ffbb12ab57e3dfb126051a72b9c6201331c99f2f5526cbba5cadeec139f3b275

Sharing

Copy URL Twitter E-mail

General

Target

ffbb12ab57e3dfb126051a72b9c6201331c99f2f5526cbba5cadeec139f3b275
Size

1.0MB
MD5

91442f92abd3c0613c8b6aa3eb0aff78
SHA1

40d28d890c9f4a5dc2e1bf1250f0f8f7f9f6b5af
SHA256

ffbb12ab57e3dfb126051a72b9c6201331c99f2f5526cbba5cadeec139f3b275
SHA512

ec1a8fafbc4723fb90baeff2c4ea888315e2a2aadce54a1c0104a1fd25585fcfdab523947c1a40d3b9859690dca57c56e353cae8cc0a4142ea8fe59a300fbcb6
SSDEEP

24576:F/D/UO99Syw9s5zXP5CyQm+7O2j3Wd/73Km1B:FwOuySs5zXPtQU2LWBB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffbb12ab57e3dfb126051a72b9c6201331c99f2f5526cbba5cadeec139f3b275

Files

ffbb12ab57e3dfb126051a72b9c6201331c99f2f5526cbba5cadeec139f3b275
.dll windows x64

d3dfbe218740f0779dd14dceb38a5534

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

dwmapi

DwmSetWindowAttribute

libcef

cef_string_utf16_set
cef_string_utf16_clear
cef_v8value_create_bool
cef_v8context_get_entered_context
cef_v8value_create_function
cef_v8value_create_array
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_undefined
cef_v8value_create_double
cef_v8value_create_int
cef_string_userfree_utf16_free
cef_string_utf8_clear
cef_string_utf16_to_utf8
cef_string_utf8_to_utf16
cef_v8context_get_current_context

kernel32

SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
GetModuleHandleW
LoadLibraryExA
LoadLibraryExW
LoadLibraryA
SuspendThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetFileAttributesW
GetThreadContext
GetVolumeInformationW
CreateProcessW
GetCurrentProcessId
LocalFree
ReadDirectoryChangesW
GetOverlappedResult
ResetEvent
CloseHandle
Process32FirstW
Process32NextW
MultiByteToWideChar
CreateEventW
CreateToolhelp32Snapshot
CreateFileW
WriteFile
GetCommandLineW
GetLastError
FreeLibrary
GetLogicalDrives
ExitProcess
GetProcAddress
LoadLibraryW
lstrcatW
DisableThreadLibraryCalls
GetSystemDirectoryW
SetEnvironmentVariableW
GetModuleFileNameW
GetCurrentProcess
GetCurrentThread
GlobalAlloc
GlobalUnlock
GlobalLock
GetLocaleInfoA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindFirstFileExW
GetTickCount64
SetUnhandledExceptionFilter
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
AllocConsole
FindResourceW
LoadResource
LockResource
SizeofResource
GetConsoleWindow
WideCharToMultiByte
WaitForSingleObject
ResumeThread
GetModuleHandleA

user32

MessageBoxW
SetWindowTextW
MessageBoxA
wsprintfA
ReleaseDC
GetSystemMetrics
GetDC
FindWindowExW
DestroyWindow
ShowWindow
SetWindowDisplayAffinity
SetLayeredWindowAttributes
FindWindowW
wsprintfW
DestroyIcon
GetKeyboardLayout
RegisterWindowMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageA
SetActiveWindow
MessageBeep
WindowFromPoint
SetForegroundWindow
FillRect
SetRect
SetWindowRgn
SystemParametersInfoA
CreateIconIndirect
LoadIconA
LoadCursorA
GetWindow
GetParent
SetWindowLongA
GetWindowLongA
MapWindowPoints
ClientToScreen
GetCursorPos
SetCursor
AdjustWindowRectEx
GetWindowRect
ValidateRgn
InvalidateRect
GetUpdateRgn
GetForegroundWindow
KillTimer
SetTimer
MsgWaitForMultipleObjects
ReleaseCapture
SetCapture
GetAsyncKeyState
GetKeyState
SetFocus
PostMessageA
GetClipboardData
SetClipboardData
ChangeClipboardChain
SetClipboardViewer
GetClipboardOwner
CloseClipboard
OpenClipboard
BringWindowToTop
IsIconic
SetWindowPos
OpenIcon
IsWindow
CreateWindowExW
CreateWindowExA
RegisterClassExW
RegisterClassExA
DefWindowProcW
DefWindowProcA
EmptyClipboard

gdi32

Arc
ExtCreatePen
TextOutW
GetTextMetricsA
SetTextColor
GetCharacterPlacementW
GetTextExtentPoint32W
GetGlyphOutlineW
CreateFontA
Polygon
DPtoLP
Pie
SetTextAlign
SetDIBitsToDevice
SetBkMode
SaveDC
RestoreDC
CreateRectRgn
CreateBitmap
CombineRgn
PolyPolygon
Polyline
SelectClipRgn
MoveToEx
PlayEnhMetaFile
CreateDIBSection
CreatePolygonRgn
LPtoDP
StretchDIBits
LineTo
UpdateColors
RectInRegion
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetDIBits
GetDeviceCaps
DeleteDC
DeleteObject
GdiFlush
ExtCreateRegion
CreateDCA
CreatePalette
CreatePen
CreateSolidBrush
GetStockObject
RealizePalette
SelectPalette
SetPixel
EqualRgn
GetRgnBox
GetEnhMetaFileHeader

comdlg32

GetOpenFileNameW

advapi32

RegGetValueW
RegQueryValueExW
RegOpenKeyW
RegCloseKey

shell32

DragQueryFileW
ShellExecuteExW
SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoTaskMemFree
ReleaseStgMedium
OleInitialize
OleUninitialize
RegisterDragDrop
DoDragDrop

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEAD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?do_encoding@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHXZ
?do_max_length@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHXZ
?do_always_noconv@?$codecvt@_WDU_Mbstatet@@@std@@MEBA_NXZ
?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?do_out@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?do_in@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@_K@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
_Cnd_destroy_in_situ
_Cnd_broadcast
_Mtx_unlock
_Thrd_join
_Xtime_get_ticks
_Thrd_detach
_Query_perf_counter
_Thrd_id
_Cnd_wait
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
_Strcoll
_Mtx_init_in_situ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Mtx_lock
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Wcsxfrm
_Mtx_destroy_in_situ
?_Syserror_map@std@@YAPEBDH@Z
?id@?$collate@D@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Throw_C_error@std@@YAXH@Z
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
_Wcscoll
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Strxfrm
_Cnd_init_in_situ
?__ExceptionPtrCreate@@YAXPEAX@Z
_Thrd_hardware_concurrency
_Cnd_signal
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

ws2_32

closesocket
select
shutdown
accept
getaddrinfo
WSAStartup
getpeername
getsockname
send
socket
ntohs
WSASocketW
recv
freeaddrinfo
WSACleanup
bind
getnameinfo
setsockopt
listen

dbghelp

StackWalk64
UnDecorateSymbolNameW
SymFunctionTableAccess64
SymGetModuleBase64
SymCleanup
SymGetSymFromAddr64
SymInitialize

wininet

InternetCloseHandle
InternetOpenW
InternetOpenUrlW
InternetReadFile

shlwapi

PathStripPathW
StrCmpIW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

comctl32

_TrackMouseEvent

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate
strchr
__std_type_info_hash
__C_specific_handler
memchr
strrchr
memset
memcmp
_purecall
__std_exception_copy
memcpy
memmove
__std_exception_destroy
__current_exception_context
__std_type_info_destroy_list
_CxxThrowException
__current_exception

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
fflush
setvbuf
_wfopen
fgetc
ungetc
fsetpos
fread
fclose
_ftelli64
_wfopen_s
_fseeki64
fgets
__stdio_common_vfprintf
fwrite
_get_stream_buffer_pointers
freopen
__stdio_common_vswprintf
__acrt_iob_func
fgetpos
__stdio_common_vsscanf
fgetwc
ungetwc
fputwc
__stdio_common_vswprintf_s
fputc

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
calloc
_callnewh

api-ms-win-crt-math-l1-1-0

cos
sqrt
ceil
acos
_dsign
floor
sin
_dtest

api-ms-win-crt-convert-l1-1-0

strtoll
strtod
strtoul
strtoull
atol
atoi

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_crt_atexit
_cexit
_initterm
exit
_initterm_e
_errno
_configure_narrow_argv
_beginthreadex
_initialize_narrow_environment
_register_onexit_function
terminate
_initialize_onexit_table
raise
_invalid_parameter_noinfo_noreturn
_execute_onexit_table

api-ms-win-crt-string-l1-1-0

strcpy_s
wcscmp
isspace
tolower
strcmp
strncpy_s
strncpy
isdigit
isalpha
wcslen
isupper
toupper
_stricmp
_strdup
strncmp
isxdigit
strcspn
strlen
isalnum

api-ms-win-crt-filesystem-l1-1-0

_access_s
_lock_file
_wmkdir
_unlock_file
_stat64i32
_waccess

api-ms-win-crt-locale-l1-1-0

localeconv
___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

getenv
_wgetenv

api-ms-win-crt-time-l1-1-0

_utime64
_mktime64

Exports

Exports

AlphaBlend
DllInitialize
GradientFill
TransparentBlt
vSetDdrawflag

Sections

.text
Size: 694KB - Virtual size: 694KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3dfbe218740f0779dd14dceb38a5534

Headers

DLL Characteristics

File Characteristics

Imports

dwmapi

libcef

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

msvcp140

ws2_32

dbghelp

wininet

shlwapi

version

comctl32

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: 694KB - Virtual size: 694KB

.rdata Size: 181KB - Virtual size: 180KB

.data Size: 69KB - Virtual size: 89KB

.pdata Size: 29KB - Virtual size: 28KB

.detourc Size: 8KB - Virtual size: 8KB

.detourd Size: 512B - Virtual size: 24B

.rsrc Size: 69KB - Virtual size: 69KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 694KB - Virtual size: 694KB

.rdata
Size: 181KB - Virtual size: 180KB

.data
Size: 69KB - Virtual size: 89KB

.pdata
Size: 29KB - Virtual size: 28KB

.detourc
Size: 8KB - Virtual size: 8KB

.detourd
Size: 512B - Virtual size: 24B

.rsrc
Size: 69KB - Virtual size: 69KB

.reloc
Size: 6KB - Virtual size: 5KB