41138f0e4c72e89239453ae8fec718e2e794d3d711d17743d73665adc174ef04

Sharing

Copy URL Twitter E-mail

General

Target

41138f0e4c72e89239453ae8fec718e2e794d3d711d17743d73665adc174ef04
Size

2.7MB
MD5

313e2a74b3571f6f09632a7b4e233a43
SHA1

a72c9fb6d7816634362b1e6b34a8cd1aa5fc39a3
SHA256

41138f0e4c72e89239453ae8fec718e2e794d3d711d17743d73665adc174ef04
SHA512

8b3a4f1d0edfa9c8a11de1d5e5dbb8c16aceb269fbf7cf8d1b45a19d2b4e0d3e07751a8a7d89008f4e37ebe482e8cd0d3df7943a8ee8a2f69f96e76c758bbe2a
SSDEEP

49152:H8HBrHFuFu06bgDB2vOkZnI1zrcBhKnHwvv5pbpQZqJx9J4ogkdz49+sL9GztE:WrIFR6bWYvDtUrcB8nHwvBdJgj9R

Score

1^/10

Malware Config

Signatures

Files

41138f0e4c72e89239453ae8fec718e2e794d3d711d17743d73665adc174ef04
.zip
jiabai/ComputerZ12.dll
.dll regsvr32 windows x86

3c20e9d355c1b000a6750a846560fcd5

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7c:fa:4a:90:48:25:f3:ae:4b:df:3d:1d:9b:e6:65:55:10:0e:e4:e5:2e:c7:80:79:c0:1d:0a:08:76:aa:0d:4a
Signer

Actual PE Digest

7c:fa:4a:90:48:25:f3:ae:4b:df:3d:1d:9b:e6:65:55:10:0e:e4:e5:2e:c7:80:79:c0:1d:0a:08:76:aa:0d:4a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
lstrlenW
GlobalDeleteAtom
GlobalFindAtomW
OpenEventW
SetLastError
GetPrivateProfileStringW
OpenProcess
FindClose
GetFullPathNameW
FindFirstFileW
FindNextFileW
ResetEvent
DeviceIoControl
CreateFileW
lstrcmpiW
WriteFile
ReadFile
GetLocalTime
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
ResumeThread
LocalFileTimeToFileTime
WaitForSingleObjectEx
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
GetFileSize
GetCurrentThread
GetProcAddress
FreeLibrary
DeleteFileW
CreateDirectoryW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetModuleFileNameW
CreateEventW
GetTickCount
CloseHandle
WaitForMultipleObjects
TerminateProcess
LeaveCriticalSection
EnterCriticalSection
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
WriteConsoleW
SetStdHandle
ReadConsoleW
GetStdHandle
GetACP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetModuleFileNameA
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
InitializeCriticalSection
RtlUnwind
CreateSemaphoreW
InitializeCriticalSectionEx
WaitNamedPipeW
WaitForMultipleObjectsEx
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
GetCurrentProcessId
InterlockedCompareExchange
LoadLibraryW
LocalFree
GetVersionExW
GetModuleHandleW
GetCurrentProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetEvent
WideCharToMultiByte
MultiByteToWideChar
FindResourceExW
FindResourceW
SizeofResource
LoadResource
LockResource
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
TerminateThread
DuplicateHandle
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
GetSystemWindowsDirectoryW
FreeResource
Sleep
CreateFileA
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
SuspendThread
SetThreadContext
GetThreadContext
GetCurrentThreadId
RaiseException
GetProcessHeap
VirtualQuery
VirtualProtect
FlushFileBuffers
DosDateTimeToFileTime
SetFileTime
SetEndOfFile
DecodePointer
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetFilePointer
OpenFileMappingW
LoadLibraryExW
ReleaseSemaphore
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
FindNextFileA
GetFileSizeEx
CreateMutexW
ReleaseMutex
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
QueryPerformanceCounter
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
ExitThread
OutputDebugStringW
IsDebuggerPresent

user32

SetWindowsHookExW
UnhookWindowsHookEx
SendMessageTimeoutW
PostMessageW
IsWindow
SetRect
OffsetRect
PtInRect
SetCursor
LoadCursorW
BeginPaint
wsprintfW
EndPaint
IsRectEmpty
GetMessageW
FindWindowExW
GetWindowThreadProcessId
FindWindowW
ReleaseDC
EnumWindows
GetMonitorInfoW
GetDC
MonitorFromPoint
EnumDisplaySettingsW
GetWindow
GetShellWindow
GetDesktopWindow
WindowFromPoint
GetWindowRect
GetForegroundWindow
TranslateMessage
DispatchMessageW
PeekMessageW
DefWindowProcW
CallWindowProcW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
SetWindowLongW
UnregisterClassW
GetWindowLongW
SetTimer
CallNextHookEx
GetWindowInfo
GetClassNameW
GetAncestor
MonitorFromWindow
GetParent
MapWindowPoints
InvalidateRect
SetForegroundWindow
GetDlgItem
DestroyWindow
PostQuitMessage
SendMessageW
SystemParametersInfoW
CopyRect
GetClientRect
SetWindowRgn
KillTimer
IsWindowVisible
UpdateLayeredWindow
ShowWindow
SetWindowPos

gdi32

EnumFontFamiliesW
CreateRectRgn
CreateCompatibleBitmap
CombineRgn
SetViewportOrgEx
SelectObject
DeleteDC
CreateCompatibleDC
BitBlt
DeleteObject
CreateFontW

advapi32

OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegGetValueW
RegQueryValueExW
RegNotifyChangeKeyValue
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
GetTokenInformation

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetSpecialFolderPathW
ord165
SHCreateDirectoryExW

ole32

CLSIDFromString
CoUninitialize
CoInitialize
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoInitializeEx

shlwapi

StrCmpIW
SHGetValueW
StrStrNIW
SHDeleteKeyW
PathCombineW
StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
StrStrIA
PathIsRootW
PathIsRelativeW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
SHSetValueW
StrStrIW
PathIsDirectoryW
PathFindFileNameW

comctl32

_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipCreateImageAttributes
GdipDrawImagePointRectI
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdiplusStartup
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectRectI
GdipDeleteBrush
GdipCreateSolidFill
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipSetTextRenderingHint
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont

ws2_32

ntohs

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetGetConnectedState
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetReadFile

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

psapi

GetProcessImageFileNameW
EnumProcessModules
GetModuleFileNameExW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

iphlpapi

GetAdaptersInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
HookTaskBar
InstallHook
UnHookTaskBar
Uninst

Sections

.text
Size: 864KB - Virtual size: 863KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
jiabai/ComputerZ12_helper_x64.exe
.exe windows x64

d35e20d79d00a868ccda74f589bfc50d

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b2:2f:cd:67:5b:69:6b:2a:13:fe:d2:67:b2:44:bf:e2:75:c5:89:ba:f5:82:73:07:df:d9:3a:a5:5c:7b:0b:41
Signer

Actual PE Digest

b2:2f:cd:67:5b:69:6b:2a:13:fe:d2:67:b2:44:bf:e2:75:c5:89:ba:f5:82:73:07:df:d9:3a:a5:5c:7b:0b:41

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LoadLibraryW
GetProcAddress
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionEx
MultiByteToWideChar
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
LockResource
FreeLibrary
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
LoadResource
SizeofResource
LoadLibraryExW
FindResourceW
FindResourceExW
WideCharToMultiByte
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
DeleteFileW
GetFileSizeEx
ReadFile
CloseHandle
CreateFileW
GetStringTypeW
FormatMessageW
EncodePointer
SetLastError
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
HeapDestroy
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
LocalFree
GetCurrentProcessId
GetCurrentThreadId
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetCurrentProcess
WriteFile
FindClose
FindNextFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
QueryPerformanceCounter
InitializeSListHead
FlushFileBuffers
RtlPcToFileHeader
RtlUnwindEx
GetFileType
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
SetEndOfFile
ReadConsoleW
WriteConsoleW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetLastError
RaiseException
LCMapStringW
DecodePointer

user32

wsprintfW

shlwapi

PathAppendW
PathFileExistsW
StrStrIW
PathRemoveFileSpecW
PathIsDirectoryW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

urlmon

URLDownloadToCacheFileW

advapi32

RegQueryValueExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW

Sections

.text
Size: 336KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
jiabai/ComputerZ12_x64.dll
.dll regsvr32 windows x64

d6df9c3f7aa035e447dff084c70328fb

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5e:fc:0f:fb:7f:74:c5:f2:99:e0:82:da:9f:fb:18:ba:a6:4b:8b:6b:17:8f:63:2c:90:b4:81:7a:74:c7:44:56
Signer

Actual PE Digest

5e:fc:0f:fb:7f:74:c5:f2:99:e0:82:da:9f:fb:18:ba:a6:4b:8b:6b:17:8f:63:2c:90:b4:81:7a:74:c7:44:56

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

SetLastError
GetPrivateProfileStringW
OpenProcess
FindClose
GetFullPathNameW
FindFirstFileW
FindNextFileW
ResetEvent
DeviceIoControl
CreateFileW
GetFileSize
WriteFile
ReadFile
OpenEventW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
ResumeThread
LocalFileTimeToFileTime
WaitForSingleObjectEx
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
RtlUnwind
GetLocalTime
GlobalFindAtomW
Process32FirstW
CreateToolhelp32Snapshot
LoadLibraryW
GetProcAddress
FreeLibrary
DeleteFileW
CreateDirectoryW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetModuleFileNameW
CreateEventW
GetTickCount
CloseHandle
WaitForMultipleObjects
GlobalDeleteAtom
LeaveCriticalSection
EnterCriticalSection
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
WriteConsoleW
SetStdHandle
ReadConsoleW
GetACP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetModuleFileNameA
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetModuleHandleExW
ExitThread
InitializeCriticalSection
RtlUnwindEx
CreateSemaphoreW
InitializeCriticalSectionEx
WaitNamedPipeW
WaitForMultipleObjectsEx
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
lstrlenW
lstrcmpiW
GetCurrentThread
TerminateProcess
Process32NextW
GetCurrentProcessId
LocalFree
GetVersionExW
GetModuleHandleW
GetCurrentProcess
SetEvent
WideCharToMultiByte
MultiByteToWideChar
FindResourceExW
FindResourceW
SizeofResource
LoadResource
LockResource
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
TerminateThread
InterlockedFlushSList
DuplicateHandle
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
GetFileType
GetStdHandle
GetSystemWindowsDirectoryW
FreeResource
Sleep
CreateFileA
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
GetCurrentThreadId
RaiseException
GetProcessHeap
SuspendThread
SetThreadContext
GetThreadContext
VirtualQuery
VirtualProtect
FlushFileBuffers
DosDateTimeToFileTime
SetFileTime
SetEndOfFile
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
DecodePointer
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetFilePointer
OpenFileMappingW
LoadLibraryExW
ReleaseSemaphore
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
FindNextFileA
GetFileSizeEx
CreateMutexW
ReleaseMutex
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
QueryPerformanceCounter
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
LoadLibraryExA
VirtualFree
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
RtlPcToFileHeader
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList

user32

SetWindowsHookExW
UnhookWindowsHookEx
SendMessageTimeoutW
PostMessageW
IsWindow
SetRect
OffsetRect
PtInRect
SetCursor
LoadCursorW
BeginPaint
EndPaint
IsRectEmpty
GetMessageW
TranslateMessage
FindWindowExW
GetWindowThreadProcessId
FindWindowW
GetDesktopWindow
ReleaseDC
GetDC
GetParent
WindowFromPoint
GetWindowRect
GetForegroundWindow
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
SetTimer
wsprintfW
DispatchMessageW
PeekMessageW
DefWindowProcW
CallWindowProcW
SetWindowPos
UnregisterClassW
CreateWindowExW
GetClassInfoExW
CallNextHookEx
GetShellWindow
GetClassNameW
EnumWindows
MonitorFromWindow
GetWindow
MapWindowPoints
InvalidateRect
SetForegroundWindow
GetDlgItem
DestroyWindow
PostQuitMessage
SendMessageW
SystemParametersInfoW
CopyRect
GetClientRect
SetWindowRgn
KillTimer
IsWindowVisible
UpdateLayeredWindow
ShowWindow
GetAncestor
GetWindowInfo
GetMonitorInfoW
MonitorFromPoint
EnumDisplaySettingsW
RegisterClassExW

gdi32

CreateCompatibleDC
CreateRectRgn
CreateCompatibleBitmap
CombineRgn
SetViewportOrgEx
SelectObject
DeleteDC
BitBlt
EnumFontFamiliesW
DeleteObject
CreateFontW

advapi32

GetTokenInformation
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegGetValueW
RegQueryValueExW
RegNotifyChangeKeyValue
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetSpecialFolderPathW
ord165
SHCreateDirectoryExW

ole32

CLSIDFromString
CoUninitialize
CoInitialize
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoInitializeEx

shlwapi

StrCmpIW
SHGetValueW
PathFindFileNameW
SHDeleteKeyW
PathCombineW
PathIsDirectoryW
StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
StrStrIA
PathIsRootW
PathIsRelativeW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
SHSetValueW
StrStrNIW
StrStrIW

comctl32

_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipCreateImageAttributes
GdipDrawImagePointRectI
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdiplusStartup
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectRectI
GdipCreateSolidFill
GdipDeleteBrush
GdipDisposeImageAttributes
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipSetImageAttributesColorMatrix
GdipSetTextRenderingHint
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont

ws2_32

ntohs

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetGetConnectedState
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetReadFile

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

psapi

GetProcessImageFileNameW
EnumProcessModules
GetModuleFileNameExW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

iphlpapi

GetAdaptersInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
HookTaskBar
InstallHook
UnHookTaskBar
Uninst

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 348KB - Virtual size: 348KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
jiabai/guardhp.exe
.exe windows x86

9d6b8a5323b051eb5736531e5c8ff914

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d1:8a:c4:d4:2d:bc:00:48:9f:7c:cd:2b:a4:e9:02:7a:32:88:1c:a9:18:55:a8:09:50:fa:ef:50:7d:fc:11:b2
Signer

Actual PE Digest

d1:8a:c4:d4:2d:bc:00:48:9f:7c:cd:2b:a4:e9:02:7a:32:88:1c:a9:18:55:a8:09:50:fa:ef:50:7d:fc:11:b2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipCreateBitmapFromStream
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipDrawImageRectRect
GdipFillRectangleI
GdipSetTextRenderingHint
GdipCreateSolidFill
GdipDeleteBrush
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdiplusShutdown
GdipGetImageWidth
GdiplusStartup
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImagePointRectI
GdipDrawImageRectRectI
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM

kernel32

RemoveDirectoryW
GlobalAddAtomW
GlobalFindAtomW
WriteConsoleW
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetACP
SetConsoleCtrlHandler
ExitProcess
GetTimeZoneInformation
GetConsoleCP
SetFilePointerEx
GetModuleHandleExW
ExitThread
RtlUnwind
VerifyVersionInfoA
GetSystemDirectoryA
VerSetConditionMask
PeekNamedPipe
ExpandEnvironmentStringsA
FormatMessageA
SleepEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
VirtualProtect
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
CreateSemaphoreW
WaitForMultipleObjectsEx
InitializeCriticalSectionEx
WaitNamedPipeW
GetSystemWindowsDirectoryW
FreeResource
DosDateTimeToFileTime
VirtualFreeEx
VirtualAllocEx
GetComputerNameA
MoveFileExW
FindNextFileW
FindFirstFileW
GetFileAttributesExW
GetFileAttributesW
SetFileAttributesW
GetTempPathW
GetStartupInfoW
CreateProcessW
FindClose
DeviceIoControl
FlushFileBuffers
ReadFile
WriteFile
GetFileSize
ReleaseSemaphore
TerminateProcess
OutputDebugStringW
WriteProcessMemory
WaitForSingleObject
CreateDirectoryW
LoadLibraryExW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DecodePointer
GetCurrentProcess
GetTickCount
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCommandLineW
CreateMutexW
WaitForSingleObjectEx
Sleep
ReleaseMutex
GetShortPathNameW
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
LocalFree
DeleteFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleFileNameW
CreateEventW
GetLocalTime
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentThreadId
CreateFileW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetVersionExW
GetModuleHandleW
WideCharToMultiByte
MultiByteToWideChar
GetLastError
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTime
SetFileTime
SetEndOfFile
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
GetEnvironmentVariableW
LoadLibraryA
GetFullPathNameW
GetCurrentDirectoryW
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
GetFileType
GetStdHandle
InterlockedCompareExchange
InterlockedExchange
GetModuleFileNameA
CreateFileA
GetSystemDirectoryW
QueryDosDeviceW
FindResourceExW
FindResourceW
LoadLibraryW
GetLogicalDriveStringsW
lstrlenW
lstrcmpiA
lstrcmpA
GlobalFree
GlobalUnlock
SetEnvironmentVariableA
FreeEnvironmentStringsW
GlobalLock
GlobalAlloc
GetFileSizeEx
WaitForMultipleObjects
ReadProcessMemory
OpenFileMappingW
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCurrentThread
DuplicateHandle
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
LoadLibraryExA
CloseHandle
GetEnvironmentStringsW
GetCommandLineA
SizeofResource
LoadResource
GetCurrentProcessId
OpenProcess
GetLongPathNameW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
LockResource
FindFirstFileExW
IsValidCodePage
GetOEMCP

user32

SetTimer
KillTimer
GetWindowLongW
SetWindowLongW
LoadCursorW
SendMessageTimeoutW
FindWindowExW
GetWindowThreadProcessId
SendMessageW
PostMessageW
FindWindowW
GetMessageW
DestroyWindow
DispatchMessageW
PeekMessageW
CharNextW
GetForegroundWindow
GetWindowRect
WindowFromPoint
GetDesktopWindow
GetShellWindow
GetWindow
MonitorFromPoint
GetMonitorInfoW
GetWindowInfo
GetAncestor
ShowWindow
OffsetRect
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
UnionRect
EqualRect
PtInRect
SetCursor
DrawFocusRect
UpdateLayeredWindow
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
TranslateMessage
SetWindowPos
IsWindowVisible
GetAsyncKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
EndPaint
SetWinEventHook
FillRect
GetWindowTextLengthW
GetWindowTextW
DrawTextW
EnableWindow
GetFocus
PostQuitMessage
RegisterWindowMessageW
WaitForInputIdle
wsprintfW
SystemParametersInfoW
GetParent
CopyRect
ScreenToClient
GetClientRect
InvalidateRect
SetWindowRgn
BeginPaint

gdi32

SetViewportOrgEx
RectVisible
OffsetViewportOrgEx
EnumFontFamiliesW
CreateFontW
ExtTextOutW
SetTextColor
SetBkMode
SetBkColor
GetStockObject
GetObjectW
CreateDIBSection
SelectObject
SelectClipRgn
SaveDC
RestoreDC
DeleteObject
DeleteDC
CreateRectRgnIndirect
CreateRectRgn
CreateCompatibleDC
CreateCompatibleBitmap
CombineRgn
BitBlt

advapi32

CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegCreateKeyExA
RegQueryValueExA
RegEnumKeyExA
CryptReleaseContext
CryptDestroyKey
CryptGenRandom
CryptDecrypt
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CloseServiceHandle
ControlService
DeleteService
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
GetTokenInformation
OpenSCManagerW
OpenServiceW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertSidToStringSidA
RegGetValueW
RegSetValueExA
LookupPrivilegeValueW
LookupAccountNameA
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegGetValueA
RegOpenKeyExA
CryptAcquireContextW

shell32

ord165
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteW
SHFileOperationW
SHCreateDirectoryExW
SHLoadInProc

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromString
StringFromGUID2
CoCreateGuid
CreateStreamOnHGlobal

oleaut32

SysAllocString
VarUI4FromStr
SysFreeString

shlwapi

PathAppendA
StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
StrStrIA
StrStrIW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
SHGetValueW
PathRemoveFileSpecA
PathFileExistsA
SHSetValueW
StrCmpIW
PathCombineW
PathIsDirectoryW
PathIsRelativeW
PathIsRootW

comctl32

_TrackMouseEvent
InitCommonControlsEx

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

ws2_32

send
recv
accept
bind
closesocket
connect
listen
setsockopt
socket
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError
ntohs
getsockopt
getsockname
ioctlsocket
WSACleanup
WSAStartup
__WSAFDIsSet
select
getpeername
htons
WSAIoctl
recvfrom
sendto
gethostname
shutdown
WSASetLastError

netapi32

Netbios

crypt32

CertCloseStore
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertEnumCertificatesInStore
CertGetNameStringW
CryptStringToBinaryW
CryptBinaryToStringW
CertGetCertificateContextProperty

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

wldap32

ord33
ord35
ord79
ord26
ord30
ord200
ord22
ord41
ord50
ord60
ord211
ord46
ord217
ord143
ord32
ord301
ord27

rasapi32

RasGetConnectStatusW
RasEnumConnectionsW

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 643KB - Virtual size: 642KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3c20e9d355c1b000a6750a846560fcd5

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

7c:fa:4a:90:48:25:f3:ae:4b:df:3d:1d:9b:e6:65:55:10:0e:e4:e5:2e:c7:80:79:c0:1d:0a:08:76:aa:0d:4aSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

gdiplus

ws2_32

version

wininet

urlmon

psapi

crypt32

wintrust

iphlpapi

Exports

Exports

Sections

.text Size: 864KB - Virtual size: 863KB

.rdata Size: 201KB - Virtual size: 201KB

.data Size: 23KB - Virtual size: 40KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 44KB - Virtual size: 43KB

d35e20d79d00a868ccda74f589bfc50d

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

b2:2f:cd:67:5b:69:6b:2a:13:fe:d2:67:b2:44:bf:e2:75:c5:89:ba:f5:82:73:07:df:d9:3a:a5:5c:7b:0b:41Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

crypt32

wintrust

urlmon

advapi32

Sections

.text Size: 336KB - Virtual size: 336KB

.rdata Size: 138KB - Virtual size: 137KB

.data Size: 10KB - Virtual size: 17KB

.pdata Size: 16KB - Virtual size: 15KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

7c:fa:4a:90:48:25:f3:ae:4b:df:3d:1d:9b:e6:65:55:10:0e:e4:e5:2e:c7:80:79:c0:1d:0a:08:76:aa:0d:4a
Signer

.text
Size: 864KB - Virtual size: 863KB

.rdata
Size: 201KB - Virtual size: 201KB

.data
Size: 23KB - Virtual size: 40KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 44KB - Virtual size: 43KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

b2:2f:cd:67:5b:69:6b:2a:13:fe:d2:67:b2:44:bf:e2:75:c5:89:ba:f5:82:73:07:df:d9:3a:a5:5c:7b:0b:41
Signer

.text
Size: 336KB - Virtual size: 336KB

.rdata
Size: 138KB - Virtual size: 137KB

.data
Size: 10KB - Virtual size: 17KB

.pdata
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

5e:fc:0f:fb:7f:74:c5:f2:99:e0:82:da:9f:fb:18:ba:a6:4b:8b:6b:17:8f:63:2c:90:b4:81:7a:74:c7:44:56
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 348KB - Virtual size: 348KB

.data
Size: 66KB - Virtual size: 87KB

.pdata
Size: 42KB - Virtual size: 42KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

d1:8a:c4:d4:2d:bc:00:48:9f:7c:cd:2b:a4:e9:02:7a:32:88:1c:a9:18:55:a8:09:50:fa:ef:50:7d:fc:11:b2
Signer