winbox[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

winbox.exe
Size

1.7MB
MD5

9e8943dde34b1468a2e8209ed2b3afef
SHA1

5894b2a9a83fd08b142bdb3d5ede400f85fc7aa9
SHA256

d71b0aa804d1115bbb6f5b43059c75012be8eb75fede61c082b70690629ce2a4
SHA512

0f1f07d95a1fa3e14209a00d213f1f0af537d5cf142f1d83d097d59916ad81b20b8fd992c99d0825e5c59a5e3b73c0a60fdac7d1009ef08085bd6fc974899086
SSDEEP

49152:ow5FZsXtTY0PsDT32JXYoaT3iU9RgH5ND0R55CjA+X:oiDItsYXYoaT3zCjA+X

Score

1^/10

Malware Config

Signatures

Files

winbox.exe
.exe windows x86

1ca1d058cf75d1d9da33fca2b0f3e624

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:fb:17:4a:a1:ef:59:f0:e5:d2:90:d2:9c:25:56:1a
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

03/07/2023, 00:00

Not After

04/07/2026, 23:59

Subject

SERIALNUMBER=40003286799,CN=SIA \"Mikrotīkls\",O=SIA \"Mikrotīkls\",L=Riga,C=LV,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c56

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

24:73:0a:a3:9e:46:af:5c:59:a2:11:ed:41:2c:a6:0c:5d:6f:c5:50:51:b9:4e:85:ba:08:04:ee:18:c4:70:1e
Signer

Actual PE Digest

24:73:0a:a3:9e:46:af:5c:59:a2:11:ed:41:2c:a6:0c:5d:6f:c5:50:51:b9:4e:85:ba:08:04:ee:18:c4:70:1e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext

comctl32

InitCommonControls

comdlg32

GetOpenFileNameA
GetSaveFileNameA

crypt32

CertGetNameStringA

dbghelp

SymFromAddr
SymGetLineFromAddr64
SymInitialize

gdi32

BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreateFontA
CreateFontIndirectW
CreateHatchBrush
CreatePatternBrush
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
ExcludeClipRect
GetCharWidth32A
GetCharWidthA
GetClipBox
GetDIBits
GetDeviceCaps
GetObjectW
GetPixel
GetStockObject
GetTextColor
GetTextExtentExPointA
GetTextMetricsA
IntersectClipRect
LineTo
MoveToEx
OffsetViewportOrgEx
OffsetWindowOrgEx
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetROP2
SetTextColor
TextOutA

iphlpapi

GetAdaptersAddresses

kernel32

Beep
CloseHandle
CreateDirectoryA
CreateFileA
CreatePipe
CreateProcessA
CreateThread
DeleteCriticalSection
DeleteFileA
DuplicateHandle
EnterCriticalSection
FileTimeToDosDateTime
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FormatMessageA
GetCommandLineW
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesA
GetFileSize
GetFileTime
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTickCount
GetWindowsDirectoryA
GlobalAddAtomA
GlobalAlloc
GlobalLock
GlobalSize
GlobalUnlock
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryExA
LoadResource
LocalFree
LockResource
MoveFileExA
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
RemoveDirectoryA
RtlCaptureStackBackTrace
SetHandleInformation
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile

msvcrt

__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_atoi64
_cexit
_errno
_exit
_initterm
_iob
_msize
_onexit
_snprintf
_stricmp
_ui64toa
_vsnprintf
abort
atoi
calloc
exit
fclose
feof
ferror
fgets
fopen
fprintf
fputs
fread
free
fseek
fwprintf
fwrite
isalnum
isalpha
isdigit
islower
isprint
isspace
isupper
isxdigit
log10
malloc
memchr
memcmp
memcpy
memmove
gmtime
perror
puts
raise
rand
realloc
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcpy
strftime
strlen
strncmp
strncpy
strtol
strtoul
tolower
toupper
vfprintf
wcscpy
wcslen
_snwprintf
_write
_stricmp
_strdup
_read
_lseek

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemFree
DoDragDrop
OleGetClipboard
OleInitialize
OleSetClipboard
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop

shell32

CommandLineToArgvW
DragQueryFileA
SHBrowseForFolderA
SHCreateDirectoryExA
SHGetFolderPathA
SHGetPathFromIDListA
ShellExecuteA

user32

AdjustWindowRectEx
BeginDeferWindowPos
BeginPaint
CallWindowProcA
ClientToScreen
CloseClipboard
CreateAcceleratorTableA
CreateCaret
CreateIconIndirect
CreateMenu
CreatePopupMenu
CreateWindowExA
CreateWindowExW
DefWindowProcA
DeferWindowPos
DestroyCaret
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageA
DrawEdge
DrawFocusRect
DrawIconEx
DrawTextExA
DrawTextExW
EmptyClipboard
EnableMenuItem
EnableWindow
EndDeferWindowPos
EndPaint
FillRect
FrameRect
GetActiveWindow
GetCapture
GetClassLongA
GetClassNameA
GetClientRect
GetClipboardData
GetClipboardFormatNameA
GetCursor
GetCursorPos
GetDC
GetDCEx
GetDoubleClickTime
GetFocus
GetKeyState
GetMenu
GetMenuItemCount
GetMessageA
GetMessagePos
GetMonitorInfoA
GetParent
GetPropA
GetScrollPos
GetSysColor
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowLongA
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
GetWindowTextW
GetWindowThreadProcessId
InsertMenuItemA
IntersectRect
InvalidateRect
IsClipboardFormatAvailable
KillTimer
LoadBitmapA
LoadCursorA
LoadImageA
LockWindowUpdate
MessageBoxW
MonitorFromRect
OpenClipboard
PostMessageA
PostQuitMessage
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemovePropA
ScreenToClient
ScrollWindowEx
SendMessageA
SendNotifyMessageA
SetActiveWindow
SetCapture
SetCaretPos
SetClipboardData
SetCursor
SetFocus
SetMenu
SetMenuItemInfoA
SetPropA
SetTimer
SetWindowLongA
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextA
SetWindowTextW
ShowCaret
ShowCursor
ShowWindow
SystemParametersInfoA
TrackPopupMenuEx
TranslateAcceleratorA
TranslateMessage
UnionRect
UpdateWindow
WindowFromPoint

wininet

HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetGetLastResponseInfoA
InternetOpenA
InternetReadFileExA
InternetSetStatusCallback

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrustEx

ws2_32

WSAAsyncGetHostByAddr
WSAAsyncGetHostByName
WSAAsyncSelect
WSACancelAsyncRequest
WSAGetLastError
WSAStartup
bind
closesocket
connect
freeaddrinfo
getaddrinfo
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
ntohl
ntohs
recv
recvfrom
send
sendto
setsockopt
socket

Exports

Exports

_Z10createEnumPK8MapEntry
_Z10createEnumPPKc
_Z10createFlagP5IIconjRK6string
_Z10createFlagcRK6stringRK5Colori
_Z10createFontP7HFONT__i
_Z10createFontibbbi
_Z10createMenuv
_Z10doDraggingP5IBaseP10ICopyHooksRK5Point
_Z10getServicePKcS0_
_Z10loadBitmapP11HINSTANCE__i
_Z10loadCursorP11HINSTANCE__i
_Z10loadCursorPKc
_Z10openWindowP15IWindowProducerPv
_Z10openWindowP5IBaseRK6string
_Z10packArray8RK6vectorIjE
_Z10sipAddressPKc
_Z10unpackDataP6stringRS_
_Z11castServiceP8IServicej
_Z11createGraphP11IGraphModel
_Z11createLabelRK6stringb
_Z11createMeterv
_Z11createProxyP7ILooper
_Z11createTableb
_Z11dumpFormatsP11IDataObject
_Z11enableDebugb
_Z11getSettingsjPjj
_Z11isDebuggingv
_Z11isLocalCopyP11IDataObject
_Z11numPairLessP10NumberPairS0_
_Z11packArray16RK6vectorIjE
_Z11removeTimerP13EventListenerPv
_Z11sip6AddressPKc
_Z11snumberListPKc
_Z11string2enumRK6stringP5IEnumPj
_Z12altConvertorRK6memberRK6vectorIS_ERKS2_I9ReferenceI10IConvertorEERKS2_IjE
_Z12altConvertorRK6vectorI6memberERKS_I9ReferenceI10IConvertorEE
_Z12createBitmapP9HBITMAP__
_Z12createHeaderRK6string
_Z12createPackerv
_Z12getObjectMapPKj
_Z12loadSettingsRK6string
_Z12lookupObjectRK6stringS1_jP15IObjectConsumer
_Z12mbr_type_Rawv
_Z12openedWindowP15IWindowProducerPv
_Z12saveSettingsRK6string
_Z12smallSetViewRK6stringP10NumberPairP5IEnumbjb
_Z12snumberRangePKc
_Z12sstringArrayPKc
_Z12unpackArray8P6stringR6vectorIjE
_Z13addToLauncherP10IMenuEntryj
_Z13addToLauncherP13EventListenerRK6stringP5IIconj
_Z13addToLauncherP15IWindowProducerRK6stringP5IIconj
_Z13arrayAccessorj
_Z13createGridRowP8IGridRowib
_Z13createHandlerP13IHandlerHooksj
_Z13createMDIPaneRK6stringP5IIconii
_Z13createMessagev
_Z13createToolbarb
_Z13createTooltipRK6string
_Z13enumConvertorP5IEnumjb
_Z13getMainWindowv
_Z13getPersistentP7IWindow
_Z13monitorAppletRK6stringP7IObjectRK6memberP10IConvertor
_Z13number2stringjj
_Z13sintegerRangePKc
_Z13unpackArray16P6stringR6vectorIjE
_Z14addToDashboardP7IAppletRK6string
_Z14createCheckBoxRK6string
_Z14createComboBoxP5IEnumb
_Z14createDeckPanev
_Z14createFlowPaneibb
_Z14createGridPaneiib
_Z14createMsgEventP5IBasejl
_Z14createStockPeni
_Z14createTextEditbbb
_Z14disableServicePKcS0_
_Z14integer2stringi
_Z14mbr_type_Arrayv
_Z14openCommentForP7IObject
_Z14queryInterfaceRK5_GUIDPPvS1_P8IUnknown
_Z14removeSettingsj
_Z14showMessageBoxRK6stringS1_P13EventListener
_Z15copyToClipboardP5IBaseP10ICopyHooks
_Z15createCOMObject5_GUIDS_
_Z15createDashboardv
_Z15createEnumEventN10IEnumEvent9EventTypeEjb
_Z15createFieldPaneb
_Z15createObjectMapP14IObjectFactoryPKjbj
_Z15createObjectMapPFPvRKN2nv7messageEENS0_6u32_idEPKjbj
_Z15createObjectMapPFPvRKN2nv7messageEEPKjbj
_Z15createPopupMenuv
_Z15createRadioBandv
_Z15createScrollBarb
_Z15createSeparatorb
_Z15createStackPaneiRK6Insets
_Z15createStaticBoxRK6stringj
_Z15createStatusBarv
_Z15createTableDatav
_Z15createTablePanebb
_Z15getObjectHolderPKj
_Z15loadAllSettingsRK5Point
_Z15mbr_type_stringv
_Z15removeTimerByIDj
_Z15showProgressBoxRK6stringS1_P13EventListener
_Z15showQuestionBoxRK6stringS1_P13EventListener
_Z16createDataObjectP10ICopyHooks
_Z16createDoitWindowP7IObjectRK6stringiS3_S3_
_Z16createFramedPaneRK6string
_Z16createHatchBrushiRK5Color
_Z16createMessageBoxRK6stringS1_
_Z16createNullWindowjP13EventListener
_Z16createObjectGridP7IObjectRK6stringj
_Z16createObjectPaneP7IObjectib
_Z16createOneTabPanev
_Z16createSolidBrushRK5Color
_Z16createStatusTextP10IStatusBarj
_Z16createStockBrushi
_Z16createTabbedPanev
_Z16getAnsiFixedFontv
_Z16getGlobalHandlerv
_Z16integerConvertoriiii
_Z16mbr_type_genericj
_Z16postfixConvertorP10IConvertorRK6string
_Z16registerProviderRK6stringP15IObjectProvider
_Z16registerSettingsP8IMessagej
_Z16sip6ZonedAddressPKc
_Z16smultilineStringPKc
_Z16snumberRangeListPKc
_Z16storeAllSettingsv
_Z17createFilteredMapP11IGenericMapP9PredicateP14IObjectFactoryb
_Z17createObjectQueryP7IObjectP14IObjectFactoryS0_PKjbj
_Z17createProgressBoxRK6stringS1_
_Z17createQueryWindowP12IObjectQueryibbb
_Z17createQuestionBoxRK6stringS1_
_Z17createRadioButtonRK6stringP10IRadioBand
_Z17createSetupWindowP13ISetupManager
_Z17createSetupWindowP7IObject
_Z17createTableWindowRK6stringb
_Z17createWidgetEventP5IBase
_Z17createWindowClassRK6stringjP8HBRUSH__P5IIconii
_Z17createWindowEventP7IWindowji
_Z17getDefaultGUIFontv
_Z17getWindowNotifierv
_Z17mbr_type_BigArrayv
_Z17showBigMessageBoxRK6stringS1_
_Z17tristateConvertorP10IConvertor
_Z18addToLauncherGroupP15IWindowProducerRK6stringS3_j
_Z18createActionWindowP13IObjectActionibP13EventListenerS2_b
_Z18createBalancedPanei
_Z18createContainerMapPFPvRKN2nv7messageEEPKjb
_Z18createMessageEventRKN2nv7messageE
_Z18createObjectActionP7IObjectS0_PKj
_Z18createObjectHolderP7IObjectPKjb
_Z18createObjectWindowP7IObjectibb
_Z18createPatternBrushP11HINSTANCE__i
_Z18createSetupManagerPFPvRKN2nv7messageEEPKj
_Z18fitWindowInMonitorR4RectRK5Point
_Z18fitWindowInTheRectR4RectRK5PointRKS_
_Z18getDefaultBoldFontv
_Z18initCommentManagerv
_Z18loadIconFromBitmapP11HINSTANCE__ii
_Z18pasteFromClipboardP5IBaseP11IPasteHooks
_Z18registerDropTargetP5IBaseP11IPasteHooks
_Z18registerPersistentP5IBaseP11IPersistent
_Z18unregisterProviderRK6stringP15IObjectProvider
_Z19createBigMessageBoxRK6stringS1_
_Z19createBoundsContextv
_Z19createIPAddressEditv
_Z19getErrorDescriptionjRK6string
_Z19mbr_type_NumberPairv
_Z20createActiveXControlP7IWindowRK5_GUIDPP8IUnknownP11IStatusText
_Z20createCompactButtonsP5IIconS0_j
_Z20createSurroundedPaneii
_Z20dateAndTimeConvertorbjb
_Z20getDefaultItalicFontv
_Z20unregisterDropTargetP5IBase
_Z20unregisterPersistentP5IBaseP11IPersistent
_Z21createArrayGraphModelPvjP10IConvertorjjb
_Z22createOrderedObjectMapP14IObjectFactoryPKjbbj
_Z22createOrderedObjectMapPFPvRKN2nv7messageEENS0_6u32_idEPKjbbj
_Z22createOrderedObjectMapPFPvRKN2nv7messageEEPKjbbj
_Z23createSlidingGraphModeljP10IConvertor
_Z23createSlidingGraphModeljRK6string
_Z24createDataRateGraphModelj
_Z25createOrderedContainerMapPFPvRKN2nv7messageEEPKjb
_Z4cmapPKc
_Z4initR6member
_Z4initR6memberRKS_
_Z4initR6memberjP11member_type
_Z4pathj
_Z4pathjj
_Z4pathjjjj
_Z5cdoitPKc
_Z5cenumP5CEnumS0_
_Z5cenumPK8MapEntry
_Z5cenumPKPKc
_Z5cenumPKj
_Z5cenumRK10enumfilter
_Z5cenumRK10offsetenum
_Z5cenumRK7defenum
_Z5cenumRK8slotenum
_Z5cenumRK9mapfilter
_Z5cenumRK9queryenum
_Z5cenumRK9remapenum
_Z5citemPKc
_Z5pslotPKcP9Predicate
_Z5scondPKc
_Z6assignR6memberRKS_
_Z6caliasPKc
_Z6cqueryPKc
_Z6csetupPKc
_Z7cactionPKc
_Z7destroyR6member
_Z7getDataP11IDataObjectjPv
_Z7getDataP11IDataObjectjPvj
_Z7hasDataP11IDataObjectj
_Z7isErrorRKN2nv7messageEPjP6string
_Z7pobjectPKjP9Predicate
_Z7setDataP11IDataObjectjPvj
_Z7snumberPKc
_Z7sscriptPKc
_Z7ssecretPKc
_Z7sstringPKc
_Z8addTimerjP13EventListenerPvb
_Z8enumViewRK6stringP6NumberP5IEnumbb
_Z8getLoginv
_Z8hasTimerP13EventListenerPv
_Z8loadIconP11HINSTANCE__i
_Z8packDataRK6string
_Z8packDataj
_Z8saddressPKc
_Z8sintegerPKc
_Z8slotListv
_Z8snetmaskPKc
_Z8sversionPKc
_Z8textViewRK6stringPvP10IConvertorjj
_Z9addSourceP11IDataObjectP5IBase
_Z9addTargetP11IDataObjectP5IBase
_Z9createPenRK5Color
_Z9createPeniiRK5Color
_Z9cterminalPKc
_Z9getLooperv
_Z9showErrorRK6stringRKN2nv7messageE
_Z9showErrorRK6stringS1_
_Z9snetwork6PKc
_Z9spasswordPKc
_ZN10IConvertor4castEj
_ZN11IFramedPane10setMarginsERK6Insets
_ZN11IFramedPane11computeSizeEii
_ZN11IFramedPane12getFrameRectEv
_ZN11IFramedPane13setForegroundERK5Color
_ZN11IFramedPane14getHeadingSizeEv
_ZN11IFramedPane14setColumnWidthEj
_ZN11IFramedPane18minimumColumnWidthEv
_ZN11IFramedPane4castEj
_ZN11IFramedPane5paintEP3IDC
_ZN11IFramedPane6layoutEv
_ZN11IFramedPane6setTopEP7IWindow
_ZN11IFramedPane7realizeEP7IWindow
_ZN11IFramedPane7setTextERK6string
_ZN11IFramedPane9setCenterEP7IWindow
_ZN11IFramedPaneC1ERK6string
_ZN11IFramedPaneC2ERK6string
_ZN11IFramedPaneD0Ev
_ZN11IFramedPaneD1Ev
_ZN11IFramedPaneD2Ev
_ZN11SNumberList2idEN2nv12u32_array_idE
_ZN12ObjectMapRef12getObjectMapEv
_ZN12ObjectMapRefC1Ejj
_ZN12ObjectMapRefC2Ejj
_ZN12SNumberRange2idEN2nv6u32_idES1_
_ZN12SNumberRangeC1Ev
_ZN12SNumberRangeC2Ev
_ZN12SNumberRangeD0Ev
_ZN12SNumberRangeD1Ev
_ZN12SNumberRangeD2Ev
_ZN13SIntegerRange2idEN2nv6u32_idES1_
_ZN13SlotCondition2onEP4SlotP9Predicate
_ZN13SlotCondition2onEP9Predicate
_ZN13SlotCondition2onEPKcP9Predicate
_ZN13SlotCondition2onEPKcS1_P9Predicate
_ZN13SlotCondition4orOnEPKc
_ZN16SNumberRangeList2idEN2nv12u32_array_idE
_ZN4CMap15createContainerEv
_ZN4CMap4pathEjj
_ZN4CMap4pathEjjjj
_ZN4CMap6createEv
_ZN4CMap7genericEPKcS1_
_ZN4CMap7inheritEPKcj
_ZN4Rect6extendERK6Insets
_ZN4Rect6moveByEii
_ZN4Rect6narrowERK6Insets
_ZN4RectC1ERK5PointS2_
_ZN4RectC2ERK5PointS2_
_ZN4SRaw15createConvertorEv
_ZN4SRaw15createFilterForEP5IEnum
_ZN4SRaw4copyEPvPKv
_ZN4SRaw4ctorEPv
_ZN4SRaw4dtorEPv
_ZN4SRaw5setupEP6JSNode
_ZN4SRaw6getMbrEv
_ZN4SRaw7realizeEP10SlotMaster
_ZN4SRawC1EP6JSNode
_ZN4SRawC2EP6JSNode
_ZN4Slot15createFilterForEP5IEnum
_ZN5CDoit4pathEjj
_ZN5CDoit4pathEjjj
_ZN5CItem4pathEjj
_ZN5CItem4pathEjjj
_ZN5CType3addER13SlotCondition
_ZN5CType3addER4Slot
_ZN5CType3addERK8SlotList
_ZN5CType3addEbR4Slot
_ZN5CType4iconEij
_ZN5CType4nameEPKcP4SlotS1_
_ZN5CType4nameEPKcS1_S1_
_ZN5CType4slotEPKc
_ZN5CType5aliasEPKc
_ZN5CType5colorEPKci
_ZN5CType5iconsER9CIconList
_ZN5CType6iconOnEPKc
_ZN5CType6treeOnEPKc
_ZN5CType7inheritEPS_
_ZN5ColorC1Eiii
_ZN5ColorC2Eiii
_ZN5IView6updateEv
_ZN5PointC1El
_ZN5PointC2El
_ZN5Views3addEP4SlotP5IView
_ZN6CQuery11createQueryEv
_ZN6CQuery12createWindowEP12IObjectQuery
_ZN6CQuery14getObjectQueryEv
_ZN6CQuery3addER13SlotCondition
_ZN6CQuery3addER4Slot
_ZN6CQuery3addERK8SlotList
_ZN6CQuery3addEbR4Slot
_ZN6CQuery4iconEij
_ZN6CQuery4nameEPKcS1_S1_
_ZN6CQuery4pathEjj
_ZN6CQuery4pathEjjj
_ZN6CQuery5iconsER9CIconList
_ZN6CQuery5replyEv
_ZN6CQuery6iconOnEPKc
_ZN6CQuery6statusEv
_ZN6CSetup4pathEjj
_ZN6CSetup4pathEjjj
_ZN7CAction12createActionEv
_ZN7CAction12createWindowEP13IObjectAction
_ZN7CAction3addER13SlotCondition
_ZN7CAction3addER4Slot
_ZN7CAction3addERK8SlotList
_ZN7CAction3addEbR4Slot
_ZN7CAction4pathEjj
_ZN7CAction4pathEjjj
_ZN7CAction5replyEv
_ZN7IObject10getSubtypeEv
_ZN7IObject11getParentIDEv
_ZN7IObject13setToDefaultsEv
_ZN7IObject4castEj
_ZN7IObject5getIDEv
_ZN7IObject5hasIDEv
_ZN7IObject5setIDEj
_ZN7IObject7getIconEv
_ZN7IObject7getNameEv
_ZN7IObject7getTypeEv
_ZN7IObject8canCloneEv
_ZN7IObject8getAliasEv
_ZN7IObject8getAttrsEv
_ZN7IObject8getCTypeEv
_ZN7IObject8getColorEv
_ZN7IObject8getFlagsER6vectorIP5IFlagE
_ZN7IObject8getOwnerEv
_ZN7IObject8setOwnerEP12IObjectOwner
_ZN7IObject8toStringEv
_ZN7IObject9canRemoveEv
_ZN7IObjectC1Ev
_ZN7IObjectC2Ev
_ZN7IObjectD0Ev
_ZN7IObjectD1Ev
_ZN7IObjectD2Ev
_ZN7IWindow10createPaneEPS_
_ZN7IWindow10doRelayoutEv
_ZN7IWindow10dpiChangedEv
_ZN7IWindow10findWindowEP6HWND__
_ZN7IWindow10fromScreenERK5Point
_ZN7IWindow10getExStyleEv
_ZN7IWindow10hasTabStopEv
_ZN7IWindow10invalidateERK4Rectb
_ZN7IWindow10invalidateEb
_ZN7IWindow10isRealizedEv
_ZN7IWindow10lockUpdateEv
_ZN7IWindow10onCtlColorEjlPl
_ZN7IWindow10onSetFocusEjlPl
_ZN7IWindow10setEnabledEb
_ZN7IWindow10setTabStopEb
_ZN7IWindow10setVisibleEb
_ZN7IWindow10showCursorEb
_ZN7IWindow10windowProcEP6HWND__jjl@16
_ZN7IWindow11computeSizeEii
_ZN7IWindow11doDpiChangeEv
_ZN7IWindow11getBaselineEi
_ZN7IWindow11isMaximizedEv
_ZN7IWindow11isMinimizedEv
_ZN7IWindow11isTopWindowEv
_ZN7IWindow11onFocusLostEv
_ZN7IWindow11onKillFocusEjlPl
_ZN7IWindow11onLButtonUpEiRK5Point
_ZN7IWindow11onMouseMoveEiRK5Point
_ZN7IWindow11onRButtonUpEiRK5Point
_ZN7IWindow11postMessageEjjl
_ZN7IWindow11sendMessageEjjl
_ZN7IWindow12createCanvasEPS_iibPv
_ZN7IWindow12createWindowEPS_RK6stringjjPvb
_ZN7IWindow12findWindowAtERK5Point
_ZN7IWindow12getLastChildEv
_ZN7IWindow12getTopParentEv
_ZN7IWindow12onChildFocusEPS_
_ZN7IWindow12onDpiChangedEjlPl
_ZN7IWindow12onMouseWheelEiRK5Pointi
_ZN7IWindow12requestFocusEv
_ZN7IWindow12unlockUpdateEv
_ZN7IWindow12updateCursorEjl
_ZN7IWindow13captureCursorEv
_ZN7IWindow13getBackgroundEv
_ZN7IWindow13getDialogCodeEP6tagMSG
_ZN7IWindow13getForegroundEv
_ZN7IWindow13onLButtonDownEiRK5Point
_ZN7IWindow13onRButtonDownEiRK5Point
_ZN7IWindow13releaseCursorEv
_ZN7IWindow13setAutoExpandEb
_ZN7IWindow13setBackgroundERK5Color
_ZN7IWindow13setForegroundERK5Color
_ZN7IWindow13showingWindowEb
_ZN7IWindow14getFocusWindowEv
_ZN7IWindow14getTrimmedTextEv
_ZN7IWindow15blockAutoExpandEb
_ZN7IWindow15compactChildrenEv
_ZN7IWindow15createDragImageEP12IDragContextRK5Point
_ZN7IWindow15destroyChildrenEv
_ZN7IWindow15findMouseWindowERK5Point
_ZN7IWindow15onGetMinMaxInfoEjlPl
_ZN7IWindow15processMouseMsgEiRK5PointMS_FbiS2_E
_ZN7IWindow16getChildrenCountEv
_ZN7IWindow16getRestoreBoundsEv
_ZN7IWindow16getTooltipWindowERK5Point
_ZN7IWindow16onSysColorChangeEjlPl
_ZN7IWindow16sysColorsChangedEv
_ZN7IWindow17activateTopParentEv
_ZN7IWindow17clientAreaToFrameERK5Point
_ZN7IWindow17createAlienWindowEPS_P6HWND__
_ZN7IWindow17createLightCanvasEPS_ii
_ZN7IWindow17createLightweightEPS_
_ZN7IWindow17frameToClientAreaERK5Point
_ZN7IWindow17hasCapturedCursorEv
_ZN7IWindow17onLButtonDblClickEiRK5Point
_ZN7IWindow17processDefaultMsgEjjlPl
_ZN7IWindow17processMouseWheelEiRK5Pointi
_ZN7IWindow18addDestroyListenerEP13EventListener
_ZN7IWindow18createAcceleratorsERK6vectorI8tagACCELE
_ZN7IWindow18getVisibleChildrenER6vectorIPS_E
_ZN7IWindow18getWindowPlacementEPv
_ZN7IWindow18onWindowPosChangedEjlPl
_ZN7IWindow18setWindowPlacementEPv
_ZN7IWindow19getClientAreaBoundsEv
_ZN7IWindow20translateAcceleratorEP6tagMSG
_ZN7IWindow21removeDestroyListenerEP13EventListener
_ZN7IWindow23parentVisibilityChangedEb
_ZN7IWindow3addEPS_
_ZN7IWindow4castEj
_ZN7IWindow5onMsgEjjlPl
_ZN7IWindow5paintEP3IDC
_ZN7IWindow6createEPS_
_ZN7IWindow6detachEv
_ZN7IWindow6layoutEv
_ZN7IWindow6onCharEci
_ZN7IWindow6removeEPS_
_ZN7IWindow6updateEv
_ZN7IWindow7destroyEv
_ZN7IWindow7getLongEi
_ZN7IWindow7getTextEv
_ZN7IWindow7hScrollEiRK4Recti
_ZN7IWindow7isShownEv
_ZN7IWindow7onFocusEv
_ZN7IWindow7onKeyUpEii
_ZN7IWindow7onPaintEjlPl
_ZN7IWindow7realizeEPS_
_ZN7IWindow7setLongEij
_ZN7IWindow7setTextERK6string
_ZN7IWindow7vScrollEiRK4Recti
_ZN7IWindow8activateEv
_ZN7IWindow8attachToEP6HWND__b
_ZN7IWindow8getChildEPS_
_ZN7IWindow8getClassEv
_ZN7IWindow8getStyleEv
_ZN7IWindow8hasFocusEv
_ZN7IWindow8isActiveEv
_ZN7IWindow8maximizeEb
_ZN7IWindow8onNotifyEjlPl
_ZN7IWindow8paintAllEP3IDC
_ZN7IWindow8relayoutEv

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 273KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ca1d058cf75d1d9da33fca2b0f3e624

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0e:fb:17:4a:a1:ef:59:f0:e5:d2:90:d2:9c:25:56:1aCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

24:73:0a:a3:9e:46:af:5c:59:a2:11:ed:41:2c:a6:0c:5d:6f:c5:50:51:b9:4e:85:ba:08:04:ee:18:c4:70:1eSigner

Headers

File Characteristics

Imports

advapi32

comctl32

comdlg32

crypt32

dbghelp

gdi32

iphlpapi

kernel32

msvcrt

ole32

shell32

user32

wininet

wintrust

ws2_32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.data Size: 2KB - Virtual size: 1KB

.rdata Size: 273KB - Virtual size: 273KB

.bss Size: - Virtual size: 6KB

.edata Size: 23KB - Virtual size: 22KB

.idata Size: 11KB - Virtual size: 10KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 169KB - Virtual size: 169KB

.reloc Size: 95KB - Virtual size: 95KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0e:fb:17:4a:a1:ef:59:f0:e5:d2:90:d2:9c:25:56:1a
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

24:73:0a:a3:9e:46:af:5c:59:a2:11:ed:41:2c:a6:0c:5d:6f:c5:50:51:b9:4e:85:ba:08:04:ee:18:c4:70:1e
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 2KB - Virtual size: 1KB

.rdata
Size: 273KB - Virtual size: 273KB

.bss
Size: - Virtual size: 6KB

.edata
Size: 23KB - Virtual size: 22KB

.idata
Size: 11KB - Virtual size: 10KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 169KB - Virtual size: 169KB

.reloc
Size: 95KB - Virtual size: 95KB