Voicemod_2[.]38[.]0[.]rar

Resubmissions

17/12/2022, 23:21

221217-3b8tfsch61 3

17/12/2022, 23:12

221217-26xt1aaa34 3

Sharing

Copy URL Twitter E-mail

General

Target

Voicemod_2.38.0.rar
Size

25.1MB
MD5

b546f4be44354e32d219de5697e2f1bd
SHA1

4a093be65e1a682c55c202ccdc8e54651d25f5e9
SHA256

da7b8473143e2a009159932f9cd33dbfc8a5836c8c5766ce5a892c924cd8d730
SHA512

87f073ca0e80dbbe24624823ea49888ac7b5773c2b3a862316fd00d30570765fcf19fde418958be48b819bd45aab06abf3ee4b73bd8b109509689b6b161bbba1
SSDEEP

393216:ZQ1CCJEi3ZWZemfo/QCy3sux+3GKdr0ICIPVMDzYC91mT4c+aZJ3RxPx60Dfm+8W:ZQ1hJEi3ae01CiQGKh0IaBzYzPx6OR

Score

N/A

Malware Config

Signatures

Files

Voicemod_2.38.0.rar
.rar
Voicemod_2.38.0/Accessible.tlb
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/Windows.Data.TimeZones.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.ar-SA.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.bg-BG.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.cs-CZ.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.da-DK.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.de-DE.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.el-GR.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.en-GB.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.en-US.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.es-ES.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.et-EE.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.fi-FI.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.fr-FR.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.he-IL.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.hr-HR.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.hu-HU.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.it-IT.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.ja-JP.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.ko-KR.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.lt-LT.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.lv-LV.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.nb-NO.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.nl-NL.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.pl-PL.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.pt-BR.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.pt-PT.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.ro-RO.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.ru-RU.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.sk-SK.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.sl-SI.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.sr-Latn-RS.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.sv-SE.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.th-TH.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.tr-TR.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.uk-UA.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.zh-CN.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.zh-HK.pri
Voicemod_2.38.0/Additional Files/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.zh-TW.pri
Voicemod_2.38.0/Data/Language.pimx
Voicemod_2.38.0/Data/Main.ini
Voicemod_2.38.0/Data/Packaged/Main.ini
.xml
Voicemod_2.38.0/Data/Packaged/Resource.dll
.zip

Password: 2022
placeholder.txt
Voicemod_2.38.0/Data/Packaged/Utils.dll
.xml
Voicemod_2.38.0/Debug/DebugPPF.tmp
Voicemod_2.38.0/Debug/DebugPPT.tmp
Voicemod_2.38.0/Debug/Management.log
Voicemod_2.38.0/bin/AdskNLM.exe
.exe windows x64

Password: 2022

d3bbfd624fcfeb095c7bf0242b723cee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

ord17

shell32

ShellExecuteW
SHBrowseForFolderW
ShellExecuteExW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderPathW
SHGetMalloc

gdi32

CreateCompatibleDC
CreateFontIndirectW
DeleteObject
DeleteDC
GetCurrentObject
StretchBlt
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
GetObjectW

advapi32

FreeSid
AllocateAndInitializeSid
CheckTokenMembership

user32

EnableMenuItem
IsWindow
EnableWindow
MessageBeep
LoadIconW
LoadImageW
SetWindowsHookExW
PtInRect
CallNextHookEx
DefWindowProcW
CallWindowProcW
DrawIconEx
DialogBoxIndirectParamW
GetWindow
ClientToScreen
GetDC
DrawTextW
SystemParametersInfoW
GetSystemMetrics
SetFocus
UnhookWindowsHookEx
GetWindowLongPtrW
SetWindowLongPtrW
GetClientRect
GetDlgItem
GetKeyState
GetSystemMenu
DestroyWindow
GetSysColor
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
wsprintfA
GetClassNameA
GetWindowLongW
GetMenu
GetWindowDC
ReleaseDC
CopyImage
GetParent
ScreenToClient
CreateWindowExW
GetDesktopWindow
GetWindowRect
SetWindowPos
SetTimer
GetMessageW
CreateWindowExA
KillTimer
CharUpperW
SendMessageW
DispatchMessageW
ShowWindow
BringWindowToTop
wsprintfW
MessageBoxW
wvsprintfW
MessageBoxA
EndDialog

ole32

CreateStreamOnHGlobal
CoInitialize
CoCreateInstance

oleaut32

SysFreeString
VariantClear
SysAllocStringLen
OleLoadPicture
SysAllocString

kernel32

GetFileInformationByHandle
WaitForMultipleObjects
VirtualAlloc
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
VirtualFree
SetEndOfFile
SetFileTime
ReadFile
SetFilePointer
GetFileSize
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FormatMessageW
lstrcpyW
LocalFree
IsBadReadPtr
SuspendThread
TerminateThread
GetSystemDirectoryW
GetCurrentThreadId
InitializeCriticalSection
ResetEvent
SetEvent
CreateEventW
GetVersionExW
GetModuleFileNameW
GetCurrentProcess
SetProcessWorkingSetSize
SetEnvironmentVariableW
GetDriveTypeW
CreateFileW
LoadLibraryA
SetThreadLocale
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
CompareFileTime
WideCharToMultiByte
GetTempPathW
GetCurrentDirectoryW
FindFirstFileW
lstrcmpW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
SetCurrentDirectoryW
GetEnvironmentVariableW
lstrcmpiW
GetLocaleInfoW
MultiByteToWideChar
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetSystemDefaultLCID
lstrcmpiA
GlobalAlloc
GlobalFree
MulDiv
FindResourceExA
SizeofResource
LoadResource
LockResource
GetProcAddress
GetModuleHandleW
GetStdHandle
WriteFile
lstrlenA
CreateDirectoryW
GetFileAttributesW
lstrlenW
GetLocalTime
SystemTimeToFileTime
CreateThread
GetExitCodeThread
Sleep
ExitProcess
lstrcatW
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
CloseHandle
WaitForSingleObject
GetExitCodeProcess
GetQueuedCompletionStatus
ResumeThread
SetInformationJobObject
CreateIoCompletionPort
AssignProcessToJobObject
CreateJobObjectW
GetLastError
CreateProcessW
GetStartupInfoW
GetCommandLineW
SetLastError
GetDiskFreeSpaceExW
SetFileAttributesW
GetCurrentProcessId

msvcrt

__CxxFrameHandler
??3@YAXPEAX@Z
memset
_wtol
_purecall
memcmp
??2@YAPEAX_K@Z
_wcsnicmp
memmove
memcpy
strncpy
wcsncpy
wcsncmp
strncmp
?_set_new_handler@@YAP6AH_K@ZP6AH0@Z@Z
_beginthreadex
wcscmp
_CxxThrowException
wcsstr
free
malloc
__C_specific_handler
_unlock
__dllonexit
_lock
_onexit
??1type_info@@UEAA@XZ
__getmainargs
_XcptFilter
_exit
_ismbblead
_cexit
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ

Sections

.text
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Voicemod_2.38.0/bin/libGLESv2.dll
Voicemod_2.38.0/bin/setup_1667379260.805929.exe
.exe windows x86

Password: 2022

739a0db3ffe3242d1c4d5a119cbc06b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
GetLastError
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
CreateFileW
WriteConsoleW
DecodePointer

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 95KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Voicemod_2.38.0/bin/updater.ini
Voicemod_2.38.0/resources/AdobePIM.dll
.dll windows x86

Password: 2022

dd6ba004004c70f4eb3bbd4c9ec97b28

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:9e:86:75:de:ec:b8:47:4c:ba:a5:7d:83:53:a2:3b:25:dc:dd:a5:31:88:42:96:16:ee:64:6e:89:81:6a:d4
Signer

Actual PE Digest

54:9e:86:75:de:ec:b8:47:4c:ba:a5:7d:83:53:a2:3b:25:dc:dd:a5:31:88:42:96:16:ee:64:6e:89:81:6a:d4

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

20/06/2020, 13:52
Valid: true

Chain 1

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord147
ord74
ord145

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
EnumProcessModules

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory

shlwapi

PathIsFileSpecW
PathAddExtensionW
PathRemoveFileSpecA
PathIsDirectoryA
PathIsDirectoryEmptyW
PathIsSystemFolderW
PathIsRootW
PathRenameExtensionW
PathIsDirectoryW
PathAppendW
PathRemoveBackslashW
PathStripPathW
PathAppendA
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsA
PathRemoveExtensionW

shell32

ShellExecuteExW
SHCreateDirectoryExW
SHGetFolderLocation
SHGetSpecialFolderPathW
SHGetKnownFolderPath
SHGetPathFromIDListW
SHGetFolderPathW
ord680
CommandLineToArgvW
ord51
SHCreateItemFromParsingName

winhttp

WinHttpOpen
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetCredentials
WinHttpSendRequest
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetOption

kernel32

TlsFree
TlsSetValue
TlsGetValue
CompareStringW
SwitchToThread
InitializeCriticalSectionAndSpinCount
GetStringTypeW
EncodePointer
TlsAlloc
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetTimeZoneInformation
ExitProcess
GetStdHandle
GetFileType
IsValidLocale
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
GetConsoleCP
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionEx
GetLastError
RaiseException
DecodePointer
DeleteCriticalSection
ReleaseSemaphore
CreateMutexW
WaitForSingleObject
LocalAlloc
ReleaseMutex
Sleep
OpenSemaphoreW
CloseHandle
LocalFree
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
GetTempPathW
MultiByteToWideChar
SetEvent
ResetEvent
GetCommandLineW
CreateProcessW
GetLocalTime
GetTimeFormatW
GetDateFormatW
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
FindFirstFileW
FindNextFileW
TerminateProcess
RemoveDirectoryW
FindClose
SetEnvironmentVariableW
SetFileAttributesW
CreateEventW
GetDiskFreeSpaceExW
CreateThread
CopyFileW
lstrcmpiW
lstrcmpW
GetExitCodeProcess
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LockFileEx
GetFileSize
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetCurrentProcess
GetFileSizeEx
lstrlenW
GetACP
SizeofResource
GetModuleFileNameW
LockResource
LoadResource
FindResourceW
MoveFileExW
GlobalAlloc
GlobalFree
VerSetConditionMask
GetModuleHandleW
VerifyVersionInfoW
SetLastError
DuplicateHandle
ProcessIdToSessionId
TerminateThread
FindResourceExW
lstrcpyW
QueryFullProcessImageNameW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
FileTimeToSystemTime
OpenMutexW
GetUserDefaultLCID
LCMapStringW
GetUserDefaultLangID
GetUserDefaultUILanguage
SetFilePointerEx
ResumeThread
SetStdHandle
WriteConsoleW
QueryPerformanceFrequency
GetVersionExW
CreateFileMappingW

user32

wsprintfW
EnumWindows
GetWindowThreadProcessId
GetShellWindow

advapi32

InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
RegQueryValueExW
FreeSid
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
LookupAccountSidW
CreateWellKnownSid
EqualSid
GetTokenInformation
DuplicateTokenEx
GetUserNameW
ConvertSidToStringSidW
ImpersonateLoggedOnUser
ConvertStringSidToSidW
RevertToSelf
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoInitialize
CoCreateGuid
StringFromGUID2
CLSIDFromProgID
OleRun
CLSIDFromString

oleaut32

SysStringLen
VariantChangeType
VariantInit
SysFreeString
SysAllocString
VariantClear
VariantCopy
GetErrorInfo

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

Exports

Exports

AAMIU_Uninstall
AAMIU_getDeploymentValidationStatus
AAMIU_preInstallPropertySet
pim_createLibraryRef
pim_freeLibraryRef
pim_freeLiraryRef
pim_freeString
pim_getAppletAndPackageInfo
pim_getAppletRegistrationInfo
pim_getAppletRelationshipInfo
pim_getCurrentCCVersion
pim_getCurrentPackagesVersion
pim_getInstallStatus
pim_getInstalledPackagesInfo
pim_launchACCCUninstallerExecutableAsAdmin
pim_selfUpdateCheck
pim_selfUpdateCheckWithData
pim_startWorkflow
pim_startWorkflowWithData
pim_syncFromPathToACF
pim_syncFromPathToPath
pim_syncUSFToACF
pim_uninstallAAMFromAAMCleanerTool
pim_uninstallAAMUsingAAMCleanerTool
pim_uninstallACCC64FromACCCCleanerTool
pim_uninstallACCCFromACCCCleanerTool
pim_uninstallADC64UsingADCCleanerTool
pim_uninstallADCUsingADCCleanerTool

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Voicemod_2.38.0/resources/Config.dat
.dll windows x86

Password: 2022

86ba4f2319a41b225b9705fef1040672

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentThreadId
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
GetStdHandle
GetFileType
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
GetStringTypeW
HeapSize
HeapReAlloc
CreateFileW
WriteConsoleW
DecodePointer

Exports

Exports

GetFile

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Voicemod_2.38.0/resources/Config.xml
.xml
Voicemod_2.38.0/setup.exe
.exe windows x86

Password: 2022

ff7559763260dd4ceb36564febeb3414

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetFolderPathAndSubDirW

kernel32

GetStdHandle
WriteConsoleW
FreeConsole
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
HeapSize
RaiseException
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
SetEndOfFile
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CloseHandle
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
CreateFileW

Sections

.text
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: 2022

Password: 2022

d3bbfd624fcfeb095c7bf0242b723cee

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

shell32

gdi32

advapi32

user32

ole32

oleaut32

kernel32

msvcrt

Sections

.text Size: 125KB - Virtual size: 125KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 3KB - Virtual size: 20KB

.pdata Size: 7KB - Virtual size: 6KB

.rsrc Size: 246KB - Virtual size: 245KB

Password: 2022

739a0db3ffe3242d1c4d5a119cbc06b1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 60KB - Virtual size: 59KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 95KB - Virtual size: 98KB

.rsrc Size: 55KB - Virtual size: 55KB

.reloc Size: 5KB - Virtual size: 4KB

Password: 2022

dd6ba004004c70f4eb3bbd4c9ec97b28

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

54:9e:86:75:de:ec:b8:47:4c:ba:a5:7d:83:53:a2:3b:25:dc:dd:a5:31:88:42:96:16:ee:64:6e:89:81:6a:d4Signer

Signature Validations

Verification

20/06/2020, 13:52 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

msi

version

psapi

wtsapi32

shlwapi

shell32

winhttp

kernel32

user32

advapi32

ole32

oleaut32

crypt32

wintrust

Exports

.text
Size: 125KB - Virtual size: 125KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 3KB - Virtual size: 20KB

.pdata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 246KB - Virtual size: 245KB

.text
Size: 60KB - Virtual size: 59KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 95KB - Virtual size: 98KB

.rsrc
Size: 55KB - Virtual size: 55KB

.reloc
Size: 5KB - Virtual size: 4KB

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

54:9e:86:75:de:ec:b8:47:4c:ba:a5:7d:83:53:a2:3b:25:dc:dd:a5:31:88:42:96:16:ee:64:6e:89:81:6a:d4
Signer

20/06/2020, 13:52
Valid: true

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 356KB - Virtual size: 356KB

.data
Size: 20KB - Virtual size: 28KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 66KB - Virtual size: 66KB

.text
Size: 50KB - Virtual size: 50KB

.rdata
Size: 29KB - Virtual size: 28KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 139KB - Virtual size: 138KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 97KB - Virtual size: 100KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 7KB - Virtual size: 7KB