212128dff491bae9d1563b66954dc11a_mafia_magniber_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

212128dff491bae9d1563b66954dc11a_mafia_magniber_JC.exe
Size

2.6MB
MD5

212128dff491bae9d1563b66954dc11a
SHA1

0cb46ea5fdd680dc6f3fd8010973689757050ffe
SHA256

13bf17cae084683102a46c6e1a7223e9278f736e8fff61dacf7ad5d662c2b27c
SHA512

9f8a5f8d7ee1b546198af735c91d47f332b2a841714526cc0be8e8f70fe3b50eaeb1b0110a46dfe481ddf3e6b4824f00080798f9b765c9ae492de036a024bb5e
SSDEEP

49152:ttL3ftRSJEKs2DP/qiCfJg/CrdSWJrScJVcb79ojG/mtEu2SgXOnxduzS0fK+ah9:TVRuzs2DP/bn/CRJpVcb7sGU3qDzS0In

Score

1^/10

Malware Config

Signatures

Files

212128dff491bae9d1563b66954dc11a_mafia_magniber_JC.exe
.exe windows x86

b36dde7faec0dbe70c102edbf12faee7

Code Sign

08:93:8e:06:3f:2c:05:9f:fc:f5:54:22:39:a4:83:65
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/03/2020, 00:00

Not After

22/03/2023, 12:00

Subject

CN=Sangfor Technologies Inc.,OU=research and development department,O=Sangfor Technologies Inc.,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:37:b3:4f:a0:45:c0:00:bc:cd:99:99:6e:1e:eb:29
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/03/2020, 00:00

Not After

22/03/2023, 12:00

Subject

CN=Sangfor Technologies Inc.,OU=research and development department,O=Sangfor Technologies Inc.,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b1:32:bf:cb:ec:59:ff:e7:39:9e:9c:0d:fb:d7:a3:46:b1:f2:ce:fe:df:4b:57:0d:ab:3a:90:da:07:75:7e:a4
Signer

Actual PE Digest

b1:32:bf:cb:ec:59:ff:e7:39:9e:9c:0d:fb:d7:a3:46:b1:f2:ce:fe:df:4b:57:0d:ab:3a:90:da:07:75:7e:a4

Digest Algorithm

sha256

PE Digest Matches

true

70:b7:89:78:c5:72:77:41:f6:c6:ad:8d:30:65:de:2f:35:6c:5c:d1
Signer

Actual PE Digest

70:b7:89:78:c5:72:77:41:f6:c6:ad:8d:30:65:de:2f:35:6c:5c:d1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

sangforvpnssleay32

ord77
ord242
ord61
ord157
ord127
ord130
ord385
ord116
ord266
ord361
ord387
ord90
ord164
ord45
ord60
ord180
ord31
ord96
ord86
ord76
ord74
ord235
ord17
ord49
ord126
ord5
ord87
ord28
ord43
ord21
ord15
ord22
ord110
ord183
ord78
ord8
ord48
ord108
ord12
ord30
ord24
ord222
ord75
ord141
ord58
ord112
ord35
ord6

sangforvpnlibeay32

ord490
ord497
ord117
ord129
ord484
ord119
ord3686
ord464
ord469
ord1114
ord486
ord161
ord1095
ord150
ord3106
ord3171
ord227
ord2206
ord281
ord641
ord52
ord1882
ord401
ord399
ord66
ord2437
ord2436
ord2435
ord784
ord809
ord3024
ord808
ord3479
ord3712
ord341
ord340
ord391
ord2454
ord869
ord653
ord7
ord656
ord151
ord120
ord421
ord544
ord542
ord1180
ord543
ord18
ord979
ord680
ord248
ord556
ord625
ord958
ord2254
ord466
ord2201
ord467
ord280
ord654
ord223
ord2431
ord78
ord95
ord2291
ord3182
ord3212
ord3214
ord222
ord181
ord2442
ord188
ord1951
ord566
ord578
ord579
ord657
ord1216
ord2023
ord2075
ord1653
ord1654
ord1958
ord3173
ord2838
ord2844
ord2647
ord2971
ord2989
ord2593
ord3025
ord3048
ord3164
ord2598
ord2561
ord3020
ord2596

wldap32

ord301
ord33
ord79
ord27
ord32
ord200
ord30
ord26
ord35
ord50
ord46
ord41
ord60
ord143
ord211
ord22

kernel32

IsProcessorFeaturePresent
TlsFree
TlsSetValue
TlsGetValue
GetLocaleInfoW
SetFileAttributesA
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
CompareStringW
LCMapStringW
GetCPInfo
RtlUnwind
RaiseException
GlobalMemoryStatus
GetLogicalDrives
GetComputerNameA
GetVolumeInformationA
LoadLibraryExW
InterlockedIncrement
InterlockedCompareExchange
InterlockedDecrement
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
GetLastError
SetLastError
FormatMessageA
LocalFree
SwitchToThread
GetProcessTimes
GetCurrentProcessId
CloseHandle
DuplicateHandle
GetCurrentProcess
CreateMutexA
WaitForSingleObject
ReleaseMutex
UnmapViewOfFile
CreateSemaphoreA
ReleaseSemaphore
CreateFileMappingA
MapViewOfFileEx
CreateFileA
GetSystemInfo
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
WriteFile
InterlockedExchangeAdd
GetProcAddress
GetModuleHandleA
GetTickCount
CreateEventA
HeapAlloc
GetProcessHeap
HeapFree
QueryPerformanceCounter
QueryPerformanceFrequency
SetEvent
WaitForSingleObjectEx
ExpandEnvironmentStringsA
ResetEvent
CreateEventW
ExpandEnvironmentStringsW
GetCurrentThreadId
MultiByteToWideChar
GetDriveTypeA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ResumeThread
WaitForMultipleObjects
GlobalFree
OpenFileMappingA
OpenEventA
GetModuleHandleW
AllocConsole
SetConsoleTitleW
GetStdHandle
SetConsoleTextAttribute
FreeConsole
GetModuleFileNameW
MapViewOfFile
GetTempPathW
FindFirstFileW
OutputDebugStringW
DeleteFileW
FindNextFileW
FindClose
VirtualQuery
VirtualFree
VirtualAlloc
GetThreadContext
HeapReAlloc
SetThreadContext
Thread32First
HeapDestroy
HeapCreate
Thread32Next
FlushInstructionCache
OpenThread
VirtualProtect
CreateToolhelp32Snapshot
SuspendThread
SetUnhandledExceptionFilter
GetCommandLineW
SetHandleInformation
GetFileAttributesW
GetPrivateProfileIntW
GetPrivateProfileStringW
FreeLibrary
GetStartupInfoW
CreateProcessW
FindResourceA
LoadResource
SizeofResource
LockResource
OpenMutexA
CreateDirectoryW
CreateFileW
LoadLibraryW
OpenProcess
TerminateProcess
Process32FirstW
Process32NextW
GetLocalTime
OutputDebugStringA
TerminateThread
SleepEx
VerifyVersionInfoA
VerSetConditionMask
ReadFile
PeekNamedPipe
GetFileType
LoadLibraryA
GetVersionExW
AreFileApisANSI
SetFilePointer
FlushFileBuffers
GetFileSize
UnlockFile
LockFile
LockFileEx
UnlockFileEx
GetFileAttributesA
DeleteFileA
GetFileAttributesExW
GetSystemTime
GetTempPathA
FormatMessageW
GetFullPathNameA
GetFullPathNameW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
CreateFileMappingW
SystemTimeToFileTime
GetFileInformationByHandle
HeapSetInformation
FindFirstFileExA
GetDateFormatA
GetTimeFormatA
GetThreadPriority
GetCurrentThread
SetThreadPriority
EncodePointer
DecodePointer
ExitThread
CreateThread
HeapQueryInformation
HeapSize
UnhandledExceptionFilter
IsDebuggerPresent
CreateProcessA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
WideCharToMultiByte
CreateDirectoryA
MoveFileA
CreateWaitableTimerA
WaitForMultipleObjectsEx
SetWaitableTimer
DeviceIoControl
RemoveDirectoryW
SetEnvironmentVariableA
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
GetExitCodeProcess
CreatePipe
GetConsoleMode
GetConsoleCP
SetStdHandle
SetHandleCount
FindFirstFileExW

user32

MessageBoxA
CharLowerW

advapi32

RegQueryValueExA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegCreateKeyW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyA
RegEnumValueW
RegSetValueExW
RegEnumValueA
RegQueryInfoKeyA
RegQueryValueExW
RegOpenKeyExW
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
LookupAccountNameA
GetUserNameA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetLengthSid
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner

shell32

SHGetSpecialFolderPathW
CommandLineToArgvW

ole32

CoCreateGuid
CLSIDFromProgID

ws2_32

WSAGetLastError
htons
ntohs
getsockname
setsockopt
shutdown
select
htonl
ntohl
recvfrom
inet_ntoa
connect
ioctlsocket
getpeername
getaddrinfo
freeaddrinfo
WSASetLastError
gethostname
WSAStartup
WSACleanup
accept
listen
getsockopt
send
closesocket
__WSAFDIsSet
sendto
bind
recv
socket
WSAIoctl

shlwapi

StrChrW
PathFileExistsW
StrStrIW
StrStrIA

winmm

timeGetTime

crypt32

CryptQueryObject
CertAddCertificateContextToStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winhttp

WinHttpGetIEProxyConfigForCurrentUser

wininet

InternetQueryOptionW
InternetSetOptionW

psapi

GetModuleFileNameExW

Exports

Exports

??0?$oserializer@Vtext_oarchive@archive@boost@@UtMsgBackString@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtMsgBackString@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtMsgJsAction@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtMsgOpenBrowser@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtMsgReadConfig@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtMsgWriteConfig@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtMsgBackString@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtMsgJsAction@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtMsgOpenBrowser@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtMsgReadConfig@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtMsgWriteConfig@@@serialization@boost@@@serialization@boost@@QAE@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtMsgBackString@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtMsgBackString@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtMsgJsAction@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtMsgJsAction@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtMsgOpenBrowser@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtMsgOpenBrowser@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtMsgReadConfig@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtMsgReadConfig@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtMsgWriteConfig@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtMsgWriteConfig@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgBackString@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgBackString@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgBackString@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgBackString@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@3@XZ
?get_lock@singleton_module@serialization@boost@@CAAA_NXZ
?get_mutable_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@@serialization@boost@@SAAAV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@boost@@@serialization@boost@@SAAAV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@boost@@@serialization@boost@@SAAAV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@boost@@@serialization@boost@@SAAAV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgBackString@@@detail@archive@boost@@@serialization@boost@@SAAAV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgBackString@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@@serialization@boost@@SAAAV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@3@XZ
?is_destroyed@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_locked@singleton_module@serialization@boost@@SA_NXZ
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_ptr@?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@EBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_ptr@?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@boost@@EBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_ptr@?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@boost@@EBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_ptr@?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@boost@@EBEXAAVbasic_iarchive@234@PAXI@Z
?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@SAXXZ
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@UtMsgBackString@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_ptr@?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgBackString@@@detail@archive@boost@@EBEXAAVbasic_oarchive@234@PBX@Z
?save_object_ptr@?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@EBEXAAVbasic_oarchive@234@PBX@Z
?unlock@singleton_module@serialization@boost@@SAXXZ

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 393KB - Virtual size: 392KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b36dde7faec0dbe70c102edbf12faee7

Code Sign

08:93:8e:06:3f:2c:05:9f:fc:f5:54:22:39:a4:83:65Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

03:37:b3:4f:a0:45:c0:00:bc:cd:99:99:6e:1e:eb:29Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

b1:32:bf:cb:ec:59:ff:e7:39:9e:9c:0d:fb:d7:a3:46:b1:f2:ce:fe:df:4b:57:0d:ab:3a:90:da:07:75:7e:a4Signer

70:b7:89:78:c5:72:77:41:f6:c6:ad:8d:30:65:de:2f:35:6c:5c:d1Signer

Headers

DLL Characteristics

File Characteristics

Imports

sangforvpnssleay32

sangforvpnlibeay32

wldap32

kernel32

user32

advapi32

shell32

ole32

ws2_32

shlwapi

winmm

crypt32

version

winhttp

wininet

psapi

Exports

Exports

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 393KB - Virtual size: 392KB

.data Size: 38KB - Virtual size: 85KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 124KB - Virtual size: 123KB

08:93:8e:06:3f:2c:05:9f:fc:f5:54:22:39:a4:83:65
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

03:37:b3:4f:a0:45:c0:00:bc:cd:99:99:6e:1e:eb:29
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b1:32:bf:cb:ec:59:ff:e7:39:9e:9c:0d:fb:d7:a3:46:b1:f2:ce:fe:df:4b:57:0d:ab:3a:90:da:07:75:7e:a4
Signer

70:b7:89:78:c5:72:77:41:f6:c6:ad:8d:30:65:de:2f:35:6c:5c:d1
Signer

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 393KB - Virtual size: 392KB

.data
Size: 38KB - Virtual size: 85KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 124KB - Virtual size: 123KB