VTYaQsAA0Hei[.]exe

Resubmissions

12-10-2023 03:24

231012-dyhs4sce9w 8

17-09-2023 21:25

230917-z9paxscg7t 8

17-09-2023 21:06

230917-zxs4cacg4s 8

17-09-2023 20:58

230917-zscwkafc29 8

Sharing

Copy URL

Twitter E-mail

General

Target

VTYaQsAA0Hei.exe
Size

5.8MB
MD5

284fb670fe2bc13889345537218dc883
SHA1

6a0f9bf98ae4417fbad3681bc57e7f795e40b160
SHA256

707d8b322b6ae7c70344034b7802b1ddcca766114425f9ae212bc79394cb4aeb
SHA512

9f3b34b97dc56622cafe89fc1f913a9ce61a43c4ac7fa65b1a0f229289fe8e139f8163953be6bb924d2909ed2c707d2b6552c06596bf1097ea665fd6e5935bcf
SSDEEP

98304:irb/nXZD75WXGVuJB1687EcfM6tQ1DmcJSLROcZbVO3WS8iWQNekngFVDXnd:irb/nXhtFm68rfRt4mGSLR/ZEmSdNZgB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VTYaQsAA0Hei.exe

Files

VTYaQsAA0Hei.exe
.exe windows:6 windows x64

d693627513c85c0290064179c84bd40d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

WSARecv
WSASocketW
connect
select
getsockopt
WSASend
setsockopt
WSACleanup
closesocket
htonl
ntohl
htons
WSASetLastError
WSAStringToAddressW
WSAGetLastError
WSAStartup
ioctlsocket

kernel32

GetCurrentProcessId
GetDynamicTimeZoneInformation
WriteFile
WriteConsoleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetStdHandle
GetConsoleMode
GetCurrentThreadId
WideCharToMultiByte
LocalFree
FormatMessageW
FormatMessageA
GetLastError
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SetLastError
SetWaitableTimer
LeaveCriticalSection
EnterCriticalSection
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
CloseHandle
WaitForSingleObject
SleepEx
SetEvent
CreateEventW
CreateIoCompletionPort
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoA
VerSetConditionMask
QueueUserAPC
TerminateThread
WaitForMultipleObjects
MultiByteToWideChar
GetModuleHandleA
Sleep
GetProcAddress
VirtualFree
VirtualAlloc
LoadLibraryA
LoadLibraryExA
GetFileAttributesW
DeviceIoControl
GlobalLock
GlobalUnlock
GlobalAlloc
GetCurrentProcess
QueryPerformanceFrequency
QueryPerformanceCounter
FreeLibrary
VerifyVersionInfoW
CreateEventA
GetFullPathNameW
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
GetModuleHandleW
MoveFileExW
GetFileInformationByHandleEx
GetLocaleInfoEx
HeapFree
GetProcessHeap
ResetEvent
WaitForSingleObjectEx
WaitForMultipleObjectsEx
OpenEventA
CreateWaitableTimerA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
FindFirstFileW
FindClose
CreateFileW
ReadProcessMemory
GlobalFree
GetFileAttributesExW
GetSystemInfo
CreateFileA
InitializeCriticalSection

user32

GetDesktopWindow
RegisterClassExA
CreateWindowExA
UnregisterClassA
GetWindowRect
UpdateWindow
PeekMessageA
TranslateMessage
DispatchMessageA
ShowWindow
DestroyWindow
GetAsyncKeyState
SetLayeredWindowAttributes
SetWindowLongW
GetWindowLongW
SetWindowTextW
IsIconic
SetFocus
SetForegroundWindow
BringWindowToTop
SetWindowPos
PostQuitMessage
DefWindowProcA
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
SetCursor
LoadCursorA
ClientToScreen
SetCursorPos
GetCursorPos
GetForegroundWindow
IsChild
ScreenToClient
WindowFromPoint
GetMonitorInfoA
EnumDisplayMonitors
GetClientRect
GetKeyState
GetCapture
SetWindowLongA
AdjustWindowRectEx
MonitorFromWindow
ReleaseDC
GetDC
ReleaseCapture
SetCapture

gdi32

GetDeviceCaps

advapi32

AdjustTokenPrivileges
SystemFunction036
RegOpenKeyExA
OpenProcessToken
RegCloseKey
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
LookupPrivilegeValueW
RegDeleteKeyA
RegOpenKeyA

msvcp140

??0?$codecvt@DDU_Mbstatet@@@std@@QEAA@_K@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??1?$codecvt@DDU_Mbstatet@@@std@@MEAA@XZ
?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Thrd_id
_Cnd_signal
_Mtx_unlock
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Cnd_destroy_in_situ
_Mtx_destroy_in_situ
_Xtime_get_ticks
_Mtx_init_in_situ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Xbad_alloc@std@@YAXXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@D@std@@2V0locale@2@A
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
_Query_perf_counter
_Query_perf_frequency
_Thrd_sleep
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?do_max_length@codecvt_base@std@@MEBAHXZ
?do_in@?$codecvt@DDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?do_out@?$codecvt@DDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?do_encoding@codecvt_base@std@@MEBAHXZ
?do_length@?$codecvt@DDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
?do_unshift@?$codecvt@DDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z

d3d9

Direct3DCreate9

ntdll

RtlInitAnsiString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
NtQuerySystemInformation
NtUnloadDriver
NtLoadDriver

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
__current_exception
memcmp
_CxxThrowException
memmove
memcpy
memset
__std_type_info_name
memchr
strstr
__std_type_info_compare
__C_specific_handler
_purecall
__std_exception_destroy
__std_exception_copy
__std_terminate

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_register_onexit_function
abort
_get_narrow_winmain_command_line
_initterm
_initterm_e
_set_app_type
_invalid_parameter_noinfo_noreturn
terminate
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_c_exit
_seh_filter_exe
_initialize_onexit_table
_cexit
_errno
_crt_atexit
_exit
exit
_beginthreadex

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
__stdio_common_vsprintf
__stdio_common_vsprintf_s
fgetc
ungetc
fread
_fseeki64
fgetpos
fsetpos
setvbuf
fflush
fputc
fwrite
fclose
_get_stream_buffer_pointers
__stdio_common_vsscanf
fseek
ftell
__acrt_iob_func
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
_wfopen

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64_s
_localtime64_s

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free
_set_new_mode
_callnewh

api-ms-win-crt-math-l1-1-0

sinf
ceilf
acosf
cosf
_dclass
_ldclass
_fdclass
__setusermatherr
sqrtf
_dsign
fmodf

api-ms-win-crt-string-l1-1-0

strcmp
_stricmp
strncpy
isdigit
strncmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-convert-l1-1-0

strtof
strtol

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func

Exports

Exports

??0?$codecvt_null@_W@archive@boost@@QEAA@_K@Z
??0?$oserializer@Vbinary_oarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@boost@@QEAA@XZ
??0?$oserializer@Vbinary_oarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@boost@@QEAA@XZ
??0?$oserializer@Vbinary_oarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@boost@@QEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@Uencrypted_msg@Server@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@Ufunctions_struct@Server@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@Uloader_struct@Server@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??1?$codecvt_null@_W@archive@boost@@UEAA@XZ
??_F?$codecvt_null@_W@archive@boost@@QEAAXXZ
?do_always_noconv@?$codecvt_null@_W@archive@boost@@EEBA_NXZ
?do_encoding@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_in@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?do_max_length@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_out@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Uencrypted_msg@Server@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@Uencrypted_msg@Server@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Ufunctions_struct@Server@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@Ufunctions_struct@Server@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Uloader_struct@Server@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@Uloader_struct@Server@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vbinary_iarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vbinary_iarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vbinary_iarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$oserializer@Vbinary_oarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$oserializer@Vbinary_oarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$oserializer@Vbinary_oarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@3@XZ
?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_locked@singleton_module@serialization@boost@@QEAA_NXZ
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@QEAAXXZ
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@boost@@UEBAXAEAVbasic_oarchive@234@PEBX@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@boost@@UEBAXAEAVbasic_oarchive@234@PEBX@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@boost@@UEBAXAEAVbasic_oarchive@234@PEBX@Z
?unlock@singleton_module@serialization@boost@@QEAAXXZ

Sections

.text
Size: 764KB - Virtual size: 764KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 261KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vm_sec
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vlizer
Size: 4.4MB - Virtual size: 14.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

Files

d693627513c85c0290064179c84bd40d

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

msvcp140

d3d9

ntdll

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 764KB - Virtual size: 764KB

.rdata Size: 261KB - Virtual size: 260KB

.data Size: 21KB - Virtual size: 27KB

.pdata Size: 30KB - Virtual size: 30KB

.rsrc Size: 194KB - Virtual size: 194KB

.reloc Size: - Virtual size: 2KB

.vm_sec Size: 64KB - Virtual size: 64KB

.vlizer Size: 4.4MB - Virtual size: 14.2MB

.text
Size: 764KB - Virtual size: 764KB

.rdata
Size: 261KB - Virtual size: 260KB

.data
Size: 21KB - Virtual size: 27KB

.pdata
Size: 30KB - Virtual size: 30KB

.rsrc
Size: 194KB - Virtual size: 194KB

.reloc
Size: - Virtual size: 2KB

.vm_sec
Size: 64KB - Virtual size: 64KB

.vlizer
Size: 4.4MB - Virtual size: 14.2MB