ca0cee20f18d388b12f5e758aa5806e1c0b59d2359f080766277c1bb24f377da

Sharing

Copy URL Twitter E-mail

General

Target

ca0cee20f18d388b12f5e758aa5806e1c0b59d2359f080766277c1bb24f377da
Size

1.5MB
MD5

bfa0d31cb93ed925fe85acf4bac4b4d8
SHA1

05a828679bc337b47149dba53b57b118126eda7e
SHA256

ca0cee20f18d388b12f5e758aa5806e1c0b59d2359f080766277c1bb24f377da
SHA512

8a2f746d50599cb80236dffb81c7852805f3b9e8d9c440724c310a7ecb89c0566223c639740201455492e468af65cec3fa0c6b4259bb2cb09000b5bbd9c13a95
SSDEEP

24576:kgZylVdo+6nZ/h0g+nGNnjYJAOXjs4lYOC+iDt0iaT3lmJadG:vZye+c/h0g+KjgAOzs4SJt0in

Score

1^/10

Malware Config

Signatures

Files

ca0cee20f18d388b12f5e758aa5806e1c0b59d2359f080766277c1bb24f377da
.dll windows x64

9d51b657db39525a83ab5ca3fd647e3c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:a3:69:27:05:89:1d:c4:d7:0d:db:4e:c4:8c:ce:be
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

20/04/2022, 00:00

Not After

06/05/2025, 23:59

Subject

CN=ZWSOFT CO.\, LTD.(Guangzhou),O=ZWSOFT CO.\, LTD.(Guangzhou),L=Guangzhou,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f3:62:1e:46:cc:89:ad:78:a6:ea:4a:6e:79:1c:d3:a8:40:99:25:b3:d0:4e:47:1b:12:49:25:6e:4f:c3:bf:ef
Signer

Actual PE Digest

f3:62:1e:46:cc:89:ad:78:a6:ea:4a:6e:79:1c:d3:a8:40:99:25:b3:d0:4e:47:1b:12:49:25:6e:4f:c3:bf:ef

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=ZWSOFT CO.\, LTD.(Guangzhou),O=ZWSOFT CO.\, LTD.(Guangzhou),L=Guangzhou,ST=Guangdong Province,C=CN

30/03/2023, 10:57
Valid: true

Chain 1

CN=ZWSOFT CO.\, LTD.(Guangzhou),O=ZWSOFT CO.\, LTD.(Guangzhou),L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

CN=ZWSOFT CO.\, LTD.(Guangzhou),O=ZWSOFT CO.\, LTD.(Guangzhou),L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

dhcpcsvc

DhcpRequestParams

userenv

GetProfilesDirectoryA

netapi32

Netbios

fnp_act_installer

fnpActSvcForceUninstallWin
fnpActSvcGetLastErrorWin
fnpActSvcUninstallWin
fnpActSvcInstallWin
fnpActSvcStatusCodeToText

mfc140

ord2207
ord473
ord2332
ord2229
ord1487
ord1485

kernel32

DeleteCriticalSection
GetProcessHeap
GetEnvironmentStrings
FreeEnvironmentStringsA
GetVersionExA
lstrlenA
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetCurrentProcessId
FindClose
FindFirstFileA
FindNextFileA
GetSystemWindowsDirectoryA
GetWindowsDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
FormatMessageA
GetDriveTypeA
GetVersion
GetVolumeInformationA
GetCommandLineW
GetEnvironmentVariableA
GetEnvironmentVariableW
MultiByteToWideChar
HeapSize
CreateFileA
ReadFile
WriteFile
CloseHandle
SetNamedPipeHandleState
SleepEx
WaitNamedPipeA
SetEvent
ResetEvent
DecodePointer
Sleep
SetHandleInformation
SetErrorMode
GetLocalTime
GetTimeZoneInformation
GetModuleHandleA
FindFirstFileW
FindNextFileW
DeviceIoControl
GetTickCount
GetProcessTimes
GetCurrentProcess
GetSystemTimeAsFileTime
LoadLibraryExA
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
InitializeCriticalSectionEx
HeapFree
HeapDestroy
HeapAlloc
RaiseException
HeapReAlloc
DisableThreadLibraryCalls
CreateEventA
GetLastError
WideCharToMultiByte
OutputDebugStringW

user32

GetParent
GetWindowLongA
ScreenToClient
MessageBeep
GetWindowRect
GetClientRect
SetWindowTextA
EnableWindow
GetFocus
CreateDialogIndirectParamA
GetDlgItemTextW
GetDlgItemTextA
SetDlgItemTextA
GetDlgItem
EndDialog
MoveWindow
ShowWindow
SendMessageA
MessageBoxA
GetSystemMetrics
wsprintfA
GetActiveWindow
UnregisterClassA
SetFocus
DialogBoxIndirectParamA

comdlg32

GetOpenFileNameA

advapi32

OpenSCManagerA
OpenServiceA
RegCloseKey
RegDeleteValueA
RegEnumValueA
RegOpenKeyExA
QueryServiceStatus
StartServiceA
RegEnumKeyExA
RegQueryInfoKeyA
CloseServiceHandle
RegSetValueExW
RegCreateKeyExA
GetUserNameA
GetUserNameW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA

shell32

ord680

comctl32

ord17

shlwapi

PathRemoveBackslashW

ole32

CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
SysAllocStringLen
SafeArrayDestroy
SysFreeString
SafeArrayUnaccessData
VariantInit
VariantClear
SafeArrayAccessData

ws2_32

getaddrinfo
freeaddrinfo
inet_addr
inet_ntoa
getnameinfo
getsockopt
__WSAFDIsSet
closesocket
connect
ioctlsocket
recv
select
send
setsockopt
socket
WSAGetLastError
htonl
getpeername
getsockname
WSAStartup
WSACleanup

vcruntime140

__C_specific_handler
memcmp
strstr
strrchr
wcsstr
memcpy
memchr
__std_terminate
__CxxFrameHandler3
memset
strchr
__std_type_info_destroy_list
memmove

api-ms-win-crt-string-l1-1-0

strncpy_s
isspace
strcspn
strcpy
strcat
strcpy_s
_strnicmp
toupper
iscntrl
isgraph
isprint
isalnum
ispunct
isxdigit
isdigit
islower
isupper
isalpha
strlen
_strdup
tolower
wcspbrk
strtok
strspn
_stricmp
strpbrk
strncpy
strncmp
strcmp

api-ms-win-crt-time-l1-1-0

_localtime64
_mktime64
_time64

api-ms-win-crt-heap-l1-1-0

calloc
free
realloc
malloc
_recalloc

api-ms-win-crt-convert-l1-1-0

_strtoi64
strtoul
atof
strtol
strtod
_strtoui64
atoi

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_p
__stdio_common_vsscanf
freopen
_getcwd
_mktemp
_wfopen
_wfreopen
putc
fwrite
_close
fputc
_open
fflush
_wopen
fputs
fread
fopen
__stdio_common_vsprintf_s
__stdio_common_vsprintf
getchar
__stdio_common_vfprintf_p
__stdio_common_vfprintf_s
__stdio_common_vfprintf
__stdio_common_vswscanf
__stdio_common_vswprintf_p
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vfwscanf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf_s
__stdio_common_vfwprintf
clearerr
fgetc
fgets
fseek
ungetc
__acrt_iob_func
ftell
fclose
__stdio_common_vfscanf
__stdio_common_vsnprintf_s

api-ms-win-crt-filesystem-l1-1-0

_mkdir
_unlink
rename
_wremove
_wstat64i32
_waccess
_access
_wunlink
remove
_findnext64i32
_findfirst64i32
_wrename
_stat64i32
_findclose

api-ms-win-crt-environment-l1-1-0

_putenv
getenv

api-ms-win-crt-runtime-l1-1-0

_cexit
__sys_errlist
__sys_nerr
_initterm
terminate
_seh_filter_dll
_exit
_crt_at_quick_exit
_endthread
_initialize_onexit_table
_register_onexit_function
_initterm_e
_initialize_narrow_environment
_configure_narrow_argv
_errno
_getpid
exit
perror
_crt_atexit
_execute_onexit_table
_invalid_parameter_noinfo
_beginthread

api-ms-win-crt-utility-l1-1-0

srand
bsearch
rand_s
qsort
rand

Exports

Exports

_flxAct3SvrConfigNode
_flxAct3SvrGetConfigString
_flxAct3SvrGetNodeName
_flxActAppActivationCreate
_flxActAppActivationDelete
_flxActAppActivationDurationGet
_flxActAppActivationDurationSet
_flxActAppActivationEntitlementIdGet
_flxActAppActivationEntitlementIdSet
_flxActAppActivationExpDateGet
_flxActAppActivationExpDateSet
_flxActAppActivationProductIdGet
_flxActAppActivationProductIdSet
_flxActAppActivationReasonGet
_flxActAppActivationReasonSet
_flxActAppActivationReqCreate
_flxActAppActivationReqSet
_flxActAppActivationRespProcess
_flxActAppActivationRespProdLicSpcGet
_flxActAppActivationSend
_flxActAppActivationShortCodeCancel
_flxActAppActivationShortCodeCancelFromBuffer
_flxActAppActivationShortCodeGenerate
_flxActAppActivationShortCodeGenerateFromBuffer
_flxActAppActivationShortCodePending
_flxActAppActivationShortCodePendingFromBuffer
_flxActAppActivationVendorDataGet
_flxActAppActivationVendorDataSet
_flxActAppGetPendingShortCode
_flxActAppGetPendingShortCodeFromBuffer
_flxActAppRepairCreate
_flxActAppRepairDelete
_flxActAppRepairEntitlementIdGet
_flxActAppRepairFRIdGet
_flxActAppRepairFRIdSet
_flxActAppRepairProdLicSpcSet
_flxActAppRepairProductIdGet
_flxActAppRepairReqCreate
_flxActAppRepairReqSet
_flxActAppRepairRespProcess
_flxActAppRepairSend
_flxActAppRepairShortCodeCancel
_flxActAppRepairShortCodeCancelFromBuffer
_flxActAppRepairShortCodeGenerate
_flxActAppRepairShortCodeGenerateFromBuffer
_flxActAppRepairShortCodePending
_flxActAppRepairShortCodePendingFromBuffer
_flxActAppRepairSuiteIdGet
_flxActAppRepairVendorDataGet
_flxActAppRepairVendorDataSet
_flxActAppReturnCancel
_flxActAppReturnCreate
_flxActAppReturnDelete
_flxActAppReturnEntitlementIdGet
_flxActAppReturnFRIdGet
_flxActAppReturnFRIdSet
_flxActAppReturnProdLicSpcSet
_flxActAppReturnProductIdGet
_flxActAppReturnReasonGet
_flxActAppReturnReasonSet
_flxActAppReturnReqCreate
_flxActAppReturnReqSet
_flxActAppReturnRespProcess
_flxActAppReturnSend
_flxActAppReturnShortCodeCancel
_flxActAppReturnShortCodeCancelFromBuffer
_flxActAppReturnShortCodeGenerate
_flxActAppReturnShortCodeGenerateFromBuffer
_flxActAppReturnShortCodePending
_flxActAppReturnShortCodePendingFromBuffer
_flxActAppReturnSuiteIdGet
_flxActAppReturnVendorDataGet
_flxActAppReturnVendorDataSet
_flxActBorrowActivate
_flxActBorrowReturn
_flxActBorrowTSViewCreate
_flxActBorrowTSViewDelete
_flxActBorrowTSViewFRAttributeGet
_flxActCommonDedSpcCountGet
_flxActCommonDedSpcDestinationFulfillmentIdGet
_flxActCommonDedSpcDestinationSystemNameGet
_flxActCommonDedSpcExpDateGet
_flxActCommonDedSpcTypeGet
_flxActCommonGetFRCountFromServerTS
_flxActCommonGetProtectionMode
_flxActCommonHandleClose
_flxActCommonHandleDeleteProduct
_flxActCommonHandleGetCommType
_flxActCommonHandleGetError
_flxActCommonHandleGetLastOpsError
_flxActCommonHandleGetLastOpsErrorString
_flxActCommonHandleGetLastResponseError
_flxActCommonHandleGetLastResponseErrorReason
_flxActCommonHandleGetLastResponseErrorString
_flxActCommonHandleGetRemoteServer
_flxActCommonHandleGetUniqueMachineNumber
_flxActCommonHandleOpen
_flxActCommonHandleSetCommType
_flxActCommonHandleSetPollInterval
_flxActCommonHandleSetProxyDetails
_flxActCommonHandleSetRemoteServer
_flxActCommonHandleSetSSLDetails
_flxActCommonHandleSetStatusCallback
_flxActCommonHandleSetTimeout
_flxActCommonLibraryCleanup
_flxActCommonLibraryInit
_flxActCommonLicSpcAddASRFromBuffer
_flxActCommonLicSpcAddASRs
_flxActCommonLicSpcCheckASR
_flxActCommonLicSpcCheckASRFromBuffer
_flxActCommonLicSpcCreate
_flxActCommonLicSpcDelete
_flxActCommonLicSpcGet
_flxActCommonLicSpcGetNumProdEntries
_flxActCommonLicSpcGetNumberProducts
_flxActCommonLicSpcGetProd
_flxActCommonLicSpcPopulateAllFromServerTS
_flxActCommonLicSpcPopulateAllFromTS
_flxActCommonLicSpcPopulateFromServerTS
_flxActCommonLicSpcPopulateFromTS
_flxActCommonLicSpcProductDelete
_flxActCommonProdLicSpcActServerChainGet
_flxActCommonProdLicSpcCountGet
_flxActCommonProdLicSpcDedSpcGet
_flxActCommonProdLicSpcEntitlementIdGet
_flxActCommonProdLicSpcExpDateGet
_flxActCommonProdLicSpcFeatureLineGet
_flxActCommonProdLicSpcFulfillmentIdGet
_flxActCommonProdLicSpcFulfillmentTypeGet
_flxActCommonProdLicSpcIsDisabled
_flxActCommonProdLicSpcNumberDedSpcGet
_flxActCommonProdLicSpcNumberValidDedSpcGet
_flxActCommonProdLicSpcPopulateFRFromServerTS
_flxActCommonProdLicSpcProductIdGet
_flxActCommonProdLicSpcSuiteIdGet
_flxActCommonProdLicSpcTrustFlagsGet
_flxActCommonProdLicSpcUniqueIdGet
_flxActCommonProdLicSpcVendorDataGetByIndex
_flxActCommonProdLicSpcVendorDataGetByKey
_flxActCommonProdLicSpcVendorDataGetCount
_flxActCommonRepairLocalTrustedStorage
_flxActCommonResetTrialASRFromBuffer
_flxActCommonResetTrialASRs
_flxActCommonRespProdLicSpcGet
_flxActCommonValidateDateString
_flxActCommonVirtualFamilyGet
_flxActCommonVirtualGenidGet
_flxActCommonVirtualNameGet
_flxActCommonVirtualStatusGet
_flxActCommonVirtualUuidGet
_flxActShortCodeCancelRequest
_flxActShortCodeCreate
_flxActShortCodeCreateFromBuffer
_flxActShortCodeDestroy
_flxActShortCodeGetActivationRequest
_flxActShortCodeGetDenyReason
_flxActShortCodeGetErrorDetail
_flxActShortCodeGetPendingRequest
_flxActShortCodeGetPendingRequestProdSpc
_flxActShortCodeGetRepairRequest
_flxActShortCodeGetReturnRequest
_flxActShortCodeGetWarning
_flxActShortCodeProcessResponse
_flxActShortCodeSetVendorData
_flxActSvrActivationCountGet
_flxActSvrActivationCountSet
_flxActSvrActivationCreate
_flxActSvrActivationDelete
_flxActSvrActivationEntitlementIdGet
_flxActSvrActivationEntitlementIdSet
_flxActSvrActivationExpDateGet
_flxActSvrActivationExpDateSet
_flxActSvrActivationHostnameGet
_flxActSvrActivationHostnameSet
_flxActSvrActivationIncludeEnterpriseData
_flxActSvrActivationProductIdGet
_flxActSvrActivationProductIdSet
_flxActSvrActivationReasonGet
_flxActSvrActivationReasonSet
_flxActSvrActivationReqCreate
_flxActSvrActivationReqSet
_flxActSvrActivationRespProcess
_flxActSvrActivationSend
_flxActSvrActivationUsernameGet
_flxActSvrActivationUsernameSet
_flxActSvrActivationVendorDataGet
_flxActSvrActivationVendorDataSet
_flxActSvrGetType
_flxActSvrRepairCreate
_flxActSvrRepairDelete
_flxActSvrRepairEntitlementIdGet
_flxActSvrRepairFRIdGet
_flxActSvrRepairProdLicSpcSet
_flxActSvrRepairProductIdGet
_flxActSvrRepairReqCreate
_flxActSvrRepairReqSet
_flxActSvrRepairRespProcess
_flxActSvrRepairSend
_flxActSvrRepairSuiteIdGet
_flxActSvrRepairVendorDataGet
_flxActSvrRepairVendorDataSet
_flxActSvrReturnCancel
_flxActSvrReturnCreate
_flxActSvrReturnDelete
_flxActSvrReturnEntitlementIdGet
_flxActSvrReturnFRIdGet
_flxActSvrReturnForceIncompleteGet
_flxActSvrReturnForceIncompleteSet
_flxActSvrReturnNumberValidDedSpcGet
_flxActSvrReturnProdLicSpcSet
_flxActSvrReturnProductIdGet
_flxActSvrReturnReasonGet
_flxActSvrReturnReasonSet
_flxActSvrReturnReqCreate
_flxActSvrReturnReqSet
_flxActSvrReturnRespProcess
_flxActSvrReturnSend
_flxActSvrReturnSuiteIdGet
_flxActSvrReturnVendorDataGet
_flxActSvrReturnVendorDataSet
_flxActTranDictionaryGetByIndex
_flxActTranDictionaryGetByKey
_flxActTranDictionaryGetCount
_flxActTranDictionarySetByKey
_flxActTranReqActionGetAttribute
_flxActTranReqActionGetFLEXnetDictionary
_flxActTranReqActionGetType
_flxActTranReqActionGetVendorDictionary
_flxActTranReqActionSetAttribute
_flxActTranRequestAddAction
_flxActTranRequestAddExistingFulfillment
_flxActTranRequestClearExistingFulfillments
_flxActTranRequestGetAction
_flxActTranRequestGetActionCount
_flxActTranRequestGetAttribute
_flxActTranRequestGetFLEXnetDictionary
_flxActTranRequestGetStatus
_flxActTranRequestGetVendorDictionary
_flxActTranRequestGetXML
_flxActTranRequestMatchStored
_flxActTranRequestSave
_flxActTranRequestSetAttribute
_flxActTranRequestSetExistingFulfillmentDetails
_flxActTranResponseGetAction
_flxActTranResponseGetActionCount
_flxActTranResponseGetFLEXnetDictionary
_flxActTranResponseGetVendorDictionary
_flxActTranRspActionGetAttribute
_flxActTranRspActionGetFLEXnetDictionary
_flxActTranRspActionGetResult
_flxActTranRspActionGetType
_flxActTranRspActionGetVendorDictionary
_flxActTransactionCreate
_flxActTransactionCreateRecoveryRequest
_flxActTransactionCreateRequest
_flxActTransactionDeleteStoredRequest
_flxActTransactionDeleteStoredRequestBySeqNo
_flxActTransactionDestroy
_flxActTransactionGetCommsAttribute
_flxActTransactionGetError
_flxActTransactionGetFunctionId
_flxActTransactionGetLogString
_flxActTransactionGetRequest
_flxActTransactionGetResponse
_flxActTransactionGetResponseXML
_flxActTransactionGetResult
_flxActTransactionGetStoredRequestCount
_flxActTransactionLoadStoredRequest
_flxActTransactionLogError
_flxActTransactionProcessResponse
_flxActTransactionSend
_flxActTransactionSetCommsAttribute
_fnpActSvcForceUninstallWin
_fnpActSvcGetLastErrorWin
_fnpActSvcInstallWin
_fnpActSvcStatusCodeToText
_fnpActSvcUninstallWin
_l_borrow_decrypt
_l_borrow_dptr
_l_n36_buf
_l_new_hostid
_l_pubkey_verify
_l_x77_buf
_la_createStatusSpecifier
_la_freeFulfillmentStatus
_la_freeStatusSpecifier
_la_getFulfillmentStatus
_la_init
_la_statGetAvailableCounts
_la_statGetDeductionCounts
_la_statGetDeductionDestinationFulfillId
_la_statGetDeductionExpirationDate
_la_statGetDeductionSystemName
_la_statGetEntitlementId
_la_statGetExpirationDate
_la_statGetFeatureLines
_la_statGetFulfillmentChain
_la_statGetFulfillmentId
_la_statGetFulfillmentVersion
_la_statGetHops
_la_statGetMaximumCounts
_la_statGetMaximumOverdraftDuration
_la_statGetNumDeductions
_la_statGetNumFulfillments
_la_statGetOriginalExpirationDate
_la_statGetProductId
_la_statGetSuiteId
_la_statSelectFirstDeduction
_la_statSelectFirstFulfillment
_la_statSelectLastDeduction
_la_statSelectLastFulfillment
_la_statSelectNextDeduction
_la_statSelectNextFulfillment
_la_statSelectNthDeduction
_la_statSelectNthFulfillment
_la_statSelectPrevDeduction
_la_statSelectPrevFulfillment
_la_statSpecSetDetail
_la_statSpecSetEntitlementId
_la_statSpecSetFeatureName
_la_statSpecSetFulfillmentId
_la_statSpecSetProductId
_lc_ascii_date
_lc_auth_data
_lc_baddate
_lc_bin_date
_lc_borrow_return
_lc_check_key
_lc_checkin
_lc_checkout
_lc_chk_conf
_lc_ck_feats
_lc_cleanup
_lc_convert
_lc_copy_hostid
_lc_crypt
_lc_cryptstr
_lc_daemon
_lc_disconn
_lc_display
_lc_err_info
_lc_errstring
_lc_errtext
_lc_expire_days
_lc_extract_date
_lc_feat_list
_lc_feat_set
_lc_first_job
_lc_flexinit
_lc_flexinit_cleanup
_lc_flexinit_property_handle_create
_lc_flexinit_property_handle_free
_lc_flexinit_property_handle_get
_lc_flexinit_property_handle_set
_lc_fnpservice_present
_lc_free_config
_lc_free_hostid
_lc_free_job
_lc_free_lmgrd_stat
_lc_free_mem
_lc_get_attr
_lc_get_config
_lc_get_errno
_lc_get_feats
_lc_get_registry
_lc_get_server_version
_lc_get_version
_lc_gethostid
_lc_getid_type
_lc_heartbeat
_lc_hostid
_lc_hostname
_lc_hosttype
_lc_idle
_lc_init
_lc_init_simple_composite
_lc_install_license
_lc_install_license_path
_lc_isadmin
_lc_lic_where
_lc_log
_lc_lookup
_lc_master_list
_lc_new_job
_lc_next_conf
_lc_next_job
_lc_perror
_lc_remove
_lc_removeh
_lc_set_alt_vendor
_lc_set_attr
_lc_set_attr_vendor
_lc_set_errno
_lc_set_registry
_lc_set_vendor
_lc_set_vendor_alias
_lc_shutdown
_lc_status
_lc_test_conf
_lc_timer
_lc_userlist
_lc_username
_lc_virtualstatusget
_lc_vsend
_lp_checkin
_lp_checkout
_lp_errstring
_lp_heartbeat
_lp_perror
_lp_pwarn
_lp_warning

Sections

.text
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textidx
Size: 932KB - Virtual size: 932KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fnp_dir
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fnp_mar
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d51b657db39525a83ab5ca3fd647e3c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:a3:69:27:05:89:1d:c4:d7:0d:db:4e:c4:8c:ce:beCertificate

Extended Key Usages

Key Usages

f3:62:1e:46:cc:89:ad:78:a6:ea:4a:6e:79:1c:d3:a8:40:99:25:b3:d0:4e:47:1b:12:49:25:6e:4f:c3:bf:efSigner

Signature Validations

Verification

30/03/2023, 10:57 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

dhcpcsvc

userenv

netapi32

fnp_act_installer

mfc140

kernel32

user32

comdlg32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 256KB - Virtual size: 255KB

.textidx Size: 932KB - Virtual size: 932KB

.rdata Size: 200KB - Virtual size: 199KB

.data Size: 32KB - Virtual size: 56KB

.pdata Size: 56KB - Virtual size: 55KB

.fnp_dir Size: 512B - Virtual size: 120B

.fnp_mar Size: 512B - Virtual size: 1B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 3KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:a3:69:27:05:89:1d:c4:d7:0d:db:4e:c4:8c:ce:be
Certificate

f3:62:1e:46:cc:89:ad:78:a6:ea:4a:6e:79:1c:d3:a8:40:99:25:b3:d0:4e:47:1b:12:49:25:6e:4f:c3:bf:ef
Signer

30/03/2023, 10:57
Valid: true

.text
Size: 256KB - Virtual size: 255KB

.textidx
Size: 932KB - Virtual size: 932KB

.rdata
Size: 200KB - Virtual size: 199KB

.data
Size: 32KB - Virtual size: 56KB

.pdata
Size: 56KB - Virtual size: 55KB

.fnp_dir
Size: 512B - Virtual size: 120B

.fnp_mar
Size: 512B - Virtual size: 1B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 3KB