OfficeClickToRun[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

OfficeClickToRun.exe
Size

8.8MB
MD5

25eb7ce2419d631ffb4e211a994acf47
SHA1

111bb8d0ed0bbd7bdcffb3ca3fb8d0cee3872c45
SHA256

cd3ab28d3e73814ea8ae4e14074bb50674254b2c68592304488173209bad170d
SHA512

24bcd56b1730b48d306c25434f19e7642ca0891cac1845126729d379e0535b2de2af7976301b88542273b4b48d1b4ba97cf917dc45faa15c80cef06b42e6af8d
SSDEEP

49152:oLhFJwC1HWL1ftMSG+pHCdlKTta/6mgzBz2C9X6uDqZZwUK9J+0aZ2iMp0zx/Z1y:InkpH3SxX47DoirrPLIi7

Score

1^/10

Malware Config

Signatures

Files

OfficeClickToRun.exe
.exe windows:6 windows x64

f3849e9444171aa6cd0c1913cc044ff2

Code Sign

33:00:00:05:00:27:d6:32:6f:43:73:7b:87:00:00:00:00:05:00
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:11

Not After

31/01/2024, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:10

Not After

31/01/2024, 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e2:e0:ab:8c:39:3b:f9:e3:75:2d:c2:dc:f4:54:c6:ca:f7:b9:c7:6e:c3:ea:eb:39:c9:f8:cd:8a:8a:1d:dd:d9
Signer

Actual PE Digest

e2:e0:ab:8c:39:3b:f9:e3:75:2d:c2:dc:f4:54:c6:ca:f7:b9:c7:6e:c3:ea:eb:39:c9:f8:cd:8a:8a:1d:dd:d9

Digest Algorithm

sha256

PE Digest Matches

true

e2:e0:ab:8c:39:3b:f9:e3:75:2d:c2:dc:f4:54:c6:ca:f7:b9:c7:6e:c3:ea:eb:39:c9:f8:cd:8a:8a:1d:dd:d9
Signer

Actual PE Digest

e2:e0:ab:8c:39:3b:f9:e3:75:2d:c2:dc:f4:54:c6:ca:f7:b9:c7:6e:c3:ea:eb:39:c9:f8:cd:8a:8a:1d:dd:d9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
CreateWellKnownSid
CheckTokenMembership
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteTreeW
RegDeleteKeyW
RegGetValueW
RegDeleteValueW
GetTokenInformation
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
ReportEventW
RegisterEventSourceW
DeregisterEventSource
EventWriteTransfer
EventRegister
EventUnregister
CryptReleaseContext
CryptAcquireContextW
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
GetFileSecurityW
SetFileSecurityW
RegNotifyChangeKeyValue
RevertToSelf
RegQueryValueW
OpenThreadToken
OpenProcessToken
GetLengthSid
CopySid
InitializeAcl
AddAccessAllowedAce
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
ConvertSidToStringSidW
EqualSid
EventWrite
RegEnumValueA
RegDeleteValueA
CreateProcessAsUserW
RegCopyTreeW
ConvertStringSidToSidW
LookupAccountSidW
ImpersonateLoggedOnUser
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
CloseServiceHandle
OpenServiceW
QueryServiceStatusEx
QueryServiceConfigW
StartServiceW
ControlService
EnumDependentServicesW
DeleteService
CreateServiceW
ChangeServiceConfig2W
ChangeServiceConfigW
SetServiceObjectSecurity
RegGetValueA
DuplicateTokenEx
SetTokenInformation
SetThreadToken
ControlTraceW
StartTraceW
OpenTraceW
CloseTrace
ProcessTrace
EnableTraceEx
RegSaveKeyExW
RegRestoreKeyW
RegGetKeySecurity
RegSetKeySecurity
RegRenameKey
RegOpenCurrentUser
DuplicateToken

gdi32

GetFontData
RemoveFontResourceW
CreateFontIndirectW
AddFontResourceW
EnumFontFamiliesExW
DeleteObject
GetDeviceCaps
SelectObject

iphlpapi

GetAdaptersInfo
CreateSortedAddressPairs
FreeMibTable

kernel32

LoadLibraryA
FormatMessageA
GetSystemTimeAsFileTime
GetTickCount64
GetCurrentThreadId
GetUserDefaultLocaleName
IsValidCodePage
WideCharToMultiByte
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetCPInfoExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
TlsAlloc
TlsFree
FlsGetValue
TlsGetValue
FlsSetValue
TlsSetValue
InitializeSRWLock
GetProcessTimes
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
K32GetModuleFileNameExW
CreateProcessW
FindResourceW
SizeofResource
LoadResource
VerSetConditionMask
VerifyVersionInfoW
OpenProcess
GlobalMemoryStatusEx
GetVersionExW
GetDiskFreeSpaceExW
GetWindowsDirectoryW
CreateFileW
DeviceIoControl
SetErrorMode
GetComputerNameW
MulDiv
FormatMessageW
GetLogicalProcessorInformation
GetNativeSystemInfo
GetSystemDirectoryW
HeapFree
HeapAlloc
GetProcessHeap
WaitForSingleObject
CreateThread
WaitForMultipleObjectsEx
CreateEventExW
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
ReleaseSemaphore
WaitForSingleObjectEx
QueryDepthSList
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
RtlCaptureStackBackTrace
TzSpecificLocalTimeToSystemTime
OpenEventW
OpenMutexW
GetTempPathW
GetLongPathNameW
ResetEvent
IsDebuggerPresent
GetFileAttributesExW
FindFirstFileExW
MoveFileExW
FindNextFileW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
WriteFile
ReadFile
SetFilePointerEx
SetEndOfFile
GetFileSizeEx
FlushFileBuffers
LockFileEx
UnlockFileEx
CopyFileExW
GetVolumePathNamesForVolumeNameW
SetFileInformationByHandle
CreateFileMappingW
WaitForMultipleObjects
RtlLookupFunctionEntry
RtlVirtualUnwind
GetFileType
SetFilePointer
LockFile
GetOverlappedResult
GetFileAttributesW
GetFileTime
ReplaceFileW
CopyFileW
GetTempFileNameW
GetShortPathNameW
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalFree
GlobalAlloc
GetFileSize
LockResource
SetFileTime
CancelIoEx
GetProcessAffinityMask
CreateWaitableTimerW
SetWaitableTimerEx
CancelWaitableTimer
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
QueryFullProcessImageNameW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetThreadIOPendingFlag
GetCurrentThread
GetQueuedCompletionStatus
lstrlenW
GetStartupInfoW
CreateMemoryResourceNotification
GetSystemPowerStatus
IsSystemResumeAutomatic
QueryUnbiasedInterruptTime
OutputDebugStringW
RtlCaptureContext
CreateMutexW
OpenEventA
CreateEventA
OpenMutexA
CreateMutexA
OpenSemaphoreA
CreateSemaphoreA
OpenFileMappingA
LocalAlloc
LCMapStringEx
LCIDToLocaleName
K32GetProcessMemoryInfo
GetPhysicallyInstalledSystemMemory
GetProductInfo
GetLocalTime
GetLocaleInfoEx
ResolveLocaleName
GetUserPreferredUILanguages
GetACP
GetSystemDefaultLCID
EnumSystemLocalesEx
GetSystemDefaultLocaleName
GetUserGeoID
GetGeoInfoW
GetUserDefaultUILanguage
GetTimeZoneInformation
GetThreadLocale
DeleteFileA
GetTempPathA
FindFirstFileW
lstrcmpW
FlushViewOfFile
GetFullPathNameW
GetPriorityClass
GetExitCodeProcess
K32EnumProcesses
ProcessIdToSessionId
GetVolumeInformationW
GetExitCodeThread
AreFileApisANSI
HeapCreate
GetDiskFreeSpaceW
InitializeCriticalSection
GetFullPathNameA
HeapValidate
HeapSize
GetDiskFreeSpaceA
GetFileAttributesA
GetModuleHandleW
GetSystemInfo
HeapCompact
HeapDestroy
CreateFileMappingA
DeleteTimerQueueTimer
CreateTimerQueueTimer
CloseHandle
GetStringTypeExW
UnlockFile
MapViewOfFile
GetCurrentProcess
GetModuleHandleExW
GetLastError
CompareStringEx
GetProcAddress
FreeLibrary
CreateFileA
UnmapViewOfFile
FindClose
LocaleNameToLCID
ReleaseMutex
GetCurrentProcessId
GlobalAddAtomW
GlobalFindAtomW
CreateEventW
SetEvent
DeleteFileW
FlsAlloc
LoadLibraryExA
VirtualQuery
VirtualProtect
InitOnceBeginInitialize
InitOnceComplete
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
GetFileInformationByHandle
FlsFree
GetTickCount
Sleep
OutputDebugStringA
QueryActCtxW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetDriveTypeW
lstrcmpiW
GetDateFormatW
GetTimeFormatW
SetCurrentDirectoryW
CreateActCtxW
FindActCtxSectionStringW
LoadLibraryW
ActivateActCtx
DeactivateActCtx
SetLastError
RaiseException
LocalFree
GetModuleFileNameW
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSectionEx
LoadLibraryExW
ExpandEnvironmentStringsW
IsWow64Process
HeapReAlloc

oleaut32

RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
GetErrorInfo
SetErrorInfo
SysStringLen
SysAllocString
VariantInit
VariantClear
SysFreeString

rpcrt4

RpcRevertToSelf
RpcImpersonateClient
UuidToStringW
RpcMgmtStopServerListening
NdrServerCall2
RpcBindingInqAuthClientW
RpcServerUnregisterIf
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcMgmtWaitServerListen
RpcBindingSetAuthInfoW
RpcBindingFree
RpcMgmtIsServerListening
RpcServerRegisterIf2
RpcServerListen
RpcServerUseProtseqEpW
RpcServerRegisterAuthInfoW
UuidCreate

ws2_32

WSAStartup
GetAddrInfoW
FreeAddrInfoW

rstrtmgr

RmShutdown
RmAddFilter
RmRestart
RmStartSession
RmRegisterResources
RmGetList
RmEndSession

cabinet

ord13
ord14

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSSendMessageW
WTSQuerySessionInformationW
WTSQueryUserToken

setupapi

SetupIterateCabinetW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
memcpy
__std_terminate
__C_specific_handler_noexcept
__RTDynamicCast
memchr
memcmp
_purecall
wcsrchr
strstr
__std_exception_copy
__std_exception_destroy
__C_specific_handler
memmove
__std_type_info_compare
__RTtypeid
__current_exception
__std_type_info_name
wcschr
strchr
__current_exception_context
memset
wcsstr

msvcp140

?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?width@ios_base@std@@QEAA_J_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?flags@ios_base@std@@QEBAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?width@ios_base@std@@QEBA_JXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?exceptions@ios_base@std@@QEAAXH@Z
?flags@ios_base@std@@QEAAHH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?precision@ios_base@std@@QEAA_J_J@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?widen@?$ctype@D@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?narrow@?$ctype@D@std@@QEBADDD@Z
?is@?$ctype@D@std@@QEBA_NFD@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
_Thrd_id
?classic@locale@std@@SAAEBV12@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??0id@locale@std@@QEAA@_K@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z
_Xtime_get_ticks
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_broadcast
_Mtx_current_owns
_Cnd_timedwait
_Query_perf_counter
_Query_perf_frequency
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1_Locinfo@std@@QEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@PEBD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
_Wcsxfrm
_Wcscoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setf@ios_base@std@@QEAAHH@Z
?setf@ios_base@std@@QEAAHHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
_Thrd_sleep
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
_Thrd_join
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?widen@?$ctype@_W@std@@QEBA_WD@Z
??Bios_base@std@@QEBA_NXZ
?fail@ios_base@std@@QEBA_NXZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
?_Random_device@std@@YAIXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA_W_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
_Cnd_wait
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
_Thrd_yield
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
_Mtx_trylock
_Cnd_signal
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_K@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?bad@ios_base@std@@QEBA_NXZ
?narrow@?$ctype@_W@std@@QEBAD_WD@Z
?id@?$numpunct@_W@std@@2V0locale@2@A
_Cnd_unregister_at_thread_exit
_Cnd_register_at_thread_exit
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?uncaught_exceptions@std@@YAHXZ
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?toupper@?$ctype@_W@std@@QEBA_W_W@Z

api-ms-win-crt-heap-l1-1-0

_set_new_mode
realloc
_msize
calloc
free
malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s
__stdio_common_vswscanf
__stdio_common_vswprintf
__stdio_common_vsprintf_s
__p__commode
_set_fmode
_get_stream_buffer_pointers
fputc
fread
fwrite
fputwc
ungetwc
ungetc
fgetc
fgetwc
fgetpos
__stdio_common_vsnprintf_s
_wfopen_s
fclose
__stdio_common_vswprintf_s
__stdio_common_vsprintf
__stdio_common_vsscanf
fgets
fputs
fflush
setvbuf
fsetpos
_fseeki64

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_crt_atexit
_seh_filter_exe
_endthreadex
_clearfp
_beginthreadex
_set_app_type
_configure_wide_argv
_register_thread_local_exe_atexit_callback
abort
terminate
_invalid_parameter_noinfo_noreturn
_c_exit
_cexit
_initialize_wide_environment
_exit
exit
_initterm_e
_initterm
_errno
_get_wide_winmain_command_line
_invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

strncpy_s
_stricmp
towupper
wcsncpy_s
tolower
strncmp
strcspn
isxdigit
isspace
_wcsnicmp
wcstok_s
isdigit
wmemcpy_s
_towupper_l
towlower
iswspace
iswalpha
strnlen
wcsncat_s
wcscpy_s
isalnum
wcscat_s
wcsncmp
wcscmp
strcmp
wcsnlen
_wcsicmp

api-ms-win-crt-convert-l1-1-0

wcstoll
_ui64toa_s
wcstoul
_i64tow_s
_itow_s
strtol
strtod
_ultow_s
strtoull
_wtoi64
wcstoull
_wtof
_wcstoui64
strtoll
_wtol
_wcstoi64
wcstol
_wtoi
_ui64tow_s
wcstod

api-ms-win-crt-time-l1-1-0

_difftime64
wcsftime
_mktime64
_time64
clock
_gmtime64_s
_localtime64_s

api-ms-win-crt-math-l1-1-0

logf
log10
floor
expf
ceilf
ceil
_dclass
_dsign
round
__setusermatherr
log2
pow

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char
___lc_codepage_func
_configthreadlocale
_create_locale

api-ms-win-crt-utility-l1-1-0

srand
rand
rand_s

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file
_wsplitpath_s

netapi32

NetGetJoinInformation
NetApiBufferFree

ntdll

NtSetInformationKey

apiclient

?GetProcessPoolProcessId@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z
?KillQueuedProcesses@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z
?RestartKilledProcesses@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z
?InvokeProcessKillerEx@@YAJV?$shared_ptr@VORpcClient@@@std@@HHHPEB_W1PEAK@Z
?InvokeProcessKiller@@YAJV?$shared_ptr@VORpcClient@@@std@@HHHPEB_WPEAK@Z
?GetClickToRunData@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WK@Z
?PromptUser@@YAJV?$shared_ptr@VORpcClient@@@std@@KPEAKPEB_W@Z
?RaiseTaskErrorEvent3@@YAJV?$shared_ptr@VORpcClient@@@std@@KKKKPEB_W@Z
?RaiseTaskToastEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@H@Z
?RaiseTaskDialogEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1@Z
?RaiseTaskProgressEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@U_GUID@@K@Z
?GetServiceVersion@@YAJV?$shared_ptr@VORpcClient@@@std@@PEA_WK@Z
?QueueTaskItem@@YAJV?$shared_ptr@VORpcClient@@@std@@U_GUID@@@Z

Sections

.text
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 256KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 328KB - Virtual size: 327KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3849e9444171aa6cd0c1913cc044ff2

Code Sign

33:00:00:05:00:27:d6:32:6f:43:73:7b:87:00:00:00:00:05:00Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

e2:e0:ab:8c:39:3b:f9:e3:75:2d:c2:dc:f4:54:c6:ca:f7:b9:c7:6e:c3:ea:eb:39:c9:f8:cd:8a:8a:1d:dd:d9Signer

e2:e0:ab:8c:39:3b:f9:e3:75:2d:c2:dc:f4:54:c6:ca:f7:b9:c7:6e:c3:ea:eb:39:c9:f8:cd:8a:8a:1d:dd:d9Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

iphlpapi

kernel32

oleaut32

rpcrt4

ws2_32

rstrtmgr

cabinet

wintrust

wtsapi32

setupapi

vcruntime140_1

vcruntime140

msvcp140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

netapi32

ntdll

apiclient

Sections

.text Size: 5.2MB - Virtual size: 5.2MB

.rdata Size: 2.7MB - Virtual size: 2.7MB

.data Size: 256KB - Virtual size: 282KB

.pdata Size: 328KB - Virtual size: 327KB

.didat Size: 2KB - Virtual size: 2KB

.rsrc Size: 100KB - Virtual size: 100KB

.reloc Size: 164KB - Virtual size: 164KB

33:00:00:05:00:27:d6:32:6f:43:73:7b:87:00:00:00:00:05:00
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

e2:e0:ab:8c:39:3b:f9:e3:75:2d:c2:dc:f4:54:c6:ca:f7:b9:c7:6e:c3:ea:eb:39:c9:f8:cd:8a:8a:1d:dd:d9
Signer

e2:e0:ab:8c:39:3b:f9:e3:75:2d:c2:dc:f4:54:c6:ca:f7:b9:c7:6e:c3:ea:eb:39:c9:f8:cd:8a:8a:1d:dd:d9
Signer

.text
Size: 5.2MB - Virtual size: 5.2MB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 256KB - Virtual size: 282KB

.pdata
Size: 328KB - Virtual size: 327KB

.didat
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 100KB - Virtual size: 100KB

.reloc
Size: 164KB - Virtual size: 164KB