5759af53fd1bf5812e51364d74911271fb87a533c7557effca9870cd4fca162f

Sharing

Copy URL

Twitter E-mail

General

Target

5759af53fd1bf5812e51364d74911271fb87a533c7557effca9870cd4fca162f
Size

682KB
MD5

782ea8afb5c0ec3ccfbae29cd788cda4
SHA1

d99feba1ae2460d7d01396cb7d2908987b37c6ea
SHA256

5759af53fd1bf5812e51364d74911271fb87a533c7557effca9870cd4fca162f
SHA512

bcd7c2ba3adb198f333b90239bdb941f964dc0f662df3f9ff05fd6acfb571b1d877b0058e765c0dc29cd4bed90dad8b10c8e754967e8365c28756212758a60d8
SSDEEP

12288:hpQhlmHA5NDa2t0BV8j6JADgRiNYM5V6No5fwKMD:bolmHUdK8jaCgEn6NoBw1

Score

N/A

Malware Config

Signatures

Files

5759af53fd1bf5812e51364d74911271fb87a533c7557effca9870cd4fca162f
.exe windows x86

53e49e3ca742f12046d3ea27ccf9d38b

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:d0:21:0f:d3:cf:ba:83:68:c6:ee:09:b4:b8:87:67
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

03/04/2015, 00:00

Not After

02/04/2016, 23:59

Subject

CN=WEB LIDER OAO,O=WEB LIDER OAO,L=Moscow,ST=Moskovskaya oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

76:55:5e:a7:ba:5d:1a:59:e3:7c:fd:b6:41:88:16:f6:d8:67:ce:32
Signer

Actual PE Digest

76:55:5e:a7:ba:5d:1a:59:e3:7c:fd:b6:41:88:16:f6:d8:67:ce:32

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=WEB LIDER OAO,O=WEB LIDER OAO,L=Moscow,ST=Moskovskaya oblast,C=RU

24/11/2022, 14:55
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

wininet

FtpCreateDirectoryW

user32

CascadeChildWindows
IsCharUpperA
IsMenu
MapVirtualKeyW
IsGUIThread
CopyAcceleratorTableA
IsWindowUnicode
GetDC
GetCursor
GetAltTabInfoW
SystemParametersInfoW
IsDialogMessageA
EndMenu
SetDebugErrorLevel
EditWndProc
SetCursor
CreateCaret
WindowFromDC
GetInputDesktop
RegisterClassA
SetScrollInfo
ShowWindowAsync
CreateMDIWindowW
GetMenuStringW
SetProgmanWindow
ReleaseCapture
GetMenuInfo
FindWindowExW
DrawFrameControl
GetWindowContextHelpId
MessageBoxExA
GetCursorPos
EndTask
EnumDesktopsW
SetMenuItemBitmaps
DrawFocusRect
MapVirtualKeyExW
FillRect
GetIconInfo
IsChild
GetPropW
ToUnicode
CharPrevExA
wvsprintfW
LoadIconA
MenuWindowProcW
CharLowerBuffA
IsDialogMessageW
SetDlgItemTextW
GetWindowTextA
UnregisterHotKey
CreatePopupMenu
ReleaseDC
DefFrameProcW
BeginPaint
LoadKeyboardLayoutEx
GetMenuDefaultItem
GetMessageA
GetDlgItemTextA
GetNextDlgGroupItem
SystemParametersInfoA
DrawTextA
LoadImageA
PrivateExtractIconExA
ExitWindowsEx
EnumPropsExA
CopyIcon
LoadMenuA
SetProcessWindowStation
CreateIconFromResourceEx
DispatchMessageW
RegisterClipboardFormatA
LoadBitmapA
GetClipCursor
CallMsgFilterW
SendMessageA
SetScrollRange
AppendMenuW
wsprintfW
LoadCursorFromFileA
AlignRects
DrawTextExA
IsCharAlphaW
CheckDlgButton
MapVirtualKeyExA
EnumClipboardFormats
BroadcastSystemMessageExW
SetWindowRgn
ScrollWindowEx
GetMouseMovePointsEx
IsCharUpperW
AdjustWindowRect
AttachThreadInput
MonitorFromRect
SetActiveWindow
RegisterClassExA
ShowStartGlass
PostThreadMessageW
IsZoomed
EqualRect
EnableScrollBar
GetCapture
CharToOemBuffW
MessageBoxExW
SetRect
SetRectEmpty
CheckMenuRadioItem
GetKeyboardLayoutNameW
SetDeskWallpaper
GetWindowTextLengthA
ScrollChildren
SetScrollPos
GetAsyncKeyState
GetAltTabInfoA
TranslateMessage
DestroyIcon
EnumWindowStationsW
IsWindowEnabled
DestroyAcceleratorTable
DefDlgProcW
LoadCursorFromFileW
GetMenuItemCount
SetWindowWord
SetCursorPos
CharLowerA
DlgDirSelectExW
DrawMenuBarTemp
ChangeMenuA
MapWindowPoints
GetMonitorInfoA
PeekMessageW
DrawCaption
GetScrollPos
WinHelpA
GetTopWindow
GetUserObjectInformationA
GetSysColorBrush
UnionRect
GetGUIThreadInfo
DialogBoxIndirectParamA
GetTitleBarInfo
CloseDesktop
UpdateWindow
DrawCaptionTempW
IsWindowVisible
InvalidateRect
SetInternalWindowPos
OffsetRect
TrackPopupMenu
DlgDirListA
LoadAcceleratorsA
DrawEdge
GetDialogBaseUnits
KillTimer
SetMenuInfo
GetThreadDesktop
DrawIconEx
WaitMessage
AnyPopup
DrawFrame
DrawTextExW
AllowForegroundActivation
CreateMenu
GetMenuItemInfoA
BringWindowToTop
TabbedTextOutW
ChangeDisplaySettingsExW
CharUpperA
GetMessagePos
WindowFromPoint
RegisterDeviceNotificationA
SetClassWord
TileChildWindows
TabbedTextOutA
GetMenuContextHelpId
SetUserObjectInformationA
MapVirtualKeyA
GetScrollBarInfo
MonitorFromWindow
UnloadKeyboardLayout
EnumPropsA
UpdateLayeredWindow
GrayStringA
SetParent
UnregisterClassA
CharLowerBuffW
CopyRect
SetCursorContents
LoadStringW
GetKeyNameTextW
GetMenuStringA
CharUpperBuffW
ActivateKeyboardLayout
GetMessageExtraInfo
ArrangeIconicWindows
GetWindow
OpenIcon
SubtractRect
RegisterClassW
DeleteMenu
GetComboBoxInfo
GetUpdateRect
SetSysColors
CharToOemW
MessageBoxA
SetWindowContextHelpId
CharUpperBuffA
GetClassWord
EndPaint
CascadeWindows
EnumDisplaySettingsW
GetDesktopWindow
ChangeMenuW
LoadMenuW
OemToCharBuffW
GetTabbedTextExtentA
FlashWindowEx
GetListBoxInfo
CallWindowProcW
ChangeDisplaySettingsW
GetRawInputDeviceInfoA
RegisterWindowMessageA
SetLayeredWindowAttributes
CharNextW
PrintWindow
CallNextHookEx
CharToOemBuffA
GetMonitorInfoW
ModifyMenuA
IsDialogMessage
GetMessageW
PeekMessageA
ShowWindow
SetWindowsHookExA
RegisterWindowMessageW
InsertMenuItemA
GetParent
EnumPropsW
ToAscii
GetWindowPlacement
GetDlgItemTextW
TrackMouseEvent
SetTimer
MessageBeep
PrivateExtractIconsW
GetAncestor
SetCaretBlinkTime
SetWindowsHookA
GetNextDlgTabItem
OpenInputDesktop
GetWindowWord
GetWindowLongA
SetLastErrorEx
CheckRadioButton
DestroyWindow
DispatchMessageA
LoadCursorW
UnregisterDeviceNotification
RealChildWindowFromPoint
CharPrevW
DragObject
MoveWindow
DestroyMenu
GetMenuItemID
GetUpdateRgn
DrawStateA
HideCaret
GetWindowDC
SetClipboardData
RemovePropW
LoadImageW
OpenWindowStationW
SendMessageTimeoutA
GetWindowRgnBox
GetCursorInfo
DrawAnimatedRects
PtInRect
SetCaretPos
ClipCursor
IsWindow
UnregisterClassW
PostMessageW
DefWindowProcA
GetWindowInfo
GetLastInputInfo
SendNotifyMessageW
GetKeyboardState
GetSystemMetrics
SetSystemCursor
AdjustWindowRectEx
GetInternalWindowPos
CreateIcon
EnumPropsExW
LockWindowUpdate
CallWindowProcA
wsprintfA
FindWindowW
IsIconic
GetWindowTextLengthW
GetClassInfoExW
LoadKeyboardLayoutA
EnumThreadWindows
GetWindowRect
MessageBoxIndirectA
SetDlgItemTextA
AnyPopup
OpenIcon
CreateDialogIndirectParamA

kernel32

AllocConsole
SetProcessAffinityMask
CallNamedPipeW
RtlZeroMemory
PeekConsoleInputW
EndUpdateResourceW
lstrcat
ProcessIdToSessionId
DeleteTimerQueueTimer
GetCalendarInfoA
GetPrivateProfileIntA
SetCurrentDirectoryW
EnumResourceTypesW
WinExec
AllocateUserPhysicalPages
FindNextFileA
MultiByteToWideChar
VirtualFreeEx
GetShortPathNameA
GetProcessAffinityMask
GetLogicalDrives
lstrcmp
LZOpenFileA
LockFileEx
GetVersion
LCMapStringA
GetLongPathNameW
ReadConsoleOutputCharacterA
GetLocaleInfoA
GetPrivateProfileStructA
SetProcessPriorityBoost
GlobalAlloc
SystemTimeToTzSpecificLocalTime
WriteConsoleW
lstrcpyn
EnumLanguageGroupLocalesA
GetFileInformationByHandle
GlobalUnlock
CreateFileA
GetPriorityClass
GetGeoInfoW
SetMailslotInfo
GetVolumePathNameW
GlobalReAlloc
lstrcpynW
GetFileSize
RtlUnwind
PrepareTape
GetNamedPipeHandleStateW
HeapDestroy
GetThreadPriorityBoost
VerifyVersionInfoW
SetUnhandledExceptionFilter
RegisterWaitForInputIdle
BuildCommDCBA
EnumSystemCodePagesA
AddAtomA
LocalUnlock
ExitProcess
SetCommBreak
WaitCommEvent
GlobalFlags
SetEvent
GetCurrentProcessId
ReadConsoleOutputCharacterW
GetComPlusPackageInstallStatus
GetStringTypeExW
RestoreLastError
CopyLZFile
GetTapePosition
CompareStringW
FindResourceW
WritePrivateProfileStringA
IsBadHugeReadPtr
GetBinaryTypeA
QueryDosDeviceA
WriteConsoleOutputA
GetComputerNameExW
BackupRead
FreeResource
MapUserPhysicalPages
SetInformationJobObject
GetLastError
SearchPathA
EnumDateFormatsW
GlobalDeleteAtom
SetVolumeMountPointA
InitAtomTable
VerifyConsoleIoHandle
SizeofResource
GetConsoleCursorMode
lstrcmpA
ReplaceFileW
BuildCommDCBAndTimeoutsW
SetFileAttributesW
EnumResourceTypesA
ReplaceFile
QueryDosDeviceW
GenerateConsoleCtrlEvent
GetLongPathNameA
GetThreadTimes
GetProfileSectionW
FindAtomA
GetCurrentThreadId
GetCurrentConsoleFont
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetModuleHandleW
GetNamedPipeHandleStateA
FreeEnvironmentStringsA
SetDefaultCommConfigW
GetConsoleDisplayMode
FatalExit
CreateJobObjectW
SetLocalTime
FoldStringA
CreateActCtxA
FlushFileBuffers
WriteProfileSectionA
LocalLock
BeginUpdateResourceA
GetHandleContext
GetConsoleInputExeNameA
RegisterWaitForSingleObject
FindFirstFileExA
SetFileApisToOEM
TransmitCommChar
MulDiv
IsBadStringPtrW
OpenMutexW
LZCreateFileW
WriteConsoleOutputCharacterA
UnregisterWait
SetEndOfFile
GetPrivateProfileStructW
LZCloseFile
GetCurrentDirectoryA
GetVersionExA
WritePrivateProfileSectionW
CreateTimerQueueTimer
CreateActCtxW
UnlockFile
GetNamedPipeInfo
IsDBCSLeadByteEx
lstrlenA
RtlCaptureStackBackTrace
SetErrorMode
CopyFileExW
EnumResourceLanguagesW
lstrlenW
SetComputerNameExA
AddRefActCtx
SetLastError
GetConsoleSelectionInfo
EnumUILanguagesA
SetThreadPriority
AttachConsole
GlobalSize
GetSystemPowerStatus
ExpandEnvironmentStringsA
ReleaseSemaphore
LocalReAlloc
GetConsoleAliasesW
CopyFileW
IsValidLanguageGroup
GetSystemDirectoryW
CreatePipe
InterlockedIncrement
TzSpecificLocalTimeToSystemTime
SetCalendarInfoA
HeapCompact
LoadModule
GlobalHandle
GlobalFindAtomA
CreateSemaphoreA
GetCommandLineW
QueryInformationJobObject
UnmapViewOfFile
GetDiskFreeSpaceW
GetPrivateProfileStringW
SetLocaleInfoA
GetProcessIoCounters
InvalidateConsoleDIBits
GetMailslotInfo
OpenEventW
GetNumberFormatA
CreateNamedPipeA
SleepEx
SetComPlusPackageInstallStatus
TlsSetValue
CreateConsoleScreenBuffer
FileTimeToDosDateTime
lstrcmpW
SetThreadAffinityMask
GetCurrentProcess
FindVolumeClose
GetFileAttributesA
FreeConsole
FindNextChangeNotification
PulseEvent
GlobalFix
SearchPathW
PeekConsoleInputA
GetFileAttributesW
ReadConsoleInputA
FileTimeToSystemTime
GetAtomNameA
FreeLibraryAndExitThread
GetEnvironmentStringsA
ReadFileEx
GetTimeZoneInformation
HeapSetInformation
LZSeek
HeapFree
SetFileShortNameA
GetComputerNameA
GetNativeSystemInfo
FindCloseChangeNotification
WaitNamedPipeA
CreateThread
RemoveVectoredExceptionHandler
ConsoleMenuControl
GetConsoleCursorInfo
DeleteVolumeMountPointA
OpenWaitableTimerA
OpenFileMappingA
UnlockFileEx
ConnectNamedPipe
OpenSemaphoreW
GetShortPathNameW
Heap32Next
GetConsoleAliasesA
GlobalCompact
GetConsoleWindow
ActivateActCtx
GlobalWire
PrivCopyFileExW
CreateProcessA
LocalFree
Heap32ListFirst
DeleteTimerQueueEx
DebugBreak
GetCompressedFileSizeW
GetOEMCP
GetDriveTypeW
CopyFileExA
SetThreadLocale
MoveFileW
lstrcatW
SetFilePointerEx
GetConsoleProcessList
EnumResourceNamesW
GetPrivateProfileStringA
FindFirstFileExW
DeleteFileW
VirtualFree
GetCommConfig
GetDefaultCommConfigA
QueryMemoryResourceNotification
GetStartupInfoA
SuspendThread
EnumTimeFormatsW
RemoveDirectoryW
GetCurrentActCtx
WaitForSingleObjectEx
LoadResource
OpenEventA
WriteConsoleOutputCharacterW
FindNextVolumeW
RtlFillMemory
GetBinaryTypeW
HeapLock
DelayLoadFailureHook
ExitThread
CommConfigDialogW
WaitNamedPipeW
TerminateThread
ScrollConsoleScreenBufferW
DefineDosDeviceA
SetFilePointer
GlobalFree
CallNamedPipeA
GetACP
lstrcpyW
BuildCommDCBW
DosPathToSessionPathW
GetTempPathW
SetThreadUILanguage
SetStdHandle
GetNumberOfConsoleInputEvents
lstrcpynA
IsBadStringPtrA
CompareFileTime
EnumTimeFormatsA
SetDefaultCommConfigA
SetEnvironmentVariableA
GetConsoleCharType
LocalSize
OpenSemaphoreA
WideCharToMultiByte
AddConsoleAliasW
CreateJobObjectA
IsDBCSLeadByte
WaitForDebugEvent
GetVolumePathNamesForVolumeNameW
CancelTimerQueueTimer
FindResourceA
LeaveCriticalSection
EnumSystemLocalesW
CreateFileW
SetComputerNameW
SignalObjectAndWait
GetVolumePathNamesForVolumeNameA
OpenFileMappingW
OutputDebugStringW
AddVectoredExceptionHandler
GlobalGetAtomNameW
GetExitCodeThread
ReadFile
Heap32First
IsValidLocale
ReadConsoleInputW
GetDiskFreeSpaceExA
WriteTapemark
SetVolumeLabelA
HeapWalk
GetVolumeInformationW
GetProcessShutdownParameters
Heap32ListNext
lstrcmpi
AddAtomW
GetCalendarInfoW
GetVolumeNameForVolumeMountPointW
WriteConsoleInputA
GetSystemTimeAdjustment
WritePrivateProfileSectionA
IsBadWritePtr
ReadConsoleInputExA
IsBadReadPtr
CancelIo
Beep
QueryActCtxW
InitializeCriticalSectionAndSpinCount
GetUserDefaultLCID
FindActCtxSectionGuid
LZStart
LockFile
SetSystemTimeAdjustment
SetThreadContext
LZCopy
EnumSystemGeoID
SetThreadExecutionState
GetCurrentThread
GetThreadContext
ClearCommBreak
GetConsoleTitleW
DeleteTimerQueue
CreateSemaphoreW
BackupSeek
GetTapeParameters
ReadConsoleOutputAttribute
EnumSystemCodePagesW
IsProcessInJob
GetFileAttributesExA
MoveFileWithProgressA
GetCurrencyFormatW
GetStartupInfoW
SetNamedPipeHandleState
SetCommTimeouts
GetDateFormatW
QueryPerformanceCounter
FindNextFileW
ReadConsoleOutputW
CreateMemoryResourceNotification
GetDefaultCommConfigW
CloseHandle
GetDateFormatA
WaitForMultipleObjects
FillConsoleOutputCharacterA
ReplaceFileA
GetConsoleCP
TransactNamedPipe
GetSystemDefaultLCID
CreateTimerQueue
GetLocaleInfoW
GetModuleHandleA
WaitForMultipleObjectsEx
OutputDebugStringA
GetDiskFreeSpaceExW
GlobalAddAtomW
LocalHandle
FindFirstVolumeMountPointW
ResetWriteWatch
ReadFileScatter
CreateDirectoryW
GlobalGetAtomNameA
Sleep
RaiseException
GlobalMemoryStatusEx
WriteProfileStringW
ReadDirectoryChangesW
TerminateProcess
ConvertDefaultLocale
VirtualUnlock
GetPrivateProfileSectionNamesA
HeapSize
CancelDeviceWakeupRequest
GetNumberFormatW
VirtualQueryEx
QueryPerformanceCounter
GetThreadPriorityBoost
VirtualQuery
LoadLibraryA
LocalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

ole32

CoReleaseMarshalData
DoDragDrop
CoGetInstanceFromIStorage
IsAccelerator
HBITMAP_UserFree
CoQueryAuthenticationServices
OleCreateFromFileEx
CoCreateFreeThreadedMarshaler
CoGetCallerTID
StringFromIID
OleSetAutoConvert
OleSaveToStream
CoGetInterfaceAndReleaseStream
StringFromCLSID
HPALETTE_UserSize
HMETAFILE_UserFree
IsValidPtrIn
CreateAntiMoniker
SNB_UserMarshal
CoGetCallContext
OleCreateFromData
OleCreateLinkToFileEx
CoRevokeMallocSpy
StgConvertPropertyToVariant
CoDosDateTimeToFileTime
CoRegisterPSClsid
HWND_UserFree
IsValidPtrOut
UpdateDCOMSettings
StgOpenAsyncDocfileOnIFillLockBytes
PropVariantCopy
CoRegisterChannelHook
CreateClassMoniker
OleInitialize
HICON_UserFree
GetDocumentBitStg
HBRUSH_UserFree
CoFreeLibrary
CoGetDefaultContext
CoDisableCallCancellation
CoAddRefServerProcess
CoDisconnectObject
PropStgNameToFmtId
StringFromGUID2
CoInitialize
CoFreeUnusedLibrariesEx
StgCreateDocfileOnILockBytes
CLSIDFromProgIDEx
GetRunningObjectTable
PropVariantChangeType
CoRegisterMallocSpy
HMETAFILE_UserUnmarshal
CoUnmarshalHresult
CoInstall
CoDeactivateObject
CoGetComCatalog
CoGetCancelObject
CoGetInstanceFromFile
WriteClassStg
OleCreateMenuDescriptor
GetHGlobalFromStream
ComPs_NdrDllGetClassObject
CoGetPSClsid
StgCreateDocfile
IsValidInterface
CoPushServiceDomain
MkParseDisplayName
CoSwitchCallContext
CoSetCancelObject
CoRevertToSelf
StgCreatePropSetStg
CoGetTreatAsClass
OleDoAutoConvert

comdlg32

GetOpenFileNameA
ReplaceTextW
GetFileTitleA
PageSetupDlgW
WantArrows
ChooseFontW
dwOKSubclass
GetOpenFileNameW
PageSetupDlgA
PrintDlgA
dwLBSubclass
ReplaceTextA
ChooseColorW
ChooseFontA
FindTextA
GetSaveFileNameA
ChooseColorA
LoadAlterBitmap
PrintDlgExA
PrintDlgW
GetSaveFileNameW
FindTextW
GetFileTitleW
CommDlgExtendedError

oleaut32

VarNeg
VarCyFromR4
VarUI4FromUI2
VarUI1FromUI4
VarDecCmpR8
RegisterActiveObject
VarUI4FromDisp
VarUI8FromI8
VarAdd
VarBstrFromI8
VarCyMul
VarUI2FromStr
SysAllocStringLen
DosDateTimeToVariantTime
VarI4FromI2
VarDecAbs
OleLoadPicturePath
GetActiveObject
VarBstrFromDate
OleCreatePictureIndirect
ClearCustData
VarR8FromCy
VarR4FromUI8
VarUI1FromDate
VarDecFromBool
VarUI2FromCy
VarParseNumFromStr
SysAllocString
VarBoolFromI4
VarPow
VarDateFromR4
VARIANT_UserMarshal
VarUI1FromBool
VarDecFromR8
SysStringByteLen
VarMonthName
SysStringLen
DllUnregisterServer
VarUI2FromBool
OleLoadPictureEx
VarBoolFromR8
VarI4FromUI1
VariantCopyInd
VarUI4FromBool
VarDateFromDec
VarDecFromUI1
VarI1FromI2
VarDateFromI2
LPSAFEARRAY_Marshal
LPSAFEARRAY_Unmarshal
VarI1FromCy
VarCyInt
LPSAFEARRAY_UserMarshal
CreateTypeLib2
VarR8FromUI2
VarDateFromBool
VarUdateFromDate
VarI2FromUI2
SafeArrayCopy
VarDecFromI4
VarCmp
VarDecSub
VarI2FromBool
LoadRegTypeLib
SafeArrayGetDim
OleCreatePropertyFrameIndirect
SysFreeString
VarI4FromR4
VarUI4FromI1
LoadTypeLib
VarDateFromUI8
VarR8FromDec
VarUI8FromUI1
VarBoolFromUI2
VarRound
VarDecRound
VarBoolFromStr
VarDateFromUI2
CreateErrorInfo
VarUI1FromI8
VarR8FromI2
SafeArrayAllocData
SafeArrayGetLBound
VarImp
VarDecNeg
VarBoolFromDate
VarUI8FromStr
VarR4FromI1
VarI1FromUI1
VarCyFix
VarDecFromDate
VarI8FromUI8
VarCyFromUI4
VarCyFromI8
VarR8Round
BSTR_UserSize
VarI8FromUI2

gdi32

GdiAddGlsRecord
CreateDCA
ColorCorrectPalette
EnumEnhMetaFile
STROBJ_vEnumStart
CreateColorSpaceA
GetMiterLimit
SetMetaFileBitsEx
GetMetaFileA
GdiProcessSetup
EngDeletePalette
GdiTransparentBlt
GdiAddFontResourceW
PlayEnhMetaFileRecord
EngFindResource
AnyLinkedFonts
GdiSetServerAttr
ExtEscape
GdiConvertFont
CopyEnhMetaFileW
GdiReleaseDC
GetRelAbs
GetCurrentObject
CloseEnhMetaFile
EnumFontFamiliesW
GetEUDCTimeStamp
SetTextJustification
StartDocW
EngCreateClip
EngBitBlt
GetTextExtentPointA
GetRegionData
XFORMOBJ_iGetXform
EngTransparentBlt
GdiCreateLocalMetaFilePict
GetCharacterPlacementA
GetDIBColorTable
GdiGetBatchLimit
GetBitmapAttributes
Escape
CreateColorSpaceW
TranslateCharsetInfo
EngPlgBlt
GdiResetDCEMF
XLATEOBJ_piVector
Ellipse
PolyDraw
bMakePathNameW
GdiConvertToDevmodeW
PlayMetaFileRecord
GdiPlayPrivatePageEMF
ColorMatchToTarget
PatBlt
EngQueryEMFInfo
GdiDrawStream
GetEnhMetaFileA
SetPixel
GetTextMetricsW
GetCharWidthInfo
GetTextCharacterExtra
GetEnhMetaFilePaletteEntries
ExtFloodFill
DeleteMetaFile
GetCurrentPositionEx
EnumICMProfilesA
SetPaletteEntries
GetHFONT
DeleteEnhMetaFile
FlattenPath
GdiGetLocalBrush
GetRgnBox
UnloadNetworkFonts
GetKerningPairs
DeleteObject
EngMarkBandingSurface
GdiDeleteLocalDC
GetLogColorSpaceA
GetDCOrgEx
CreateRectRgn
GetCharABCWidthsFloatA
GdiConvertAndCheckDC
SelectBrushLocal
InvertRgn
SetColorAdjustment
SetViewportOrgEx
BitBlt
SetTextCharacterExtra
SetVirtualResolution
GetCharABCWidthsW
GetSystemPaletteEntries
FONTOBJ_cGetGlyphs
EngMultiByteToUnicodeN
GdiEndDocEMF
AddFontResourceExW
CreateFontIndirectA
SetDIBits

ws2_32

gethostbyaddr
WSALookupServiceBeginW
WSCEnumProtocols
WSAStringToAddressW
WSAHtons
WSASetServiceW
WSAStringToAddressA
WSASend
WSCUpdateProvider
WSAEnumProtocolsW
WSARecvFrom
WSADuplicateSocketW
WSAGetServiceClassNameByClassIdA
WSACreateEvent
WSAAsyncGetProtoByName
WSASocketA
gethostname
WSARecvDisconnect
WSASetLastError
WSASetServiceA
accept
WSAStartup
listen
WSALookupServiceNextA
getaddrinfo
WSAInstallServiceClassW
WSAInstallServiceClassA
WSCInstallNameSpace
WSAAsyncGetHostByAddr
socket
WSCEnableNSProvider
getservbyport
WSANSPIoctl
setsockopt
send
WSCWriteNameSpaceOrder
closesocket
WSARecv
WSAJoinLeaf
htonl
WSAResetEvent
WSAGetServiceClassInfoW
shutdown
ntohl
WSAEventSelect
getprotobynumber
WSAEnumNetworkEvents
WSANtohl
WSASocketW
WSASetBlockingHook
WSAAsyncGetHostByName
WSAIoctl
WSAGetOverlappedResult
WSAIsBlocking
WSCDeinstallProvider
WSACancelAsyncRequest
WPUCompleteOverlappedRequest
getsockopt
WSAEnumNameSpaceProvidersW
WSAGetServiceClassNameByClassIdW
WSAAddressToStringW
ntohs
WSADuplicateSocketA
freeaddrinfo
WSACloseEvent
getservbyname
inet_addr
WSAUnhookBlockingHook
recv
ioctlsocket
WSANtohs
WSCUnInstallNameSpace
WSASendDisconnect
htons
sendto
bind
getsockname

Exports

Exports

%Yι�T�[VF+��BIn�L� �%��:��=��tܙ��#�7[�Zϻ<vֻ��fb]��LV�k��,��ny�<�\$⩃e�.t�� p�b��X5,6��ʈ7��DP9@�S~[��E��Բ�u[_Ϫ)}N�5��-t�*��[��i��c��Pr��؈��9��|��#,D�v&��T�t�g��^��(a��u��ⶎ q��ߌ��Q�m��8��3��M^��ȼ)Gn02BxG�=��VU�M1��m��S`��z�ӶjY)V��}��Ų��i��hT�c��l��H/M�WEL�ב��jf� uw%s|ە�S[�DKt^��ئ;9j��E�^BN� ֧&�W][w�|��r�b��1�:?��[1h�FA��D "b/��4v�T�^g{�em��#x/�^9ք=Ӧ�k"÷�7�lPR��2�!j��2�=��UI�q ��EHԇO!��?� �� <|o�^��c�ߏ!�u��b��M��F��j5Iн��}3��C��Ձ��&,d��Q�)�2w;�d��1ؒ��ԣe��y�V�n�Dif=u��c�F�Q�;sm<��clZٷ��"WpD��4m��:�APbJO��]g�Y�pt৷F]��Ʃ��4�*QR��n@AFJh?lܷ1>F�s��xd��-:�񊀝˶X�>��D,�MH�f:��mE�b��#��Mۍ_ �B�}��/��$?�I釘�<�p��n�Ւz�%�|ۆ�c�V�Wd:E�y]�lgbˑ��B�#��h��Eu��7uk��;��xk��yi��0Y�G�(�<E��8�Q��dX�� Z��qYkI��Ϩ��[8�P��%;d$+�b?)4H[�C%�n��>rѨT31ơ�+��F��Ee'��N�-�,�[9��B��nq<|�$��6_��Þ|��T\�i=Ik�N]��r�� &z�N�j��p0�ۃ��=x;ɾ;־��mv&��-[��c{#�g�Y�_��Ơ��U�8��_$+�HH�ϙl�=9 ]*8��"�O˥T��-+��^��#t��a��/dv ��9�,��ˌq��8��Qp��,S��C?ˊ��sV[��g��;=΃UT'6�64�sE~<sD�9�2�P�Fp�P�a��;�#ivx�mng�US��7�(�4 q�ܫx��[ :�ՙ�~}��i`:��t��Ey��*O�t��\)/�:��]�M��q;��#l��Cohz}��V#c��o˻ی6�p��L�*��v6Թk�FjA�_�x�Q �P�(��5ms^��F��v�v!��?S�Xܵ��O��R�K-Z�0z� y��x��ي�Bv8r#F"��Am2�~Z.uWH�.Qz��z|�)�B!� t5@Jˮ �K�{OV��T��'W��~��c�YOX��㋓�U�n @�Y��N�%1��%F��&֓�"k��.��0� ��LyO^��V5�A-Ǻ�7��Gޓ��D�̦��g�1ݷ*��R��)��p��HG�(�� O��3��(T�Sվ�d�d��5��99L!Q%𫆊 @�W�O��. ��]:�,7`t8��%h��)޸�;Ar��F��W��΄І0��R~��%�a ��N�B��V��Qd^[�9�K��k ��H��/�n��v�+�� o3|�W��=d��Vf}��9�� ֚�n�r"}ݼ��-A��7��C�5XYCۉ:��Y�J&��d�a%�� F*J�Xj��"��wJ��9��C��1�'[�TM�lK}<�#jvV1�Pە�rk�l�?k4y��m�YW�m��1� �a��:�g�P:h� *��5�N*??��e~��U�@�G x�U��"��|ޜH̒��.w��%�c��Х�̵��V�zTS�mM��"��c?�Og��[13rl�V��~��Q�%1�3]�|BjʇS6^�%#�i�c�76��e��Y��=x;�!��A��4�E|��/��_{��cÆnu2��h�~��E邈�=�2�l��/�SC��N6J�L��8(�nmhA�w�{G�m��H}t"��~J�� T�>��x��L�ƤfIQ�F�d��m��@#��D �9��qx��A�)��i��좭��D�,y��i�^] }�W'��9,�u�P��(Q9��.�m%ſ��(#ق]�sT Pm��i�8,�!��±��G~�L6��S8xz��o�7�Ҟ'��uH<$0��r��ۢ�I��y��rL7��>Q�p�q"Z��?aG�P�Um�{Bӊ�k�]^jAV��;�TN>�a��NrZq]G4ĕir�[U�o0b6�� T^]��[��,��f��U��M.C�o��=I��R(=�=�y�X��t��O�ЃS?��jnʕ��f*O��Q�N�,koW��i8��iTt��C�uH�y�}�(�'��Љr<�ރ�wp8փ�c�D��n �R��E��~��\�2AL��M56�8�B�]mqP!s*��Fi�>k�C��8�M ݣ��1;c�ڞ�Ϻp�t_��<��R@קּ�eL߸P�jL�n��072ύ^�pR�龘u5Ɂ��D�<ݿ�B\��͐� 0l�[��=��O8�z?��jJ��!�/ �[Ά�^��8<��h�ƈ�߽��2��g�J��S�&}T>�� S�$3��.lEYs�r/@ ��("g�e��}��v�w=��vm �U��X<4��|��ք��s!�F�1��9�J\d�a�IG

Sections

CODE
Size: 458KB - Virtual size: 457KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

53e49e3ca742f12046d3ea27ccf9d38b

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

0e:d0:21:0f:d3:cf:ba:83:68:c6:ee:09:b4:b8:87:67Certificate

Extended Key Usages

Key Usages

76:55:5e:a7:ba:5d:1a:59:e3:7c:fd:b6:41:88:16:f6:d8:67:ce:32Signer

Signature Validations

Verification

24/11/2022, 14:55 Valid: false

Headers

File Characteristics

Imports

wininet

user32

kernel32

ole32

comdlg32

oleaut32

gdi32

ws2_32

Exports

Exports

Sections

CODE Size: 458KB - Virtual size: 457KB

DATA Size: 23KB - Virtual size: 23KB

BSS Size: - Virtual size: 1KB

.idata Size: 25KB - Virtual size: 24KB

.text0 Size: 17KB - Virtual size: 17KB

.tls Size: 512B - Virtual size: 24B

.text1 Size: 89KB - Virtual size: 88KB

.reloc Size: 11KB - Virtual size: 10KB

.rsrc Size: 53KB - Virtual size: 53KB

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

0e:d0:21:0f:d3:cf:ba:83:68:c6:ee:09:b4:b8:87:67
Certificate

76:55:5e:a7:ba:5d:1a:59:e3:7c:fd:b6:41:88:16:f6:d8:67:ce:32
Signer

24/11/2022, 14:55
Valid: false

CODE
Size: 458KB - Virtual size: 457KB

DATA
Size: 23KB - Virtual size: 23KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 25KB - Virtual size: 24KB

.text0
Size: 17KB - Virtual size: 17KB

.tls
Size: 512B - Virtual size: 24B

.text1
Size: 89KB - Virtual size: 88KB

.reloc
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 53KB - Virtual size: 53KB