bdcam[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bdcam.exe
Size

6.7MB
MD5

268393caa92b441f3cc5ab62234f4617
SHA1

2524c5b2161a14cabfab2aa44d23bf2ae0969c9a
SHA256

852408b2a080d44405695e0203514e7a29d480d2c7d0f7e185f13f364ac802e1
SHA512

50cc74d845b392aaf99be9dfb0296ad506199414d998cfeb027561371064188508fcf91f2779dac3538478d4629e1443d210e5c248d70660d0807354cb82f283
SSDEEP

98304:Uvsw+QqGeSxY6/QykO8cGaNELs3ow1dY+vRAvvoqHKuvSTTc8JESGvuaMG7saG0:UvsrQ7Y6tH5f1dY+vRu4uvWJuvug95

Score

1^/10

Malware Config

Signatures

Files

bdcam.exe
.exe windows x86

5598d976a91b6323681ce63e961d3346

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

22/12/2017, 00:00

Not After

19/02/2021, 23:59

Subject

CN=Bandicam Company,O=Bandicam Company,L=Yeoungdeungpo-=gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

22/12/2017, 00:00

Not After

19/02/2021, 23:59

Subject

CN=Bandicam Company,O=Bandicam Company,L=Yeoungdeungpo-=gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

98:ce:d6:1f:4f:5f:1b:dc:b4:a2:54:5f:64:19:35:00:fd:ec:3e:76:58:0c:c9:d0:a5:de:f4:2e:82:7c:af:8d
Signer

Actual PE Digest

98:ce:d6:1f:4f:5f:1b:dc:b4:a2:54:5f:64:19:35:00:fd:ec:3e:76:58:0c:c9:d0:a5:de:f4:2e:82:7c:af:8d

Digest Algorithm

sha256

PE Digest Matches

true

82:03:9d:66:3d:6d:8d:29:67:e2:19:9b:39:ea:1c:3f:0e:d7:3c:20
Signer

Actual PE Digest

82:03:9d:66:3d:6d:8d:29:67:e2:19:9b:39:ea:1c:3f:0e:d7:3c:20

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetDriveTypeW
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetStdHandle
VirtualQuery
InitializeSListHead
GetCommandLineW
GetCommandLineA
GetFileType
SetStdHandle
FreeLibraryAndExitThread
ExitThread
RtlUnwind
LCMapStringW
GetCPInfo
GetStringTypeW
LoadLibraryExA
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
WriteConsoleW
GetStartupInfoW
WaitForSingleObjectEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetProfileIntW
SearchPathW
VerifyVersionInfoW
VerSetConditionMask
GetFileAttributesExW
VirtualProtect
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GlobalGetAtomNameW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CompareStringA
ResumeThread
UnlockFile
SetEndOfFile
LockFile
GetThreadLocale
IsDebuggerPresent
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
EncodePointer
LoadLibraryA
GetModuleHandleA
CopyFileW
DuplicateHandle
lstrcmpiW
GetThreadPriority
WaitForMultipleObjects
SwitchToThread
LoadLibraryExW
GetModuleHandleExW
SetErrorMode
SetUnhandledExceptionFilter
DecodePointer
FormatMessageW
MoveFileW
GetDateFormatW
CreateThread
ReadDirectoryChangesW
SleepEx
GetLocalTime
GetUserDefaultLCID
LCIDToLocaleName
GetUserDefaultLangID
CompareStringW
QueryFullProcessImageNameW
GetTickCount
GetSystemWow64DirectoryW
RaiseException
GetCurrentThreadId
InitializeCriticalSectionEx
CreateFileMappingW
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateMutexW
VirtualFree
VirtualAlloc
CreateEventW
GlobalSize
GlobalUnlock
GlobalLock
FlushFileBuffers
ExitProcess
FileTimeToLocalFileTime
lstrcmpA
LocalAlloc
ResetEvent
SetEvent
CreateEventA
GetWindowsDirectoryW
lstrlenA
QueryPerformanceFrequency
GetTickCount64
QueryPerformanceCounter
FindResourceExW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
MulDiv
lstrcmpW
WriteFile
SetThreadPriority
Sleep
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetVersionExW
GetSystemInfo
TerminateProcess
OpenProcess
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
GetExitCodeProcess
GetLastError
WaitForSingleObject
CreateProcessW
IsDBCSLeadByteEx
MultiByteToWideChar
WideCharToMultiByte
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
LocalFree
GetFileSizeEx
GetFileSize
GetFileAttributesW
DeleteFileW
GetTempFileNameW
GetTempPathW
GetCurrentDirectoryW
GetSystemDirectoryW
GetModuleFileNameW
GetDiskFreeSpaceW
GlobalFree
GlobalAlloc
GetCurrentThread
GetCurrentProcess
FreeLibrary
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetVolumeInformationW
SetLastError
FindClose
FindNextFileW
lstrcpyW
FindFirstFileW
lstrcpynW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetFileTime
FindResourceW
LoadResource
LockResource
SizeofResource
ReadFile
SetFilePointer
CreateFileW
OutputDebugStringA
OutputDebugStringW
lstrlenW
CloseHandle
HeapQueryInformation
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

BeginDeferWindowPos
SetWindowPlacement
IsChild
IsMenu
GetMessageTime
GetMessagePos
RemoveMenu
InsertMenuW
GetMenuState
MsgWaitForMultipleObjects
GetQueueStatus
PostThreadMessageW
GetActiveWindow
GetMessageW
SetMenuDefaultItem
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetWindow
WindowFromPoint
GetCursor
GetCursorInfo
ShowCursor
FillRect
AppendMenuW
CreatePopupMenu
GetDoubleClickTime
SetCursorPos
UpdateLayeredWindowIndirect
GetCapture
EnableMenuItem
UpdateLayeredWindow
SetParent
CheckMenuItem
DeleteMenu
CheckMenuRadioItem
DrawIconEx
LoadImageW
SetClassLongW
GetAsyncKeyState
TranslateAcceleratorW
DrawIcon
LoadAcceleratorsW
GetClassInfoW
EnumDisplayDevicesW
MessageBoxW
EnumDisplayMonitors
GetWindowTextLengthW
GetFocus
IsWindowEnabled
TrackPopupMenuEx
DestroyMenu
LoadMenuW
TrackMouseEvent
SetWindowRgn
GetClassInfoExW
RegisterClassExW
DeferWindowPos
SetFocus
InflateRect
GetCursorPos
GetWindowDC
SetScrollInfo
SetScrollRange
SetScrollPos
CreateWindowExW
EndPaint
BeginPaint
GetSysColor
GetKeyState
DestroyWindow
UnionRect
IsClipboardFormatAvailable
CloseClipboard
SetClipboardData
PostQuitMessage
IsZoomed
EmptyClipboard
OpenClipboard
CreateDialogIndirectParamW
SetWindowContextHelpId
SendMessageW
GetNextDlgTabItem
KillTimer
SetTimer
ShowWindow
CallWindowProcW
RemovePropW
GetPropW
SetPropW
SetLayeredWindowAttributes
SetActiveWindow
IntersectRect
RegisterClassW
LoadIconW
DefWindowProcW
GetSysColorBrush
InvalidateRect
SetCursor
LoadCursorW
SetCapture
RedrawWindow
ReleaseCapture
PtInRect
GetClientRect
EnableWindow
wsprintfW
GetSubMenu
GetMenuItemInfoW
ModifyMenuW
GetMenuItemID
EndDeferWindowPos
GetDlgItem
GetMenu
SetMenu
TrackPopupMenu
UpdateWindow
ValidateRect
ScrollWindow
GetScrollPos
GetScrollRange
ShowScrollBar
AdjustWindowRectEx
GetTopWindow
GetLastActivePopup
GetScrollInfo
WinHelpW
MonitorFromWindow
CheckDlgButton
GetMenuStringW
GetMenuItemCount
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
DrawTextExW
GrayStringW
UnregisterClassW
SystemParametersInfoW
GetWindowRect
MonitorFromRect
GetMonitorInfoW
CopyRect
MonitorFromPoint
OffsetRect
EqualRect
MoveWindow
GetWindowLongW
SetWindowPos
ScreenToClient
ClientToScreen
PeekMessageW
TranslateMessage
DispatchMessageW
IsWindow
GetParent
GetDesktopWindow
FindWindowExW
GetWindowThreadProcessId
IsWindowVisible
IsIconic
GetWindowTextW
GetWindowPlacement
GetForegroundWindow
SetForegroundWindow
BringWindowToTop
GetDC
ReleaseDC
RegisterWindowMessageW
DestroyIcon
DrawTextW
ExitWindowsEx
PostMessageW
IsRectEmpty
MapDialogRect
ShowOwnedPopups
SendDlgItemMessageA
DrawStateW
GetKeyNameTextW
EnableScrollBar
MapVirtualKeyW
CopyImage
RealChildWindowFromPoint
InsertMenuItemW
TabbedTextOutW
MessageBeep
EndDialog
GetClassNameW
GetClassLongW
SetRectEmpty
SetRect
GetDlgCtrlID
SetWindowTextW
MapWindowPoints
SetWindowLongW
EnumChildWindows
GetSystemMetrics
UnpackDDElParam
ReuseDDElParam
GetSystemMenu
NotifyWinEvent
WaitMessage
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
RegisterClipboardFormatW
LockWindowUpdate
CharNextW
InvalidateRgn
GetNextDlgGroupItem
GetMenuDefaultItem
GetWindowRgn
GetComboBoxInfo
DestroyCursor
CreateMenu
InvertRect
HideCaret
GetIconInfo
GetUpdateRect
SubtractRect
MapVirtualKeyExW
IsCharLowerW
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
FrameRect
CopyIcon
CharUpperBuffW
DrawFocusRect
DrawFrameControl
DrawEdge
CharUpperW

gdi32

CreateRectRgnIndirect
FillRgn
CopyMetaFileW
CreateBitmap
CreateHatchBrush
CreatePatternBrush
Escape
GetClipBox
GetObjectType
GetViewportExtEx
IntersectClipRect
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
GetPixel
PatBlt
GetMapMode
SetRectRgn
DPtoLP
CreateDIBitmap
GetTextCharsetInfo
GetDIBits
RealizePalette
SetPixel
SetDIBColorTable
CreateRoundRectRgn
GetRgnBox
GetTextColor
GetBkColor
EnumFontFamiliesExW
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
LPtoDP
RoundRect
ExtFloodFill
SetPaletteEntries
GetViewportOrgEx
GetWindowOrgEx
FrameRgn
GetBoundsRect
PtInRegion
GetTextFaceW
SetPixelV
Rectangle
CreatePen
CreateDCW
CreateSolidBrush
ExtCreateRegion
LineTo
MoveToEx
CombineRgn
OffsetRgn
CreateRectRgn
ExcludeClipRect
SetWindowOrgEx
CreateCompatibleBitmap
TextOutW
SetTextCharacterExtra
AbortPath
GetPath
EndPath
CloseFigure
BeginPath
StretchBlt
BitBlt
CreateDIBSection
CreateFontIndirectW
GetDeviceCaps
SelectObject
SetTextColor
SetBkMode
CreateCompatibleDC
DeleteDC
CreateFontW
DeleteObject
ExtTextOutW
SetBkColor
EnumFontFamiliesW
GetObjectW
GetStockObject
GetTextMetricsW
ScaleWindowExtEx
GetWindowExtEx
GetTextExtentPoint32W

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetOpenFileNameW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

InitializeSecurityDescriptor
OpenProcessToken
AllocateAndInitializeSid
FreeSid
SetEntriesInAclW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueW
RegEnumKeyW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityDescriptorDacl
RegQueryInfoKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
SetNamedSecurityInfoW

shell32

SHBrowseForFolderW
ord190
SHOpenFolderAndSelectItems
ord155
ShellExecuteW
Shell_NotifyIconW
SHChangeNotify
CommandLineToArgvW
ExtractIconExW
SHGetFileInfoW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetMalloc
SHAppBarMessage
DragFinish
DragQueryFileW
SHGetPathFromIDListW

comctl32

InitCommonControlsEx

shlwapi

StrStrW
PathFindExtensionW
PathIsDirectoryW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathFindFileNameW

uxtheme

GetThemeSysColor
IsAppThemed
DrawThemeText
DrawThemeParentBackground
DrawThemeBackground
IsThemeBackgroundPartiallyTransparent
OpenThemeData
CloseThemeData
GetThemePartSize
GetThemeColor
GetCurrentThemeName
GetWindowTheme

ole32

OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleCreateMenuDescriptor
OleUninitialize
OleInitialize
OleLockRunning
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoGetClassObject
CreateStreamOnHGlobal
CoDisconnectObject
StgOpenStorageOnILockBytes
CoCreateGuid
CLSIDFromString
CoInitializeEx
ReleaseStgMedium
OleDuplicateData
CoFreeUnusedLibraries
CoTaskMemAlloc
PropVariantClear
CoInitialize
CoTaskMemFree
CoCreateInstance
OleSetContainedObject
OleCreate
CoUninitialize
CoRevokeClassObject
CoRegisterMessageFilter
CLSIDFromProgID

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
SysStringLen
VariantCopy
VarBstrFromDate
LoadTypeLi
OleCreateFontIndirect
SysFreeString
VariantInit
VariantClear
SysAllocString
SafeArrayDestroy
OleCreatePropertyFrame
VariantChangeType

oledlg

OleUIBusyW

urlmon

CoInternetCombineUrl

gdiplus

GdipCloneBrush
GdipDrawString
GdipSetClipRectI
GdipResetClip
GdipFillRectangleI
GdipSetSmoothingMode
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipSetPenStartCap
GdipSetPenEndCap
GdipDrawLineI
GdipCreateAdjustableArrowCap
GdipDeleteCustomLineCap
GdipSetPenCustomEndCap
GdipCreateSolidFill
GdipFillEllipse
GdipGetDC
GdipCreateFontFromDC
GdipCreateFontFromLogfontW
GdipReleaseDC
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdiplusShutdown
GdipFlush
GdipCreateFromHDC
GdipDrawEllipseI
GdipGetDpiX
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreatePath
GdipDeletePath
GdipAddPathEllipseI
GdipSetClipPath
GdipDrawImageI
GdipFillEllipseI
GdipCreateRegion
GdipDeleteRegion
GdipAddPathRectangleI
GdipCreateRegionPath
GdipSetClipRegion
GdipCreateRegionRectI
GdipCombineRegionRectI
GdipFillRegion
GdipSetPenWidth
GdipSetPenDashArray
GdipSetEmpty
GdipCombineRegionRegion
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectI
GdipSetTextRenderingHint
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromHBITMAP
GdipSetInterpolationMode
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipGraphicsClear
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdiplusStartup
GdipDeleteBrush
GdipDrawRectangleI
GdipImageRotateFlip

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wininet

InternetQueryOptionW
InternetConnectW
InternetSetCookieW
HttpOpenRequestA
HttpEndRequestW
InternetWriteFile
HttpSendRequestExW
HttpAddRequestHeadersW
InternetConnectA
InternetCrackUrlA
HttpOpenRequestW
InternetCanonicalizeUrlW
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
InternetCloseHandle
InternetReadFile
InternetQueryDataAvailable
HttpQueryInfoW
InternetOpenUrlW
HttpSendRequestW

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CertGetNameStringW
CryptMsgGetParam
CryptQueryObject
CryptDecodeObject

psapi

EnumProcessModules
GetModuleFileNameExW

winmm

timeBeginPeriod
timeEndPeriod
PlaySoundW
waveOutSetVolume
timeSetEvent
timeKillEvent

msvfw32

ICInfo
ICOpen
ICClose
ICGetInfo
ICSendMessage

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetContext
ImmReleaseContext
ImmGetOpenStatus

Exports

Exports

)�1�2=N��J ��Q8�.��C��a�� <��џ1�WY��!S3z��v��U�-�$7D�OL��[^��7�h)��z�x�m7�!q�o��)�;Y~dHv;[�q��g�N�;�Z��݂�S�t�8�Q��4�y��4+�� I�_Ȧ�$� `��ז�s�?�²�Nr<�M2��O��]�~E��V��%��?�!N��}s'��n�>��qHM�g5�LRP�"��4a@�q�Wm�H)ۖP)�,M��D�a�ҙ�R��?;�d"9.��=��b�!�9�+�Oʪ{nR�-�U��]�IuA�>�ϊ��<��LS��.s�9�ƲKQ�Cb)&�УI�u�.J ��H(׷�G��r)��V�H��B0�F{]o�H��[T �Jy:��.�>�<lz9Wʹ�H�5[�*yN��oF�Ż\�&7s�XՎ��Ti��-%��a�43x1~�k��۷r��c��B �4�:55��)�^� ��m��y�ɞ�1l��~��+iX��kP��vſD��,Ξ��o%�9=��[Z��!Fz��#�g(S�j�o�ƵЬ�Tx8��T��c0��&�?��bV]��JBF��Ve�3 ��5��u��D�� y \#��f��6�}��.�H��*ׯU� Џ�^�\O*�<��Bm�5�,�tO��D<��r/:��Uc9��Ώ��}]"�܌R�-R�Z{�;ƴ˵0T��lu�ߤB�M��4� ��W��.��?��R�F��~-�맗#�*c1��"]iF�iN�y��[bfR�2y,�FT}A��/��=��?��%q�a:�^�0��B-�ji�4��|��A�/�U�uT�y1e��C�G>\�B|�|��9�KnfGq3N��9��i��\��處6�wD2!G�S��9N6V�Ml��D��`�Q��ӪkC(�w�Y��%j"�zD��ݬ�G�?��'�H�*�#� �xڼ��z2�e9��{@��E��ߙ��eF��P�}�VBR�YHP!T�� +g|��=I:�cky�u��F#�k�91ެ��Ŧ��S��pV��u"�ۆh�B��3v�}�Q��:�U}��m��,l '��o�k�T��w��:��V��NkCՈ�s�U��e�c�WF�� <z%�?�}{�RJu.Ş�2&8�?\T��$��v;k��"��^&O:X�WL��*!A��z��NH�� `�uh�Q�9�s��0� �7� ��&�Ԋ�4�hn�wJ�+H�i��a�L�Hs;�d�1��,��F�� y;\�>�@��B�g��r��E�� N?FBq��Ƈ �`�QB��l��Qi:�#3q��i1�:=�BΡ��A(G�ᕦ��9��r��惯` ��'i�Ts��t��{�b헚+ރ��|'�m�8Fk��U��wC��+�@�M첥Jr��r�o%DU��8�uj��~��F_�r1��D�:5�ZQ�2B[��E|ML9�Кh �j��i/G��@:�Fkf�r9c��芨�[��d!�N��3��@a~�g <�(�Kҥ�#N�\Q9MYPO��A�-#q?&`�~�A{��Gh��M�Y&2[�1X��5�n�rVL[ZR�E��!�tV`wP��:oR�;�EG=E��!2YBF�b��at�7Ov\R�\u@��oQ@��D��H!:��S��^�Q�T|��b�gE�"{FU'dB�i�nDez�]Qg��Ŀ+�qy\��<�j �'��Q��Moi�@ٳ�g��:ِHw�� Q2DA�l2��Aqf�W�ky4P\ZNP��<�mm~��ڳI ��k߯2面��a��o5-��mf�Y��>��੕��t��h��Ü��)� �� 2�&�Y��լܳ�aS��wwT_t�ʶչ�d�yX3�:#K��U�#� �ԸT��8�^��J�d��ΟL&E�@ E �0q�ʻw�y��<�Z��N ��UC��z4��,s�A�},�OeW܈@��/�,��K�=�V��}�$�=��Dӻ�H��K��Dq��ٛ��Ni��tt�q�u��wۗ�~�Bc��VF� ��%Ϻf�L�:X��VobY-� ��ݾO � f+��H:��|��o��3̻��臗^��#�t@��?��*��!W`h�\��خR�U�ԝN!�脤��͒ �5�JH�6kl�) ��,]�0�s*Nć/�_i� �W�z�}�⥳��n��d�h�e��6�x ��-�GPV�|J#1Z��5��m��qgգR��T�<=��;��%��-U��b��?sw�ݣㄉ�H�]�=C�s��3��}w"�vc��S��+0f�V�m�70��V:f>f(le eMN�)8J�Z��D��k�XY�(�o �L@�(� \��dYk便u�/��8S�aݝ��/F�D��U��~��܈;��Dx�݋�ma�˿�ʜ�V�-ߵ��Z˒פ|$�� E�IӬԳO޷��C��T��9��Ӄü��k�A.��Hk��;F��z^�F �|L��rDi��+S�GOj��[w�/L��,b:�� 0�V��ރ�H�<9�M��%�MJ�1S�Dd��ݹFI1B�P��>Jã�f��#�o7�(4� ?�,��w�ietxS��/T0��){�$��m��@;��>h�s��8��Y��f^�K�d�қ��C�)�p;JI.4,�O xA��fRL2�:�{hu��Y�Fȵ9r�)�QS�{��`�Ė�#��]��-D=Ї$o��A��28{��D[@� h��+�:��#m�d��H� �ǝ�Ti�*eޅ/��)y� Et

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 673KB - Virtual size: 673KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 245KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BANDISH
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BANDI0
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.BANDI1
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 707KB - Virtual size: 707KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5598d976a91b6323681ce63e961d3346

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

98:ce:d6:1f:4f:5f:1b:dc:b4:a2:54:5f:64:19:35:00:fd:ec:3e:76:58:0c:c9:d0:a5:de:f4:2e:82:7c:af:8dSigner

82:03:9d:66:3d:6d:8d:29:67:e2:19:9b:39:ea:1c:3f:0e:d7:3c:20Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

urlmon

gdiplus

version

wininet

crypt32

psapi

winmm

msvfw32

oleacc

imm32

Exports

Exports

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 673KB - Virtual size: 673KB

.data Size: 245KB - Virtual size: 273KB

.BANDISH Size: 512B - Virtual size: 16B

.BANDI0 Size: 1.6MB - Virtual size: 1.6MB

.BANDI1 Size: 97KB - Virtual size: 97KB

.reloc Size: 240KB - Virtual size: 240KB

.rsrc Size: 707KB - Virtual size: 707KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

98:ce:d6:1f:4f:5f:1b:dc:b4:a2:54:5f:64:19:35:00:fd:ec:3e:76:58:0c:c9:d0:a5:de:f4:2e:82:7c:af:8d
Signer

82:03:9d:66:3d:6d:8d:29:67:e2:19:9b:39:ea:1c:3f:0e:d7:3c:20
Signer

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 673KB - Virtual size: 673KB

.data
Size: 245KB - Virtual size: 273KB

.BANDISH
Size: 512B - Virtual size: 16B

.BANDI0
Size: 1.6MB - Virtual size: 1.6MB

.BANDI1
Size: 97KB - Virtual size: 97KB

.reloc
Size: 240KB - Virtual size: 240KB

.rsrc
Size: 707KB - Virtual size: 707KB