bazarbackdoor | HorizonZeroDawn[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

HorizonZeroDawn.exe
Size

44.6MB
MD5

9a279f42983baa6994141359648fa687
SHA1

e412af2111f0b362cbbf19af9875fbe7fa6f30ef
SHA256

98134dfdc92fc286fcb45e7f39f5b5c8a8008d0f25389122321e551afc58ee6e
SHA512

89e4e4208d215d91825ddd492982a212ae7dd5158d6d4204bfe70bbfe09dbe3fc47f418608a5567f2961cf7e8bdd69461a40445b45ba3bfd56893a146a2bc19d
SSDEEP

393216:XOavIP1JONAl66HWfsAu1rPT2J5vnipL6tqhBq39xWGXPJXE96apOx4JEWZM:+aFDuB2YLpePZPJXEg8EZ

Score

10^/10

bazarbackdoor

Malware Config

Signatures

Bazar/Team9 Backdoor payload 1 IoCs

resource	yara_rule
sample	BazarBackdoorVar3

Bazarbackdoor family
bazarbackdoor

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HorizonZeroDawn.exe

Files

HorizonZeroDawn.exe
.exe windows x64

03f118b18cc16db971fb502e0c2bdd3f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WakeAllConditionVariable
WaitForSingleObjectEx
WideCharToMultiByte
GetCurrentThreadId
SetEvent
CreateEventExA
SetHandleInformation
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
GetActiveProcessorCount
GetCurrentThread
SleepConditionVariableSRW
DuplicateHandle
GetCurrentProcess
SetThreadPriority
SetThreadAffinityMask
SetThreadGroupAffinity
ResumeThread
SwitchToThread
GetLogicalProcessorInformationEx
GetUserDefaultLocaleName
FlushFileBuffers
CreateNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
CreateFileMappingA
GetModuleHandleExA
GetComputerNameA
GetComputerNameExA
IsDebuggerPresent
SetUnhandledExceptionFilter
SetThreadExecutionState
VirtualQueryEx
CreateToolhelp32Snapshot
Process32Next
Process32First
GlobalAlloc
GlobalFree
MultiByteToWideChar
RtlCaptureStackBackTrace
SetCurrentDirectoryA
LoadLibraryExA
GetVersionExA
CreateProcessA
TerminateThread
GetExitCodeProcess
SetNamedPipeHandleState
CreatePipe
MapViewOfFile
SetConsoleTitleA
TlsAlloc
TlsSetValue
TlsFree
DebugBreak
LocalFree
TlsGetValue
GetFileSize
GetProcessTimes
OpenThread
GetThreadTimes
GetSystemTimes
GlobalMemoryStatusEx
K32GetProcessMemoryInfo
SignalObjectAndWait
GetThreadPriority
ExitThread
GetExitCodeThread
GetLogicalDrives
GetStdHandle
OutputDebugStringW
SetConsoleTextAttribute
PulseEvent
GetProcessAffinityMask
GetTimeFormatA
GetDateFormatA
InitializeConditionVariable
GlobalLock
FreeResource
CreateWaitableTimerW
EnumResourceNamesA
EnumResourceTypesA
FindResourceA
SizeofResource
LockResource
LoadResource
GetModuleHandleA
CreateSemaphoreA
ReleaseSemaphore
ReleaseMutex
CreateMutexA
CreateThread
WaitForSingleObject
SleepEx
Sleep
FindClose
FindNextFileW
FindFirstFileExW
FindFirstFileW
ExpandEnvironmentStringsA
GetDiskFreeSpaceA
SetFileAttributesW
GetFileAttributesW
GetFileAttributesA
GetFullPathNameW
GetFullPathNameA
GetLongPathNameA
GetCurrentDirectoryA
RemoveDirectoryW
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleHandleExW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
OpenFile
CreateWaitableTimerA
CancelWaitableTimer
SetWaitableTimer
GetThreadId
GetLogicalProcessorInformation
SleepConditionVariableCS
VerifyVersionInfoA
lstrcmpW
GetLocalTime
InitializeCriticalSectionAndSpinCount
MoveFileExW
GetNamedPipeInfo
GetFileSizeEx
WaitNamedPipeW
CreateNamedPipeW
TransactNamedPipe
ReadProcessMemory
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
GetVersion
FlushInstructionCache
CreateEventW
GetFileType
CreateSemaphoreW
LoadLibraryW
CreateMutexW
VirtualUnlock
GetLargePageMinimum
VirtualProtect
FlsSetValue
FlsAlloc
VerifyVersionInfoW
lstrcmpA
LocalAlloc
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
GetSystemDirectoryW
CreateProcessW
CompareFileTime
VerSetConditionMask
ReadDirectoryChangesW
QueryDosDeviceA
GetCommandLineA
CreateDirectoryW
CopyFileW
GlobalUnlock
GetDriveTypeA
MoveFileW
DeleteFileW
SetFileTime
SetFilePointer
SetEndOfFile
ReadFile
WriteFile
CreateFileW
CreateFileA
ResetEvent
CreateEventA
GetOverlappedResult
GetTimeZoneInformation
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
LoadLibraryA
GetProcAddress
FreeLibrary
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeSRWLock
GlobalMemoryStatus
VirtualQuery
GetSystemInfo
GetTickCount
FormatMessageA
VirtualFree
VirtualAlloc
LeaveCriticalSection
TryEnterCriticalSection
EnterCriticalSection
InitializeCriticalSection
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
TerminateProcess
OpenProcess
GetCurrentProcessId
CloseHandle
GetModuleFileNameA
FileTimeToSystemTime

user32

GetKeyState
GetKeyboardLayout
RegisterRawInputDevices
GetRawInputData
SetWindowsHookExA
CharLowerBuffA
PostThreadMessageA
UnhookWindowsHookEx
ClientToScreen
GetSystemMetrics
SetCapture
ReleaseCapture
FlashWindowEx
GetClientRect
SetCursor
LoadCursorA
MapVirtualKeyA
ClipCursor
WindowFromPoint
UnregisterClassA
GetDoubleClickTime
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
EnumDisplaySettingsA
SetCursorPos
GetCursorPos
MessageBoxA
LoadIconA
ScreenToClient
BeginPaint
EndPaint
FillRect
PostQuitMessage
CreateWindowExA
DestroyWindow
SetForegroundWindow
RegisterClassA
SetWindowPos
SetWindowTextA
AdjustWindowRectEx
ShowCursor
IsWindowVisible
PostMessageA
MoveWindow
OpenClipboard
GetWindowRect
CountClipboardFormats
EmptyClipboard
GetScrollRange
GetWindowLongPtrA
GetDlgItem
SendMessageA
SetActiveWindow
BringWindowToTop
GetActiveWindow
GetLastActivePopup
GetDesktopWindow
GetClassNameA
GetWindowLongA
SetFocus
RegisterClassExA
GetDlgCtrlID
GetFocus
GetAsyncKeyState
EnableWindow
UpdateWindow
InvalidateRect
GetWindow
IsDialogMessageA
DialogBoxIndirectParamA
EndDialog
SendDlgItemMessageA
EnumDisplayDevicesA
GetMonitorInfoA
EnumDisplayMonitors
GetParent
GetCapture
IsWindow
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
ReleaseDC
OffsetRect
IsRectEmpty
EqualRect
EnumChildWindows
DestroyCursor
LoadBitmapW
GetDC
RedrawWindow
SetRect
DrawEdge
ShowScrollBar
UnionRect
FrameRect
CreatePopupMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuA
AppendMenuA
RemoveMenu
GetMenuItemInfoA
MessageBoxW
SystemParametersInfoA
SetWindowLongPtrA
ShowWindow
IsIconic
DefWindowProcA
CallWindowProcA
LoadImageA
CloseClipboard
GetClassInfoA
GetWindowDC
GetForegroundWindow
PtInRect
InflateRect
GetTopWindow
GetWindowPlacement
CallNextHookEx
GetSysColor

gdi32

SetPixelV
GetTextColor
CreateCompatibleBitmap
FillRgn
CombineRgn
StretchBlt
CreateSolidBrush
CreateRectRgn
CreateCompatibleDC
CreateFontIndirectA
DeleteDC
DeleteObject
GetGlyphOutlineA
GetGlyphOutlineW
GetGlyphIndicesW
AddFontMemResourceEx
RemoveFontMemResourceEx
SelectObject
Polyline
GetStockObject
PatBlt
CreatePolyPolygonRgn
BitBlt
CreateBitmapIndirect
CreateDIBitmap
CreatePen
GetBitmapBits
GetDIBits
GetPixel
Rectangle
SetBitmapBits
SetDIBits
SetDIBitsToDevice
StretchDIBits
GetObjectA
Polygon
GetTextExtentPoint32A

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

advapi32

SystemFunction036
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildExplicitAccessWithNameW
BuildSecurityDescriptorW
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
ReportEventA
RegisterEventSourceA
DeregisterEventSource
GetUserNameW
RegOpenKeyA
CredFree
CredWriteA
CredReadA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExA
RegSetValueExA
GetUserNameA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegEnumKeyA

shell32

SHGetPathFromIDListA
ShellExecuteA
SHCreateDirectoryExA
SHGetMalloc
SHGetSpecialFolderPathA
SHBrowseForFolderA
SHGetFolderPathA

ole32

CoInitializeEx
OleUninitialize
OleInitialize
CoSetProxyBlanket
CoQueryProxyBlanket
CoUninitialize
CoInitialize
OleSetContainedObject
OleCreate
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
PropVariantClear
CoCreateGuid
CLSIDFromString

oleaut32

SafeArrayDestroy
VariantInit
VariantClear
SysFreeString
SysAllocString
SafeArrayCreate
SafeArrayAccessData
SysStringLen

iphlpapi

GetNetworkParams
GetAdaptersAddresses
GetUdpStatistics
GetAdaptersInfo

shlwapi

ord219

dbghelp

MiniDumpWriteDump

d3d12

ord102
ord101
D3D12SerializeRootSignature

dxgi

CreateDXGIFactory1
CreateDXGIFactory
CreateDXGIFactory2

gdiplus

GdipAlloc
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenDashStyle
GdipSetPenDashArray
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipCreateBitmapFromGraphics
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawLinesI
GdipDrawRectangle
GdipFillRectangle
GdipDrawImageI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipDrawString
GdipCreateRegion
GdipDeleteRegion
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetDC
GdipReleaseDC
GdipDrawRectangleI
GdipSetClipRectI
GdipSetClipRegion
GdipGetClip
GdipSetSolidFillColor
GdipGetImageWidth
GdipGetImageHeight
GdipFillRectangleI
GdipFillPolygonI
GdipFree

winmm

timeEndPeriod
timeSetEvent
timeKillEvent
waveOutGetNumDevs
waveOutGetDevCapsA
waveOutGetErrorTextA
timeGetTime
waveOutClose
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
waveOutPause
waveOutRestart
waveOutReset
waveOutGetPosition
waveOutMessage
waveInGetNumDevs
waveInGetDevCapsA
waveInGetErrorTextA
waveInOpen
waveInClose
waveInPrepareHeader
waveInUnprepareHeader
waveInAddBuffer
timeGetDevCaps
timeBeginPeriod
waveInStart
waveInReset
waveInMessage
waveOutOpen

winhttp

WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpSetTimeouts
WinHttpConnect
WinHttpReceiveResponse
WinHttpOpen
WinHttpSetStatusCallback
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpCloseHandle

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoUninitialize
RoInitialize

ws2_32

inet_ntop
inet_pton
freeaddrinfo
getaddrinfo
gethostname
WSASetLastError
gethostbyaddr
gethostbyname
__WSAFDIsSet
accept
bind
closesocket
connect
ioctlsocket
getpeername
getsockname
getsockopt
htonl
listen
recv
select
setsockopt
shutdown
socket
WSAStartup
WSACleanup
WSAGetLastError
WSAIoctl
WSARecv
WSARecvFrom
WSASend
WSASendTo
htons
WSASocketW
inet_addr
inet_ntoa
recvfrom
send
sendto
ntohl
ntohs

api-ms-win-core-versionansi-l1-1-0

VerQueryValueA

api-ms-win-core-errorhandling-l1-1-0

SetLastError

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
GetEnvironmentVariableA

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetSystemTime
GetWindowsDirectoryA

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegQueryValueExW
RegDeleteValueA

api-ms-win-core-console-l1-1-0

SetConsoleMode
GetConsoleCP
GetConsoleMode

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetACP

api-ms-win-core-file-l1-1-0

UnlockFileEx
GetLongPathNameW
FindFirstFileA
SetFilePointerEx
SetFileAttributesA
RemoveDirectoryA
GetFileTime
GetFileInformationByHandle
LockFileEx

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime

comctl32

ord17

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?_Xout_of_range@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Xbad_alloc@std@@YAXXZ
_Mbrtowc
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z

mfc140

ord310
ord305
ord2917
ord8788
ord4086
ord3157
ord6565
ord13784
ord8432
ord2182
ord2305
ord5225
ord5331
ord6698
ord7153
ord4420
ord2349
ord1409
ord13459
ord3261
ord3147
ord6557
ord7204
ord446
ord3705
ord10075
ord2899
ord12913
ord12692
ord5227
ord1448
ord983
ord1053
ord361
ord1367
ord878
ord1084
ord4021
ord4489
ord4490
ord13479
ord12707
ord12708
ord438
ord2471
ord4710
ord6527
ord2473
ord2207
ord1118
ord2796
ord14146
ord11981
ord12670
ord11594
ord488
ord5547
ord10636
ord8944
ord8773
ord8670
ord10175
ord11375
ord5049
ord9789
ord10144
ord10239
ord11109
ord14070
ord7566
ord5409
ord3944
ord1119
ord489
ord5986
ord6287
ord5731
ord8692
ord10656
ord8779
ord1051
ord4069
ord3051
ord6230
ord10117
ord7364
ord1450
ord12652
ord13876
ord4715
ord6595
ord4711
ord12390
ord5729
ord1686
ord4760
ord4836
ord4821
ord8780
ord8401
ord4070
ord9941
ord7519
ord4993
ord12952
ord3052
ord6233
ord6749
ord5752
ord8785
ord1156
ord7749
ord4075
ord7744
ord13242
ord6322
ord4334
ord4326
ord2264
ord13680
ord8784
ord1155
ord2687
ord14113
ord3740
ord2902
ord8404
ord4074
ord3091
ord6321
ord1421
ord11761
ord5980
ord13327
ord2695
ord8863
ord11802
ord1087
ord8693
ord10657
ord3943
ord3299
ord1674
ord3066
ord6264
ord5896
ord5982
ord13331
ord3205
ord3202
ord9903
ord7881
ord2696
ord14279
ord9933
ord9935
ord9934
ord9932
ord9936
ord5435
ord11365
ord11366
ord8792
ord11719
ord3710
ord11575
ord14128
ord8618
ord11850
ord6703
ord10644
ord8909
ord3166
ord13438
ord11892
ord11888
ord1695
ord1717
ord1743
ord1729
ord1750
ord4765
ord4832
ord4777
ord4795
ord4789
ord4783
ord4842
ord4826
ord4771
ord4848
ord4803
ord4741
ord4756
ord4817
ord4351
ord5566
ord9343
ord4343
ord2962
ord14136
ord7620
ord14134
ord14047
ord8413
ord6607
ord11357
ord13284
ord5704
ord5224
ord7430
ord2627
ord11754
ord3804
ord3270
ord3271
ord5213
ord11798
ord988
ord3591
ord3689
ord6226
ord3748
ord6299
ord14197
ord12035
ord14144
ord11978
ord4648
ord1507
ord1032
ord7431
ord316
ord6483
ord2338
ord2342
ord2344
ord8131
ord7363
ord1446
ord8050
ord11877
ord10079
ord12552
ord12490
ord4436
ord7685
ord7989
ord5167
ord10026
ord2437
ord12171
ord12170
ord14135
ord7619
ord14133
ord9049
ord4002
ord3941
ord12571
ord7637
ord2004
ord11615
ord11614
ord14007
ord12160
ord7688
ord14207
ord6100
ord14209
ord6102
ord14208
ord6101
ord981
ord6590
ord3723
ord5687
ord11869
ord7888
ord11881
ord11849
ord5064
ord5347
ord5536
ord9001
ord5323
ord5539
ord5691
ord6229
ord357
ord6292
ord13689
ord8471
ord13683
ord13135
ord2684
ord2310
ord2217
ord6533
ord3138
ord3258
ord1381
ord5221
ord448
ord6612
ord13493
ord12667
ord13492
ord11544
ord6544
ord886
ord8465
ord8029
ord8009
ord9118
ord7396
ord14114
ord300
ord6340
ord3795
ord4714
ord2477
ord4077
ord8405
ord6237
ord3053
ord4072
ord8403
ord3738
ord2901
ord1055
ord8781
ord3300
ord1504
ord7420
ord5211
ord8862
ord9898
ord11037
ord7890
ord5067
ord9912
ord3165

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

imm32

ImmAssociateContext

version

GetFileVersionInfoSizeA
GetFileVersionInfoA

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameA

setupapi

SetupDiGetClassDevsA
SetupDiSetDeviceInstallParamsA
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo

vcruntime140

_set_purecall_handler
_purecall
strstr
memmove
memcpy
memcmp
strchr
strrchr
__std_terminate
memset
_CxxThrowException
longjmp
memchr
__C_specific_handler
__RTDynamicCast
wcschr
wcsrchr
wcsstr
__CxxFrameHandler3
__current_exception
__current_exception_context
__intrinsic_setjmp
__std_type_info_destroy_list

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

_msize
_set_new_mode
calloc
_aligned_free
_aligned_malloc
_aligned_msize
free
malloc
_recalloc
realloc

api-ms-win-crt-string-l1-1-0

strncpy
strncat
strcmp
strncmp
wcstok
_wcsupr
wcsncpy_s
strpbrk
strncpy_s
_memccpy
strcpy_s
_strnicmp
strcat_s
_wcsnicmp
wcscpy_s
strncat_s
_wcsicmp
toupper
iscntrl
isalnum
isprint
tolower
_stricmp
strcoll
strcspn
isalpha
isupper
islower
isdigit
isxdigit
isspace
ispunct
strtok_s

api-ms-win-crt-runtime-l1-1-0

_endthread
abort
_beginthread
_wassert
_seh_filter_dll
_configure_narrow_argv
_endthreadex
_beginthreadex
_initialize_narrow_environment
_exit
signal
_clearfp
_invalid_parameter_noinfo_noreturn
_invoke_watson
exit
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_invalid_parameter_noinfo
_errno
_crt_atexit
_crt_at_quick_exit
strerror
_cexit
terminate
_seh_filter_exe
_set_app_type
_get_narrow_winmain_command_line
_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_controlfp

api-ms-win-crt-stdio-l1-1-0

_set_fmode
ferror
fflush
fgets
fopen
fwrite
getc
_pclose
_popen
setvbuf
ungetc
__stdio_common_vfscanf
freopen
__p__commode
__stdio_common_vsscanf
_close
__stdio_common_vfwprintf
__stdio_common_vfwprintf_p
__stdio_common_vfwscanf
_wopen
__stdio_common_vswprintf
__stdio_common_vswprintf_s
_lseek
fputs
fputc
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
_open
__stdio_common_vswprintf_p
ftell
fseek
fread
feof
fclose
fopen_s
__stdio_common_vswscanf
fgetc
__stdio_common_vfprintf_s
__stdio_common_vfprintf_p
__stdio_common_vsprintf_p
_fileno
putchar
_wfopen
_get_osfhandle
__stdio_common_vfwprintf_s
_pipe
_read
_write
_setmode
_setmaxstdio
__stdio_common_vsprintf_s
_getcwd
_fseeki64
fsetpos
_wsopen_s
_wsopen_dispatch
_lseeki64
fgetpos
_get_stream_buffer_pointers
setbuf
clearerr
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-math-l1-1-0

ldexp
log
sin
floor
sqrtf
asin
log10
cos
atan2
atan
tanf
acos
exp
coshf
expf
hypot
sqrt
_copysignf
_finite
ceil
floorf
powf
modf
fmod
ceilf
atanf
tan
__setusermatherr
log10f
cosf
fmin
fmax
modff
fmodf
acosf
asinf
pow
sinhf
atan2f
sinf
logf

api-ms-win-crt-convert-l1-1-0

atof
strtod
strtoll
strtoull
strtol
_strtod_l
atoi
strtoul
_strtoi64_l
_strtoi64
_strtoui64_l

api-ms-win-crt-time-l1-1-0

_mkgmtime64
_mktime64
clock
_time64
_gmtime64_s
_ctime64
strftime
_localtime64
_gmtime64
asctime
__tzname

api-ms-win-crt-multibyte-l1-1-0

_mbctolower
_mbsnbcpy

api-ms-win-crt-utility-l1-1-0

_lfind
qsort
rand
rand_s
abs
bsearch

api-ms-win-crt-filesystem-l1-1-0

_makepath_s
_fullpath
_unlock_file
_splitpath_s
_mkdir
_rmdir
_umask
_stat64i32
_wrmdir
_wmkdir
_findnext64i32
_findfirst64i32
_findclose
_wfindnext64i32
_wfindfirst64i32
_fstat64i32
_lock_file
_stat64
_fstat64
rename
_chmod
_unlink
_wstat64
_wrename
_wunlink
_wchmod

api-ms-win-crt-environment-l1-1-0

_wgetcwd
_putenv
getenv

api-ms-win-crt-locale-l1-1-0

_create_locale
localeconv
_configthreadlocale

api-ms-win-crt-conio-l1-1-0

_cputs

hid

HidD_GetHidGuid
HidD_GetSerialNumberString
HidD_GetProductString
HidD_GetManufacturerString
HidD_SetFeature
HidD_GetFeature
HidP_GetCaps
HidP_GetValueCaps
HidD_GetAttributes
HidD_GetPreparsedData
HidD_FreePreparsedData

Exports

Exports

sceAjmBatchCancel
sceAjmBatchErrorDump
sceAjmBatchJobControlBufferRa
sceAjmBatchJobInlineBuffer
sceAjmBatchJobRunBufferRa
sceAjmBatchJobRunSplitBufferRa
sceAjmBatchStartBuffer
sceAjmBatchWait
sceAjmDecMp3ParseFrame
sceAjmFinalize
sceAjmInitialize
sceAjmInstanceCodecType
sceAjmInstanceCreate
sceAjmInstanceDestroy
sceAjmInstanceExtend
sceAjmInstanceSwitch
sceAjmMemoryRegister
sceAjmMemoryUnregister
sceAjmModuleRegister
sceAjmModuleUnregister
sceAjmStrError

Sections

.text
Size: 26.3MB - Virtual size: 26.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8.8MB - Virtual size: 8.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7.0MB - Virtual size: 106.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 729B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CPADinfo
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 623KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

03f118b18cc16db971fb502e0c2bdd3f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

shlwapi

dbghelp

d3d12

dxgi

gdiplus

winmm

winhttp

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

ws2_32

api-ms-win-core-versionansi-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-timezone-l1-1-0

comctl32

msvcp140

mfc140

wtsapi32

imm32

version

psapi

setupapi

vcruntime140

vcruntime140_1

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-conio-l1-1-0

hid

Exports

Exports

Sections

.text Size: 26.3MB - Virtual size: 26.3MB

.rdata Size: 8.8MB - Virtual size: 8.8MB

.data Size: 7.0MB - Virtual size: 106.1MB

.pdata Size: 1.7MB - Virtual size: 1.7MB

.tls Size: 1024B - Virtual size: 729B

.gfids Size: 1024B - Virtual size: 800B

CPADinfo Size: 512B - Virtual size: 56B

_RDATA Size: 18KB - Virtual size: 17KB

.rsrc Size: 207KB - Virtual size: 207KB

.reloc Size: 623KB - Virtual size: 623KB

.text
Size: 26.3MB - Virtual size: 26.3MB

.rdata
Size: 8.8MB - Virtual size: 8.8MB

.data
Size: 7.0MB - Virtual size: 106.1MB

.pdata
Size: 1.7MB - Virtual size: 1.7MB

.tls
Size: 1024B - Virtual size: 729B

.gfids
Size: 1024B - Virtual size: 800B

CPADinfo
Size: 512B - Virtual size: 56B

_RDATA
Size: 18KB - Virtual size: 17KB

.rsrc
Size: 207KB - Virtual size: 207KB

.reloc
Size: 623KB - Virtual size: 623KB