SystemInformer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SystemInformer.exe
Size

2.8MB
MD5

9dda3112826fded6975cb48a206eb6d1
SHA1

c3a3ba9c2dfb6992dd4a9cd3e7d692a1c511cd44
SHA256

6bbded754704ad1c4a84d7216a31a9ffeeac4c4f5be4e213a9ca62c0240d3602
SHA512

a9c76c7d1a1258bee90f8741fd89613baddb6089060b093ba96046e6184c01ca3e1390e26d741d531d07dd04e8313c1006bc55fb856027d30824d53c8b65f781
SSDEEP

49152:4/0fgQ/ItqMXNxF8OEiTteI/w4NU2jARkTaLi7d9E:4ZpVlNUUaLi7w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SystemInformer.exe

Files

SystemInformer.exe
.exe windows x64

c66fcfc2dd89063683f85345da88d253

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

CreatePropertySheetPageW
InitCommonControlsEx
ord345
ImageList_CoCreateInstance
ord381
PropertySheetW

ntdll

NtSetInformationToken
NtPowerInformation
NtTestAlert
NtFsControlFile
NtSetInformationThread
NtIsProcessInJob
NtQuerySystemInformationEx
RtlRegisterWait
RtlDeregisterWaitEx
RtlCreateSecurityDescriptor
RtlCreateAcl
RtlAddAccessAllowedAce
NtAcceptConnectPort
NtReplyWaitReceivePort
NtCompleteConnectPort
RtlSetDaclSecurityDescriptor
NtCreatePort
RtlValidRelativeSecurityDescriptor
RtlSelfRelativeToAbsoluteSD2
NtConnectPort
NtRequestWaitReplyPort
RtlAbsoluteToSelfRelativeSD
NtCreateSection
RtlQueryElevationFlags
NtDeleteKey
NtFreeVirtualMemory
NtSuspendThread
NtQueryInformationProcess
NtRemoveProcessDebug
NtSetSystemPowerState
NtResumeProcess
NtReleaseSemaphore
NtSetHighEventPair
NtQueryEvent
RtlInitializeBitMap
RtlNtStatusToDosErrorNoTeb
RtlGetFullPathName_U
NtCreateDirectoryObject
RtlGUIDFromString
NtDuplicateToken
RtlRandomEx
RtlTimeToTimeFields
RtlDosPathNameToNtPathName_U_WithStatus
RtlCreateProcessReflection
RtlGetAce
RtlFreeUnicodeString
RtlDestroyProcessParameters
RtlQueryEnvironmentVariable_U
NtDelayExecution
RtlFindMessage
RtlStringFromGUID
RtlQueryPerformanceCounter
RtlCreateProcessParameters
RtlCreateUserProcess
RtlGetDaclSecurityDescriptor
NtTerminateProcess
RtlExpandEnvironmentStrings_U
RtlUnicodeToMultiByteN
RtlUpcaseUnicodeChar
NtCreateThreadEx
NtAllocateVirtualMemory
RtlReAllocateHeap
RtlUTF8ToUnicodeN
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteSize
RtlUnicodeToUTF8N
RtlInterlockedPopEntrySList
RtlGetVersion
NtUnlockFile
NtSetInformationFile
NtLockFile
NtFlushBuffersFile
NtQueryInformationFile
NtGetContextThread
LdrGetProcedureAddress
LdrUnloadDll
LdrLoadDll
NtQueryValueKey
NtQueryKey
NtOpenProcessToken
NtOpenThread
RtlQueueApcWow64Thread
NtOpenSymbolicLinkObject
NtEnumerateKey
NtUnloadDriver
NtEnumerateValueKey
NtQueueApcThread
NtOpenKey
RtlGetSaclSecurityDescriptor
RtlConvertSidToUnicodeString
NtQuerySymbolicLinkObject
NtOpenProcess
NtTerminateThread
NtCreateNamedPipeFile
NtQueryInformationJobObject
NtSetSecurityObject
NtDeleteValueKey
NtQueryAttributesFile
NtDeviceIoControlFile
NtOpenDirectoryObject
RtlGetUnloadEventTraceEx
NtQueryDirectoryObject
NtAdjustGroupsToken
NtSetSystemEnvironmentValueEx
NtOpenThreadToken
NtQuerySystemEnvironmentValueEx
RtlQueryPerformanceFrequency
RtlNumberOfSetBits
NtLoadKeyEx
NtCreateKey
NtEnumerateSystemEnvironmentValuesEx
NtQuerySecurityAttributesToken
NtCreateFile
NtQueryDirectoryFile
NtOpenSection
NtQuerySecurityObject
NtSetValueKey
NtOpenFile
NtQueryFullAttributesFile
NtReleaseKeyedEvent
NtWaitForKeyedEvent
NtCreateKeyedEvent
NtLoadDriver
LdrFindResource_U
LdrAccessResource
RtlLengthSecurityDescriptor
RtlValidSecurityDescriptor
NtClearEvent
NtQueryObject
NtCreateSemaphore
NtFlushInstructionCache
RtlSetOwnerSecurityDescriptor
RtlGetControlSecurityDescriptor
RtlMapGenericMask
RtlGetOwnerSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlSetControlSecurityDescriptor
RtlSetGroupSecurityDescriptor
TpWaitForIoCompletion
TpAllocIoCompletion
TpReleasePool
TpReleaseIoCompletion
TpAllocPool
TpSetPoolMinThreads
TpCancelAsyncIoOperation
TpStartAsyncIoOperation
TpSetPoolMaxThreads
NtSetTimer
NtAlertThread
NtCreateTimer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
NtQuerySemaphore
NtCancelTimer
NtPulseEvent
NtSetLowEventPair
NtQueryTimer
NtResetEvent
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlFirstEntrySList
RtlInterlockedFlushSList
RtlInitializeSListHead
RtlInterlockedPushEntrySList
RtlCreateHeap
RtlFreeHeap
RtlAllocateHeap
RtlDestroyHeap
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
NtSetSystemInformation
NtWriteVirtualMemory
NtCreateMutant
RtlSetCurrentDirectory_U
RtlSetUnhandledExceptionFilter
NtAdjustPrivilegesToken
NtOpenMutant
RtlExitUserProcess
NtSystemDebugControl
NtQuerySystemInformation
NtTerminateJobObject
NtAssignProcessToJobObject
NtQueryMutant
NtQueryVolumeInformationFile
NtMapViewOfSection
NtQuerySection
NtGetNextProcess
NtQueryVirtualMemory
NtProtectVirtualMemory
RtlSetHeapInformation
RtlInitializeCriticalSection
NtQueryPerformanceCounter
RtlDeleteCriticalSection
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtWaitForMultipleObjects
NtSetEvent
NtCreateEvent
NtAlpcQueryInformation
NtReadVirtualMemory
NtReadFile
NtWriteFile
NtQueryInformationThread
NtSuspendProcess
NtResumeThread
NtWaitForSingleObject
NtSetInformationDebugObject
NtUnmapViewOfSection
RtlRaiseStatus
NtSetInformationProcess
NtShutdownSystem
NtDuplicateObject
NtInitiatePowerAction
NtClose
NtQueryInformationToken

kernel32

FlsFree
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetCPInfo
MultiByteToWideChar
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
SetStdHandle
WideCharToMultiByte
GetLastError
SetConsoleCtrlHandler
FreeConsole
GetConsoleWindow
AllocConsole
SetProcessShutdownParameters
TlsSetValue
TlsAlloc
TlsGetValue
LoadLibraryExW
GetComputerNameW
SetLastError
FlsGetValue
SearchPathW
GetTimeFormatEx
GetLocaleInfoW
GetDateFormatEx
FormatMessageW
GetNumberFormatW
CreateProcessW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
IsProcessorFeaturePresent
FreeLibrary
GetCurrentProcess
LocalAlloc
GlobalSize
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetCommandLineW
GetProcessHeap
FlushFileBuffers
CloseHandle
CreateFileW
WriteConsoleW
HeapSize
FlsAlloc
FlsSetValue
GetFileType
SetFilePointerEx
GetFileSizeEx
HeapAlloc
HeapFree
GetModuleHandleExW
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
GetProcAddress
ReadFile
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleOutputCP
GetStdHandle
LocalFree
GetModuleFileNameW
SetEndOfFile

user32

DrawIconEx
FrameRect
TrackMouseEvent
GetCapture
RegisterClassExW
UnregisterClassW
GetDC
GetFocus
CallWindowProcW
DefWindowProcW
PostQuitMessage
KillTimer
SetCursor
LoadCursorW
TranslateMessage
IsDialogMessageW
SetTimer
DispatchMessageW
GetMessageW
SetWindowTextW
TranslateAcceleratorW
IsChild
LoadAcceleratorsW
SendMessageTimeoutW
UpdateWindow
OpenWindowStationW
OpenDesktopW
CreateMenu
EndDeferWindowPos
DrawMenuBar
ChangeWindowMessageFilterEx
IntersectRect
SetMenu
MoveWindow
SetMenuInfo
CloseDesktop
BeginDeferWindowPos
IsWindow
GetWindowPlacement
CreateWindowExW
CloseWindowStation
GetWindow
ShowWindowAsync
DeferWindowPos
GetMonitorInfoW
IsHungAppWindow
SetActiveWindow
MonitorFromWindow
MonitorFromPoint
GetForegroundWindow
GetDoubleClickTime
CreateIconIndirect
LoadImageW
GetCursor
GetGuiResources
GetProcessWindowStation
GetUserObjectInformationW
GetThreadDesktop
EnumDesktopsW
ReleaseCapture
PtInRect
SetCapture
GetAsyncKeyState
SetWindowPlacement
GetGUIThreadInfo
SystemParametersInfoW
GetDesktopWindow
PeekMessageW
MsgWaitForMultipleObjects
GetShellWindow
GetSystemMetrics
MonitorFromRect
GetScrollBarInfo
GetWindowDC
GetIconInfo
FindWindowExW
GetWindowTextW
CreateDialogIndirectParamW
LookupIconIdFromDirectoryEx
SetClipboardData
EnumWindows
LoadMenuIndirectW
DialogBoxIndirectParamW
InternalGetWindowText
EmptyClipboard
CloseClipboard
GetWindowInfo
OpenClipboard
GetActiveWindow
EnumChildWindows
GetPropW
CreateIconFromResourceEx
GetWindowTextLengthW
DestroyMenu
TrackPopupMenu
CreatePopupMenu
InsertMenuItemW
SetScrollPos
ShowCaret
EnableScrollBar
DestroyCaret
DragDetect
GetClipboardData
CreateCaret
SetCaretPos
GetScrollInfo
RegisterClipboardFormatW
SetScrollInfo
SetCursorPos
ScrollWindowEx
GetUpdateRect
GetMessageTime
DrawFocusRect
InvalidateRgn
GetClassInfoExW
GetMessagePos
GetUpdateRgn
WaitMessage
DrawFrameControl
GetAncestor
GetDCEx
ReleaseDC
BeginPaint
EndPaint
GetSystemMenu
DeleteMenu
BringWindowToTop
EnableMenuItem
SetFocus
MapDialogRect
GetWindowRect
SetWindowPos
MapWindowPoints
FillRect
GetSysColor
DrawTextW
GetSysColorBrush
GetMenuItemInfoW
GetKeyState
PostMessageW
GetMenu
GetMenuItemCount
SetWindowLongPtrW
ScreenToClient
GetWindowLongPtrW
GetSubMenu
RedrawWindow
DestroyIcon
ClientToScreen
SetLayeredWindowAttributes
FindWindowW
GetClientRect
InvalidateRect
GetCursorPos
GetWindowThreadProcessId
GetClassNameW
EndDialog
IsWindowEnabled
GetParent
EnableWindow
AllowSetForegroundWindow
IsWindowVisible
ExitWindowsEx
LockWorkStation
DestroyWindow
SendMessageW
ShowWindow
GetDlgItem
SetForegroundWindow
IsIconic
DrawEdge

gdi32

DeleteObject
SetBkMode
SetTextColor
DeleteDC
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
SetDCBrushColor
GetStockObject
RectVisible
GetObjectW
GetTextExtentPoint32W
SetBkColor
GetTextColor
GetTextMetricsW
SetDCPenColor
Polyline
CreateFontW
CreateDIBSection
ExcludeClipRect
PatBlt
GetDeviceCaps
CombineRgn
CreateRectRgn
GdiAlphaBlend
GetDIBits
Rectangle
GetCharWidthW
TextOutW
SetBoundsRect
IntersectClipRect
RestoreDC
SelectClipRgn
GetClipRgn
SaveDC
CreateFontIndirectW
CreateSolidBrush

advapi32

LsaLookupPrivilegeName
GetEffectiveRightsFromAclW
LsaSetSecurityObject
StartServiceW
ControlService
DeleteService
CloseServiceHandle
OpenSCManagerW
LsaClose
LsaAddAccountRights
ChangeServiceConfigW
ChangeServiceConfig2W
CreateServiceW
QueryServiceStatusEx
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
OpenServiceW
QueryServiceConfig2W
NotifyServiceStatusChangeW
CreateProcessAsUserW
LogonUserW
CreateProcessWithLogonW
InitiateShutdownW
QueryServiceConfigW
EnumServicesStatusExW
SetServiceObjectSecurity
LsaQuerySecurityObject
LsaOpenPolicy
LsaLookupNames2
LsaLookupPrivilegeDisplayName
LsaLookupPrivilegeValue
LsaFreeMemory
LsaLookupSids
GetInheritanceSourceW
GetSecurityInfo
SetSecurityInfo

ole32

CoSetProxyBlanket
CoUninitialize
CoTaskMemFree
CoInitializeEx

Exports

Exports

PhAddComboBoxStrings
PhAddElementAvlTree
PhAddEntryHashtable
PhAddEntryHashtableEx
PhAddItemArray
PhAddItemList
PhAddItemPointerList
PhAddItemSimpleHashtable
PhAddItemsArray
PhAddItemsList
PhAddJsonArrayObject
PhAddJsonObject
PhAddJsonObject2
PhAddJsonObjectInt64
PhAddJsonObjectUInt64
PhAddJsonObjectValue
PhAddLayoutItem
PhAddLayoutItemEx
PhAddListViewColumn
PhAddListViewGroup
PhAddListViewGroupItem
PhAddListViewItem
PhAddProcessPropPage
PhAddProcessPropPage2
PhAddPropPageLayoutItem
PhAddSetting
PhAddSettings
PhAddTabControlTab
PhAddTreeNewFilter
PhAdjustPrivilege
PhAdjustRectangleToBounds
PhAdjustRectangleToWorkingArea
PhAllocate
PhAllocateExSafe
PhAllocateFromFreeList
PhAllocatePage
PhAllocateSafe
PhAppResolverGetAppIdForWindow
PhAppendBytesBuilder
PhAppendBytesBuilder2
PhAppendBytesBuilderEx
PhAppendCharStringBuilder
PhAppendCharStringBuilder2
PhAppendFormatStringBuilder
PhAppendFormatStringBuilder_V
PhAppendStringBuilder
PhAppendStringBuilderEx
PhApplicationFont
PhApplyTreeNewFilters
PhApplyTreeNewFiltersToNode
PhAutoDereferenceObject
PhBitmapSetAlpha
PhBoostProvider
PhBufferToHexString
PhBufferToHexStringEx
PhCenterRectangle
PhCenterWindow
PhClearArray
PhClearCircularBuffer_FLOAT
PhClearCircularBuffer_PVOID
PhClearCircularBuffer_ULONG
PhClearCircularBuffer_ULONG64
PhClearHashtable
PhClearIgnoredSettings
PhClearList
PhCmLoadSettings
PhCmSaveSettings
PhCompareStringRef
PhCompareStringZNatural
PhCompareUnicodeStringZIgnoreMenuPrefix
PhConcatStringRef2
PhConcatStringRef3
PhConcatStrings
PhConcatStrings2
PhConcatStrings_V
PhConnectPipe
PhConvertIgnoredSettings
PhConvertMultiByteToUtf16
PhConvertMultiByteToUtf16Ex
PhConvertUtf16ToAsciiEx
PhConvertUtf16ToMultiByte
PhConvertUtf16ToMultiByteEx
PhConvertUtf16ToUtf8
PhConvertUtf16ToUtf8Buffer
PhConvertUtf16ToUtf8Ex
PhConvertUtf16ToUtf8Size
PhConvertUtf8ToUtf16
PhConvertUtf8ToUtf16Buffer
PhConvertUtf8ToUtf16Ex
PhConvertUtf8ToUtf16Size
PhCopyBytesZ
PhCopyCircularBuffer_FLOAT
PhCopyCircularBuffer_PVOID
PhCopyCircularBuffer_ULONG
PhCopyCircularBuffer_ULONG64
PhCopyListView
PhCopyListViewInfoTip
PhCopyStringZ
PhCopyStringZFromBytes
PhCopyStringZFromMultiByte
PhCountStringZ
PhCreateAlloc
PhCreateBytes
PhCreateBytesEx
PhCreateCacheFile
PhCreateDialog
PhCreateDirectoryFullPathWin32
PhCreateDirectoryWin32
PhCreateEMenu
PhCreateEMenuItem
PhCreateFile
PhCreateFileStream
PhCreateFileStream2
PhCreateFileWin32
PhCreateFileWin32Ex
PhCreateHashtable
PhCreateJsonArray
PhCreateJsonObject
PhCreateJsonParser
PhCreateJsonParserEx
PhCreateKey
PhCreateKsiSettingsBlob
PhCreateList
PhCreateNamedPipe
PhCreateObject
PhCreateObjectType
PhCreateObjectTypeEx
PhCreateOpenFileDialog
PhCreatePipe
PhCreatePointerList
PhCreateProcess
PhCreateProcessAsUser
PhCreateProcessPropContext
PhCreateProcessPropPageContext
PhCreateProcessPropPageContextEx
PhCreateProcessRedirection
PhCreateProcessWin32
PhCreateProcessWin32Ex
PhCreateSaveFileDialog
PhCreateSearchControl
PhCreateSecurityPage
PhCreateServiceListControl
PhCreateSimpleHashtable
PhCreateString
PhCreateStringEx
PhCreateSymbolProvider
PhCreateThread
PhCreateThread2
PhCreateThreadEx
PhCreateXmlNode
PhCreateXmlOpaqueNode
PhDecodeUnicodeDecoder
PhDelayExecution
PhDeleteApplicationWindowIcon
PhDeleteArray
PhDeleteAutoPool
PhDeleteBytesBuilder
PhDeleteCacheFile
PhDeleteCallback
PhDeleteCircularBuffer_FLOAT
PhDeleteCircularBuffer_PVOID
PhDeleteCircularBuffer_ULONG
PhDeleteCircularBuffer_ULONG64
PhDeleteDirectoryWin32
PhDeleteFastLock
PhDeleteFileWin32
PhDeleteFreeList
PhDeleteGraphState
PhDeleteImageVersionInfo
PhDeleteLayoutManager
PhDeleteMemoryItemList
PhDeleteProviderThread
PhDeleteStaticWindowIcon
PhDeleteStringBuilder
PhDeleteTreeNewColumnMenu
PhDeleteTreeNewFilterSupport
PhDeleteValueKey
PhDeleteWorkQueue
PhDereferenceObject
PhDereferenceObjectDeferDelete
PhDereferenceObjectEx
PhDereferenceProcessRecord
PhDeselectAllProcessNodes
PhDeselectAllServiceNodes
PhDestroyEMenu
PhDestroyEMenuItem
PhDetermineDosPathNameType
PhDeviceIoControlFile
PhDialogBox
PhDisconnectNamedPipe
PhDivideSinglesBySingle
PhDnsFree
PhDnsQuery
PhDnsQuery2
PhDoPropPageLayout
PhDoesFileExist
PhDoesFileExistWin32
PhDosErrorToNtStatus
PhDrainAutoPool
PhDrawGraphDirect
PhDrawTrayIconText
PhDuplicateBytesZ
PhDuplicateBytesZSafe
PhDuplicateProcessNodeList
PhDuplicateStringZ
PhEditSecurity
PhEllipsisString
PhEllipsisStringPath
PhEncodeUnicode
PhEnumAvlTree
PhEnumChildWindows
PhEnumDirectoryFile
PhEnumDirectoryObjects
PhEnumFileStreams
PhEnumFirmwareEnvironmentValues
PhEnumGenericModules
PhEnumHandles
PhEnumHandlesEx
PhEnumHandlesEx2
PhEnumHashtable
PhEnumKernelModules
PhEnumObjectTypes
PhEnumPagefiles
PhEnumPointerListEx
PhEnumProcessEnvironmentVariables
PhEnumProcessItems
PhEnumProcessModules
PhEnumProcessModules32
PhEnumProcessModules32Ex
PhEnumProcessModulesEx
PhEnumProcesses
PhEnumProcessesEx
PhEnumProcessesForSession
PhEnumServices
PhEnumWindows
PhEnumerateKey
PhEnumeratePlugins
PhEnumerateValueKey
PhEqualStringRef
PhEscapeCommandLinePart
PhEscapeStringForMenuPrefix
PhExecuteRunAsCommand2
PhExecuteRunAsCommand3
PhExpandAllProcessNodes
PhExpandEnvironmentStrings
PhExponentiate
PhExponentiate64
PhExtractIcon
PhExtractIconEx
PhFillMemoryUlong
PhFinalArrayItems
PhFinalBytesBuilderBytes
PhFinalHash
PhFinalStringBuilderString
PhFindCharInStringRef
PhFindEMenuItem
PhFindElementAvlTree
PhFindEntryHashtable
PhFindIntegerSiKeyValuePairs
PhFindItemList
PhFindItemPointerList
PhFindItemSimpleHashtable
PhFindLastCharInStringRef
PhFindListViewItemByFlags
PhFindListViewItemByParam
PhFindLoaderEntry
PhFindNetworkNode
PhFindPlugin
PhFindProcessInformation
PhFindProcessInformationByImageName
PhFindProcessNode
PhFindProcessRecord
PhFindServiceNode
PhFindStringInStringRef
PhFindStringSiKeyValuePairs
PhFindXmlObject
PhFlushFileStream
PhFormat
PhFormatBytes
PhFormatBytes_V
PhFormatDate
PhFormatDateTime
PhFormatDecimal
PhFormatGuid
PhFormatImageVersionInfo
PhFormatLogEntry
PhFormatNativeKeyName
PhFormatSize
PhFormatString
PhFormatString_V
PhFormatTime
PhFormatTimeSpan
PhFormatTimeSpanRelative
PhFormatToBuffer
PhFormatUInt64
PhFree
PhFreeFileDialog
PhFreeJsonObject
PhFreeLibrary
PhFreeLibraryAsImageResource
PhFreePage
PhFreeToFreeList
PhFreeXmlObject
PhGenerateGuid
PhGenerateGuidFromName
PhGenerateRandomAlphaString
PhGenerateRandomNumber64
PhGetAccessEntries
PhGetAccessString
PhGetActiveProcessorCount
PhGetApplicationDataFileName
PhGetApplicationDirectory
PhGetApplicationDirectoryFileName
PhGetApplicationDirectoryWin32
PhGetApplicationFileNameWin32
PhGetApplicationIcon
PhGetApplicationIconEx
PhGetBaseDirectory
PhGetBaseName
PhGetClassObject
PhGetClientIdName
PhGetClientIdNameEx
PhGetComboBoxString
PhGetDialogItemValue
PhGetDllFileName
PhGetDllHandle
PhGetDpi
PhGetDpiValue
PhGetDrawInfoGraphBuffers
PhGetEnabledProvider
PhGetEtwPublisherName
PhGetFileDialogFileName
PhGetFileDialogFilterIndex
PhGetFileDialogOptions
PhGetFileName
PhGetFilePosition
PhGetFileSize
PhGetFileVersionFixedInfo
PhGetFileVersionInfo
PhGetFileVersionInfoEx
PhGetFileVersionInfoLangCodePage
PhGetFileVersionInfoString
PhGetFileVersionInfoString2
PhGetFilterSupportNetworkTreeList
PhGetFilterSupportProcessTreeList
PhGetFilterSupportServiceTreeList
PhGetFirmwareEnvironmentVariable
PhGetFullPath
PhGetGeneralCallback
PhGetGenericTreeNewLines
PhGetGlobalWorkQueue
PhGetHandleInformation
PhGetHandleInformationEx
PhGetImageListIcon
PhGetIntegerPairStringRefSetting
PhGetIntegerStringRefSetting
PhGetJobProcessIdList
PhGetJsonArrayIndexObject
PhGetJsonArrayLength
PhGetJsonArrayLong64
PhGetJsonArrayString
PhGetJsonObject
PhGetJsonObjectAsArrayList
PhGetJsonObjectBool
PhGetJsonObjectLength
PhGetJsonObjectType
PhGetJsonValueAsInt64
PhGetJsonValueAsString
PhGetJsonValueAsUInt64
PhGetKernelFileName
PhGetKernelFileName2
PhGetKnownFolderPath
PhGetKnownLocation
PhGetLineFromAddress
PhGetListBoxString
PhGetListViewContextMenuPoint
PhGetListViewItemImageIndex
PhGetListViewItemParam
PhGetListViewItemText
PhGetMappedImageCfg
PhGetMappedImageCfgEntry
PhGetMappedImageExportFunction
PhGetMappedImageExports
PhGetMappedImageLoadConfig32
PhGetMappedImageLoadConfig64
PhGetMessage
PhGetModuleFromAddress
PhGetModuleProcAddress
PhGetMonitorDpi
PhGetNamedPipeClientComputerName
PhGetNamedPipeClientProcessId
PhGetNamedPipeServerProcessId
PhGetNtMessage
PhGetObjectSecurity
PhGetObjectType
PhGetObjectTypeInformation
PhGetObjectTypeName
PhGetOwnTokenAttributes
PhGetPhVersion
PhGetPhVersionHash
PhGetPhVersionNumbers
PhGetPluginCallback
PhGetPluginFileName
PhGetPluginInformation
PhGetPluginName
PhGetPositionFileStream
PhGetPrimeNumber
PhGetProcedureAddress
PhGetProcedureAddressRemote
PhGetProcessCommandLine
PhGetProcessDepStatus
PhGetProcessDeviceMap
PhGetProcessEnvironment
PhGetProcessImageFileName
PhGetProcessImageFileNameByProcessId
PhGetProcessImageFileNameWin32
PhGetProcessIsDotNet
PhGetProcessIsDotNetEx
PhGetProcessIsSuspended
PhGetProcessKnownType
PhGetProcessKnownTypeEx
PhGetProcessMappedFileName
PhGetProcessPackageFullName
PhGetProcessPebString
PhGetProcessPriority
PhGetProcessPriorityClassString
PhGetProcessSmallImageList
PhGetProcessUnloadedDlls
PhGetProcessWindowTitle
PhGetProcessWorkingSetInformation
PhGetProcessWsCounters
PhGetProtocolTypeName
PhGetScalableIntegerPairStringRefSetting
PhGetSeObjectSecurity
PhGetSelectedAndPropagateProcessItems
PhGetSelectedListViewItemParam
PhGetSelectedListViewItemParams
PhGetSelectedProcessItem
PhGetSelectedProcessItems
PhGetSelectedProcessNodes
PhGetSelectedServiceItem
PhGetSelectedServiceItems
PhGetServiceChange
PhGetServiceConfig
PhGetServiceDelayedAutoStart
PhGetServiceDescription
PhGetServiceDllParameter
PhGetServiceErrorControlInteger
PhGetServiceErrorControlString
PhGetServiceNameFromTag
PhGetServiceStartTypeInteger
PhGetServiceStartTypeString
PhGetServiceStateString
PhGetServiceTypeInteger
PhGetServiceTypeString
PhGetSidFullName
PhGetSizeDpiValue
PhGetStatisticsTime
PhGetStatisticsTimeString
PhGetStatusMessage
PhGetStockApplicationIcon
PhGetStringRefSetting
PhGetSymbolFromAddress
PhGetSymbolFromName
PhGetSystemDirectory
PhGetSystemDpi
PhGetSystemMetrics
PhGetSystemParametersInfo
PhGetSystemRoot
PhGetTaskbarDpi
PhGetTcpStateName
PhGetTemporaryDirectoryRandomAlphaFileName
PhGetThreadServiceTag
PhGetTokenGroups
PhGetTokenIntegrityLevel
PhGetTokenIntegrityLevelRID
PhGetTokenOwner
PhGetTokenPrimaryGroup
PhGetTokenPrivileges
PhGetTokenUser
PhGetTreeNewText
PhGetWin32Message
PhGetWindowContext
PhGetWindowDpi
PhGetWindowText
PhGetWindowTextEx
PhGetXmlInterface
PhGetXmlNodeAttributeByIndex
PhGetXmlNodeAttributeCount
PhGetXmlNodeAttributeText
PhGetXmlNodeElementText
PhGetXmlNodeFirstChild
PhGetXmlNodeNextChild
PhGetXmlNodeOpaqueText
PhGetXmlObject
PhGraphStateGetDrawInfo
PhHandleCopyCellEMenuItem
PhHandleCopyListViewEMenuItem
PhHandleListViewNotifyBehaviors
PhHandleListViewNotifyForCopy

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 632KB - Virtual size: 630KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 4KB - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sithird
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sithird
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c66fcfc2dd89063683f85345da88d253

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

ntdll

kernel32

user32

gdi32

advapi32

ole32

Exports

Exports

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 632KB - Virtual size: 630KB

.data Size: 40KB - Virtual size: 68KB

.pdata Size: 72KB - Virtual size: 70KB

.didat Size: 4KB - Virtual size: 448B

_RDATA Size: 4KB - Virtual size: 512B

.sithird Size: 12KB - Virtual size: 8KB

.sithird Size: 4KB - Virtual size: 24B

.rsrc Size: 172KB - Virtual size: 168KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 632KB - Virtual size: 630KB

.data
Size: 40KB - Virtual size: 68KB

.pdata
Size: 72KB - Virtual size: 70KB

.didat
Size: 4KB - Virtual size: 448B

_RDATA
Size: 4KB - Virtual size: 512B

.sithird
Size: 12KB - Virtual size: 8KB

.sithird
Size: 4KB - Virtual size: 24B

.rsrc
Size: 172KB - Virtual size: 168KB

.reloc
Size: 12KB - Virtual size: 8KB