e22e4489efeae81fb84c37566e5e4563a970ec11605977de0fff3c79981a6335

Sharing

Copy URL Twitter E-mail

General

Target

e22e4489efeae81fb84c37566e5e4563a970ec11605977de0fff3c79981a6335
Size

629KB
MD5

05d0dd079471e9ec4a87627490326a90
SHA1

8abc62dc793f298ccf24323bec4c2af2e1fc75d6
SHA256

e22e4489efeae81fb84c37566e5e4563a970ec11605977de0fff3c79981a6335
SHA512

f97fef3ddcdb136a1c11422e67ac6fe906aff99dc1481f62f77190255b720ae9a6fa07797d3a761a8a4013339da2ae4d254364458b85bfaddec9cceed74c4e0d
SSDEEP

6144:L8vYwX8rB7Y3v4CrUZu5HPfUQ9BWLs3Em1poXd1hxnx615ORouCuTf3ve49B50XC:wvE1Ug1s1ALfXtxx63IS49B50VM/

Score

N/A

Malware Config

Signatures

Files

e22e4489efeae81fb84c37566e5e4563a970ec11605977de0fff3c79981a6335
.exe windows x86

d2800928289d808526f8f477283d6dd8

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:cf:f2:29:0b:ab:f3:51:00:9a:74:69:3e:4c:90:4e
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16/03/2015, 00:00

Not After

15/03/2016, 23:59

Subject

CN=IT-SERVIS,O=IT-SERVIS,POSTALCODE=350000,STREET=NOVOKUZNECHNAYA\, 84,L=KRASNODAR,ST=KRASNODAR REGION,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

26:52:45:f9:21:26:00:5a:4e:7a:09:d5:dc:e4:db:75:0e:94:c8:78
Signer

Actual PE Digest

26:52:45:f9:21:26:00:5a:4e:7a:09:d5:dc:e4:db:75:0e:94:c8:78

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=IT-SERVIS,O=IT-SERVIS,POSTALCODE=350000,STREET=NOVOKUZNECHNAYA\, 84,L=KRASNODAR,ST=KRASNODAR REGION,C=RU

04/11/2022, 15:40
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

GetKeyboardState
SetWindowsHookW
ToAsciiEx
GetMenuItemCount
GetDCEx
CallMsgFilterW
EndMenu
GetWindowRect
DrawStateA
CharToOemBuffW
AdjustWindowRect
MessageBoxW
WindowFromPoint
PeekMessageW
GetShellWindow
EnableWindow
MessageBoxIndirectA
SetProgmanWindow
GetDlgItem
WaitForInputIdle
DialogBoxIndirectParamA
SwitchDesktop
GetClipboardFormatNameW
IsRectEmpty
ScrollWindow
SetDoubleClickTime
GetMessageExtraInfo
EnumClipboardFormats
GetMenuStringW
ShowCursor
IntersectRect
GetWindowWord
RegisterClipboardFormatA
GetMenuItemInfoA
GetMenuDefaultItem
GetWindowModuleFileNameW
DefDlgProcA
SetDlgItemTextA
EnumThreadWindows
CharLowerW
GetKeyNameTextW
DrawFrame
GetDlgItemTextA
GetKeyboardLayoutNameW
RemovePropA
EnableMenuItem
MessageBoxExW
IsCharLowerW
GetMonitorInfoA
CharUpperA
CreateCaret
SetDlgItemTextW
UpdateWindow
GetMenu
EnumDisplayMonitors
GetPropA
OpenDesktopW
DrawFrameControl
SetWindowPos
DrawTextExA
TranslateMessage
GetLastActivePopup
LoadCursorFromFileA
GetWindowLongA
GetKeyboardLayout
IsCharUpperW
PostThreadMessageW
CharPrevW
GetClassNameW
GetUpdateRgn
ValidateRect
CheckDlgButton
SendDlgItemMessageW
DestroyWindow
CallNextHookEx
EnumPropsExW
DrawIcon
SetClassLongW
IsDialogMessageW
IsChild
RegisterClassExW
MessageBoxTimeoutA
SetMenuItemInfoW
SetUserObjectInformationA
GetDlgItemTextW
SetRect
GetIconInfo
SetMessageExtraInfo
GetCaretBlinkTime
LoadBitmapW
SetWindowPlacement
PrivateExtractIconsW
IsDialogMessage
GetInputState
LoadBitmapA
LockWorkStation
DestroyCaret
SetProcessWindowStation
ChildWindowFromPointEx
BroadcastSystemMessageExA
EmptyClipboard
CharPrevExA
PostMessageW
SetPropW
SendMessageCallbackA
CreateIconIndirect
SetMenuInfo
MonitorFromRect
MapVirtualKeyW
MessageBoxExA
DefDlgProcW
GetClassNameA
GetWindowRgnBox
FrameRect
CreateMenu
MapWindowPoints
SetLastErrorEx
GetMenuInfo
PrivateExtractIconExA
LoadMenuW
GetCursor
WinHelpA
WaitMessage
SetCursorPos
BroadcastSystemMessageA
DrawCaptionTempA
SetParent
TrackMouseEvent
SetTimer
SetMenuItemInfoA
ChangeDisplaySettingsExA
DlgDirListA
EqualRect
SetWindowsHookExA
DestroyMenu
MapVirtualKeyExW
SetClipboardData
OemToCharA
GetSystemMetrics
CreateIcon
SetInternalWindowPos
SetDeskWallpaper
EditWndProc
TabbedTextOutW
GetMenuItemRect
EnumDisplaySettingsExW
EndTask
SetClipboardViewer
SendInput
HideCaret
AllowForegroundActivation
GetMenuState
PrivateExtractIconsA
DragObject
IsMenu
AnyPopup
GetWindowRgn
LoadKeyboardLayoutA
GetKeyboardLayoutNameA
IsCharLowerA
CharUpperW
GetClassInfoExW
UnregisterClassA
FillRect
FindWindowA
LoadStringA
wvsprintfW
GetScrollRange
LoadCursorA
GetMessageTime
GetMonitorInfoW
SystemParametersInfoW
IsGUIThread
GetDlgCtrlID
CreateDialogIndirectParamW
UnhookWindowsHook
DlgDirSelectExW
ModifyMenuA
SystemParametersInfoA
CloseDesktop
DialogBoxParamA
ReleaseDC
SetFocus
ChangeDisplaySettingsW
GetTopWindow
LoadAcceleratorsA
DefWindowProcW
GetUserObjectSecurity
TranslateAcceleratorA
RealChildWindowFromPoint
MessageBeep
InvalidateRgn
GetFocus
GetCursorInfo
IsCharAlphaNumericA
RegisterClassExA
UpdateLayeredWindow
MapVirtualKeyExA
GetAsyncKeyState
TabbedTextOutA
BeginPaint
LoadKeyboardLayoutEx
RedrawWindow
SetWindowContextHelpId
ReleaseCapture
DrawEdge
SetScrollInfo
GetClassInfoA
GetMenuStringA
SwapMouseButton
GetActiveWindow
ExitWindowsEx

kernel32

InitializeCriticalSectionAndSpinCount
GetBinaryTypeA
lstrcmp
GetLogicalDrives
SetTimeZoneInformation
GetThreadSelectorEntry
LoadModule
GetCurrentProcessId
VirtualUnlock
MapViewOfFileEx
GetProcessTimes
FileTimeToDosDateTime
GetVolumeInformationA
GetConsoleAliasesA
OpenEventW
CreateHardLinkA
EnumDateFormatsExW
SetNamedPipeHandleState
ReadConsoleInputW
DeleteVolumeMountPointW
QueryPerformanceCounter
FindNextFileW
SetCommBreak
ScrollConsoleScreenBufferA
InterlockedExchangeAdd
IsValidLocale
DeleteCriticalSection
WriteConsoleInputW
GetUserGeoID
CreateFileMappingA
CreateDirectoryExA
AssignProcessToJobObject
WriteProfileStringW
FindActCtxSectionStringW
CopyFileExA
GetCalendarInfoA
WriteConsoleOutputAttribute
CreateMemoryResourceNotification
HeapSetInformation
GetLongPathNameW
DosPathToSessionPathA
IsWow64Process
SetThreadContext
UnregisterWaitEx
EnumSystemCodePagesA
ReleaseActCtx
GetConsoleCharType
ClearCommBreak
EndUpdateResourceW
GlobalFix
lstrcmpW
ReadDirectoryChangesW
CreateNamedPipeA
VerLanguageNameW
OpenJobObjectW
CreateDirectoryExW
BackupWrite
FindCloseChangeNotification
SetSystemTime
FillConsoleOutputCharacterA
lstrcpyW
SetFileValidData
FileTimeToLocalFileTime
FlushViewOfFile
FindFirstFileA
SetWaitableTimer
RtlFillMemory
SetCurrentDirectoryA
lstrcatW
GetFileAttributesA
LockFileEx
SleepEx
WriteProfileSectionA
CreateSemaphoreW
HeapWalk
EnumUILanguagesA
MoveFileExW
SetErrorMode
GetConsoleTitleW
GetPrivateProfileSectionNamesW
GetConsoleProcessList
RemoveVectoredExceptionHandler
SetCommState
lstrlenA
lstrcmpi
SystemTimeToTzSpecificLocalTime
HeapQueryInformation
ReadConsoleInputExA
MoveFileW
SystemTimeToFileTime
GetGeoInfoA
GetFileType
EnumLanguageGroupLocalesA
GetModuleHandleW
ClearCommError
SetComputerNameA
AddAtomA
ConnectNamedPipe
FindVolumeMountPointClose
EnumCalendarInfoExA
GetLastError
FormatMessageW
GetCalendarInfoW
FreeLibrary
OpenMutexA
MapUserPhysicalPages
GetThreadPriorityBoost
FlushInstructionCache
ResetEvent
GetConsoleMode
EnumResourceLanguagesA
DnsHostnameToComputerNameW
FindFirstVolumeW
GetConsoleInputExeNameA
QueryInformationJobObject
QueryActCtxW
GetSystemPowerStatus
GetCommandLineA
GetBinaryTypeW
SetFileTime
CreateDirectoryW
GetProfileIntW
SetFileShortNameW
EnumCalendarInfoW
UpdateResourceA
LocalFlags
CommConfigDialogA
SignalObjectAndWait
GetLongPathNameA
ReadFileScatter
GetSystemDirectoryW
DeleteAtom
lstrcmpiW
WriteFileEx
CallNamedPipeW
FreeConsole
InterlockedIncrement
CancelDeviceWakeupRequest
EnumSystemLanguageGroupsA
lstrcatA
ScrollConsoleScreenBufferW
HeapUnlock
SetStdHandle
SetEndOfFile
WaitForSingleObjectEx
GetTimeZoneInformation
DosDateTimeToFileTime
SetCalendarInfoW
EnumSystemLanguageGroupsW
GetLogicalDriveStringsW
GetProfileStringA
AllocateUserPhysicalPages
SetVolumeMountPointW
SetCriticalSectionSpinCount
LeaveCriticalSection
GetHandleInformation
GetConsoleWindow
GetCommConfig
CloseProfileUserMapping
SetCalendarInfoA
GetSystemInfo
CreateFileA
GetThreadLocale
CreateActCtxW
GetPrivateProfileStringA
LZOpenFileW
GetFileSizeEx
GetConsoleFontInfo
GetVolumeNameForVolumeMountPointW
SetCommTimeouts
QueryPerformanceFrequency
LZInit
CreateProcessInternalA
HeapCompact
SetCommConfig
FatalExit
CopyFileExW
OpenWaitableTimerA
FindNextVolumeMountPointW
FindClose
SetThreadPriorityBoost
UnregisterWait
lstrcat
GetCurrencyFormatW
VerifyVersionInfoA
EnumSystemGeoID
CreateMailslotW
CreateActCtxA
OpenWaitableTimerW
GetThreadPriority
VirtualFree
GetConsoleDisplayMode
DeleteTimerQueueTimer
GetTapeParameters
FormatMessageA
GetVersion
HeapValidate
LZCloseFile
SetLocaleInfoW
GetConsoleCursorInfo
EndUpdateResourceA
SetComputerNameW
OpenFile
EnumDateFormatsA
UnhandledExceptionFilter
LocalLock
GetLocaleInfoA
Beep
GetPrivateProfileIntW
CreateWaitableTimerA
ShowConsoleCursor
SetComputerNameExW
CopyFileA
lstrlenW
BeginUpdateResourceW
SetTimerQueueTimer
SetUnhandledExceptionFilter
GetCompressedFileSizeW
GetModuleFileNameW
GetConsoleHardwareState
CancelWaitableTimer
WaitNamedPipeW
GetStringTypeW
SetFileAttributesW
IsValidCodePage
GetStartupInfoW
LocalFileTimeToFileTime
WriteFile
FreeUserPhysicalPages
GetConsoleTitleA
OpenFileMappingW
GetLastError
VirtualQuery
LoadLibraryA
LocalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

ole32

CoUnmarshalHresult
OleRegEnumFormatEtc
CoInitializeEx
IsAccelerator
CoRegisterSurrogateEx
HBITMAP_UserSize
OleRegGetUserType
OleGetIconOfClass
CreateAntiMoniker
OleSaveToStream
OleSave
CoGetMalloc
IsEqualGUID
CoGetInterceptorFromTypeInfo
CreateFileMoniker
OleUninitialize
OleSetClipboard
HENHMETAFILE_UserFree
OleLoad
CoRevertToSelf
CoQueryAuthenticationServices
CoSuspendClassObjects
ComPs_NdrDllUnregisterProxy
OleSetContainedObject
OleRegEnumVerbs
GetErrorInfo
OleQueryCreateFromData
StgCreateDocfile
HICON_UserMarshal
CoLockObjectExternal
WriteFmtUserTypeStg
HMETAFILE_UserFree
CoTaskMemFree
CoCreateGuid
DllRegisterServer
IIDFromString
CoInitializeSecurity
CoSetProxyBlanket
DoDragDrop
CLSIDFromProgIDEx
CoGetStandardMarshal
HDC_UserMarshal
HMETAFILE_UserSize
CLSIDFromString
CoIsHandlerConnected
HBRUSH_UserUnmarshal
HWND_UserSize
OleConvertIStorageToOLESTREAMEx
CoFreeUnusedLibrariesEx
HACCEL_UserSize
WriteClassStg
OleCreateLinkFromDataEx
CoReleaseServerProcess
ComPs_NdrDllRegisterProxy
CoGetInstanceFromIStorage
StgIsStorageFile
OleCreateEmbeddingHelper
CoImpersonateClient
StgGetIFillLockBytesOnFile
OleNoteObjectVisible
CoGetClassObject
CoGetCallContext
HPALETTE_UserUnmarshal

oleaut32

SysReAllocString
LoadTypeLib
VarDateFromUI4
VarCyFromUI2
VectorFromBstr
DllCanUnloadNow
GetRecordInfoFromGuids
VarI2FromUI1
VarR4FromUI2
VarDecFromUI4
VarI2FromI1
VARIANT_UserSize
VarUI8FromR4
VarFormatPercent
VarCyFromDate
DllGetClassObject
SafeArrayGetUBound
VarBoolFromR8
VarDecFromUI8
VarR8FromI1
VarUI8FromI1
VarCyFromDec
VarR8FromI8
VarI1FromR4
OleIconToCursor
VarDecFromCy
VarDateFromI2
SafeArrayPutElement
OleCreatePropertyFrame
VarUI4FromBool
VarCyNeg
SafeArrayGetElement
VarI1FromDisp
VariantChangeType
VarUI8FromDec
VarCySub
VarFormatDateTime
VarImp
SafeArrayUnaccessData
SafeArrayCopy
VarBstrFromR8
OleTranslateColor
VarI1FromI2
VarR4FromUI8
VarIdiv
OleCreatePropertyFrameIndirect
VarDecFromR8
VarI1FromUI2
VarUI2FromDisp
VarI2FromI4
VarUI8FromStr
VarI4FromI8
SafeArrayRedim
VarBstrFromUI2
VarDateFromStr
VarBoolFromI2
VarBstrFromR4
VarUI2FromDec
VarR4FromI4
CreateTypeLib2

advapi32

AccessCheck
WmiQueryAllDataW
GetCurrentHwProfileA
LsaQueryDomainInformationPolicy
GetSecurityDescriptorGroup
StartTraceA
GetServiceDisplayNameW
NotifyChangeEventLog
SetSecurityDescriptorRMControl
CredWriteW
GetSecurityDescriptorControl
SaferCloseLevel
WmiQuerySingleInstanceMultipleA
LsaQueryInfoTrustedDomain
GetSidSubAuthorityCount
RegisterTraceGuidsA
GetTrusteeTypeW
ConvertStringSidToSidW
WmiQueryGuidInformation
ElfDeregisterEventSource
FreeEncryptedFileKeyInfo
ReportEventA
QueryServiceObjectSecurity
EncryptionDisable
OpenTraceW
PrivilegeCheck
LsaFreeMemory
GetUserNameW
AddAccessDeniedObjectAce
GetSecurityDescriptorSacl
EnumServicesStatusA
AccessCheckByTypeAndAuditAlarmA
WmiFileHandleToInstanceNameA
ProcessTrace
RegSetKeySecurity
LsaEnumerateAccountsWithUserRight
SaferCreateLevel
GetInformationCodeAuthzLevelW
GetSecurityInfo
BuildSecurityDescriptorW
EncryptFileA
LookupPrivilegeValueA
RegDeleteKeyW
SaferiRecordEventLogEntry
GetWindowsAccountDomainSid
LsaCreateSecret
MakeAbsoluteSD
WmiDevInstToInstanceNameA
IsWellKnownSid
TraceMessage
CredReadDomainCredentialsW
WriteEncryptedFileRaw
SetInformationCodeAuthzLevelW
OpenBackupEventLogW
RegOpenUserClassesRoot
SetInformationCodeAuthzPolicyW
ConvertSecurityDescriptorToStringSecurityDescriptorA
GetManagedApplications
FreeSid
GetLengthSid
SetEntriesInAclW
RegDeleteValueA
InitiateSystemShutdownExW
CredpDecodeCredential
GetNamedSecurityInfoW
AddAccessDeniedAceEx
EncryptedFileKeyInfo
LsaSetQuotasForAccount
LookupPrivilegeNameA

Exports

Exports

w$%��y��/��wj0W�KKh�� ϛ��1s�O��,��;�>��<��M��N��<�*蝾�6'��y�g��M8�\N�VV1��8 U�Q��<��:8)��3y �(ß!�h�|x�е_��x�4va��\흴Ϲ*S�'�q�/Ҙ^��n�/��z��D��Q��v��7|��m��jF�Wg�#�3�>'�[i�p�R��o)-�хIם#��3�#ԍ}_Ÿ��+�s��F1{Fq��8��h��a��p��L�L�� gF�0�x�5�/��N��u��q��5@?�Ǚ�F�L�a/%ц��,F��MK�F{��B~�̄�:�q,E{�+��fΧ�*�{�b#��b�\��sm2}��'(�`��t&��Y�譟�+U��D#l<KU].)� �+��4��'�"�/��~&@��c2�4��KAp�� G`h�d�4\��r��P��I��<g��9^/�S&2��\ ��Ns�Gg�M�u��uWUc8�]-��і��E%4�l��w��h�`��ղ[L��5:� ` "�v��.�a7��HD��¶t��q�c�Q��ّ*��/2�c�f?Z��r�e�W�>ݯI7 �1qH*�#z�:��%��Y�DⅥ��@��6d��Տ*�ˊ�-0�j�d��U)6�jܶ�@6�~�g3�)%-p�bk\�0��^�.�ccLF��I�W7��֕��5��Lw�՜�6��H��ݣħ��9��Mn�k��Q��|DL��|j�zYL=^,�K�E�՘�Ac;_��{��u�#~F7A7Z��2 ?�a��a�F�w��?�j�/g��~��G��WD�ĩ8�2s��;��3�j%��Z^�}�-D��*�_��4��oL�ip�I�H��0Dl� ja�`Ha��uZn�ؚ4B}��Ey`7˘1϶��K��=��O[:d��t��(�6��!4E��*�o�@C��ui��6ؕ�ܺ`t=�e��L,wܻкTa1��L��j��.��t�ye�ș�/~=�s ��/�v%3�5�p {�j�� {$�VR<at��g�dO��~Ī��8�Xaj ��<�짬� �GX#�G��i�!��sTy��P e!Ɔ/��m&.��m�V{V�=��B:ϱ��w�J��QWR�㾠~@0ٰ��Q��f��L�$*��U��/��7�3�L��A�Md��J�Đ�t/].��t@fA6�q.�=U��x��X��/v��0��桫��1H�k�cbI5��|��_�L��g �e�}a� �d᱐A�W��'�n0�{f�1�+� �6VDl��i��@@b�)��8��S�s��I��Ԕ�2� ��yHk��H��&��S��B7��P��"�u��BcS�{��H��^��%yȆ��\��rW]H+��.h�c��c�v#��Rωi3��y�-��9i׹��S�n�� Խ�'e�CT�7�n��(��5�\a�a�r��c�9+�GF�G�H��}U��Av�_e�~;̻�9��n�t7�1��A�햄�n`��i��]��qHa�x�� '�ЏB�m��6�'h鬸m�sf�<{��3*��/�+{I�*��fC)ՠ4 V� tDCV��' KGP��_��Q�p~��r�=�sS��c��R��˘oa±��J�L�k8��W��W>@��-��KѮ�srsh%G��+ �Z^nS��e��h�yч��S��{�n��ԩϐ��jg)3��~��D��FV��0��l�dL�W� �l"t��O��Y��"Q��~3�3��k%#�L� ��<@��˥� �9Aܿ�ݘMg��[�)=lC�� FO��&��Sh�] �G+.��_-E�?prZ��I� [V�/ۃ��ӯʕ��#��T�;��-�&�A x,��+��i!��2.��(�ۭ-��Wg��;;Z�y,�ܮp&�LUCL�P��F�S�Q3�Dբ��t��Jh��&ƙ�*gkL��k�~-��ɼ��ϳ�R�(uP�{ �/�V%k�E� ��:��8�*�E��IV��Y48S�d��ۧ��tK6�ͦ\u�&%|�H|�8Ld[��ڶ�1��u`��Xbu�K�5c��d�$t�E9 ڂfA��,��B�� vC��Ǌj�,t�J��!�״fC��e,��3��NS?i)�.��1�bޖA�VX$��e��LJz{| �IJ��{�ླྀ%։��%��I�Zk��^\��y|�?U@��˂3��'��7frWB�3�G��[��X��h�-C�$Y�/=,�e��z��.�Vp�Ӷ8��_4b��mb��x�w�{�5dq� �N��7?��)AL\��+�b�^<!)Xߔ!�^]��O��ZvK<��*�H~ܤ*�(qd��W��moA�R�*4��o�-�]��$7o�#"��`�ք܌�a�`%X��Ŏ�X"��$�h�@_�x^�9��?2��ne��6��*S�^0��]W ��=��0`\l2�x�m��?B�� 93� �ne�Ҍ܃�m��]�霯r��[Ap��F!�̺�W�s3�t�Hp�<�`��j?*��_��;��J��"�7dtB��o:��'V�Ğ�k�4J�}�;�q�e.��и��&��u��96��M.fy��wf��9�x�j��-P/}hNG�ŻW��,]D��Ru��7��O��,Y�}�h��6�#��=�R��1��^Jfk(��I��>�8�P]�M��S=:�˪�*��Q��!��r �� 6�X�'��b,C��z�Ry%�2r� �E:(S�9f

Sections

CODE
Size: 445KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 995B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 17KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2800928289d808526f8f477283d6dd8

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

49:cf:f2:29:0b:ab:f3:51:00:9a:74:69:3e:4c:90:4eCertificate

Extended Key Usages

Key Usages

26:52:45:f9:21:26:00:5a:4e:7a:09:d5:dc:e4:db:75:0e:94:c8:78Signer

Signature Validations

Verification

04/11/2022, 15:40 Valid: false

Headers

File Characteristics

Imports

user32

kernel32

ole32

oleaut32

advapi32

Exports

Exports

Sections

CODE Size: 445KB - Virtual size: 445KB

DATA Size: 9KB - Virtual size: 9KB

BSS Size: - Virtual size: 995B

.idata Size: 15KB - Virtual size: 14KB

.text0 Size: 17KB - Virtual size: 19KB

.tls Size: 512B - Virtual size: 24B

.text1 Size: 74KB - Virtual size: 73KB

.reloc Size: 7KB - Virtual size: 7KB

.rsrc Size: 53KB - Virtual size: 53KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

49:cf:f2:29:0b:ab:f3:51:00:9a:74:69:3e:4c:90:4e
Certificate

26:52:45:f9:21:26:00:5a:4e:7a:09:d5:dc:e4:db:75:0e:94:c8:78
Signer

04/11/2022, 15:40
Valid: false

CODE
Size: 445KB - Virtual size: 445KB

DATA
Size: 9KB - Virtual size: 9KB

BSS
Size: - Virtual size: 995B

.idata
Size: 15KB - Virtual size: 14KB

.text0
Size: 17KB - Virtual size: 19KB

.tls
Size: 512B - Virtual size: 24B

.text1
Size: 74KB - Virtual size: 73KB

.reloc
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 53KB - Virtual size: 53KB