VEGAS_Pro_18[.]0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

VEGAS_Pro_18.0.exe
Size

18.1MB
MD5

c3999c87f4dfe38671384c7e01351935
SHA1

f534da68e9a52d7edead335a9ab9d227ed85cfaf
SHA256

265093ae202ada5c9b23b513ef66585319145bea23b8b0be60b970c9ac5c92cf
SHA512

d45af6452eda8b50a4db540a84d55b0d26eebd37c207798194e9f8803c813e423e4858164aa22f1b8679e1e8400ccd186d1e034fc21eddaf7e5243c72f4e5e56
SSDEEP

393216:m0zN03h0QuTwmM+dVn0Cdr2GI2fWbqFxNLsm:k39mHR0Cdr9pfIMxNLs

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VEGAS_Pro_18.0.exe

Files

VEGAS_Pro_18.0.exe
.exe windows x64

40caed1529ca9db1968e42ee0c353d97

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wintrust

WinVerifyTrust

d3d10

D3D10CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ws2_32

getnameinfo
select
freeaddrinfo
getaddrinfo
WSAStartup
WSACleanup
__WSAFDIsSet
closesocket
WSAGetLastError
getsockopt
send
getpeername
connect
ioctlsocket
setsockopt
socket
recv

kernel32

SetEvent
CreateEventW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
DeleteCriticalSection
RtlLookupFunctionEntry
LoadResource
LockResource
SizeofResource
FindResourceA
Sleep
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
CloseHandle
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
UnhandledExceptionFilter
RtlVirtualUnwind
VirtualProtect
GetModuleHandleW
GetProcAddress
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetLastError
SetLastError
TerminateProcess
GetTickCount64
GetModuleHandleA
K32EnumProcessModules
K32GetModuleFileNameExA
K32GetModuleInformation
GetHandleInformation
GetModuleFileNameA
K32EnumProcesses
WaitForSingleObject
VirtualFreeEx
GetVolumeInformationA
Beep
ExitProcess
GetPhysicallyInstalledSystemMemory
VirtualAllocEx
GetComputerNameA
MultiByteToWideChar
AllocConsole
SetConsoleCtrlHandler
VirtualProtectEx
GetExitCodeProcess
Process32Next
LocalFree
SetUnhandledExceptionFilter
FlushInstructionCache
IsDebuggerPresent
GetStartupInfoW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
SetThreadContext
InitializeSListHead
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetAsyncKeyState
MapVirtualKeyA
SetWindowPos
GetWindowRect
GetDesktopWindow
ShowWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
PeekMessageA
DispatchMessageA
TranslateMessage
MessageBoxExA
LoadCursorA
ScreenToClient
ClientToScreen
SetCursor
SetCursorPos
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetActiveWindow
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
GetCursorPos
GetClientRect
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

advapi32

GetCurrentHwProfileA
OpenProcessToken

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoUninitialize

oleaut32

VariantClear
VariantInit
SysStringLen
SysFreeString
SysAllocString

msvcp140

?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
_Cnd_broadcast
?rdstate@ios_base@std@@QEBAHXZ
_Mtx_trylock
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Cnd_wait
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Cnd_destroy
_Cnd_init
_Mtx_destroy
_Mtx_init
_Thrd_id
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
?_Xout_of_range@std@@YAXPEBD@Z
??Bios_base@std@@QEBA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
_Cnd_signal
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?setf@ios_base@std@@QEAAHHH@Z
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
_Strcoll
_Strxfrm
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?is@?$ctype@D@std@@QEBA_NFD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Winerror_message@std@@YAKKPEADK@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
_Stat
_To_wide
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
_Thrd_start
_Thrd_join
_Thrd_hardware_concurrency

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

vcruntime140

memset
__std_terminate
__std_exception_destroy
memchr
memmove
memcmp
__CxxFrameHandler3
_CxxThrowException
strchr
__C_specific_handler
strstr
__std_exception_copy
_purecall

api-ms-win-crt-runtime-l1-1-0

_cexit
_set_app_type
_crt_atexit
_get_narrow_winmain_command_line
_initterm
_register_onexit_function
terminate
_exit
_invalid_parameter_noinfo_noreturn
_c_exit
_initialize_onexit_table
abort
_register_thread_local_exe_atexit_callback
_initterm_e
_errno
exit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_exe
_invalid_parameter_noinfo

api-ms-win-crt-heap-l1-1-0

free
_callnewh
calloc
_set_new_mode
malloc
realloc

api-ms-win-crt-math-l1-1-0

pow
ldexp
atan2f
powf
sqrt
ceilf
ceil
log2
floorf
floor
_dsign
sqrtf
cosf
fmodf
sinf
__setusermatherr
_dtest

api-ms-win-crt-string-l1-1-0

_stricmp
strcpy_s
iswdigit
iswalpha
tolower
strncpy
isprint
strncmp

api-ms-win-crt-convert-l1-1-0

strtoul
strtoll
strtoull
atof
strtol
strtod

api-ms-win-crt-stdio-l1-1-0

freopen_s
__stdio_common_vfprintf
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fputc
fgetpos
fgetc
_get_stream_buffer_pointers
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__acrt_iob_func
_set_fmode
__stdio_common_vsscanf
fseek
__p__commode
feof
fread
fflush
fclose

api-ms-win-crt-utility-l1-1-0

qsort
srand
rand

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-locale-l1-1-0

setlocale
localeconv
_configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_gmtime64

wtsapi32

WTSSendMessageW

Exports

Exports

י��o�\(N*Q� @� ɻ_�Y��4��Hߦ��w��f��3�HV�:�"ʜ9��N�f�#��I��( &/Y��5K�W��*J�{�7G(� �� uN��O��I3��;�h�}׭�K��%y�Լa�¾�� ~�~7s�� v�tcմZ��z�M�w�3ApI��o5��,�g�g'0x��a��k-�:�Y�*�8��|슍�D-�ic��5�+�?B��o�Q��N��yw��Дf��w�4��ף![VgpU%��N�u��ň7 H�u��F�ڽS�^��S�ɽ��^��MF�H��珧��G��l�5��p�\P�|_�yD��LS��+`��>G�0bX��r*�e�@AJ|+�_�0m�bDP�1��Ra��u��݈ vU+Ú-��0i��1k�� Ќۧ��x�.&9/ �o�a��N��T��_��}[+��aBz]�w�WZ��{�:�*��<:m��w�}ݞ#A��%�.(�>v�r:a��R�S :�x�u�{�U;p!R��V}�J�j��֡ށ;ΞV(<��gBp'�W�`j�vLIdt�tg�۟7�� p��/�mxօ��Fָ� �Nd�+��fY��65DS��ا�El�J��8�9Y�\�e��-�Q_�#!�� g�7� k�K��o~bP�!O0'�л�֖H胣��m �,%�4�f�Ĩ|m]\ԟ�PԼ�l[��?��.��h��:�l�W��>*Y��խ��I\��6��6mL�5�M0�W�[��(��P`�Kݺ%O�1=�O��i�Hs8��>�P �/��w�� Dtœxtp��?*x��s �-L=��:;��Th�|ތ7J�Uzc˚AL��ã:W�� '��g��c2��ϥ�1��^��Ԋ��X��^��l󷶂uB4��=)}��&J 1S��#!� 4��{ml��ͨ��?��hr��:#�!��z�b�>��46��Y��4�Z��$�Rs'�lO?�E�Ds-s�{}X�F6��"�(s��ϡWKR�U/5�%�#&��²xi�Kc��D9�WD~�u�?��d��K��5��y�RÁ3�18� ��2ŜO_?�4��;ꨨ��5��@v��i��s��ʍi�q��B ��q�� ؽ�`�<xb��T��'Z��AW56<�rL+��a"儋��n�~�bD�`�(q��LB��k��H�'�I�b��Ɩͥ�3��}�N��+}�laM|��L�ʹ*H��_�5X"�{k،�� &��2��3.rn� DWw�K� ��h�Bnl��ƺ�7��\��)��]�o��o��O ��p{�A�xTÓ� �� n��1]��Me�e)��,ީ��{%lG�% *��$t9촩��i.9؏��t+��hN�<z|�&`^kvPc��v�w!ώ�Q��-��[l��Q��I�N�\�S&�B��ǫ��SuJ��#2sBb�0Q6 �Fnl�YG'F1;|$��[��#A��:��QL��y�= B�".Q7�f�˼�_s��F��^��lQ�sT��0��mc��7�7.��<�ޣ�&C�f�?�潶�(��ke��crטC��r鲺�t��F@r�x��n�W1�񼔥F��ncx-x͏��-�&��[�ߑZ53l��T?:迊�� @�p��;r�r>��`�[9�y�C�<��XTq�^��Qrd��&��FpYT�P��3u�}�Q� ��FS�]u�ܯ�^�t\lN`(�!�#��H�j��P��>�`��Yhs �\2:ASG p�2�N�"��H]9L��G�<�r�*�Bs��D�#cZiBL5W�s��S*��+�F�� $��і��\��ɀ7��پ�>��.��{ #a��6I��y�<KU�f�y��m¾�@>��^�d��Cu\��`wV}��A@ҭi 9��É�"�b��cG`(Ps ?Zi��H��:![�2/Y^�x?��Ǭ��kѤ<��x��x;��-[�NBL�F��2~�sY�zŗ�6��-�[lF� �S4ӲTi��H�~�1"��֗��2.��ñ��ޯ�ŲڬNv��D��;5��*A��Y3@��{��60�Z�I;�]^��]�}�fR�h'��B�.�X��,�@!)��hL�� U��3Ҽk�:ЁP><��m뀍��C�(9�i��;i��?�$��@Z��%�x��B(��̤��˕�H~��g�W@��-��ˎ��8l��G!锣� �wG�'�t㎵�FΈY3"{`��ڈ�1��oe�̄YIR�!��˄��/�.~��@�н@��不e~o `��9b�KR��͹��e��8��ӌ, a��L��&b]}'��;� �R�� ~��W얠Ʋ��X+ٺ�斆A��I�!��/�Ӎ�8��QU@km�� n��Ut��8婗��0�-�9�4<5�6.!�ߛ��okeY��j��B��/�� f�?�$�X*x4��P��%-Vw��R��J��^��&�Y��(@3]�e��˹BP��!��M��t̠2�g��(}�!��-�uV ��(�q��.�{��ף-)�:bk��A��-�ۿr��b?�@=��|��i3<i�ZW�nU��Up��*�b��ұ ��cL��|PmVx�-��}��|<�\>��u�ʡ�K��+�!w��Y�A��8��`��&D��jv�z�S��T�Ֆ��<a_FC{((��Ut\��|H��LJ�k�)8q?�� U�Ψ�� NR��

Sections

.text
Size: - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 817KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: - Virtual size: 11.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UPX1
Size: 13.1MB - Virtual size: 13.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40caed1529ca9db1968e42ee0c353d97

Headers

DLL Characteristics

File Characteristics

Imports

wintrust

d3d10

d3dcompiler_47

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

msvcp140

imm32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 3.5MB

.rdata Size: - Virtual size: 817KB

.data Size: - Virtual size: 130KB

.pdata Size: - Virtual size: 164KB

.UPX0 Size: - Virtual size: 11.5MB

.UPX1 Size: 13.1MB - Virtual size: 13.1MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 3.5MB

.rdata
Size: - Virtual size: 817KB

.data
Size: - Virtual size: 130KB

.pdata
Size: - Virtual size: 164KB

.UPX0
Size: - Virtual size: 11.5MB

.UPX1
Size: 13.1MB - Virtual size: 13.1MB

.rsrc
Size: 512B - Virtual size: 480B