General

Malware Config

Signatures

Files

• Setup.exe

  .exe windows:6 windows x86 arch:x86

  fc0d8ac831316f17cc2e481a4218dd73

  
  

  Code Sign

  0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  13-01-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0b:be:02:c8:83:8f:bf:02:ab:56:ed:ab:b1:e3:4c:19

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  22-10-2021 00:00

  Not After

  22-10-2024 23:59

  Subject

  SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  77:9e:b3:42:e4:a7:23:1b:7e:75:5f:70:f0:ed:6a:03:9f:cb:bb:36:ae:20:a5:60:a1:ae:20:d6:89:32:af:ab

  Signer

  Actual PE Digest

  77:9e:b3:42:e4:a7:23:1b:7e:75:5f:70:f0:ed:6a:03:9f:cb:bb:36:ae:20:a5:60:a1:ae:20:d6:89:32:af:ab

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  D:\Jenkins\workspace\AURAServiceSetup\Release\LightingService.pdb

  Imports

  powrprof

  CallNtPowerInformation

  avrt

  AvSetMmThreadCharacteristicsW

  AvRevertMmThreadCharacteristics

  winmm

  timeKillEvent

  timeSetEvent

  timeGetDevCaps

  timeEndPeriod

  timeBeginPeriod

  wtsapi32

  WTSEnumerateSessionsW

  WTSFreeMemory

  WTSQueryUserToken

  userenv

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  kernel32

  FlushFileBuffers

  ReadFile

  WriteFile

  PeekNamedPipe

  DecodePointer

  RaiseException

  InitializeCriticalSectionEx

  DeleteCriticalSection

  GetCurrentDirectoryW

  CreateThread

  SetThreadPriority

  TerminateThread

  GetExitCodeThread

  ResumeThread

  GetCurrentProcessId

  GetCurrentThreadId

  GetCommandLineW

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  GetModuleHandleW

  LoadLibraryExW

  LoadResource

  SizeofResource

  FindResourceW

  SetDllDirectoryW

  GetEnvironmentVariableW

  HeapDestroy

  HeapAlloc

  HeapReAlloc

  HeapFree

  HeapSize

  GetProcessHeap

  LocalFree

  FormatMessageW

  GetPrivateProfileStringW

  GetPrivateProfileSectionNamesW

  CreateDirectoryW

  GetFileAttributesW

  LocalAlloc

  lstrcmpW

  GetSystemTimes

  FormatMessageA

  GetWindowsDirectoryW

  FindResourceExW

  LockResource

  SetThreadExecutionState

  GetFileAttributesExW

  WritePrivateProfileStringW

  SetWaitableTimer

  CancelWaitableTimer

  WaitForMultipleObjects

  CreateWaitableTimerW

  DeleteFileW

  SetEnvironmentVariableW

  GetFullPathNameW

  FileTimeToSystemTime

  SystemTimeToTzSpecificLocalTime

  GetFileType

  GetDriveTypeW

  VirtualQuery

  GetModuleHandleExW

  ExitThread

  RtlUnwind

  UnregisterWaitEx

  QueryDepthSList

  InterlockedFlushSList

  InterlockedPushEntrySList

  InterlockedPopEntrySList

  ReleaseSemaphore

  VirtualFree

  VirtualProtect

  VirtualAlloc

  GetVersionExW

  OutputDebugStringW

  GetTickCount64

  QueryPerformanceFrequency

  QueryPerformanceCounter

  GetModuleFileNameA

  CreateEventW

  ResetEvent

  SetEvent

  lstrcmpiW

  SetThreadAffinityMask

  GetCurrentThread

  TerminateProcess

  GetLastError

  DuplicateHandle

  WaitForSingleObject

  CloseHandle

  GetModuleFileNameW

  FreeLibrary

  WideCharToMultiByte

  MultiByteToWideChar

  GetModuleHandleA

  GetTickCount

  GetSystemInfo

  GetCurrentProcess

  LoadLibraryW

  GetProcAddress

  Sleep

  ExitProcess

  GetStdHandle

  GetFileSizeEx

  GetConsoleMode

  ReadConsoleW

  GetDateFormatW

  FreeLibraryAndExitThread

  GetThreadTimes

  UnregisterWait

  RegisterWaitForSingleObject

  GetProcessAffinityMask

  GetNumaHighestNodeNumber

  DeleteTimerQueueTimer

  ChangeTimerQueueTimer

  CreateTimerQueueTimer

  GetLogicalProcessorInformation

  GetThreadPriority

  SignalObjectAndWait

  CreateTimerQueue

  InitializeSListHead

  GetStartupInfoW

  IsDebuggerPresent

  IsProcessorFeaturePresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  GetCPInfo

  GetSystemTimeAsFileTime

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  SetLastError

  EncodePointer

  AcquireSRWLockShared

  AcquireSRWLockExclusive

  ReleaseSRWLockShared

  ReleaseSRWLockExclusive

  SwitchToThread

  WaitForSingleObjectEx

  GetStringTypeW

  AreFileApisANSI

  SetFilePointerEx

  SetEndOfFile

  GetFileInformationByHandle

  FindNextFileW

  FindFirstFileExW

  FindClose

  TryEnterCriticalSection

  CreateFileW

  GetTimeFormatW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetConsoleCP

  SetStdHandle

  GetTimeZoneInformation

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  RemoveDirectoryW

  user32

  CreateWindowExW

  TranslateMessage

  DispatchMessageW

  RegisterPowerSettingNotification

  PostThreadMessageW

  DefWindowProcW

  PostQuitMessage

  RegisterClassExW

  DestroyWindow

  ShowWindow

  CharUpperW

  CharNextW

  UpdateWindow

  MessageBoxW

  LoadCursorW

  LoadIconW

  RegisterDeviceNotificationW

  UnregisterDeviceNotification

  wsprintfW

  LoadStringW

  MessageBoxA

  GetMessageW

  gdi32

  GetObjectW

  DeleteObject

  advapi32

  RegisterServiceCtrlHandlerW

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  SetNamedSecurityInfoW

  RegCloseKey

  RegCreateKeyExA

  RegOpenKeyExA

  RegQueryInfoKeyA

  RegQueryInfoKeyW

  RegQueryValueExA

  RegQueryValueExW

  RegSetValueExW

  BuildTrusteeWithSidW

  GetNamedSecurityInfoW

  GetAce

  FreeSid

  EqualSid

  DeleteAce

  AllocateAndInitializeSid

  CreateProcessAsUserW

  RegEnumValueW

  StartServiceW

  StartServiceCtrlDispatcherW

  SetServiceStatus

  OpenServiceW

  OpenSCManagerW

  DeleteService

  CreateServiceW

  ControlService

  CloseServiceHandle

  ChangeServiceConfigW

  RegEnumKeyExW

  RegDeleteValueW

  RegDeleteKeyW

  ReportEventW

  RegisterEventSourceW

  DeregisterEventSource

  RegCreateKeyExW

  RegOpenKeyExW

  ole32

  CoRevokeClassObject

  CoAddRefServerProcess

  CoRegisterClassObject

  CoUninitialize

  CoInitializeEx

  CLSIDFromProgID

  CoReleaseServerProcess

  CoInitializeSecurity

  StringFromGUID2

  CoTaskMemAlloc

  CoTaskMemRealloc

  CoTaskMemFree

  StringFromCLSID

  CLSIDFromString

  PropVariantClear

  CoCreateInstance

  CoResumeClassObjects

  oleaut32

  SysAllocString

  VarUI4FromStr

  LoadTypeLi

  LoadRegTypeLi

  RegisterTypeLi

  GetErrorInfo

  UnRegisterTypeLi

  SysStringByteLen

  SafeArrayGetUBound

  SafeArrayGetLBound

  SafeArrayGetElement

  VariantInit

  SysFreeString

  VariantClear

  SysStringLen

  ws2_32

  WSAStartup

  WSACleanup

  WSAGetLastError

  setsockopt

  htonl

  inet_addr

  socket

  send

  recv

  htons

  connect

  closesocket

  inet_pton

  crypt32

  CertCloseStore

  CertFindCertificateInStore

  CertFreeCertificateContext

  CertGetNameStringW

  CryptMsgGetParam

  CryptMsgClose

  CryptQueryObject

  shlwapi

  PathFileExistsW

  StrCpyNW

  PathFileExistsA

  pdh

  PdhOpenQueryW

  PdhGetFormattedCounterValue

  PdhAddEnglishCounterW

  PdhCollectQueryData

  PdhCloseQuery

  wintrust

  WinVerifyTrust

  Sections

  .text

  Size: 3.6MB - Virtual size: 3.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 771KB - Virtual size: 771KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 39KB - Virtual size: 114KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  _RDATA

  Size: 512B - Virtual size: 32B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1.2MB - Virtual size: 1.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ