aa34da8ac6155ed1125fa9d0a9305c69554a6f153c44c88594cd5d4325583f11

Sharing

Copy URL

Twitter E-mail

General

Target

aa34da8ac6155ed1125fa9d0a9305c69554a6f153c44c88594cd5d4325583f11
Size

234KB
MD5

d06f4f67730174756c4180fff547adb0
SHA1

139c5e299ccee04bdb3c5d1f2ad10432b744f448
SHA256

aa34da8ac6155ed1125fa9d0a9305c69554a6f153c44c88594cd5d4325583f11
SHA512

d485479c1d8f1a3005ffec6bd139751c651b6a11af3a34fa0539f20308fa8ed2a83fccaeab4e5bae388955ed9c5f7ad0456d082b0e8177ad58b308624fc5d478
SSDEEP

3072:B1uViRZ9KTkFPucyerhMyXkzRp8BNW6F4HdHdU:pZ9rrlsp8/WC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa34da8ac6155ed1125fa9d0a9305c69554a6f153c44c88594cd5d4325583f11

Files

aa34da8ac6155ed1125fa9d0a9305c69554a6f153c44c88594cd5d4325583f11
.dll windows:6 windows x86

63de4fc61011efe990a08856b823ae8c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

select

shlwapi

PathFileExistsW
PathCombineW
PathAppendW
PathRemoveFileSpecW
StrStrW
StrCmpIW
PathIsDirectoryW
StrStrIW
StrStrA
StrStrIA

iphlpapi

GetAdaptersInfo

ts_sqlite3

sqlite3_open
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_text
sqlite3_close
sqlite3_column_int64
sqlite3_column_type
sqlite3_step
sqlite3_column_count
sqlite3_finalize
sqlite3_prepare_v2
sqlite3_column_double

threadcore

Thread_Create
Thread_Start
Thread_WaitComplete
Thread_IsCompleted
Thread_Release
Thread_Stop

libcurl

curl_multi_timeout
curl_multi_cleanup
curl_easy_setopt
curl_slist_append
curl_easy_perform
curl_easy_getinfo
curl_easy_cleanup
curl_multi_init
curl_multi_add_handle
curl_multi_perform
curl_multi_fdset
curl_easy_init

kernel32

GetSystemInfo
GetModuleHandleW
GetProcAddress
GetVersionExW
DisableThreadLibraryCalls
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
GetLogicalDriveStringsW
GetVolumeInformationW
SetEnvironmentVariableW
lstrlenW
ExpandEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
TerminateProcess
lstrcmpiW
K32GetModuleBaseNameW
K32EnumProcessModules
OpenProcess
K32EnumProcesses
CreateProcessW
ResetEvent
Sleep
HeapFree
HeapAlloc
GetTickCount
MoveFileW
DeleteFileW
SetFilePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpool
GlobalFree
GlobalAlloc
CreateThreadpool
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
CreateThreadpoolCleanupGroup
CreateThreadpoolWork
SubmitThreadpoolWork
lstrcpyA
lstrcmpiA
CreateFileA
GetFileSizeEx
ReadFile
CloseHandle
WriteFile
CreateDirectoryW
CreateFileW
GetLastError
FindFirstFileW
FindNextFileW
GetWindowsDirectoryW
GetTempPathW
GetModuleFileNameW
SetEvent
WaitForSingleObject
TerminateThread
GetLocalTime
lstrcpyW
CreateEventW
GetCurrentThreadId
GetCurrentProcessId
CreateThread
OutputDebugStringW
GetProcessHeap

advapi32

OpenServiceW
ControlService
CloseServiceHandle
StartServiceW
QueryServiceStatus
OpenSCManagerW

shell32

SHGetFolderPathW

ole32

CoInitialize
CoUninitialize

msvcp140

?uncaught_exception@std@@YA_NXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

vcruntime140

_except_handler4_common
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
__CxxFrameHandler3
strchr
strstr
wcsstr
memcmp
memcpy
_purecall
memset
memmove
__std_terminate

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_crt_atexit
_cexit
terminate
_seh_filter_dll
_invalid_parameter_noinfo
_initialize_onexit_table
_initialize_narrow_environment
_register_onexit_function
_initterm
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_errno
_initterm_e
_get_errno

api-ms-win-crt-string-l1-1-0

strcat_s
wcscat_s
wcslen
wcscpy_s
strtok
strlen
wmemcpy_s

api-ms-win-crt-stdio-l1-1-0

_fseeki64
_wfopen
fwrite
__stdio_common_vswprintf
fread
fseek
ftell
__stdio_common_vswprintf_s
__stdio_common_vsprintf_s
fclose
__stdio_common_vsprintf

api-ms-win-crt-convert-l1-1-0

atol
atof
atoi

api-ms-win-crt-heap-l1-1-0

_callnewh
realloc
malloc
free

api-ms-win-crt-filesystem-l1-1-0

_wrename
_waccess
_wremove
_wsplitpath_s

api-ms-win-crt-math-l1-1-0

_except1
_dtest

Exports

Exports

??0CColumn@core@libts@@QAE@ABV012@@Z
??0CColumn@core@libts@@QAE@XZ
??0CRow@core@libts@@QAE@ABV012@@Z
??0CRow@core@libts@@QAE@XZ
??0CTable@core@libts@@QAE@ABV012@@Z
??0CTable@core@libts@@QAE@XZ
??0TSAppContext@core@libts@@QAE@$$QAV012@@Z
??0TSAppContext@core@libts@@QAE@ABV012@@Z
??0TSAppContext@core@libts@@QAE@XZ
??0TSBaseContext@core@libts@@QAE@$$QAV012@@Z
??0TSBaseContext@core@libts@@QAE@ABV012@@Z
??0TSBaseContext@core@libts@@QAE@XZ
??0TSCSqlite3@core@libts@@QAE@ABV012@@Z
??0TSCSqlite3@core@libts@@QAE@XZ
??0TSGuard@core@libts@@QAE@ABVTSGuardLock@12@@Z
??0TSGuardLock@core@libts@@QAE@XZ
??0TSHttpClient@core@libts@@QAE@ABV012@@Z
??0TSHttpClient@core@libts@@QAE@XZ
??0TSProperties@core@libts@@QAE@ABV012@@Z
??0TSProperties@core@libts@@QAE@XZ
??0TSSetting@core@libts@@QAE@ABV012@@Z
??0TSSetting@core@libts@@QAE@PBD@Z
??0TSStringConverter@core@libts@@QAE@AAV012@@Z
??0TSStringConverter@core@libts@@QAE@PBD@Z
??0TSStringConverter@core@libts@@QAE@PB_W@Z
??0TSStringConverter@core@libts@@QAE@XZ
??0TSThreadTask@core@libts@@QAE@$$QAV012@@Z
??0TSThreadTask@core@libts@@QAE@ABV012@@Z
??0TSThreadTask@core@libts@@QAE@XZ
??0TSThreadpool@core@libts@@AAE@KK@Z
??0TSThreadpool@core@libts@@QAE@ABV012@@Z
??1CColumn@core@libts@@QAE@XZ
??1CRow@core@libts@@QAE@XZ
??1CTable@core@libts@@UAE@XZ
??1TSCSqlite3@core@libts@@UAE@XZ
??1TSGuard@core@libts@@QAE@XZ
??1TSGuardLock@core@libts@@QAE@XZ
??1TSHttpClient@core@libts@@QAE@XZ
??1TSProperties@core@libts@@UAE@XZ
??1TSSetting@core@libts@@UAE@XZ
??1TSStringConverter@core@libts@@QAE@XZ
??1TSThreadpool@core@libts@@AAE@XZ
??4CColumn@core@libts@@QAEAAV012@ABV012@@Z
??4CRow@core@libts@@QAEAAV012@ABV012@@Z
??4CTable@core@libts@@QAEAAV012@ABV012@@Z
??4TSAppContext@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSAppContext@core@libts@@QAEAAV012@ABV012@@Z
??4TSBaseContext@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSBaseContext@core@libts@@QAEAAV012@ABV012@@Z
??4TSCSqlite3@core@libts@@QAEAAV012@ABV012@@Z
??4TSCrpytoBASE64@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSCrpytoBASE64@core@libts@@QAEAAV012@ABV012@@Z
??4TSCrpytoMD5@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSCrpytoMD5@core@libts@@QAEAAV012@ABV012@@Z
??4TSCryptoSHA1@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSCryptoSHA1@core@libts@@QAEAAV012@ABV012@@Z
??4TSDirectory@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSDirectory@core@libts@@QAEAAV012@ABV012@@Z
??4TSDownloader@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSDownloader@core@libts@@QAEAAV012@ABV012@@Z
??4TSFile@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSFile@core@libts@@QAEAAV012@ABV012@@Z
??4TSFolder@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSFolder@core@libts@@QAEAAV012@ABV012@@Z
??4TSGuardLock@core@libts@@QAEAAV012@ABV012@@Z
??4TSHardwareManager@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSHardwareManager@core@libts@@QAEAAV012@ABV012@@Z
??4TSHttpClient@core@libts@@QAEAAV012@ABV012@@Z
??4TSLocalService@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSLocalService@core@libts@@QAEAAV012@ABV012@@Z
??4TSLogger@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSLogger@core@libts@@QAEAAV012@ABV012@@Z
??4TSPath@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSPath@core@libts@@QAEAAV012@ABV012@@Z
??4TSProcess@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSProcess@core@libts@@QAEAAV012@ABV012@@Z
??4TSProperties@core@libts@@QAEAAV012@ABV012@@Z
??4TSSetting@core@libts@@QAEAAV012@ABV012@@Z
??4TSStringConverter@core@libts@@QAE?AV012@ABV012@@Z
??4TSStringConverter@core@libts@@QAE?AV012@PBD@Z
??4TSStringConverter@core@libts@@QAE?AV012@PB_W@Z
??4TSStringHelper@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSStringHelper@core@libts@@QAEAAV012@ABV012@@Z
??4TSStringManager@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSStringManager@core@libts@@QAEAAV012@ABV012@@Z
??4TSSystemEnvironment@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSSystemEnvironment@core@libts@@QAEAAV012@ABV012@@Z
??4TSSystemVersion@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSSystemVersion@core@libts@@QAEAAV012@ABV012@@Z
??4TSThreadTask@core@libts@@QAEAAV012@$$QAV012@@Z
??4TSThreadTask@core@libts@@QAEAAV012@ABV012@@Z
??4TSThreadpool@core@libts@@QAEAAV012@ABV012@@Z
??HTSStringConverter@core@libts@@QAE?AV012@ABV012@@Z
??HTSStringConverter@core@libts@@QAE?AV012@PBD@Z
??HTSStringConverter@core@libts@@QAE?AV012@PB_W@Z
??YTSStringConverter@core@libts@@QAE?AV012@ABV012@@Z
??YTSStringConverter@core@libts@@QAE?AV012@PBD@Z
??YTSStringConverter@core@libts@@QAE?AV012@PB_W@Z
??_7CTable@core@libts@@6B@
??_7TSAppContext@core@libts@@6B@
??_7TSBaseContext@core@libts@@6B@
??_7TSCSqlite3@core@libts@@6B@
??_7TSProperties@core@libts@@6B@
??_7TSSetting@core@libts@@6B@
??_7TSThreadTask@core@libts@@6B@
??_7TSThreadpool@core@libts@@6BTSDisposer@2@@
??_7TSThreadpool@core@libts@@6BTSInitializer@2@@
??_FTSThreadpool@core@libts@@QAEXXZ
?AddColoumn@CRow@core@libts@@QAEXVCColumn@23@@Z
?AddRow@CTable@core@libts@@QAEXVCRow@23@@Z
?AddSetting@TSProperties@core@libts@@QBEXPAVTSSetting@23@@Z
?AnsiToUnicode@TSStringConverter@core@libts@@QAEXAAPA_W@Z
?AnsiToUtf8@TSStringConverter@core@libts@@QAEXAAPAD@Z
?CheckTableNameisExist@TSCSqlite3@core@libts@@QAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ClearTable@CTable@core@libts@@QAEXXZ
?Connection@TSCSqlite3@core@libts@@QAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Create@TSDirectory@core@libts@@SAHPB_W@Z
?Create@TSProcess@core@libts@@SAHPA_W00HPAU_PROCESS_INFORMATION@@@Z
?Create@TSProcess@core@libts@@SAHPA_W00KHPAU_PROCESS_INFORMATION@@@Z
?Create@TSProcess@core@libts@@SAHPA_W0HPAU_PROCESS_INFORMATION@@@Z
?Create@TSProcess@core@libts@@SAHPA_WHPAU_PROCESS_INFORMATION@@@Z
?Create@TSProcess@core@libts@@SAHPA_WPAU_PROCESS_INFORMATION@@@Z
?CreateAll@TSDirectory@core@libts@@SAHPB_W@Z
?CreateAllDirectory@TSBaseContext@core@libts@@UAEHPB_W@Z
?CreateDirectoryW@TSBaseContext@core@libts@@UAEHPB_W@Z
?CreateDownlaoder@TSDownloader@core@libts@@SAPAXXZ
?DisConnect@TSCSqlite3@core@libts@@AAEXXZ
?Dispose@TSLogger@core@libts@@SAXXZ
?Dispose@TSThreadpool@core@libts@@UAEXXZ
?Execute@TSThreadpool@core@libts@@UAEXPAXPAVTSThreadTask@23@@Z
?ExecuteSql@TSCSqlite3@core@libts@@QAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Finalize@TSHttpClient@core@libts@@QAEXXZ
?Get@TSHttpClient@core@libts@@QAEKABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?GetAdapterInfo@TSHardwareManager@core@libts@@SAHPAU_TSAdapterInfo@23@@Z
?GetAppRootPath@TSPath@core@libts@@CAHPB_WPA_W@Z
?GetBOLBValue@CColumn@core@libts@@QAEHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetColumn@CRow@core@libts@@QAEKAAVCColumn@23@K@Z
?GetCount@CRow@core@libts@@QAEKXZ
?GetCount@CTable@core@libts@@QAEKXZ
?GetCpuInfo@TSHardwareManager@core@libts@@SAHPAU_TSCpuInfo@23@@Z
?GetCurrentFolder@TSBaseContext@core@libts@@UAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?GetCurrentFolder@TSFolder@core@libts@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?GetFilePath@TSBaseContext@core@libts@@UAEHW4_TSPathType@TSPath@23@PB_WPA_W@Z
?GetFilePath@TSPath@core@libts@@SAHW4_TSPathType@123@PB_WPA_W@Z
?GetFileSize@TSBaseContext@core@libts@@UAE_JPB_W@Z
?GetFileSize@TSFile@core@libts@@SA_JPB_W@Z
?GetFiles@TSLogger@core@libts@@SAHAAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z
?GetFloateValue@CColumn@core@libts@@QAEHAAN@Z
?GetFolderContents@TSBaseContext@core@libts@@UAE?AV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@0@Z
?GetFolderContents@TSFolder@core@libts@@SA?AV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@0@Z
?GetFolderPath@TSPath@core@libts@@CAHHPB_W0PA_W@Z
?GetInstance@TSThreadpool@core@libts@@SAPAV123@XZ
?GetInt64Value@CColumn@core@libts@@QAEHAA_J@Z
?GetIntValue@CColumn@core@libts@@QAEHAAK@Z
?GetLogicalDrives@TSHardwareManager@core@libts@@SAHAAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z
?GetName@TSSetting@core@libts@@QAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetOSVersion@TSSystemVersion@core@libts@@SA?AW4_TSOSVersion@23@XZ
?GetPathVariable@TSSystemEnvironment@core@libts@@SAHPA_WAAK@Z
?GetProcessorArch@TSSystemVersion@core@libts@@SA?AW4_TSProcessorArch@23@XZ
?GetResponseCode@TSHttpClient@core@libts@@QAEKXZ
?GetResponseContent@TSHttpClient@core@libts@@QAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetResult@TSCSqlite3@core@libts@@QAEXAAVCTable@23@@Z
?GetRow@CRow@core@libts@@QAEXAAV?$vector@VCColumn@core@libts@@V?$allocator@VCColumn@core@libts@@@std@@@std@@@Z
?GetRow@CTable@core@libts@@QAEKAAVCRow@23@K@Z
?GetSetting@TSProperties@core@libts@@QBEPAVTSSetting@23@PBD@Z
?GetStrValue@CColumn@core@libts@@QAEHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetSysAppDataPath@TSPath@core@libts@@CAHPB_WPA_W@Z
?GetSysDesktopPath@TSPath@core@libts@@CAHPB_WPA_W@Z
?GetSysDocumentPath@TSPath@core@libts@@CAHPB_WPA_W@Z
?GetSysProgramCommonPath@TSPath@core@libts@@CAHPB_WPA_W@Z
?GetSysProgramPath@TSPath@core@libts@@CAHPB_WPA_W@Z
?GetSysRootPath@TSPath@core@libts@@CAHPB_WPA_W@Z
?GetSysTempPath@TSPath@core@libts@@CAHPB_WPA_W@Z
?GetSysWindowsPath@TSPath@core@libts@@CAHPB_WPA_W@Z
?GetSystemLogicalDrive@TSHardwareManager@core@libts@@SAHPA_W@Z
?GetTable@CTable@core@libts@@QAEXAAV?$vector@VCRow@core@libts@@V?$allocator@VCRow@core@libts@@@std@@@std@@@Z
?GetVolumeInfo@TSHardwareManager@core@libts@@SAHPAU_TSVolumeInfo@23@@Z
?Guard@TSGuardLock@core@libts@@QAEXXZ
?Init@TSLogger@core@libts@@SAHPA_WK@Z
?Init@TSThreadpool@core@libts@@UAEHXZ
?Initialize@TSHttpClient@core@libts@@QAEHXZ
?IsLocked@TSGuardLock@core@libts@@QBEHXZ
?LookupValue@TSSetting@core@libts@@QBE_NPBDAAH@Z
?LookupValue@TSSetting@core@libts@@QBE_NPBDAAI@Z
?LookupValue@TSSetting@core@libts@@QBE_NPBDAAM@Z
?LookupValue@TSSetting@core@libts@@QBE_NPBDAAN@Z
?LookupValue@TSSetting@core@libts@@QBE_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?LookupValue@TSSetting@core@libts@@QBE_NPBDAA_J@Z
?LookupValue@TSSetting@core@libts@@QBE_NPBDAA_K@Z
?LookupValue@TSSetting@core@libts@@QBE_NPBDAA_N@Z
?LookupValue@TSSetting@core@libts@@QBE_NPBDPAD@Z
?MD5Final@TSCrpytoMD5@core@libts@@SAXQAEPAUMD5_CTX@23@@Z
?MD5Init@TSCrpytoMD5@core@libts@@SAXPAUMD5_CTX@23@@Z
?MD5Update@TSCrpytoMD5@core@libts@@SAXPAUMD5_CTX@23@PAEI@Z
?PathVariableExist@TSSystemEnvironment@core@libts@@SAHPA_W@Z
?Pause@TSDownloader@core@libts@@SAKPAX@Z
?Post@TSHttpClient@core@libts@@QAEKABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00@Z
?QueryServiceStatus@TSLocalService@core@libts@@SAKPB_W@Z
?ReadFile@TSProperties@core@libts@@QAE_NPBD@Z
?ReadJson@TSSetting@core@libts@@QAEXAAVValue@Json@@@Z
?ReadString@TSSetting@core@libts@@QAE_NPBD@Z
?RegisterProgressCallBack@TSDownloader@core@libts@@SAKPAXP6GX_J10@Z@Z
?ReleaseDownloader@TSDownloader@core@libts@@SAXPAX@Z
?ReplaceTo@TSStringConverter@core@libts@@QAEKPB_W0@Z
?Resume@TSDownloader@core@libts@@SAKPAX@Z
?SHA1Final@TSCryptoSHA1@core@libts@@SAXPAU_TSSHA1_CONTEXT@23@QAE@Z
?SHA1Init@TSCryptoSHA1@core@libts@@SAXPAU_TSSHA1_CONTEXT@23@@Z
?SHA1Transform@TSCryptoSHA1@core@libts@@CAPBEPAU_TSSHA1_CONTEXT@23@PBEI@Z
?SHA1Update@TSCryptoSHA1@core@libts@@SAXPAU_TSSHA1_CONTEXT@23@PBXI@Z
?SetBLOBValue@CColumn@core@libts@@QAEXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetBasicInfo@TSDownloader@core@libts@@SAXPAXPBDPB_W@Z
?SetDownlaodThreadMaxCount@TSDownloader@core@libts@@SAXPAXK@Z
?SetDownloadPartialLen@TSDownloader@core@libts@@SAXPAX_J@Z
?SetFloateValue@CColumn@core@libts@@QAEXN@Z
?SetInt64Value@CColumn@core@libts@@QAEX_J@Z
?SetIntValue@CColumn@core@libts@@QAEXK@Z
?SetPathVariable@TSSystemEnvironment@core@libts@@SAHPA_W@Z
?SetStrValue@CColumn@core@libts@@QAEXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetUserData@TSDownloader@core@libts@@SAXPAX0@Z
?SetValue@TSSetting@core@libts@@QBEXPBD0@Z
?SetValue@TSSetting@core@libts@@QBEXPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetValue@TSSetting@core@libts@@QBEXPBDH@Z
?SetValue@TSSetting@core@libts@@QBEXPBDI@Z
?SetValue@TSSetting@core@libts@@QBEXPBDM@Z
?SetValue@TSSetting@core@libts@@QBEXPBDN@Z
?SetValue@TSSetting@core@libts@@QBEXPBD_J@Z
?SetValue@TSSetting@core@libts@@QBEXPBD_K@Z
?SetValue@TSSetting@core@libts@@QBEXPBD_N@Z
?SimpleDownload@TSDownloader@core@libts@@SAKPBDPADPA_W@Z
?Start@TSDownloader@core@libts@@SAKPAX@Z
?StartServiceW@TSLocalService@core@libts@@SAHPB_W@Z
?Stop@TSDownloader@core@libts@@SAKPAX@Z
?StopService@TSLocalService@core@libts@@SAHPB_W@Z
?Terminate@TSProcess@core@libts@@SAHKI@Z
?Terminate@TSProcess@core@libts@@SAHPA_WI@Z
?Unguard@TSGuardLock@core@libts@@QAEXXZ
?UnicodeToAnsi@TSStringConverter@core@libts@@QAEXAAPAD@Z
?UnicodeToUtf8@TSStringConverter@core@libts@@QAEXAAPAD@Z
?Utf8ToAnsi@TSStringConverter@core@libts@@QAEXAAPAD@Z
?Utf8ToAnsi@TSStringConverter@core@libts@@QAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Utf8ToUnicode@TSStringConverter@core@libts@@QAEXAAPA_W@Z
?WorkCallback@TSThreadpool@core@libts@@CGXPAU_TP_CALLBACK_INSTANCE@@PAXPAU_TP_WORK@@@Z
?Write@TSLogger@core@libts@@SAXPB_WZZ
?WriteCallback@TSHttpClient@core@libts@@CAJPAXKKAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?WriteFile@TSProperties@core@libts@@QAE_NPBD@Z
?WriteJson@TSSetting@core@libts@@QAEXAAVValue@Json@@@Z
?__autoclassinit2@CRow@core@libts@@QAEXI@Z
?__autoclassinit2@CTable@core@libts@@QAEXI@Z
?__autoclassinit2@TSCSqlite3@core@libts@@QAEXI@Z
?__autoclassinit2@TSHttpClient@core@libts@@QAEXI@Z
?__autoclassinit2@TSProperties@core@libts@@QAEXI@Z
?__autoclassinit2@TSSetting@core@libts@@QAEXI@Z
?__autoclassinit2@TSStringConverter@core@libts@@QAEXI@Z
?base64decode@TSCrpytoBASE64@core@libts@@SAPAEPBDPAI@Z
?base64encode@TSCrpytoBASE64@core@libts@@SAPADPBEPAI@Z
?m_cLock@TSThreadpool@core@libts@@0VTSGuardLock@23@A
?m_pInstance@TSThreadpool@core@libts@@0PAV123@A
?s2ws@TSStringHelper@core@libts@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@5@I@Z
?s2ws@TSStringHelper@core@libts@@SAXPBDPA_WI@Z
?ws2s@TSStringHelper@core@libts@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@I@Z
?ws2s@TSStringHelper@core@libts@@SAXPB_WPADI@Z

Sections

.text
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63de4fc61011efe990a08856b823ae8c

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

shlwapi

iphlpapi

ts_sqlite3

threadcore

libcurl

kernel32

advapi32

shell32

ole32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 163KB - Virtual size: 162KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 1KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 163KB - Virtual size: 162KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 1KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB