VUJJJFwwwLFLF-june[.]zip

Resubmissions

06/04/2023, 22:57

230406-2xhzgshe4v 10

13/03/2023, 11:48

230313-nypa1acc6t 6

01/06/2022, 05:36

220601-gaj8taabgn 6

Sharing

Copy URL Twitter E-mail

General

Target

VUJJJFwwwLFLF-june.zip
Size

6.6MB
MD5

826e9eb095fd5c1474bd43f5c2999c69
SHA1

62dcff5d087d7d4a4d1aae80a6db90bc3af01e58
SHA256

4c6783e8930c1638fdc343a9ceef0362a5444c00facb2ff66929a30c98faeaf6
SHA512

8f22a338a1d8a5a87253d3927fa6e254bc36382c95d295f57047096268aa0224c92a4f1d6698c75e4c954c6b2a6e368229a38c8e51b76d8daa60d216f5adeb55
SSDEEP

196608:iBEFF/wQZm7wPx9qVY4Yi6Ttodu6fV7NfnLZHdpV9AA9n:tKwpoY4UGu6fV7NP9Hzf3Z

Score

1^/10

Malware Config

Signatures

Files

VUJJJFwwwLFLF-june.zip
.zip
dbghelp.dll
.dll regsvr32 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

A0DB34FC6FE35D429A28ADDE5467D4D7
DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
DeinitLightshot
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExportList
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
Function00001
Function00010
Function00012
Function00025
Function00033
Function00035
Function00036
Function00037
Function00039
Function00043
Function00056
Function00057
Function00058
Function00061
Function00062
Function00063
Function00064
Function00065
Function00066
Function00067
Function00068
Function00073
Function00082
Function00083
GetLoaderInterface
GetRegisteredUserName
GetTeamViewerInterface
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
InitLightshot
IsInternetConnected
JAVALI2021
MVDefragStart
MVDefragStop
MakeScreenshot
MakeScreenshotByCommand
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
OpenPages
RegistryCheck
RegistryCheckItems
RegistryImportFile
RunMVDefrag
Scintilla_DirectFunction
SearchTreeForFile
SearchTreeForFileW
SetRegistryItem
SetTranslations
StackWalk
StackWalk64
StopMVDefrag
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymCleanup
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
__CxxFrameHandler4
__NLG_Dispatch2
__NLG_Return2
__mingwthr_key_dtor
__mingwthr_remove_key_dtor
_libiconv_version
block
chksym
dbghelp
dh
fptr
homedir
itoldyouso
libiconv
libiconv_close
libiconv_open
libiconvctl
libiconvlist
lmi
lminfo
locale_charset
omap
png_access_version_number
png_build_grayscale_palette
png_calloc
png_chunk_error
png_chunk_warning
png_convert_from_struct_tm
png_convert_from_time_t
png_convert_to_rfc1123
png_create_info_struct
png_create_read_struct
png_create_read_struct_2
png_create_write_struct
png_create_write_struct_2
png_data_freer
png_destroy_info_struct
png_destroy_read_struct
png_destroy_write_struct
png_error
png_free
png_free_data
png_free_default
png_get_IHDR
png_get_PLTE
png_get_bKGD
png_get_bit_depth
png_get_cHRM
png_get_cHRM_fixed
png_get_channels
png_get_chunk_cache_max
png_get_chunk_malloc_max
png_get_color_type
png_get_compression_buffer_size
png_get_compression_type
png_get_copyright
png_get_error_ptr
png_get_filter_type
png_get_gAMA
png_get_gAMA_fixed
png_get_hIST
png_get_header_ver
png_get_header_version
png_get_iCCP
png_get_image_height
png_get_image_width
png_get_interlace_type
png_get_io_chunk_name
png_get_io_ptr
png_get_io_state
png_get_libpng_ver
png_get_mem_ptr
png_get_oFFs
png_get_pCAL
png_get_pHYs
png_get_pixel_aspect_ratio
png_get_pixels_per_meter
png_get_progressive_ptr
png_get_rgb_to_gray_status
png_get_rowbytes
png_get_rows
png_get_sBIT
png_get_sCAL
png_get_sPLT
png_get_sRGB
png_get_signature
png_get_tIME
png_get_tRNS
png_get_text
png_get_uint_31
png_get_unknown_chunks
png_get_user_chunk_ptr
png_get_user_height_max
png_get_user_transform_ptr
png_get_user_width_max
png_get_valid
png_get_x_offset_microns
png_get_x_offset_pixels
png_get_x_pixels_per_meter
png_get_y_offset_microns
png_get_y_offset_pixels
png_get_y_pixels_per_meter
png_handle_as_unknown
png_info_init_3
png_init_io
png_malloc
png_malloc_default
png_malloc_warn
png_permit_mng_features
png_process_data
png_progressive_combine_row
png_read_end
png_read_image
png_read_info
png_read_png
png_read_row
png_read_rows
png_read_update_info
png_reset_zstream
png_save_int_32
png_save_uint_16
png_save_uint_32
png_set_IHDR
png_set_PLTE
png_set_add_alpha
png_set_bKGD
png_set_background
png_set_bgr
png_set_cHRM
png_set_cHRM_fixed
png_set_chunk_cache_max
png_set_chunk_malloc_max
png_set_compression_buffer_size
png_set_compression_level
png_set_compression_mem_level
png_set_compression_method
png_set_compression_strategy
png_set_compression_window_bits
png_set_crc_action
png_set_error_fn
png_set_expand
png_set_expand_gray_1_2_4_to_8
png_set_filler
png_set_filter
png_set_filter_heuristics
png_set_flush
png_set_gAMA
png_set_gAMA_fixed
png_set_gamma
png_set_gray_to_rgb
png_set_hIST
png_set_iCCP
png_set_interlace_handling
png_set_invalid
png_set_invert_alpha
png_set_invert_mono
png_set_keep_unknown_chunks
png_set_longjmp_fn
png_set_mem_fn
png_set_oFFs
png_set_pCAL
png_set_pHYs
png_set_packing
png_set_packswap
png_set_palette_to_rgb
png_set_progressive_read_fn
png_set_quantize
png_set_read_fn
png_set_read_status_fn
png_set_read_user_chunk_fn
png_set_read_user_transform_fn
png_set_rgb_to_gray
png_set_rgb_to_gray_fixed
png_set_rows
png_set_sBIT
png_set_sCAL
png_set_sPLT
png_set_sRGB
png_set_sRGB_gAMA_and_cHRM
png_set_shift
png_set_sig_bytes
png_set_strip_16
png_set_strip_alpha
png_set_swap
png_set_swap_alpha
png_set_tIME
png_set_tRNS
png_set_tRNS_to_alpha
png_set_text
png_set_unknown_chunk_location
png_set_unknown_chunks
png_set_user_limits
png_set_user_transform_info
png_set_write_fn
png_set_write_status_fn
png_set_write_user_transform_fn
png_sig_cmp
png_start_read_image
png_warning
png_write_chunk
png_write_chunk_data
png_write_chunk_end
png_write_chunk_start
png_write_end
png_write_flush
png_write_image
png_write_info
png_write_info_before_PLTE
png_write_png
png_write_row
png_write_rows
png_write_sig
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

CODE
Size: 9.7MB - Virtual size: 9.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 10KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 269.4MB - Virtual size: 269.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
uires.dll
.dll windows x86

Code Sign

2b:70:75:a7:50:5d:97:82:4e:f3:d4:aa:68:28:aa:3f
Certificate

Issuer

CN=TestCert_2019-4-20_14-38-28

Not Before

20/04/2019, 11:28

Not After

20/04/2020, 11:48

Subject

CN=TestCert_2019-4-20_14-38-28

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0b:64:d8:e6:ce:c3:f6:b8:28:77:cd:7f:c4:df:ed:9c:c5:ca:90:f8:34:1d:f2:55:80:0a:fb:0f:be:4d:4c:49
Signer

Actual PE Digest

0b:64:d8:e6:ce:c3:f6:b8:28:77:cd:7f:c4:df:ed:9c:c5:ca:90:f8:34:1d:f2:55:80:0a:fb:0f:be:4d:4c:49

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=TestCert_2019-4-20_14-38-28

23/04/2019, 09:37
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11.2MB - Virtual size: 11.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
umvg6yh.exe
.exe windows x86

64f92d254e774639c1bf3e182fe2187d

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:7d:59:66:04:91:55:be:bf:38:3f:fb:0b:e3:29:10
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

06/03/2020, 00:00

Not After

05/03/2023, 23:59

Subject

CN=Caphyon SRL,OU=SECURE APPLICATION DEVELOPMENT,O=Caphyon SRL,L=Craiova,ST=Dolj,C=RO

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:4e:68:33:fb:f2:e6:06:08:60:40:66:9f:e0:eb:13:7f:82:67:df:a5:3b:e1:ae:86:ea:99:29:89:62:50:d7
Signer

Actual PE Digest

35:4e:68:33:fb:f2:e6:06:08:60:40:66:9f:e0:eb:13:7f:82:67:df:a5:3b:e1:ae:86:ea:99:29:89:62:50:d7

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Caphyon SRL,OU=SECURE APPLICATION DEVELOPMENT,O=Caphyon SRL,L=Craiova,ST=Dolj,C=RO

30/08/2021, 15:20
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord92
ord74
ord94
ord8

kernel32

WideCharToMultiByte
AttachConsole
FreeConsole
AllocConsole
GetConsoleWindow
GetModuleHandleW
DecodePointer
LocalFree
SetConsoleTitleW
GetExitCodeThread
CreateThread
WaitForSingleObject
LoadLibraryExA
SetEndOfFile
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
ReadConsoleW
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
GetTimeZoneInformation
GetFileType
ExitProcess
GetConsoleCP
TlsFree
TlsSetValue
TlsGetValue
LocalFileTimeToFileTime
RtlUnwind
GetCurrentProcessId
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetLocaleInfoEx
GetSystemTimeAsFileTime
QueryPerformanceCounter
WaitForSingleObjectEx
GetCPInfo
CompareStringEx
DosDateTimeToFileTime
WriteFile
CreateFileW
CloseHandle
VirtualFree
MulDiv
SetLastError
Sleep
MultiByteToWideChar
GetEnvironmentVariableW
GetModuleFileNameW
GetTempPathW
GetWindowsDirectoryW
SetFileTime
RaiseException
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
DeleteFileW
lstrcmpiW
FreeLibrary
GetPrivateProfileSectionW
GetLastError
LoadLibraryW
LoadLibraryExW
GetProcessHeap
HeapAlloc
HeapFree
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetFullPathNameW
GetModuleFileNameA
LoadLibraryA
FormatMessageW
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
FlushFileBuffers
SetConsoleOutputCP
GetConsoleOutputCP
SizeofResource
GetSystemDirectoryW
GetProcAddress
GetEnvironmentStringsW
GetCurrentThread
DuplicateHandle
LCMapStringEx
GetModuleHandleExW
SetUnhandledExceptionFilter
InitializeCriticalSection
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleTextAttribute
MoveFileW
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
TlsAlloc
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
SleepConditionVariableSRW
TerminateThread
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetSystemInfo
VirtualProtect
VirtualQuery
GetShortPathNameW
GetFileAttributesW
SetFileAttributesW
GetStringTypeW
ExpandEnvironmentStringsW
ReadFile
GetTempFileNameW
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
CreateDirectoryW
CopyFileW
GetLogicalDriveStringsW
GetFileSize
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetCurrentProcess
QueryDosDeviceW
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
CreateProcessW
GetExitCodeProcess
SetFilePointer

user32

LoadStringW
GetSystemMetrics
UnregisterClassW
GetActiveWindow
SetWindowLongW
IsRectEmpty
DialogBoxIndirectParamW
GetClientRect
GetPropW
PostQuitMessage
RegisterWindowMessageW
SetPropW
RemovePropW
KillTimer
MessageBeep
SetTimer
CallWindowProcW
SetDlgItemTextW
DefWindowProcW
CharNextW
keybd_event
LoadImageW
SetFocus
MoveWindow
ScreenToClient
PtInRect
GetComboBoxInfo
GetWindowTextLengthW
GetWindowTextW
EnableWindow
ReleaseDC
GetDC
InvalidateRect
RedrawWindow
IsWindowVisible
ShowWindow
DialogBoxParamW
EndDialog
CreateWindowExW
DestroyWindow
SetWindowTextW
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
MapWindowPoints
GetDlgItem
GetWindowLongW
SetWindowPos
ModifyMenuW
GetSystemMenu
SendMessageW
PostMessageW
IsWindow
ClientToScreen

gdi32

CreateFontIndirectW
CreateFontW
GetObjectW
GetDeviceCaps
CreateCompatibleDC
DeleteDC
CreateCompatibleBitmap
DeleteObject
SelectObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

CryptHashData
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
CryptAcquireContextW
IsTextUnicode
CryptCreateHash
CryptReleaseContext
CryptDestroyHash
CryptDeriveKey
CryptEncrypt
CryptDestroyKey
CryptDecrypt
RegCloseKey

shell32

SHGetSpecialFolderLocation
SHGetMalloc
SHGetFolderPathW
SHGetPathFromIDListW

ole32

CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString
VarUI4FromStr
SysStringLen

zlibai

unzOpenW
unzLocateFile
unzGetCurrentFileInfo
unzOpenCurrentFile
unzReadCurrentFile
unzCloseCurrentFile
unzClose

shlwapi

PathIsDirectoryW
PathIsUNCW

comctl32

CreatePropertySheetPageW
InitCommonControlsEx
DestroyPropertySheetPage
PropertySheetW

dbghelp

SymGetLineFromAddr
SymFunctionTableAccess
SymSetSearchPath
SymCleanup
SymSetOptions
StackWalk
SymInitialize
SymGetModuleBase

psapi

GetMappedFileNameW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 675KB - Virtual size: 675KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zlibai.dll
.dll windows x86

87587cfcb7975e6d58d7a436bfc00fe8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetStdHandle
GetFileType
HeapFree
CloseHandle
WriteFile
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
CreateFileW
SetStdHandle
FlushFileBuffers
GetStringTypeW
HeapSize
HeapReAlloc
SetEndOfFile
WriteConsoleW
DecodePointer

Exports

Exports

adler32
adler32_combine
adler32_combine64
compress
compress2
compressBound
crc32
crc32_combine
crc32_combine64
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
fill_fopen_filefunc
get_crc_table
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
uncompress
unzClose
unzCloseCurrentFile
unzGetCurrentFileInfo
unzGoToFirstFile
unzGoToNextFile
unzLocateFile
unzOpenCurrentFile
unzOpenW
unzReadCurrentFile
zError
zipClose
zipCloseFileInZip
zipOpen
zipOpen2
zipOpenNewFileInZip
zipWriteInFileInZip
zlibCompileFlags
zlibVersion

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 9.7MB - Virtual size: 9.7MB

DATA Size: 75KB - Virtual size: 75KB

BSS Size: - Virtual size: 10KB

.idata Size: 14KB - Virtual size: 13KB

.edata Size: 13KB - Virtual size: 12KB

.reloc Size: 172KB - Virtual size: 171KB

.rsrc Size: 269.4MB - Virtual size: 269.4MB

Code Sign

2b:70:75:a7:50:5d:97:82:4e:f3:d4:aa:68:28:aa:3fCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

0b:64:d8:e6:ce:c3:f6:b8:28:77:cd:7f:c4:df:ed:9c:c5:ca:90:f8:34:1d:f2:55:80:0a:fb:0f:be:4d:4c:49Signer

Signature Validations

Verification

23/04/2019, 09:37 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 284B

.rsrc Size: 11.2MB - Virtual size: 11.2MB

64f92d254e774639c1bf3e182fe2187d

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

79:7d:59:66:04:91:55:be:bf:38:3f:fb:0b:e3:29:10Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

35:4e:68:33:fb:f2:e6:06:08:60:40:66:9f:e0:eb:13:7f:82:67:df:a5:3b:e1:ae:86:ea:99:29:89:62:50:d7Signer

Signature Validations

Verification

30/08/2021, 15:20 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

zlibai

shlwapi

comctl32

dbghelp

psapi

version

Sections

.text Size: 675KB - Virtual size: 675KB

.rdata Size: 169KB - Virtual size: 169KB

.data Size: 13KB - Virtual size: 19KB

.rsrc Size: 4KB - Virtual size: 4KB

CODE
Size: 9.7MB - Virtual size: 9.7MB

DATA
Size: 75KB - Virtual size: 75KB

BSS
Size: - Virtual size: 10KB

.idata
Size: 14KB - Virtual size: 13KB

.edata
Size: 13KB - Virtual size: 12KB

.reloc
Size: 172KB - Virtual size: 171KB

.rsrc
Size: 269.4MB - Virtual size: 269.4MB

2b:70:75:a7:50:5d:97:82:4e:f3:d4:aa:68:28:aa:3f
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

0b:64:d8:e6:ce:c3:f6:b8:28:77:cd:7f:c4:df:ed:9c:c5:ca:90:f8:34:1d:f2:55:80:0a:fb:0f:be:4d:4c:49
Signer

23/04/2019, 09:37
Valid: false

.rdata
Size: 512B - Virtual size: 284B

.rsrc
Size: 11.2MB - Virtual size: 11.2MB

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

79:7d:59:66:04:91:55:be:bf:38:3f:fb:0b:e3:29:10
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

35:4e:68:33:fb:f2:e6:06:08:60:40:66:9f:e0:eb:13:7f:82:67:df:a5:3b:e1:ae:86:ea:99:29:89:62:50:d7
Signer

30/08/2021, 15:20
Valid: false

.text
Size: 675KB - Virtual size: 675KB

.rdata
Size: 169KB - Virtual size: 169KB

.data
Size: 13KB - Virtual size: 19KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 38KB - Virtual size: 38KB

.text
Size: 111KB - Virtual size: 110KB

.rdata
Size: 42KB - Virtual size: 41KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB