8b8ae96768a9d0_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

8b8ae96768a9d0_JC.exe
Size

9.5MB
MD5

8b8ae96768a9d0924af7689d1abf8aa5
SHA1

60433df88110ea9b939b7c1b98158944695970f7
SHA256

1dcc3bcb19c277e8d9a53000e20885abd7b2e0100052330bf1b5b21de9546425
SHA512

521ce790519f6cadf2844183b3a243f8ecfcfeeb0abeb3365b5a12572eca76237e0e267c58b1e21063602b5181c2c41e840fd3f1c32ee499e7aef7dab6ec84f6
SSDEEP

196608:qURLFnqqkhSTR71pbVTIOazcrqN0CI63e4cBoMIB+VHJfpQalY:qURAqkkN7jVicrqNl3vcBoMIB+JJfpB+

Score

1^/10

Malware Config

Signatures

Files

8b8ae96768a9d0_JC.exe
.exe windows x86

a811a3880bb25a6940337c2eb145bc81

Code Sign

65:03:f9:53:62:bb:b1:42:04:fb:61:47:f1:c7:72:08
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

27-01-2016 00:00

Not After

18-01-2017 23:59

Subject

CN=Interactive Brands Malta Limited,O=Interactive Brands Malta Limited,L=Attard,ST=ATD,C=MT

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cf:bd:e0:c0:c2:eb:42:ff:34:6e:ce:9a:d0:a4:66:17:17:0b:fc:d1
Signer

Actual PE Digest

cf:bd:e0:c0:c2:eb:42:ff:34:6e:ce:9a:d0:a4:66:17:17:0b:fc:d1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

select
ioctlsocket
listen
accept
recvfrom
sendto
getservbyport
gethostbyaddr
getservbyname
htonl
inet_ntoa
gethostbyname
inet_addr
WSAStartup
WSASetLastError
socket
connect
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
recv
WSAGetLastError
closesocket
WSACleanup
__WSAFDIsSet
shutdown
gethostname

wldap32

ord301
ord27
ord41
ord35
ord32
ord30
ord79
ord50
ord60
ord143
ord46
ord211
ord22
ord200
ord26
ord33

wininet

InternetQueryOptionA
InternetSetOptionA
InternetErrorDlg
HttpSendRequestA
HttpOpenRequestW
InternetOpenA
HttpQueryInfoA
InternetGetLastResponseInfoA
InternetConnectA
HttpSendRequestW
InternetOpenW
InternetSetOptionW
InternetConnectW
InternetReadFile
HttpQueryInfoW
InternetCloseHandle
InternetCombineUrlA
HttpOpenRequestA

oleacc

AccessibleObjectFromWindow
LresultFromObject

winmm

timeKillEvent
timeGetTime
PlaySoundA
timeSetEvent
timeGetDevCaps

imm32

ImmReleaseContext
ImmGetContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmNotifyIME
ImmIsIME
ImmSetCandidateWindow

comctl32

ImageList_DrawEx
ImageList_GetIconSize
ImageList_GetImageInfo

urlmon

FindMimeFromData

kernel32

GetTempPathW
CreateMutexW
DecodePointer
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
TlsFree
CreateEventA
GetLastError
TlsAlloc
InterlockedExchangeAdd
CloseHandle
SetEvent
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
lstrlenA
lstrlenW
LocalFree
LocalAlloc
GetCurrentProcess
GetDriveTypeW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
RaiseException
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetModuleHandleW
WaitForSingleObject
GetCurrentThreadId
CreateThread
CreateEventW
TerminateProcess
GetCurrentProcessId
OutputDebugStringW
GetFileSize
SetUnhandledExceptionFilter
CreateFileW
ReadFile
GetModuleFileNameW
GetTickCount
WaitForSingleObjectEx
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
GetVersionExW
GetFullPathNameW
DeleteFileW
SetFileAttributesW
WriteFile
CopyFileW
CreateProcessW
FindClose
FindNextFileW
FindFirstFileW
RemoveDirectoryW
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentDirectoryW
Sleep
ReleaseSemaphore
CreateSemaphoreA
GetSystemTimeAsFileTime
WaitForMultipleObjectsEx
lstrcmpiW
FreeLibrary
LoadLibraryExW
EncodePointer
CreateMutexA
DeleteFileA
CreateDirectoryW
GetUserDefaultLCID
IsWow64Process
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetExitCodeProcess
GetModuleHandleA
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetModuleFileNameA
VerifyVersionInfoW
VerSetConditionMask
TlsGetValue
TlsSetValue
SetWaitableTimer
PostQueuedCompletionStatus
CreateIoCompletionPort
QueueUserAPC
TerminateThread
WaitForMultipleObjects
GetQueuedCompletionStatus
SetLastError
InterlockedCompareExchange
GetSystemInfo
FormatMessageW
GetComputerNameA
SetConsoleTextAttribute
GetWindowsDirectoryA
GetStdHandle
GetConsoleScreenBufferInfo
OutputDebugStringA
GetTempPathA
QueryPerformanceCounter
lstrcpynW
GetLocaleInfoA
LoadLibraryA
GetTempFileNameA
GlobalSize
SystemTimeToFileTime
GetLocalTime
GetSystemTime
GetTimeZoneInformation
GetDateFormatW
FileTimeToSystemTime
GetThreadLocale
GetLocaleInfoW
MulDiv
ExitThread
GetVersionExA
FindResourceA
SetEndOfFile
SetFilePointer
UnmapViewOfFile
FlushViewOfFile
MapViewOfFile
CreateFileMappingA
GetCPInfo
SetThreadLocale
CompareStringW
GetFileAttributesW
LocalFileTimeToFileTime
GetFileInformationByHandle
GetNumberFormatW
GetCurrencyFormatW
GetStringTypeW
GetStringTypeA
SleepEx
GetSystemDirectoryA
PeekNamedPipe
GetFileType
ExpandEnvironmentStringsA
FormatMessageA
GetVersion
GlobalMemoryStatus
FlushConsoleInputBuffer
RtlUnwind
HeapReAlloc
HeapSize
ResumeThread
GetTimeFormatA
GetDateFormatA
SetConsoleCtrlHandler
UnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
VirtualQuery
HeapSetInformation
GetStartupInfoW
CreateProcessA
DuplicateHandle
GetFileAttributesA
WriteConsoleW
GetConsoleCP
GetConsoleMode
GetTimeFormatW
ExitProcess
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
CreateFileA
ReadConsoleInputA
SetConsoleMode
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
FlushFileBuffers
EnumSystemLocalesA
IsValidLocale
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
CreatePipe
LoadLibraryW
GetFullPathNameA
SetEnvironmentVariableA
OpenEventA
ResetEvent
CreateWaitableTimerA
DeviceIoControl
GetFileAttributesExW
AreFileApisANSI
GetStringTypeExA
GetStringTypeExW
LCMapStringA
IsDBCSLeadByteEx
FoldStringW
ReleaseMutex

user32

SetWindowRgn
DrawTextA
DrawTextW
InvertRect
GetSysColorBrush
DrawEdge
DrawFrameControl
IsChild
GetActiveWindow
CreateWindowExA
GetKeyboardLayout
DestroyCaret
SetCaretPos
CreateCaret
SetScrollInfo
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
ScrollDC
ScrollWindowEx
RegisterClipboardFormatW
CloseClipboard
EmptyClipboard
OpenClipboard
EnumClipboardFormats
CountClipboardFormats
SetClipboardData
GetClipboardData
IsClipboardFormatAvailable
GetIconInfo
DrawIconEx
CreateIconFromResourceEx
SendMessageTimeoutA
AdjustWindowRectEx
MessageBeep
GetKeyState
GetCaretBlinkTime
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
LoadStringW
IsWindowEnabled
SetWindowsHookExA
CallNextHookEx
GetSysColor
LoadCursorFromFileA
DestroyIcon
SetCursor
GetMessageA
TranslateMessage
DispatchMessageA
NotifyWinEvent
GetWindowPlacement
InvalidateRect
KillTimer
PtInRect
GetFocus
SetFocus
SetTimer
GetScrollInfo
SetCapture
LoadStringA
MoveWindow
LoadCursorA
CreateCursor
UnhookWindowsHookEx
SystemParametersInfoA
GetDoubleClickTime
GetWindowLongA
GetWindowDC
GetSystemMetrics
InflateRect
OffsetRect
GetClassLongA
FillRect
DefWindowProcA
ReleaseDC
GetAsyncKeyState
GetDlgCtrlID
EndPaint
BeginPaint
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
SetParent
EndDialog
DialogBoxIndirectParamW
DestroyMenu
GetCursorPos
AppendMenuW
CreatePopupMenu
RegisterWindowMessageW
SetWindowTextW
IsZoomed
DestroyWindow
DefWindowProcW
GetWindowLongW
SetWindowLongW
UpdateWindow
RegisterClassExW
GetClassInfoExW
SystemParametersInfoW
CreateWindowExW
LoadIconW
CharUpperW
SendMessageA
PostMessageA
IsIconic
CharNextW
PostMessageW
GetWindowThreadProcessId
FindWindowW
SetWindowPlacement
IntersectRect
PostQuitMessage
DispatchMessageW
GetMessageW
GetDC
RegisterWindowMessageA
UnregisterClassW
RegisterClassW
UnregisterClassA
RegisterClassExA
RegisterClassA
SetWindowLongA
IsWindowUnicode
WindowFromPoint
GetWindowRect
ShowWindow
IsWindow
SetForegroundWindow
ScreenToClient
GetSystemMenu
EnableMenuItem
TrackPopupMenu
PostThreadMessageW
SetWindowPos
GetParent
SendMessageW
MessageBoxW
PeekMessageA
ReleaseCapture
ClientToScreen
GetDesktopWindow
GetCapture

gdi32

CreateRectRgn
CreateRoundRectRgn
CreatePen
GetTextMetricsA
GetWindowOrgEx
TextOutA
TextOutW
SetTextAlign
GetTextAlign
SetBkMode
CreateBitmap
SetPixel
GetPixel
SetBrushOrgEx
CreateHatchBrush
Rectangle
GetTextExtentPoint32W
GetTextExtentPoint32A
RectVisible
PatBlt
CreatePatternBrush
GetDeviceCaps
IntersectClipRect
GetTextExtentExPointW
GetCharacterPlacementW
GetFontLanguageInfo
GdiFlush
EnumFontFamiliesExA
CreateFontA
AddFontMemResourceEx
GetClipBox
CreateDIBSection
StretchDIBits
SetStretchBltMode
StretchBlt
GetDIBits
GetKerningPairsA
GetCurrentObject
GetGlyphOutlineW
GetObjectA
SetTextColor
SetBkColor
CreateRectRgnIndirect
CombineRgn
ExcludeClipRect
CreateSolidBrush
SetWindowOrgEx
BitBlt
DeleteDC
CreateCompatibleDC
LPtoDP
CreateCompatibleBitmap
SelectObject
GetStockObject
GetMapMode
SetMapMode
SetViewportOrgEx
DPtoLP
SetViewportExtEx
RestoreDC
GetWindowExtEx
SetWindowExtEx
SaveDC
SetLayout
GetViewportExtEx
CreateDIBPatternBrushPt
DeleteObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW

shell32

Shell_NotifyIconW
SHGetPathFromIDListW
SHGetFileInfoW
ord74
DragQueryFileW
SHChangeNotify
SHGetSpecialFolderPathW
ShellExecuteW
SHBrowseForFolderW

ole32

CoUninitialize
CoInitialize
CoCreateGuid
DoDragDrop
CoCreateInstance
OleRun
CoRegisterClassObject
CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeEx
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoRevokeClassObject
StringFromGUID2
CoGetClassObject
RevokeDragDrop
RegisterDragDrop
ReleaseStgMedium

oleaut32

GetErrorInfo
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysStringLen
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen
SysFreeString
VarUI4FromStr
VariantInit

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

msi

ord8
ord92
ord117
ord160
ord88
ord137
ord45
ord141
ord43
ord111
ord70
ord14
ord205
ord32
ord159

shlwapi

PathFileExistsW
UrlEscapeA

psapi

GetProcessImageFileNameW

dbghelp

MiniDumpWriteDump

winhttp

WinHttpGetIEProxyConfigForCurrentUser

wintrust

WinVerifyTrust

Exports

Exports

??0?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@QAE@XZ
??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UtagRECT@@@23@XZ@51
??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ@51
??_B?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ@51
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtagRECT@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UtagRECT@@@23@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ
?get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@UtagRECT@@@23@A
?instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@A
?instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@A
?instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@A
?instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@A
?instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@A
?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@A
?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@A
?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UtagRECT@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@634@A

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 993KB - Virtual size: 992KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 202KB - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 440KB - Virtual size: 440KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a811a3880bb25a6940337c2eb145bc81

Code Sign

65:03:f9:53:62:bb:b1:42:04:fb:61:47:f1:c7:72:08Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

cf:bd:e0:c0:c2:eb:42:ff:34:6e:ce:9a:d0:a4:66:17:17:0b:fc:d1Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

wininet

oleacc

winmm

imm32

comctl32

urlmon

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

version

msi

shlwapi

psapi

dbghelp

winhttp

wintrust

Exports

Exports

Sections

.text Size: 4.6MB - Virtual size: 4.6MB

.rdata Size: 993KB - Virtual size: 992KB

.data Size: 202KB - Virtual size: 300KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 3.3MB - Virtual size: 3.3MB

.reloc Size: 440KB - Virtual size: 440KB

65:03:f9:53:62:bb:b1:42:04:fb:61:47:f1:c7:72:08
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

cf:bd:e0:c0:c2:eb:42:ff:34:6e:ce:9a:d0:a4:66:17:17:0b:fc:d1
Signer

.text
Size: 4.6MB - Virtual size: 4.6MB

.rdata
Size: 993KB - Virtual size: 992KB

.data
Size: 202KB - Virtual size: 300KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 3.3MB - Virtual size: 3.3MB

.reloc
Size: 440KB - Virtual size: 440KB