terabox[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

terabox.exe
Size

6.3MB
MD5

84fde267bbb9bdc9bc8dc0e8b6b2d930
SHA1

c22d16a6931fccac848b7c4d2dfbcf8a2dd37f60
SHA256

96d2f9a27a8e096a59824505893d87b7dd1c3cbba0c1c16906c9cd04b6f3a041
SHA512

15e07e676cde1a26adbfffeaf24aa596b0e7a5076f4ae3415eb690d54f1457cf668503f0b67dc62bfbe5e40f066f22f8d29297303dd0f4894a9161851b27b6f2
SSDEEP

98304:IiJHoeMbMX2P1UfkFbutesPkbwwgvB34KYALZ:IiJIeMbMX2skFG6wwc/Z

Score

1^/10

Malware Config

Signatures

Files

terabox.exe
.exe windows x86

3efb7d268591ea633e206fe8f1a512ff

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

20/12/2022, 08:57

Not After

18/03/2025, 08:54

Subject

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

20/12/2022, 08:57

Not After

18/03/2025, 08:54

Subject

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:c5:e4:b6:ab:27:aa:4f:45:31:40:1f:e6:3a:81:92:f3:95:26:d9:9f:ea:df:d8:f1:dd:30:e7:b2:4e:90:5e
Signer

Actual PE Digest

61:c5:e4:b6:ab:27:aa:4f:45:31:40:1f:e6:3a:81:92:f3:95:26:d9:9f:ea:df:d8:f1:dd:30:e7:b2:4e:90:5e

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

07/02/2023, 20:39
Valid: true

Chain 1

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Chain 2

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

8c:86:9f:75:d8:e1:41:ff:85:7b:5a:ec:05:24:ec:55:fc:19:cd:64
Signer

Actual PE Digest

8c:86:9f:75:d8:e1:41:ff:85:7b:5a:ec:05:24:ec:55:fc:19:cd:64

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

03/02/2023, 04:37
Valid: true

Chain 1

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Chain 2

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

updateagent

update_agent_global_cleanup
update_agent_setopt
update_agent_global_init

bull140u

?GuidToString@BULL@@YAPA_WABU_GUID@@@Z
?CreateObjectNative@BULL@@YAJABU_GUID@@0PAPAX@Z
?XLogV@BULL@@YAXIPB_W0PAD@Z
?GetNamedObject@BULL@@YAJPA_WABU_GUID@@1PAPAX@Z
?LoadModuleInfo@BULL@@YAJPB_W@Z
?MultiByteToWideChar@BULL@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@IPBD@Z
?_wtoui@@YAIPB_W@Z
?CreateGuid@BULL@@YA?AU_GUID@@XZ
?RegisterObject@BULL@@YAJABU_GUID@@0P6GJPAX0PAPAX@ZPB_W@Z
?Base64Decode@BULL@@YAJPA_WPAPAUIGeneralBuffer@1@@Z
?Base64Encode@BULL@@YAJPAUIGeneralBuffer@1@PAPA_WK@Z
?MD5@BULL@@YAJPAUIGeneralBuffer@1@PAPAU21@@Z
?KillTimer_s@BULL@@YAXK@Z
?KillTimer@BULL@@YAJK@Z
?SetTimer@BULL@@YAJK_NPAUICallbackTimer@1@KPAK@Z
?GetLogController@BULL@@YAJPAPAUILogController@1@@Z
?GetModuleVer@BULL@@YAJPA_WPAPA_W1@Z
?AssertOut@BULL@@YAJPB_WH_N0@Z
?EnableNamedObject@BULL@@YAJPA_WABU_GUID@@@Z

apputil

?GetForceUpdateContent@Misc@AppUtil@@YAJPAPA_W00@Z
?TransformUtf8HttpMemoryBlockToBSTR@Misc@AppUtil@@YAJPAUIHttpMemoryBlock@BULL@@PAPA_W@Z
?Parse@JsonLib@@YAJPA_WPAPAUIGeneralData@BULL@@@Z
?TransformUtf8StringToWString@Misc@AppUtil@@YAJV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@AAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@4@@Z
?GetUrl@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@H0AAV23@@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAH@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAV23@H@Z
?TransformWStringToUtf8String@Misc@AppUtil@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@4@@Z
?CurlIsIPV6@Misc@AppUtil@@YAHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAI@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AA_J@Z
?VersionInfoDecode@Misc@AppUtil@@YAJPAPA_WH@Z
?TransUidToString@Misc@AppUtil@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAV34@@Z
?GetChannelInfo@Misc@AppUtil@@YAJPAPA_W@Z
?GetTeraBoxTempPath@Misc@AppUtil@@YAJPAPA_W@Z
?IsAllAUPackageReady@Misc@AppUtil@@YAHAAH@Z
?IsAutoUpdate@Misc@AppUtil@@YAHXZ
GetInt64FromJsonDataShim
?TransformUtf8BufferToBSTR@Misc@AppUtil@@YAJPAUIGeneralBuffer@BULL@@PAPA_W@Z
?GetCurrentLangId@Misc@AppUtil@@YAJAAK@Z
?CurURLDecode@Misc@AppUtil@@YAJPBDAAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
?GetDomain@HelpAppSetting@@YAJAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?Parse@JsonLib@@YAJPA_WPAPAUIGeneralArray@BULL@@@Z
?GetProxyInfo@HelpProxySetting@@YAJPAKPAPA_WPAG@Z
?SetProxyInfo@HelpProxySetting@@YAJKPA_WG@Z
?IsAutoRun@Misc@AppUtil@@YAHXZ
?SetAutoRun@Misc@AppUtil@@YAJH@Z
?SetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0H@Z
?CurURLEncode@Misc@AppUtil@@YAJPBDAAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
?CurURLEncode@Misc@AppUtil@@YAJPB_WAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?JsonEncode@JsonLib@@YAJPAUIGeneralData@BULL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
?IsNeedAutoUpdate@Misc@AppUtil@@YAHXZ
?GetLangDuiStringTableId@Misc@AppUtil@@YAJAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetUpdateLevel@Misc@AppUtil@@YAJPAH@Z
?IsTeraBoxDomain@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAH@Z

kernel32

MulDiv
lstrcmpW
Sleep
GetDiskFreeSpaceExW
VerifyVersionInfoW
VerSetConditionMask
CreateFileW
GetFileSize
ReadFile
WriteFile
SetErrorMode
GetTempPathW
DeleteFileW
GlobalFree
GetDriveTypeW
SetThreadExecutionState
OpenProcess
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
LocalFree
WriteProcessMemory
CreateEventW
GetPrivateProfileIntW
VirtualAlloc
LoadLibraryExW
FindClose
GetFullPathNameW
FindFirstFileW
FindNextFileW
GetExitCodeProcess
OpenMutexW
WaitForSingleObjectEx
ReleaseMutex
CreateMutexW
OpenFileMappingW
GetTempFileNameW
SystemTimeToTzSpecificLocalTime
lstrcmpiW
OpenEventW
SetEvent
GetSystemDirectoryW
GetLogicalDrives
WinExec
GetSystemTime
ExpandEnvironmentStringsW
GetSystemInfo
GetCurrentProcess
GlobalAlloc
SetLastError
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetFilePointer
DosDateTimeToFileTime
lstrcpyW
FreeResource
InitializeCriticalSection
HeapCreate
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
ConvertFiberToThread
DeleteFiber
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetFileType
GetStdHandle
MoveFileExW
GetModuleHandleA
LoadLibraryA
VirtualProtect
LoadLibraryExA
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
EncodePointer
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
ResetEvent
GlobalLock
GlobalUnlock
GetModuleHandleW
DecodePointer
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetLastError
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
WaitForSingleObject
CreateProcessW
GetThreadContext
Thread32Next
CloseHandle
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentProcessId
GetVersionExW
GetEnvironmentVariableW
GetCurrentThreadId
SetUnhandledExceptionFilter
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FileTimeToSystemTime
VirtualFree
lstrlenW

user32

UnregisterClassW
OemToCharBuffW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
MessageBeep
MapVirtualKeyA
GetMenuItemInfoW
DestroyIcon
SetRect
IsRectEmpty
SetForegroundWindow
AttachThreadInput
GetActiveWindow
AllowSetForegroundWindow
CharLowerBuffW
PeekMessageW
LoadImageW
LoadIconW
UnregisterHotKey
SetClipboardData
SetActiveWindow
UnhookWinEvent
SetWinEventHook
ClipCursor
SystemParametersInfoW
ShowCursor
GetCursorInfo
GetDoubleClickTime
GetShellWindow
GetForegroundWindow
FindWindowExW
PtInRect
OffsetRect
InflateRect
IntersectRect
GetWindowRect
IsWindowVisible
UpdateWindow
EnumChildWindows
RegisterClipboardFormatW
KillTimer
GetSystemMetrics
SetTimer
EmptyClipboard
ChangeClipboardChain
SetClipboardViewer
GetClipboardOwner
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
IsIconic
UnionRect
SetRectEmpty
IsZoomed
SetCursor
GetCursorPos
TrackMouseEvent
GetWindowThreadProcessId
MonitorFromPoint
FindWindowW
DrawTextW
FrameRect
EnableWindow
MapWindowPoints
TrackPopupMenu
AppendMenuW
InsertMenuW
DestroyMenu
CreatePopupMenu
IsMenu
EnableMenuItem
DrawIconEx
SetCaretPos
GetCaretBlinkTime
CreateCaret
EndMenu
SetLayeredWindowAttributes
PrintWindow
UpdateLayeredWindow
AnimateWindow
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromWindow
GetDesktopWindow
DestroyAcceleratorTable
CharNextW
FillRect
MoveWindow
GetWindowTextW
SetWindowTextW
SetFocus
SetCapture
ReleaseDC
GetDC
ReleaseCapture
CreateAcceleratorTableW
RedrawWindow
ScreenToClient
GetSysColor
ClientToScreen
InvalidateRect
GetClientRect
GetClassNameW
GetDlgItem
GetFocus
IsChild
EndPaint
GetWindow
GetParent
SetWindowPos
GetKeyState
IsWindowEnabled
CopyRect
SetCursorPos
SendMessageW
CreateWindowExW
BeginPaint
GetWindowTextLengthW
LoadCursorW
RegisterWindowMessageW
GetClassInfoExW
RegisterClassExW
SendMessageTimeoutW
CallWindowProcW
DefWindowProcW
PostMessageW
IsWindow
ShowWindow
DestroyWindow
SetWindowLongW
GetWindowLongW
MessageBoxW
WaitForInputIdle
GetProcessWindowStation
GetUserObjectInformationW
EqualRect
InvalidateRgn

gdi32

SelectClipRgn
SaveDC
RestoreDC
DeleteDC
OffsetViewportOrgEx
CreateRectRgnIndirect
GetClipBox
ExtSelectClipRgn
SetBkMode
ExtTextOutW
GetDeviceCaps
SetViewportOrgEx
GetStockObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
SetBkColor
SetTextColor
CombineRgn
GetCurrentObject
GetRgnBox
StretchBlt
GetTextExtentPointW
GetTextExtentPoint32W
GetTextColor
GetTextMetricsW
CreateBitmap
CreateDIBitmap
TextOutW
MoveToEx
ExtCreatePen
CreateDIBSection
RoundRect
GetObjectW
CreateFontIndirectW
LineTo
CreatePen
CreateRectRgn
ExcludeClipRect
GetClipRgn
GetObjectType
RectInRegion
Rectangle
DeleteObject
GetViewportOrgEx
GetObjectA

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

CryptEnumProvidersW
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegEnumKeyW
RegEnumValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW

shell32

SHAppBarMessage
DragQueryFileW
SHChangeNotify
DragFinish
SHGetSpecialFolderLocation
ord2
ord4
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHBrowseForFolderW
SHGetMalloc
CommandLineToArgvW
SHFileOperationW
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW
SHCreateDirectoryExW

ole32

CreateBindCtx
CLSIDFromString
CoCreateInstance
CoSetProxyBlanket
CoFreeLibrary
CoLoadLibrary
OleSetContainedObject
CreateOleAdviseHolder
StgCreateDocfile
OleDuplicateData
DoDragDrop
ReleaseStgMedium
RevokeDragDrop
RegisterDragDrop
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
OleInitialize
CoInitializeEx
OleUninitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

GetErrorInfo
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
OleCreateFontIndirect
VarUI4FromStr
SysFreeString
SysAllocString
VariantInit
VariantClear
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetVartype
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocStringLen

shlwapi

StrStrIW
PathAppendW
SHDeleteKeyW
ord219
StrCmpLogicalW
StrToIntExA
StrToIntW

comctl32

InitCommonControlsEx

msvcp140

?tolower@?$ctype@D@std@@QBEDD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?id@?$collate@D@std@@2V0locale@2@A
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
_Strxfrm
?id@?$ctype@D@std@@2V0locale@2@A
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
_Strcoll
??0facet@locale@std@@IAE@I@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??0_Locinfo@std@@QAE@PBD@Z
??1_Lockit@std@@QAE@XZ
??1_Locinfo@std@@QAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??1facet@locale@std@@MAE@XZ
?_Incref@facet@locale@std@@UAEXXZ

gdiplus

GdipDrawImageRectRectI
GdipFillRectangleI
GdipSetImageAttributesWrapMode
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipLoadImageFromFileICM
GdipLoadImageFromStreamICM
GdipLoadImageFromFile
GdipLoadImageFromStream
GdipCreateTexture2I
GdipDeleteBrush
GdipCloneBrush
GdiplusShutdown
GdiplusStartup
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipCreatePen1
GdipDeletePen
GdipDrawArcI
GdipFree
GdipAlloc
GdipCloneImage
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectI
GdipImageSelectActiveFrame
GdipImageRotateFlip
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDisposeImage

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertGetNameStringW
CertOpenStore
CertGetCertificateContextProperty

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData

ws2_32

WSASetLastError
send
closesocket
WSAGetLastError
WSACleanup
recv

urlmon

UrlMkSetSessionOption
UrlMkGetSessionOption

psapi

EnumProcesses
GetModuleBaseNameW

wininet

InternetSetCookieW
FindCloseUrlCache
InternetSetCookieExW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
DeleteUrlCacheEntryW

winmm

PlaySoundW

vcruntime140

_CxxThrowException
memcmp
memcpy
strrchr
strstr
__RTDynamicCast
memset
__CxxFrameHandler3
__vcrt_InitializeCriticalSectionEx
wcschr
memchr
strchr
__std_exception_copy
__std_exception_destroy
_purecall
wcsstr
wcsrchr
memmove
__std_terminate
_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_control87
_get_wide_winmain_command_line
exit
_errno
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
terminate
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_c_exit
_invalid_parameter_noinfo
_set_invalid_parameter_handler
_cexit
signal
_crt_atexit
_register_onexit_function
_controlfp_s
strerror_s
_initialize_onexit_table
_exit
raise

api-ms-win-crt-string-l1-1-0

_wcsnicmp
wmemcpy_s
wcscpy_s
_stricmp
isspace
strncmp
iswxdigit
iswprint
iswalpha
iswalnum
wcstok
_wcsicmp
strcpy_s
_wcsdup
wcsncpy
wcscpy
strcat
strcpy
strcmp
isblank
wcscmp
wcscat_s
isprint
wcscspn
wcsspn
iswdigit
_strnicmp
wcsncmp
strnlen
isdigit
strncpy
iswspace
_wcsupr_s
_wcslwr_s
strlen
wcslen
wcsnlen
wcsncpy_s
strcspn
strspn

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s
fwrite
fclose
__stdio_common_vfwprintf
_wfopen_s
__stdio_common_vswscanf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
fputs
__stdio_common_vsscanf
fopen
_wfopen
__stdio_common_vswprintf
__stdio_common_vswprintf_s
__acrt_iob_func
_setmode
ftell
fseek
fread
_fileno
fgets
__p__commode
fflush
ferror
feof
__stdio_common_vfprintf
_set_fmode

api-ms-win-crt-time-l1-1-0

_localtime64_s
_gmtime64_s
wcsftime
_mktime64
_time64

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_recalloc
_callnewh
realloc
_set_new_mode

api-ms-win-crt-multibyte-l1-1-0

_mbsrchr
_mbslwr_s
_mbscmp
_mbsicmp

api-ms-win-crt-convert-l1-1-0

wcstol
strtol
_wtoi64
strtoul
_atoi64
atof
atoi
_wtoi

api-ms-win-crt-filesystem-l1-1-0

_wrmdir
_wfindnext64i32
_wfindfirst64i32
_waccess
_stat64i32
_findclose
_wremove

api-ms-win-crt-utility-l1-1-0

qsort
rand
bsearch
div
srand
labs
abs

api-ms-win-crt-math-l1-1-0

fabs
ceil
_libm_sse2_log10_precise
_libm_sse2_cos_precise
_CIfmod
_libm_sse2_sin_precise
_except1
__setusermatherr
_libm_sse2_pow_precise

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

bcrypt

BCryptGenRandom

imm32

ImmAssociateContext
ImmReleaseContext
ImmGetContext

msimg32

AlphaBlend
GradientFill

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 978KB - Virtual size: 977KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 130KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 902KB - Virtual size: 901KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 265KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 771KB - Virtual size: 771KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3efb7d268591ea633e206fe8f1a512ff

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:c8:cb:43:1d:57:65:77:57:fb:47:fcCertificate

Extended Key Usages

Key Usages

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:c8:cb:43:1d:57:65:77:57:fb:47:fcCertificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

61:c5:e4:b6:ab:27:aa:4f:45:31:40:1f:e6:3a:81:92:f3:95:26:d9:9f:ea:df:d8:f1:dd:30:e7:b2:4e:90:5eSigner

Signature Validations

Verification

07/02/2023, 20:39 Valid: true

Chain 1

Chain 2

8c:86:9f:75:d8:e1:41:ff:85:7b:5a:ec:05:24:ec:55:fc:19:cd:64Signer

Signature Validations

Verification

03/02/2023, 04:37 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

updateagent

bull140u

apputil

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msvcp140

gdiplus

crypt32

wintrust

ws2_32

urlmon

psapi

wininet

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

61:c5:e4:b6:ab:27:aa:4f:45:31:40:1f:e6:3a:81:92:f3:95:26:d9:9f:ea:df:d8:f1:dd:30:e7:b2:4e:90:5e
Signer

07/02/2023, 20:39
Valid: true

8c:86:9f:75:d8:e1:41:ff:85:7b:5a:ec:05:24:ec:55:fc:19:cd:64
Signer

03/02/2023, 04:37
Valid: true

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 978KB - Virtual size: 977KB

.data
Size: 130KB - Virtual size: 212KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 116B

_RDATA
Size: 2KB - Virtual size: 1KB

.vmp0
Size: 902KB - Virtual size: 901KB

.reloc
Size: 265KB - Virtual size: 264KB

.rsrc
Size: 771KB - Virtual size: 771KB