415a4d3d70930b93fe642deeefbf7cb068c7af27df08f636493388aff52cf4d7

Sharing

Copy URL Twitter E-mail

General

Target

415a4d3d70930b93fe642deeefbf7cb068c7af27df08f636493388aff52cf4d7
Size

3.3MB
MD5

762cb74ef9f9ef9afac7bace71667c2b
SHA1

4a4bfab21f83fa64c8a7d5b66a0b8ee502046046
SHA256

415a4d3d70930b93fe642deeefbf7cb068c7af27df08f636493388aff52cf4d7
SHA512

c10bab12db16ab9ffc857079ced8f2f6b34f1691f0123f709ed97370cc1d19673cffe9ef9385824a9a8adb77eb79df2ed1741e3d0f079ca6d1409bb2573a4c41
SSDEEP

98304:HnQpTGcDqDByNWtVzIRHhAhnJ6dEdEy7Mee:HQ1zDEBBUgWdEdEy7Mee

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Atnsoft Key Manager 1.15.0.450/Crack/keymanager.exe

Files

415a4d3d70930b93fe642deeefbf7cb068c7af27df08f636493388aff52cf4d7
.rar
Atnsoft Key Manager 1.15.0.450/50568202F617987B5C2AC657E94396C68F2CCC7B.torrent
Atnsoft Key Manager 1.15.0.450/Crack/keymanager.exe
.exe windows x86

e81645bef9d40435ea1ce9d12d06e8f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEnvironmentVariableA
GetDriveTypeW
WriteConsoleW
LCMapStringW
GetConsoleMode
GetConsoleCP
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetTimeZoneInformation
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
GetFileType
SetStdHandle
HeapSize
HeapQueryInformation
ExitProcess
HeapReAlloc
RaiseException
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualAlloc
CreateDirectoryW
CreateThread
ExitThread
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
FindResourceExW
VirtualProtect
SearchPathW
GetProfileIntW
GetTempPathW
GetTempFileNameW
GetNumberFormatW
GetWindowsDirectoryW
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
GetFileTime
GetFileSizeEx
GetFileAttributesExW
SetErrorMode
GlobalFlags
GlobalGetAtomNameW
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedIncrement
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
FileTimeToSystemTime
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
lstrlenA
lstrcmpA
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
MoveFileW
DeleteFileW
CreateFileW
ResumeThread
InterlockedDecrement
ReleaseActCtx
CreateActCtxW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
lstrcmpW
GetCurrentProcessId
FormatMessageW
LocalFree
MulDiv
GetVersion
lstrcmpiW
LocalAlloc
FreeResource
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
SetThreadPriority
GetCommandLineW
ReleaseMutex
CreateMutexW
GetModuleFileNameW
HeapFree
HeapAlloc
GetProcessHeap
GetLocaleInfoW
lstrlenW
WideCharToMultiByte
SetSystemPowerState
GetCurrentProcess
lstrcpyW
GetFileAttributesW
GetEnvironmentVariableW
GetVersionExW
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
OpenProcess
GlobalUnlock
GlobalAlloc
GlobalLock
GlobalSize
GlobalFree
FindNextFileW
FindClose
FindFirstFileW
GetCurrentThreadId
Sleep
CloseHandle
InterlockedExchange
CopyFileW
MultiByteToWideChar
ActivateActCtx
GetModuleHandleW
DeactivateActCtx
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
GetLastError
GetTickCount
FindResourceW
LoadResource
LockResource
SizeofResource

user32

GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
ScrollWindow
SetMenu
SetScrollRange
GetScrollRange
ShowScrollBar
UpdateWindow
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SendDlgItemMessageW
CheckDlgButton
GetScrollPos
SetScrollPos
GetLastActivePopup
EndPaint
BeginPaint
GetWindowDC
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuStringW
InsertMenuW
RemoveMenu
GetNextDlgGroupItem
SetWindowRgn
LoadBitmapW
DrawFocusRect
OffsetRect
DrawEdge
GetMenuItemID
TrackPopupMenu
LoadMenuW
RegisterWindowMessageW
GetSysColor
GetClassNameW
IsChild
SetFocus
GetKeyboardLayoutList
ReleaseCapture
InvalidateRect
SetCapture
GetCapture
PtInRect
GetKeyboardLayout
GetKeyState
PostThreadMessageW
GetMessageW
GetAsyncKeyState
GetKeyboardState
SendInput
DefFrameProcW
UnhookWindowsHookEx
SetWindowsHookExW
EndDeferWindowPos
CallNextHookEx
GetIconInfo
ReleaseDC
SetWindowPlacement
CopyRect
GetWindowPlacement
DestroyIcon
DrawIconEx
InsertMenuItemW
CharLowerW
CharUpperW
FindWindowW
SetWindowPos
CreateWindowExW
GetFocus
SetRect
ExitWindowsEx
GetClassLongW
MonitorFromWindow
GetMonitorInfoW
SystemParametersInfoW
MessageBoxA
GetWindowTextW
GetWindowTextLengthW
GetTopWindow
IsClipboardFormatAvailable
SetClipboardData
RegisterClipboardFormatW
EmptyClipboard
CloseClipboard
GetClipboardData
GetClipboardFormatNameW
EnumClipboardFormats
OpenClipboard
SetParent
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemCount
SetActiveWindow
ClientToScreen
GetGUIThreadInfo
AttachThreadInput
GetWindowThreadProcessId
MoveWindow
UpdateLayeredWindow
MapVirtualKeyExW
ShowWindow
PostMessageW
GetWindowRect
EnableWindow
MessageBoxW
IsCharLowerW
GetDoubleClickTime
SetCursorPos
GetDC
CheckMenuRadioItem
DrawMenuBar
GetSubMenu
DeleteMenu
ModifyMenuW
IsWindowVisible
SetMenuDefaultItem
SetForegroundWindow
AppendMenuW
CreatePopupMenu
DrawIcon
IsIconic
ScreenToClient
LockWindowUpdate
GetClientRect
GetWindowLongW
SetWindowLongW
LoadIconW
KillTimer
TranslateAcceleratorW
BeginDeferWindowPos
DispatchMessageW
RemovePropW
GetPropW
SetPropW
WinHelpW
SendDlgItemMessageA
CheckMenuItem
EnableMenuItem
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetWindowRgn
DestroyCursor
MapDialogRect
IsWindow
RedrawWindow
GetParent
WindowFromPoint
GetForegroundWindow
GetSystemMetrics
GetCursorPos
SetTimer
GetWindow
LoadAcceleratorsW
LoadImageW
SendMessageW
SubtractRect
CharUpperBuffW
GetUpdateRect
FrameRect
CreateMenu
TranslateMDISysAccel
GetDlgCtrlID
DefMDIChildProcW
CopyIcon
IsMenu
MonitorFromPoint
CreateAcceleratorTableW
ToUnicodeEx
GetKeyNameTextW
SetClassLongW
DestroyAcceleratorTable
UnionRect
GetSystemMenu
NotifyWinEvent
EnableScrollBar
HideCaret
InvertRect
GetMenuDefaultItem
WaitMessage
DrawFrameControl
IsRectEmpty
DrawStateW
SetLayeredWindowAttributes
EnumDisplayMonitors
MessageBeep
UnpackDDElParam
ReuseDDElParam
BringWindowToTop
UnregisterClassW
RealChildWindowFromPoint
LoadCursorW
GetSysColorBrush
IntersectRect
ShowOwnedPopups
SetCursor
PostQuitMessage
CopyImage
TranslateMessage
ValidateRect
DestroyMenu
InflateRect
SetRectEmpty
MapVirtualKeyW
IsZoomed
CopyAcceleratorTableW

gdi32

SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
GetLayout
SetLayout
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
CreateBitmap
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateSolidBrush
CreateHatchBrush
CreateRectRgnIndirect
PatBlt
SetRectRgn
DPtoLP
GetBkColor
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreateEllipticRgn
CreatePolygonRgn
GetTextColor
Polyline
Ellipse
Polygon
RealizePalette
SetPixel
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
CreateRoundRectRgn
OffsetRgn
GetRgnBox
Rectangle
EnumFontFamiliesExW
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
GetTextFaceW
SetTextColor
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCW
GetDeviceCaps
CombineRgn
CreateRectRgn
GetPixel
SelectClipRgn
BitBlt
CreateCompatibleBitmap
GetTextExtentPoint32W
GetObjectW
SetDIBColorTable
GetDIBColorTable
StretchBlt
DeleteDC
SelectObject
CreateCompatibleDC
GetDIBits
CreateDIBSection
CreateFontIndirectW
CopyMetaFileW
CopyEnhMetaFileW
DeleteMetaFile
DeleteEnhMetaFile
DeleteObject
GetTextMetricsW
EnumFontsW

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegEnumKeyW
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegQueryValueW
OpenProcessToken
RegEnumKeyExW
RegEnumValueW
RegCreateKeyExA
RegDeleteKeyW
RegDeleteValueW
AdjustTokenPrivileges
LookupPrivilegeValueW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
DragQueryFileW
ShellExecuteW
Shell_NotifyIconW
SHAppBarMessage
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetDesktopFolder
DragFinish

comctl32

InitCommonControlsEx
_TrackMouseEvent
ImageList_GetIconSize

shlwapi

AssocQueryStringW
ord487
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW

ole32

OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleGetClipboard
CoInitializeEx
OleDuplicateData
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
CreateStreamOnHGlobal
StgCreateStorageEx
StgOpenStorageEx
StgIsStorageFile
CoUninitialize
CoCreateInstance
DoDragDrop
RegisterDragDrop
CoLockObjectExternal
CoInitialize
ReleaseStgMedium
RevokeDragDrop

oleaut32

VariantClear
VariantChangeType
VariantInit
SysAllocString
SysAllocStringLen
SysStringLen
VarBstrFromDate
SysFreeString
VarDateFromStr
VariantTimeToSystemTime
SystemTimeToVariantTime

gdiplus

GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdipFree
GdipDrawImageRectI

winmm

mixerGetLineControlsW
mixerGetNumDevs
PlaySoundW
mixerClose
mixerSetControlDetails
mixerGetControlDetailsW
mixerGetDevCapsW
mixerOpen
mixerGetLineInfoW

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

6br706ue
Size: 604KB - Virtual size: 604KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

h8brciio
Size: 348KB - Virtual size: 348KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Atnsoft Key Manager 1.15.0.450/keymanager_setup.exe
.exe windows x86

20dd26497880c05caed9305b3c8b9109

Code Sign

43:4a:d2:68:fa:82:4d:21:c4:cd:86:3d:38:7a:a9:a6
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/07/2020, 00:00

Not After

08/07/2023, 23:59

Subject

CN=ATNSOFT,O=ATNSOFT,POSTALCODE=398036,STREET=Prospekt Pobedy 116\, 9,L=Lipetsk,ST=RU,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

43:4a:d2:68:fa:82:4d:21:c4:cd:86:3d:38:7a:a9:a6
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/07/2020, 00:00

Not After

08/07/2023, 23:59

Subject

CN=ATNSOFT,O=ATNSOFT,POSTALCODE=398036,STREET=Prospekt Pobedy 116\, 9,L=Lipetsk,ST=RU,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8a:4c:26:69:82:74:b4:ca:19:b6:6e:a8:2f:7c:0c:9b:bb:ce:00:91:b0:e6:f6:db:e0:e1:24:1a:3b:73:ab:c0
Signer

Actual PE Digest

8a:4c:26:69:82:74:b4:ca:19:b6:6e:a8:2f:7c:0c:9b:bb:ce:00:91:b0:e6:f6:db:e0:e1:24:1a:3b:73:ab:c0

Digest Algorithm

sha256

PE Digest Matches

true

8c:76:c4:ae:d4:17:00:9d:db:93:ef:31:33:ce:be:35:17:fb:b9:00
Signer

Actual PE Digest

8c:76:c4:ae:d4:17:00:9d:db:93:ef:31:33:ce:be:35:17:fb:b9:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

user32

GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW

kernel32

GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
GetWindowsDirectoryW
GetVersionExW
GetVersion
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetSystemDirectoryW
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
DeleteFileW
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CloseHandle
Sleep

comctl32

InitCommonControls

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 21KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e81645bef9d40435ea1ce9d12d06e8f4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

winmm

oleacc

imm32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

6br706ue Size: 604KB - Virtual size: 604KB

.data Size: 68KB - Virtual size: 68KB

.rsrc Size: 2.7MB - Virtual size: 2.7MB

h8brciio Size: 348KB - Virtual size: 348KB

20dd26497880c05caed9305b3c8b9109

Code Sign

43:4a:d2:68:fa:82:4d:21:c4:cd:86:3d:38:7a:a9:a6Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

43:4a:d2:68:fa:82:4d:21:c4:cd:86:3d:38:7a:a9:a6Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8a:4c:26:69:82:74:b4:ca:19:b6:6e:a8:2f:7c:0c:9b:bb:ce:00:91:b0:e6:f6:db:e0:e1:24:1a:3b:73:ab:c0Signer

8c:76:c4:ae:d4:17:00:9d:db:93:ef:31:33:ce:be:35:17:fb:b9:00Signer

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

comctl32

Sections

.text Size: 61KB - Virtual size: 60KB

.itext Size: 4KB - Virtual size: 3KB

.data Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 21KB

.idata Size: 4KB - Virtual size: 3KB

.tls Size: - Virtual size: 8B

.text
Size: 1.5MB - Virtual size: 1.5MB

6br706ue
Size: 604KB - Virtual size: 604KB

.data
Size: 68KB - Virtual size: 68KB

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

h8brciio
Size: 348KB - Virtual size: 348KB

43:4a:d2:68:fa:82:4d:21:c4:cd:86:3d:38:7a:a9:a6
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

43:4a:d2:68:fa:82:4d:21:c4:cd:86:3d:38:7a:a9:a6
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8a:4c:26:69:82:74:b4:ca:19:b6:6e:a8:2f:7c:0c:9b:bb:ce:00:91:b0:e6:f6:db:e0:e1:24:1a:3b:73:ab:c0
Signer

8c:76:c4:ae:d4:17:00:9d:db:93:ef:31:33:ce:be:35:17:fb:b9:00
Signer

.text
Size: 61KB - Virtual size: 60KB

.itext
Size: 4KB - Virtual size: 3KB

.data
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 21KB

.idata
Size: 4KB - Virtual size: 3KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.rsrc
Size: 44KB - Virtual size: 44KB