc49963e776e2504c3ac2da10708c8122fda57ed6c8b5f5a8e00a4edabf4dcd23e7d813285d1cc55a54a70f8134f65711b
SSDEEP 384:Ivb7hIh0WvVIw5RZNvQe8E9VF2ZsHL74ixZY1R:IXhg08T3CNE97BwR
TLSH
T1B7625D15CFD45806EFBB4EB034F9C2259F3572916B60C1F77226C0944B91B8268E53BE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
NSIS installer

installer

Digest

af:f4:94:59:33:b9:20:9f:df:cb:c0:f1:71:68:50:9a:77:51:13:3a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 21, 2022

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

07:b8:14:87:41:fc:84:53:9b:db:20:75:90:e3:a9:50

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2021 - Apr 30, 2024

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Minor OS version

0

Major OS version

5

Entry point

4788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\VisualStudio_build\VS2008\ImageSAFERSvc\Release\ImageSAFERSvc.pdb

$WINDIR/system32/$R0

IMPHASH b7595e2389d64616ef929b1110bf24a1
SHA256 4574fbdb2cd737eea7299dc98653ed4acb07d710100ffd573c1b6e570a1aabb4
MD5 3b2955aac1d9fa353e2fe678ef0e1be4
SHA1 7c9018541e696ce6f1995a945009ca25aa915f9c
SHA512 ed42410b965e9635648af6df68f711fc49963e776e2504c3ac2da10708c8122fda57ed6c8b5f5a8e00a4edabf4dcd23e7d813285d1cc55a54a70f8134f65711b
SSDEEP 384:Ivb7hIh0WvVIw5RZNvQe8E9VF2ZsHL74ixZY1R:IXhg08T3CNE97BwR
TLSH
T1B7625D15CFD45806EFBB4EB034F9C2259F3572916B60C1F77226C0944B91B8268E53BE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
NSIS installer

installer

Digest

af:f4:94:59:33:b9:20:9f:df:cb:c0:f1:71:68:50:9a:77:51:13:3a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 21, 2022

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=101-81-47345,CN=MarkAny Inc.,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

07:b8:14:87:41:fc:84:53:9b:db:20:75:90:e3:a9:50

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2021 - Apr 30, 2024

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Minor OS version

0

Major OS version

5

Entry point

4788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\VisualStudio_build\VS2008\ImageSAFERSvc\Release\ImageSAFERSvc.pdb

$WINDIR/system32/ImageSAFERFilter.dll

IMPHASH 0c22f1ef05bbf98cb2d1ad8bbbad4704
SHA256 4c6655db6e301c14715efc42693f6cf26e5f1e8166dd3680cd5a517d76ed14f3
MD5 6386a662e6da888e93b7e14ed117baec
SHA1 8ddec3bac3c6e748aaba1521f8c94b514b84f4ab
SHA512 0fd0b94d1418045f261f4f2e117191c021b62491911bd4ea71a497be82dc6fa3773ec833b2c2421b4ff6b553056cd3ffaaf759bca259e519d707a9fca43f2418
SSDEEP 3072:gbM/AyQhiGks7RN3JU8P6sebdcm6AICg/H4OtEmfgB8kCI:V4jRPT5Uvsu6ALWH4OtRzI
TLSH
T1BFF3E7007BE94139FABB273E5A766629253B79D88B34D6DF53981A4E5C30BC09C71323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

74005

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\SVN\ImageSAFERv4_ePage\IMGSFDeamon\Release\ImageSAFERFilter.pdb

kernel32

ProcessIdToSessionId OpenMutexW CreateMutexW GetSystemInfo GetModuleHandleW GetVersionExW UnmapViewOfFile GetCurrentThread lstrcmpiW GetSystemDefaultLangID SetErrorMode SetUnhandledExceptionFilter InterlockedDecrement GetCurrentProcess GetSystemWindowsDirectoryW CreateDirectoryW IsBadReadPtr IsBadWritePtr CreateFileW DisableThreadLibraryCalls IsWow64Process GetCurrentThreadId InterlockedIncrement GetFileSize ReadFile MultiByteToWideChar CreateFileMappingW GetThreadContext SetThreadContext InterlockedCompareExchange FlushInstructionCache VirtualAlloc VirtualProtect SuspendThread ResumeThread SetLastError GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter IsDebuggerPresent UnhandledExceptionFilter TerminateProcess Sleep InterlockedExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException LocalFree OpenFileMappingW MapViewOfFile GetModuleFileNameW VirtualQuery CloseHandle FreeLibrary GetProcAddress LoadLibraryW lstrlenW WaitForSingleObject ReleaseMutex FindResourceExW FindResourceW LoadResource LockResource SizeofResource lstrlenA OutputDebugStringA GetModuleFileNameA GetCurrentProcessId CreateDirectoryA GetLastError OutputDebugStringW

user32

UnhookWindowsHookEx CallNextHookEx GetKeyState FindWindowExW GetWindowThreadProcessId WindowFromDC GetDesktopWindow PrintWindow GetClassNameW GetParent OffsetRect CharNextW CloseClipboard SetWindowsHookExW SetClipboardData GetDC ReleaseDC GetSystemMetrics IsClipboardFormatAvailable RegisterClipboardFormatW EmptyClipboard GetActiveWindow GetForegroundWindow OpenClipboard GetClientRect CopyRect FillRect IsWindowVisible IsRectEmpty IntersectRect GetWindowRect SetRectEmpty IsWindow SetRect

gdi32

SetGraphicsMode GetObjectType BitBlt RectVisible DeleteObject GetStockObject CreateDCW CreateCompatibleDC CreateCompatibleBitmap SelectObject TextOutW SetBkMode SetTextColor GetDeviceCaps CreateFontW

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityInfo RegSetValueExW

shell32

SHGetFolderPathW SHGetFolderPathA

msvcp90

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ??1locale@std@@QAE@XZ ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z ??0locale@std@@QAE@PBDH@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?open@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXPBDHH@Z ?close@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??_D?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z ?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?uncaught_exception@std@@YA_NXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?setw@std@@YA?AU?$_Smanip@H@1@H@Z

shlwapi

StrStrIW StrRChrW PathFindFileNameA PathAppendA PathFileExistsA PathAppendW PathFindFileNameW StrRChrIW

msvcr90

memmove _CxxThrowException __CxxFrameHandler3 __clean_type_info_names_internal ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ _crt_debugger_hook _except_handler4_common __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _encoded_null _malloc_crt _decode_pointer _onexit _lock _encode_pointer __dllonexit _unlock strlen memcpy memset wcschr iswspace ??3@YAXPAX@Z memcpy_s ??2@YAPAXI@Z ??0exception@std@@QAE@ABV01@@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@ABQBD@Z memmove_s ??0exception@std@@QAE@XZ _invalid_parameter_noinfo _vsnprintf wcsnlen vswprintf_s _vscwprintf swprintf_s _vsnwprintf _wtoi _localtime64_s ??_V@YAXPAX@Z _time64 free wcsstr _local_unwind4

dbghelp

MiniDumpWriteDump

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Name

.text

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

HOOK01

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$WINDIR/system32/ImageSAFERLang.xml

SHA256 c913b94dfa14883461738f01330484a85d4c637795cef5bc9b06796b263fc579
MD5 f3e93ced4621ade06e32391019e169d6
SHA1 af82d54de05c4da3aa7a72f8f8fcc7c5529b6721
SHA512 a0b208c7dec95235beff02fd9cf2254995de36b02ad8bce43d94ab9f2cb1a52465cc4f65c25111e65120d237be2b495c295840e4491cffcb55afde35f795b302
SSDEEP 96:BXH+fAIoy7fE7o5YkXVKp80Ti7Jt91NC7:hg47
TLSH
T1C4C1600317FE822971B1AA4C59BA11699F2BFC104C3C815D40EC2A4D9FE3F918925BFB
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$WINDIR/system32/ImageSAFERMessage.exe

IMPHASH aeb857bd71b46876b5223f42b3601fcf
SHA256 88dd644cd20bfa195e75f691fa95453ca6367a1977844cc019125ad6bc8f20ab
MD5 1c16b1ef674cedd715d3a65d9581fa8c
SHA1 73e71c19f73f662748772814454ff0ed723f78a2
SHA512 e614d34d578dd826dba2dcc76b66a69541202af2610e3a8d878741e26051476879ec24383d4ac378252cce2c8be0152fff0d94f3e0f5cb28143f60cfa2b3212c
SSDEEP 384:Swvc/M4aVPbt/dSEYF/ilFwOujet1xq3UZU9w1xq3UZU9C4MG:bY0F9YFowOEedZU9qZU9f
TLSH
T1B2535F0266018864F35D0B316A16F9E4099A9E3C59E4F18FF57CBE3A6C721D39AB314F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

8559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\SVN\ImageSAFERv4 - 인증용4\IMGSFDeamon\ImageSAFERMessage\Release\ImageSAFERMessage.pdb

kernel32

LoadLibraryW GetProcAddress FreeLibrary ProcessIdToSessionId GetCurrentProcessId OpenProcess lstrcmpiW OutputDebugStringW CloseHandle SizeofResource LockResource LoadResource FindResourceW FindResourceExW SetUnhandledExceptionFilter GetSystemTimeAsFileTime GetCurrentThreadId GetTickCount QueryPerformanceCounter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW InterlockedCompareExchange Sleep InterlockedExchange DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc IsDebuggerPresent HeapDestroy

user32

MessageBoxW GetActiveWindow

shlwapi

PathFindFileNameW

msvcr90

__p__commode __p__fmode _encode_pointer __set_app_type _unlock __dllonexit _lock _onexit _decode_pointer _except_handler4_common _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _invoke_watson _controlfp_s _adjust_fdiv _configthreadlocale _initterm_e _initterm _wcmdln exit _XcptFilter _exit _cexit __wgetmainargs _amsg_exit memset free wcschr memmove_s memcpy_s ??3@YAXPAX@Z _CxxThrowException __setusermatherr __CxxFrameHandler3

$WINDIR/system32/ImageSAFERProcMon.dll

IMPHASH e052a5a1f98545f8ec5cb2f72074a304
SHA256 bc18d1f6d99628dbc9445765b551d4c2c7a0aa334fa3eb7820879c24e017f01e
MD5 c5bda27ab9c82ff49f62165516f1f03e
SHA1 381cfdcfcdc4a288c5bf69aed0620f6b220e77c0
SHA512 de8d344e3e939082f0cf4a24921cdb41d4c9063401169d680e0af1d217b05da0b103ca451f831e4bd6f3f3f72f5692ff111348cf7cd0c796f7636936225f403d
SSDEEP 1536:cOs+GkKMza8jVrYbcBI6zI6VR9A9eteqSwT9jm/VbhbTbatFFugjuLaGIgICS4A5:cO/GkKmaMIUH9DeqSwT9jm/VbhbTbat/
TLSH
T187935A003BE98972FAEA1B707936D70D6279BA614FB194DFA3561B4F0D306C1AC35326
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

39231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\SVN\ImageSAFERv4_ePage\IMGSFDeamon\Release\ImageSAFERProcMon.pdb

kernel32

CloseHandle TerminateThread CreateMutexW OpenMutexW WaitForSingleObject ReleaseMutex UnmapViewOfFile CreateFileMappingW OpenFileMappingW MapViewOfFile IsBadReadPtr Sleep SizeofResource LockResource LoadResource FindResourceW FindResourceExW LoadLibraryW GetProcAddress FreeLibrary OpenProcess CreateFileW GetCurrentProcess GetModuleHandleW ProcessIdToSessionId ConnectNamedPipe DisconnectNamedPipe FlushFileBuffers WriteFile GetNamedPipeInfo GetVersionExW DisableThreadLibraryCalls IsWow64Process GetSystemInfo MultiByteToWideChar InterlockedIncrement InterlockedDecrement GetFileSize ReadFile GetSystemTimeAsFileTime GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess OutputDebugStringW CreateDirectoryA GetCurrentProcessId GetModuleFileNameA OutputDebugStringA lstrlenW GetLastError lstrcmpiW lstrlenA LocalFree CreateNamedPipeW InterlockedCompareExchange InterlockedExchange DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetProcessHeap HeapSize HeapReAlloc HeapAlloc HeapFree HeapDestroy

user32

GetClassNameW GetWindowTextW IsWindow GetWindow GetDesktopWindow CharNextW GetWindowThreadProcessId

advapi32

RegQueryValueExW RegSetValueExW RegCloseKey RegOpenKeyExW RegCreateKeyExW SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

SHGetFolderPathW SHGetFolderPathA

shlwapi

PathFindFileNameA PathAppendA PathFileExistsA PathAppendW PathFindFileNameW StrStrIW

msvcp90

?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ?setw@std@@YA?AU?$_Smanip@H@1@H@Z ?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ?uncaught_exception@std@@YA_NXZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?close@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?open@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXPBDHH@Z ??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@XZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ??_D?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z ??1locale@std@@QAE@XZ ??0locale@std@@QAE@PBDH@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr90

vswprintf_s ??2@YAPAXI@Z ??0exception@std@@QAE@ABV01@@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@ABQBD@Z memmove_s ??0exception@std@@QAE@XZ _invalid_parameter_noinfo _vsnprintf swprintf_s _beginthreadex wcsnlen malloc free ??_V@YAXPAX@Z wcschr wcsstr iswspace memmove memset memcpy strlen _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _except_handler4_common _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal __CxxFrameHandler3 ??3@YAXPAX@Z _vscwprintf memcpy_s _CxxThrowException

psapi

GetModuleFileNameExW

Name

.text

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DUKS

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$WINDIR/system32/ImageSAFERRecovery.exe

IMPHASH 1a911ab7aa68b1ea68e5917a27d0e43f
SHA256 ee6c5fe451dcf57a2feb3e49f8ad607f0132f2e7b06f351c4d3bf102cc0ed8e8
MD5 1f9b2f80b4ee174ae6d1b9f9cb78b7de
SHA1 2d9ce48cb469f4963892b1d044d13f973f8ba65a
SHA512 2a765c5d26127b782747e8e293f3f19c5d8f8208bc62e8cad2361cb0f54fa31ce7fc0ee2eafd49707ce978ecb6151ceaef5d657cdb3e52fb206e110fcc1cc5b4
SSDEEP 768:HR41ZSYY14jb7Rf5VpdgpSOrTZU9qZU9rK:x47rY1WQAOrTpYK
TLSH
T15F7360126B128464F3590B711962FAE444AAAD3C2AE4F58FF57CBE3A29321D34D7314F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

13826

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\SVN\ImageSAFERv4_ePage\IMGSFDeamon\Release\ImageSAFERRecovery.pdb

kernel32

FindResourceW FindResourceExW lstrlenA WaitForSingleObject GetModuleHandleW GetProcAddress OutputDebugStringA SizeofResource GetCurrentProcessId CreateDirectoryA OutputDebugStringW GetVersionExW GetSystemInfo CreateProcessW LockResource LoadResource GetModuleFileNameA GetLastError GetSystemTimeAsFileTime GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedExchange Sleep InterlockedCompareExchange GetStartupInfoW RaiseException TerminateProcess

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

SHGetFolderPathA SHGetFolderPathW

shlwapi

PathAppendA PathFileExistsA PathAppendW PathFindFileNameA

msvcp90

??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@XZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??_D?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z ??1locale@std@@QAE@XZ ??0locale@std@@QAE@PBDH@Z ?close@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z ?uncaught_exception@std@@YA_NXZ ?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ?setw@std@@YA?AU?$_Smanip@H@1@H@Z ?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ?open@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXPBDHH@Z

msvcr90

_decode_pointer _amsg_exit __wgetmainargs _cexit _exit _XcptFilter exit _wcmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler4_common _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _invoke_watson _controlfp_s _onexit _lock _encode_pointer __dllonexit _unlock memset free _vsnprintf vswprintf_s _vscwprintf ??2@YAPAXI@Z wcsnlen memmove_s memcpy_s ??3@YAXPAX@Z __CxxFrameHandler3 _CxxThrowException

$WINDIR/system32/ImgsfProcPolicyForExe.xml

SHA256 cd13ebb19f879a350e37edbf6bbb7a1dac5ee030088b9707462701e9004ff4f4
MD5 14ca2dfc723a7c24fed0ecd97568f3f5
SHA1 dc5a1cfa4f3fa08c854c0c2ffef4a00df30d5575
SHA512 931568563a4cc84bf1dcfb9dc92b7fa4d516df82e71713f2ae6785928bffdb70ce046c5a60485add87628a14b8dc1bba5dc479c3c03615f056c79769141c9e3a
TLSH
T193412B900F70613980F9A0FE119D3AE9877642974FD3C9FE9350988285B1ACEAA311CE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$WINDIR/system32/ImgsfprocPolicy.xml

SHA256 7fb571415ca547f80106434ddb352766b82efe6b89a1a876d4fecf8ded28fdac
MD5 208c8aafb5e5cc2da63079eb2d5bdc6e
SHA1 47a122ebe757985311d3c6e1530034c400bb14f2
SHA512 1cd430be03aa9e41edebc617e68fe6cf7728b213d3ef995c5d862187c3ccf7e79ceb79a336087ee87fb181b9d9e5cfca1aab44ba353526bf00fe97010de7ad98
SSDEEP 96:rQt1tx5GXOyO2SuQf0PABvqr618myp6sHaySS/fM:8t1tSi2vQf+Ad1NJsHiSHM
TLSH
T1B1B1AF5A5073D91731F7AB4C12C4493D6877990CC5788E940E3254B69BD3C1C96E25D3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

setup_epagesaferrt.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/KillProcDLL.dll

kernel32

msvcrt

generic

$PLUGINSDIR/MaImgsfCheck.dll

kernel32

user32

advapi32

msvcr90

msvcp90

shlwapi

generic

$PLUGINSDIR/MaPlugins.dll

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/nsJSON.dll

wininet

kernel32

user32

generic

$PLUGINSDIR/nsProcess.dll

kernel32

generic

$SYSDIR/$R0

shlwapi

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

ole32

setupapi

generic

$TEMP/Inst_MaEPSBroker.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/MaPlugins.dll

kernel32

user32

msvcr90

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsProcess.dll

kernel32

generic

$R0

wininet