50ffc79ca5c62cb1cae11955cf47dd0b7ff0af5920792ee805ea9c672cecce3d

Sharing

Copy URL Twitter E-mail

General

Target

50ffc79ca5c62cb1cae11955cf47dd0b7ff0af5920792ee805ea9c672cecce3d
Size

847KB
MD5

cf37edd00a63a84de2d3ab9ced094378
SHA1

27358a4d61750ac9d3d23e55987458b9ed89a060
SHA256

50ffc79ca5c62cb1cae11955cf47dd0b7ff0af5920792ee805ea9c672cecce3d
SHA512

96ef271d096303eef1fdc55537cbce4bc9940d6962b6b1278a9f798a94ea5ac526fa48e4a045df82b67f6a26985b50e68f209bef108bd3d9c13aa65103f50ad7
SSDEEP

24576:Slp6mWR1bwzzI+BqoCKDoBvegQ69dH88t:oa1tKq9R88t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50ffc79ca5c62cb1cae11955cf47dd0b7ff0af5920792ee805ea9c672cecce3d

Files

50ffc79ca5c62cb1cae11955cf47dd0b7ff0af5920792ee805ea9c672cecce3d
.dll windows x86

f35d312fbbbff761428173d5be8161bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dwmapi

DwmSetWindowAttribute

libcef

cef_string_utf16_set
cef_string_utf16_clear
cef_string_userfree_utf16_free
cef_string_utf8_to_utf16
cef_string_utf16_to_utf8
cef_string_utf8_clear
cef_v8value_create_bool
cef_v8context_get_entered_context
cef_v8value_create_function
cef_v8value_create_array
cef_v8context_get_current_context
cef_v8value_create_object
cef_v8value_create_int
cef_v8value_create_undefined
cef_v8value_create_double
cef_v8value_create_string

kernel32

GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
GetModuleHandleW
LoadLibraryExA
LoadLibraryExW
GetModuleHandleA
LoadLibraryA
GlobalAlloc
GlobalUnlock
GlobalLock
GetLocaleInfoA
GetFileAttributesW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FindClose
FindFirstFileW
FindNextFileW
GetLogicalDrives
SetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
GetVolumeInformationW
CreateProcessW
GetCurrentProcessId
LocalFree
ReadDirectoryChangesW
GetOverlappedResult
ResetEvent
GetDiskFreeSpaceExW
InitializeSListHead
CloseHandle
Process32FirstW
Process32NextW
MultiByteToWideChar
CreateEventW
CreateToolhelp32Snapshot
CreateFileW
WriteFile
GetCommandLineW
GetLastError
SetEnvironmentVariableW
GetModuleFileNameW
GetCurrentProcess
GetCurrentThread
GetTickCount64
SetUnhandledExceptionFilter
AllocConsole
TlsFree
TlsGetValue
FreeLibrary
ExitProcess
GetProcAddress
FindResourceW
LoadResource
LoadLibraryW
LockResource
TlsAlloc
lstrcatW
DisableThreadLibraryCalls
GetSystemDirectoryW
TlsSetValue
SizeofResource
GetConsoleWindow
WideCharToMultiByte
TerminateThread
WaitForSingleObject
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime

user32

ShowWindow
SetWindowDisplayAffinity
SetLayeredWindowAttributes
FindWindowW
FindWindowExW
DestroyWindow
GetKeyboardLayout
SetActiveWindow
MessageBeep
WindowFromPoint
SetForegroundWindow
FillRect
SetRect
SetWindowRgn
SystemParametersInfoA
CreateIconIndirect
LoadIconA
LoadCursorA
GetWindow
GetParent
SetWindowLongA
GetWindowLongA
MapWindowPoints
ClientToScreen
GetCursorPos
SetCursor
AdjustWindowRectEx
GetWindowRect
ValidateRgn
InvalidateRect
GetUpdateRgn
GetForegroundWindow
KillTimer
SetTimer
MsgWaitForMultipleObjects
ReleaseCapture
SetCapture
GetAsyncKeyState
GetKeyState
SetFocus
EmptyClipboard
GetClipboardData
SetClipboardData
ChangeClipboardChain
SetClipboardViewer
GetClipboardOwner
CloseClipboard
OpenClipboard
BringWindowToTop
IsIconic
SetWindowPos
OpenIcon
IsWindow
CreateWindowExW
CreateWindowExA
RegisterClassExW
RegisterClassExA
DefWindowProcW
DefWindowProcA
PostMessageA
SendMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
wsprintfW
RegisterWindowMessageW
DestroyIcon
GetDC
GetSystemMetrics
ReleaseDC
SetWindowTextW
MessageBoxW
MessageBoxA

gdi32

CreateBitmap
CreateRectRgn
RestoreDC
SaveDC
SetBkMode
SetDIBitsToDevice
SetTextAlign
UpdateColors
GetEnhMetaFileHeader
PlayEnhMetaFile
CreateDIBSection
CreatePolygonRgn
LPtoDP
GdiFlush
ExtCreateRegion
CreateDCA
CreatePalette
CreatePen
CreateSolidBrush
GetStockObject
CombineRgn
CreateCompatibleBitmap
SetPixel
EqualRgn
GetRgnBox
LineTo
RectInRegion
SelectClipRgn
MoveToEx
DPtoLP
Polygon
CreateFontA
GetGlyphOutlineW
GetTextExtentPoint32W
GetCharacterPlacementW
SetTextColor
GetTextMetricsA
TextOutW
ExtCreatePen
Arc
Pie
PolyPolygon
Polyline
StretchDIBits
CreateCompatibleDC
BitBlt
GetDIBits
GetDeviceCaps
DeleteDC
SelectPalette
SelectObject
RealizePalette
DeleteObject

comdlg32

GetOpenFileNameW

advapi32

RegOpenKeyW
RegCloseKey
RegGetValueW
RegQueryValueExW

shell32

ShellExecuteExW
SHGetKnownFolderPath
DragQueryFileW
CommandLineToArgvW

ole32

DoDragDrop
RegisterDragDrop
OleUninitialize
OleInitialize
ReleaseStgMedium
CoTaskMemFree

msvcp140

??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?do_encoding@?$codecvt@_WDU_Mbstatet@@@std@@MBEHXZ
?do_max_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHXZ
?do_always_noconv@?$codecvt@_WDU_Mbstatet@@@std@@MBE_NXZ
?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z
?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z
?do_out@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?do_in@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
_Cnd_signal
_Thrd_hardware_concurrency
?__ExceptionPtrCreate@@YAXPAX@Z
_Cnd_init_in_situ
_Strxfrm
?__ExceptionPtrCopy@@YAXPAXPBX@Z
_Wcscoll
_Query_perf_frequency
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPBD@Z
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Syserror_map@std@@YAPBDH@Z
_Mtx_destroy_in_situ
_Wcsxfrm
?__ExceptionPtrDestroy@@YAXPAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPAX@Z
_Mtx_init_in_situ
_Strcoll
_Cnd_do_broadcast_at_thread_exit
_Thrd_sleep
_Cnd_wait
_Thrd_id
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
_Thrd_join
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?is@?$ctype@_W@std@@QBE_NF_W@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ

ws2_32

setsockopt
getnameinfo
freeaddrinfo
recv
ntohs
socket
send
getsockname
WSACleanup
accept
bind
closesocket
select
shutdown
listen
WSASocketW
getaddrinfo
WSAStartup
getpeername

dbghelp

SymGetSymFromAddr64
StackWalk64
SymInitialize
SymFunctionTableAccess64
UnDecorateSymbolNameW
SymGetModuleBase64
SymCleanup

wininet

InternetCloseHandle
InternetOpenW
InternetOpenUrlW
InternetReadFile

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

comctl32

_TrackMouseEvent

vcruntime140

__current_exception_context
__current_exception
memchr
_CxxThrowException
strrchr
__std_type_info_hash
strchr
__std_terminate
memset
memcmp
__std_type_info_destroy_list
_purecall
__std_exception_copy
memcpy
memmove
__std_exception_destroy
__CxxFrameHandler3
_except_handler4_common

api-ms-win-crt-stdio-l1-1-0

fwrite
ungetc
_fseeki64
__stdio_common_vfprintf
_get_stream_buffer_pointers
fgets
freopen
__acrt_iob_func
__stdio_common_vsscanf
fgetc
setvbuf
__stdio_common_vswprintf_s
_wfopen
fputwc
fclose
fflush
ungetwc
fgetwc
__stdio_common_vsprintf
fgetpos
__stdio_common_vswprintf
_ftelli64
fsetpos
fputc
_wfopen_s
fread

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
calloc
_callnewh

api-ms-win-crt-math-l1-1-0

ceil
rint
_libm_sse2_cos_precise
_libm_sse2_sqrt_precise
_libm_sse2_sin_precise
_dsign
_libm_sse2_acos_precise
_dtest

api-ms-win-crt-convert-l1-1-0

strtod
strtoul
atoi
strtoull
atol
strtoll

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_seh_filter_dll
raise
_crt_atexit
_errno
_beginthreadex
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_cexit
_initterm
terminate
_initterm_e
exit

api-ms-win-crt-string-l1-1-0

isalpha
isupper
isdigit
_stricmp
strcpy_s
wcscmp
toupper
strncpy
_strdup
isxdigit
isspace
isalnum
tolower
strlen
strcmp
wcslen
strcspn
strncmp
strncpy_s

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_lock_file
_waccess
_wmkdir
_unlock_file
_access_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
localeconv

api-ms-win-crt-environment-l1-1-0

_wgetenv
getenv

api-ms-win-crt-time-l1-1-0

_mktime64
_utime64

Exports

Exports

AlphaBlend
DllInitialize
GradientFill
TransparentBlt
vSetDdrawflag

Sections

.text
Size: 484KB - Virtual size: 483KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f35d312fbbbff761428173d5be8161bd

Headers

DLL Characteristics

File Characteristics

Imports

dwmapi

libcef

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

msvcp140

ws2_32

dbghelp

wininet

version

comctl32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: 484KB - Virtual size: 483KB

.rdata Size: 130KB - Virtual size: 129KB

.data Size: 61KB - Virtual size: 73KB

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.rsrc Size: 130KB - Virtual size: 130KB

.reloc Size: 35KB - Virtual size: 35KB

.text
Size: 484KB - Virtual size: 483KB

.rdata
Size: 130KB - Virtual size: 129KB

.data
Size: 61KB - Virtual size: 73KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.rsrc
Size: 130KB - Virtual size: 130KB

.reloc
Size: 35KB - Virtual size: 35KB