065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96

Sharing

Copy URL

Twitter E-mail

General

Target

065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96
Size

651KB
MD5

cc6f7edc4884f2c9f34c9c9e4a17c394
SHA1

042287ef644681e9699acfadc750e51e8d1bb30e
SHA256

065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96
SHA512

b9743d648556c05c4ed1610e6d7cbd0e0db7c7029a3fb537c5f21e3780769d3108c96ef3b5fb92c97202a67dea21b2bafd80012c87b4ea5ce03665a3f0b13976
SSDEEP

12288:4vLDgqO/uCq1eLSh1i7jp0HngrICE2DNMT:4f7O/uCwe2heYwD+

Score

N/A

Malware Config

Signatures

Files

065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96
.exe windows x86

5e0ddfa18df917de9ccf774b2b649637

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:cf:f2:29:0b:ab:f3:51:00:9a:74:69:3e:4c:90:4e
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16-03-2015 00:00

Not After

15-03-2016 23:59

Subject

CN=IT-SERVIS,O=IT-SERVIS,POSTALCODE=350000,STREET=NOVOKUZNECHNAYA\, 84,L=KRASNODAR,ST=KRASNODAR REGION,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f1:48:34:00:f0:ea:ed:27:db:29:a4:55:fb:b4:93:64:f7:3a:9c:7c
Signer

Actual PE Digest

f1:48:34:00:f0:ea:ed:27:db:29:a4:55:fb:b4:93:64:f7:3a:9c:7c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=IT-SERVIS,O=IT-SERVIS,POSTALCODE=350000,STREET=NOVOKUZNECHNAYA\, 84,L=KRASNODAR,ST=KRASNODAR REGION,C=RU

24-11-2022 14:54
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

IsZoomed
DlgDirSelectExA
GetMessagePos
CreateMDIWindowW
DestroyCursor
SystemParametersInfoA
MenuWindowProcW
DrawStateA
GetInputState
ChangeMenuA
EnableScrollBar
ModifyMenuA
EnumDisplaySettingsW
ShowOwnedPopups
CreateCursor
FlashWindowEx
MonitorFromPoint
RegisterClassA
UnregisterClassW
DlgDirSelectExW
GetScrollBarInfo
GetWindowModuleFileNameA
FlashWindow
BroadcastSystemMessageExA
GetNextDlgGroupItem
MapVirtualKeyA
InsertMenuItemA
SwitchDesktop
PrintWindow
MapDialogRect
GetCapture
SetSystemCursor
GetLastInputInfo
DrawStateW
MapWindowPoints
ChangeDisplaySettingsExA
GetClassWord
GetMouseMovePointsEx
SetScrollPos
IsDialogMessageW
EnumPropsW
GetWindowThreadProcessId
IsCharUpperA
RemovePropA
IsWindow
DialogBoxParamW
GetDlgItemTextW
PaintDesktop
RegisterClipboardFormatW
EndTask
DefFrameProcW
GetClipCursor
PrivateExtractIconsA
CreateDialogIndirectParamA
LoadKeyboardLayoutW
SetMessageExtraInfo
wvsprintfA
GetTopWindow
RealGetWindowClassW
FindWindowExA
InflateRect
IsCharLowerA
GetClipboardFormatNameW
SetTimer
SendMessageTimeoutW
BeginPaint
CharLowerBuffA
CascadeWindows
IsWindowUnicode
ToAscii
CharNextExA
SendNotifyMessageA
DefWindowProcA
EnumClipboardFormats
OpenInputDesktop
GetWindowPlacement
CopyImage
SetScrollRange
GrayStringW
DrawAnimatedRects
CopyIcon
CreateIcon
BroadcastSystemMessageA
GetMenuStringA
ShowScrollBar
ScreenToClient
CheckMenuItem
RegisterDeviceNotificationA
GetGUIThreadInfo
LoadIconW
EndPaint
SetMenuContextHelpId
GetMenuItemInfoW
GetMenuInfo
ExitWindowsEx
GetRawInputDeviceInfoA
CharToOemA
GetClassInfoW
ShowCaret
PeekMessageW
SetWindowPos
CharToOemW
SendMessageCallbackA
DestroyIcon
RegisterWindowMessageW
CharUpperBuffW
CharUpperW
CreateIconFromResourceEx
ToUnicode
LoadMenuW
AnyPopup
DrawCaption
ToUnicodeEx
CheckRadioButton
DestroyAcceleratorTable
LoadMenuA
InsertMenuW
LockWorkStation
TranslateAcceleratorA
CopyAcceleratorTableW
RegisterWindowMessageA
ChangeDisplaySettingsW
GetTabbedTextExtentA
GetSubMenu
DragDetect
AdjustWindowRect
OffsetRect
GetListBoxInfo
CreateMenu
IsIconic
GetCaretBlinkTime
InvalidateRect
CreateAcceleratorTableA
CharPrevW
GetLastActivePopup
CloseWindowStation
wvsprintfW
MessageBoxA
GetDesktopWindow
SetClassLongA
GetInputDesktop
GetGuiResources
CharUpperA
LoadCursorFromFileA
PtInRect
GetDlgCtrlID
WindowFromDC
GetMessageW
DefWindowProcW
ScrollChildren
CharToOemBuffW
ClipCursor
TrackPopupMenu
SetMenuInfo
SetWindowsHookExA
IsCharLowerW
BroadcastSystemMessageW
GetWindowContextHelpId
DialogBoxIndirectParamA
GetClassInfoExW
GetProgmanWindow
GetIconInfo
OemToCharW
DestroyMenu
SendMessageA
GetKeyboardLayout
GetWindowLongA
ReleaseDC
InvertRect
AnimateWindow
PrivateExtractIconsW
CloseDesktop
GetScrollInfo
SetMenuDefaultItem
ShowWindow
FindWindowA
SetDlgItemInt
UnloadKeyboardLayout
OemToCharBuffA
GetWindowRgnBox
EndDialog
SetFocus
DestroyWindow
EnumThreadWindows
GetDlgItemInt
EmptyClipboard
GetFocus
SendNotifyMessageW
CopyAcceleratorTableA
IsHungAppWindow
ScrollWindow
GrayStringA
ChangeDisplaySettingsExW
GetForegroundWindow
EqualRect
CallNextHookEx
SetWindowPlacement
MapVirtualKeyW
CharLowerBuffW
SystemParametersInfoW
CreateDialogIndirectParamW
GetUpdateRgn
SetSysColors
EnableMenuItem
IsDialogMessageA
SetCursorPos
GetMenuItemInfoA
GetCursorPos
LoadCursorFromFileW
GetProcessWindowStation
CharLowerW
SendMessageTimeoutA
LoadKeyboardLayoutEx
DrawFrame
EnumPropsExW
GetTitleBarInfo
GetPropW
RemoveMenu
GetWindow
GetClipboardViewer
DlgDirListA
GetTabbedTextExtentW
EnumDesktopsW
GetSystemMetrics
LoadStringW
FillRect
GetMenuItemCount
UpdateLayeredWindow
DialogBoxParamA
GetWindowModuleFileNameW
SetProgmanWindow
DrawCaptionTempW
SetDlgItemTextW
OpenDesktopA
MonitorFromWindow
LoadAcceleratorsW
DrawMenuBar
UnlockWindowStation
HideCaret
SendMessageCallbackW
DialogBoxIndirectParamW
SetCursorContents
CharToOemBuffA
GetUserObjectSecurity
GetDlgItem
BlockInput
SetActiveWindow
AppendMenuW
WaitMessage
UnionRect
SetRect
GetUserObjectInformationA
GetInternalWindowPos
GetMenuItemID
SetWindowRgn
GetMonitorInfoA
SetMenuItemInfoA
GetMessageExtraInfo
GetInputDesktop
InvalidateRect
GetAsyncKeyState

kernel32

IsBadReadPtr
GetStringTypeExW
ReadDirectoryChangesW
InterlockedCompareExchange
GetVolumePathNameW
VirtualUnlock
UnregisterWaitEx
LocalCompact
GetModuleFileNameA
ReplaceFile
LZRead
Heap32ListFirst
SizeofResource
GetPrivateProfileStructW
LZCopy
IsBadHugeReadPtr
GetProcessTimes
FindResourceW
GetLocaleInfoA
ReadConsoleInputW
GetCurrencyFormatA
GetTimeZoneInformation
FreeEnvironmentStringsW
SetVolumeLabelW
LZOpenFileA
IsBadHugeWritePtr
SystemTimeToTzSpecificLocalTime
TerminateThread
lstrcmpiW
EnumResourceLanguagesW
GetShortPathNameW
GetCommModemStatus
DefineDosDeviceW
RestoreLastError
ScrollConsoleScreenBufferW
DeleteTimerQueueEx
GetDateFormatW
EnumResourceTypesW
HeapValidate
ReadConsoleInputExA
EnumResourceLanguagesA
GetDefaultCommConfigA
WriteTapemark
GetModuleHandleW
RtlMoveMemory
GetVersionExW
GetLogicalDrives
AssignProcessToJobObject
FindResourceExW
EnumSystemLocalesA
DeleteTimerQueue
SetThreadPriority
ExitThread
SetWaitableTimer
OpenMutexA
GetBinaryTypeA
LocalLock
Beep
DelayLoadFailureHook
GlobalAddAtomA
WriteConsoleOutputCharacterA
ReadConsoleInputExW
GetAtomNameA
GetEnvironmentStringsW
WideCharToMultiByte
ChangeTimerQueueTimer
SearchPathA
CreateFileA
QueryPerformanceFrequency
SetInformationJobObject
DebugBreak
CreateEventW
HeapCreate
CloseHandle
GetFileSize
LocalSize
SetThreadUILanguage
SetLastError
GetConsoleOutputCP
GetExitCodeThread
ActivateActCtx
CreateProcessInternalA
FindFirstVolumeW
ScrollConsoleScreenBufferA
GetCurrentDirectoryW
SetProcessShutdownParameters
lstrcpyA
InterlockedIncrement
SleepEx
GetSystemPowerStatus
ConnectNamedPipe
CloseProfileUserMapping
GetConsoleFontInfo
UnregisterWait
FindVolumeClose
GetModuleHandleExA
SetFileValidData
GetACP
WritePrivateProfileStructW
SetLocalTime
GetTempPathA
lstrcmp
SetFileShortNameW
BeginUpdateResourceW
IsBadWritePtr
GetProcessPriorityBoost
GetConsoleProcessList
QueryInformationJobObject
GetConsoleKeyboardLayoutNameA
FatalAppExitA
GetConsoleTitleA
GetGeoInfoW
SetProcessWorkingSetSize
ClearCommError
DefineDosDeviceA
WaitForSingleObject
SetThreadPriorityBoost
PeekConsoleInputA
GetVolumeInformationW
LZCreateFileW
VerLanguageNameA
SystemTimeToFileTime
EnumCalendarInfoExA
GetDriveTypeW
GetStartupInfoW
SetCriticalSectionSpinCount
SetErrorMode
GetNamedPipeInfo
WriteProfileSectionA
OpenWaitableTimerA
SetPriorityClass
DosPathToSessionPathW
GetProfileStringA
CommConfigDialogW
OpenFile
EnumSystemLocalesW
GetConsoleFontSize
WriteConsoleOutputW
CreateThread
QueueUserWorkItem
CreateTimerQueueTimer
GetConsoleAliasesW
EnumSystemLanguageGroupsW
GetLastError
RegisterWaitForInputIdle
GetComPlusPackageInstallStatus
WinExec
GetConsoleMode
GetStdHandle
GetConsoleCharType
DosPathToSessionPathA
GetFileAttributesA
GetCommandLineA
FindFirstVolumeMountPointW
TransactNamedPipe
GetThreadPriority
lstrcmpW
GetSystemTime
GlobalSize
GetDiskFreeSpaceExA
FindFirstVolumeMountPointA
GetOEMCP
HeapDestroy
GetLogicalDriveStringsA
SetFilePointer
CallNamedPipeA
FindNextFileA
GetCurrencyFormatW
lstrcpy
FlushViewOfFile
GetLogicalDriveStringsW
AddAtomW
FindFirstVolumeA
DeactivateActCtx
CreateWaitableTimerA
GetNumberFormatA
CancelTimerQueueTimer
RtlFillMemory
ReleaseSemaphore
ConvertDefaultLocale
SetFileApisToANSI
WriteConsoleOutputCharacterW
ReadFileScatter
QueryMemoryResourceNotification
IsValidLocale
WriteProfileSectionW
GetNamedPipeHandleStateW
CreateMailslotA
AddRefActCtx
IsDBCSLeadByte
GetPrivateProfileSectionW
GetNumberOfConsoleInputEvents
GetProcessIoCounters
ReadConsoleInputA
lstrlenW
GetCurrentProcess
WriteFileGather
VerLanguageNameW
SetUnhandledExceptionFilter
FatalAppExitW
GlobalGetAtomNameA
GetStartupInfoA
GlobalFix
GetCompressedFileSizeW
OpenEventA
BackupSeek
GetVolumeNameForVolumeMountPointW
EnterCriticalSection
SetSystemTime
DosDateTimeToFileTime
MoveFileWithProgressW
SetVolumeMountPointW
FlushInstructionCache
SetHandleCount
WriteConsoleInputA
BuildCommDCBAndTimeoutsA
HeapLock
GetVolumeNameForVolumeMountPointA
lstrlen
SetCurrentDirectoryA
GlobalFlags
LockFileEx
WriteConsoleOutputA
LCMapStringA
GlobalLock
EnumTimeFormatsW
UnmapViewOfFile
SetComputerNameW
ReleaseMutex
lstrlenA
LocalFileTimeToFileTime
GetModuleFileNameW
CompareStringW
OutputDebugStringW
GetPrivateProfileIntA
SetFileAttributesW
FileTimeToLocalFileTime
GetPriorityClass
CreateSocketHandle
GetUserDefaultUILanguage
UnhandledExceptionFilter
MapUserPhysicalPages
DeleteVolumeMountPointA
GetProfileStringW
GlobalReAlloc
CopyFileW
TlsSetValue
SetDefaultCommConfigA
AddConsoleAliasA
RtlCaptureStackBackTrace
MoveFileWithProgressA
GetPrivateProfileSectionNamesA
lstrcmpiA
UpdateResourceW
GetTickCount
GetSystemDefaultUILanguage
SetVolumeMountPointA
OpenMutexW
LZCloseFile
lstrcmpi
TlsFree
lstrcpynA
SetFileApisToOEM
ReleaseActCtx
AddVectoredExceptionHandler
GetFileAttributesExA
RegisterWowExec
LZOpenFileW
VerifyVersionInfoW
WaitForSingleObjectEx
SetSystemTimeAdjustment
FileTimeToDosDateTime
HeapSize
GetLastError
LZClose
ResetWriteWatch
VirtualQuery
LoadLibraryA
LocalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

ole32

CoAllowSetForegroundWindow
CreateStreamOnHGlobal
CoQueryProxyBlanket
CoRegisterClassObject
ComPs_NdrDllUnregisterProxy
CoFreeLibrary
GetRunningObjectTable
StringFromGUID2
ComPs_NdrDllCanUnloadNow
CoEnableCallCancellation
OleCreateFromData
CoInitializeEx
HWND_UserFree
PropVariantChangeType
ReadClassStm
HMENU_UserMarshal
CoPopServiceDomain
CoBuildVersion
CoSetState
CreateObjrefMoniker
SNB_UserFree
CLSIDFromString
StgOpenAsyncDocfileOnIFillLockBytes
CoGetPSClsid
StgGetIFillLockBytesOnILockBytes
StgCreatePropSetStg
StgOpenStorageOnHandle
ComPs_NdrDllRegisterProxy
OleMetafilePictFromIconAndLabel
HBITMAP_UserSize
OleRegEnumFormatEtc
RevokeDragDrop
PropVariantClear
CoFreeUnusedLibrariesEx
CoSetCancelObject
CoResumeClassObjects
HWND_UserUnmarshal
ReadClassStg
HMETAFILE_UserFree
CoDeactivateObject
CoGetApartmentID
HWND_UserSize
OleInitializeWOW
OleDraw
CLSIDFromProgID
OleUninitialize
CoInvalidateRemoteMachineBindings
CoGetInterceptorFromTypeInfo
OleNoteObjectVisible
OleConvertIStorageToOLESTREAMEx

comdlg32

LoadAlterBitmap
ChooseColorA
GetSaveFileNameA
GetFileTitleA
PageSetupDlgW
PrintDlgExA
GetOpenFileNameA
GetFileTitleW
ChooseFontW
FindTextW
GetSaveFileNameW
PageSetupDlgA
dwLBSubclass
ReplaceTextA
CommDlgExtendedError
FindTextA
ReplaceTextW
ChooseColorW
GetOpenFileNameW
dwOKSubclass
PrintDlgA

oleaut32

VarCyFromI8
LoadTypeLib
OleLoadPicture
OleCreatePropertyFrame
VarI8FromI2
VarDecFix
VarUI1FromI8
LHashValOfNameSys
VarXor
DllGetClassObject
VarUI8FromDec
DosDateTimeToVariantTime
VarBoolFromI4
VarCyInt
VarCyFromStr
VarBstrFromUI2
VarI2FromI4
VarI8FromUI8
RegisterActiveObject
VarCyCmp
VarCyAdd
VarI2FromR4
VarI4FromUI4
VarBstrCat
VarCyFromDec
VarWeekdayName
VariantCopyInd
VarR4FromDisp
VarR8FromUI8
VarBoolFromStr
BSTR_UserMarshal
VarUdateFromDate
VarDateFromDec
LPSAFEARRAY_UserFree
VectorFromBstr
VarI8FromI1
DllUnregisterServer
VarI4FromBool
VarR8Round
SafeArrayCopy
VarBoolFromI1
VarUI2FromR4
OleCreateFontIndirect
VarUI4FromDec
VarI1FromUI1
VarI1FromUI8
VarI8FromBool
VariantClear
VarAdd
VarR4FromUI2
VarUI4FromUI8
VarR8FromCy
VarI4FromUI8
VarBstrFromDec
SafeArrayGetVartype
VarFormatDateTime
VarDecFromR4
VarUI4FromR8
VarI1FromCy
VarUI1FromDate
VarBoolFromUI2
VarR8FromI1
VarR4FromI4
VarUI8FromDisp
VarI4FromUI2

shell32

SHCreateProcessAsUserW
InternalExtractIconListA
SHFormatDrive
DragQueryFileAorW
ExtractIconExW
SHGetFolderPathAndSubDirW
ExtractIconEx
SheChangeDirExW
SHGetIconOverlayIndexW
SHBrowseForFolder
SHCreateShellItem
SHChangeNotifySuspendResume
OpenAs_RunDLLW
StrNCmpIA
Control_RunDLLA
SHInvokePrinterCommandW
RealShellExecuteExW
ShellExec_RunDLLW
SHParseDisplayName
SHLoadInProc
StrRChrW
SHGetDataFromIDListW
SHGetFolderLocation
DllGetVersion
SHGetUnreadMailCountW
SHGetFileInfoW
DragQueryPoint
FindExecutableA
ShellExecuteW
SHHelpShortcuts_RunDLLW
SHQueryRecycleBinA
SHCreateLocalServerRunDll
StrCmpNW
SHSetLocalizedName
ShellAboutW
ShellExec_RunDLL
SheGetDirA
SHIsFileAvailableOffline
StrNCmpIW
SHBrowseForFolderA
DllUnregisterServer
SHEmptyRecycleBinA
Control_RunDLLW
SHGetFolderPathA
StrChrIW
StrStrIA
StrStrA
DllCanUnloadNow
DragAcceptFiles
SHGetPathFromIDListA
Options_RunDLLW
ShellExecuteExA
ExtractAssociatedIconExW
ExtractIconW
ShellExecuteExW
PrintersGetCommand_RunDLLA
SHGetFileInfo
StrRChrA
SHPathPrepareForWriteA
StrRStrW
SHOpenFolderAndSelectItems
CheckEscapesW
SHGetIconOverlayIndexA
SHFileOperationA
SHEnableServiceObject
OpenAs_RunDLL
SHSetUnreadMailCountW
SHFileOperation
FindExecutableW
DoEnvironmentSubstA
SHGetMalloc
SHGetPathFromIDList
SHGetPathFromIDListW

advapi32

CryptSetKeyParam
RegSaveKeyExA
AreAllAccessesGranted
CredUnmarshalCredentialW
BuildTrusteeWithSidW
LsaQuerySecret
EqualDomainSid
TreeResetNamedSecurityInfoA
LsaDeleteTrustedDomain
CreateProcessAsUserA
CryptGetKeyParam
LsaFreeMemory
AddAccessAllowedAceEx
GetTrusteeFormW
CryptHashData
LsaQueryInfoTrustedDomain
EnumServiceGroupW
GetAuditedPermissionsFromAclW
ElfOpenEventLogW
MakeSelfRelativeSD
RegGetKeySecurity
CredEnumerateW
ElfReportEventW
GetSecurityDescriptorSacl
MSChapSrvChangePassword2
LsaGetSystemAccessAccount
OpenEncryptedFileRawA
InitiateSystemShutdownW
GetSecurityInfoExW
FreeSid
RegDeleteKeyA
SetFileSecurityA
CreateWellKnownSid
RegisterIdleTask
CloseTrace
GetSecurityDescriptorRMControl
EncryptionDisable
MakeAbsoluteSD
SetEntriesInAccessListA
QueryServiceLockStatusA
AddAuditAccessObjectAce
ConvertStringSidToSidW
CredGetTargetInfoW
RegisterEventSourceW
WmiSetSingleItemW
LsaCreateAccount
GetTraceEnableLevel
AccessCheckByTypeResultListAndAuditAlarmByHandleA
CopySid
LsaLookupPrivilegeName
IsValidSid
ControlTraceA
ControlService
CryptSetProviderExA
CreateProcessWithLogonW
LsaICLookupSids
SaferRecordEventLogEntry
SetNamedSecurityInfoA
RegReplaceKeyA
RegisterServiceCtrlHandlerExW
GetManagedApplicationCategories
CredRenameA
SetEntriesInAclA
GetServiceDisplayNameA
CreatePrivateObjectSecurityEx
CredGetTargetInfoA
FindFirstFreeAce
OpenServiceW
GetPrivateObjectSecurity
GetAclInformation
UnregisterTraceGuids
MD5Init
CryptDuplicateKey
AccessCheckByType
LsaEnumerateAccountRights
IsValidSecurityDescriptor
CredReadDomainCredentialsW
LookupAccountSidW
AdjustTokenPrivileges
GetTrusteeNameW
CryptGetDefaultProviderA
QueryUsersOnEncryptedFile
CryptSetProviderA
LsaLookupNames
UpdateTraceW
BuildSecurityDescriptorW
WmiQueryAllDataMultipleA
ProcessIdleTasks

gdi32

SetPolyFillMode
SelectBrushLocal
GetOutlineTextMetricsA
SetICMMode
GdiGetBatchLimit
EndPage
SelectPalette
SetStretchBltMode
FontIsLinked
GdiValidateHandle
StrokePath
GetMetaFileW
CreateDIBitmap
SetDIBColorTable
SetMetaFileBitsEx
GdiDllInitialize
CreateICA
SetRectRgn
bInitSystemAndFontsDirectoriesW
Chord
STROBJ_bGetAdvanceWidths
CopyMetaFileW
GetFontData
GetGraphicsMode
CreateColorSpaceW
CreateCompatibleDC
EngDeleteSurface
CreateFontIndirectExW
bMakePathNameW
GetBrushAttributes
ResizePalette
GdiResetDCEMF
GetMetaFileA
GetObjectW
CloseFigure
PolyTextOutW
HT_Get8BPPFormatPalette
ScaleViewportExtEx
GetBitmapAttributes
CreateRectRgnIndirect
GdiIsMetaPrintDC
ClearBitmapAttributes
GetEUDCTimeStamp
GetDIBits
DeleteEnhMetaFile
SetPixelFormat
GdiEndPageEMF
GdiPlayScript
GdiGradientFill
SetLayout
InvertRgn
GdiDeleteSpoolFileHandle
CreatePolygonRgn
CreateHalftonePalette
SetTextAlign
MoveToEx
STROBJ_vEnumStart
GdiConvertDC
GetTextExtentPointA
GetTextMetricsA
EnumEnhMetaFile
CreateDCA
GdiGetLocalDC
GetStringBitmapW
Escape
GetNearestPaletteIndex
ModifyWorldTransform
PolylineTo
ExtCreateRegion
PlayEnhMetaFileRecord
GetTextFaceA
GetTextCharset
GetBoundsRect
EnumFontFamiliesW
AnyLinkedFonts

comctl32

DrawStatusTextW
FlatSB_GetScrollPos
PropertySheet
ImageList_SetOverlayImage
MenuHelp
ImageList_GetImageCount
ImageList_Merge
ImageList_DrawIndirect
ImageList_DragMove
ShowHideMenuCtl
DllGetVersion
ImageList_GetBkColor
DrawStatusText
ImageList_SetImageCount
ImageList_AddIcon
ImageList_Destroy
ImageList_EndDrag
FlatSB_SetScrollProp
ImageList_DragLeave
FlatSB_EnableScrollBar
DrawStatusTextA
FlatSB_GetScrollInfo
ImageList_GetIcon
ImageList_GetImageInfo
FlatSB_GetScrollProp
UninitializeFlatSB
ImageList_DragShowNolock
PropertySheetW
ImageList_Read
ImageList_AddMasked
GetMUILanguage
ImageList_LoadImageA
ImageList_SetBkColor
CreateUpDownControl
DestroyPropertySheetPage
GetEffectiveClientRect
CreatePropertySheetPage
CreatePropertySheetPageA
FlatSB_SetScrollRange
CreateToolbarEx
ImageList_BeginDrag
ImageList_GetIconSize
InitCommonControlsEx
ImageList_Add
ImageList_Write
LBItemFromPt
FlatSB_SetScrollPos
CreateStatusWindow
CreateMappedBitmap
ImageList_DrawEx
CreateToolbar
ImageList_LoadImageW
ImageList_DragEnter
ImageList_SetIconSize

Exports

Exports

��F�d�:^?:�H��kI*w]*��<��ly��bQjBz�R��`+h��Az��f닢��87�:��9Vqe��m��Ӎ�b�`S�z7[�S�g\i�I�(8�ǜ� ��\Ġ�Ѹ<R\ Z;��E�TL*��O:��C;�PטqL7�!1��R��e�d�� F�ִ�y��&�-{�4j&4�tV7��6�m�!@�]Yx"�"�9��N��SU=��X@@VW��[@��8�~/��ڎQfłP9Il��0�-�Հ��ә�d ��p��p:p��yڦ: V%d��dYE��+1w �6^pT��i�z7ʝp ��g�[a�q��L��t��k$6�L�eq�-u��<��]��WZ'��Yk�8��|�nT��G��Lo��gh��)vm|�ѥ}@�k��@H��@ο��{~u�g-b�F��p��1*�c�b,��z��/� 1#�Lc�&�D7*VK�+k��u�8�=|%�a/�DN��%��(��%�n2�׬x7��\l!��F�k�O�\LX�5�B�Y��tr6�_Nh��>��ꎥ ��/A��T�� %@Ei\��V��y��s��;<be��ܪ|d�I%��K��9��jfđg]��%*1��#�P�Ht�+~?S�2��V��N��?d��VĄ��5��>^�[תǵ��ch _~�� sG��6^��O7��׉�b�|�`�у��X�wi*Q�vq��2)=�<�iٿ��B�qCλ�~tE��R��/Yy=��`dǛ��]��&U��@�i�o��`PNU��fȶ��d��|(HKbi��e�V�2]�� ,a]vQd7�%؄�F{��+�W�yޚGM2��фU(��I��y�<�aRR��S�G��?Nh�6k��? �h�2��N��c�7<z��l�UW�RuX�L�.�D�Z��:��ך`VS��<ړ�e�I�b);�)�]if�я,�ܾ��TkK,� ��$��[��o�V4nR�� E�Te��-��3΅��M��b�yD�d(:�L/N�{�Q��2n�@V��1�<k��G�~�/�`R>S��viX`8��In��%^�oe��x��L<g��r𗩛H��R��<C#�#l�w�9md�_n�iō��ۑV%��Z]��>�MDi�w��(��.C!B])a�|zVU�DG��2ZK�R��wܚJ��s� ��{N`�NFl0|�_U2��զ59��Uy��vD��Z�ԩ�l>F�v�;�[[ls�x�7��C�`�c-�Pը}�#J��}�Ȕ�YM��`IL��J �w�%�*�z�F}� ��H��%�a0�#��K="7n&VY��Pp�U*M�j�"�6\F�f��Z�Sq�@� 6ؠ�!�� S��i��V�fE�v��.ā��*��m�~oV��9I�qե� �� CUV�s��dc웄^��6c\�=��?[y�O�� JFۈL�=^�d��޼J��&��9��q+>L4��. �ņ�7$��x�N#Z�s��V�y�tq3d��_�Y3�g��LY�I�ɰ`�gٮ�y��8�ܼB)�ôu�oKȆ(��2��Ax0��J�.Hh1qM�l�Ygq8��D��Q��-��gT��}!��ӏ*76zo��4�k��x� �%��h�l��C�O僴FS��o� ��w�� 3��N��LT��.��/6cVO��,�_��P��'��&4��c��H�= ��,�7�W�^Rʿ{vDn�G�9\T�P[;��T�b�3�6+`�9��G��nR]��`Ϩ�$�흫��і�;��'� ��ד� ��ur��/��<�%R�P�)g�=�# �j9�R|F��ّ�Kl-'�r��x�:�1ck��i��a��5�H�9u'q��ȇ\-��.qp��C��/��y8�⇉:$��9��˿=�JkS�h�"�p� ��N�RB��5y�GU�ꠢ8GR>��>i��{�|å��Z�M�$��:�]�W�E��h㥅IW�=��@`(��RbC�j�Q, ��Bc�t��2z��U��ih i1_��'�,�4�Ӄ��,A5Nb��^_��fP�K�FQ�ʐ�/�Mptc�NR`�C��p� �VT��~jWȒ��_�� \�?�<H��2:��ۻ��,�;-^-N� Y-�.�{3+�$~�~�@��t�0}�,�}[a�n��_��e%��D��#*��a��O�ë%Ϊw <$�b�7��~P5qq!�`��l�$�9�xC{�dǹ%�>�P:Aw&��NHZ��-��J�� ^(�Y��_��X��in��3�}@�㜇�d>�� -��K[Ӂ�ϙ]��uct��ۇY0�@��Jl�&�b�.��Y��i��\L�$en@��*UA��y�31��^���f{M��5ÊT��.`�H�r�e��8��?��0��> V ݘ��!s~��V9o��H��X��U�D��I�ZrP8�5�O1�~wغf��N[֎gq0�>�1i��ݸ�@�Rމ�^��:��3��Й>�~�e�� B�NP��z��x`Ր�B�W�a�(�p��@�ǌ��2]�C�^��UJ��&L�;�W1�CԆS��kɪhA�@FI�_��H��<I��U�G�\�e1(1��$%E_w��]��ic��0T/��v�a��o��ì�V�Ũ�iΚ�-�d��q�Tl��m+��0 ��ڶ2�h|;E(��>��ʰ��Ҭs�ez$�&�9CzgU�B��'^�r<��t��~6�&��GW=�y^֫�;1Q��$�g�⇅W�.�n��o�gh�^�l*)u��}�Ȥ��V�,�5*��;K��䖁SD��l��P^U�YءZ�)1��;��򃡅�J��΄M�

Sections

CODE
Size: 450KB - Virtual size: 452KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 9KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 81KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5e0ddfa18df917de9ccf774b2b649637

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

49:cf:f2:29:0b:ab:f3:51:00:9a:74:69:3e:4c:90:4eCertificate

Extended Key Usages

Key Usages

f1:48:34:00:f0:ea:ed:27:db:29:a4:55:fb:b4:93:64:f7:3a:9c:7cSigner

Signature Validations

Verification

24-11-2022 14:54 Valid: false

Headers

File Characteristics

Imports

user32

kernel32

ole32

comdlg32

oleaut32

shell32

advapi32

gdi32

comctl32

Exports

Exports

Sections

CODE Size: 450KB - Virtual size: 452KB

DATA Size: 9KB - Virtual size: 16KB

.idata Size: 23KB - Virtual size: 24KB

.text Size: 17KB - Virtual size: 20KB

.tls Size: 512B - Virtual size: 4KB

.text Size: 81KB - Virtual size: 84KB

.reloc Size: 9KB - Virtual size: 12KB

.rsrc Size: 53KB - Virtual size: 53KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

49:cf:f2:29:0b:ab:f3:51:00:9a:74:69:3e:4c:90:4e
Certificate

f1:48:34:00:f0:ea:ed:27:db:29:a4:55:fb:b4:93:64:f7:3a:9c:7c
Signer

24-11-2022 14:54
Valid: false

CODE
Size: 450KB - Virtual size: 452KB

DATA
Size: 9KB - Virtual size: 16KB

.idata
Size: 23KB - Virtual size: 24KB

.text
Size: 17KB - Virtual size: 20KB

.tls
Size: 512B - Virtual size: 4KB

.text
Size: 81KB - Virtual size: 84KB

.reloc
Size: 9KB - Virtual size: 12KB

.rsrc
Size: 53KB - Virtual size: 53KB