6144d527b891483405a683365c16f1c7904010f4989aa9c3c7bafb352cb8293f

Sharing

Copy URL Twitter E-mail

General

Target

6144d527b891483405a683365c16f1c7904010f4989aa9c3c7bafb352cb8293f
Size

685KB
MD5

b410c84dd29cb2732f2eba5ee7613ce6
SHA1

f442bf85eabf0282f37b7c934b14c8b3ddc6c840
SHA256

6144d527b891483405a683365c16f1c7904010f4989aa9c3c7bafb352cb8293f
SHA512

86ce46a6cecf276114101ca9c430270cc3736e698a9bc3b87c9a015474317744c73abf84f7edbfe45f2835beb50f1869c485bfb02a2285c503b72c50c544f6d8
SSDEEP

12288:q7igQ/mFVqDChWOsNiG2bpb01yMH78lLCmHgy7JhD+PwD9rptC:qhQ2VqDChWOxg7u7/+e9FtC

Score

N/A

Malware Config

Signatures

Files

6144d527b891483405a683365c16f1c7904010f4989aa9c3c7bafb352cb8293f
.exe windows x86

b0ccc5c175f6c86424b5a8a30704fa05

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9c:39:5a:86:d9:1d:a6:3b:ac:9c:ef:69:4a:77:2b:43
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

20/05/2015, 00:00

Not After

19/05/2016, 23:59

Subject

CN=PKK OOO,O=PKK OOO,POSTALCODE=241037,STREET=103 ul.Krasnoarmeiskaya,L=Bryansk,ST=Bryansk Region,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:3b:0f:d6:86:db:ee:ee:5d:0f:e8:fc:98:61:e2:75:52:67:06:dd
Signer

Actual PE Digest

77:3b:0f:d6:86:db:ee:ee:5d:0f:e8:fc:98:61:e2:75:52:67:06:dd

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=PKK OOO,O=PKK OOO,POSTALCODE=241037,STREET=103 ul.Krasnoarmeiskaya,L=Bryansk,ST=Bryansk Region,C=RU

28/10/2022, 15:04
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

IsHungAppWindow
DestroyWindow
MessageBeep
SetWindowsHookW
SetCapture
GetClassWord
ShowWindow
FlashWindowEx
GetKeyboardLayout
ChildWindowFromPointEx
WinHelpW
CloseWindow
SetDlgItemTextW
DlgDirSelectExW
ChangeDisplaySettingsA
ShowCursor
GetKeyboardType
ModifyMenuW
ClipCursor
SetClassWord
GetScrollPos
OemToCharBuffA
GetLastInputInfo
SetDebugErrorLevel
EnableMenuItem
GetMenuStringA
DrawTextExA
SetDoubleClickTime
FindWindowExW
GetClipCursor
InvalidateRect
MessageBoxExW
DestroyCaret
GetInputDesktop
RegisterHotKey
PrivateExtractIconsW
DragObject
SetMessageExtraInfo
MessageBoxTimeoutW
AllowForegroundActivation
GetMonitorInfoA
SetCaretBlinkTime
ToUnicodeEx
GetProgmanWindow
IsIconic
OpenIcon
DrawIconEx
SetCursor
GetAltTabInfoA
GrayStringA
DrawTextExW
DrawFocusRect
CopyAcceleratorTableA
PrintWindow
MessageBoxW
ValidateRgn
SetWindowPos
SetWindowRgn
MessageBoxIndirectW
GetListBoxInfo
CharPrevA
CharUpperW
EndPaint
WaitMessage
DefDlgProcA
EnableWindow
BlockInput
RemovePropA
UpdateWindow
IsCharLowerA
GetMessageA
MessageBoxA
ArrangeIconicWindows
RemoveMenu
GetSysColor
DrawTextW
CharPrevW
GetKeyNameTextW
CascadeChildWindows
LockWindowUpdate
GetClipboardData
LoadImageA
BringWindowToTop
MenuWindowProcA
DispatchMessageA
GetWindowPlacement
SetMenu
IsDialogMessageW
ReleaseDC
SetScrollInfo
CloseWindowStation
RegisterClassExA
ChangeDisplaySettingsExA
PostThreadMessageW
LoadMenuW
SetForegroundWindow
LoadCursorA
ChangeDisplaySettingsExW
GetDlgItemTextW
ValidateRect
GetThreadDesktop
GetScrollRange
IsDialogMessageA
DrawMenuBar
GetActiveWindow
SetWindowsHookExW
GetTitleBarInfo
DlgDirListA
MapVirtualKeyExA
RegisterClipboardFormatA
IsWindowUnicode
SetPropA
OemKeyScan
GetUserObjectInformationA
CheckDlgButton
EnumWindowStationsA
RealGetWindowClassA
SwapMouseButton
ShowWindowAsync
DrawFrame
OemToCharW
GetClassNameA
DefWindowProcW
DrawEdge
DialogBoxParamW
DrawCaptionTempA
TileChildWindows
SetScrollRange
CharNextW
OpenClipboard
RegisterClassExW
UnlockWindowStation
UnregisterClassA
CreateIcon
LoadAcceleratorsA
SetLastErrorEx
EnumPropsA
GetMouseMovePointsEx
MonitorFromWindow
OpenDesktopA
ScrollWindowEx
GetScrollBarInfo
CreateMDIWindowW
SendNotifyMessageA
BroadcastSystemMessageExA
SetRectEmpty
DrawStateW
SetClassLongA
ToAsciiEx
EnumPropsExA
DialogBoxParamA
GetWindowContextHelpId
PostMessageA
GetDialogBaseUnits
SetSysColors
PeekMessageW
ChildWindowFromPoint
RedrawWindow
LoadCursorFromFileA
SetMenuItemInfoA
LoadIconA
GetClassInfoExA
EmptyClipboard
EndDialog
GetNextDlgGroupItem
SetWindowsHookA
CopyIcon
IsWindow
GetClipboardOwner
DestroyIcon
TileWindows
PostMessageW
GetClassLongW
ChangeDisplaySettingsW
CreateAcceleratorTableW
CharLowerBuffW
GetRawInputDeviceInfoW
DlgDirSelectExA
DrawMenuBarTemp
EnableScrollBar
RegisterClassW
RemovePropW
SetLayeredWindowAttributes
GetClassInfoW
GetCaretPos
GetTabbedTextExtentA
GetTopWindow
GetUserObjectInformationW
AdjustWindowRectEx
SetClipboardData
GetWindowModuleFileNameW
SubtractRect
CharUpperBuffW
GetWindowTextLengthW
SetKeyboardState
GetCaretBlinkTime
InsertMenuA
GetWindowTextW
CheckMenuItem
IsCharAlphaW
SetMenuInfo
MessageBoxIndirectA
GetWindowWord
SystemParametersInfoA
ShowOwnedPopups
TrackMouseEvent
SetProcessWindowStation
wsprintfW
GetMenuItemID
GetShellWindow
GetSysColorBrush
GetWindowThreadProcessId
KillTimer
DialogBoxIndirectParamA
InsertMenuItemW
DefFrameProcA
SetClipboardViewer
GetKeyNameTextW

kernel32

SetSystemTimeAdjustment
WriteFileGather
WriteTapemark
CreateDirectoryExW
GlobalCompact
GetLocaleInfoA
WriteProfileStringA
SetInformationJobObject
GlobalFix
SetEvent
GetVersion
SetFileApisToANSI
SetCalendarInfoW
EndUpdateResourceA
ReadConsoleW
EnumResourceTypesA
ProcessIdToSessionId
GetWriteWatch
CallNamedPipeA
LZOpenFileA
CancelWaitableTimer
GetProcessPriorityBoost
BuildCommDCBAndTimeoutsW
GenerateConsoleCtrlEvent
SetThreadUILanguage
FindVolumeMountPointClose
DeactivateActCtx
GetPrivateProfileIntA
SetProcessWorkingSetSize
ReadConsoleOutputAttribute
HeapLock
GetLogicalDrives
WriteFile
GlobalMemoryStatus
LoadModule
RequestDeviceWakeup
MoveFileWithProgressA
QueryDosDeviceW
GetModuleHandleExW
HeapSetInformation
FindFirstVolumeA
GetVolumePathNameA
ReadConsoleInputW
BeginUpdateResourceW
LZCreateFileW
VirtualQuery
CreateSemaphoreA
GetCurrentProcess
FreeUserPhysicalPages
CreateHardLinkW
GlobalHandle
CreateEventA
CloseHandle
GlobalLock
FindFirstVolumeW
EndUpdateResourceW
CopyLZFile
lstrcmp
ReadConsoleInputExW
RtlFillMemory
lstrlenA
FindFirstVolumeMountPointW
GetModuleFileNameA
FileTimeToLocalFileTime
IsBadCodePtr
GetConsoleInputWaitHandle
HeapSize
LocalLock
GetVolumeNameForVolumeMountPointA
GetDriveTypeW
GetCommProperties
MoveFileExA
SetFilePointer
ShowConsoleCursor
CreateMailslotA
ReadConsoleOutputCharacterW
WriteConsoleOutputCharacterA
GetTickCount
SetFilePointerEx
HeapDestroy
GetProcessHeaps
GetCurrencyFormatA
FreeLibraryAndExitThread
QueueUserWorkItem
SetCurrentDirectoryW
LZCopy
EnumResourceTypesW
CompareStringW
WritePrivateProfileStringA
SetFileAttributesA
FindFirstChangeNotificationW
GetEnvironmentStringsA
GetVolumePathNameW
MoveFileWithProgressW
SetFileTime
SetFileShortNameA
SystemTimeToTzSpecificLocalTime
WaitForMultipleObjects
InterlockedCompareExchange
GetCPInfoExA
GetConsoleSelectionInfo
InterlockedDecrement
WaitForSingleObjectEx
BeginUpdateResourceA
CreateMailslotW
GetCPInfoExW
WaitForSingleObject
EnumLanguageGroupLocalesW
GetConsoleHardwareState
FlushConsoleInputBuffer
EnumResourceNamesW
GetShortPathNameW
CreateTimerQueue
DefineDosDeviceW
GetCurrentThread
GetFileInformationByHandle
FatalAppExitW
GetLogicalDriveStringsW
GetConsoleAliasesA
FreeConsole
DeleteTimerQueue
GetSystemDirectoryA
GetConsoleFontSize
CopyFileA
SetThreadAffinityMask
SignalObjectAndWait
SetFileAttributesW
ResetWriteWatch
RestoreLastError
Heap32ListFirst
GetUserDefaultLCID
GetExpandedNameA
LCMapStringW
GlobalAddAtomW
BuildCommDCBAndTimeoutsA
UnmapViewOfFile
SetDefaultCommConfigW
QueryDosDeviceA
lstrlen
FindNextVolumeA
RtlMoveMemory
DeleteTimerQueueEx
WriteConsoleInputW
GetDefaultCommConfigW
LockFileEx
CreateFileW
FormatMessageA
EnumSystemCodePagesA
FindAtomA
FindClose
lstrcatW
VerLanguageNameW
SetProcessPriorityBoost
OpenJobObjectW
GetGeoInfoW
InitAtomTable
GlobalSize
GetTimeFormatW
GetACP
CreateDirectoryExA
GetPrivateProfileStructW
GlobalGetAtomNameW
ConnectNamedPipe
GetVolumePathNamesForVolumeNameA
FreeResource
TerminateProcess
GetThreadPriorityBoost
PrepareTape
VirtualUnlock
AddAtomA
GetDiskFreeSpaceA
DosPathToSessionPathA
GetPrivateProfileIntW
GlobalFree
LZStart
OpenMutexW
EnumCalendarInfoA
SetTapePosition
GetTapeParameters
FatalAppExitA
FreeLibrary
CreateProcessW
SetCommMask
WideCharToMultiByte
GetLongPathNameW
FoldStringA
FreeEnvironmentStringsA
CreateJobSet
SetComPlusPackageInstallStatus
CreateActCtxW
lstrcmpiA
FlushInstructionCache
OpenSemaphoreW
GlobalAddAtomA
GetConsoleTitleW
SetFileShortNameW
FindNextVolumeMountPointA
ActivateActCtx
GetStringTypeW
SetTapeParameters
IsBadWritePtr
VerLanguageNameA
lstrcmpi
DebugBreak
ReadFileEx
SetCommTimeouts
GetConsoleWindow
GetProfileStringA
LZCloseFile
FreeEnvironmentStringsW
CreateJobObjectA
GetModuleFileNameW
GetGeoInfoA
lstrcpyn
GetCompressedFileSizeA
FindVolumeClose
SetFileValidData
CreateDirectoryW
EnumDateFormatsA
WriteConsoleOutputCharacterW
SetPriorityClass
SetThreadLocale
SetCommBreak
GetConsoleAliasesW
GetUserDefaultLangID
RaiseException
GetModuleHandleA
GetThreadContext
SetLocaleInfoW
ReadConsoleOutputA
GetThreadSelectorEntry
BackupSeek
OpenEventA
CreateNamedPipeW
SetCriticalSectionSpinCount
GetThreadPriority
SetEndOfFile
GetCurrentDirectoryW
GetUserDefaultUILanguage
QueryInformationJobObject
SystemTimeToFileTime
GetFileAttributesExW
GetConsoleInputExeNameW
ReplaceFile
GetDefaultCommConfigA
MapViewOfFileEx
GetComputerNameExA
WinExec
GetPriorityClass
DisableThreadLibraryCalls
CopyFileExA
ReadConsoleA
ChangeTimerQueueTimer
CreateHardLinkA
GetAtomNameW
TerminateJobObject
GetDiskFreeSpaceExW
FindFirstFileExA
GetVersionExW
LocalAlloc
FindNextVolumeW
WritePrivateProfileStructA
GetNamedPipeHandleStateW
CreateSemaphoreW
GetSystemPowerStatus
lstrcmpA
GetConsoleCP
EnumResourceLanguagesA
DisconnectNamedPipe
AddConsoleAliasA
SetVolumeMountPointA
AllocateUserPhysicalPages
HeapCompact
InterlockedIncrement
GlobalFindAtomW
PeekNamedPipe
LocalHandle
CancelTimerQueueTimer
UpdateResourceA
GetPrivateProfileSectionNamesA
LockResource
GetBinaryTypeW
InterlockedExchangeAdd
VirtualLock
GetFileAttributesExA
FindActCtxSectionGuid
VirtualQueryEx
FindNextFileA
GetCompressedFileSizeW
SetLastError
GetVolumeInformationW
ReadConsoleInputExA
EnumSystemLanguageGroupsW
HeapFree
GetDateFormatA
TzSpecificLocalTimeToSystemTime
GlobalMemoryStatusEx
SetThreadContext
CreateFileA
Heap32First
GetCurrentThread
GetVersion
LoadLibraryExA
VirtualUnlock
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

shlwapi

StrFormatByteSizeA
SHEnumValueW
SHRegCloseUSKey
PathStripPathA
UrlCreateFromPathW
StrCSpnA
SHCreateStreamOnFileA
StrCmpNIA
SHSetValueA
PathIsPrefixA
UrlIsOpaqueA
StrToIntA
StrCatChainW
AssocQueryStringByKeyA
PathFindFileNameW
StrDupA
SHCreateStreamOnFileW
PathRemoveFileSpecA
PathStripToRootW
PathGetCharTypeA
SHQueryValueExA
PathIsNetworkPathW
StrRChrA
StrStrNW
PathAppendA
StrSpnA
StrCmpW
SHEnumValueA
PathIsUNCServerW
PathIsDirectoryW
SHEnumKeyExW
SHRegGetBoolUSValueW
SHRegQueryInfoUSKeyW
StrCSpnW
PathStripToRootA
SHRegSetPathW
StrIsIntlEqualA
SHStrDupA
StrDupW
PathFindFileNameA
PathSkipRootW
StrRetToStrW
StrCatBuffA
StrRStrIA
SHDeleteEmptyKeyW
PathMatchSpecW
AssocQueryStringByKeyW
SHGetThreadRef
SHRegDuplicateHKey
PathIsSystemFolderW
SHDeleteKeyA
PathRemoveArgsW
UrlGetLocationA
PathIsUNCA
UrlCreateFromPathA
PathGetDriveNumberA
SHLoadIndirectString
StrCpyNW
SHRegGetPathW
ChrCmpIA
PathRemoveBackslashW
StrStrIA
PathCreateFromUrlA
PathRenameExtensionW
SHCreateShellPalette
SHRegDeleteUSValueA
StrCmpNA
SHGetValueA
SHRegEnumUSValueA
PathIsRootW
SHOpenRegStream2W
PathFindNextComponentW
SHRegDeleteEmptyUSKeyW
GetMenuPosFromID
StrCatBuffW
SHDeleteValueW
StrCmpNIW
PathFindNextComponentA
StrToInt64ExW
StrCmpLogicalW
PathStripPathW
PathIsUNCServerA
PathIsPrefixW
PathCompactPathA
SHRegCreateUSKeyW
SHRegOpenUSKeyW
UrlCombineA
StrToIntExA
PathBuildRootA
SHRegDeleteEmptyUSKeyA
StrStrA
SHRegSetPathA
PathIsRootA
IntlStrEqWorkerA
UrlUnescapeA
ColorRGBToHLS
StrFormatByteSize64A
AssocQueryKeyA

ole32

CoCreateObjectInContext
OleGetIconOfFile
OleQueryLinkFromData
CoGetObjectContext
IsValidPtrOut
CoCreateGuid
CoCopyProxy
OleCreateLinkToFile
CoGetContextToken
CoInitializeSecurity
OleDuplicateData
HWND_UserFree
CoGetInterceptorFromTypeInfo
CoReleaseServerProcess
CoTestCancel
SNB_UserSize
CoTaskMemAlloc
CoInitializeWOW
CoCreateInstance
ReadFmtUserTypeStg
WriteOleStg
CoQueryProxyBlanket
StgCreateDocfile
OleSetAutoConvert
GetHGlobalFromILockBytes
StgCreatePropSetStg
DllGetClassObject
WriteFmtUserTypeStg
DoDragDrop
CoGetDefaultContext
CoGetObject
CreateOleAdviseHolder
CoGetProcessIdentifier
CLSIDFromOle1Class
HBRUSH_UserFree
CoDisableCallCancellation
ProgIDFromCLSID
HMENU_UserFree
CreateDataAdviseHolder
CoRevokeMallocSpy
UtGetDvtd16Info
CoLockObjectExternal
OleRegEnumFormatEtc
FreePropVariantArray
OleRegEnumVerbs
PropSysFreeString
OleSetContainedObject
CLSIDFromString
CoIsOle1Class
StgOpenAsyncDocfileOnIFillLockBytes
CoFreeLibrary
PropSysAllocString
IsAccelerator
DllGetClassObjectWOW
IsEqualGUID
CoMarshalHresult
OleCreateEmbeddingHelper
CoGetInstanceFromFile
CoMarshalInterface
OleConvertOLESTREAMToIStorage
StgOpenPropStg
CoGetClassObject
CoCancelCall
OleQueryCreateFromData
PropVariantCopy
HMETAFILE_UserFree
CoRevertToSelf
CoSetState
CoFileTimeNow
HPALETTE_UserSize
CreatePointerMoniker
HBITMAP_UserSize
SNB_UserUnmarshal
CoMarshalInterThreadInterfaceInStream
CoQueryReleaseObject
EnableHookObject
HWND_UserSize

comdlg32

ChooseColorW
GetFileTitleA
CommDlgExtendedError
GetOpenFileNameW
PrintDlgW
WantArrows
PageSetupDlgW
PageSetupDlgA
GetSaveFileNameW
GetOpenFileNameA
FindTextW
GetSaveFileNameA
ChooseColorA
dwLBSubclass
ChooseFontW
GetFileTitleW
dwOKSubclass
PrintDlgA
ChooseFontA
PrintDlgExW
LoadAlterBitmap
ReplaceTextA
ReplaceTextW
FindTextA

oleaut32

VarBstrCmp
SafeArrayCopy
VarDateFromR4
VariantChangeType
VarI4FromDisp
VarBstrFromDec
SafeArrayGetElement
VarR4FromI8
VarDateFromDisp
VarI4FromStr
VarCmp
VarDecCmpR8
VarI1FromDec
VarDateFromUI2
VarR8FromBool
VarEqv
VarUI4FromI8
DllCanUnloadNow
VarBstrCat
BSTR_UserMarshal
OleLoadPicturePath
VarCyFromI2
GetVarConversionLocaleSetting
LHashValOfNameSysA
DllRegisterServer
VarI1FromUI2
VarUI1FromR8
VarUI2FromDisp
VarImp
SafeArrayGetDim
VarI8FromUI4
VarUI8FromDate
SetOaNoCache
VarFormatCurrency
VarFormatDateTime
SysAllocStringByteLen
VarBoolFromUI8
VarCyAbs
VarI4FromUI1
VarI8FromI1
VarI1FromDisp
VarR4FromI4
LHashValOfNameSys
VarR8FromUI8
VarUI8FromI2
VarI1FromI8
OleCreatePropertyFrame
VarNumFromParseNum
VarUI1FromStr
VarI4FromCy
VarUI4FromUI2
VarUI1FromDec
VarDecFromDisp
VarI4FromR8
VarFix
VarUI8FromCy
VarNeg
SafeArrayAllocDescriptorEx
VarUI4FromR8
VarCyMul
SysReAllocStringLen
VarR8FromUI4
VarI4FromR4
VarDateFromUdateEx
UnRegisterTypeLib
VarDateFromUI4
VarCyFromStr
VarUI8FromUI2
SafeArrayGetRecordInfo
ClearCustData
VarFormatNumber
VarUI2FromI1
VarDecFromUI8
VarI1FromStr
LPSAFEARRAY_UserSize
VarUI8FromR8
VarBoolFromI8
VarDecRound
VarI8FromDate
DispInvoke
SysFreeString
VarUI4FromDec
SystemTimeToVariantTime
VarBoolFromUI4
CreateTypeLib
VarUI4FromDate
DispGetParam
VarR4FromI1
LPSAFEARRAY_Size
VarDiv
VarBoolFromI1
SafeArrayAllocDescriptor
DispCallFunc
VarDecFromUI1
SysStringLen
VarR8FromUI1
VarI2FromUI1
VarUI2FromDate
VarUI4FromDisp

shell32

SHFreeNameMappings
SHAppBarMessage
RealShellExecuteW
SheChangeDirExW
RealShellExecuteExA
DllRegisterServer
SheSetCurDrive
SHInvokePrinterCommandA
SHGetFileInfoA
FreeIconList
SHInvokePrinterCommandW
SHQueryRecycleBinA
StrRStrW
SheChangeDirA
CommandLineToArgvW
StrNCmpW
SHBindToParent
DragAcceptFiles
SHAddToRecentDocs
ShellHookProc
ExtractAssociatedIconW
SHGetFileInfoW
Control_RunDLLW
AppCompat_RunDLLW
SHGetDesktopFolder
StrNCmpIA
SHBrowseForFolder
SHSetUnreadMailCountW
SHExtractIconsW
SHPathPrepareForWriteA
ShellExecuteA
DllGetVersion
SHLoadInProc
StrChrIA
StrRStrIA
DllCanUnloadNow
ShellExec_RunDLL
StrRChrIA
InternalExtractIconListA
StrCmpNIA
ExtractAssociatedIconExA
SHUpdateRecycleBinIcon
SHPathPrepareForWriteW
ShellExec_RunDLLW
DllInstall
DoEnvironmentSubstW
SHBrowseForFolderW
SHGetNewLinkInfo
SheGetDirA
Control_RunDLL
StrNCmpIW
Options_RunDLLW
ExtractAssociatedIconExW
DragFinish
SHGetFolderLocation
SHGetPathFromIDListW
SHChangeNotifySuspendResume
ShellAboutW
StrCmpNA
Options_RunDLLA
StrChrA
StrRChrIW
DragQueryPoint
SHEnumerateUnreadMailAccountsW
ExtractIconA
SHFileOperationW
StrChrW
StrRStrA
SHCreateShellItem
SHSetLocalizedName
SHChangeNotify
SHGetMalloc
SHGetPathFromIDList
SHParseDisplayName
StrCmpNIW
SHGetDiskFreeSpaceExW
SHOpenFolderAndSelectItems
SHCreateLocalServerRunDll
SHGetNewLinkInfoA
SHLoadNonloadedIconOverlayIdentifiers
SHCreateProcessAsUserW
Shell_NotifyIconW
SHCreateQueryCancelAutoPlayMoniker
SHGetFolderPathA

winspool.drv

XcvDataW
AddPrintProvidorW
DevicePropertySheets
GetPrinterDataExA
GetPrinterW
WaitForPrinterChange
FindNextPrinterChangeNotification
AdvancedSetupDialog
EnumPrintProcessorsA
StartDocDlgA
PerfCollect
PrinterMessageBoxA
EnumPrintersA
SetPrinterDataA
EnumPrinterDriversW
AddPrinterDriverExW
EnumPrinterKeyW
EnumPrintProcessorDatatypesA
AddMonitorA
OpenPrinterA
GetJobA
DeletePrinterDriverA
PrinterProperties
DeletePrinterKeyW
StartPagePrinter
PerfClose
AdvancedDocumentPropertiesA
DEVICECAPABILITIES
GetSpoolFileHandle
SpoolerPrinterEvent
AddPrinterA
DeletePrintProcessorW
DevQueryPrintEx
GetDefaultPrinterW
EnumFormsW
DEVICEMODE
GetFormA
FindClosePrinterChangeNotification
GetDefaultPrinterA
SetPrinterA
EnumPrinterKeyA
DeletePrinterConnectionW
EndDocPrinter
EnumPortsA
SetPortA
DevQueryPrint
GetPrinterDriverDirectoryA
AddPortExW
GetPrinterDataExW
OpenPrinterW
EXTDEVICEMODE
CreatePrinterIC
QueryColorProfile
SetJobW
ResetPrinterW
AddPrinterConnectionA
StartDocPrinterW
ConvertUnicodeDevModeToAnsiDevmode
SetDefaultPrinterW
CommitSpoolData
EnumMonitorsA
SeekPrinter
DeletePrintProcessorA
AdvancedDocumentPropertiesW
GetPrintProcessorDirectoryA

advapi32

RegEnumKeyA
BuildImpersonateExplicitAccessWithNameA
CredFree
CredGetSessionTypes
LsaGetRemoteUserName
LsaICLookupSidsWithCreds
GetLocalManagedApplications
CloseCodeAuthzLevel
CryptAcquireContextA
EnumerateTraceGuids
RevertToSelf
AddUsersToEncryptedFile
RegisterIdleTask
SaferiChangeRegistryScope
SetSecurityInfoExW
EncryptFileA
SetSecurityDescriptorSacl
AddAccessDeniedObjectAce
CryptDuplicateKey
SaferGetLevelInformation
BuildTrusteeWithObjectsAndNameA
SetSecurityInfo
EnumDependentServicesW
CryptEnumProvidersW
GetUserNameA
BuildImpersonateTrusteeA
CryptDestroyHash
AllocateAndInitializeSid
GetSidSubAuthorityCount
TreeResetNamedSecurityInfoA
RegDeleteValueW
SetEntriesInAccessListW
SetSecurityDescriptorRMControl
UpdateTraceW
GetCurrentHwProfileA
LsaICLookupNames
GetTraceLoggerHandle
GetEffectiveRightsFromAclA
CredGetTargetInfoA
ConvertStringSidToSidA
GetOverlappedAccessResults
LsaNtStatusToWinError
AccessCheckByTypeAndAuditAlarmA
ElfRegisterEventSourceA
RegSetKeySecurity
RegDisablePredefinedCache
LsaSetTrustedDomainInformation
BuildTrusteeWithSidW
GetSecurityDescriptorGroup
ReadEventLogA
GetLocalManagedApplicationData
PrivilegedServiceAuditAlarmW
WmiEnumerateGuids
AccessCheckByTypeResultListAndAuditAlarmByHandleW
LookupSecurityDescriptorPartsA
RegCloseKey
RegCreateKeyExA
CryptSetProviderA
LsaAddPrivilegesToAccount
LsaOpenPolicySce
StopTraceW
LsaCreateTrustedDomain

gdi32

EngStretchBlt
GetMapMode
CombineRgn
EnumFontsA
EngCreateClip
GetWindowOrgEx
CreateEnhMetaFileW
EngTextOut
GetPath
GetTextExtentPointA
DeleteMetaFile
CreateFontIndirectW
SetROP2
LPtoDP
SetPaletteEntries
GetTransform
CreateScalableFontResourceA
BRUSHOBJ_ulGetBrushColor
GetTextMetricsW
ScaleViewportExtEx
SetICMMode
StretchBlt
StrokeAndFillPath
EngEraseSurface
CreateMetaFileW
SetBkColor
FlattenPath
EngStrokePath
CLIPOBJ_cEnumStart
SetLayout
GetTextCharsetInfo
GetCurrentPositionEx
SetDCPenColor
MaskBlt
GetFontResourceInfoW
EndPath
GetCharWidthW
EngGradientFill
EnumFontsW
StartPage
EngCreateBitmap
STROBJ_vEnumStart
CreateHatchBrush
HT_Get8BPPFormatPalette
GetCharWidth32A
FillRgn
GetStockObject
GdiDescribePixelFormat
SetTextAlign
STROBJ_bEnum
StartFormPage
CreateDIBitmap
RoundRect
GetObjectType
GetBitmapAttributes
DeviceCapabilitiesExW
GetROP2
GetEnhMetaFileDescriptionW
OffsetViewportOrgEx
CreateScalableFontResourceW
SelectFontLocal
GdiPrinterThunk
GetClipRgn
STROBJ_bGetAdvanceWidths
CreatePolyPolygonRgn
SetPolyFillMode
ExcludeClipRect
SetRectRgn
GetEUDCTimeStampExW
XFORMOBJ_bApplyXform
RectInRegion
Rectangle
SetTextJustification
GdiSetLastError
PlayEnhMetaFileRecord
GetAspectRatioFilterEx
RemoveFontMemResourceEx
SelectObject
PolyPolygon
Arc
PlayEnhMetaFile
EngUnicodeToMultiByteN

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueW
VerQueryValueA
VerFindFileA
GetFileVersionInfoW
VerFindFileW
VerLanguageNameW
GetFileVersionInfoSizeW
VerInstallFileW
VerLanguageNameA

wtsapi32

WTSSetSessionInformationW
WTSLogoffSession
WTSTerminateProcess
WTSEnumerateServersA
WTSOpenServerA
WTSOpenServerW
WTSQuerySessionInformationW
WTSSendMessageA
WTSQueryUserConfigA
WTSVirtualChannelPurgeOutput
WTSQuerySessionInformationA
WTSEnumerateProcessesA
WTSQueryUserConfigW
WTSWaitSystemEvent
WTSSetSessionInformationA
WTSRegisterSessionNotification
WTSEnumerateSessionsW
WTSVirtualChannelOpen
WTSShutdownSystem
WTSVirtualChannelWrite
WTSEnumerateProcessesW
WTSFreeMemory
WTSEnumerateServersW
WTSSendMessageW
WTSVirtualChannelClose
WTSVirtualChannelPurgeInput
WTSUnRegisterSessionNotification
WTSEnumerateSessionsA
WTSDisconnectSession
WTSCloseServer
WTSSetUserConfigA

ws2_32

WSAGetServiceClassNameByClassIdW
htons
WSAUnhookBlockingHook
WSAAsyncGetServByPort
getnameinfo
ntohs
WSADuplicateSocketW
WSAGetServiceClassNameByClassIdA
WSASetServiceW
ioctlsocket
WSARecv
sendto
WSASocketA
WSAStringToAddressA
WSAStringToAddressW
getservbyname
WSASetServiceA
WSAProviderConfigChange
accept
WSAGetQOSByName
gethostbyname
WSAAsyncGetHostByName
WSACancelAsyncRequest
WSAGetOverlappedResult
WSCUpdateProvider
shutdown
WSCEnableNSProvider
WSADuplicateSocketA
WSALookupServiceNextW
WSALookupServiceBeginW
WSARecvDisconnect
WSAAsyncGetHostByAddr
closesocket
WSAEnumNameSpaceProvidersW
setsockopt
WSAWaitForMultipleEvents
getservbyport
WSARecvFrom
WSASetBlockingHook
WSALookupServiceBeginA
WSARemoveServiceClass
WSCInstallNameSpace
WSACancelBlockingCall
WSAIsBlocking
WSAHtons
WSAAsyncSelect
getprotobyname
bind
WSALookupServiceEnd
getsockopt
inet_addr
WSAAddressToStringA
WSASetEvent
WSAGetLastError
WSAGetServiceClassInfoA
htonl
gethostname
WSAEventSelect
listen
WSAGetServiceClassInfoW
socket
WSCGetProviderPath
WSAResetEvent
gethostbyaddr
WSCDeinstallProvider

comctl32

ImageList_DrawEx
ImageList_Add
FlatSB_GetScrollInfo
FlatSB_ShowScrollBar
CreateUpDownControl
InitializeFlatSB
ImageList_GetDragImage
LBItemFromPt
CreateToolbar
FlatSB_GetScrollPos
ImageList_GetIcon
CreateStatusWindow
ImageList_DragLeave
GetMUILanguage
DllGetVersion
FlatSB_SetScrollProp
InitMUILanguage
FlatSB_GetScrollRange
CreateStatusWindowA
PropertySheet
ImageList_DragShowNolock
DrawStatusText
ImageList_SetIconSize
ImageList_Write
ImageList_LoadImageA
CreatePropertySheetPageA
FlatSB_SetScrollRange
ImageList_SetBkColor
ImageList_SetDragCursorImage
GetEffectiveClientRect
CreateToolbarEx
ImageList_EndDrag
FlatSB_EnableScrollBar
ImageList_LoadImage
ImageList_GetIconSize
FlatSB_GetScrollProp
ImageList_GetImageRect
CreatePropertySheetPageW
CreatePropertySheetPage
ImageList_Replace
CreateStatusWindowW
ImageList_Destroy
ImageList_SetFlags
ImageList_Copy
ImageList_GetFlags
ImageList_DragEnter
ImageList_SetImageCount
ImageList_ReplaceIcon
MakeDragList
FlatSB_SetScrollInfo
ImageList_AddMasked
ImageList_Draw
ImageList_AddIcon
ImageList_GetImageInfo
DestroyPropertySheetPage
ImageList_Duplicate
ImageList_GetImageCount
ImageList_DrawIndirect
PropertySheetA
DrawStatusTextA

Exports

Exports

�H��t{z��tpp EՅ��0:FR]l�C��i��P�"�-2�2t��g_[��⫴��PC�{OT�`ן��x��p\��Uoa��Na䩨��☼�!X (Qy ՘_J�K^?<��Xu��9�/l�@��_�vfƘ@��wKE�an��|J�z�ץ�rs�&�;Dhڢ��,��[9 ��Zk��2�膔��N��`�(��Vt�E��%��Z��rC ��#�v%S�2��V5��A2\��v��'��8��YņtkŊ핫A��!��g�t�К;�p21�j�B�ON��]�9�V��ʧ��d��D��e'� vF{��ѝ�j?6i��C�=��5��(:4�)�z��I$�cc|�]�艷E��5�M�Ƶ��xչʤ��* ��E:�T_k�q81��Ɏ��&@*�%@�qg�fDM�Ǥ��]�ǳ�)l{��7F�&�@��/hAM��T�2��,ik��`�� Ũ��@��)riz5��F��wj�Ƭ�R�f�V�l��g��l�q&��'RF(z��Ϭ�Q�(�z�Pc��1pW��.��-~��fZM�@�O��A =��>C�e�Kg!�5 �r= ؠ��s��P�L^Q��!a鍪s,}i#��D'E�^-��0� aOjVk��#4�Y��U��Z.�k<��~v�|pN��q�n�� v� ��D� �Ĕ[�nw��q�O�n6��n�j�.��ٔf��n��-յ�$��FQ̜�<t�Eh#��D�#[y�Q�M|�n3�7/H�i��>�y��N��eA�ڂDu��|�:�E@s& i*�,VtE>C!�a��mW�B#��U�O0϶xT�z��lC�G�I��^)a�40��ٽZ%z��Ӄt�{��L@Ǌi�x�D�;;��}�/� F�О��@�y Aͦ`1m�vj�� ;T/��\��P��&��=�F��mH0\9}DbN��X��Ɯp��r(H?��b8�7**�Dh�SѾ��<��./�3�v��B��5zVu[��b.�4;�y�O �-&]YnB��ET�D)��պo�BE��F��$��m��uS��L�|&|۸��}�<�R-�G�_M��[U��?e�}��۪��_��l��1ʮ��b� ��V�y��&޾kn1��K˯|��l�f�w?��w��3E'/�v�~,VS��a�B��qd��=�G��L��h5�r��xIl��EVO1��%��E��rM�;��o*�)��[��F?#�@�If5�ۇ$_��RSE��"�� 3��Ǎy��;L�ܜ?��i=P5��6]�w�E��Q�ӡ�kY0%��}g��nl�vAW>�Q5li�ӗ��`�� q#f��bv��'\\�\� �16Y�z�k��ڎk�L򘬍-��GB2�{,� @��%|L�e� ��`�ĴQ��i TP��Ofc��|��~�܋�v`�Q��Lq�WS<��ĭ��w5�Ԁ��x�h̭bG��9�ͼm��3Q-��VY�m�#��d��}uB<m�]��$q�͙�қP3+eX��n��D��D{��Y\�d��XvTw~�bMt�c��|�>��Đ��5�Í��>Ԋ%}G%&�f��L(�:U5Wlu��ަ�*h�:�vs�˝C�\��#sq��#��|*;{�ؗbF��.��F�i�bZ� k�@��41<DJ$1��w��l��Mɇ��W5�g��[P�9��<��SxG�h(Bls6�)2X��@�яN(e�掗2��V (�P��@��a��;�j%�FD0Q��[� �_9~<|%��z��R(��zƗgq.�7��C�wP(��_fi*��K?��y�4��hǨ>�D�Brw[`��ꑟ]Ơ y��q�g�j5�Bֽ��%�F0�*�("��p�Vgx�O��S�S�r�R|�?j�q�2.K�n�BI�F�� ^�-N�_��w�^ p��%[�,� 'ż֍g�OQ�맼P�� MÒ�)+��Md5)�V�h�s:��(��ixP� ��㷕�n �}��Weq�W"��}A]�2"��G�a3&��lk�Cl��F��lժ��vm"�u��p��Ԯ6ٖ�[J�Xr*-��}1��o��#܇��WE��SY��+��SкfyH}��෥��`^��T�2+0��=�s ��-&��YǠ��-�bN��F�SQ��$��o��w�� WMB��p�X �#ɦ�}��ݔ�N��A{�˩��g9�ю��え�u��o�-�5e�c�]��Z��l��_l��9��"��X�S��%-�Pф,�yg�s+i0f�~E`�Nipgك�� l��(5��j��*��jƛ��ȏ��f��'U�ʬ��V�� /�l�.9�2D��)b+��S�� rt��TfDm_��H�,��V��Yb!ļ��2�[�[Uu��߫��W�Օ�zrN�ܹ|D3��r��v#L��C��@� ��y�� HQ:�{��K�7�l��g��Wϖ� ?��!Q7�� <6��+]}T�-R��l�W.�:�[��ۃ��j[�4+�U�Ρ5��ΥB��'�?)b��w�|L�A+IP0�E:�I*9��]]ջ�=�8<i{�gpq�fx�H�%��Q�n�4#�h��f3��K��4��D�8ä�}]��n��YY�}�ؖ��<r�MvN� �;��%�~��2Z��>#іn�V�W3�ɻ�ii\��D3$%Y��;��õv��iɜw�I)=� �) ��

Sections

CODE
Size: 460KB - Virtual size: 464KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 24KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0ccc5c175f6c86424b5a8a30704fa05

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

9c:39:5a:86:d9:1d:a6:3b:ac:9c:ef:69:4a:77:2b:43Certificate

Extended Key Usages

Key Usages

77:3b:0f:d6:86:db:ee:ee:5d:0f:e8:fc:98:61:e2:75:52:67:06:ddSigner

Signature Validations

Verification

28/10/2022, 15:04 Valid: false

Headers

File Characteristics

Imports

user32

kernel32

shlwapi

ole32

comdlg32

oleaut32

shell32

winspool.drv

advapi32

gdi32

version

wtsapi32

ws2_32

comctl32

Exports

Exports

Sections

CODE Size: 460KB - Virtual size: 464KB

DATA Size: 24KB - Virtual size: 32KB

.idata Size: 30KB - Virtual size: 32KB

.text0 Size: 19KB - Virtual size: 20KB

.tls Size: 512B - Virtual size: 4KB

.text1 Size: 97KB - Virtual size: 100KB

.reloc Size: 12KB - Virtual size: 12KB

.rsrc Size: 35KB - Virtual size: 34KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

9c:39:5a:86:d9:1d:a6:3b:ac:9c:ef:69:4a:77:2b:43
Certificate

77:3b:0f:d6:86:db:ee:ee:5d:0f:e8:fc:98:61:e2:75:52:67:06:dd
Signer

28/10/2022, 15:04
Valid: false

CODE
Size: 460KB - Virtual size: 464KB

DATA
Size: 24KB - Virtual size: 32KB

.idata
Size: 30KB - Virtual size: 32KB

.text0
Size: 19KB - Virtual size: 20KB

.tls
Size: 512B - Virtual size: 4KB

.text1
Size: 97KB - Virtual size: 100KB

.reloc
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 35KB - Virtual size: 34KB