6d1a9e1b005ff74cf1353a3dcc1cd0c27b0f2d835ef2654d33b5c06607aa790d

Sharing

Copy URL Twitter E-mail

General

Target

6d1a9e1b005ff74cf1353a3dcc1cd0c27b0f2d835ef2654d33b5c06607aa790d
Size

684KB
MD5

2e12b6f8f5987aaea0c6a2beda8f33f0
SHA1

af1c2cb9e019a42f3b087ca26d8f865e977532dd
SHA256

6d1a9e1b005ff74cf1353a3dcc1cd0c27b0f2d835ef2654d33b5c06607aa790d
SHA512

6a0d9bb2f154b46b1e4d169a2ca84ac173b8feef85fe69e2a254619ab91ef41a9c89220ccaff1e676a5f6fa0b8f729af2493fb1b76de6e6a4870116dcaf4263c
SSDEEP

12288:2KmDOD84l0k8NH3YHKfkNGWko2aIN9w9oi0GDNzeBvsQlaBMn:2bDOD84l0k8NH3YYk0o/Irw990G8B0di

Score

N/A

Malware Config

Signatures

Files

6d1a9e1b005ff74cf1353a3dcc1cd0c27b0f2d835ef2654d33b5c06607aa790d
.exe windows x86

3c3e6ed9659d1b628cc1d236347c0564

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c5:74:8d:95:0b:58:55:c8:f1:29:13:00:ca:a2:1e:91
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/04/2015, 00:00

Not After

07/04/2016, 23:59

Subject

CN=PLANETA SOFT,O=PLANETA SOFT,POSTALCODE=196143,STREET=42 ul.Ordzhonikidze,L=St. Petersburg,ST=St. Petersburg region,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

64:6f:79:99:79:26:0b:b2:8c:71:10:5c:3b:32:67:59:d0:fa:6a:4b
Signer

Actual PE Digest

64:6f:79:99:79:26:0b:b2:8c:71:10:5c:3b:32:67:59:d0:fa:6a:4b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=PLANETA SOFT,O=PLANETA SOFT,POSTALCODE=196143,STREET=42 ul.Ordzhonikidze,L=St. Petersburg,ST=St. Petersburg region,C=RU

06/10/2022, 18:32
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

ToAsciiEx
CreateIconFromResourceEx
ShowWindowAsync
GetInputDesktop
GetWindowPlacement
GetWindowModuleFileNameW
KillTimer
ChangeMenuA
DispatchMessageW
SetUserObjectInformationW
UnregisterClassA
CopyRect
SetDlgItemInt
GetClipboardFormatNameA
GetKeyboardLayoutNameW
DefWindowProcA
SetDeskWallpaper
CharUpperBuffW
SetKeyboardState
PaintDesktop
RemovePropA
IsHungAppWindow
ModifyMenuW
SetSystemCursor
SetClassLongA
GetWindowThreadProcessId
MapVirtualKeyW
SetClipboardData
RemovePropW
CreateMDIWindowA
CharUpperA
GetProgmanWindow
SetRectEmpty
EnableMenuItem
IsZoomed
CharToOemW
LockWindowUpdate
AdjustWindowRect
TabbedTextOutA
LoadCursorFromFileW
DialogBoxIndirectParamW
RegisterDeviceNotificationW
CopyAcceleratorTableW
AnyPopup
GetClassInfoA
ShowOwnedPopups
MessageBoxExA
CharNextA
RegisterClassA
CreateCursor
ValidateRect
SetLayeredWindowAttributes
GetGuiResources
wvsprintfA
WindowFromPoint
SetWindowPlacement
GetMessageW
CascadeWindows
SendMessageW
SetLastErrorEx
EnumDesktopsW
CreateDialogIndirectParamW
UnionRect
LoadAcceleratorsW
InsertMenuW
SetWindowsHookW
SetWindowTextW
SendMessageTimeoutW
RemoveMenu
GetTitleBarInfo
BroadcastSystemMessageExA
AlignRects
GetClipboardFormatNameW
PostThreadMessageA
EnumDesktopWindows
CreateAcceleratorTableW
PrintWindow
TranslateAcceleratorW
DestroyWindow
DestroyCursor
GetCaretPos
CharUpperW
MapDialogRect
MessageBoxTimeoutA
DragDetect
GetWindowRgnBox
GetDlgItemInt
DrawMenuBar
GetMessageTime
IsCharLowerW
GetDlgItemTextA
MonitorFromWindow
WinHelpA
GetScrollInfo
FindWindowA
GetNextDlgGroupItem
FindWindowExW
GetActiveWindow
PrivateExtractIconExW
GetThreadDesktop
GetMessageExtraInfo
GetInternalWindowPos
GetWindowInfo
AttachThreadInput
GetInputState
DrawFocusRect
GetClassLongW
ChangeDisplaySettingsExA
GetMenuItemInfoA
DrawTextExA
GetUserObjectInformationA
BlockInput
DialogBoxParamW
ShowStartGlass
IsWindowUnicode
SetCaretBlinkTime
CharPrevA
CreateCaret
DefFrameProcA
GetMenu
CharNextW
LoadCursorFromFileA
GetMenuBarInfo
LoadKeyboardLayoutW
SetActiveWindow
SystemParametersInfoA
GetCursorPos
SetCapture
DrawMenuBarTemp
DrawIconEx
MessageBoxA
TileChildWindows
CheckMenuRadioItem
InflateRect
GetPropW
IsDialogMessageW
SwitchDesktop
GetKeyboardState
InsertMenuItemA
PeekMessageA
LoadCursorW
GetClassNameW
RealGetWindowClassW
CharToOemBuffA
PostMessageW
CopyAcceleratorTableA
GetDlgItemTextW
GetMenuStringA
GetTabbedTextExtentA
GetSysColorBrush
UpdateLayeredWindow
GetAltTabInfoA
GetListBoxInfo
CloseDesktop
PostThreadMessageW
SetWindowsHookA
EnumClipboardFormats
CharToOemBuffW
TileWindows
DlgDirSelectExA
GetCursor
AdjustWindowRectEx
InsertMenuItemW
GetWindowTextA
LoadIconW
BringWindowToTop
FindWindowExA
GetIconInfo
GetMouseMovePointsEx
SetScrollInfo
SetForegroundWindow
GetKeyNameTextA
GetDCEx
TabbedTextOutW
SetSysColors
IsCharUpperA
ScrollChildren
CallNextHookEx
GetClipboardOwner
EnableScrollBar
GetMenuItemRect
GetCaretBlinkTime
RealChildWindowFromPoint
LoadAcceleratorsA
ScrollWindowEx
LoadMenuW
IsCharAlphaA
GetKeyNameTextW
GetClipboardData
DispatchMessageA
TrackMouseEvent
SendNotifyMessageW
CloseClipboard
ModifyMenuA
GetCursorInfo
GetAncestor
SendDlgItemMessageA
ChangeDisplaySettingsW
SendDlgItemMessageW
SetClipboardViewer
SetParent
FillRect
MapVirtualKeyA
EnumDisplaySettingsA
CharUpperBuffA
GetMenuStringW
UnregisterDeviceNotification
GetWindowLongW
MessageBoxW
DlgDirListA
CheckRadioButton
EnumDisplaySettingsExA
CallMsgFilterA
SetScrollPos
IsCharAlphaNumericW
LoadBitmapW
UnloadKeyboardLayout
SetMenuItemBitmaps
LoadKeyboardLayoutA
GetMenuItemInfoW
CreateIconFromResource
SetThreadDesktop
GetWindowContextHelpId
EnableWindow
EndTask
MessageBoxExW
GetComboBoxInfo
RegisterClassExW
RealGetWindowClassA
GetClassNameA
AnimateWindow
BroadcastSystemMessageA
SetCursorPos
SetFocus
CreateDialogIndirectParamA
CharPrevExA
EndDialog
MessageBeep
LoadMenuIndirectW
GetMenuDefaultItem
GetProcessWindowStation
GetRawInputDeviceInfoW
LoadMenuA
WindowFromDC
DlgDirSelectExW
SetDlgItemTextW
OpenInputDesktop
DrawEdge
UnregisterClassW
GetWindowTextLengthA
GetUserObjectInformationW
FlashWindowEx
SystemParametersInfoW
MonitorFromRect
OemToCharBuffA
CreateIcon
LoadStringA
GetMenuState
IsWindow
GetWindowTextLengthW
GetParent
SetDoubleClickTime
GetSubMenu
CloseWindowStation
DefWindowProcW
IsCharAlphaNumericA
IsWindowEnabled
DrawFrame
EnumDesktopsA
DestroyAcceleratorTable
wsprintfW
GetScrollPos
SetMenuContextHelpId
SetWindowRgn
SendMessageTimeoutA
EnumPropsExA
GetMenuContextHelpId
PrivateExtractIconsW
GetClipboardViewer
GetKeyboardType
DialogBoxParamA
GetShellWindow
SubtractRect
DestroyIcon
OffsetRect
AllowForegroundActivation
UnhookWindowsHook
SetPropW
EndPaint
CharPrevW
EnumPropsW
RegisterClipboardFormatA
OemToCharBuffW
WaitForInputIdle
DrawCaptionTempW
MenuWindowProcA
ShowCaret
EnumPropsA
SetMenuInfo
DefFrameProcW
SetDlgItemTextA
CharToOemA
DestroyMenu
SendInput
GetMessageA
ValidateRgn
GetNextDlgTabItem
DrawTextA
ScrollWindow
RegisterWindowMessageW
GetSystemMenu
GetKeyboardLayoutNameA
BroadcastSystemMessageExW
RegisterClassExA
SetMenu
RedrawWindow
CascadeChildWindows
ScreenToClient
GetDlgItem
IsIconic
MoveWindow
IsDialogMessage
LoadBitmapA
SetTimer
GetTopWindow
DrawCaption
GetMenuItemCount

kernel32

TerminateProcess
VerLanguageNameW
DisconnectNamedPipe
IsValidLocale
FindAtomA
GetLocaleInfoA
UpdateResourceA
GetDiskFreeSpaceExW
RegisterWowExec
CreateEventW
BeginUpdateResourceA
CreateHardLinkW
GetNumberOfConsoleFonts
HeapDestroy
DeleteFileW
GetNativeSystemInfo
GlobalAddAtomW
EnumDateFormatsExA
SetTapePosition
GetConsoleCharType
InterlockedIncrement
LZSeek
GetConsoleMode
QueryPerformanceFrequency
LocalFlags
GetCommState
GetCommandLineA
GetComputerNameExA
GetProcessWorkingSetSize
CancelTimerQueueTimer
GetMailslotInfo
SetHandleInformation
TlsGetValue
VerLanguageNameA
MoveFileA
OpenEventA
GlobalFindAtomA
lstrlenA
RequestDeviceWakeup
IsValidCodePage
FlushFileBuffers
DeleteVolumeMountPointW
BackupWrite
EnumResourceLanguagesA
GetVolumePathNamesForVolumeNameA
MoveFileWithProgressW
Heap32ListNext
GetFileSize
lstrcmpA
GetPrivateProfileStructA
GlobalReAlloc
IsDBCSLeadByte
CreateMemoryResourceNotification
DeleteTimerQueue
ScrollConsoleScreenBufferA
FlushViewOfFile
LCMapStringW
FreeLibrary
EnumSystemCodePagesW
BuildCommDCBW
EnumTimeFormatsW
SetVolumeLabelA
FindAtomW
LCMapStringA
OpenFileMappingW
HeapQueryInformation
CreateSemaphoreW
GetProfileIntW
SetStdHandle
GlobalUnlock
EnumCalendarInfoA
GetEnvironmentStringsW
WriteProfileStringW
GetConsoleCursorInfo
DisableThreadLibraryCalls
GetProfileStringW
CompareStringA
GetConsoleDisplayMode
HeapSetInformation
lstrcmpiW
GlobalUnfix
FreeEnvironmentStringsW
GetFileSizeEx
MoveFileExW
InterlockedExchangeAdd
FindResourceW
RemoveDirectoryA
SetProcessWorkingSetSize
lstrcmp
LZStart
GetSystemInfo
GetProcessIoCounters
FindFirstChangeNotificationW
GetUserDefaultUILanguage
CreateActCtxW
GetDriveTypeA
CreateTapePartition
EnumResourceTypesW
HeapFree
OpenSemaphoreA
WideCharToMultiByte
GetPrivateProfileStringA
GetPriorityClass
SetTimeZoneInformation
MoveFileW
FindFirstVolumeW
OpenJobObjectA
LockFileEx
DeactivateActCtx
RestoreLastError
HeapAlloc
GetCurrentThreadId
GetProcessVersion
GetTickCount
QueueUserWorkItem
GetTapePosition
FoldStringW
GetFileAttributesA
FindNextChangeNotification
lstrcatA
CancelWaitableTimer
GetConsoleFontInfo
GetSystemTime
TransmitCommChar
CompareFileTime
FindFirstFileW
SetCurrentDirectoryW
ReadConsoleOutputCharacterW
GetConsoleHardwareState
EnumSystemLocalesW
VerifyVersionInfoW
VirtualQueryEx
InterlockedCompareExchange
LocalUnlock
GetCurrentThread
CreateThread
GetFileType
SetVolumeMountPointW
GetExpandedNameA
GetStringTypeExW
FileTimeToDosDateTime
WriteConsoleInputW
GetCPInfoExW
SetComPlusPackageInstallStatus
GetCurrentDirectoryW
GetFileAttributesExA
GlobalUnWire
GetDefaultCommConfigA
WaitForDebugEvent
GetCalendarInfoA
IsWow64Process
LoadResource
ReleaseSemaphore
FormatMessageA
FindNextFileW
WriteFileGather
CreateWaitableTimerW
FindFirstVolumeMountPointA
GetVolumePathNamesForVolumeNameW
SetThreadPriority
FindVolumeMountPointClose
OpenJobObjectW
WaitNamedPipeW
GetStringTypeExA
ExpandEnvironmentStringsW
EnumSystemLanguageGroupsA
ReadConsoleA
TryEnterCriticalSection
InterlockedDecrement
Sleep
MapUserPhysicalPages
SetFileValidData
GetVersionExW
SetThreadPriorityBoost
SetHandleCount
lstrcat
DosPathToSessionPathA
IsBadHugeReadPtr
LocalAlloc
CreateMailslotW
GetConsoleAliasesW
GetTempPathW
IsBadHugeWritePtr
ResetEvent
BackupRead
LocalCompact
VerifyConsoleIoHandle
GetPrivateProfileSectionNamesW
EnumResourceTypesA
GetHandleContext
GetBinaryTypeA
QueryMemoryResourceNotification
EnumCalendarInfoExA
LocalReAlloc
lstrcatW
CreateFileW
FindVolumeClose
UpdateResourceW
GlobalMemoryStatus
WritePrivateProfileStringW
AddAtomA
SetFileApisToANSI
GetPrivateProfileSectionA
GetPrivateProfileIntW
CreateDirectoryA
SetThreadContext
GetVersionExA
GetCompressedFileSizeA
GetSystemDirectoryA
ReadConsoleInputExW
SetProcessAffinityMask
CreateMailslotA
WriteConsoleOutputA
DeleteTimerQueueTimer
WriteProfileSectionW
GetFileAttributesW
GetExitCodeThread
TerminateThread
GetAtomNameA
LocalLock
LZCloseFile
PeekConsoleInputA
FileTimeToSystemTime
FindFirstChangeNotificationA
GetAtomNameW
GetNumberOfConsoleMouseButtons
GetExpandedNameW
IsBadStringPtrA
RtlZeroMemory
GetModuleHandleExW
GlobalHandle
OpenFileMappingA
SetLocaleInfoA
GetSystemDefaultLCID
QueryDosDeviceA
CopyFileW
SetVolumeMountPointA
HeapWalk
GetCalendarInfoW
WaitForMultipleObjects
ReadConsoleInputExA
CloseHandle
GetModuleHandleW
UnhandledExceptionFilter
LocalFree
CreateNamedPipeW
LZCreateFileW
GetUserGeoID
CreateDirectoryExA
GetCPInfoExA
LocalSize
MulDiv
GetDateFormatW
SetUnhandledExceptionFilter
BeginUpdateResourceW
SetFilePointerEx
CommConfigDialogW
GetFileInformationByHandle
InitializeCriticalSectionAndSpinCount
SetLastError
GlobalLock
PrepareTape
GetVersion
RtlUnwind
TransactNamedPipe
HeapValidate
BuildCommDCBA
DeleteFileA
LockFile
PeekConsoleInputW
GetConsoleOutputCP
SearchPathA
FindResourceExA
SetSystemPowerState
EnumSystemLanguageGroupsW
RtlCaptureStackBackTrace
GetACP
EndUpdateResourceW
GetCompressedFileSizeW
CommConfigDialogA
IsValidLanguageGroup
GetCurrentProcess
GetNumberFormatW
RtlCaptureContext
SetCommBreak
FillConsoleOutputCharacterW
GetCommConfig
LZCopy
ReadFile
DeleteAtom
GetDefaultCommConfigW
QueryActCtxW
GetDiskFreeSpaceExA
ExpandEnvironmentStringsA
GetOEMCP
SystemTimeToTzSpecificLocalTime
SleepEx
GetNumberFormatA
GetSystemDefaultUILanguage
DelayLoadFailureHook
SetCalendarInfoW
WritePrivateProfileStringA
SetVolumeLabelW
SetInformationJobObject
SetEnvironmentVariableA
BackupSeek
ProcessIdToSessionId
ShowConsoleCursor
GetThreadTimes
SetTimerQueueTimer
RemoveVectoredExceptionHandler
ReleaseActCtx
DefineDosDeviceW
GetConsoleCursorMode
MoveFileExA
DefineDosDeviceA
Beep
GetStartupInfoW
FatalAppExitA
GetEnvironmentVariableA
VerifyVersionInfoA
GetSystemTimeAdjustment
GlobalSize
FreeUserPhysicalPages
CreateSocketHandle
WaitCommEvent
IsBadWritePtr
SetThreadLocale
FlushConsoleInputBuffer
PrivCopyFileExW
InvalidateConsoleDIBits
GetSystemPowerStatus
ReadConsoleW
GetSystemTimeAsFileTime
WriteConsoleA
CopyFileA
FatalExit
GetEnvironmentVariableW
GetUserDefaultLangID
WaitNamedPipeA
HeapUnlock
EndUpdateResourceA
ConnectNamedPipe
GetProcessHeaps
InterlockedExchange
GetCurrencyFormatA
ReadFileEx
GetShortPathNameW
Heap32First
FindNextVolumeMountPointW
IsProcessInJob
ReadDirectoryChangesW
SetSystemTimeAdjustment
GlobalAddAtomA
MapViewOfFile
BuildCommDCBAndTimeoutsA
FreeConsole
FindResourceA
LockResource
WritePrivateProfileSectionW
lstrcpy
GetConsoleFontSize
OpenWaitableTimerW
FindFirstFileA
GetLogicalDriveStringsW
GetProcessPriorityBoost
lstrcmpi
HeapCreate
VirtualFreeEx
LZOpenFileW
EnumDateFormatsA
GetGeoInfoA
ChangeTimerQueueTimer
lstrcpyA
DosDateTimeToFileTime
LeaveCriticalSection
GetProcessHeap
GetLargestConsoleWindowSize
ActivateActCtx
OpenMutexW
FlushInstructionCache
InitializeCriticalSection
EnumCalendarInfoExW
WriteFileEx
OpenFile
SetProcessShutdownParameters
UnmapViewOfFile
GlobalFindAtomW
WriteConsoleOutputCharacterW
GetProfileSectionA
GetCurrentDirectoryA
SetUserGeoID
Heap32ListFirst
GetThreadSelectorEntry
GetSystemDefaultLangID
HeapLock
SetFileShortNameW
RegisterWaitForInputIdle
GetTimeZoneInformation
GetConsoleKeyboardLayoutNameW
TzSpecificLocalTimeToSystemTime
GlobalDeleteAtom
GetNamedPipeHandleStateA
CreateConsoleScreenBuffer
SystemTimeToFileTime
GetCurrentProcessId
GetVolumePathNameA
FindNextVolumeMountPointA
HeapCompact
GetModuleFileNameW
ReplaceFileA
GetUserDefaultLCID
WinExec
Heap32Next
SetWaitableTimer
SetPriorityClass
GetDateFormatA
EnumSystemLocalesA
GetVolumeNameForVolumeMountPointW
DeleteTimerQueueEx
OpenSemaphoreW
lstrcmpW
RegisterWaitForSingleObject
VirtualFree
ReadConsoleOutputA
GetConsoleTitleW
SignalObjectAndWait
GetExitCodeProcess
DosPathToSessionPathW
RtlMoveMemory
GetProcessHeap
MapViewOfFileEx
RtlZeroMemory
OpenWaitableTimerW
VirtualQuery
LoadLibraryA
LocalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

comdlg32

ReplaceTextA
dwOKSubclass
ChooseColorW
ChooseFontW
dwLBSubclass
PageSetupDlgW
ChooseColorA
FindTextA
ChooseFontA
FindTextW
GetFileTitleA
GetFileTitleW
PageSetupDlgA
CommDlgExtendedError
PrintDlgExW
LoadAlterBitmap
WantArrows
GetOpenFileNameA
PrintDlgW
GetSaveFileNameA
ReplaceTextW
GetOpenFileNameW
PrintDlgA
GetSaveFileNameW

oleaut32

VarI1FromR8
VarUI4FromI8
VariantCopy
VarI1FromUI2
GetActiveObject
VarCyFromR4
LoadRegTypeLib
SafeArrayRedim
VarCyFromBool
VarDateFromCy
VarUI4FromI4
VarCyMul
SafeArrayAccessData
OleCreatePictureIndirect
OleLoadPicturePath
SafeArrayDestroyDescriptor
VarUI4FromDisp
VarCyAdd
VarDateFromI4
VarBoolFromI2
SafeArrayPtrOfIndex
VarParseNumFromStr
VarUI4FromR4
VarDecFromCy
VarTokenizeFormatString
VarBoolFromR8
VarDecFromR8
VarUI1FromUI4
VarR4FromUI1
VarI8FromUI8
VarUI1FromDate
VarCyMulI4
RevokeActiveObject
VarDecFromUI8
SafeArrayGetUBound
VarDateFromI8
OleSavePictureFile
VarUI8FromUI4
VARIANT_UserUnmarshal
VarI2FromDate
VarBoolFromUI2
OleIconToCursor
VariantClear
VarDateFromUdate
VarI2FromDisp
VarSub
VarI1FromI4
GetErrorInfo
VarR4FromUI2
VarUI4FromI1
VarR4FromUI8
VarI4FromUI4
VarDateFromR4
VarI1FromDisp
VarR8FromI8
VarDecSub
VarI8FromCy
VarFix
VarI1FromDec
VarBoolFromDate
VarCmp
VarI1FromStr
SafeArrayCreateVector
VarR4FromStr
VarUI8FromDate
VarDecFromUI4
CreateDispTypeInfo
VarBoolFromDec
LPSAFEARRAY_UserMarshal
VarUI2FromUI1
VarR8FromUI8
VarUI4FromStr
OleCreatePropertyFrame
DllRegisterServer
VarUI1FromR8
VarDateFromR8
SafeArraySetRecordInfo
VarCyFromR8
DllUnregisterServer
VarUI1FromStr
VarCyNeg
LoadTypeLibEx
VarUI2FromR8
VarNot
VarDateFromUI1

winspool.drv

StartDocPrinterA
EnumFormsW
SetJobA
DeviceCapabilities
FindFirstPrinterChangeNotification
SetFormW
PerfClose
DeletePrinterKeyW
DEVICEMODE
AddFormA
SpoolerPrinterEvent
DevicePropertySheets
ConvertUnicodeDevModeToAnsiDevmode
ConfigurePortA
DeletePrinterDriverA
EnumJobsA
DeleteMonitorA
EndPagePrinter
SetPrinterDataExW
AddJobA
AddMonitorA
AddPrintProvidorW
ConvertAnsiDevModeToUnicodeDevmode
DeletePrintProcessorW
StartPagePrinter
CloseSpoolFileHandle
EnumPrintersW
SetFormA
GetDefaultPrinterW
PrinterProperties
AddPrinterW
SetPrinterDataW
AddFormW
AddPrinterA
DocumentEvent
AddMonitorW
PerfCollect
DeletePrinterDataW
DevQueryPrintEx
FreePrinterNotifyInfo
PrinterMessageBoxW
AddPrinterDriverExA
EnumPrinterDataExW
GetFormA
GetSpoolFileHandle
EnumPrinterKeyA
DeleteFormA
ResetPrinterA
StartDocDlgW
SetPrinterA
GetPrinterW
WaitForPrinterChange
OpenPrinterW
DeleteFormW
DeletePrinterDataExW
EnumPrinterDataExA
SetJobW
GetPrinterDataW
QuerySpoolMode
DeviceCapabilitiesA
AddPortW
DocumentPropertiesW
ScheduleJob
DeletePrinterDataA
EnumPrintProcessorDatatypesA
QueryColorProfile
GetPrintProcessorDirectoryA
WritePrinter
GetFormW
EndDocPrinter
DevQueryPrint
FlushPrinter
GetPrinterDataExW
EnumPrintProcessorsA
ConfigurePortW
DeviceCapabilitiesW

gdi32

CreateRectRgn
ExtCreatePen
PaintRgn
EnumFontFamiliesExA
DPtoLP
CreateEllipticRgn
SetMetaFileBitsEx
GetBkColor
GdiPlayDCScript
ResetDCW
CreateDIBitmap
CreateFontIndirectA
UpdateICMRegKeyA
GetEnhMetaFileA
CreatePenIndirect
GetICMProfileA
EngFindResource
EngReleaseSemaphore
EngUnlockSurface
GetTextExtentPoint32W
GetSystemPaletteEntries
FONTOBJ_pifi
CreateEnhMetaFileA
EudcUnloadLinkW
GetEnhMetaFilePixelFormat
SetFontEnumeration
GdiDllInitialize
GdiRealizationInfo
EngGradientFill
AddFontMemResourceEx
GetDCOrgEx
SelectBrushLocal
GdiInitializeLanguagePack
EqualRgn
RectVisible
GetCharABCWidthsW
GdiSetLastError
FloodFill
LineTo
GdiArtificialDecrementDriver
PtInRegion
OffsetRgn
BRUSHOBJ_hGetColorTransform
GetNearestColor
GetTextExtentPointW
CreateDIBPatternBrush
GetColorAdjustment
GetViewportExtEx
AngleArc
SetArcDirection
GetOutlineTextMetricsA
RemoveFontResourceExA
CreateMetaFileA
bMakePathNameW
RemoveFontResourceTracking
GetICMProfileW
GdiGetSpoolMessage
EngMultiByteToWideChar
CreateDCA
GetROP2
PlayEnhMetaFileRecord
GdiCreateLocalMetaFilePict
Escape
EngGetPrinterDataFileName
StretchBlt
GdiAddGlsRecord
GdiDeleteSpoolFileHandle
GdiSwapBuffers
GetTextMetricsA
GetStringBitmapW
GetEUDCTimeStampExW
PlayEnhMetaFile
GetMetaRgn
GetEnhMetaFileBits
GdiDrawStream
EngCreateDeviceSurface
ExcludeClipRect
FrameRgn
STROBJ_bGetAdvanceWidths
CreateBitmap
GdiPlayEMF
GetDCBrushColor

version

VerFindFileW
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
VerFindFileA
VerInstallFileW
VerLanguageNameW
VerLanguageNameA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

WSCInstallNameSpace
WSCEnableNSProvider
WSCGetProviderPath
WSARecvDisconnect
WSAGetServiceClassNameByClassIdA
WSAEnumProtocolsW
getsockname
recvfrom
WSAStringToAddressW
gethostbyname
WSAAsyncGetProtoByNumber
getpeername
getprotobyname
WSANtohs
select
WSASend
WSALookupServiceBeginW
WSAStartup
WSAEnumNetworkEvents
WSAGetLastError
accept
WSASocketW
WSANSPIoctl
bind
WSAWaitForMultipleEvents
WSADuplicateSocketA
WSALookupServiceEnd
shutdown
sendto
WSAEnumProtocolsA
WSAAsyncGetHostByName
WSASendTo
WSAIoctl
ntohs
WSAHtons
WSACleanup
inet_ntoa
WSAInstallServiceClassA
WSAEventSelect
gethostname
getprotobynumber
WSAUnhookBlockingHook
WSAAsyncGetHostByAddr
htonl
getsockopt
WSACancelBlockingCall
WSAEnumNameSpaceProvidersW
ntohl

comctl32

ImageList_DrawIndirect
ImageList_LoadImageW
InitializeFlatSB
ImageList_GetFlags
InitCommonControlsEx
InitCommonControls
ImageList_GetImageRect
ImageList_GetIcon
CreatePropertySheetPage
ImageList_SetIconSize
FlatSB_GetScrollPos
ShowHideMenuCtl
ImageList_SetOverlayImage
FlatSB_GetScrollProp
ImageList_GetImageInfo
DrawInsert
ImageList_DrawEx
FlatSB_SetScrollInfo
PropertySheetW
ImageList_GetImageCount
ImageList_ReplaceIcon
CreateMappedBitmap
GetEffectiveClientRect
ImageList_Merge
ImageList_SetDragCursorImage
CreateToolbarEx
CreateUpDownControl
ImageList_GetDragImage
ImageList_Write
DllGetVersion
MenuHelp
CreateStatusWindowW
ImageList_GetBkColor
ImageList_SetFlags
ImageList_DragMove
MakeDragList
ImageList_DragEnter
FlatSB_SetScrollProp
ImageList_Duplicate
ImageList_Read
ImageList_EndDrag
ImageList_Destroy
ImageList_DragShowNolock
DestroyPropertySheetPage
ImageList_DragLeave
DrawStatusTextA
DrawStatusText
ImageList_GetIconSize
CreateToolbar
ImageList_LoadImage
ImageList_Create
ImageList_Add
ImageList_Copy
PropertySheet
ImageList_SetImageCount
ImageList_AddMasked
ImageList_SetBkColor
ImageList_Remove
CreateStatusWindowA
LBItemFromPt
DrawStatusTextW
ImageList_AddIcon
InitMUILanguage
ImageList_LoadImageA
FlatSB_SetScrollPos

Exports

Exports

��M�k��\1��M��voC��JJ/��t_>�(�}hq*�6$�$�ik�c�V��1g�ү}&��ۖ��LD��g�Lq�{� Z�nZ�{ Q�[U�W��3�,%��l�L��ۦC�r��1�g �Cx�n�Yjڮ�K��T��^f�(�}�k~�A��(vc؁`6d�̴B۩ �� ^��E.¹��+��:w�>[{<��;ݾ�էo"�6jw��7mZ�� z��"~��E�9�fk?��v��U!�L��ϼ�_�i��QS�"B�pdO3/!�8B:�ޛ��U��=��͑��D0uԠ�o� ��82��Py&)��,��/1ߵѶ� ��k��4�G#�ͼ=8)��̞M ��]�O� �\Ҙ�_��K�w�n_��HIح��9�q��<�3�2�g��Z=�Ḋ��Y��R��F\�&�07��Ͳ�6��ofF�rt�ҭY�O(0�⺅~�^K�2�G�>�7t2��X� W)AL�O��Ț��e�v쵥іqw)�;�8��$i��uP4�bˡ�nа �⚋J��.,��DiK��z�Ú�7��YNp��Wʂ!�YT3� ��q�|+�3�, ��ѐ��#�e��r��R��"��M!\�]$g��.��L҂��9��h�X٤Җ�..��+��}w��Őn��n_��s��?,�Lw��8X^%�,p�չ��mh�� D�Qc��_XJC*�F��ܰ{0/��2Ȭ>� �P��ج9�*�_��1!%��s>Wd��5&F�S}��@�� A��(�ܤFɈE*��.a<��s;==��D�~zPS=�RH�8i-9�%!��l ?��z��}�'�ah�p��f�;��Eg�}`��K�땜hh,��9��}��D�ÿw�F/��E��k �~bU5�j��)-��? ��*��&Ƶ!8*?ș�{_Э��P|L��A4W��7�h��F��v蘋XE�m�a�3��D��V�H �$=$�Le��ۚX��)��(��T��#^��Bs� ��JϘ�V��ٴ��*^b��s��T'N��6�6�GsR)��T��C��ttE΋@��L�c�i�H孴��L�/�<�m��"��t��n濹��׸ϧ��*�$I��WK�k7b6�ɠ��N��j��Pp��ƨ��6��-�p'�[/4�9^��Yk��$F*+)��Bğ �1�l _�+�(2�_2� 8=@��r�<V��%�$v�W��t.��sI_�BDsм[)1+ˊ��l,��1�<E E=a!�?]1 �ӟ�j��E��Gg��Z4�4tM��k��#�z��䩉z |��V�6]^�� i��J[T�aLs�t�{eϺ؜us��݉gѝ[yXf�>P$��7l�X��e�n:�h��I��+B��h� �]6Ĺ2:��8��b�]V�CN�`��(��U�S'�ײ��p/ޢ@�BP��i(S9T��w< -�2sL�"�Frˮ�)�f-֭Rn1��m�3Tl�-��µ�-��ʉ�� j� v��0�c�\@��4�pA>�@��|��W��B�F¬�@F��(�Xeΐ:D�( cP�C󝎼�(̑��Lùr��4�c|��lĎ�8��?x�`|�~F��.��x��7�ϾI2B�Vi/�i�]tR�Ƈt'N�+��v[��b��NQG",,$�d��=�T�]�� #�xv��ps��o�6��Z g�Xe�� r\׈TW$�ʨ��%7'%��B;0Z�Y��sY� �<�ͫ�axU��(npi�H�c��W�I��Y�{<�E^`ŏ��T�'��#5(�I]?��_�aH!f�5��~�G�|*a? �q��ے+��E�Mc�[�PƐ[&�ݫ�N6��sv��#��%��*G�ig0�l-7��y��Ϛ��K��׫��Ơ�l@�\��;zp��)��*�WyG��15�&��H2v�s0�&:"[��a�g�� Q<E�+l�G/�s��o*��8�V#��`�󳴢�)52��6ѽ5@� x]��ᙚH��a\��!�">m$3�ǒ�v��Ql�;��TK�|�,��Y!��(=��S�kKN��v��đ^CS*��=}��~t��&-�^[�x*�Ǚ_WI�o��s �� v��:�;93�Ax��k��\�Q��8r��˘W�vn��Ӌ��53�LK8��z�J�ƺ��r�ͮ�l��ZV�1/��(z��,Z￭� �Y�?�b�0`�wT��?�B��\�<5�J�fV+��j��(f37��.��;��׉%��c�(˶P��+~5��z�kK?�e�+�l�C��iM��p]*��~�*��A*H�Q��u��%��ɰ�Ü�X��h^��51 ��(Aađs{؆��:� K��m��z�=��}�?��ۃǥޙ'/�� Q�4��{��n�P��1��mCl��B��u!��w'�DBԻ��&:��Xц��f#z��Z0��VQ��,��P��DS��2^�0��Մwr�@4�%Ш�&^]��SO�+z�j� Ò�ж櫊��%��CZ��u��b��?�i�Ѹ�N�Z��5��ɳx�^��l;�!V�u��)��ƻ�t��N��=��8(�}m�f��>��@�n��2k��5��63��U�}hl`�>8��=tp��=|C3�,ę-�o|��Vm�łztx��+D |ᢎ�T�Q]�ael�t��[W��B��6��/)4⼸D݊&��h�J�

Sections

CODE
Size: 462KB - Virtual size: 461KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3c3e6ed9659d1b628cc1d236347c0564

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

c5:74:8d:95:0b:58:55:c8:f1:29:13:00:ca:a2:1e:91Certificate

Extended Key Usages

Key Usages

64:6f:79:99:79:26:0b:b2:8c:71:10:5c:3b:32:67:59:d0:fa:6a:4bSigner

Signature Validations

Verification

06/10/2022, 18:32 Valid: false

Headers

File Characteristics

Imports

user32

kernel32

comdlg32

oleaut32

winspool.drv

gdi32

version

ws2_32

comctl32

Exports

Exports

Sections

CODE Size: 462KB - Virtual size: 461KB

.data Size: 21KB - Virtual size: 20KB

BSS Size: - Virtual size: 1KB

.idata Size: 27KB - Virtual size: 26KB

.text0 Size: 13KB - Virtual size: 13KB

.tls Size: 512B - Virtual size: 24B

.text1 Size: 88KB - Virtual size: 88KB

.reloc Size: 11KB - Virtual size: 11KB

.rsrc Size: 53KB - Virtual size: 53KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

c5:74:8d:95:0b:58:55:c8:f1:29:13:00:ca:a2:1e:91
Certificate

64:6f:79:99:79:26:0b:b2:8c:71:10:5c:3b:32:67:59:d0:fa:6a:4b
Signer

06/10/2022, 18:32
Valid: false

CODE
Size: 462KB - Virtual size: 461KB

.data
Size: 21KB - Virtual size: 20KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 27KB - Virtual size: 26KB

.text0
Size: 13KB - Virtual size: 13KB

.tls
Size: 512B - Virtual size: 24B

.text1
Size: 88KB - Virtual size: 88KB

.reloc
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 53KB - Virtual size: 53KB