fbb2b7d009749af72c45450d1c2b36b1527cd7ed8fe0a480ecfd4de8eab85e39

Sharing

Copy URL Twitter E-mail

General

Target

fbb2b7d009749af72c45450d1c2b36b1527cd7ed8fe0a480ecfd4de8eab85e39
Size

4.5MB
MD5

785bf9606edba04aa8b00934e16946bf
SHA1

aa92ea1128d5cf937d72d39bcb20d687f9157e83
SHA256

fbb2b7d009749af72c45450d1c2b36b1527cd7ed8fe0a480ecfd4de8eab85e39
SHA512

3297388a4cc90f1e08ac3719d9c4804cd129e0544dce256bbf55f40767545020f0fe2bdae4f1e69b41bdebf6700236cb1bc46bb42360cd5e02d8c3b8aea5b4c4
SSDEEP

49152:s2Gye1JPrGtOL9G0l8IPQrJJpf13Ai9R43kFIqeGWampaZWqGyfUyU8OZIT2qiGd:8rl+BUKQhI6q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbb2b7d009749af72c45450d1c2b36b1527cd7ed8fe0a480ecfd4de8eab85e39

Files

fbb2b7d009749af72c45450d1c2b36b1527cd7ed8fe0a480ecfd4de8eab85e39
.exe windows x86

c97621c7fe457c3d917f16d603319fc2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmDisableIME

rime

RimeFreeContext
RimeGetContext
RimeFreeCommit
RimeGetCommit
RimeGetStatus
RimeFreeStatus
RimeSetOption
RimeGetOption
RimeSetProperty
RimeSchemaOpen
RimeConfigOpen
RimeConfigClose
RimeConfigGetBool
RimeConfigGetInt
RimeConfigGetString
RimeConfigNext
RimeConfigEnd
RimeClearComposition
RimeCommitComposition
RimeProcessKey
RimeDestroySession
RimeFindSession
RimeCreateSession
RimeStartMaintenance
RimeFinalize
RimeInitialize
RimeSetNotificationHandler
RimeSetup
RimeConfigBeginMap

kernel32

GetConsoleOutputCP
HeapValidate
TlsFree
GetStdHandle
WriteFile
IsDebuggerPresent
DebugBreak
OutputDebugStringW
CloseHandle
RaiseException
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
CreateMutexW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadResource
LockResource
SizeofResource
FormatMessageW
FindResourceA
GetDynamicTimeZoneInformation
GetConsoleMode
WriteConsoleA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetFileAttributesW
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
lstrlenW
VerSetConditionMask
CreateDirectoryW
ExitProcess
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
FindResourceW
lstrcmpiW
VerifyVersionInfoW
RegisterApplicationRestart
AllocConsole
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
InterlockedFlushSList
VirtualQuery
GetStartupInfoW
ResetEvent
InitializeCriticalSectionAndSpinCount
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringEx
GetCPInfo
CompareStringEx
GetLocaleInfoEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateEventExW
SleepConditionVariableCS
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
SetFileInformationByHandle
GetStringTypeW
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
WaitForMultipleObjects
CreateEventW
WaitForSingleObject
GetOverlappedResult
CreateNamedPipeW
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileSizeEx
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
TransactNamedPipe
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
SetNamedPipeHandleState
GetDateFormatW
SetConsoleCtrlHandler
HeapQueryInformation
HeapReAlloc
HeapSize
GetCurrentThread
WriteConsoleW
GetFileType
FreeLibraryAndExitThread
ResumeThread
ExitThread
ConnectNamedPipe
ReadFile
CreateThread
CreateFileW
ReadConsoleW
FormatMessageA
LocalFree
ExpandEnvironmentStringsW
SetEvent
CreateEventA
GetSystemInfo

user32

DispatchMessageW
PeekMessageW
PostMessageW
DefWindowProcW
SetWindowPos
GetMessageW
UpdateLayeredWindow
GetSystemMetrics
GetMonitorInfoW
CloseClipboard
SetClipboardData
EmptyClipboard
SendInput
GetDC
ReleaseDC
BeginPaint
TranslateMessage
ShowWindow
SetRect
OpenClipboard
EndPaint
GetClientRect
CopyRect
InflateRect
OffsetRect
IsRectEmpty
EqualRect
PtInRect
DrawIconEx
MonitorFromRect
CallWindowProcW
MessageBoxW
CharNextW
SystemParametersInfoW
LoadImageW
DestroyIcon
LoadIconW
GetClassNameW
FindWindowW
EnumChildWindows
SetParent
GetCursorPos
GetWindowRect
RedrawWindow
SetForegroundWindow
SetActiveWindow
SetMenuDefaultItem
TrackPopupMenu
GetMenuItemID
GetSubMenu
DestroyMenu
LoadMenuW
KillTimer
SetTimer
DestroyWindow
DrawAnimatedRects
RegisterWindowMessageW
LoadStringW
LoadCursorW
SetWindowLongW
GetWindowLongW
PhysicalToLogicalPointForPerMonitorDPI
SetWindowTextW
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegOpenKeyW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
GetUserNameW

shell32

Shell_NotifyIconW
SHAppBarMessage
ShellExecuteW

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CoUninitialize

oleaut32

SysFreeString
VarUI4FromStr

comctl32

InitCommonControlsEx

winsparkle

win_sparkle_init
win_sparkle_cleanup
win_sparkle_set_appcast_url
win_sparkle_set_registry_path
win_sparkle_check_update_with_ui

gdiplus

GdipAddPathArcI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneBitmapAreaI
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipIsEmptyRegion
GdipCombineRegionRegion
GdipDeleteRegion
GdipCloneRegion
GdipCreateRegionPath
GdipAddPathLineI
GdipDrawImageI
GdipFillPath
GdipDrawPath
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipSetPenColor
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathRectangleI
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipSetSmoothingMode

d2d1

ord1

dwrite

DWriteCreateFactory

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

gdi32

SetViewportOrgEx
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetObjectType
SelectObject
StretchBlt
BitBlt

Exports

Exports

??0?$codecvt_null@_W@archive@boost@@QAE@I@Z
??0?$oserializer@Vtext_woarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_woarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_woarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_woarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_woarchive@archive@boost@@UUIStyle@weasel@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UUIStyle@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ
??0?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@IAE@XZ
??0?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@IAE@XZ
??1?$codecvt_null@_W@archive@boost@@UAE@XZ
??_F?$codecvt_null@_W@archive@boost@@QAEXXZ
?do_always_noconv@?$codecvt_null@_W@archive@boost@@EBE_NXZ
?do_encoding@?$codecvt_null@_W@archive@boost@@EBEHXZ
?do_in@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?do_max_length@?$codecvt_null@_W@archive@boost@@EBEHXZ
?do_out@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UCandidateInfo@weasel@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UText@weasel@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UTextAttribute@weasel@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UTextRange@weasel@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UUIStyle@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UUIStyle@weasel@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@23@XZ
?get_const_instance@?$singleton@V?$map@Vtext_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_woarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@UText@weasel@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@UTextRange@weasel@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UUIStyle@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@UUIStyle@weasel@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@3@XZ
?get_lock@singleton_module@serialization@boost@@AAEAA_NXZ
?get_mutable_instance@?$singleton@V?$map@Vtext_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_woarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?is_destroyed@?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$extended_type_info_typeid@UUIStyle@weasel@@@serialization@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vtext_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UUIStyle@weasel@@@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_locked@singleton_module@serialization@boost@@QAE_NXZ
?lock@?1??get_lock@singleton_module@serialization@boost@@AAEAA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@QAEXXZ
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@UUIStyle@weasel@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?unlock@singleton_module@serialization@boost@@QAEXXZ

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 483KB - Virtual size: 482KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 787B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c97621c7fe457c3d917f16d603319fc2

Headers

DLL Characteristics

File Characteristics

Imports

imm32

rime

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

winsparkle

gdiplus

d2d1

dwrite

api-ms-win-shcore-scaling-l1-1-1

gdi32

Exports

Exports

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 483KB - Virtual size: 482KB

.data Size: 32KB - Virtual size: 54KB

.idata Size: 13KB - Virtual size: 12KB

.tls Size: 1024B - Virtual size: 787B

.00cfg Size: 512B - Virtual size: 270B

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.reloc Size: 89KB - Virtual size: 88KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 483KB - Virtual size: 482KB

.data
Size: 32KB - Virtual size: 54KB

.idata
Size: 13KB - Virtual size: 12KB

.tls
Size: 1024B - Virtual size: 787B

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.reloc
Size: 89KB - Virtual size: 88KB