ad57388b018c9de2d1a7ba7465d0effc5d0999c5557e883b87a10299348f9a01

Sharing

Copy URL

Twitter E-mail

General

Target

ad57388b018c9de2d1a7ba7465d0effc5d0999c5557e883b87a10299348f9a01
Size

1.3MB
MD5

bfcdd731ded8183ff189305c64c394e4
SHA1

9057efb9c2dab40bbd512cfd20a3acb0c0d5a7dd
SHA256

ad57388b018c9de2d1a7ba7465d0effc5d0999c5557e883b87a10299348f9a01
SHA512

9bd0ede2f12cb82c26dc8f9a64b77626a5fa839ec928f8d5fc7f607de1ff1b50b20272a8c26454e5d8449462c6db721cc5aac84ad9ccd824ff9331428071c429
SSDEEP

24576:zMhKJ0mOmysmJh9LOHl35yeBfw9VY0cWNTrL9tId2Hs5NWU:zMhkuD/Q3kcQbTrLH6/R

Score

N/A

Malware Config

Signatures

Files

ad57388b018c9de2d1a7ba7465d0effc5d0999c5557e883b87a10299348f9a01
.dll windows x86

526aaeb79810c0871c91db11229ef7aa

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:34:99:e1:10:4f:5e:75:e7:21:a7:f1:54:73:bb:1f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16-10-2019 00:00

Not After

20-10-2022 12:00

Subject

CN=AVG Technologies USA\, LLC,OU=RE 999,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a3:da:ef:5b:4f:3a:be:02:9f:d9:18:a8:96:64:c4:2a:cf:3c:f3:d6:63:b1:8c:0f:36:c3:2c:2e:37:46:f3:6a
Signer

Actual PE Digest

a3:da:ef:5b:4f:3a:be:02:9f:d9:18:a8:96:64:c4:2a:cf:3c:f3:d6:63:b1:8c:0f:36:c3:2c:2e:37:46:f3:6a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=AVG Technologies USA\, LLC,OU=RE 999,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US

12-04-2021 10:14
Valid: true

Chain 1

CN=AVG Technologies USA\, LLC,OU=RE 999,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpCrackUrl

module_lifetime

?GetModuleLifetimeDll@mi@asw@@YA?AV?$shared_ptr@VIModuleLifetime@mi@asw@@@std@@XZ

dll_loader

?load_dll@dll_loader@asw@@YAPAUHINSTANCE__@@PB_W0@Z
?free_dll@dll_loader@asw@@YA_NPAUHINSTANCE__@@@Z

crypt32

CertOpenStore
CertGetCertificateChain
CertFreeCertificateChain
CryptUnprotectData
CryptProtectData
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
CertAddCertificateContextToStore
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine

ntdll

VerSetConditionMask
NtSetInformationThread

protobuf

?Add@?$RepeatedField@H@protobuf@google@@QAEXABH@Z
?Clear@?$RepeatedField@H@protobuf@google@@QAEXXZ
?InitProtobufDefaults@internal@protobuf@google@@YAXXZ
?ClearFallback@UnknownFieldSet@protobuf@google@@AAEXXZ
?end@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QBE?AV?$RepeatedPtrIterator@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@internal@23@XZ
?begin@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QBE?AV?$RepeatedPtrIterator@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@internal@23@XZ
?Get@?$RepeatedField@H@protobuf@google@@QBEABHH@Z
?size@?$RepeatedField@H@protobuf@google@@QBEHXZ
?SerializePartialToArray@MessageLite@protobuf@google@@QBE_NPAXH@Z
?ParseFromArray@MessageLite@protobuf@google@@QAE_NPBXH@Z
?Reserve@RepeatedPtrFieldBase@internal@protobuf@google@@IAEXH@Z
?SerializeAsString@MessageLite@protobuf@google@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?ParseFromArray@UnknownFieldSet@protobuf@google@@QAE_NPBXH@Z
?OnArenaAllocation@Arena@protobuf@google@@ABEXPBVtype_info@@I@Z
?InternalExtend@RepeatedPtrFieldBase@internal@protobuf@google@@AAEPAPAXH@Z
?InitSCCImpl@internal@protobuf@google@@YAXPAUSCCInfoBase@123@@Z
?OnShutdownRun@internal@protobuf@google@@YAXP6AXPBX@Z0@Z
?DestroyMessage@internal@protobuf@google@@YAXPBX@Z
?MergeFrom@UnknownFieldSet@protobuf@google@@QAEXABV123@@Z
?SpaceUsedLong@Message@protobuf@google@@UBEIXZ
?CopyFrom@Message@protobuf@google@@UAEXABV123@@Z
?AssignDescriptors@internal@protobuf@google@@YAXPBUDescriptorTable@123@@Z
?Clear@Message@protobuf@google@@UAEXXZ
?VerifyVersion@internal@protobuf@google@@YAXHHPBD@Z
??0?$RepeatedField@H@protobuf@google@@QAE@XZ
??1?$RepeatedField@H@protobuf@google@@QAE@XZ
?InternalSerializeWithCachedSizesToArray@MessageLite@protobuf@google@@UBEPAEPAE@Z
?AllocateAlignedAndAddCleanup@ArenaImpl@internal@protobuf@google@@QAEPAXIP6AXPAX@Z@Z
?MergeFrom@Message@protobuf@google@@UAEXABV123@@Z
?GetTypeName@Message@protobuf@google@@UBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?IsInitialized@Message@protobuf@google@@UBE_NXZ
?ShutdownProtobufLibrary@protobuf@google@@YAXXZ
?InitializationErrorString@Message@protobuf@google@@UBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?CheckTypeAndMergeFrom@Message@protobuf@google@@UAEXABVMessageLite@23@@Z
?ByteSizeLong@Message@protobuf@google@@UBEIXZ
?SerializeWithCachedSizes@Message@protobuf@google@@UBEXPAVCodedOutputStream@io@23@@Z
?SerializeWithCachedSizesToArray@MessageLite@protobuf@google@@UBEPAEPAE@Z
?DiscardUnknownFields@Message@protobuf@google@@UAEXXZ
?New@MessageLite@protobuf@google@@UBEPAV123@PAVArena@23@@Z
?InitializationErrorString@MessageLite@protobuf@google@@UBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?SerializeWithCachedSizes@MessageLite@protobuf@google@@UBEXPAVCodedOutputStream@io@23@@Z
?WriteRaw@CodedOutputStream@io@protobuf@google@@QAEXPBXH@Z
?ReadBytes@WireFormatLite@internal@protobuf@google@@SA_NPAVCodedInputStream@io@34@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0StringOutputStream@io@protobuf@google@@QAE@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0CodedOutputStream@io@protobuf@google@@QAE@PAVZeroCopyOutputStream@123@_N@Z
??1CodedOutputStream@io@protobuf@google@@QAE@XZ
?ReadTagFallback@CodedInputStream@io@protobuf@google@@AAEII@Z
?SkipField@WireFormatLite@internal@protobuf@google@@SA_NPAVCodedInputStream@io@34@IPAVCodedOutputStream@634@@Z
?WriteAliasedRaw@ZeroCopyOutputStream@io@protobuf@google@@UAE_NPBXH@Z
?WriteStringMaybeAliased@WireFormatLite@internal@protobuf@google@@SAXHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAVCodedOutputStream@io@34@@Z
?ReadVarint32Fallback@CodedInputStream@io@protobuf@google@@AAE_JI@Z
?WriteVarint32SlowPath@CodedOutputStream@io@protobuf@google@@AAEXI@Z
?WriteInt32@WireFormatLite@internal@protobuf@google@@SAXHHPAVCodedOutputStream@io@34@@Z
?WriteEnum@WireFormatLite@internal@protobuf@google@@SAXHHPAVCodedOutputStream@io@34@@Z
?ReadVarint64Fallback@CodedInputStream@io@protobuf@google@@AAE?AU?$pair@_K_N@std@@XZ
?WriteInt64@WireFormatLite@internal@protobuf@google@@SAXH_JPAVCodedOutputStream@io@34@@Z
?WriteBool@WireFormatLite@internal@protobuf@google@@SAXH_NPAVCodedOutputStream@io@34@@Z
?size@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QBEHXZ
?Clear@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QAEXXZ
?Get@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?Add@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QAEPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??0?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QAE@XZ
??1?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QAE@XZ
??0?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QAE@ABV012@@Z
?WriteString@WireFormatLite@internal@protobuf@google@@SAXHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAVCodedOutputStream@io@34@@Z
?MergeFrom@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QAEXABV123@@Z
?WriteMessage@WireFormatLite@internal@protobuf@google@@SAXHABVMessageLite@34@PAVCodedOutputStream@io@34@@Z
?ReadVarintSizeAsIntFallback@CodedInputStream@io@protobuf@google@@AAEHXZ
?IncrementRecursionDepthAndPushLimit@CodedInputStream@io@protobuf@google@@QAE?AU?$pair@HH@std@@H@Z
?DecrementRecursionDepthAndPopLimit@CodedInputStream@io@protobuf@google@@QAE_NH@Z
?WriteSInt32@WireFormatLite@internal@protobuf@google@@SAXHHPAVCodedOutputStream@io@34@@Z
?ReadLittleEndian64Fallback@CodedInputStream@io@protobuf@google@@AAE_NPA_K@Z
?WriteBytesMaybeAliased@WireFormatLite@internal@protobuf@google@@SAXHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAVCodedOutputStream@io@34@@Z
?WriteDouble@WireFormatLite@internal@protobuf@google@@SAXHNPAVCodedOutputStream@io@34@@Z
?MergePartialFromCodedStream@Message@protobuf@google@@UAE_NPAVCodedInputStream@io@23@@Z

kernel32

ReleaseMutex
GetSystemDirectoryA
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FormatMessageA
WaitForSingleObjectEx
GetModuleHandleA
VerifyVersionInfoA
ExpandEnvironmentStringsA
CreateFileA
LoadLibraryW
GetVersionExA
GetWindowsDirectoryA
CreateMutexW
InitializeSListHead
SleepEx
OutputDebugStringW
GetSystemTimes
GetCurrentProcessId
FindVolumeClose
GetVolumePathNamesForVolumeNameW
FindNextVolumeW
FindFirstVolumeW
GetWindowsDirectoryW
K32GetMappedFileNameW
FindClose
GetDiskFreeSpaceExW
SetFilePointer
SetFileAttributesW
ExpandEnvironmentStringsW
FindNextFileW
MultiByteToWideChar
GetLastError
LoadLibraryA
GetProcAddress
LoadLibraryExW
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleExW
InitializeCriticalSection
DeleteCriticalSection
WideCharToMultiByte
GetModuleFileNameA
GetCurrentThreadId
LCIDToLocaleName
GetUserDefaultLCID
GlobalMemoryStatusEx
Sleep
SetEvent
CreateEventW
WaitForMultipleObjects
GetModuleHandleW
CloseHandle
GetModuleFileNameW
CompareStringW
LocalFree
ResetEvent
GetFileSizeEx
LockFileEx
CreateFileW
UnlockFileEx
SetFilePointerEx
ReadFile
HeapFree
InitializeCriticalSectionEx
RaiseException
HeapAlloc
GetProcessHeap
CreateDirectoryW
GetFileSize
WriteFile
DeleteFileW
InitializeCriticalSectionAndSpinCount
GetThreadPriority
GetCurrentThread
GetCurrentProcess
GetThreadTimes
WaitForSingleObject
GetTickCount
SetThreadPriority
GetNativeSystemInfo
SetLastError
SetEndOfFile
QueryPerformanceFrequency
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryThreadCycleTime
FreeLibrary
GetSystemDirectoryW
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
GetFileAttributesW
FindFirstFileW
QueryDosDeviceW

user32

GetClassInfoExW
RegisterClassExW
GetSystemMetrics

advapi32

CryptAcquireContextA
OpenThreadToken
GetTokenInformation
RegQueryValueExA
CryptReleaseContext
CryptGenRandom
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
RegEnumKeyExA
CryptAcquireContextW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RevertToSelf
EqualSid
OpenProcessToken
RegOpenKeyExA

shell32

SHGetFolderPathW

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
OleRun

msvcp140

?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
??0ctype_base@std@@QAE@I@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1ctype_base@std@@UAE@XZ
?_Getctype@_Locinfo@std@@QBE?AU_Ctypevec@@XZ
_Tolower
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
?_Winerror_map@std@@YAHH@Z
_Toupper
??0_Locinfo@std@@QAE@PBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?classic@locale@std@@SAABV12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??Bid@locale@std@@QAEIXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Xout_of_range@std@@YAXPBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?__ExceptionPtrToBool@@YA_NPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
_Xtime_get_ticks
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1_Locinfo@std@@QAE@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
_Query_perf_counter
_Query_perf_frequency
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
_Lock_shared_ptr_spin_lock
_Unlock_shared_ptr_spin_lock
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?_Random_device@std@@YAIXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Syserror_map@std@@YAPBDH@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ

vcruntime140

memset
_except_handler4_common
__std_exception_copy
__current_exception
memmove
__RTDynamicCast
_purecall
_CxxThrowException
memchr
strstr
strchr
__std_type_info_compare
__std_exception_destroy
__CxxFrameHandler3
__RTtypeid
__std_type_info_name
__current_exception_context
__std_terminate
__std_type_info_destroy_list
memcpy
strrchr

api-ms-win-crt-heap-l1-1-0

free
calloc
malloc
_callnewh
realloc

api-ms-win-crt-runtime-l1-1-0

abort
_errno
_invalid_parameter_noinfo_noreturn
__sys_nerr
strerror
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
_initterm_e

api-ms-win-crt-stdio-l1-1-0

fseek
ferror
fflush
fsetpos
_fseeki64
fgetpos
fwrite
fread
fgetc
fclose
__stdio_common_vsprintf
__stdio_common_vswprintf
ungetc
ftell
__stdio_common_vsscanf
setvbuf
_get_stream_buffer_pointers
fputs
fgets
fopen
__acrt_iob_func
fputc

api-ms-win-crt-filesystem-l1-1-0

_stat64
_lock_file
_access
_unlock_file

api-ms-win-crt-string-l1-1-0

strcspn
strncpy
_wcsnicmp
strncmp
_stricmp
_strnicmp
wcsncmp
strcpy_s
_strdup
wcscat_s
isxdigit
strncat
tolower
strspn
isupper
isspace
isdigit

api-ms-win-crt-convert-l1-1-0

atoi
strtoul
wcstoul
strtol
strtoll

api-ms-win-crt-time-l1-1-0

_localtime64
strftime
_difftime64
_mktime64
_time64
_ctime64
_gmtime64

api-ms-win-crt-math-l1-1-0

modf
ceil
floor

api-ms-win-crt-utility-l1-1-0

qsort
rand

ws2_32

recv
send
InetNtopW
bind
socket
WSAGetLastError
recvfrom
gethostname
inet_addr
htonl
ioctlsocket
select
__WSAFDIsSet
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
ntohl

oleaut32

GetErrorInfo

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcpy
_mbsncmp
_mbschr
_mbspbrk

api-ms-win-crt-environment-l1-1-0

getenv

secur32

QueryContextAttributesW

dnsapi

DnsFree
DnsQuery_W

Exports

Exports

?CreateBurgerClientModule@detail@burger_client@asw@@YA?AV?$shared_ptr@VIBurgerClientModule@burger_client@asw@@@std@@XZ
?GetModuleLifetimeObject@detail@burger_client@asw@@YA?AV?$shared_ptr@VIModuleLifetime@mi@asw@@@std@@XZ
CreateBurgerClientModuleRaw
on_avast_dll_unload

Sections

.text
Size: 948KB - Virtual size: 947KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 238KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

526aaeb79810c0871c91db11229ef7aa

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

07:34:99:e1:10:4f:5e:75:e7:21:a7:f1:54:73:bb:1fCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

a3:da:ef:5b:4f:3a:be:02:9f:d9:18:a8:96:64:c4:2a:cf:3c:f3:d6:63:b1:8c:0f:36:c3:2c:2e:37:46:f3:6aSigner

Signature Validations

Verification

12-04-2021 10:14 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

module_lifetime

dll_loader

crypt32

ntdll

protobuf

kernel32

user32

advapi32

shell32

ole32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

ws2_32

oleaut32

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-environment-l1-1-0

secur32

dnsapi

Exports

Exports

Sections

.text Size: 948KB - Virtual size: 947KB

.rdata Size: 238KB - Virtual size: 237KB

.data Size: 36KB - Virtual size: 40KB

.didat Size: 512B - Virtual size: 92B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 61KB - Virtual size: 60KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

07:34:99:e1:10:4f:5e:75:e7:21:a7:f1:54:73:bb:1f
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

a3:da:ef:5b:4f:3a:be:02:9f:d9:18:a8:96:64:c4:2a:cf:3c:f3:d6:63:b1:8c:0f:36:c3:2c:2e:37:46:f3:6a
Signer

12-04-2021 10:14
Valid: true

.text
Size: 948KB - Virtual size: 947KB

.rdata
Size: 238KB - Virtual size: 237KB

.data
Size: 36KB - Virtual size: 40KB

.didat
Size: 512B - Virtual size: 92B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 61KB - Virtual size: 60KB