b77a4233037c4cfefa303f64a61b455936dd91169064cc91effef4aaa26a00c4

Sharing

Copy URL Twitter E-mail

General

Target

b77a4233037c4cfefa303f64a61b455936dd91169064cc91effef4aaa26a00c4
Size

676KB
MD5

0ac413d0c16c63a48767d78913b05530
SHA1

ecf5b97ce5564c0a2c07b20b6efab06465926be1
SHA256

b77a4233037c4cfefa303f64a61b455936dd91169064cc91effef4aaa26a00c4
SHA512

bdcabb960af9178939f0116bdf055a07c741b7d2583952eebfe0aff3a1a2369baf721d810c5f84ffb1388ed5116e4524801308136bdfa96373288bd276cd733c
SSDEEP

12288:ZrNUHVZkSOAE/29raTMtVogG5nRMJH78lLCmHJ/LrORagN:ZRUHVZkSOAd9zkst7u36agN

Score

N/A

Malware Config

Signatures

Files

b77a4233037c4cfefa303f64a61b455936dd91169064cc91effef4aaa26a00c4
.exe windows x86

b2da281f9befc6fae3ac82a68c1e761a

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9c:39:5a:86:d9:1d:a6:3b:ac:9c:ef:69:4a:77:2b:43
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

20/05/2015, 00:00

Not After

19/05/2016, 23:59

Subject

CN=PKK OOO,O=PKK OOO,POSTALCODE=241037,STREET=103 ul.Krasnoarmeiskaya,L=Bryansk,ST=Bryansk Region,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:60:05:a7:67:f2:cc:85:7e:86:15:ab:c4:1a:b6:65:92:a6:67:50
Signer

Actual PE Digest

77:60:05:a7:67:f2:cc:85:7e:86:15:ab:c4:1a:b6:65:92:a6:67:50

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=PKK OOO,O=PKK OOO,POSTALCODE=241037,STREET=103 ul.Krasnoarmeiskaya,L=Bryansk,ST=Bryansk Region,C=RU

28/10/2022, 15:17
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

IsHungAppWindow
DestroyWindow
MessageBeep
SetWindowsHookA
SetCapture
GetClassWord
ShowWindow
FlashWindowEx
GetKeyboardLayout
ChildWindowFromPointEx
WinHelpA
CloseWindow
SetDlgItemTextA
DlgDirSelectExA
ChangeDisplaySettingsW
ShowCursor
GetKeyboardType
ModifyMenuA
ClipCursor
SetClassWord
GetScrollPos
OemToCharBuffW
GetLastInputInfo
SetDebugErrorLevel
EnableMenuItem
GetMenuStringW
DrawTextExW
SetDoubleClickTime
FindWindowExA
GetClipCursor
InvalidateRect
MessageBoxExA
DestroyCaret
GetInputDesktop
RegisterHotKey
PrivateExtractIconsA
DragObject
SetMessageExtraInfo
MessageBoxTimeoutA
AllowForegroundActivation
GetMonitorInfoW
SetCaretBlinkTime
ToUnicodeEx
GetProgmanWindow
IsIconic
OpenIcon
DrawIconEx
SetCursor
GetAltTabInfoW
GrayStringW
DrawTextExA
DrawFocusRect
CopyAcceleratorTableW
PrintWindow
MessageBoxA
ValidateRgn
SetWindowPos
SetWindowRgn
MessageBoxIndirectA
GetListBoxInfo
CharPrevW
CharUpperA
EndPaint
WaitMessage
DefDlgProcW
EnableWindow
BlockInput
RemovePropW
UpdateWindow
IsCharLowerW
GetMessageW
MessageBoxW
ArrangeIconicWindows
RemoveMenu
GetSysColor
DrawTextA
CharPrevA
GetKeyNameTextA
CascadeChildWindows
LockWindowUpdate
GetClipboardData
LoadImageW
BringWindowToTop
MenuWindowProcW
DispatchMessageW
GetWindowPlacement
SetMenu
IsDialogMessageA
ReleaseDC
SetScrollInfo
CloseWindowStation
RegisterClassExW
ChangeDisplaySettingsExW
PostThreadMessageA
LoadMenuA
SetForegroundWindow
LoadCursorW
ChangeDisplaySettingsExA
GetDlgItemTextA
ValidateRect
GetThreadDesktop
GetScrollRange
IsDialogMessageW
DrawMenuBar
GetActiveWindow
SetWindowsHookExA
GetTitleBarInfo
DlgDirListW
MapVirtualKeyExW
RegisterClipboardFormatW
IsWindowUnicode
SetPropW
OemKeyScan
GetUserObjectInformationW
CheckDlgButton
EnumWindowStationsW
RealGetWindowClassW
SwapMouseButton
ShowWindowAsync
DrawFrame
OemToCharA
GetClassNameW
DefWindowProcA
DrawEdge
DialogBoxParamA
DrawCaptionTempW
TileChildWindows
SetScrollRange
CharNextA
OpenClipboard
RegisterClassExA
UnlockWindowStation
UnregisterClassW
CreateIcon
LoadAcceleratorsW
SetLastErrorEx
EnumPropsW
GetMouseMovePointsEx
MonitorFromWindow
OpenDesktopW
ScrollWindowEx
GetScrollBarInfo
CreateMDIWindowA
SendNotifyMessageW
BroadcastSystemMessageExW
SetRectEmpty
DrawStateA
SetClassLongW
ToAsciiEx
EnumPropsExW
DialogBoxParamW
GetWindowContextHelpId
PostMessageW
GetDialogBaseUnits
SetSysColors
PeekMessageA
ChildWindowFromPoint
RedrawWindow
LoadCursorFromFileW
SetMenuItemInfoW
LoadIconW
GetClassInfoExW
EmptyClipboard
EndDialog
GetNextDlgGroupItem
SetWindowsHookW
CopyIcon
IsWindow
GetClipboardOwner
DestroyIcon
TileWindows
PostMessageA
GetClassLongA
ChangeDisplaySettingsA
CreateAcceleratorTableA
CharLowerBuffA
GetRawInputDeviceInfoA
DlgDirSelectExW
DrawMenuBarTemp
EnableScrollBar
RegisterClassA
RemovePropA
SetLayeredWindowAttributes
GetClassInfoA
GetCaretPos
GetTabbedTextExtentW
GetTopWindow
GetUserObjectInformationA
AdjustWindowRectEx
SetClipboardData
GetWindowModuleFileNameA
SubtractRect
CharUpperBuffA
GetWindowTextLengthA
SetKeyboardState
GetCaretBlinkTime
InsertMenuW
GetWindowTextA
CheckMenuItem
IsCharAlphaA
SetMenuInfo
MessageBoxIndirectW
GetWindowWord
SystemParametersInfoW
ShowOwnedPopups
TrackMouseEvent
SetProcessWindowStation
wsprintfA
GetMenuItemID
GetShellWindow
GetSysColorBrush
GetWindowThreadProcessId
KillTimer
DialogBoxIndirectParamW
InsertMenuItemA
DefFrameProcW
SetClipboardViewer
GetKeyNameTextA

kernel32

SetSystemTimeAdjustment
WriteFileGather
WriteTapemark
CreateDirectoryExA
GlobalCompact
GetLocaleInfoW
WriteProfileStringW
SetInformationJobObject
GlobalFix
SetEvent
GetVersion
SetFileApisToANSI
SetCalendarInfoA
EndUpdateResourceW
ReadConsoleA
EnumResourceTypesW
ProcessIdToSessionId
GetWriteWatch
CallNamedPipeW
LZOpenFileW
CancelWaitableTimer
GetProcessPriorityBoost
BuildCommDCBAndTimeoutsA
GenerateConsoleCtrlEvent
SetThreadUILanguage
FindVolumeMountPointClose
DeactivateActCtx
GetPrivateProfileIntW
SetProcessWorkingSetSize
ReadConsoleOutputAttribute
HeapLock
GetLogicalDrives
WriteFile
GlobalMemoryStatus
LoadModule
RequestDeviceWakeup
MoveFileWithProgressW
QueryDosDeviceA
GetModuleHandleExA
HeapSetInformation
FindFirstVolumeW
GetVolumePathNameW
ReadConsoleInputA
BeginUpdateResourceA
LZCreateFileW
VirtualQuery
CreateSemaphoreW
GetCurrentProcess
FreeUserPhysicalPages
CreateHardLinkA
GlobalHandle
CreateEventW
CloseHandle
GlobalLock
FindFirstVolumeA
EndUpdateResourceA
CopyLZFile
lstrcmp
ReadConsoleInputExA
RtlFillMemory
lstrlenW
FindFirstVolumeMountPointA
GetModuleFileNameW
FileTimeToLocalFileTime
IsBadCodePtr
GetConsoleInputWaitHandle
HeapSize
LocalLock
GetVolumeNameForVolumeMountPointW
GetDriveTypeA
GetCommProperties
MoveFileExW
SetFilePointer
ShowConsoleCursor
CreateMailslotW
ReadConsoleOutputCharacterA
WriteConsoleOutputCharacterW
GetTickCount
SetFilePointerEx
HeapDestroy
GetProcessHeaps
GetCurrencyFormatW
FreeLibraryAndExitThread
QueueUserWorkItem
SetCurrentDirectoryA
LZCopy
EnumResourceTypesA
CompareStringA
WritePrivateProfileStringW
SetFileAttributesW
FindFirstChangeNotificationA
GetEnvironmentStringsW
GetVolumePathNameA
MoveFileWithProgressA
SetFileTime
SetFileShortNameW
SystemTimeToTzSpecificLocalTime
WaitForMultipleObjects
InterlockedCompareExchange
GetCPInfoExW
GetConsoleSelectionInfo
InterlockedDecrement
WaitForSingleObjectEx
BeginUpdateResourceW
CreateMailslotA
GetCPInfoExA
WaitForSingleObject
EnumLanguageGroupLocalesA
GetConsoleHardwareState
FlushConsoleInputBuffer
EnumResourceNamesA
GetShortPathNameA
CreateTimerQueue
DefineDosDeviceA
GetCurrentThread
GetFileInformationByHandle
FatalAppExitA
GetLogicalDriveStringsA
GetConsoleAliasesW
FreeConsole
DeleteTimerQueue
GetSystemDirectoryW
GetConsoleFontSize
CopyFileW
SetThreadAffinityMask
SignalObjectAndWait
SetFileAttributesA
ResetWriteWatch
RestoreLastError
Heap32ListFirst
GetUserDefaultLCID
GetExpandedNameW
LCMapStringA
GlobalAddAtomA
BuildCommDCBAndTimeoutsW
UnmapViewOfFile
SetDefaultCommConfigA
QueryDosDeviceW
lstrlen
FindNextVolumeW
RtlMoveMemory
DeleteTimerQueueEx
WriteConsoleInputA
GetDefaultCommConfigA
LockFileEx
CreateFileA
FormatMessageW
EnumSystemCodePagesW
FindAtomW
FindClose
lstrcatA
VerLanguageNameA
SetProcessPriorityBoost
OpenJobObjectA
GetGeoInfoA
InitAtomTable
GlobalSize
GetTimeFormatA
GetACP
CreateDirectoryExW
GetPrivateProfileStructA
GlobalGetAtomNameA
ConnectNamedPipe
GetVolumePathNamesForVolumeNameW
FreeResource
TerminateProcess
GetThreadPriorityBoost
PrepareTape
VirtualUnlock
AddAtomW
GetDiskFreeSpaceW
DosPathToSessionPathW
GetPrivateProfileIntA
GlobalFree
LZStart
OpenMutexA
EnumCalendarInfoW
SetTapePosition
GetTapeParameters
FatalAppExitW
FreeLibrary
CreateProcessA
SetCommMask
WideCharToMultiByte
GetLongPathNameA
FoldStringW
FreeEnvironmentStringsW
CreateJobSet
SetComPlusPackageInstallStatus
CreateActCtxA
lstrcmpiW
FlushInstructionCache
OpenSemaphoreA
GlobalAddAtomW
GetConsoleTitleA
SetFileShortNameA
FindNextVolumeMountPointW
ActivateActCtx
GetStringTypeA
SetTapeParameters
IsBadWritePtr
VerLanguageNameW
lstrcmpi
DebugBreak
ReadFileEx
SetCommTimeouts
GetConsoleWindow
GetProfileStringW
LZCloseFile
FreeEnvironmentStringsA
CreateJobObjectW
GetModuleFileNameA
GetGeoInfoW
lstrcpyn
GetCompressedFileSizeW
FindVolumeClose
SetFileValidData
CreateDirectoryA
EnumDateFormatsW
WriteConsoleOutputCharacterA
SetPriorityClass
SetThreadLocale
SetCommBreak
GetConsoleAliasesA
GetUserDefaultLangID
RaiseException
GetModuleHandleW
GetThreadContext
SetLocaleInfoA
ReadConsoleOutputW
GetThreadSelectorEntry
BackupSeek
OpenEventW
CreateNamedPipeA
SetCriticalSectionSpinCount
GetThreadPriority
SetEndOfFile
GetCurrentDirectoryA
GetUserDefaultUILanguage
QueryInformationJobObject
SystemTimeToFileTime
GetFileAttributesExA
GetConsoleInputExeNameA
ReplaceFile
GetDefaultCommConfigW
MapViewOfFileEx
GetComputerNameExW
WinExec
GetPriorityClass
DisableThreadLibraryCalls
CopyFileExW
ReadConsoleW
ChangeTimerQueueTimer
CreateHardLinkW
GetAtomNameA
TerminateJobObject
GetDiskFreeSpaceExA
FindFirstFileExW
GetVersionExA
LocalAlloc
FindNextVolumeA
WritePrivateProfileStructW
GetNamedPipeHandleStateA
CreateSemaphoreA
GetSystemPowerStatus
lstrcmpW
GetConsoleCP
EnumResourceLanguagesW
DisconnectNamedPipe
AddConsoleAliasW
SetVolumeMountPointW
AllocateUserPhysicalPages
HeapCompact
InterlockedIncrement
GlobalFindAtomA
PeekNamedPipe
LocalHandle
CancelTimerQueueTimer
UpdateResourceW
GetPrivateProfileSectionNamesW
LockResource
GetBinaryTypeA
InterlockedExchangeAdd
VirtualLock
GetFileAttributesExW
FindActCtxSectionGuid
VirtualQueryEx
FindNextFileW
GetCompressedFileSizeA
SetLastError
GetVolumeInformationA
ReadConsoleInputExW
EnumSystemLanguageGroupsA
HeapFree
GetDateFormatW
TzSpecificLocalTimeToSystemTime
GlobalMemoryStatusEx
SetThreadContext
CreateFileW
Heap32First
GetCurrentProcess
GetVersion
LoadLibraryExA
VirtualUnlock
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

shlwapi

StrFormatByteSizeW
SHEnumValueA
SHRegCloseUSKey
PathStripPathW
UrlCreateFromPathA
StrCSpnW
SHCreateStreamOnFileW
StrCmpNIW
SHSetValueW
PathIsPrefixW
UrlIsOpaqueW
StrToIntW
StrCatChainW
AssocQueryStringByKeyW
PathFindFileNameA
StrDupW
SHCreateStreamOnFileA
PathRemoveFileSpecW
PathStripToRootA
PathGetCharTypeW
SHQueryValueExW
PathIsNetworkPathA
StrRChrW
StrStrNW
PathAppendW
StrSpnW
StrCmpW
SHEnumValueW
PathIsUNCServerA
PathIsDirectoryA
SHEnumKeyExA
SHRegGetBoolUSValueA
SHRegQueryInfoUSKeyA
StrCSpnA
PathStripToRootW
SHRegSetPathA
StrIsIntlEqualW
SHStrDupW
StrDupA
PathFindFileNameW
PathSkipRootA
StrRetToStrA
StrCatBuffW
StrRStrIW
SHDeleteEmptyKeyA
PathMatchSpecA
AssocQueryStringByKeyA
SHGetThreadRef
SHRegDuplicateHKey
PathIsSystemFolderA
SHDeleteKeyW
PathRemoveArgsA
UrlGetLocationW
PathIsUNCW
UrlCreateFromPathW
PathGetDriveNumberW
SHLoadIndirectString
StrCpyNW
SHRegGetPathA
ChrCmpIW
PathRemoveBackslashA
StrStrIW
PathCreateFromUrlW
PathRenameExtensionA
SHCreateShellPalette
SHRegDeleteUSValueW
StrCmpNW
SHGetValueW
SHRegEnumUSValueW
PathIsRootA
SHOpenRegStream2A
PathFindNextComponentA
SHRegDeleteEmptyUSKeyA
GetMenuPosFromID
StrCatBuffA
SHDeleteValueA
StrCmpNIA
PathFindNextComponentW
StrToInt64ExA
StrCmpLogicalW
PathStripPathA
PathIsUNCServerW
PathIsPrefixA
PathCompactPathW
SHRegCreateUSKeyA
SHRegOpenUSKeyA
UrlCombineW
StrToIntExW
PathBuildRootW
SHRegDeleteEmptyUSKeyW
StrStrW
SHRegSetPathW
PathIsRootW
IntlStrEqWorkerW
UrlUnescapeW
ColorRGBToHLS
StrFormatByteSize64A
AssocQueryKeyW

ole32

CoCreateObjectInContext
OleGetIconOfFile
OleQueryLinkFromData
CoGetObjectContext
IsValidPtrOut
CoCreateGuid
CoCopyProxy
OleCreateLinkToFile
CoGetContextToken
CoInitializeSecurity
OleDuplicateData
HWND_UserFree
CoGetInterceptorFromTypeInfo
CoReleaseServerProcess
CoTestCancel
SNB_UserSize
CoTaskMemAlloc
CoInitializeWOW
CoCreateInstance
ReadFmtUserTypeStg
WriteOleStg
CoQueryProxyBlanket
StgCreateDocfile
OleSetAutoConvert
GetHGlobalFromILockBytes
StgCreatePropSetStg
DllGetClassObject
WriteFmtUserTypeStg
DoDragDrop
CoGetDefaultContext
CoGetObject
CreateOleAdviseHolder
CoGetProcessIdentifier
CLSIDFromOle1Class
HBRUSH_UserFree
CoDisableCallCancellation
ProgIDFromCLSID
HMENU_UserFree
CreateDataAdviseHolder
CoRevokeMallocSpy
UtGetDvtd16Info
CoLockObjectExternal
OleRegEnumFormatEtc
FreePropVariantArray
OleRegEnumVerbs
PropSysFreeString
OleSetContainedObject
CLSIDFromString
CoIsOle1Class
StgOpenAsyncDocfileOnIFillLockBytes
CoFreeLibrary
PropSysAllocString
IsAccelerator
DllGetClassObjectWOW
IsEqualGUID
CoMarshalHresult
OleCreateEmbeddingHelper
CoGetInstanceFromFile
CoMarshalInterface
OleConvertOLESTREAMToIStorage
StgOpenPropStg
CoGetClassObject
CoCancelCall
OleQueryCreateFromData
PropVariantCopy
HMETAFILE_UserFree
CoRevertToSelf
CoSetState
CoFileTimeNow
HPALETTE_UserSize
CreatePointerMoniker
HBITMAP_UserSize
SNB_UserUnmarshal
CoMarshalInterThreadInterfaceInStream
CoQueryReleaseObject
EnableHookObject
HWND_UserSize

comdlg32

ChooseColorA
GetFileTitleW
CommDlgExtendedError
GetOpenFileNameA
PrintDlgA
WantArrows
PageSetupDlgA
PageSetupDlgW
GetSaveFileNameA
GetOpenFileNameW
FindTextA
GetSaveFileNameW
ChooseColorW
dwLBSubclass
ChooseFontA
GetFileTitleA
dwOKSubclass
PrintDlgW
ChooseFontW
PrintDlgExA
LoadAlterBitmap
ReplaceTextW
ReplaceTextA
FindTextW

oleaut32

VarBstrCmp
SafeArrayCopy
VarDateFromR4
VariantChangeType
VarI4FromDisp
VarBstrFromDec
SafeArrayGetElement
VarR4FromI8
VarDateFromDisp
VarI4FromStr
VarCmp
VarDecCmpR8
VarI1FromDec
VarDateFromUI2
VarR8FromBool
VarEqv
VarUI4FromI8
DllCanUnloadNow
VarBstrCat
BSTR_UserMarshal
OleLoadPicturePath
VarCyFromI2
GetVarConversionLocaleSetting
LHashValOfNameSysA
DllRegisterServer
VarI1FromUI2
VarUI1FromR8
VarUI2FromDisp
VarImp
SafeArrayGetDim
VarI8FromUI4
VarUI8FromDate
SetOaNoCache
VarFormatCurrency
VarFormatDateTime
SysAllocStringByteLen
VarBoolFromUI8
VarCyAbs
VarI4FromUI1
VarI8FromI1
VarI1FromDisp
VarR4FromI4
LHashValOfNameSys
VarR8FromUI8
VarUI8FromI2
VarI1FromI8
OleCreatePropertyFrame
VarNumFromParseNum
VarUI1FromStr
VarI4FromCy
VarUI4FromUI2
VarUI1FromDec
VarDecFromDisp
VarI4FromR8
VarFix
VarUI8FromCy
VarNeg
SafeArrayAllocDescriptorEx
VarUI4FromR8
VarCyMul
SysReAllocStringLen
VarR8FromUI4
VarI4FromR4
VarDateFromUdateEx
UnRegisterTypeLib
VarDateFromUI4
VarCyFromStr
VarUI8FromUI2
SafeArrayGetRecordInfo
ClearCustData
VarFormatNumber
VarUI2FromI1
VarDecFromUI8
VarI1FromStr
LPSAFEARRAY_UserSize
VarUI8FromR8
VarBoolFromI8
VarDecRound
VarI8FromDate
DispInvoke
SysFreeString
VarUI4FromDec
SystemTimeToVariantTime
VarBoolFromUI4
CreateTypeLib
VarUI4FromDate
DispGetParam
VarR4FromI1
LPSAFEARRAY_Size
VarDiv
VarBoolFromI1
SafeArrayAllocDescriptor
DispCallFunc
VarDecFromUI1
SysStringLen
VarR8FromUI1
VarI2FromUI1
VarUI2FromDate
VarUI4FromDisp

shell32

SHFreeNameMappings
SHAppBarMessage
RealShellExecuteA
SheChangeDirExW
RealShellExecuteExW
DllRegisterServer
SheSetCurDrive
SHInvokePrinterCommandW
SHGetFileInfoW
FreeIconList
SHInvokePrinterCommandA
SHQueryRecycleBinW
StrRStrA
SheChangeDirA
CommandLineToArgvW
StrNCmpA
SHBindToParent
DragAcceptFiles
SHAddToRecentDocs
ShellHookProc
ExtractAssociatedIconA
SHGetFileInfoA
Control_RunDLLA
AppCompat_RunDLLW
SHGetDesktopFolder
StrNCmpIW
SHBrowseForFolder
SHSetUnreadMailCountW
SHExtractIconsW
SHPathPrepareForWriteW
ShellExecuteW
DllGetVersion
SHLoadInProc
StrChrIW
StrRStrIW
DllCanUnloadNow
ShellExec_RunDLL
StrRChrIW
InternalExtractIconListW
StrCmpNIW
ExtractAssociatedIconExW
SHUpdateRecycleBinIcon
SHPathPrepareForWriteA
ShellExec_RunDLLA
DllInstall
DoEnvironmentSubstA
SHBrowseForFolderA
SHGetNewLinkInfo
SheGetDirA
Control_RunDLL
StrNCmpIA
Options_RunDLLA
ExtractAssociatedIconExA
DragFinish
SHGetFolderLocation
SHGetPathFromIDListA
SHChangeNotifySuspendResume
ShellAboutA
StrCmpNW
Options_RunDLLW
StrChrW
StrRChrIA
DragQueryPoint
SHEnumerateUnreadMailAccountsW
ExtractIconW
SHFileOperationA
StrChrA
StrRStrW
SHCreateShellItem
SHSetLocalizedName
SHChangeNotify
SHGetMalloc
SHGetPathFromIDList
SHParseDisplayName
StrCmpNIA
SHGetDiskFreeSpaceExA
SHOpenFolderAndSelectItems
SHCreateLocalServerRunDll
SHGetNewLinkInfoW
SHLoadNonloadedIconOverlayIdentifiers
SHCreateProcessAsUserW
Shell_NotifyIconA
SHCreateQueryCancelAutoPlayMoniker
SHGetFolderPathW

winspool.drv

XcvDataW
AddPrintProvidorA
DevicePropertySheets
GetPrinterDataExW
GetPrinterA
WaitForPrinterChange
FindNextPrinterChangeNotification
AdvancedSetupDialog
EnumPrintProcessorsW
StartDocDlgW
PerfCollect
PrinterMessageBoxW
EnumPrintersW
SetPrinterDataW
EnumPrinterDriversA
AddPrinterDriverExA
EnumPrinterKeyA
EnumPrintProcessorDatatypesW
AddMonitorW
OpenPrinterW
GetJobW
DeletePrinterDriverW
PrinterProperties
DeletePrinterKeyA
StartPagePrinter
PerfClose
AdvancedDocumentPropertiesW
DEVICECAPABILITIES
GetSpoolFileHandle
SpoolerPrinterEvent
AddPrinterW
DeletePrintProcessorA
DevQueryPrintEx
GetDefaultPrinterA
EnumFormsA
DEVICEMODE
GetFormW
FindClosePrinterChangeNotification
GetDefaultPrinterW
SetPrinterW
EnumPrinterKeyW
DeletePrinterConnectionA
EndDocPrinter
EnumPortsW
SetPortW
DevQueryPrint
GetPrinterDriverDirectoryW
AddPortExA
GetPrinterDataExA
OpenPrinterA
EXTDEVICEMODE
CreatePrinterIC
QueryColorProfile
SetJobA
ResetPrinterA
AddPrinterConnectionW
StartDocPrinterA
ConvertUnicodeDevModeToAnsiDevmode
SetDefaultPrinterA
CommitSpoolData
EnumMonitorsW
SeekPrinter
DeletePrintProcessorW
AdvancedDocumentPropertiesA
GetPrintProcessorDirectoryW

advapi32

RegEnumKeyW
BuildImpersonateExplicitAccessWithNameW
CredFree
CredGetSessionTypes
LsaGetRemoteUserName
LsaICLookupSidsWithCreds
GetLocalManagedApplications
CloseCodeAuthzLevel
CryptAcquireContextW
EnumerateTraceGuids
RevertToSelf
AddUsersToEncryptedFile
RegisterIdleTask
SaferiChangeRegistryScope
SetSecurityInfoExA
EncryptFileW
SetSecurityDescriptorSacl
AddAccessDeniedObjectAce
CryptDuplicateKey
SaferGetLevelInformation
BuildTrusteeWithObjectsAndNameW
SetSecurityInfo
EnumDependentServicesA
CryptEnumProvidersA
GetUserNameW
BuildImpersonateTrusteeW
CryptDestroyHash
AllocateAndInitializeSid
GetSidSubAuthorityCount
TreeResetNamedSecurityInfoW
RegDeleteValueA
SetEntriesInAccessListA
SetSecurityDescriptorRMControl
UpdateTraceA
GetCurrentHwProfileW
LsaICLookupNames
GetTraceLoggerHandle
GetEffectiveRightsFromAclW
CredGetTargetInfoW
ConvertStringSidToSidW
GetOverlappedAccessResults
LsaNtStatusToWinError
AccessCheckByTypeAndAuditAlarmW
ElfRegisterEventSourceW
RegSetKeySecurity
RegDisablePredefinedCache
LsaSetTrustedDomainInformation
BuildTrusteeWithSidA
GetSecurityDescriptorGroup
ReadEventLogW
GetLocalManagedApplicationData
PrivilegedServiceAuditAlarmA
WmiEnumerateGuids
AccessCheckByTypeResultListAndAuditAlarmByHandleA
LookupSecurityDescriptorPartsW
RegCloseKey
RegCreateKeyExW
CryptSetProviderW
LsaAddPrivilegesToAccount
LsaOpenPolicySce
StopTraceA
LsaCreateTrustedDomain

gdi32

EngStretchBlt
GetMapMode
CombineRgn
EnumFontsW
EngCreateClip
GetWindowOrgEx
CreateEnhMetaFileA
EngTextOut
GetPath
GetTextExtentPointW
DeleteMetaFile
CreateFontIndirectA
SetROP2
LPtoDP
SetPaletteEntries
GetTransform
CreateScalableFontResourceW
BRUSHOBJ_ulGetBrushColor
GetTextMetricsA
ScaleViewportExtEx
SetICMMode
StretchBlt
StrokeAndFillPath
EngEraseSurface
CreateMetaFileA
SetBkColor
FlattenPath
EngStrokePath
CLIPOBJ_cEnumStart
SetLayout
GetTextCharsetInfo
GetCurrentPositionEx
SetDCPenColor
MaskBlt
GetFontResourceInfoW
EndPath
GetCharWidthA
EngGradientFill
EnumFontsA
StartPage
EngCreateBitmap
STROBJ_vEnumStart
CreateHatchBrush
HT_Get8BPPFormatPalette
GetCharWidth32W
FillRgn
GetStockObject
GdiDescribePixelFormat
SetTextAlign
STROBJ_bEnum
StartFormPage
CreateDIBitmap
RoundRect
GetObjectType
GetBitmapAttributes
DeviceCapabilitiesExA
GetROP2
GetEnhMetaFileDescriptionA
OffsetViewportOrgEx
CreateScalableFontResourceA
SelectFontLocal
GdiPrinterThunk
GetClipRgn
STROBJ_bGetAdvanceWidths
CreatePolyPolygonRgn
SetPolyFillMode
ExcludeClipRect
SetRectRgn
GetEUDCTimeStampExW
XFORMOBJ_bApplyXform
RectInRegion
Rectangle
SetTextJustification
GdiSetLastError
PlayEnhMetaFileRecord
GetAspectRatioFilterEx
RemoveFontMemResourceEx
SelectObject
PolyPolygon
Arc
PlayEnhMetaFile
EngUnicodeToMultiByteN

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
VerFindFileW
GetFileVersionInfoA
VerFindFileA
VerLanguageNameA
GetFileVersionInfoSizeA
VerInstallFileA
VerLanguageNameW

wtsapi32

WTSSetSessionInformationA
WTSLogoffSession
WTSTerminateProcess
WTSEnumerateServersW
WTSOpenServerW
WTSOpenServerA
WTSQuerySessionInformationA
WTSSendMessageW
WTSQueryUserConfigW
WTSVirtualChannelPurgeOutput
WTSQuerySessionInformationW
WTSEnumerateProcessesW
WTSQueryUserConfigA
WTSWaitSystemEvent
WTSSetSessionInformationW
WTSRegisterSessionNotification
WTSEnumerateSessionsA
WTSVirtualChannelOpen
WTSShutdownSystem
WTSVirtualChannelWrite
WTSEnumerateProcessesA
WTSFreeMemory
WTSEnumerateServersA
WTSSendMessageA
WTSVirtualChannelClose
WTSVirtualChannelPurgeInput
WTSUnRegisterSessionNotification
WTSEnumerateSessionsW
WTSDisconnectSession
WTSCloseServer
WTSSetUserConfigW

ws2_32

WSAGetServiceClassNameByClassIdA
htons
WSAUnhookBlockingHook
WSAAsyncGetServByPort
getnameinfo
ntohs
WSADuplicateSocketA
WSAGetServiceClassNameByClassIdW
WSASetServiceA
ioctlsocket
WSARecv
sendto
WSASocketW
WSAStringToAddressW
WSAStringToAddressA
getservbyname
WSASetServiceW
WSAProviderConfigChange
accept
WSAGetQOSByName
gethostbyname
WSAAsyncGetHostByName
WSACancelAsyncRequest
WSAGetOverlappedResult
WSCUpdateProvider
shutdown
WSCEnableNSProvider
WSADuplicateSocketW
WSALookupServiceNextA
WSALookupServiceBeginA
WSARecvDisconnect
WSAAsyncGetHostByAddr
closesocket
WSAEnumNameSpaceProvidersA
setsockopt
WSAWaitForMultipleEvents
getservbyport
WSARecvFrom
WSASetBlockingHook
WSALookupServiceBeginW
WSARemoveServiceClass
WSCInstallNameSpace
WSACancelBlockingCall
WSAIsBlocking
WSAHtons
WSAAsyncSelect
getprotobyname
bind
WSALookupServiceEnd
getsockopt
inet_addr
WSAAddressToStringW
WSASetEvent
WSAGetLastError
WSAGetServiceClassInfoW
htonl
gethostname
WSAEventSelect
listen
WSAGetServiceClassInfoA
socket
WSCGetProviderPath
WSAResetEvent
gethostbyaddr
WSCDeinstallProvider

comctl32

ImageList_DrawEx
ImageList_Add
FlatSB_GetScrollInfo
FlatSB_ShowScrollBar
CreateUpDownControl
InitializeFlatSB
ImageList_GetDragImage
LBItemFromPt
CreateToolbar
FlatSB_GetScrollPos
ImageList_GetIcon
CreateStatusWindow
ImageList_DragLeave
GetMUILanguage
DllGetVersion
FlatSB_SetScrollProp
InitMUILanguage
FlatSB_GetScrollRange
CreateStatusWindowW
PropertySheet
ImageList_DragShowNolock
DrawStatusText
ImageList_SetIconSize
ImageList_Write
ImageList_LoadImageW
CreatePropertySheetPageW
FlatSB_SetScrollRange
ImageList_SetBkColor
ImageList_SetDragCursorImage
GetEffectiveClientRect
CreateToolbarEx
ImageList_EndDrag
FlatSB_EnableScrollBar
ImageList_LoadImage
ImageList_GetIconSize
FlatSB_GetScrollProp
ImageList_GetImageRect
CreatePropertySheetPageA
CreatePropertySheetPage
ImageList_Replace
CreateStatusWindowA
ImageList_Destroy
ImageList_SetFlags
ImageList_Copy
ImageList_GetFlags
ImageList_DragEnter
ImageList_SetImageCount
ImageList_ReplaceIcon
MakeDragList
FlatSB_SetScrollInfo
ImageList_AddMasked
ImageList_Draw
ImageList_AddIcon
ImageList_GetImageInfo
DestroyPropertySheetPage
ImageList_Duplicate
ImageList_GetImageCount
ImageList_DrawIndirect
PropertySheetW
DrawStatusTextW

Exports

Exports

�w�w��+��A��5iEI��\x۳��.Թ{\�<��Tj2��=ѿ$�'��ˬׁ^W�3=�C��D}�Q�^�Tl2 l��߰:o��7(��|ϧ��i^��J��eP�;�p(��5��0��{#L`^��B��T9�+�e1�TM�83��`ȺR�2�􉭆��ȟ��̑��MԧKa�A�=�e��&pʼ��"A7m�<��3#�%��<�q�x�dڭ.?�yo��B��A��!w{x[�c��0Le�e�.p�?��~��9�ſx��`��I�'�w��F��&�b�F~��ܷ9Gi�oJT��^r�y[��B P�Z!�a ��jq�Aa*C�� gj�#��Ĝ�3�| G8r*/�JeA��H�fL~�6%ؖ:C�I��7�c�{|�5[��2��*�½Z��|l��k��=8�g�1�QAq�*j@>��%+*�j�$��#��g��kI�� Qyĵ��`��)[��}�P�^`u��A��Wز�N�'V7��*1�:�g�^s��v�vuz�V;q>��eU�@@��}��A�e�u%(��}"Y�wr/%�8��d?��K��-5t 1�-bg��ǣhh�߲��B��'w�^F��ܻ��g�p`k��dj��.��QK02G��|��=a��ˠ��%��g9�B��y��8ߑ@�_��m"��%��s�_WL��T;JhZ�o6��Xj�ܨ��.�Ĉ?C��4.�G��o�bf'�D�lF�T�@�!l��@/�N��&3��[�E�rOr� <�+�҆��(Mz��t�i(�� e�2��Cz�O��dےֈ�у�q��y��o4 �5��&k�-�ч��~�7Z��B��x{R3o��K��t!Q<��p�Z~�i��߬>k,)�m�)�P ��O3�A��뿨G�M�X��4m!Kh��2P�ŉ�lo��&�@��d��a�ux��=̐۞\l��璧̣��ǊF� �i�&��!{a�M�1��g�mc��3-y�@�Lj��q�)(�;��pr��2ˇ�"��ɨ]*�c7��q��F�z�`"�`�ɘ ��f��j5��|&��H�6M��+�Q?��ơ��gm�uo/R|��'�|j��U�(�u.&�Y�׍�Da��P{�� !��,��;��x�WS0x6]�E�D�ye.��^��ij�k�O�`ey\l?��)ְ��\��y�L��v�W��rG �%ކ �ܮ��Ne ^$��f��匿K��ڞ#�it��u��ږ"�g}a��5F��[��}��_O� ��y �s��[�e��$M��l��k��ٕb�h�^�j0��d��i�!Y��A�@�]�X ?�Cg=J��<#io��XM��>�r�tȥ�Y{p��"".��f�L��P��Xǚf �H*�qw�4$Ǭ��g��w�Wwbx��I��Oǰ�Գ�ݩ<�V��eg��/�컌f]�ҕ��C��b!vu��E�O��ޥ�q\��U޸�r�C��Oڼ��B`�U�Я��6�->!ɠd��v� ۙ�Ç�O�F�{ҍ��V�K��#��V6�z#�� G��N�� c�A1�/qA�PBJ��y��>1�iδdS{T��N�"G��#��*�a�n�A3�WF��>��y��?pbr��?��j�pI��̝vR��Qvɦ� `T��>Zh��q9�C�@�o�'s��CB%-�c��濘��/�V�%�wv3��,qQ\�k��׻Q�=̳Oy��a��Nh�t#0��d��ω��g J�NE��)pZZ��:��_��Dq��@�'�z��Jx��G��8je�x�SLlHL},��.x��#�� L{�CN�TӪG��ʪ�p&��G%ǌ�� | p��n�후�Z�vڥU�˸��wB]�`Uu81��7��DO�s;ˮ��ab�b�,��ԥ�Sۉ��֤�(T�S��~f��h#O��w�ձTo�u�`&�O��u�K؂N�?<��C�p~��T��B� Wy�l�֗ @(�C�3 y�;Ú ,?<��Y-�Ԉ�&v�FG^J֐l�Įu��.gh;��5�7�X�Ӡ|��@XF��C�Hׂ��H��;�T}P�D��EY�A��9K��7��5�f��Bw�Ih��1��s@�F~j@dB^ԇ,��z��^��)�"��cQ�L��w��Dq�*yr$�K�(15S��m��E�j��>B�Ӫ�}��ҳd �Gf�O��6�� T�6��Uk^R��& t��?�4TkUA�L��Ձnx�;��,e��,L��6e6P�~ �6�/� 1&�B$)5s��C��l��)�y';N]6��'�GQ��zwir��Ӑ��k�1��E�K.wN-�@��=w�t�%AUXoV�U��@��.:��\?�+��pH��k"f0��"�O��%��h�/' ø��?Z�a� �p�ۏ�lT�×+��%̨_�Z>��to#�.�W�"s�l�P��1D[�Wi��Y��ah/�o�0^�R ~��3��g0Ir^ 1ʜ��`ܕau��q��ff�Gk܆'hNZ;f��-�X��PA��b<7��_��ȕ�t��wP�榚_��|,=�k��g�:?v~!:��`�Lq�D�O�#B�("X؊~�/��A�cgK��.��~��8��J}a�탅ؗ/��bo1v��G�.@X�+q[�^�[luL�4��!��?I�e0fЁ��H�i��AE��_tJ�ㆽ\��4�#�>��}L�Wzl��8ͬ�C��&:i�m)S4�,'�L��պ��d%.<� �

Sections

CODE
Size: 460KB - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 863B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b2da281f9befc6fae3ac82a68c1e761a

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

9c:39:5a:86:d9:1d:a6:3b:ac:9c:ef:69:4a:77:2b:43Certificate

Extended Key Usages

Key Usages

77:60:05:a7:67:f2:cc:85:7e:86:15:ab:c4:1a:b6:65:92:a6:67:50Signer

Signature Validations

Verification

28/10/2022, 15:17 Valid: false

Headers

File Characteristics

Imports

user32

kernel32

shlwapi

ole32

comdlg32

oleaut32

shell32

winspool.drv

advapi32

gdi32

version

wtsapi32

ws2_32

comctl32

Exports

Exports

Sections

CODE Size: 460KB - Virtual size: 460KB

DATA Size: 24KB - Virtual size: 24KB

BSS Size: - Virtual size: 863B

.idata Size: 30KB - Virtual size: 29KB

.text0 Size: 14KB - Virtual size: 14KB

.tls Size: 512B - Virtual size: 24B

.text1 Size: 92KB - Virtual size: 92KB

.reloc Size: 12KB - Virtual size: 11KB

.rsrc Size: 35KB - Virtual size: 34KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

9c:39:5a:86:d9:1d:a6:3b:ac:9c:ef:69:4a:77:2b:43
Certificate

77:60:05:a7:67:f2:cc:85:7e:86:15:ab:c4:1a:b6:65:92:a6:67:50
Signer

28/10/2022, 15:17
Valid: false

CODE
Size: 460KB - Virtual size: 460KB

DATA
Size: 24KB - Virtual size: 24KB

BSS
Size: - Virtual size: 863B

.idata
Size: 30KB - Virtual size: 29KB

.text0
Size: 14KB - Virtual size: 14KB

.tls
Size: 512B - Virtual size: 24B

.text1
Size: 92KB - Virtual size: 92KB

.reloc
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 35KB - Virtual size: 34KB