0477e79be3b3cc1a9a9d6682040f1f19a316fc0e82634050b1a1bf26ce3178c3

Sharing

Copy URL Twitter E-mail

General

Target

0477e79be3b3cc1a9a9d6682040f1f19a316fc0e82634050b1a1bf26ce3178c3
Size

5.1MB
MD5

5ecacf14701d7cacb63dd714eb724187
SHA1

898129bb9420fd270cd14d694e72bbfaa74d3db0
SHA256

0477e79be3b3cc1a9a9d6682040f1f19a316fc0e82634050b1a1bf26ce3178c3
SHA512

17e21746a2b23383523462eaffc9f4d55511b40cfd4713a6a2301dc428e7e9f5df60fcfa60102bb1a64463b8ae349a13c26e3f9fbc3d24f146fbb52758de9606
SSDEEP

98304:FtLBv/gF8J/eYrcFqGTXPxBNXP5vH9kbhUnkwLbQ93:FtxA8nrcFqAXPxLBKUznQ93

Score

1^/10

Malware Config

Signatures

Files

0477e79be3b3cc1a9a9d6682040f1f19a316fc0e82634050b1a1bf26ce3178c3
.dll windows x86

e2c8ccc59e65ec5d351a115f25e9daa9

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:ea:0d:de:d5:5e:c1:e1:a2:9f:c5:fb:5d:ab:4f:b2
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2020, 00:00

Not After

18/05/2023, 12:00

Subject

SERIALNUMBER=91310115591679552Q,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

05:aa:43:30:0d:17:67:ac:12:49:43:54:21:65:bb:9e
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2020, 00:00

Not After

18/05/2023, 12:00

Subject

SERIALNUMBER=91310115591679552Q,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:99:4d:8f:fe:87:3f:25:c4:98:a9:e3:d4:35:d1:87:50:ea:d8:6f:ff:3c:55:f4:9c:05:35:8b:41:62:c3:a8
Signer

Actual PE Digest

16:99:4d:8f:fe:87:3f:25:c4:98:a9:e3:d4:35:d1:87:50:ea:d8:6f:ff:3c:55:f4:9c:05:35:8b:41:62:c3:a8

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91310115591679552Q,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

16/11/2022, 02:12
Valid: true

Chain 1

SERIALNUMBER=91310115591679552Q,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

29:06:62:55:75:36:d5:30:51:4a:d9:b2:57:92:dd:f0:31:6b:7b:d1
Signer

Actual PE Digest

29:06:62:55:75:36:d5:30:51:4a:d9:b2:57:92:dd:f0:31:6b:7b:d1

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=91310115591679552Q,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

16/11/2022, 02:12
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetCheckConnectionW

basicsqlite

?ExecSQL@RCSQLiteConnection@RC@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAVRCSQLiteRecordSet@2@@Z
?DisconnectDB@RCSQLiteConnection@RC@@QAE_NXZ
?LoadDB@RCSQLiteConnection@RC@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??1RCSQLiteConnection@RC@@QAE@XZ
??0RCSQLiteConnection@RC@@QAE@XZ
?GetStringField@RCSQLiteRecordSet@RC@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@HABV34@@Z
?GetIntegerField@RCSQLiteRecordSet@RC@@QBE_JH_J@Z
?GetFieldNum@RCSQLiteRecordSet@RC@@QBEHXZ
?NextRow@RCSQLiteRecordSet@RC@@QAE_NXZ
?MoveFirst@RCSQLiteRecordSet@RC@@QAE_NXZ
??1RCSQLiteRecordSet@RC@@QAE@XZ
??0RCSQLiteRecordSet@RC@@QAE@XZ

kernel32

GetVersionExW
GetModuleHandleW
GlobalMemoryStatusEx
lstrlenW
InterlockedExchangeAdd
SetLastError
InterlockedExchange
SetEvent
WaitForMultipleObjects
GetFileSize
DeleteFileW
SetEndOfFile
SetFilePointer
ReadFile
GetCurrentProcessId
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetModuleHandleExW
VirtualQuery
GetLogicalDriveStringsW
GetEnvironmentVariableW
QueryDosDeviceW
CreateFileW
WriteFile
GetTickCount
ExpandEnvironmentStringsW
LoadLibraryW
GetProcAddress
FreeLibrary
CreateFileMappingW
UnmapViewOfFile
OpenThread
SetThreadContext
GetThreadContext
CreateToolhelp32Snapshot
SuspendThread
Thread32First
Thread32Next
GetFileInformationByHandle
CreateSemaphoreW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetModuleFileNameA
ExitProcess
LocalFree
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
FlushFileBuffers
FormatMessageA
LockFileEx
UnlockFile
HeapCompact
HeapReAlloc
DeleteFileA
GetVersionExA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnlockFileEx
GetFullPathNameA
LockFile
InterlockedCompareExchange
AreFileApisANSI
GetFileType
GetStdHandle
IsBadStringPtrW
IsBadReadPtr
IsBadWritePtr
LoadLibraryExA
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
FlushInstructionCache
HeapDestroy
HeapCreate
OutputDebugStringA
VirtualProtect
CreateThread
DisableThreadLibraryCalls
GetModuleHandleA
MapViewOfFile
CloseHandle
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetCurrentThreadId
RaiseException
DecodePointer
ExitThread
GetFileAttributesW
GetModuleFileNameW
OutputDebugStringW
MapViewOfFileEx
GlobalUnlock
GlobalLock
FreeResource
CreateWaitableTimerW
SetWaitableTimer
MulDiv
GetACP
MultiByteToWideChar
WideCharToMultiByte
FindFirstFileW
GetLongPathNameW
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
SetFileTime
GetFileTime
LockResource
GetSystemInfo
LoadResource
FindResourceW
lstrcmpiW
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LoadLibraryExW
GetCurrentProcess
OpenProcess
GetDiskFreeSpaceW
FindNextFileW
FindClose
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
ResumeThread
CreateEventW
ResetEvent
HeapFree
GlobalAlloc
GlobalFree
HeapAlloc
GetProcessHeap
SwitchToThread
CreateDirectoryW
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
GetCurrentDirectoryW
GetWindowsDirectoryW
MoveFileExW
GetTempFileNameW
MoveFileW
LoadLibraryA
DeviceIoControl
lstrcatW
lstrcpyW
GetFileSizeEx
QueryPerformanceFrequency
QueryPerformanceCounter
OpenFileMappingW
FormatMessageW
EncodePointer
DuplicateHandle
WaitForSingleObjectEx
GetCurrentThread
GetExitCodeThread
GetStringTypeW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetLocalTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
InterlockedDecrement
CreateFileMappingA
LocalAlloc
lstrcmpW
InterlockedIncrement
SizeofResource

user32

CallWindowProcW
IsWindowVisible
UnregisterClassW
SetWindowLongW
LoadIconW
CopyRect
SendMessageW
DefWindowProcW
PostThreadMessageW
PeekMessageW
DispatchMessageW
SystemParametersInfoW
TranslateMessage
GetMessageW
GetDesktopWindow
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
EnableMenuItem
GetForegroundWindow
GetWindowLongW
GetWindowThreadProcessId
WaitMessage
GetCapture
MonitorFromRect
MapVirtualKeyExW
GetKeyboardLayout
GetKeyNameTextW
GetPropW
GetMenuItemInfoW
InflateRect
GetMenuItemCount
DeleteMenu
RemovePropW
CreatePopupMenu
SetMenuItemInfoW
GetMenuStringW
SetPropW
InsertMenuW
AppendMenuW
LoadMenuW
TrackPopupMenu
GetSubMenu
GetMenuDefaultItem
DestroyIcon
IsMenu
SetMenuDefaultItem
DestroyMenu
GetAsyncKeyState
GetFocus
LoadStringW
DestroyAcceleratorTable
CreateAcceleratorTableW
EnumThreadWindows
PostQuitMessage
RegisterWindowMessageW
GetAncestor
EmptyClipboard
SetClipboardData
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
GetSysColor
GetKeyboardState
GetCaretBlinkTime
ToAscii
GetWindowTextW
EnableWindow
ReleaseDC
SetForegroundWindow
GetParent
GetDlgItem
GetClientRect
GetClassNameW
MapWindowPoints
GetMonitorInfoW
IsWindow
WindowFromPoint
SetWindowTextW
MonitorFromWindow
GetDC
GetWindowRect
GetWindow
MonitorFromPoint
GetWindowTextLengthW
GetSystemMetrics
EndPaint
BeginPaint
IsIconic
GetDCEx
InvalidateRect
UpdateWindow
KillTimer
IsZoomed
GetWindowDC
SetCapture
SetParent
GetUpdateRect
SetFocus
IsWindowEnabled
ValidateRect
IsChild
ClientToScreen
RedrawWindow
SetTimer
OpenClipboard
InvalidateRgn
ScreenToClient
CreateWindowExW
SetWindowRgn
MessageBoxW
PostMessageW
ShowWindowAsync
AdjustWindowRectEx
GetClassInfoExW
LoadCursorW
IsRectEmpty
RegisterClassExW
ReleaseCapture
TrackMouseEvent
GetKeyState
GetCursorPos
SetCursor
IntersectRect
OffsetRect
EnumChildWindows
EqualRect
PtInRect
CharNextW
UnionRect
AttachThreadInput
SetRectEmpty
SetRect
UpdateLayeredWindow
FillRect
MsgWaitForMultipleObjects
GetClassLongW
SetCaretPos
LoadImageW
LoadBitmapW
DrawTextW
DrawIconEx
GetIconInfo

gdi32

GetDIBits
CreateDCW
ExtTextOutW
MoveToEx
SelectClipRgn
ExtCreatePen
GetTextMetricsW
CreateSolidBrush
SetGraphicsMode
SetMapMode
CreateRectRgnIndirect
CreatePolygonRgn
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
SetViewportOrgEx
DeleteObject
GetRgnBox
GetStockObject
GetDeviceCaps
GetMapMode
CreateRoundRectRgn
PtInRegion
CreateDIBSection
SetBkColor
EnumFontsW
GetObjectW
SetWorldTransform
GetTextExtentPointW
SetBkMode
CreatePen
AddFontMemResourceEx
DeleteDC
CreateFontIndirectW
SetTextAlign
CreateRectRgn
LineTo
GetClipBox
GetFontUnicodeRanges
EnumFontFamiliesExW
GetTextFaceW
GdiFlush
GetFontData
GetTextExtentPointI
GetGlyphIndicesW
GetCharABCWidthsW
GetGlyphOutlineW
RemoveFontMemResourceEx
GetOutlineTextMetricsW
SetTextColor

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW

shell32

SHGetSpecialFolderPathW
DragFinish
DragQueryFileW
SHChangeNotify
SHGetFolderPathW
ShellExecuteW
Shell_NotifyIconW

ole32

OleLockRunning
RegisterDragDrop
RevokeDragDrop
CoCreateGuid
StringFromGUID2
CoGetClassObject
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CLSIDFromProgID

oleaut32

LoadRegTypeLi
VariantInit
LoadTypeLi
OleCreateFontIndirect
SysStringLen
SysAllocStringLen
VarUI4FromStr
SysAllocString
VariantClear
SysFreeString
DispCallFunc

shlwapi

PathFindFileNameW
ord12
StrToIntA
AssocQueryStringW
PathAppendW
StrDupW

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

msimg32

AlphaBlend

urlmon

CoInternetCreateZoneManager
CoInternetCreateSecurityManager

gdiplus

GdipMeasureString
GdipCloneBrush
GdipRestoreGraphics
GdipRotateWorldTransform
GdipStringFormatGetGenericTypographic
GdipGetCellAscent
GdipSetTextRenderingHint
GdipCloneStringFormat
GdipGetMatrixElements
GdipGetTextureTransform
GdipCreateTexture
GdipBeginContainer2
GdipFillEllipse
GdipCreateFromHDC
GdipGetClipBoundsI
GdipSetImageAttributesWrapMode
GdipDrawString
GdipDrawPath
GdipSetClipRegion
GdipCreateImageAttributes
GdipDrawArcI
GdipGetSmoothingMode
GdipClosePathFigure
GdipSetClipRectI
GdipScaleWorldTransform
GdipSetPixelOffsetMode
GdipDrawRectangle
GdipDrawLine
GdipSetPenDashStyle
GdipGraphicsClear
GdipMultiplyWorldTransform
GdipGetPathWorldBounds
GdipFillPath
GdipTransformRegion
GdipDeleteMatrix
GdipGetFamilyName
GdipDeleteRegion
GdipSetStringFormatFlags
GdipGetImagePixelFormat
GdipCloneBitmapAreaI
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipCloneImage
GdipBitmapUnlockBits
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipAlloc
GdipDisposeImage
GdipDeleteStringFormat
GdipImageSelectActiveFrame
GdipBitmapLockBits
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetImageWidth
GdipGetPropertyItemSize
GdiplusStartup
GdiplusShutdown
GdipDeleteFont
GdipGetFontSize
GdipGetImageGraphicsContext
GdipSetStringFormatTrimming
GdipGetFontStyle
GdipCreateSolidFill
GdipCloneBitmapArea
GdipGetCellDescent
GdipSetInterpolationMode
GdipSetLinePresetBlend
GdipCreateFont
GdipSetStringFormatLineAlign
GdipCreatePath
GdipEndContainer
GdipFillRectangleI
ord1
GdipCloneRegion
GdipDeleteGraphics
GdipSetSmoothingMode
GdipCreateMatrix
GdipGetStringFormatAlign
GdipDeletePath
GdipDisposeImageAttributes
GdipTranslateWorldTransform
GdipCreateMatrix2
GdipDeleteBrush
GdipGetLineSpacing
GdipSetLineWrapMode
GdipCreateLineBrushI
GdipDrawImageRectRect
GdipSaveGraphics
GdipCreateFontFamilyFromName
GdipGetEmHeight
GdipGetStringFormatLineAlign
GdipAddPathString
GdipGetTextRenderingHint
GdipGetFamily
GdipSetCompositingQuality
GdipSetImageAttributesColorMatrix
GdipGetLineTransform
GdipDeleteFontFamily
GdipGetInterpolationMode
GdipCreateRegionPath
GdipAddPathLineI
GdipAddPathBezierI
GdipCombineRegionPath
GdipAddPathEllipseI
GdipAddPathArcI
GdipAddPathRectangleI
GdipCombineRegionRegion
GdipGetBrushType
GdipSetLineTransform
GdipSetTextureTransform
GdipDeletePen
GdipCreatePen1
GdipSetStringFormatAlign
GdipFree
GdipSetCompositingMode
GdipLoadImageFromFile
GdipCreateBitmapFromResource
GdipSetImageAttributesColorKeys
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipDrawImageRectRectI

crypt32

CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptQueryObject
CertFreeCertificateContext
CryptMsgClose
CertGetNameStringW

imm32

ImmAssociateContextEx
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmNotifyIME

usp10

ScriptShape
ScriptFreeCache
ScriptItemize

winmm

timeGetTime

psapi

GetMappedFileNameW

Exports

Exports

?__autoclassinit2@RCSQLiteConnection@RC@@QAEXI@Z
?__autoclassinit2@RCSQLiteRecordSet@RC@@QAEXI@Z
GetCurrentNotifyAssocEventCount
GetSwitchStatus
Initialize
IsAllowedPopup
IsHitDatabaseItem
NotifyAssocEventWithResult
NotifyAssocEventWithoutResult
ParseFileAssocCloudSettings
TryToCleanDoneAssocEvents
Uninitialize

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 792KB - Virtual size: 792KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 245KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2c8ccc59e65ec5d351a115f25e9daa9

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

06:ea:0d:de:d5:5e:c1:e1:a2:9f:c5:fb:5d:ab:4f:b2Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

05:aa:43:30:0d:17:67:ac:12:49:43:54:21:65:bb:9eCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

16:99:4d:8f:fe:87:3f:25:c4:98:a9:e3:d4:35:d1:87:50:ea:d8:6f:ff:3c:55:f4:9c:05:35:8b:41:62:c3:a8Signer

Signature Validations

Verification

16/11/2022, 02:12 Valid: true

Chain 1

29:06:62:55:75:36:d5:30:51:4a:d9:b2:57:92:dd:f0:31:6b:7b:d1Signer

Signature Validations

Verification

16/11/2022, 02:12 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

version

wininet

basicsqlite

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

urlmon

gdiplus

crypt32

imm32

usp10

winmm

psapi

Exports

Exports

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 792KB - Virtual size: 792KB

.data Size: 59KB - Virtual size: 84KB

_RDATA Size: 2KB - Virtual size: 2KB

.rsrc Size: 245KB - Virtual size: 245KB

.reloc Size: 180KB - Virtual size: 180KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

06:ea:0d:de:d5:5e:c1:e1:a2:9f:c5:fb:5d:ab:4f:b2
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

05:aa:43:30:0d:17:67:ac:12:49:43:54:21:65:bb:9e
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

16:99:4d:8f:fe:87:3f:25:c4:98:a9:e3:d4:35:d1:87:50:ea:d8:6f:ff:3c:55:f4:9c:05:35:8b:41:62:c3:a8
Signer

16/11/2022, 02:12
Valid: true

29:06:62:55:75:36:d5:30:51:4a:d9:b2:57:92:dd:f0:31:6b:7b:d1
Signer

16/11/2022, 02:12
Valid: false

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 792KB - Virtual size: 792KB

.data
Size: 59KB - Virtual size: 84KB

_RDATA
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 245KB - Virtual size: 245KB

.reloc
Size: 180KB - Virtual size: 180KB