General

Malware Config

Signatures

Files

• eaf91b130ecc190fb646cfdd8bc19bbf6ddcfc0eaca8c0d91861885afd33633c

  .exe windows x86

  2b1779d389634c2301f2833c85f5e847

  
  

  Code Sign

  4a:42:97:6b:0f:1d:72:97:45:39:80:f6:00:45:70:32

  Certificate

  Issuer

  CN=4mb5gWTlIemu0h0

  Not Before

  09-04-2012 04:33

  Not After

  31-12-2039 23:59

  Subject

  CN=4mb5gWTlIemu0h0

  Extended Key Usages

  ExtKeyUsageCodeSigning

  f6:eb:8e:4e:b2:8c:71:0c:47:45:5f:3b:e9:f2:5d:1e:ee:d8:64:50

  Signer

  Actual PE Digest

  f6:eb:8e:4e:b2:8c:71:0c:47:45:5f:3b:e9:f2:5d:1e:ee:d8:64:50

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=4mb5gWTlIemu0h0

  01-12-2022 14:34

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteTapemark

  UnregisterWait

  CreateDirectoryExW

  DeleteCriticalSection

  GetVersionExW

  GlobalCompact

  AddConsoleAliasW

  FindFirstVolumeW

  FindFirstVolumeMountPointW

  WriteFileGather

  FindFirstVolumeA

  HeapUnlock

  lstrcmpiW

  CreateFileA

  SystemTimeToTzSpecificLocalTime

  GetTempPathA

  Process32FirstW

  GetConsoleTitleA

  EndUpdateResourceA

  OpenThread

  EnumCalendarInfoW

  SetConsoleTextAttribute

  GetFileAttributesExW

  ReadConsoleA

  GetMailslotInfo

  SetConsoleDisplayMode

  ConnectNamedPipe

  EnumResourceNamesW

  SetCommState

  GetProfileSectionA

  QueueUserAPC

  GetFullPathNameW

  HeapSize

  VirtualAllocEx

  DeleteFileA

  OpenEventA

  GetConsoleAliasExesLengthW

  UnlockFile

  GetCPInfoExW

  _llseek

  UnmapViewOfFile

  Thread32Next

  OpenFileMappingW

  DnsHostnameToComputerNameA

  GetSystemDefaultUILanguage

  FindNextVolumeMountPointW

  GetProcessPriorityBoost

  LCMapStringW

  GetLogicalDriveStringsW

  ReleaseSemaphore

  GetNumberOfConsoleMouseButtons

  GetSystemInfo

  SetThreadIdealProcessor

  GetStringTypeA

  VirtualAlloc

  SetFileAttributesW

  BeginUpdateResourceA

  CreateRemoteThread

  TlsGetValue

  GetLocaleInfoW

  DosDateTimeToFileTime

  FatalAppExitW

  GetCurrencyFormatW

  SetEnvironmentVariableA

  CopyFileExA

  SetSystemTime

  GetUserDefaultUILanguage

  WriteProfileSectionA

  GetEnvironmentStrings

  TryEnterCriticalSection

  FindNextVolumeA

  GetDateFormatA

  SetProcessPriorityBoost

  Heap32ListNext

  GetBinaryType

  GetTempFileNameW

  FillConsoleOutputCharacterA

  EnumResourceTypesA

  RequestWakeupLatency

  LockResource

  HeapLock

  CreateHardLinkA

  MapViewOfFileEx

  BackupSeek

  CreateConsoleScreenBuffer

  SetProcessWorkingSetSize

  GetProfileSectionW

  GlobalAddAtomA

  SetConsoleOutputCP

  LoadLibraryExW

  GlobalLock

  ResetWriteWatch

  GetCommConfig

  GlobalAddAtomW

  GetWindowsDirectoryA

  WritePrivateProfileSectionA

  AllocateUserPhysicalPages

  GetCurrentProcess

  IsBadReadPtr

  LocalFileTimeToFileTime

  GetDiskFreeSpaceA

  PeekConsoleInputW

  IsDBCSLeadByte

  ResetEvent

  DeleteTimerQueueEx

  GetSystemDefaultLCID

  CreateIoCompletionPort

  lstrcpyA

  InterlockedIncrement

  DefineDosDeviceA

  CancelWaitableTimer

  GetConsoleDisplayMode

  GetPrivateProfileSectionA

  VirtualFreeEx

  SetFileAttributesA

  CancelDeviceWakeupRequest

  VirtualProtectEx

  FindNextChangeNotification

  EnumResourceLanguagesA

  HeapCompact

  DeviceIoControl

  CreateJobObjectW

  SearchPathW

  lstrcmpA

  LocalFlags

  CreateMutexA

  WriteConsoleOutputW

  _lread

  GetDriveTypeA

  GetVersion

  SetEnvironmentVariableW

  GetThreadSelectorEntry

  InterlockedExchangeAdd

  LoadModule

  ReadProcessMemory

  WritePrivateProfileSectionW

  GetStdHandle

  FindFirstFileExA

  FindFirstFileA

  SetFileApisToANSI

  LocalAlloc

  VirtualLock

  SetComputerNameExW

  WritePrivateProfileStructA

  SetSystemTimeAdjustment

  lstrcpyW

  GetFileSize

  SetThreadLocale

  ReadConsoleOutputA

  GetVolumeInformationA

  GlobalReAlloc

  SetStdHandle

  GetCommState

  EnumLanguageGroupLocalesW

  SetSystemPowerState

  IsDebuggerPresent

  GlobalMemoryStatusEx

  ReleaseMutex

  GetProcessVersion

  lstrcpynA

  GetComputerNameW

  SetConsoleTitleW

  OpenSemaphoreA

  Heap32First

  OpenWaitableTimerW

  GetCommProperties

  GetThreadTimes

  GetLastError

  SetVolumeMountPointA

  GetProcAddress

  _lopen

  FlushFileBuffers

  DeleteTimerQueueTimer

  LocalCompact

  MoveFileWithProgressA

  ProcessIdToSessionId

  Process32Next

  EnumSystemLanguageGroupsW

  GetConsoleAliasesLengthA

  MoveFileExW

  GetProfileIntW

  WriteFile

  FindAtomW

  GetCompressedFileSizeA

  GetPrivateProfileSectionNamesA

  OpenEventW

  GetCompressedFileSizeW

  CreateMailslotW

  SetComputerNameW

  GlobalAlloc

  GetConsoleAliasW

  CreateEventA

  IsBadHugeReadPtr

  Beep

  ReadConsoleW

  GetFileAttributesW

  GetPriorityClass

  FindNextVolumeW

  PeekNamedPipe

  ReadFile

  GetVolumePathNameA

  lstrlenW

  FlushConsoleInputBuffer

  AddAtomA

  LockFile

  EnumLanguageGroupLocalesA

  GlobalMemoryStatus

  GetSystemDirectoryW

  SetHandleCount

  GetDefaultCommConfigW

  HeapWalk

  CreateSemaphoreA

  UnregisterWaitEx

  InitializeCriticalSectionAndSpinCount

  GetProcessTimes

  WriteProfileSectionW

  FormatMessageW

  MulDiv

  ReadConsoleInputW

  GetLocalTime

  GetCurrentProcessId

  RtlFillMemory

  SetConsoleCursor

  FindAtomA

  IsValidLocale

  CreateProcessA

  GetTimeZoneInformation

  SwitchToFiber

  IsBadStringPtrA

  GetComputerNameA

  WriteConsoleOutputCharacterA

  Module32NextW

  OpenMutexA

  GetAtomNameW

  Toolhelp32ReadProcessMemory

  CopyFileW

  GetExitCodeProcess

  GetStartupInfoA

  CreateNamedPipeA

  _lclose

  PurgeComm

  LoadLibraryW

  ReplaceFile

  BuildCommDCBW

  InterlockedCompareExchange

  GetFileSizeEx

  WriteFileEx

  CreateFileW

  GetCommModemStatus

  SetCommBreak

  EnterCriticalSection

  CreateJobObjectA

  ExitThread

  SetVolumeLabelA

  EnumResourceNamesA

  OpenSemaphoreW

  CreateProcessW

  LoadLibraryA

  lstrcatA

  FileTimeToDosDateTime

  user32

  InternalGetWindowText

  ReplyMessage

  SetScrollRange

  MapVirtualKeyW

  CreateDesktopW

  FindWindowW

  CopyAcceleratorTableW

  SendNotifyMessageA

  GetMenuState

  GetMenuContextHelpId

  GetWindowTextLengthW

  SendMessageCallbackA

  ModifyMenuA

  OemToCharBuffA

  DdeGetData

  SetDlgItemTextA

  GetDlgCtrlID

  GetTabbedTextExtentA

  TrackPopupMenuEx

  DefDlgProcA

  MsgWaitForMultipleObjectsEx

  ValidateRect

  GetWindowContextHelpId

  DestroyCaret

  DdeQueryStringA

  EnableMenuItem

  BeginPaint

  DefMDIChildProcW

  GetWindowTextA

  UnregisterClassW

  LoadStringW

  GetWindowLongW

  CharPrevA

  GetClipboardFormatNameA

  wsprintfW

  CascadeWindows

  WinHelpW

  WaitMessage

  RegisterClipboardFormatW

  SetScrollInfo

  RealGetWindowClassW

  IsDialogMessageW

  LoadBitmapW

  SetWindowsHookA

  ChangeDisplaySettingsExW

  EndPaint

  ExcludeUpdateRgn

  CharPrevW

  WINNLSGetEnableStatus

  DdeFreeStringHandle

  CountClipboardFormats

  GetKeyState

  GetMenuItemID

  IMPQueryIMEW

  EnumThreadWindows

  SetSystemCursor

  ToUnicode

  GetMenuItemInfoW

  IsWindowEnabled

  keybd_event

  LookupIconIdFromDirectoryEx

  GetUserObjectInformationA

  ClipCursor

  EditWndProc

  GetScrollPos

  ImpersonateDdeClientWindow

  MapDialogRect

  GetKeyNameTextW

  GetMenuStringW

  GetWindowPlacement

  SetUserObjectInformationW

  DefDlgProcW

  GetProcessDefaultLayout

  GetUpdateRect

  GetMessagePos

  UpdateLayeredWindow

  GetKBCodePage

  DdeImpersonateClient

  ChangeDisplaySettingsExA

  RegisterDeviceNotificationW

  RemovePropW

  UnregisterClassA

  ChangeMenuA

  EnumDisplayDevicesA

  AllowSetForegroundWindow

  SwitchDesktop

  PostThreadMessageA

  EnumClipboardFormats

  OpenWindowStationW

  SetClipboardData

  SendMessageW

  EnumPropsA

  CharUpperW

  EnumDesktopsW

  DlgDirListComboBoxA

  IsHungAppWindow

  BroadcastSystemMessageA

  GetOpenClipboardWindow

  LoadIconA

  SetDebugErrorLevel

  DeferWindowPos

  SetDoubleClickTime

  GetDCEx

  CreateIconIndirect

  ScrollWindow

  DrawEdge

  AdjustWindowRect

  MapVirtualKeyExA

  GetMenuItemRect

  WINNLSGetIMEHotkey

  EnumWindowStationsW

  GetWindowRect

  DdeCreateStringHandleA

  DdeEnableCallback

  LookupIconIdFromDirectory

  PaintDesktop

  CloseWindow

  DdeConnectList

  EnumWindowStationsA

  OemToCharW

  InsertMenuW

  CheckMenuItem

  HiliteMenuItem

  CopyImage

  DestroyWindow

  CallWindowProcW

  DdeAccessData

  GetWindowModuleFileNameA

  IsZoomed

  WaitForInputIdle

  InSendMessageEx

  LoadKeyboardLayoutW

  OemToCharBuffW

  GetClassLongW

  DestroyIcon

  InvalidateRect

  SystemParametersInfoA

  GetSystemMenu

  DdeAbandonTransaction

  GetCaretBlinkTime

  InvertRect

  DdeNameService

  GetShellWindow

  SetCursorPos

  RegisterShellHookWindow

  GetWindow

  DdeAddData

  WINNLSEnableIME

  InvalidateRgn

  CreateIconFromResource

  GetIconInfo

  IsCharLowerW

  OpenWindowStationA

  DdeCreateStringHandleW

  GetUserObjectInformationW

  GetUserObjectSecurity

  SetParent

  GetMenuItemCount

  IsCharAlphaNumericW

  AppendMenuA

  SetMenuItemInfoA

  InsertMenuItemA

  IMPGetIMEW

  CharNextW

  SetClassWord

  FrameRect

  DestroyMenu

  GetClassInfoExA

  IsCharLowerA

  GetMenuBarInfo

  IsCharUpperA

  OpenInputDesktop

  IsCharAlphaA

  CloseWindowStation

  DrawTextExA

  SetClipboardViewer

  SetDlgItemInt

  DdeQueryConvInfo

  ChildWindowFromPointEx

  PostThreadMessageW

  TabbedTextOutA

  ClientToScreen

  SetWindowLongW

  RemovePropA

  IMPSetIMEA

  DefMDIChildProcA

  MapVirtualKeyA

  GetCursorInfo

  DdeDisconnect

  GetLastActivePopup

  SetCapture

  GetAltTabInfoW

  TileChildWindows

  GetKeyNameTextA

  CheckRadioButton

  GetDlgItem

  CascadeChildWindows

  VkKeyScanExW

  FreeDDElParam

  UnpackDDElParam

  CharLowerA

  GetClassNameA

  EnumPropsExA

  SetDlgItemTextW

  RegisterClassA

  GetSubMenu

  GetSystemMetrics

  SetThreadDesktop

  GetWindowTextW

  FlashWindow

  LoadAcceleratorsA

  DdeSetUserHandle

  DlgDirSelectComboBoxExA

  OffsetRect

  InSendMessage

  ChangeDisplaySettingsW

  CharLowerBuffA

  EnumDisplaySettingsA

  GetDlgItemTextA

  GetGuiResources

  EnumDisplaySettingsExA

  GetNextDlgTabItem

  SetFocus

  GetInputDesktop

  GetTabbedTextExtentW

  SetDeskWallpaper

  CreateAcceleratorTableW

  GetClipCursor

  MenuItemFromPoint

  GetForegroundWindow

  PeekMessageW

  UpdateWindow

  EnumPropsExW

  LoadKeyboardLayoutA

  SetClassLongW

  SendMessageCallbackW

  CallMsgFilter

  GetClassInfoA

  GetWindowModuleFileName

  SendIMEMessageExA

  GetAsyncKeyState

  WindowFromDC

  OemToCharA

  CallMsgFilterA

  GetDlgItemTextW

  GetTitleBarInfo

  msvcrt

  memcpy

  shlwapi

  StrFormatKBSizeW

  PathFileExistsW

  StrRChrA

  SHRegSetUSValueW

  StrCatBuffA

  SHRegEnumUSValueA

  wnsprintfW

  SHStrDupA

  PathIsNetworkPathA

  PathUnExpandEnvStringsW

  StrIsIntlEqualW

  UrlIsOpaqueW

  UrlGetLocationW

  PathGetArgsA

  SHRegCreateUSKeyA

  PathIsRelativeW

  AssocQueryStringByKeyW

  SHRegCreateUSKeyW

  UrlCompareW

  SHRegGetPathW

  SHEnumValueW

  SHSetValueA

  StrDupW

  UrlGetLocationA

  ChrCmpIA

  SHRegGetBoolUSValueW

  StrFromTimeIntervalA

  SHCreateStreamOnFileA

  PathMakeSystemFolderW

  wvnsprintfA

  PathCanonicalizeW

  SHRegCloseUSKey

  StrRetToStrW

  PathUnExpandEnvStringsA

  PathParseIconLocationW

  PathStripToRootW

  PathAddExtensionW

  StrStrIW

  PathIsDirectoryEmptyW

  SHRegSetPathW

  PathStripPathA

  StrCpyNW

  StrCmpNA

  StrCmpIW

  SHOpenRegStreamA

  PathRelativePathToA

  UrlApplySchemeW

  wvnsprintfW

  UrlHashW

  HashData

  PathFindFileNameA

  PathSkipRootA

  PathSetDlgItemPathA

  PathRemoveBlanksW

  SHRegGetUSValueA

  PathFindExtensionW

  PathCommonPrefixA

  StrRetToBufW

  StrCSpnA

  SHAutoComplete

  PathRenameExtensionW

  StrStrA

  StrRChrIA

  UrlUnescapeW

  ord16

  SHRegDuplicateHKey

  SHRegDeleteEmptyUSKeyA

  PathSetDlgItemPathW

  StrToIntW

  PathBuildRootW

  PathSearchAndQualifyA

  SHRegEnumUSKeyW

  UrlIsNoHistoryW

  StrStrIA

  PathFileExistsA

  PathMakeSystemFolderA

  SHRegEnumUSValueW

  SHRegDeleteUSValueW

  PathRenameExtensionA

  PathIsUNCServerW

  SHOpenRegStreamW

  StrCmpNIW

  PathFindOnPathA

  SHRegQueryInfoUSKeyW

  PathFindNextComponentA

  UrlCreateFromPathW

  PathBuildRootA

  AssocQueryStringA

  PathStripPathW

  UrlGetPartA

  SHSetValueW

  PathCompactPathA

  SHEnumKeyExA

  StrRChrIW

  PathRemoveExtensionA

  StrChrA

  StrCatBuffW

  PathCompactPathExW

  PathAddBackslashW

  SHRegEnumUSKeyA

  PathSkipRootW

  SHCopyKeyW

  PathCompactPathExA

  PathRemoveBackslashW

  StrRChrW

  PathUndecorateW

  StrRStrIW

  StrFormatKBSizeA

  SHEnumValueA

  PathUnquoteSpacesA

  PathCommonPrefixW

  StrTrimA

  StrToIntExA

  SHGetThreadRef

  UrlUnescapeA

  SHRegQueryUSValueA

  SHGetInverseCMAP

  StrCatW

  StrPBrkW

  PathFindOnPathW

  StrRetToBufA

  ChrCmpIW

  IntlStrEqWorkerA

  UrlCompareA

  StrPBrkA

  PathMakePrettyA

  StrCmpW

  SHRegDeleteUSValueA

  PathIsContentTypeA

  SHDeleteKeyW

  PathIsDirectoryA

  SHRegGetBoolUSValueA

  StrCmpNIA

  PathIsUNCA

  StrRetToStrA

  PathIsFileSpecW

  SHQueryValueExA

  PathUnmakeSystemFolderW

  PathIsPrefixW

  SHRegQueryUSValueW

  PathRemoveBlanksA

  SHRegQueryInfoUSKeyA

  ColorHLSToRGB

  SHGetValueA

  PathRemoveFileSpecW

  PathIsPrefixA

  PathAppendA

  PathAddExtensionA

  PathFindSuffixArrayW

  PathUndecorateA

  wnsprintfA

  PathFindExtensionA

  SHRegDeleteEmptyUSKeyW

  PathCombineW

  SHRegWriteUSValueA

  PathParseIconLocationA

  PathRemoveArgsW

  PathIsSameRootW

  StrSpnW

  GetMenuPosFromID

  PathIsSameRootA

  SHRegSetUSValueA

  SHRegOpenUSKeyA

  StrCSpnW

  AssocQueryKeyA

  AssocCreate

  SHSkipJunction

  StrToIntExW

  AssocQueryStringByKeyA

  StrFormatByteSize64A

  SHOpenRegStream2W

  SHEnumKeyExW

  PathIsRootW

  PathIsUNCServerShareW

  PathUnmakeSystemFolderA

  PathIsFileSpecA

  PathIsContentTypeW

  StrFormatByteSizeW

  PathMatchSpecA

  PathQuoteSpacesA

  PathMatchSpecW

  SHCreateShellPalette

  UrlCombineW

  StrCSpnIW

  SHDeleteEmptyKeyW

  StrDupA

  PathFindSuffixArrayA

  Sections

  .text

  Size: 267KB - Virtual size: 266KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 19KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ