MDE_File_Sample_deb1944dd3c8b7695ca3e04b81649009d414dc805c8d4017244d5d6f929a3f20[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

MDE_File_Sample_deb1944dd3c8b7695ca3e04b81649009d414dc805c8d4017244d5d6f929a3f20.zip
Size

446KB
MD5

6eab612e029145c49d2e842f4b2f5ffb
SHA1

000b22d979f960272f869dbe362a5d46899f73ec
SHA256

27682c59e26127b257e1ccb8a091335c0ee2219718a6aa47b4d23bee313d5a7c
SHA512

0ec1f341a4850393be79a828e9a9599ed438875e2392195acf4ec9111e871bc7927158e5073820539e2fe3e3beb66a9f111bc61d6a6fe681f846db1c9f36d59d
SSDEEP

12288:W+bVYsfed3kCVcEyG2zfIOTtw1JCy7WxT4xayjlm:W/OdhiAwPzyxQtjlm

Score

1^/10

Malware Config

Signatures

Files

MDE_File_Sample_deb1944dd3c8b7695ca3e04b81649009d414dc805c8d4017244d5d6f929a3f20.zip
.zip

Password: infected
7a19c3970082c5045fe46fefdd294c1606273431
.exe windows:6 windows x64

Password: infected

521e7b6b2641485cfcbbfb3d212b3820

Code Sign

33:00:00:04:fa:70:20:8d:01:f1:4f:ec:1e:00:00:00:00:04:fa
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:11

Not After

31/01/2024, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a9:47:e7:01:03:d6:ad:ff:b2:72:a5:c8:64:2d:cf:4f:ec:9c:00:f2:6c:4c:44:d5:b1:59:ef:98:c2:81:0f:e2
Signer

Actual PE Digest

a9:47:e7:01:03:d6:ad:ff:b2:72:a5:c8:64:2d:cf:4f:ec:9c:00:f2:6c:4c:44:d5:b1:59:ef:98:c2:81:0f:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

loggingplatform

?GuidToString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBU_GUID@@@Z
?LoggingSetCommonDatapoint@@YAXPEB_W0@Z
?LoggingSetCommonDatapointUserId@@YAXPEB_WW4UserIdType@@@Z
?StripPrivateInfoFromString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_W@Z
?g_pLoggingAPIWrapper@@3PEAVILoggingAPIWrapper@@EA
?GetEmptyTelemetryUsageExperimentVector@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?NarrowStringToWideString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEBD@Z
?LoggingSendTelemetryEvent@@YAXAEAUTelemetryEvent@@QEAUStructuredEventParameter@@@Z
?SetEventExpiration@TelemetryEvent@@QEAAXII@Z
??0TelemetryEvent@@QEAA@PEBD0AEBU_GUID@@II00II@Z
?OneDriveAssertWorker@@YAXPEB_WW4OneDriveAssertType@@0I000ZZ
?GetActiveHydrationsCount@QoS@@YAIXZ
?IsAnyLibraryIrmEnabled@QoS@@YA_NXZ
?LoggingRecordAssert@@YAXPEB_W000I0_NI1@Z
??1TelemetryEvent@@QEAA@XZ
?LoggingInitializeForExternalComponent@@YAJPEB_W0_NG11W4TelemetryTransportType@@0K1@Z
?LoggingRotateIfNeeded@@YAXXZ
?LoggingWriteStructuredEvent@@YAXAEBUStructuredEvent@@QEAUStructuredEventParameter@@@Z
??0StructuredEvent@@QEAA@PEBDH0AEBU_GUID@@IIII@Z

telemetry

?Report@IncomingTelemetry@@YAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00JV?$duration@_JU?$ratio@$00$0DLJKMKAA@@std@@@chrono@3@@Z

updateringsettings

?GetUpdateRingSettingsManager@@YAPEAVIUpdateRingSettingsManager@@XZ

propsys

PropVariantToStringAlloc
PropVariantToUInt32

ntdll

VerSetConditionMask
RtlCaptureContext
NtQueryDirectoryFile
RtlNtStatusToDosError
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

SetFilePointer
GetCompressedFileSizeW
FindFirstFileNameW
IsDebuggerPresent
SetHandleInformation
CreatePipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
DeviceIoControl
LoadLibraryExW
ReadDirectoryChangesW
CreateSymbolicLinkW
GetUserGeoID
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProductInfo
VerifyVersionInfoW
SetLastError
ReleaseMutex
WaitForMultipleObjects
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetProcessTimes
GetExitCodeProcess
CreateProcessW
RemoveDirectoryW
GetSystemTimes
SetThreadInformation
GetPrivateProfileStringW
WritePrivateProfileStringW
SetDllDirectoryW
CopyFileW
MoveFileExW
ReplaceFileW
GetComputerNameW
RegisterApplicationRestart
GetFileInformationByHandleEx
OpenFileById
GetDllDirectoryW
DebugBreak
WaitForSingleObjectEx
ReadFile
GetVolumePathNameW
WerRegisterFile
GetTickCount64
GetComputerNameExW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
DuplicateHandle
UnregisterApplicationRestart
SystemTimeToTzSpecificLocalTime
GetFinalPathNameByHandleW
OpenMutexW
GetFileType
GetFileSizeEx
GetFileSize
OutputDebugStringW
InitOnceBeginInitialize
InitOnceComplete
InitializeCriticalSectionAndSpinCount
ResetEvent
GetFileInformationByHandle
GetFileAttributesExW
GetDiskFreeSpaceExW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
CreateFileW
CreateDirectoryW
GetLongPathNameW
GetTickCount
CreateEventExW
WaitForMultipleObjectsEx
FindNextFileW
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
K32GetModuleFileNameExW
GetUserDefaultLocaleName
GetUserDefaultLCID
LCIDToLocaleName
MoveFileW
LocalAlloc
LoadLibraryW
FreeLibrary
GetVersionExW
GetSystemTimeAsFileTime
GetSystemTime
OpenProcess
TerminateProcess
GetCurrentProcessId
CreateMutexW
FindFirstFileW
FindClose
DeleteFileW
SystemTimeToFileTime
LocalFree
GetCurrentThread
SetFileAttributesW
GetFileAttributesW
CompareStringOrdinal
QueryFullProcessImageNameW
GetCurrentProcess
IsWow64Process
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
RaiseException
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
DecodePointer
HeapAlloc
CreateThread
CloseHandle
SetEvent
GetLastError
Sleep
CreateEventW
WaitForSingleObject
InitializeCriticalSectionEx
GetModuleFileNameW
GetCommandLineW
HeapFree
FormatMessageW
InitializeSListHead
QueryPerformanceCounter
GetCurrentDirectoryW
InterlockedPushEntrySList
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetFileInformationByHandle
SetProcessShutdownParameters
QueueUserWorkItem
MoveFileWithProgressW
GlobalLock
GlobalUnlock
GlobalFree
GlobalAlloc
GetDateFormatW
OpenEventW
GetLocaleInfoW

user32

CharUpperW
GetMessageW
SetTimer
KillTimer
PostMessageW
EnumWindows
GetClassNameW
DispatchMessageW
CharNextW
SendMessageTimeoutW
PeekMessageW
PostQuitMessage
MsgWaitForMultipleObjectsEx
SetCursor
TranslateMessage
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
LoadImageW
GetWindowThreadProcessId
GetProcessDefaultLayout
GetIconInfo
GetWindowRect
TrackPopupMenu
GetSubMenu
GetDoubleClickTime
PostThreadMessageW
SetMenuDefaultItem
EnableMenuItem
GetMenuStringW
GetMenuItemCount
RemoveMenu
DeleteMenu
AppendMenuW
ModifyMenuW
EndDialog
RegisterClassW
SystemParametersInfoW
DestroyWindow
ShowWindow
IsWindow
SetForegroundWindow
FindWindowW
SendMessageW
GetClientRect
RegisterClassExW
LoadIconW
GetClassInfoExW
GetLastInputInfo
IsHungAppWindow
MapWindowPoints
GetWindowLongW
CloseClipboard
OpenClipboard
GetClipboardData
SetClipboardData
EmptyClipboard
SetWindowPos
AdjustWindowRectEx
MessageBoxW
AllowSetForegroundWindow
SetFocus
GetLastActivePopup
LoadCursorW
CreateWindowExW

advapi32

CryptReleaseContext
RegCopyTreeW
RegNotifyChangeKeyValue
CheckTokenMembership
InitializeAcl
CreateProcessWithTokenW
GetUserNameW
SetFileSecurityW
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
GetAce
DeleteAce
AddAce
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
RegDeleteTreeW
RegUnLoadKeyW
RegLoadKeyW
RegEnumKeyW
RegDeleteKeyExW
RegCreateKeyTransactedW
GetAclInformation
FreeSid
DuplicateTokenEx
CreateWellKnownSid
AllocateAndInitializeSid
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
RegOpenKeyExW
CryptAcquireContextW
RegGetValueW
RegSetKeyValueW
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
LookupPrivilegeValueW
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
AdjustTokenPrivileges
AccessCheck
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
OpenProcessToken
DuplicateToken
MapGenericMask
IsValidAcl
OpenThreadToken
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
ConvertStringSidToSidW

shell32

SHGetFolderPathAndSubDirW
SHGetFolderPathW
ShellExecuteExW
SHQueryUserNotificationState
SHAppBarMessage
SHGetPathFromIDListW
SHBrowseForFolderW
SHParseDisplayName
ShellExecuteW
Shell_NotifyIconW
SHCreateDirectoryExW
SHCreateItemFromParsingName
SHGetKnownFolderItem
CommandLineToArgvW
SHFileOperationW
SHGetKnownFolderPath
ord526
SHChangeNotify
SHAssocEnumHandlers
SHGetSpecialFolderPathW
SHSetKnownFolderPath
AssocCreateForClasses

ole32

CoCreateGuid
CoSetProxyBlanket
CoWaitForMultipleHandles
CLSIDFromString
StringFromCLSID
CreateBindCtx
CoRevertToSelf
CreateItemMoniker
CoImpersonateClient
PropVariantClear
CoInitializeSecurity
GetRunningObjectTable
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoReleaseServerProcess
CoAddRefServerProcess
CoInitializeEx
CoUninitialize
CoAllowSetForegroundWindow
CoCreateInstance
CoRegisterClassObject
CoResumeClassObjects
CoRevokeClassObject
CoGetObject
CoGetCallContext
StringFromGUID2

oleaut32

SetErrorInfo
SysStringByteLen
SafeArrayUnaccessData
SafeArrayAccessData
GetErrorInfo
GetRecordInfoFromTypeInfo
LoadRegTypeLi
SysAllocStringByteLen
SysStringLen
SysAllocString
RegisterTypeLi
SysFreeString
LoadTypeLi
UnRegisterTypeLi

crypt32

CertFindExtension
CryptBinaryToStringW
CryptStringToBinaryW

rpcrt4

UuidToStringW
RpcStringFreeW
RpcBindingFree
RpcBindingFromStringBindingW
RpcBindingVectorFree
RpcStringBindingComposeW
RpcServerInqBindings
RpcServerRegisterIfEx
RpcServerUnregisterIf
RpcServerUseProtseqW
RpcBindingSetAuthInfoExW
RpcEpRegisterW
RpcEpUnregister
RpcServerInqCallAttributesW

secur32

GetUserNameExW

shlwapi

SHDeleteValueW
PathIsDirectoryEmptyW
PathRemoveFileSpecW
StrStrIW
PathIsPrefixW
PathStripToRootW
SHGetValueA
PathStripPathW
PathIsDirectoryW
SHRegGetUSValueW
SHGetValueW
PathFindFileNameW
PathFileExistsW
SHStrDupW
SHCreateStreamOnFileEx
SHRegCreateUSKeyW
SHRegCloseUSKey
SHRegSetUSValueW
AssocCreate
UrlEscapeW
UrlCreateFromPathW
SHSetValueW
SHDeleteKeyW
SHCreateStreamOnFileW
AssocQueryStringW
SHRegGetBoolUSValueW
SHRegGetPathW
SHRegGetValueW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetGetConnectedState
InternetCheckConnectionW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

msvcp140

?_Random_device@std@@YAIXZ
_Xtime_get_ticks
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?id@?$collate@_W@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Wcsxfrm
_Wcscoll
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Cnd_wait
_Cnd_broadcast
_Cnd_unregister_at_thread_exit
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Cnd_register_at_thread_exit
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xruntime_error@std@@YAXPEBD@Z
??0_Locinfo@std@@QEAA@HPEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?toupper@?$ctype@_W@std@@QEBA_W_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setf@ios_base@std@@QEAAHH@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

userenv

CreateEnvironmentBlock
GetDefaultUserProfileDirectoryW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_purecall
__std_terminate
wcschr
__std_type_info_compare
__std_type_info_name
__std_exception_copy
_CxxThrowException
__RTDynamicCast
memcpy
memmove
__C_specific_handler
__current_exception_context
__current_exception
wcsstr
wcsrchr
strchr
memcmp
memset
__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
realloc
free
_callnewh

api-ms-win-crt-string-l1-1-0

_wcsnicmp
tolower
toupper
wcscmp
_wcsicmp
isxdigit
wcsncmp
towupper
towlower
wcsncpy_s
isalnum
wcscat_s
wcscspn
_strnicmp
strncmp
_wcsdup
iswxdigit
wcstok_s
wcscpy_s
iswspace

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_beginthread
_invalid_parameter_noinfo_noreturn
abort
_set_app_type
terminate
_cexit
_errno
_invalid_parameter_noinfo
_register_thread_local_exe_atexit_callback
_c_exit
_seh_filter_exe
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
_register_onexit_function

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64

api-ms-win-crt-convert-l1-1-0

strtoull
wcstoll
atof
_wtoi
atol
strtoll
_strtod_l
wcstoul

api-ms-win-crt-locale-l1-1-0

_free_locale
_create_locale
_configthreadlocale

api-ms-win-crt-math-l1-1-0

ceilf
__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
fclose
__stdio_common_vswprintf
_set_fmode
_wfopen_s

filesyncsessions

GetSettingsPersistence

gdi32

GetObjectW

Sections

.text
Size: 619KB - Virtual size: 618KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 254KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

521e7b6b2641485cfcbbfb3d212b3820

Code Sign

33:00:00:04:fa:70:20:8d:01:f1:4f:ec:1e:00:00:00:00:04:faCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

a9:47:e7:01:03:d6:ad:ff:b2:72:a5:c8:64:2d:cf:4f:ec:9c:00:f2:6c:4c:44:d5:b1:59:ef:98:c2:81:0f:e2Signer

Headers

DLL Characteristics

File Characteristics

Imports

loggingplatform

telemetry

updateringsettings

propsys

ntdll

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

wtsapi32

msvcp140

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

filesyncsessions

gdi32

Sections

.text Size: 619KB - Virtual size: 618KB

.rdata Size: 254KB - Virtual size: 253KB

.data Size: 38KB - Virtual size: 49KB

.pdata Size: 29KB - Virtual size: 29KB

.rsrc Size: 58KB - Virtual size: 58KB

.reloc Size: 7KB - Virtual size: 6KB

33:00:00:04:fa:70:20:8d:01:f1:4f:ec:1e:00:00:00:00:04:fa
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

a9:47:e7:01:03:d6:ad:ff:b2:72:a5:c8:64:2d:cf:4f:ec:9c:00:f2:6c:4c:44:d5:b1:59:ef:98:c2:81:0f:e2
Signer

.text
Size: 619KB - Virtual size: 618KB

.rdata
Size: 254KB - Virtual size: 253KB

.data
Size: 38KB - Virtual size: 49KB

.pdata
Size: 29KB - Virtual size: 29KB

.rsrc
Size: 58KB - Virtual size: 58KB

.reloc
Size: 7KB - Virtual size: 6KB