ab004f41d632573a2a4ad96c403f7668988fbc332ec4275fb287296a51c86ccd

Sharing

Copy URL

Twitter E-mail

General

Target

ab004f41d632573a2a4ad96c403f7668988fbc332ec4275fb287296a51c86ccd
Size

1.2MB
MD5

fc4d18d087f949e4e87ab48fed71caee
SHA1

c416ec846548db8eb177c2a3b053061519bbead0
SHA256

ab004f41d632573a2a4ad96c403f7668988fbc332ec4275fb287296a51c86ccd
SHA512

48fb6baf18ee77079c6ed17d204c6e98a47b8e09674be1bf67cffb0bb8cc50fc2060b3ab2c6a575cc7c7a4bcee32fff1ad88520135ae4902bfacacbbd7fcb7ab
SSDEEP

24576:iuZU+XGvYdgqsKp6pl+imXwA4IClMgP0Qb6r+wzpdLTIa/ElhXgipjorI+5cwE:GjqHp6pl+rwA4x4pdAhXXpjofKN

Score

N/A

Malware Config

Signatures

Files

ab004f41d632573a2a4ad96c403f7668988fbc332ec4275fb287296a51c86ccd
.dll windows x86

2f50adcb331a0d1c23ed573bdc45619e

Code Sign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-12-2014 00:00

Not After

02-12-2029 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:5d:8d:48:1d:99:c6:e4:65:78:64:d0:51:5e:e5:4a
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05-11-2019 00:00

Not After

04-11-2022 23:59

Subject

SERIALNUMBER=2543798,CN=AOMEI International Network Limited,OU=Research Development Centre,O=AOMEI International Network Limited,POSTALCODE=610000,STREET=Rm 83 3/F Yau Lee ctr,L=Hong Kong,ST=Hong Kong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-04-2011 22:06

Not After

11-04-2021 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-12-2014 00:00

Not After

02-12-2029 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:5d:8d:48:1d:99:c6:e4:65:78:64:d0:51:5e:e5:4a
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05-11-2019 00:00

Not After

04-11-2022 23:59

Subject

SERIALNUMBER=2543798,CN=AOMEI International Network Limited,OU=Research Development Centre,O=AOMEI International Network Limited,POSTALCODE=610000,STREET=Rm 83 3/F Yau Lee ctr,L=Hong Kong,ST=Hong Kong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-04-2011 22:06

Not After

11-04-2021 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:20:c6:2b:18:a8:96:3f:b3:a6:b0:de:9b:4f:de:06:ba:81:df:96:05:39:ff:c8:15:c1:a0:01:7b:7e:30:63
Signer

Actual PE Digest

71:20:c6:2b:18:a8:96:3f:b3:a6:b0:de:9b:4f:de:06:ba:81:df:96:05:39:ff:c8:15:c1:a0:01:7b:7e:30:63

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2543798,CN=AOMEI International Network Limited,OU=Research Development Centre,O=AOMEI International Network Limited,POSTALCODE=610000,STREET=Rm 83 3/F Yau Lee ctr,L=Hong Kong,ST=Hong Kong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

04-11-2022 15:41
Valid: true

Chain 1

SERIALNUMBER=2543798,CN=AOMEI International Network Limited,OU=Research Development Centre,O=AOMEI International Network Limited,POSTALCODE=610000,STREET=Rm 83 3/F Yau Lee ctr,L=Hong Kong,ST=Hong Kong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

e2:49:8e:3d:4b:98:18:e2:07:95:60:14:dd:9e:3a:98:84:d0:31:10
Signer

Actual PE Digest

e2:49:8e:3d:4b:98:18:e2:07:95:60:14:dd:9e:3a:98:84:d0:31:10

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2543798,CN=AOMEI International Network Limited,OU=Research Development Centre,O=AOMEI International Network Limited,POSTALCODE=610000,STREET=Rm 83 3/F Yau Lee ctr,L=Hong Kong,ST=Hong Kong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

17-03-2022 08:25
Valid: true

Chain 1

SERIALNUMBER=2543798,CN=AOMEI International Network Limited,OU=Research Development Centre,O=AOMEI International Network Limited,POSTALCODE=610000,STREET=Rm 83 3/F Yau Lee ctr,L=Hong Kong,ST=Hong Kong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

diskmgr

CreateDdmManager

comn

GetObjectSys
GetObjectGpt
GetObjectLang
GetObjSockHlp
GetObjectLog

funclogic

CreateFuncExecute
CreateMountDisk
CreateEnumDisk

rpcrt4

UuidCreate
RpcImpersonateClient
RpcBindingFree
NdrClientCall2
RpcRevertToSelf
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW

imgfile

CreateObjectImgInfo

shell32

ShellExecuteExW
SHGetFolderPathA
SHGetFolderPathW

encrypt

StrToHex
CreateEncryptObject
BRCrc32
HexToStr

enumfolder

CreateEnumRemoteFolder

compress

CreateCompressObject

brlog

GetBrLogMgr

shlwapi

PathFileExistsW
PathFindFileNameW
PathAppendW
SHDeleteKeyW
PathIsDirectoryW

mpr

WNetGetUniversalNameW

libamcbconsole

?getTasks@NS_AMCB_CONSOLE@@YAIAAV?$vector@U_tag_AMCB_TASK_BASE_INFO@@V?$allocator@U_tag_AMCB_TASK_BASE_INFO@@@std@@@std@@@Z
?getBakTaskVersions@NS_AMCB_CONSOLE@@YAIPBGAAV?$set@HU?$less@H@std@@V?$allocator@H@2@@std@@@Z
?getTaskSuccessCnt@NS_AMCB_CONSOLE@@YAIPBGAAH@Z
?updateTaskScheduleInfo@NS_AMCB_CONSOLE@@YAIPBGABU_tagBR_UI_SCHEDULE_OPTION@@@Z
?getTaskScheduleInfo@NS_AMCB_CONSOLE@@YAIPBGAAU_tagBR_UI_SCHEDULE_OPTION@@@Z
?updateTaskDisplayName@NS_AMCB_CONSOLE@@YAIPBG0@Z
?execBackup@NS_AMCB_CONSOLE@@YAIPBU_tag_AMCB_BACKUP_TASK_INFO@@@Z
?getTaskState@NS_AMCB_CONSOLE@@YAIW4AMCB_TASK_TYPE@@PBGAAW4AMCB_TASK_STATE@@@Z
?askTaskCtrl@NS_AMCB_CONSOLE@@YAIW4AMCB_TASK_TYPE@@PBGW4AMCB_TASK_CTRL_TYPE@@@Z
?getTaskProg@NS_AMCB_CONSOLE@@YAIW4AMCB_TASK_TYPE@@PBGAAU_tag_AMCB_TASK_PROG_DETAIL@@@Z
?freeTaskInfo@NS_AMCB_CONSOLE@@YAIPAU_tag_AMCB_BACKUP_TASK_INFO@@@Z
?createTask@NS_AMCB_CONSOLE@@YAIPAU_tag_AMCB_BACKUP_TASK_INFO@@PBU_tag_POLICY_PARAM@@PBU_tagBR_UI_SCHEDULE_OPTION@@PBU_tag_AMCB_CMD_INFO@@@Z
?getTaskStrategyInfo@NS_AMCB_CONSOLE@@YAIPBGAAU_tag_POLICY_PARAM@@@Z
?updateTaskLastResTime@NS_AMCB_CONSOLE@@YAIPBG_J@Z
?updateTaskStrategyInfo@NS_AMCB_CONSOLE@@YAIPBGABU_tag_POLICY_PARAM@@@Z
?getTaskType@NS_AMCB_CONSOLE@@YAIPBGAAW4AMCB_TASK_TYPE@@@Z
?updateTaskLastExecTime@NS_AMCB_CONSOLE@@YAIPBG_J@Z
?updateTaskType@NS_AMCB_CONSOLE@@YAIPBGW4AMCB_TASK_TYPE@@@Z

usbdetect

?UidForPartition@DeviceUtil@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@D_N@Z
?GetCurRemovablePartitions@DeviceUtil@@SAXPAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@DU?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@D@std@@@2@@std@@@Z
?UidForDrive@DeviceUtil@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAGPAV23@_N@Z

kernel32

Process32NextW
GetDriveTypeW
GetPrivateProfileIntW
FreeLibrary
GetModuleFileNameW
CreateFileW
GetVersionExW
GetComputerNameW
GetPrivateProfileStringW
GetFileAttributesA
CloseHandle
LoadLibraryW
DeviceIoControl
GetLocalTime
GetSystemInfo
GetModuleHandleW
GetTempPathW
DeleteFileA
SetVolumeMountPointW
GetVolumeInformationW
CreateDirectoryA
CreateFileA
CopyFileExW
GetTempPathA
GetFileSize
GetDiskFreeSpaceExW
GetFileSizeEx
DeleteVolumeMountPointW
ReadFile
SetFilePointer
SetFileAttributesW
CreateDirectoryW
DeleteFileW
SetEvent
ReleaseMutex
ResetEvent
CreateEventW
CreateMutexW
HeapFree
HeapAlloc
OpenEventW
WaitForSingleObject
GetProcessHeap
GetVersion
GetWindowsDirectoryA
GetWindowsDirectoryW
WinExec
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetNativeSystemInfo
CreateProcessW
GetStartupInfoW
CreateThread
GetPrivateProfileStringA
IsBadReadPtr
SetFilePointerEx
IsBadWritePtr
CopyFileW
FlushFileBuffers
Process32FirstW
SetLastError
GetProcAddress
ReadConsoleW
GetSystemTime
GetConsoleWindow
WriteConsoleW
GetStdHandle
lstrlenW
lstrlenA
SetConsoleTextAttribute
AllocConsole
LockResource
FindResourceExW
SizeofResource
FindResourceW
UnlockFileEx
UnmapViewOfFile
CreateFileMappingW
GetSystemTimeAsFileTime
SetEndOfFile
AreFileApisANSI
FormatMessageA
GetDiskFreeSpaceA
WriteFile
GetFullPathNameW
QueryPerformanceCounter
GetFullPathNameA
HeapSize
GetFileAttributesExW
HeapReAlloc
FormatMessageW
InterlockedCompareExchange
LockFileEx
HeapDestroy
GetCurrentThreadId
UnlockFile
OutputDebugStringA
HeapCompact
GetDiskFreeSpaceW
HeapCreate
FlushViewOfFile
GetVersionExA
LockFile
HeapValidate
LoadLibraryA
WaitForSingleObjectEx
TryEnterCriticalSection
OutputDebugStringW
CreateFileMappingA
MapViewOfFile
GetTickCount
GetCurrentProcessId
GetSystemDirectoryW
CreatePipe
LocalAlloc
WTSGetActiveConsoleSessionId
OpenProcess
GetExitCodeProcess
GetCurrentThread
GenerateConsoleCtrlEvent
TerminateProcess
FindFirstFileW
FindClose
FindFirstFileA
GetFileAttributesW
Sleep
GetModuleFileNameA
WritePrivateProfileStringW
LocalFree
CreateToolhelp32Snapshot
WideCharToMultiByte
FindNextFileW
RemoveDirectoryW
LoadResource
GetLogicalDriveStringsW
MultiByteToWideChar
GetCurrentProcess
GetLastError
GetVolumeNameForVolumeMountPointW
RaiseException
GetThreadLocale
GetLocaleInfoA
InterlockedExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
SystemTimeToFileTime

user32

UnregisterClassA
SetProcessWindowStation
CloseDesktop
GetUserObjectSecurity
wsprintfW
SetThreadDesktop
CloseWindowStation
OpenWindowStationW
OpenDesktopW
GetSystemMetrics
DeleteMenu
GetProcessWindowStation
SetUserObjectSecurity
GetSystemMenu
GetThreadDesktop

advapi32

GetSecurityDescriptorDacl
GetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser
GetAce
SetTokenInformation
OpenThreadToken
CopySid
AddAce
GetAclInformation
SetFileSecurityA
RegOpenKeyW
ConvertSecurityDescriptorToStringSecurityDescriptorW
RegQueryValueExW
RegSetKeySecurity
RegEnumKeyExW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegUnLoadKeyW
RegDeleteKeyW
RegGetKeySecurity
RegLoadKeyW
BuildExplicitAccessWithNameW
SetNamedSecurityInfoW
SetEntriesInAclW
ConvertStringSidToSidW
RegFlushKey
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
LogonUserW
RegQueryValueExA
GetLengthSid
InitializeSecurityDescriptor
FreeSid
InitializeAcl
AddAccessAllowedAce
AllocateAndInitializeSid
SetSecurityDescriptorDacl
QueryServiceConfigW
CreateProcessAsUserW
ControlService
LookupPrivilegeValueW
DuplicateTokenEx
RegOpenKeyExW
StartServiceW
AdjustTokenPrivileges
OpenProcessToken
OpenServiceW
CloseServiceHandle
ChangeServiceConfigW
RegCloseKey
RegEnumValueW
OpenSCManagerW
RegQueryInfoKeyW
QueryServiceStatus

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantChangeType
VariantClear
SystemTimeToVariantTime

msvcr80

_time64
strftime
_localtime64
_localtime64_s
_vswprintf
sscanf
swscanf_s
mbstowcs
_atoi64
wcsstr
wcsftime
swprintf_s
strtok_s
atoi
memcpy_s
strcat_s
strncmp
strcpy_s
_wtoi
sscanf_s
setlocale
printf
_difftime64
_gmtime64
_vswprintf_c_l
fseek
fread
fclose
ftell
_wcsicmp
fopen_s
fwrite
fprintf
_wfopen_s
strstr
_fsopen
_vsnprintf_s
ferror
fputc
isspace
isalnum
tolower
isalpha
memmove
_beginthreadex
wprintf
strncpy
_vsnprintf
_vsnwprintf
sprintf_s
_vscprintf
_vscwprintf
srand
vswprintf_s
rand
vsprintf_s
wcsncat_s
wcsncpy_s
_dupenv_s
_endthreadex
realloc
_msize
rand_s
gets
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
__CxxFrameHandler3
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
memmove_s
??2@YAPAXI@Z
wcschr
strchr
_itow
??_U@YAPAXI@Z
wcscpy_s
_wcsnicmp
wcsrchr
wcstombs
strrchr
strncat_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
wcscat_s
wcsncpy
_swprintf
strncpy_s
sprintf
??_V@YAXPAX@Z
_purecall
??0exception@std@@QAE@ABV01@@Z
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
_invalid_parameter_noinfo
malloc
free
memcpy
_CIpow
memset
_CxxThrowException
_wcsupr
_mktime64

msvcp80

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@D@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?rbegin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?allocate@?$allocator@D@std@@QAEPADI@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

ws2_32

inet_ntoa
gethostbyname
WSAStartup
WSACleanup

winhttp

WinHttpSendRequest
WinHttpOpen
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpSetOption
WinHttpWriteData
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpReceiveResponse

userenv

LoadUserProfileW
GetUserProfileDirectoryW
DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock

Exports

Exports

AskServiceReloadRegInfo
CreateShutdownCfg
CreateShutdownMgr
CreateUiLogic
CreateUiOptions
CreateUiPolicyPtr
GetObjGATrackingData
GetObjTaskMgrHlp
GetRecordObj
GetScheduleObj
GetUserObject
SendUpdateSyncEvent2ABService
TerminateSpawnProcess

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f50adcb331a0d1c23ed573bdc45619e

Code Sign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

41:5d:8d:48:1d:99:c6:e4:65:78:64:d0:51:5e:e5:4aCertificate

Extended Key Usages

Key Usages

61:18:54:86:00:00:00:00:00:24Certificate

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

41:5d:8d:48:1d:99:c6:e4:65:78:64:d0:51:5e:e5:4aCertificate

Extended Key Usages

Key Usages

61:18:54:86:00:00:00:00:00:24Certificate

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

71:20:c6:2b:18:a8:96:3f:b3:a6:b0:de:9b:4f:de:06:ba:81:df:96:05:39:ff:c8:15:c1:a0:01:7b:7e:30:63Signer

Signature Validations

Verification

04-11-2022 15:41 Valid: true

Chain 1

e2:49:8e:3d:4b:98:18:e2:07:95:60:14:dd:9e:3a:98:84:d0:31:10Signer

Signature Validations

Verification

17-03-2022 08:25 Valid: true

Chain 1

Headers

File Characteristics

Imports

diskmgr

comn

funclogic

rpcrt4

imgfile

shell32

encrypt

enumfolder

compress

brlog

shlwapi

mpr

libamcbconsole

usbdetect

kernel32

user32

advapi32

ole32

oleaut32

msvcr80

msvcp80

version

wtsapi32

ws2_32

winhttp

userenv

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 128KB - Virtual size: 126KB

.data Size: 8KB - Virtual size: 100KB

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

41:5d:8d:48:1d:99:c6:e4:65:78:64:d0:51:5e:e5:4a
Certificate

61:18:54:86:00:00:00:00:00:24
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

41:5d:8d:48:1d:99:c6:e4:65:78:64:d0:51:5e:e5:4a
Certificate

61:18:54:86:00:00:00:00:00:24
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

71:20:c6:2b:18:a8:96:3f:b3:a6:b0:de:9b:4f:de:06:ba:81:df:96:05:39:ff:c8:15:c1:a0:01:7b:7e:30:63
Signer

04-11-2022 15:41
Valid: true

e2:49:8e:3d:4b:98:18:e2:07:95:60:14:dd:9e:3a:98:84:d0:31:10
Signer

17-03-2022 08:25
Valid: true

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 128KB - Virtual size: 126KB

.data
Size: 8KB - Virtual size: 100KB

.rsrc
Size: 4KB - Virtual size: 428B

.reloc
Size: 64KB - Virtual size: 63KB