b7bcbf72b1806877127ecccc459e7626d7ba8f62dcc719960f7379d5396968b7

Sharing

Copy URL Twitter E-mail

General

Target

b7bcbf72b1806877127ecccc459e7626d7ba8f62dcc719960f7379d5396968b7
Size

640KB
MD5

579229eaa63a06925c7a5c2c20e1952e
SHA1

07f1946e0bbc2b6dc680f4bbb9fb670d5f31ef44
SHA256

b7bcbf72b1806877127ecccc459e7626d7ba8f62dcc719960f7379d5396968b7
SHA512

f0e227330e05ebb26a5cee261dcf6c3fb14afe3bed9aac6eaa9104f9876eeb7ebd4840d4c01b331308d1534f8d61e6ac9c20363586c1280fb2a9908cc7b0f327
SSDEEP

6144:zqtE2360Tja8OkfhQ2Srg8X9bb84/HPOIchqPVMv/MtsA0idxv49YtmXtpkNX2YO:z3aZaMhQlNo4/req9sfmgCGuGJFH

Score

N/A

Malware Config

Signatures

Files

b7bcbf72b1806877127ecccc459e7626d7ba8f62dcc719960f7379d5396968b7
.exe windows x86

915a91d767564d3d89f70971af23aacb

Code Sign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:6c:49:48:17:87:1a:91:0f:51:74:55:f5:1a:03:b6
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

20/11/2014, 00:00

Not After

20/11/2015, 23:59

Subject

CN=Monitor LLC,O=Monitor LLC,L=Moscow,ST=Moscow region,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

06:de:10:bf:c2:eb:58:97:87:55:ee:7b:c2:aa:a4:89:cc:1e:76:d9
Signer

Actual PE Digest

06:de:10:bf:c2:eb:58:97:87:55:ee:7b:c2:aa:a4:89:cc:1e:76:d9

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Monitor LLC,O=Monitor LLC,L=Moscow,ST=Moscow region,C=RU

24/11/2022, 14:55
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

SetMenuItemInfoW
FindWindowExW
OpenClipboard
OpenWindowStationW
LoadKeyboardLayoutA
OemToCharW
CheckMenuRadioItem
InvalidateRgn
GetCaretPos
ShowScrollBar
ReleaseDC
CascadeChildWindows
SetWindowTextW
GetMenuState
CreateAcceleratorTableA
EnumPropsW
GrayStringA
CloseDesktop
DrawCaptionTempW
DrawTextExA
EnumPropsExW
SetPropW
ValidateRect
SwapMouseButton
GetUpdateRgn
SetDebugErrorLevel
AppendMenuW
TranslateMessage
ShowWindowAsync
WindowFromPoint
CharPrevW
SetRect
OemToCharBuffA
GetScrollBarInfo
TileWindows
GetClientRect
CreateAcceleratorTableA
SetMenuItemInfoA
SetSystemCursor
ValidateRgn
GetDlgItemInt
PeekMessageW
BroadcastSystemMessageW
SetUserObjectInformationA
PostMessageA
PrivateExtractIconsW
SetScrollInfo
CreateMenu
LoadCursorFromFileA
SetWindowsHookExA
EmptyClipboard
DefWindowProcW
GetSysColorBrush
IsChild
PaintDesktop
SetWindowWord
CopyIcon
SetWindowContextHelpId
AppendMenuA
TileChildWindows
IsCharUpperA
SetScrollPos
SetMenuDefaultItem
LoadKeyboardLayoutW
LoadAcceleratorsA
GetScrollInfo
SwitchDesktop
GetWindowLongW
CreateDialogParamA
GetNextDlgGroupItem
DefDlgProcA
WaitMessage
BroadcastSystemMessageExA
GetDlgCtrlID
IsWindowEnabled
UnregisterHotKey
GetLastInputInfo
ModifyMenuA
OpenDesktopA
CharToOemBuffW
RedrawWindow
GetMenuItemInfoA
ModifyMenuW
GetAltTabInfoA
GetDlgItem
LoadCursorA
GetWindowContextHelpId
wsprintfW
MonitorFromRect
GetMenuContextHelpId
ActivateKeyboardLayout
IsCharAlphaA
CharPrevA
DialogBoxIndirectParamW
SetParent
PrivateExtractIconExA
GetMessageTime
TrackMouseEvent
ExitWindowsEx
OemToCharBuffW
AnimateWindow
DestroyIcon
DestroyWindow
DispatchMessageW
CopyAcceleratorTableA
GetDCEx
ValidateRect
GetUserObjectInformationW
IsWindow
GetClipCursor
IsZoomed
GetMenuState
IsDlgButtonChecked
SetCursorPos
GetMenuBarInfo
SetPropA
GetGUIThreadInfo
SetMessageExtraInfo
RegisterHotKey
ShowCaret
CreateDialogIndirectParamA
GetMenuItemID
GetClassInfoExW
GetScrollPos
DrawMenuBarTemp
InvertRect
CreateCursor
DlgDirSelectExA
GetShellWindow
EnumDisplaySettingsW
RemovePropA
GetWindowPlacement
DrawFrame
SystemParametersInfoA
RegisterClassA
ChangeDisplaySettingsA
CheckMenuItem
WindowFromDC
BeginPaint
GetAsyncKeyState
GetWindowTextA
DrawTextW
CharLowerBuffW
GetParent
LockWindowUpdate
MonitorFromPoint
InflateRect
LoadKeyboardLayoutA
LoadStringA
GetClassNameA
EnumPropsExW
GetCursorPos
GetClassLongW
CharUpperBuffA
SetClipboardViewer
GetWindowModuleFileNameW
GetScrollRange
CreateMDIWindowA
EnumDesktopWindows
LockWorkStation
MessageBoxExW
GetWindowLongA
WaitForInputIdle
CharLowerA
CallWindowProcW
DialogBoxParamW
DeleteMenu
EndMenu
CallWindowProcA
GetFocus
SetKeyboardState
GetTabbedTextExtentA
GetWindowTextLengthA
EnableMenuItem
ChildWindowFromPoint
SendDlgItemMessageA
GetWindowInfo
SetClassWord
GetLastActivePopup
MapVirtualKeyExA
OemToCharA
IsCharAlphaNumericA
SendMessageTimeoutA
ShowCursor
GetKeyNameTextA
CheckDlgButton
GetMenuItemRect
FillRect
EnableWindow
OffsetRect
OemKeyScan
LoadCursorW
OpenWindowStationW
SetClassLongA
DestroyAcceleratorTable
RemoveMenu
WinHelpA
DlgDirListW
GetAltTabInfoW
CharToOemA
LoadIconA
DlgDirListA
IsCharLowerA
GetForegroundWindow
DefFrameProcW
ShowOwnedPopups
OpenClipboard
AllowForegroundActivation
GetKeyboardLayoutNameW
GetUpdateRect
SetCaretPos
RegisterDeviceNotificationW
LoadImageW
InsertMenuItemW
GetRawInputDeviceInfoA
IsCharAlphaW
LoadMenuW
GetCaretPos
GrayStringW
GetProgmanWindow
MenuWindowProcA
CharNextW
IsDialogMessage
PostThreadMessageA
DrawCaptionTempW
MapVirtualKeyExW
TranslateAcceleratorA
MapWindowPoints
SetSystemMenu
SetDoubleClickTime
UnloadKeyboardLayout
MenuItemFromPoint
CharUpperW
GetTabbedTextExtentW
SetWindowTextW
DrawCaption
RegisterClipboardFormatA
AdjustWindowRectEx
ChangeDisplaySettingsW
SetThreadDesktop
TranslateMessageEx
SetForegroundWindow
DrawFocusRect
SubtractRect
UnhookWindowsHook
EndPaint
ChangeDisplaySettingsExA
SwapMouseButton
SetWindowPlacement
GetClassNameW
CascadeWindows
IsCharAlphaNumericW
SetRectEmpty
ShowScrollBar
AttachThreadInput
EnumPropsA
RealChildWindowFromPoint
DrawEdge
SendNotifyMessageW
ChangeMenuA
DrawTextExW
GetDC
SetDlgItemTextA
SetCursor
GetWindowRect
SetClassLongW
SetProcessWindowStation
CreateCaret
AdjustWindowRect
CharLowerW
GetWindowDC

kernel32

CommConfigDialogW
GetPriorityClass
FindAtomA
EnumSystemLocalesA
VerifyConsoleIoHandle
WriteConsoleOutputW
DeleteVolumeMountPointW
GetConsoleFontInfo
RegisterWowExec
GetVolumePathNamesForVolumeNameW
CancelDeviceWakeupRequest
FindCloseChangeNotification
ReadConsoleOutputA
GetCurrentConsoleFont
VerLanguageNameA
TerminateThread
LZOpenFileW
CreateDirectoryExA
WaitForSingleObject
DefineDosDeviceA
RegisterWaitForSingleObject
GetConsoleSelectionInfo
SetEvent
FreeResource
GetSystemDefaultLangID
GetLastError
MapViewOfFileEx
GetLastError
EnumDateFormatsExA
CopyLZFile
GetSystemDirectoryW
FindResourceW
GetDefaultCommConfigW
SetFileAttributesA
FreeUserPhysicalPages
SetLocaleInfoW
GetCurrentDirectoryW
QueryInformationJobObject
InterlockedExchangeAdd
EnumCalendarInfoExW
DeleteAtom
CreateMemoryResourceNotification
GetShortPathNameA
RegisterWaitForSingleObject
GetAtomNameA
GetStringTypeA
SetProcessPriorityBoost
IsBadWritePtr
IsBadStringPtrA
CreateProcessInternalA
SetThreadContext
FindNextFileA
EnumSystemCodePagesW
GetVolumePathNamesForVolumeNameA
WriteConsoleInputA
GetLocalTime
GetConsoleCursorMode
ClearCommError
EnumSystemGeoID
GetConsoleMode
FindAtomA
GetDriveTypeW
GetOEMCP
HeapFree
SetSystemTimeAdjustment
GetStdHandle
GetConsoleInputExeNameA
CreateJobSet
GetModuleFileNameW
IsBadCodePtr
GetAtomNameW
GetVersionExA
ReplaceFileW
GlobalCompact
GetSystemDefaultLCID
PeekNamedPipe
LockFile
SystemTimeToFileTime
GetVolumePathNameA
PulseEvent
GlobalFlags
OpenSemaphoreA
CreateHardLinkW
EnumResourceTypesW
GetProcessShutdownParameters
InitializeCriticalSectionAndSpinCount
GetProfileSectionW
VerLanguageNameA
FormatMessageW
GetStartupInfoA
GetLocaleInfoW
GetUserDefaultLCID
EraseTape
OpenMutexA
FindFirstVolumeA
SetFileShortNameW
IsValidCodePage
LoadResource
GetExitCodeProcess
GetThreadTimes
lstrcatW
BuildCommDCBAndTimeoutsA
lstrcat
AssignProcessToJobObject
CreateNamedPipeW
SetCalendarInfoW
LockFileEx
HeapReAlloc
WaitForSingleObjectEx
SetTapeParameters
lstrcmpi
LocalLock
GetCurrentActCtx
GetConsoleFontSize
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
AddAtomA
LCMapStringW
GetNumberOfConsoleInputEvents
EnumSystemCodePagesA
SetStdHandle
AddVectoredExceptionHandler
ReadConsoleInputA
GetCurrentThread
GetConsoleTitleA
FindVolumeMountPointClose
DelayLoadFailureHook
EnumSystemLocalesW
WritePrivateProfileStructW
GetPrivateProfileStructW
SetEndOfFile
SetFileAttributesW
HeapUnlock
ReadConsoleA
QueryDosDeviceA
GetPrivateProfileIntA
GlobalWire
SetComputerNameExA
WriteConsoleW
CompareFileTime
RestoreLastError
LZOpenFileW
LocalFlags
GetFileAttributesExW
DeleteVolumeMountPointW
WriteConsoleInputW
CancelTimerQueueTimer
ExpandEnvironmentStringsA
GlobalGetAtomNameW
LeaveCriticalSection
WaitNamedPipeW
SetCommBreak
LoadModule
DisconnectNamedPipe
ClearCommBreak
GetProcessPriorityBoost
CopyFileExW
Sleep
GetProcessHeaps
SetProcessWorkingSetSize
Heap32Next
QueueUserWorkItem
ActivateActCtx
ReplaceFileA
SetUnhandledExceptionFilter
CreateTapePartition
IsProcessInJob
DnsHostnameToComputerNameW
lstrcpyW
EnumCalendarInfoW
GetFileInformationByHandle
SetThreadExecutionState
AddConsoleAliasW
TzSpecificLocalTimeToSystemTime
OpenJobObjectW
ScrollConsoleScreenBufferW
GetPriorityClass
RtlCaptureContext
CreateTimerQueueTimer
LZInit
GetEnvironmentVariableW
SetHandleCount
SetDefaultCommConfigW
MoveFileWithProgressA
GetPrivateProfileSectionNamesW
lstrlenA
LZStart
IsValidLocale
CreateSemaphoreA
GetThreadPriority
LZSeek
WinExec
FindFirstVolumeW
OpenJobObjectA
GetCompressedFileSizeA
TryEnterCriticalSection
InterlockedCompareExchange
GetThreadPriorityBoost
EnumTimeFormatsW
SetVolumeMountPointW
SetCommMask
GlobalUnWire
GetProcessVersion
SetDefaultCommConfigA
InitAtomTable
GetTimeFormatW
ReplaceFile
CancelWaitableTimer
GetFileSizeEx
UnregisterWaitEx
CreateFileW
GetStringTypeExA
DebugBreak
SetThreadLocale
IsValidLanguageGroup
WritePrivateProfileStringW
GetConsoleCharType
DeactivateActCtx
GetBinaryTypeW
CreateEventA
GetCPInfoExA
LocalCompact
GetNamedPipeInfo
GetVolumeInformationA
GetFullPathNameW
FlushFileBuffers
CreateActCtxW
GetDateFormatW
GlobalLock
GetPrivateProfileStringW
GlobalAddAtomA
LZCopy
IsWow64Process
SetLocalTime
EnumSystemLanguageGroupsW
SetCalendarInfoA
GetDiskFreeSpaceA
GetLogicalDrives
QueryMemoryResourceNotification
CreateMailslotA
ExitProcess
DosPathToSessionPathW
FindFirstChangeNotificationA
DefineDosDeviceW
DeleteTimerQueueTimer
AttachConsole
TlsSetValue
GetBinaryTypeA
LocalHandle
EnumResourceLanguagesW
CreateConsoleScreenBuffer
GetPrivateProfileSectionW
VirtualQuery
VirtualQueryEx
GlobalFree
LocalFree
LoadLibraryA
GetCommandLineA
LocalAlloc
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

shlwapi

PathFindFileNameW
SHRegGetUSValueW
PathIsRelativeA
PathRemoveFileSpecA
PathSkipRootW
StrStrNIW
StrStrW
SHRegGetUSValueA
PathIsUNCServerShareA
UrlIsNoHistoryA
UrlCompareA
PathCanonicalizeA
SHQueryValueExW
SHRegGetPathW
PathCreateFromUrlA
PathParseIconLocationW
wnsprintfW
StrPBrkW
SHSetValueW
SHReleaseThreadRef
PathMakePrettyW
PathCompactPathA
AssocCreate
PathRemoveArgsW
SHRegCreateUSKeyW
SHRegSetPathW
PathCompactPathW
PathAddBackslashW
PathMakePrettyA
PathIsNetworkPathA
StrCSpnIA
PathRenameExtensionW
PathGetCharTypeA
PathIsDirectoryW
PathIsDirectoryEmptyA
UrlIsA
UrlHashW
StrSpnA
PathMakeSystemFolderW
StrTrimW
PathSkipRootA
SHRegQueryInfoUSKeyA
PathIsUNCW
SHEnumKeyExA
StrChrA
PathIsPrefixW
PathIsContentTypeA
PathRemoveArgsA
UrlEscapeW
StrCSpnA
StrRChrIA
UrlCreateFromPathW
StrCSpnW
PathGetArgsA
PathIsFileSpecW
UrlApplySchemeW
StrNCatW
StrCmpNIW
PathIsUNCServerShareW
SHOpenRegStream2A
StrStrA
PathIsUNCA
PathIsContentTypeW
StrFromTimeIntervalW
PathFindFileNameA
StrNCatA
PathRemoveBackslashA
PathIsSameRootA
PathIsSameRootW
ColorHLSToRGB
PathFindNextComponentW
PathSetDlgItemPathA
SHRegEnumUSKeyW
StrRetToStrA
PathRelativePathToW
PathUndecorateW
SHRegGetBoolUSValueA
StrFormatByteSizeW
StrCatChainW
StrFormatKBSizeA
PathRemoveBlanksA
SHOpenRegStreamW
SHRegisterValidateTemplate
AssocQueryKeyA
PathStripPathA
SHRegDeleteUSValueW
PathCombineW
SHEnumKeyExW
UrlApplySchemeA
PathSetDlgItemPathW
SHRegCloseUSKey
StrCmpW
PathGetArgsW
StrRetToBufW
PathFindNextComponentA
SHGetThreadRef
PathCanonicalizeW
SHDeleteKeyA

ole32

CLSIDFromProgID
OleCreateEmbeddingHelper
CoInstall
ReadStringStream
HICON_UserFree
OleSaveToStream
CoAddRefServerProcess
CoReleaseServerProcess
WriteClassStg
UpdateDCOMSettings
CoCancelCall
CLSIDFromString
CoQueryAuthenticationServices
CoGetMarshalSizeMax
OleDuplicateData
StgOpenStorageEx
CoIsOle1Class
CoCreateInstance
CoEnableCallCancellation
StgIsStorageILockBytes
OleConvertOLESTREAMToIStorageEx
GetDocumentBitStg
CoGetCurrentLogicalThreadId
GetHGlobalFromStream
CoReleaseMarshalData
OleCreateLinkToFile
GetHGlobalFromILockBytes
CoLockObjectExternal
CoTaskMemAlloc
PropVariantChangeType
SNB_UserFree
StgIsStorageFile
OleInitialize
CoTaskMemRealloc
CoFreeLibrary
DllRegisterServer
OleSetAutoConvert
HWND_UserMarshal
IsValidIid
CoRetireServer
CoGetStandardMarshal
OleDraw
HBRUSH_UserMarshal
CoInvalidateRemoteMachineBindings
PropStgNameToFmtId
CoFreeAllLibraries
OleGetIconOfClass
ReadFmtUserTypeStg
SNB_UserMarshal
CoRegisterMallocSpy
CLSIDFromOle1Class
OleRegGetMiscStatus
StgGetIFillLockBytesOnFile
CoTestCancel
MkParseDisplayName
CoQueryClientBlanket
OleLockRunning
SetConvertStg
EnableHookObject

comdlg32

dwLBSubclass
LoadAlterBitmap
PrintDlgW
ReplaceTextW
ChooseFontW
PageSetupDlgA
CommDlgExtendedError
WantArrows
PrintDlgExA
FindTextW
ChooseColorW
GetOpenFileNameW
GetFileTitleW
GetSaveFileNameW
dwOKSubclass
FindTextA
GetFileTitleA
ChooseFontA
ReplaceTextA
PrintDlgA
PageSetupDlgW
GetOpenFileNameA
ChooseColorA

oleaut32

SysStringLen
VarI2FromI1
VarBstrFromUI1
VarR8FromDate
VarBoolFromUI8
VarCyFromI1
VarI8FromUI1
VarDecNeg
VarBstrCat
VarR8FromI8
VarNot
VarI8FromStr
VarR4CmpR8
SafeArrayCopy
VarUI8FromI8
CreateTypeLib2
VarI4FromDisp
VarBstrFromI1
VarUI4FromStr
LPSAFEARRAY_UserUnmarshal
VarR8FromBool
VarBstrCmp
VarI1FromR4
VarBstrFromR4
VarUI1FromR4
SafeArrayGetDim
SafeArrayGetUBound
OleLoadPictureEx
VarBoolFromR4
VarBstrFromI4
VarI1FromUI4
VarInt
VarBoolFromI1
LPSAFEARRAY_UserMarshal
SetErrorInfo
LoadTypeLib
VarCyFromStr
SafeArrayCreateVectorEx
VarI4FromI1
LHashValOfNameSys
VarUI1FromUI8
VarI8FromR8
VarDateFromI2
VarDecFromI8
SafeArrayGetLBound
VarUI4FromCy
SafeArrayGetElement
VarSub
VarI1FromUI8
VarMod
VarUI2FromR4
VarI2FromDisp
SafeArrayAccessData
VarR8FromR4
VarUI1FromDate
VarUI8FromI2
VarBoolFromDisp
VarBstrFromBool
GetRecordInfoFromTypeInfo
LoadTypeLibEx
VarUI8FromI1
VarDateFromStr
VarBstrFromR8
VarDateFromI1
VarBoolFromI2
VarDecMul
VariantTimeToSystemTime
VarI2FromCy
QueryPathOfRegTypeLib
VarDecSub
VarUI2FromI1
VARIANT_UserUnmarshal
VarUI8FromR4
VarBoolFromStr
BSTR_UserMarshal
VarUI2FromI4
VarDecFromStr
VarI8FromI2
VarUI1FromDisp
GetErrorInfo
VarCyFromR8
VarIdiv
DllCanUnloadNow
VarR8FromI4
VarDateFromUdate
SafeArrayRedim
VarBoolFromDate
SysFreeString
VarI1FromUI1
VarR8FromUI2
VarCyMul
VectorFromBstr
VarR8Round

shell32

SHGetDesktopFolder
SHGetFileInfo
CheckEscapesW
SHGetFolderPathAndSubDirA
ExtractIconW
StrRStrA
SHSetUnreadMailCountW
CommandLineToArgvW
SHGetDataFromIDListW
SHGetDiskFreeSpaceExA
Shell_NotifyIcon
SHPathPrepareForWriteA
DllInstall
StrChrA
SHHelpShortcuts_RunDLLA
StrNCmpA
SHQueryRecycleBinA
SHSetLocalizedName
SHEnableServiceObject
SHEmptyRecycleBinW
FindExecutableA
StrChrIW
ShellExec_RunDLLA
ShellExecuteA
SHCreateQueryCancelAutoPlayMoniker
ShellHookProc
PrintersGetCommand_RunDLLW
SheGetDirA
StrCmpNA
ExtractIconExA
ShellExec_RunDLLW
SHAddToRecentDocs
SHAppBarMessage
StrCmpNIW
SHLoadInProc
SHOpenFolderAndSelectItems
SHChangeNotifySuspendResume
SHBrowseForFolder
SHEnumerateUnreadMailAccountsW
SheChangeDirA
StrRChrIW
SHGetInstanceExplorer
SHGetNewLinkInfoA
SHFormatDrive
Options_RunDLLA
StrCmpNW
ExtractIconEx
Control_RunDLL
DllCanUnloadNow
SHFileOperation
SHInvokePrinterCommandW
SHExtractIconsW
SHBindToParent
DragQueryFile
DoEnvironmentSubstA
Shell_NotifyIconA
Options_RunDLL
ExtractAssociatedIconExA
DragQueryPoint
StrRStrW
SHGetPathFromIDListW
SHGetDiskFreeSpaceA
SHLoadNonloadedIconOverlayIdentifiers
ShellExecuteEx
SHGetIconOverlayIndexW
RegenerateUserEnvironment
SHCreateLocalServerRunDll
SHQueryRecycleBinW
AppCompat_RunDLLW

advapi32

RegRestoreKeyA
WmiQueryAllDataMultipleA
QueryServiceStatusEx
GetFileSecurityA
QueryAllTracesA
LsaEnumerateTrustedDomains
LsaEnumerateAccountRights
ReadEventLogW
LsaOpenTrustedDomainByName
SetServiceStatus
CryptAcquireContextA
GetMultipleTrusteeA
RegConnectRegistryA
CredDeleteW
ControlTraceA
CryptSetProvParam
LsaSetInformationPolicy
UpdateTraceA
SetEntriesInAccessListW
CryptSetHashParam
OpenEncryptedFileRawW
InitiateSystemShutdownW
RegUnLoadKeyA
RegisterServiceCtrlHandlerExW
LsaSetSecurityObject
CredReadDomainCredentialsW
EnumServicesStatusA
CredpConvertTargetInfo
CryptSetProviderExA
GetSecurityDescriptorLength
RegEnumValueW
GetAccessPermissionsForObjectW
FlushTraceA
RegQueryInfoKeyA
StopTraceA
LsaClearAuditLog
LsaQueryForestTrustInformation
LookupPrivilegeDisplayNameA
LsaOpenPolicy
AddAuditAccessObjectAce
RegLoadKeyW
TrusteeAccessToObjectW
LsaSetQuotasForAccount
GetSidLengthRequired
AccessCheckByTypeResultList
GetTrusteeFormW
RegisterTraceGuidsW
SetSecurityDescriptorRMControl
GetAclInformation
EqualPrefixSid
LsaCreateTrustedDomain
GetKernelObjectSecurity
SetFileSecurityW
ObjectDeleteAuditAlarmW
TrusteeAccessToObjectA
SetServiceObjectSecurity
EnumDependentServicesA
OpenSCManagerA
OpenBackupEventLogA
StartServiceA
ObjectPrivilegeAuditAlarmA
ImpersonateAnonymousToken
SetEntriesInAclA
QueryServiceStatus
ConvertToAutoInheritPrivateObjectSecurity
LsaCreateSecret
CryptVerifySignatureA
MSChapSrvChangePassword
FlushTraceW
SetAclInformation
CopySid
StartServiceCtrlDispatcherW

gdi32

SetBitmapAttributes
GetFontAssocStatus
GetGlyphOutlineA
GetPath
EngGetDriverName
ClearBitmapAttributes
GdiAddGlsRecord
ResetDCA
SetLayoutWidth
OffsetRgn
EngAcquireSemaphore
AbortPath
GetFontUnicodeRanges
GdiInitSpool
SetWorldTransform
PolyPolyline
GdiPlayPrivatePageEMF
XFORMOBJ_iGetXform
FONTOBJ_cGetGlyphs
GdiArtificialDecrementDriver
CreateScalableFontResourceA
AddFontMemResourceEx
GetTextCharset
PolyTextOutW
PolyDraw
PolyBezierTo
GdiConvertEnhMetaFile
AnimatePalette
CopyMetaFileW
cGetTTFFromFOT
SetDeviceGammaRamp
GdiPlayDCScript
GdiGetCharDimensions
Rectangle
GdiValidateHandle
GetDeviceGammaRamp
GdiAddGlsBounds
CreateEllipticRgnIndirect
PolyPatBlt
EudcUnloadLinkW
EngLockSurface
GetPixelFormat
SetSystemPaletteUse
GdiGetBatchLimit
AbortDoc
EngUnicodeToMultiByteN
bMakePathNameW
GdiGetDC
FillRgn
CreateCompatibleDC
ExtEscape
CreateEnhMetaFileW

version

VerQueryValueA
VerLanguageNameW
GetFileVersionInfoSizeW
VerQueryValueW
VerInstallFileA
GetFileVersionInfoA
VerFindFileA
VerFindFileW
GetFileVersionInfoW
GetFileVersionInfoSizeA
VerLanguageNameA

wtsapi32

WTSEnumerateServersA
WTSQueryUserConfigW
WTSFreeMemory
WTSVirtualChannelWrite
WTSOpenServerW
WTSVirtualChannelPurgeInput
WTSQuerySessionInformationA
WTSSendMessageA
WTSSendMessageW
WTSVirtualChannelRead
WTSShutdownSystem
WTSLogoffSession
WTSEnumerateProcessesW
WTSVirtualChannelPurgeOutput
WTSOpenServerA
WTSSetUserConfigW
WTSEnumerateSessionsW
WTSQueryUserConfigA
WTSCloseServer
WTSEnumerateProcessesA
WTSVirtualChannelClose
WTSWaitSystemEvent
WTSVirtualChannelQuery
WTSUnRegisterSessionNotification
WTSQuerySessionInformationW
WTSSetSessionInformationA
WTSTerminateProcess
WTSQueryUserToken

ws2_32

WSAAsyncGetServByPort
WSANtohl
WSAAsyncGetHostByAddr
getservbyport
WSAGetOverlappedResult
htonl
gethostbyaddr
accept
WSCInstallProvider
socket
WSACleanup
inet_ntoa
gethostname
freeaddrinfo
getsockopt
WSADuplicateSocketW
ioctlsocket
recvfrom
connect
WSAGetServiceClassInfoA
WSALookupServiceBeginW
WSCDeinstallProvider
WSAAsyncGetHostByName
gethostbyname
WSACloseEvent
WSAStringToAddressA
WSASetEvent
WPUCompleteOverlappedRequest
bind
WSAUnhookBlockingHook
WSASocketA
WSCUnInstallNameSpace
WSAIsBlocking
ntohl
select
WSADuplicateSocketA
WSASetServiceW
ntohs
WSALookupServiceNextA
WSCEnableNSProvider
WSCInstallNameSpace
WSCWriteProviderOrder
getprotobynumber
closesocket
WSCEnumProtocols
WSAGetQOSByName
htons
getaddrinfo
WSAEnumNameSpaceProvidersW
recv
WSCGetProviderPath
WSAResetEvent
WSACreateEvent
WSAAccept
listen
sendto
setsockopt
WSAEventSelect

comctl32

ImageList_LoadImageA
ImageList_GetBkColor
PropertySheet
FlatSB_SetScrollRange
GetMUILanguage
FlatSB_ShowScrollBar
FlatSB_SetScrollInfo
ImageList_BeginDrag
ImageList_ReplaceIcon
ImageList_Create
ImageList_GetImageInfo
CreatePropertySheetPageW
ImageList_GetImageCount
ImageList_SetDragCursorImage
ImageList_AddMasked
PropertySheetW
DrawStatusTextW
FlatSB_GetScrollPos
ImageList_LoadImage
ImageList_GetIcon
ShowHideMenuCtl
FlatSB_GetScrollProp
DestroyPropertySheetPage
ImageList_AddIcon
ImageList_Copy
CreateStatusWindowW
InitializeFlatSB
ImageList_DrawEx
ImageList_Replace
InitCommonControlsEx
InitMUILanguage
ImageList_Draw
ImageList_SetImageCount
DrawInsert
CreateToolbar
InitCommonControls
ImageList_GetIconSize
ImageList_Add
FlatSB_EnableScrollBar
DllGetVersion
FlatSB_SetScrollProp
CreateStatusWindow
MakeDragList
CreatePropertySheetPageA
ImageList_DragEnter
ImageList_Remove
ImageList_SetIconSize
ImageList_DragShowNolock
FlatSB_GetScrollInfo
ImageList_DrawIndirect
PropertySheetA
GetEffectiveClientRect
ImageList_SetOverlayImage
DrawStatusText
CreateToolbarEx
UninitializeFlatSB
DrawStatusTextA
ImageList_GetFlags
LBItemFromPt
ImageList_GetImageRect
ImageList_SetBkColor
MenuHelp
CreatePropertySheetPage
ImageList_Write

Exports

Exports

Z䖣GY��HOp�bl��V.�;Π,�� w�7*�<lr��o=��1i��E'�� :��VEr�s�smhT��* ؅��I�F$bU�,��b�a�C ��0��/�Fr��I#��G�Pr�o�ӯ`��y(Io�SA|��n��v,��_3\:�h�� ;��U�J��0��rb=a۶.:6q-PO��A��Z�Эkz=Q��/�Ō�5*�܇0 ��Dc��ɘīfl"��xo�� .��3ִ�p(�m ��$6��iTVқ��+-�t�䈻~��/��u�f��A�G롣5i�/��W��.?Ɠ��o�&��{ގ��ch��B�L��Ef͙��j��؃Qk�$D��V��}s�L��ľ��O�MF �9�g+��e�)^m\�S��h��k�%��uG�o�B�`��pkB��'[�V��.�� _�d�=G��cri �r�,�3/�hA�.X��y��ݮ��fo`��J��X^�: ��ى��=��1�&��k5�T�1cĬ�Ǭt;�V\�'��(E�7_�-��N7�Z$g9p��'��P3��Z��"��V��A\K��:�� K3�T�K�fz��?:��]��-J��}b>��$��J��=4A<@c��i��e��g;(�%7�{��Ɍ�, ˀ&jwom �? ��n`��.ci�pEku�t�n4��P/b�1%] 6t��\�D�g��H�� rkė����G��L-��H&��툄��}��I9s�-�-ߋ��4 ��ۦ��d�AF� �Jj1��O�'Y]PD�;,6��#I�w�kS��羐�D*�p��ˏV��fH�PY�K��FD�G��bP%iO��2״��Ѻ%>Z2�Ōcc��8��9.��xI8��ڳ��tN�SO4i� ��X�ߺO��M��.�b�� #j�@3h�!��~�<��cj�%�ޚ��D�U��A�6�[��,�۞J6c�C ��}��蟀[�U��8�ʝ�ԟ��Ӹ6�(�[��JX��Գ�A�#�Ԟ�{�᭞4�M},��9� ��1s,�|��2 �si��pzYlV ��*Y@� C��R�W��o��'�ߠK~N��ЩP�L/��2��M�(=�Ү�l0��߂�ˀ%��|��۠�j7<E��A=�$p0�irX�H�j�z#]�߀��9�:|��;�O��AeuF�1iz�؃|2�n��؇��3��0�fU#<l�G��4��L̼rw�*�dg�Zn�1�=�i��#"��rN��9�!ib��w>��AhE��Y�{�yR� wܾW�*��Le K�)-�bZ��~k�Z�qqCھ7G�>�~U^��$��(%ˀ1]�@��S��h��]��N�Z��9�p/�� D >Rs�a#��H.�n��{�s��C�M"ݥ �xD��R�D�MH�<�%�|odg�\nPh��^�]�7��./qvJ��|�D�� 2��*�Sh��n�j��z��pg�C:+�#��$ k%G�I4W��LG��Z��<�#E�b��ñ�C�R5�rj��I]Hg9藉ld�X��ĝ�!��?��~��׳k�?�ʗ��#�{I��x~D��|�� N��X�n<�v_�l��ƛ��]+��m�{�\��H�ʡHq�zZ�O0�=HF��</�E#Le��lV�{�*F^.�D��`�"x��yPn�4��ǣKn�z��A0��g�;�4�!í� ��Dp<H��w�{Y��ʿ:'��s�d��H�o`|6�f%e��o�z�%8h��M$8��}7Ȗm�w��_ �P{�P��9AO&�0��Tn:I�")��hV��C�G��g��hN�q��rb�c+�ۥ�.�,>9��G�6_ �<��v��1`�S_/5��F��3�K�q.�h��S[du��%�x��8�g��%��/��U�ML��ՙ�0��˫�6��sw��(�^�uY��7�2BhAd��/Q�N�ѳ�YՕ�9N�E��?!��|}hf�%M萘Ʒ$�0�"_�KB��R�sƓ� �c�&s��[׉A�M��Y?�(7Ӭq�Lɝs6ǜ��A��qN��ҩ@혆H�[��U��޻��]4�ʡ��`��&!F�O'��G��>�rAŮ'��T��`�q�h��X��l2O��흜L��1j��J5(:1j!�� _X�׷\3<(��x��Bf��TDq&��v��Aj��1R�4��WK��[Hs��l1��}>��c#'��O��"�畢�H.t h��Q�y%ePfWC2)3Ch�3��2OTB�ߏ�/�7��wk&|��\��/��\�4�U��ۣ��5��BU�u�skY�Ԭ��ƹ��?�J�rX��:��0)W�)󈀇y>y�a_AW�֧�"ю�K �� 5��[GX&�δt�5�벀�)��=~��a��6�p�r\� ��e��'֙�K�� 0a5g�Ho֍�h:��6?�}QR�N6��v��a_r��&Q(�'I�c��S�!��o�.��ժ|��}�O笱O��J��r�A��f��~�0�>�(�^ ?R�B��L[h��Tq�Ⴇt�J��:d�nځ�n��$;�*dJ�YAD��-F�8�c��㝪ƹf'��GdU��T�χ,�߆�˵z]{e��% ��(��v��l��6^�& 9j$��o�L{�?2�w8r�I|��|]q�R��;��Lh��O��㎛��nT�o5�{$kVK��b�\�7u��v��9R��s�<z�^��A��qp��[ϛ��)��|ʂ�p��\4��Q@l]��9

Sections

CODE
Size: 430KB - Virtual size: 430KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 782B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

915a91d767564d3d89f70971af23aacb

Code Sign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

1f:6c:49:48:17:87:1a:91:0f:51:74:55:f5:1a:03:b6Certificate

Extended Key Usages

Key Usages

06:de:10:bf:c2:eb:58:97:87:55:ee:7b:c2:aa:a4:89:cc:1e:76:d9Signer

Signature Validations

Verification

24/11/2022, 14:55 Valid: false

Headers

File Characteristics

Imports

user32

kernel32

shlwapi

ole32

comdlg32

oleaut32

shell32

advapi32

gdi32

version

wtsapi32

ws2_32

comctl32

Exports

Exports

Sections

CODE Size: 430KB - Virtual size: 430KB

DATA Size: 18KB - Virtual size: 17KB

BSS Size: - Virtual size: 782B

.idata Size: 28KB - Virtual size: 28KB

.data Size: 15KB - Virtual size: 15KB

.tls Size: 512B - Virtual size: 24B

.text Size: 113KB - Virtual size: 112KB

.reloc Size: 10KB - Virtual size: 10KB

.rsrc Size: 19KB - Virtual size: 22KB

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

1f:6c:49:48:17:87:1a:91:0f:51:74:55:f5:1a:03:b6
Certificate

06:de:10:bf:c2:eb:58:97:87:55:ee:7b:c2:aa:a4:89:cc:1e:76:d9
Signer

24/11/2022, 14:55
Valid: false

CODE
Size: 430KB - Virtual size: 430KB

DATA
Size: 18KB - Virtual size: 17KB

BSS
Size: - Virtual size: 782B

.idata
Size: 28KB - Virtual size: 28KB

.data
Size: 15KB - Virtual size: 15KB

.tls
Size: 512B - Virtual size: 24B

.text
Size: 113KB - Virtual size: 112KB

.reloc
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 19KB - Virtual size: 22KB