b4233bab1d5e0a3ad5e710adccb6a8d8887239e45b02864bf1135c72dce04421

Sharing

Copy URL Twitter E-mail

General

Target

b4233bab1d5e0a3ad5e710adccb6a8d8887239e45b02864bf1135c72dce04421
Size

792KB
MD5

598a0791c6f8f824b84aca9219177f85
SHA1

7eeabe21a804dc8ebdb853583aae1a8628466797
SHA256

b4233bab1d5e0a3ad5e710adccb6a8d8887239e45b02864bf1135c72dce04421
SHA512

c7f3e3d830868c4f577cff0b72898671b62ab32adca3e8abfb9ea71ac94ba6be3ae8fcd26c5aceee57ceff4abfa0b163b3e87759f24b9725483967ecda256aba
SSDEEP

24576:nOOnR2kuWlYem3rQDPxqcDoBve1hp3Dq:ZrKeZ7pzq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4233bab1d5e0a3ad5e710adccb6a8d8887239e45b02864bf1135c72dce04421

Files

b4233bab1d5e0a3ad5e710adccb6a8d8887239e45b02864bf1135c72dce04421
.dll windows:6 windows x86

fe9e0abe7fade43e597ac92d3cbb8a14

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

dwmapi

DwmSetWindowAttribute

libcef

cef_string_utf16_set
cef_string_utf16_clear
cef_string_userfree_utf16_free
cef_string_utf8_to_utf16
cef_string_utf16_to_utf8
cef_string_utf8_clear
cef_v8value_create_bool
cef_v8context_get_entered_context
cef_v8value_create_function
cef_v8value_create_array
cef_v8value_create_object
cef_v8value_create_string
cef_v8context_get_current_context
cef_v8value_create_undefined
cef_v8value_create_double
cef_v8value_create_int

kernel32

SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
GetModuleHandleW
LoadLibraryExA
LoadLibraryExW
GetModuleHandleA
LoadLibraryA
GlobalAlloc
GlobalUnlock
GlobalLock
GetLocaleInfoA
InitializeCriticalSection
ResumeThread
LeaveCriticalSection
FindClose
FindFirstFileW
FindNextFileW
SuspendThread
SetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
GetCurrentThreadId
GetDiskFreeSpaceExW
GetFileAttributesW
GetLogicalDrives
GetVolumeInformationW
CreateProcessW
GetCurrentProcessId
GetThreadContext
LocalFree
ReadDirectoryChangesW
GetOverlappedResult
InitializeSListHead
ResetEvent
CloseHandle
Process32FirstW
Process32NextW
MultiByteToWideChar
CreateEventW
CreateToolhelp32Snapshot
CreateFileW
WriteFile
GetCommandLineW
GetLastError
FreeLibrary
ExitProcess
GetProcAddress
LoadLibraryW
lstrcatW
DisableThreadLibraryCalls
GetSystemDirectoryW
SetEnvironmentVariableW
GetModuleFileNameW
GetCurrentProcess
GetCurrentThread
GetTickCount64
SetUnhandledExceptionFilter
AllocConsole
FindResourceW
LoadResource
LockResource
SizeofResource
GetConsoleWindow
WideCharToMultiByte
WaitForSingleObject
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
EnterCriticalSection

user32

DestroyWindow
ShowWindow
SetWindowDisplayAffinity
DestroyIcon
SetActiveWindow
MessageBeep
WindowFromPoint
SetForegroundWindow
FillRect
SetRect
SetWindowRgn
SystemParametersInfoA
CreateIconIndirect
LoadIconA
LoadCursorA
GetWindow
GetParent
SetWindowLongA
GetWindowLongA
MapWindowPoints
ClientToScreen
GetCursorPos
SetCursor
AdjustWindowRectEx
GetWindowRect
ValidateRgn
InvalidateRect
GetUpdateRgn
SetLayeredWindowAttributes
KillTimer
SetTimer
MsgWaitForMultipleObjects
ReleaseCapture
SetCapture
GetAsyncKeyState
GetKeyState
SetFocus
EmptyClipboard
GetClipboardData
SetClipboardData
ChangeClipboardChain
SetClipboardViewer
GetClipboardOwner
CloseClipboard
OpenClipboard
BringWindowToTop
IsIconic
SetWindowPos
OpenIcon
IsWindow
CreateWindowExW
CreateWindowExA
RegisterClassExW
RegisterClassExA
DefWindowProcW
DefWindowProcA
PostMessageA
SendMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
RegisterWindowMessageW
FindWindowW
GetKeyboardLayout
FindWindowExW
GetForegroundWindow
MessageBoxA
GetDC
GetSystemMetrics
ReleaseDC
wsprintfA
wsprintfW
SetWindowTextW
MessageBoxW

gdi32

CreateBitmap
CreateRectRgn
RestoreDC
SaveDC
SetBkMode
SetDIBitsToDevice
SetTextAlign
UpdateColors
GetEnhMetaFileHeader
PlayEnhMetaFile
CreateDIBSection
CreatePolygonRgn
LPtoDP
GdiFlush
ExtCreateRegion
CreateDCA
CreatePalette
CreatePen
CreateSolidBrush
GetStockObject
CombineRgn
CreateCompatibleBitmap
SetPixel
EqualRgn
GetRgnBox
LineTo
RectInRegion
SelectClipRgn
MoveToEx
DPtoLP
Polygon
CreateFontA
GetGlyphOutlineW
GetTextExtentPoint32W
GetCharacterPlacementW
SetTextColor
GetTextMetricsA
TextOutW
ExtCreatePen
Arc
Pie
PolyPolygon
Polyline
StretchDIBits
CreateCompatibleDC
BitBlt
GetDIBits
GetDeviceCaps
DeleteDC
SelectPalette
SelectObject
RealizePalette
DeleteObject

comdlg32

GetOpenFileNameW

advapi32

RegOpenKeyW
RegCloseKey
RegGetValueW
RegQueryValueExW

shell32

DragQueryFileW
CommandLineToArgvW
ShellExecuteExW
SHGetKnownFolderPath

ole32

DoDragDrop
RegisterDragDrop
OleUninitialize
OleInitialize
ReleaseStgMedium
CoTaskMemFree

msvcp140

??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?do_encoding@?$codecvt@_WDU_Mbstatet@@@std@@MBEHXZ
?do_max_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHXZ
?do_always_noconv@?$codecvt@_WDU_Mbstatet@@@std@@MBE_NXZ
?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z
?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z
?do_out@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?do_in@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
_Cnd_signal
_Thrd_hardware_concurrency
?__ExceptionPtrCreate@@YAXPAX@Z
_Cnd_init_in_situ
_Strxfrm
?__ExceptionPtrCopy@@YAXPAXPBX@Z
_Wcscoll
_Query_perf_frequency
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPBD@Z
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Syserror_map@std@@YAPBDH@Z
_Mtx_destroy_in_situ
_Wcsxfrm
?__ExceptionPtrDestroy@@YAXPAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPAX@Z
_Mtx_init_in_situ
_Strcoll
_Cnd_do_broadcast_at_thread_exit
_Thrd_sleep
_Cnd_wait
_Thrd_id
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
_Thrd_join
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?is@?$ctype@_W@std@@QBE_NF_W@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ

ws2_32

recv
getnameinfo
ntohs
socket
send
getsockname
getpeername
WSAStartup
getaddrinfo
setsockopt
WSACleanup
accept
bind
closesocket
select
shutdown
listen
freeaddrinfo
WSASocketW

dbghelp

UnDecorateSymbolNameW
StackWalk64
SymInitialize
SymGetSymFromAddr64
SymFunctionTableAccess64
SymGetModuleBase64
SymCleanup

wininet

InternetOpenUrlW
InternetReadFile
InternetOpenW
InternetCloseHandle

shlwapi

PathStripPathW
StrCmpIW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

comctl32

_TrackMouseEvent

vcruntime140

__current_exception
memchr
_CxxThrowException
strrchr
__std_type_info_hash
strchr
__std_terminate
memset
memcmp
_purecall
__std_exception_copy
memcpy
memmove
__std_exception_destroy
__CxxFrameHandler3
__std_type_info_destroy_list
_except_handler4_common
__current_exception_context

api-ms-win-crt-stdio-l1-1-0

fgetpos
_fseeki64
_get_stream_buffer_pointers
__stdio_common_vsprintf
__stdio_common_vfprintf
fputc
fwrite
fgets
setvbuf
__stdio_common_vsscanf
freopen
_wfopen
fgetc
__acrt_iob_func
__stdio_common_vswprintf_s
fputwc
ungetwc
fgetwc
fsetpos
ungetc
__stdio_common_vswprintf
fread
fclose
fflush
_ftelli64
_wfopen_s

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free
realloc
_callnewh

api-ms-win-crt-math-l1-1-0

_dtest
ceil
_libm_sse2_cos_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
floor
_libm_sse2_acos_precise
_dsign

api-ms-win-crt-convert-l1-1-0

strtod
strtoll
atol
strtoul
strtoull
atoi

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
raise
_cexit
_initterm
terminate
_beginthreadex
_initterm_e
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_configure_narrow_argv
_errno
exit

api-ms-win-crt-string-l1-1-0

strcspn
strlen
strcmp
tolower
toupper
isupper
isalpha
_strdup
wcslen
strcpy_s
wcscmp
_stricmp
strncmp
strncpy
isxdigit
isspace
isalnum
strncpy_s
isdigit

api-ms-win-crt-filesystem-l1-1-0

_wmkdir
_unlock_file
_lock_file
_waccess
_stat64i32
_access_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
localeconv

api-ms-win-crt-environment-l1-1-0

_wgetenv
getenv

api-ms-win-crt-time-l1-1-0

_mktime64
_utime64

Exports

Exports

AlphaBlend
DllInitialize
GradientFill
TransparentBlt
vSetDdrawflag

Sections

.text
Size: 485KB - Virtual size: 485KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe9e0abe7fade43e597ac92d3cbb8a14

Headers

DLL Characteristics

File Characteristics

Imports

dwmapi

libcef

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

msvcp140

ws2_32

dbghelp

wininet

shlwapi

version

comctl32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: 485KB - Virtual size: 485KB

.rdata Size: 134KB - Virtual size: 134KB

.data Size: 61KB - Virtual size: 74KB

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.rsrc Size: 69KB - Virtual size: 69KB

.reloc Size: 35KB - Virtual size: 35KB

.text
Size: 485KB - Virtual size: 485KB

.rdata
Size: 134KB - Virtual size: 134KB

.data
Size: 61KB - Virtual size: 74KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.rsrc
Size: 69KB - Virtual size: 69KB

.reloc
Size: 35KB - Virtual size: 35KB