c6b801ec3a6afd76850db62fc02f0ecbd64875f6024d476054c3db7ce8439642

Sharing

Copy URL Twitter E-mail

General

Target

c6b801ec3a6afd76850db62fc02f0ecbd64875f6024d476054c3db7ce8439642
Size

3.2MB
MD5

4b507ba27b3beddefe0dc13c0cbdaf30
SHA1

95f7de836b06a1e99203038c73a89e15408bb8fc
SHA256

c6b801ec3a6afd76850db62fc02f0ecbd64875f6024d476054c3db7ce8439642
SHA512

37c33ff50aef4428e2c0a85274b5d71e998439bf262b489685c9534ffa6acc845cc2e138ec83ccee22c9ae57230e3b68bb209c378e616c4792ddb814b7d8419e
SSDEEP

98304:a/MjGL2vMNwZPq56FLOAkGkzdnEVomFHKnP60:a/MjGLMMNWPq56FLOyomFHKnP

Score

N/A

Malware Config

Signatures

Files

c6b801ec3a6afd76850db62fc02f0ecbd64875f6024d476054c3db7ce8439642
.exe windows x86

6ac12687a1a81a8759bc36ca38fe9ccd

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6a:ca:86:70:b0:4d:be:57:46:f5:b4:4d:30:b8:b9:06
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24/01/2018, 00:00

Not After

23/01/2021, 23:59

Subject

SERIALNUMBER=914403000671618022,CN=深圳乐播科技有限公司,OU=事业部,O=深圳乐播科技有限公司,L=深圳,ST=广东,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6a:ca:86:70:b0:4d:be:57:46:f5:b4:4d:30:b8:b9:06
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24/01/2018, 00:00

Not After

23/01/2021, 23:59

Subject

SERIALNUMBER=914403000671618022,CN=深圳乐播科技有限公司,OU=事业部,O=深圳乐播科技有限公司,L=深圳,ST=广东,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:4f:fb:bf:3f:ff:9b:35:9b:da:e4:37:dc:23:24:76:d6:ec:cf:2b:38:7f:71:41:69:b1:25:7b:da:05:c1:e4
Signer

Actual PE Digest

3d:4f:fb:bf:3f:ff:9b:35:9b:da:e4:37:dc:23:24:76:d6:ec:cf:2b:38:7f:71:41:69:b1:25:7b:da:05:c1:e4

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=914403000671618022,CN=深圳乐播科技有限公司,OU=事业部,O=深圳乐播科技有限公司,L=深圳,ST=广东,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

05/09/2019, 07:34
Valid: false

58:1e:aa:bf:e0:36:19:50:db:7b:1e:29:2e:b6:c3:17:72:b8:b2:44
Signer

Actual PE Digest

58:1e:aa:bf:e0:36:19:50:db:7b:1e:29:2e:b6:c3:17:72:b8:b2:44

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=914403000671618022,CN=深圳乐播科技有限公司,OU=事业部,O=深圳乐播科技有限公司,L=深圳,ST=广东,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

05/09/2019, 07:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc140u

ord2409
ord290
ord1045
ord280
ord296
ord1523
ord1525
ord4815
ord2246
ord7441
ord1002
ord1476
ord6220
ord13756
ord3305
ord3302
ord8210
ord2761
ord14785
ord12762
ord2886
ord5583
ord8177
ord4735
ord4715
ord1144
ord503
ord12921
ord1687
ord6533
ord9476
ord11038
ord1391
ord890
ord8773
ord2215
ord6973
ord1526
ord8470
ord8386
ord12865
ord8324
ord5357
ord2486
ord12541
ord12542
ord14589
ord7922
ord14595
ord9398
ord4152
ord4090
ord12947
ord7941
ord2034
ord11982
ord11983
ord14466
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord3852
ord12239
ord12247
ord8217
ord10433
ord12251
ord12219
ord12928
ord5763
ord10250
ord6860
ord2256
ord5918
ord4589
ord13911
ord7313
ord13442
ord952
ord2205
ord7997
ord1472
ord995
ord7653
ord10379
ord14403
ord14416
ord6316
ord4093
ord1143
ord501
ord4499
ord2562
ord8719
ord12641
ord1690
ord3849
ord12313
ord12314
ord11995
ord1175
ord545
ord9235
ord12173
ord9418
ord8776
ord10472
ord7495
ord1113
ord6489
ord1111
ord462
ord4799
ord362
ord1068
ord2865
ord6865
ord6812
ord498
ord5074
ord277
ord2473
ord3846
ord8031
ord13062
ord5026
ord5027
ord5029
ord5025
ord5024
ord533
ord1168
ord3179
ord8821
ord9226
ord5528
ord12104
ord2680
ord6876
ord9692
ord3304
ord13754
ord6219
ord8304
ord11275
ord11278
ord9509
ord9524
ord9514
ord9986
ord9991
ord9526
ord11117
ord10504
ord8920
ord8912
ord11746
ord9529
ord11122
ord9011
ord11146
ord10047
ord10048
ord7787
ord6942
ord11482
ord10316
ord11524
ord10404
ord11881
ord10040
ord9488
ord10276
ord11244
ord11733
ord10349
ord10249
ord11734
ord10312
ord11605
ord11164
ord9262
ord9500
ord9501
ord11677
ord11167
ord10984
ord11894
ord11678
ord10738
ord11603
ord10282
ord11657
ord8825
ord2551
ord4053
ord8826
ord4649
ord7151
ord7508
ord12179
ord11180
ord450
ord1108
ord2520
ord3864
ord13256
ord13963
ord928
ord1412
ord8225
ord7107
ord4485
ord4882
ord13544
ord5533
ord13070
ord3954
ord6528
ord13261
ord13775
ord12558
ord12578
ord12953
ord12867
ord13095
ord13087
ord13289
ord14047
ord13694
ord14115
ord8881
ord14112
ord13019
ord14123
ord13022
ord5210
ord7109
ord6956
ord4664
ord12131
ord11396
ord4092
ord3404
ord3403
ord3164
ord6218
ord13752
ord2760
ord9210
ord8817
ord1450
ord974
ord2383
ord8032
ord285
ord5921
ord3009
ord266
ord2182
ord2181
ord4663
ord13257
ord8757
ord13964
ord8360
ord14409
ord12763
ord14415
ord3957
ord6486
ord14606
ord2899
ord11972
ord1449
ord973
ord2990
ord1511
ord2385
ord2389
ord8756
ord12884
ord2996
ord1693
ord12932
ord4886
ord14234
ord286
ord9468
ord2750
ord14137
ord2885
ord1692
ord12351
ord265
ord5886
ord11962
ord1142
ord500
ord1689
ord3171
ord2522
ord3833
ord7654
ord6566
ord3882
ord2304
ord6559
ord1066
ord6490
ord9126
ord3145
ord4219
ord1133
ord6549
ord9209
ord10255
ord8219
ord5409
ord7712
ord7723
ord7722
ord6129
ord5228
ord5411
ord5252
ord5790
ord5525
ord9350
ord5760
ord5549
ord5249
ord12168
ord3265
ord3371
ord3372
ord3941
ord12124
ord2682
ord5935
ord13703
ord11717
ord6877
ord14596
ord7923
ord14590
ord3055
ord4494
ord9693
ord4502
ord4988
ord4927
ord4912
ord4974
ord5019
ord4942
ord4997
ord5013
ord4954
ord4960
ord4966
ord4948
ord5003
ord4936
ord1777
ord1756
ord1770
ord1744
ord1722
ord12258
ord12262
ord13878
ord3266
ord9256
ord11002
ord6978
ord12220
ord8965
ord14588
ord11936
ord3838
ord12089
ord9139
ord11726
ord11725
ord5652
ord10288
ord10284
ord10286
ord10287
ord10285
ord1513

kernel32

GetSystemInfo
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
LoadLibraryA
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
K32GetModuleFileNameExW
OpenProcess
FreeLibrary
GetFileAttributesW
GetEnvironmentVariableW
SetLastError
GetCurrentDirectoryA
GetEnvironmentVariableA
GetCurrentThread
SuspendThread
GetThreadContext
ResumeThread
ReadProcessMemory
OutputDebugStringA
SetFilePointer
ReadFile
SystemTimeToFileTime
UnmapViewOfFile
GetLocalTime
GetTickCount
DeleteFileW
GetLastError
GetComputerNameW
GetSystemDefaultLangID
GetPrivateProfileStringW
WritePrivateProfileStringW
CreateFileA
SetThreadExecutionState
GetShortPathNameW
CreateDirectoryW
LocalFileTimeToFileTime
GetCurrentDirectoryW
GetModuleFileNameA
GlobalMemoryStatus
GetProcessTimes
InitializeCriticalSectionEx
SetUnhandledExceptionFilter
MoveFileW
RemoveDirectoryW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemDefaultLCID
OpenThread
GetSystemDirectoryA
GetDiskFreeSpaceExA
GlobalAlloc
GlobalFree
GetVersionExW
FindFirstFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindNextFileW
FindClose
CreateMutexW
WaitForSingleObject
ReleaseMutex
HeapAlloc
GetProcessHeap
HeapFree
InitializeCriticalSection
LoadLibraryW
CreateFileW
GetCurrentThreadId
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
LocalFree
QueryPerformanceFrequency
GlobalReAlloc
CreateThread
MulDiv
WriteFile
LeaveCriticalSection
SetFileTime
Sleep
FindResourceW
LoadResource
GetCurrentProcessId
GetCurrentProcess
LockResource
SizeofResource
GlobalLock
GlobalUnlock
GetFileInformationByHandle
DeleteCriticalSection
EnterCriticalSection
GetFileSize
CreateFileMappingW
OutputDebugStringW

user32

GetWindowTextW
GetClassNameW
GetWindowThreadProcessId
DestroyIcon
GetSystemMetrics
IsWindow
GetDC
GetCursorPos
PostMessageW
FindWindowW
GetClientRect
SendMessageW
CopyRect
SetActiveWindow
GetClassInfoExW
LoadIconW
GetWindowRect
RegisterClassExW
GetWindowLongW
IsWindowVisible
IsWindowEnabled
GetDesktopWindow
DrawIcon
CloseClipboard
ReleaseDC
wsprintfW
SystemParametersInfoW
OffsetRect
PtInRect
SetForegroundWindow
ShowWindow
ExitWindowsEx
GetWindowTextLengthW
EnumWindows
GetKeyState
RegisterPowerSettingNotification
IsIconic
PostQuitMessage
UnregisterPowerSettingNotification
SetTimer
KillTimer
LoadCursorW
OpenClipboard
EmptyClipboard
SetClipboardData
ChangeWindowMessageFilter
UpdateLayeredWindow
SetCursor
DestroyCursor
GetForegroundWindow
AttachThreadInput
GetAsyncKeyState
ScreenToClient
ClientToScreen
GetClipboardData
IsClipboardFormatAvailable
SetWindowRgn
PrintWindow
GetFocus
IsChild
GetParent
GetSysColor
SetRect
SetWindowLongW
SetLayeredWindowAttributes
IsRectEmpty
IntersectRect
UnregisterTouchWindow
GetTouchInputInfo
CloseTouchInputHandle
UpdateLayeredWindowIndirect
SetCapture
ReleaseCapture
TabbedTextOutW
DrawTextW
DrawTextExW
InflateRect
GetWindowRgn
CreateCaret
ShowCaret
HideCaret
GetCaretPos
SetCaretPos
EnableWindow
GrayStringW

gdi32

SetBitmapBits
GetRgnBox
OffsetRgn
GetBitmapBits
CreateFontIndirectW
GetStockObject
SetGraphicsMode
CreateCompatibleDC
SelectObject
BitBlt
GetObjectW
GetDIBits
DeleteDC
DeleteObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
StretchBlt
GetDeviceCaps
PtInRegion
CreateRectRgn
CreateDCW
CombineRgn
CreateCompatibleBitmap
CreateDIBSection
ExtCreateRegion

advapi32

AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
GetUserNameA
FreeSid
OpenProcessToken
CheckTokenMembership
CreateWellKnownSid
DuplicateToken
GetTokenInformation

shell32

SHGetPathFromIDListW
DragFinish
DragQueryFileW
DragAcceptFiles
Shell_NotifyIconW
SHGetSpecialFolderLocation
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
ord727
SHGetFileInfoW
ExtractIconExW
ExtractIconW

comctl32

InitCommonControlsEx
_TrackMouseEvent

ole32

StringFromGUID2
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance

oleaut32

SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantClear
VariantInit
VarBstrCat
SysStringLen
SysFreeString
SysAllocString

gdiplus

GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipSetInterpolationMode
GdipIsVisibleRegionPoint
GdipGetLogFontW
GdipDrawImageRectRectI
GdipGraphicsClear
GdipDrawImageRectI
GdipBitmapGetPixel
GdiplusStartup
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateBitmapFromStream
GdipDeletePath
GdipGetRegionBounds
GdipCreatePath
GdipCreateBitmapFromScan0
GdipFillPath
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipSetWorldTransform
GdipDrawPath
GdipDrawImageRect
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectRect
GdipCreatePen1
GdipDeletePen
GdipBeginContainer2
GdipSetSmoothingMode
GdipDrawArc
GdipEndContainer
GdipDeleteFont
GdipFree
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateSolidFill
GdipDeleteBrush
GdipAlloc
GdipCloneBrush
GdipMeasureString
GdipDrawLine
GdipFillRectangle
GdipMeasureCharacterRanges
GdipDeleteGraphics
GdipDeleteFontFamily
GdipGetFamily
GdipGetLineSpacing
GdipGetFontSize
GdipGetEmHeight
GdipDisposeImage
GdipCloneImage
GdipCloneBitmapAreaI
GdipGetImagePixelFormat
GdiplusShutdown
GdipAddPathString
GdipGetFontStyle
GdipResetPath
GdipAddPathLine
GdipAddPathArc
GdipClosePathFigure
GdipWidenPath
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipSetPixelOffsetMode
GdipGetStringFormatFlags
GdipAddPathCurve
GdipAddPathEllipse
GdipSetPenWidth
GdipCreateRegionHrgn
GdipFillRegion
GdipTranslateRegionI
GdipAddPathLine2
GdipSetSolidFillColor
GdipGetSolidFillColor
GdipGetGenericFontFamilySansSerif
GdipGetStringFormatAlign
GdipGetStringFormatLineAlign
GdipSetClipRegion
GdipGetClip
GdipCreateRegion
GdipDeleteRegion
GdipCreateFont
GdipCreateFontFamilyFromName
GdipResetClip
GdipFillPolygon
GdipDrawString
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipSetStringFormatMeasurableCharacterRanges
GdipSetClipRect
GdipDrawRectangle
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipGetLogFontA
GdipCreateFromHDC
GdipCreateBitmapFromHICON
GdipGetImageGraphicsContext
GdipDrawLineI

msvcp140

?_Xlength_error@std@@YAXPBD@Z
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
_Wcsxfrm
_Wcscoll
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

imm32

ImmSetCompositionWindow
ImmSetCompositionFontW
ImmAssociateContext
ImmReleaseContext
ImmGetContext

lbmain

?DestroySPoint@CSPointFactory@lelink_main@@SA?AW4LB_RESULT@lelink_types@@PAVISPoint@2@@Z
?CreateSPoint@CSPointFactory@lelink_main@@SA?AW4LB_RESULT@lelink_types@@PAPAVISPoint@2@@Z
?DestroyMirrorHandle@IMirror@lelink@@SA?AW4MIRROR_RETURN_TYPE_EM@2@PAV12@@Z
?CreateMirrorHandle@IMirror@lelink@@SA?AW4MIRROR_RETURN_TYPE_EM@2@PAPAV12@@Z

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoSizeA

netapi32

Netbios

wininet

InternetGetConnectedState
InternetCanonicalizeUrlW
InternetReadFile
InternetCheckConnectionW
HttpQueryInfoW
InternetOpenW
InternetOpenUrlW
InternetCloseHandle

wlanapi

WlanDisconnect
WlanSetProfile
WlanGetAvailableNetworkList
WlanScan
WlanEnumInterfaces
WlanRegisterNotification
WlanCloseHandle
WlanFreeMemory
WlanOpenHandle
WlanConnect

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

winmm

timeGetTime

vcruntime140

strchr
wcsrchr
_purecall
wcsstr
strstr
__std_terminate
__CxxFrameHandler3
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memcpy
memmove
memset

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-stdio-l1-1-0

__p__commode
putc
__stdio_common_vsprintf
_setmode
fclose
feof
ferror
__stdio_common_vsprintf_s
fflush
fopen
fputc
__stdio_common_vsscanf
fputs
__stdio_common_vsnprintf_s
fread
_set_fmode
fseek
_fileno
fwrite
__stdio_common_vfprintf
ftell
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__acrt_iob_func

api-ms-win-crt-string-l1-1-0

wcscat_s
wcscpy_s
strcat_s
_strdup
toupper
_wcsnicmp
ispunct
isalpha
_wcsicmp
tolower
strcpy_s
_wcsdup
isdigit

api-ms-win-crt-runtime-l1-1-0

terminate
_seh_filter_exe
_set_app_type
strerror
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_errno
_invalid_parameter_noinfo
_controlfp_s
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-convert-l1-1-0

atoll
atoi
atof
strtoul
_wtoi
strtoll
wcstol
_itow_s

api-ms-win-crt-time-l1-1-0

_localtime64_s
wcsftime
_time64
_mktime64

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-math-l1-1-0

_libm_sse2_sqrt_precise
ceil
floor
_except1
__setusermatherr

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath
_wrename

msimg32

AlphaBlend

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 460KB - Virtual size: 459KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ac12687a1a81a8759bc36ca38fe9ccd

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

6a:ca:86:70:b0:4d:be:57:46:f5:b4:4d:30:b8:b9:06Certificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

6a:ca:86:70:b0:4d:be:57:46:f5:b4:4d:30:b8:b9:06Certificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

3d:4f:fb:bf:3f:ff:9b:35:9b:da:e4:37:dc:23:24:76:d6:ec:cf:2b:38:7f:71:41:69:b1:25:7b:da:05:c1:e4Signer

Signature Validations

Verification

05/09/2019, 07:34 Valid: false

58:1e:aa:bf:e0:36:19:50:db:7b:1e:29:2e:b6:c3:17:72:b8:b2:44Signer

Signature Validations

Verification

05/09/2019, 07:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

gdiplus

msvcp140

imm32

lbmain

iphlpapi

version

netapi32

wininet

wlanapi

wtsapi32

winmm

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

msimg32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 460KB - Virtual size: 459KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

6a:ca:86:70:b0:4d:be:57:46:f5:b4:4d:30:b8:b9:06
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

6a:ca:86:70:b0:4d:be:57:46:f5:b4:4d:30:b8:b9:06
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

3d:4f:fb:bf:3f:ff:9b:35:9b:da:e4:37:dc:23:24:76:d6:ec:cf:2b:38:7f:71:41:69:b1:25:7b:da:05:c1:e4
Signer

05/09/2019, 07:34
Valid: false

58:1e:aa:bf:e0:36:19:50:db:7b:1e:29:2e:b6:c3:17:72:b8:b2:44
Signer

05/09/2019, 07:34
Valid: false

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 460KB - Virtual size: 459KB

.data
Size: 12KB - Virtual size: 203KB

.gfids
Size: 512B - Virtual size: 72B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 81KB - Virtual size: 81KB