AT-Win64-Shipping[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AT-Win64-Shipping.exe
Size

81.1MB
MD5

680816b8498957d133056e20f2918377
SHA1

3055830d4fbcdb677d2d27f27357b33a1095953f
SHA256

4ac3b14a45ccfd5a4f5e1947c72ab1dcddde09c86507a16baa21c78706e7b3d6
SHA512

ada21297ab20a9b04adc66b1bd182f8973f61291ca65c847146d85580b3adec4444540ce57cd4013e1c5d9f0179f64a03d6e92349aa6afe6ac8f9bb7740a5363
SSDEEP

393216:yDD2uPRKKxdFOlkGKF6hYLY6Fq4dN7P9Gz7NescxSS33eJubPdrGj/mUFxYAxDhQ:yg/25TlQVcBv/EsYBD9O

Score

1^/10

Malware Config

Signatures

Files

AT-Win64-Shipping.exe
.exe windows x64

950ced556334fb8e78516583567dbddb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

gethostbyname
accept
WSAIoctl
__WSAFDIsSet
WSASetLastError
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
gethostname
socket
shutdown
setsockopt
sendto
send
select
recvfrom
recv
ntohs
ntohl
listen
htons
htonl
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
getservbyname
WSAStringToAddressW
WSAAddressToStringW
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
getprotobyname
inet_addr

dbghelp

StackWalk64
SymSetOptions
SymGetOptions
SymFunctionTableAccess64
SymGetModuleInfo64
SymGetModuleInfoW64
SymGetModuleBase64
SymGetLineFromAddr64
SymInitializeW
SymRefreshModuleList
MiniDumpWriteDump
SymGetSymFromAddr64

winmm

timeGetDevCaps
timeBeginPeriod
waveOutGetNumDevs
timeEndPeriod
timeGetTime

kernel32

GetOverlappedResult
WriteFile
ReadFile
RtlCaptureStackBackTrace
VerSetConditionMask
GetEnvironmentVariableW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFinalPathNameByHandleW
GetFullPathNameW
GetLongPathNameW
RemoveDirectoryW
SetFileAttributesW
SetFilePointer
SetFileTime
GetTempPathW
OutputDebugStringW
RaiseException
SetThreadErrorMode
PeekNamedPipe
QueryPerformanceFrequency
ReleaseSemaphore
CreateSemaphoreW
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
SwitchToThread
CreateThread
GetCurrentThread
OpenThread
SuspendThread
ResumeThread
CreateProcessW
GetThreadContext
GlobalMemoryStatusEx
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime
GetVersionExW
GetLogicalProcessorInformation
GetNativeSystemInfo
VirtualProtect
VirtualFree
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetModuleFileNameW
TlsGetValue
GetModuleHandleExW
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
SetThreadAffinityMask
TlsFree
SetDllDirectoryW
GetDllDirectoryW
MoveFileW
GetComputerNameW
VerifyVersionInfoW
FileTimeToSystemTime
SystemTimeToFileTime
GetUserPreferredUILanguages
GetUserDefaultLocaleName
SetConsoleCtrlHandler
K32GetProcessMemoryInfo
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetProcessHandleCount
GetVersion
GlobalAlloc
GlobalUnlock
GlobalLock
GetLocaleInfoW
GetConsoleScreenBufferInfo
SetConsoleScreenBufferSize
SetConsoleWindowInfo
SetConsoleTextAttribute
FreeConsole
GlobalMemoryStatus
AllocConsole
GetConsoleWindow
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObjectEx
GetTickCount64
GetFileSize
FlushViewOfFile
SetErrorMode
TlsAlloc
SetHandleInformation
VirtualAlloc
GetSystemDefaultLocaleName
LocaleNameToLCID
OpenEventW
WideCharToMultiByte
SetThreadPriority
CreateEventW
WaitForSingleObject
VerifyVersionInfoA
SetFilePointerEx
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
VirtualQuery
GetCurrentThreadId
QueryPerformanceCounter
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
SetCriticalSectionSpinCount
FlushConsoleInputBuffer
RtlVirtualUnwind
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryW
LocalAlloc
GetExitCodeThread
CreateEventA
LoadLibraryExA
GetTickCount
CreateFileMappingA
OutputDebugStringA
MultiByteToWideChar
MoveFileA
SetEndOfFile
GetFileAttributesA
DeleteFileA
CreateFileA
InitializeCriticalSection
ResetEvent
SetEvent
CloseHandle
LoadLibraryW
FormatMessageW
WriteConsoleW
LocalFree
Sleep
CreateMutexW
ReleaseMutex
GetLastError
SetUnhandledExceptionFilter
GetFileType
GetCommandLineW
GetStdHandle
TlsSetValue
GetSystemDirectoryA
ExpandEnvironmentStringsA
WaitForMultipleObjects
SleepConditionVariableCS
InitializeCriticalSectionEx
InitializeConditionVariable
lstrlenA
ExitProcess
GetTimeFormatW
GetDateFormatW
SystemTimeToTzSpecificLocalTime
GetACP
WakeConditionVariable
LoadLibraryExW
GetModuleHandleW
SetLastError
CreateDirectoryA
GetProcessAffinityMask
GetThreadPriority
CreateSemaphoreA
GetCurrencyFormatW
GetNumberFormatW
GetUserGeoID
FormatMessageA
TerminateThread
SleepEx
CreateFileMappingW
AttachConsole
GetThreadLocale
GetLocaleInfoA
GetTimeZoneInformation
GetGeoInfoA

user32

GetRawInputDeviceList
RegisterRawInputDevices
GetRawInputDeviceInfoA
GetRawInputData
GetWindowInfo
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromWindow
MonitorFromRect
MonitorFromPoint
SystemParametersInfoW
LoadIconW
LoadCursorFromFileW
LoadCursorW
SetWindowLongW
GetWindowLongW
ClipCursor
EnumDisplayDevicesA
WindowFromPoint
ClientToScreen
GetProcessWindowStation
GetUserObjectInformationW
GetCursorPos
SetCursor
SetCursorPos
ShowCursor
AdjustWindowRectEx
GetClientRect
SetWindowRgn
EndPaint
BeginPaint
ReleaseDC
DestroyCursor
GetForegroundWindow
SetActiveWindow
UpdateWindow
DrawStateW
EnableMenuItem
GetSystemMenu
EnableWindow
ReleaseCapture
LoadImageW
CreateIconIndirect
SetCapture
ChangeDisplaySettingsW
GetCapture
RegisterTouchWindow
EnumDisplaySettingsW
GetTouchInputInfo
SendInput
GetAsyncKeyState
GetKeyState
GetFocus
GetActiveWindow
SetFocus
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
IsZoomed
IsIconic
SetWindowPlacement
GetWindowPlacement
SetLayeredWindowAttributes
ShowWindow
DestroyWindow
IsWindow
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
DisableProcessWindowsGhosting
GetKeyboardLayout
MapVirtualKeyW
EnumDisplayDevicesW
GetWindowThreadProcessId
GetTopWindow
ScreenToClient
MessageBoxW
GetWindowRect
SetWindowTextW
SetForegroundWindow
GetSystemMetrics
SetDlgItemTextW
GetDlgItem
EndDialog
DialogBoxParamW
SetWindowPos
PostQuitMessage
UnregisterHotKey
RegisterHotKey
GetKeyboardLayoutNameA
GetDesktopWindow
CloseTouchInputHandle
GetDC
IsWindowEnabled
ChangeDisplaySettingsExW

gdi32

CreateRectRgn
CreateRoundRectRgn
DeleteObject
GetDeviceCaps
GetStockObject
PtInRegion
SelectObject
SetBkColor
CreateFontIndirectW
SetTextColor
SetTextAlign
CreateDIBSection
GetObjectW
TextOutW
CreateBitmap
ChoosePixelFormat
SetPixelFormat
SwapBuffers
GetTextExtentPoint32W
DeleteDC
CreateCompatibleDC
SetBkMode
CreateDCW
ExtEscape

advapi32

GetUserNameW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW

shell32

ShellExecuteExW
ShellExecuteW
SHGetKnownFolderPath
SHGetFolderPathW
CommandLineToArgvW

ole32

StringFromGUID2
CoCreateInstance
OleInitialize
OleUninitialize
CoInitializeEx
CoTaskMemAlloc
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateGuid
RegisterDragDrop
RevokeDragDrop
ReleaseStgMedium
IIDFromString
PropVariantClear

oleaut32

SysAllocString
SysFreeString
VariantCopy

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

setupapi

SetupDiGetDevicePropertyW
SetupDiGetClassDevsA
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsExW
SetupDiOpenDevRegKey
CM_Get_Device_IDW
SetupGetInfDriverStoreLocationW

dwmapi

DwmGetCompositionTimingInfo
DwmIsCompositionEnabled
DwmFlush
DwmSetWindowAttribute

imm32

ImmGetDescriptionW
ImmGetProperty
ImmCreateContext
ImmDestroyContext
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmNotifyIME
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmGetIMEFileNameW

dsound

ord1
ord6
ord8
ord11
ord12
ord3

propsys

PropVariantToStringAlloc

opengl32

wglMakeCurrent
wglGetCurrentContext
wglDeleteContext
wglCreateContext
wglGetProcAddress
wglGetCurrentDC

dxgi

CreateDXGIFactory
CreateDXGIFactory1

d3d9

D3DPERF_EndEvent
D3DPERF_BeginEvent

d3d11

D3D11CreateDevice

x3daudio1_7

X3DAudioCalculate
X3DAudioInitialize

xapofx1_5

CreateFX

xinput1_3

ord3
ord2

crypt32

CertOpenSystemStoreW
CertGetNameStringW
CertCloseStore
CertEnumCertificatesInStore

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration

wldap32

ord22
ord46
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord211
ord41
ord50
ord60
ord143

normaliz

IdnToAscii

msvcp140

?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_BADOFF@std@@3_JB
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
_Inf
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

vcruntime140

__CxxFrameHandler3
__RTDynamicCast
wcsstr
strrchr
_set_purecall_handler
longjmp
_CxxThrowException
strstr
memchr
strchr
__std_type_info_name
__std_exception_copy
__std_exception_destroy
__RTtypeid
__std_type_info_compare
__vcrt_InitializeCriticalSectionEx
__intrinsic_setjmp
memcmp
wcsrchr
wcschr
memset
memcpy
__C_specific_handler
memmove
_purecall
__std_terminate

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_wassert
_set_app_type
_get_narrow_winmain_command_line
_cexit
_initterm
_crt_atexit
_register_onexit_function
_initterm_e
_c_exit
_initialize_onexit_table
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_errno
abort
_invoke_watson
strerror
_endthread
_exit
_beginthread
raise
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
exit
_endthreadex
_getpid
signal
_beginthreadex
__sys_nerr
_set_invalid_parameter_handler
terminate

api-ms-win-crt-utility-l1-1-0

rand
bsearch
qsort
srand

api-ms-win-crt-string-l1-1-0

memcpy_s
strncat_s
_strnicmp
wcsncpy_s
strncpy_s
strtok
wcslen
wcscmp
wcscpy_s
strcmp
strncmp
isspace
strnlen
isprint
wcsnlen
isalpha
_wcsicmp
isdigit
_wcsupr
iswspace
strcpy
tolower
strncpy
_stricmp
strcat
strncat
_strdup
iswupper
iswlower
toupper
isalnum
isgraph
_wcsnicmp
wcsncpy
islower
isupper
towlower
towupper
strcpy_s
strcat_s
iswalpha
iswxdigit
iswalnum
isxdigit
wcsncmp
strlen
iswdigit
strpbrk

api-ms-win-crt-stdio-l1-1-0

feof
_lseeki64
_wfopen
fgets
__acrt_iob_func
_open
__stdio_common_vfwprintf
fflush
__stdio_common_vsscanf
setvbuf
__stdio_common_vsprintf_s
_fileno
_setmode
__stdio_common_vsprintf
fopen_s
fclose
fopen
ferror
fread
fputc
fputs
fwrite
_set_fmode
__stdio_common_vfprintf
_fseeki64
ftell
__p__commode
_read
_write
_close
_isatty
fseek
_get_stream_buffer_pointers
fgetc
fgetpos
ungetc
fsetpos
__stdio_common_vswprintf

api-ms-win-crt-math-l1-1-0

log10f
sinhf
ldexp
exp
acosf
cos
sqrtf
acos
_fpclass
cosf
sin
atanf
expf
_finite
_isnan
sqrt
roundf
exp2
pow
log2f
tanf
modf
ceil
logf
powf
atan
frexp
fmodf
asin
modff
fabs
tan
atan2
floor
floorf
atan2f
fmod
asinf
__setusermatherr
_dtest
log
log10
sinf

api-ms-win-crt-convert-l1-1-0

wcstombs
atol
_wtof
strtol
_strtoi64
atoll
wcstod
wcstoul
_wcstoui64
_wtoi
atoi
_wtoi64
strtod
strtoll
strtoul
_strtoui64

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file
_stat64i32
_stat32i64
_stat64
_fstat64
rename

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

__timezone
__tzname
_localtime64
_mktime64
_time64
__daylight
_gmtime64
_tzset

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-conio-l1-1-0

_getch

hid

HidD_GetProductString
HidD_GetManufacturerString
HidD_SetFeature
HidD_GetFeature
HidD_FreePreparsedData
HidD_GetPreparsedData
HidD_GetHidGuid
HidD_GetAttributes
HidP_GetValueCaps
HidP_GetCaps
HidD_GetSerialNumberString

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
PrintScriptCallstack
agsDeInit
agsDriverExtensionsDX11_BeginUAVOverlap
agsDriverExtensionsDX11_CreateDevice
agsDriverExtensionsDX11_DestroyDevice
agsDriverExtensionsDX11_EndUAVOverlap
agsDriverExtensionsDX11_GetMaxClipRects
agsDriverExtensionsDX11_IASetPrimitiveTopology
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirect
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirectCountIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirectCountIndirect
agsDriverExtensionsDX11_NumPendingAsyncCompileJobs
agsDriverExtensionsDX11_SetClipRects
agsDriverExtensionsDX11_SetDepthBounds
agsDriverExtensionsDX11_SetDiskShaderCacheEnabled
agsDriverExtensionsDX11_SetMaxAsyncCompileThreadCount
agsDriverExtensionsDX11_SetViewBroadcastMasks
agsDriverExtensionsDX12_DeInit
agsDriverExtensionsDX12_Init
agsDriverExtensionsDX12_PopMarker
agsDriverExtensionsDX12_PushMarker
agsDriverExtensionsDX12_SetMarker
agsGetCrossfireGPUCount
agsInit
agsSetDisplayMode
msgpack_object_equal
msgpack_object_print
msgpack_object_print_buffer
msgpack_pack_object
msgpack_unpack
msgpack_unpack_next
msgpack_unpacker_data
msgpack_unpacker_destroy
msgpack_unpacker_execute
msgpack_unpacker_expand_buffer
msgpack_unpacker_flush_zone
msgpack_unpacker_free
msgpack_unpacker_init
msgpack_unpacker_new
msgpack_unpacker_next
msgpack_unpacker_next_with_size
msgpack_unpacker_release_zone
msgpack_unpacker_reset
msgpack_unpacker_reset_zone
msgpack_version
msgpack_version_major
msgpack_version_minor
msgpack_version_revision
msgpack_vrefbuffer_append_copy
msgpack_vrefbuffer_append_ref
msgpack_vrefbuffer_clear
msgpack_vrefbuffer_destroy
msgpack_vrefbuffer_init
msgpack_vrefbuffer_migrate
msgpack_zone_clear
msgpack_zone_destroy
msgpack_zone_free
msgpack_zone_init
msgpack_zone_is_empty
msgpack_zone_malloc_expand
msgpack_zone_new
opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_encode
opus_encode_float
opus_encoder_create
opus_encoder_ctl
opus_encoder_destroy
opus_encoder_get_size
opus_encoder_init
opus_get_version_string
opus_multistream_decode
opus_multistream_decode_float
opus_multistream_decoder_create
opus_multistream_decoder_ctl
opus_multistream_decoder_destroy
opus_multistream_decoder_get_size
opus_multistream_decoder_init
opus_multistream_packet_pad
opus_multistream_packet_unpad
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_pad
opus_packet_parse
opus_packet_unpad
opus_pcm_soft_clip
opus_repacketizer_cat
opus_repacketizer_create
opus_repacketizer_destroy
opus_repacketizer_get_nb_frames
opus_repacketizer_get_size
opus_repacketizer_init
opus_repacketizer_out
opus_repacketizer_out_range
opus_strerror
src_callback_new
src_callback_read
src_delete
src_error
src_float_to_int_array
src_float_to_short_array
src_get_channels
src_get_description
src_get_name
src_get_version
src_int_to_float_array
src_is_valid_ratio
src_new
src_process
src_reset
src_set_ratio
src_short_to_float_array
src_simple
src_strerror

Sections

.text
Size: 48.7MB - Virtual size: 48.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22.6MB - Virtual size: 22.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.6MB - Virtual size: 10.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

950ced556334fb8e78516583567dbddb

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

dbghelp

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

iphlpapi

setupapi

dwmapi

imm32

dsound

propsys

opengl32

dxgi

d3d9

d3d11

x3daudio1_7

xapofx1_5

xinput1_3

crypt32

winhttp

wldap32

normaliz

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-conio-l1-1-0

hid

Exports

Exports

Sections

.text Size: 48.7MB - Virtual size: 48.7MB

.rdata Size: 22.6MB - Virtual size: 22.6MB

.data Size: 4.6MB - Virtual size: 10.8MB

.pdata Size: 3.1MB - Virtual size: 3.1MB

.tls Size: 512B - Virtual size: 21B

.rodata Size: 4KB - Virtual size: 4KB

.gfids Size: 512B - Virtual size: 56B

_RDATA Size: 40KB - Virtual size: 39KB

.rsrc Size: 308KB - Virtual size: 308KB

.reloc Size: 1.9MB - Virtual size: 1.9MB

.text
Size: 48.7MB - Virtual size: 48.7MB

.rdata
Size: 22.6MB - Virtual size: 22.6MB

.data
Size: 4.6MB - Virtual size: 10.8MB

.pdata
Size: 3.1MB - Virtual size: 3.1MB

.tls
Size: 512B - Virtual size: 21B

.rodata
Size: 4KB - Virtual size: 4KB

.gfids
Size: 512B - Virtual size: 56B

_RDATA
Size: 40KB - Virtual size: 39KB

.rsrc
Size: 308KB - Virtual size: 308KB

.reloc
Size: 1.9MB - Virtual size: 1.9MB