44247c472613b13338d77477dabe12d5a1c769399b15cb7cfcaf90bb28d1b259

Sharing

Copy URL

Twitter E-mail

General

Target

44247c472613b13338d77477dabe12d5a1c769399b15cb7cfcaf90bb28d1b259
Size

1.2MB
MD5

22ac58844cdec7a4723e9687458fa2d4
SHA1

74a5482ae0756b6a6f8c97fc77eac026f7c41500
SHA256

44247c472613b13338d77477dabe12d5a1c769399b15cb7cfcaf90bb28d1b259
SHA512

66c0a1c68e139f91a7ef88ff9d54630bcdddee2ca882c43a742aad047a1aa627907db77233a45c64e92904c18655903010cdc0a62e22c95278aa12e51422f5d3
SSDEEP

24576:WY1x1ENkBRF8pt20YZa9b/7+U8TnDFmS/oWKGQGh93nd0:Px1ENkTWfiZaNR8Tn//a5093n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44247c472613b13338d77477dabe12d5a1c769399b15cb7cfcaf90bb28d1b259

Files

44247c472613b13338d77477dabe12d5a1c769399b15cb7cfcaf90bb28d1b259
.exe windows:6 windows x64

6b7bb2c79ab738f62b5387d0c6adecba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleHandleA
SetCurrentDirectoryA
GetCommandLineA
QueryFullProcessImageNameA
FileTimeToSystemTime
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
GetNativeSystemInfo
FileTimeToLocalFileTime
GetProcAddress
CreateFileMappingA
ReadProcessMemory
FreeLibrary
CreateProcessA
GetDiskFreeSpaceExA
MapViewOfFile
IsWow64Process
GetProcessTimes
InitializeSRWLock
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseSRWLockShared
AcquireSRWLockShared
MultiByteToWideChar
VerifyVersionInfoW
VerSetConditionMask
SleepEx
PeekNamedPipe
ReleaseMutex
CreateMutexA
FindClose
FindNextFileA
DeviceIoControl
GetCurrentProcess
FindFirstFileA
GetFileAttributesExA
GetFileSizeEx
CreateSemaphoreA
WaitForMultipleObjects
ReleaseSemaphore
GetExitCodeProcess
GetTickCount
GetFileSize
CreateFileA
OpenProcess
TerminateProcess
GetModuleFileNameA
ReadFile
Sleep
CreateTimerQueue
CreateEventA
CloseHandle
SetEvent
GetCurrentDirectoryA
WaitForSingleObject
GetFileType
GetStdHandle
GetEnvironmentVariableA
CompareFileTime
MoveFileExA
InitializeCriticalSectionEx
SetLastError
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
CreateEventW
InitializeCriticalSectionAndSpinCount
OpenEventA
ResetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
AreFileApisANSI
MoveFileExW
CreateDirectoryExW
RemoveDirectoryW
GetFullPathNameW
GetFileTime
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceExW
DeleteFileW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
FindNextFileW
FindFirstFileW
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SleepConditionVariableSRW
WakeAllConditionVariable
GetCurrentProcessId
FormatMessageW
FormatMessageA
LocalFree
GetProcessHeap
HeapFree
HeapAlloc
DeleteTimerQueueEx
CreateTimerQueueTimer
GetSystemTimeAsFileTime
WideCharToMultiByte
DeleteCriticalSection
GetLastError
InitializeCriticalSection
UnmapViewOfFile
LeaveCriticalSection
EnterCriticalSection

user32

PostThreadMessageA

advapi32

SetTokenInformation
OpenTraceA
OpenServiceA
EnableTraceEx2
QueryServiceStatusEx
DuplicateTokenEx
InitializeSecurityDescriptor
OpenProcessToken
StartServiceA
ControlService
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
CreateServiceA
SetSecurityDescriptorDacl
AdjustTokenPrivileges
CreateProcessAsUserA
ControlTraceA
RegGetValueA
ProcessTrace
CloseTrace
CloseServiceHandle
DeleteService
LookupPrivilegeValueA
SetServiceStatus
StartTraceA
OpenSCManagerA
GetTokenInformation

shell32

ShellExecuteA

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@DD@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?length@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1_K@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?clear@ios_base@std@@QEAAXH_N@Z
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?id@?$numpunct@_W@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?classic@locale@std@@SAAEBV12@XZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
_Mbrtowc
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?exceptions@ios_base@std@@QEAAXH@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?narrow@?$ctype@D@std@@QEBADDD@Z
?widen@?$ctype@D@std@@QEBADD@Z
??Bid@locale@std@@QEAA_KXZ

ws2_32

WSAWaitForMultipleEvents
WSASetLastError
setsockopt
WSAIoctl
accept
bind
recvfrom
htonl
listen
recv
getaddrinfo
freeaddrinfo
sendto
WSAResetEvent
WSACleanup
closesocket
select
WSAEventSelect
WSAStartup
WSAEnumNetworkEvents
socket
connect
getsockopt
inet_ntop
htons
ioctlsocket
WSAGetLastError
WSACreateEvent
WSACloseEvent
inet_pton
send
ntohs
__WSAFDIsSet
getpeername
gethostname
getsockname

tdh

TdhGetProperty
TdhGetEventMapInformation
TdhGetEventInformation
TdhGetPropertySize
TdhFormatProperty

shlwapi

StrStrA

libcrypto-1_1-x64

MD5
SHA256
OPENSSL_sk_num
OPENSSL_sk_value
OPENSSL_sk_pop_free
OPENSSL_sk_pop
OpenSSL_version_num
CRYPTO_malloc
CRYPTO_free
BIO_set_flags
BIO_clear_flags
BIO_s_file
BIO_new
BIO_free
BIO_set_data
BIO_get_data
BIO_set_init
BIO_set_shutdown
BIO_get_shutdown
BIO_puts
BIO_ctrl
SHA1
BIO_new_mem_buf
BIO_printf
BIO_meth_new
BIO_meth_free
BIO_meth_set_write
BIO_meth_set_read
BIO_meth_set_ctrl
BIO_meth_set_create
BIO_meth_set_destroy
BN_num_bits
BN_print
ASN1_STRING_length
ASN1_STRING_type
ASN1_STRING_get0_data
i2a_ASN1_OBJECT
i2t_ASN1_OBJECT
ASN1_STRING_to_UTF8
ASN1_TIME_print
ASN1_STRING_print
EVP_MD_CTX_new
EVP_MD_CTX_free
EVP_DigestUpdate
EVP_DigestFinal_ex
EVP_DigestInit
EVP_sha1
EVP_sha256
EVP_PKEY_id
EVP_PKEY_get0_RSA
EVP_PKEY_get1_RSA
EVP_PKEY_get0_DSA
EVP_PKEY_get0_DH
EVP_PKEY_free
EVP_PKEY_copy_parameters
RSA_get0_key
RSA_free
RSA_flags
DH_get0_pqg
DH_get0_key
DSA_get0_pqg
DSA_get0_key
X509_STORE_free
X509_STORE_up_ref
X509_STORE_set_flags
X509_STORE_add_lookup
BIO_s_mem
X509_STORE_add_cert
X509_STORE_add_crl
X509_load_crl_file
X509_STORE_load_locations
X509_verify_cert_error_string
d2i_X509_bio
d2i_PrivateKey_bio
X509_ALGOR_get0
i2d_X509_PUBKEY
X509_free
d2i_X509
X509_get0_signature
X509_INFO_free
X509_get_version
X509_get_serialNumber
X509_get_issuer_name
X509_get_subject_name
X509_get0_notBefore
X509_get0_notAfter
X509_get_X509_PUBKEY
X509_get0_extensions
X509_get_pubkey
X509_NAME_print_ex
X509_NAME_get_index_by_NID
X509_NAME_get_entry
X509_NAME_ENTRY_get_data
X509_get_ext_d2i
X509_EXTENSION_get_object
X509_EXTENSION_get_data
X509_PUBKEY_get0_param
PEM_X509_INFO_read_bio
PEM_read_bio_X509
PEM_write_bio_X509
X509_LOOKUP_file
PEM_read_bio_PrivateKey
RAND_bytes
RAND_status
GENERAL_NAMES_free
X509V3_EXT_print
X509_check_issued
ERR_get_error
ERR_peek_error
ERR_peek_last_error
ERR_clear_error
ERR_error_string_n
PKCS12_free
PKCS12_PBE_add
PKCS12_parse
d2i_PKCS12_bio
OCSP_cert_to_id
OCSP_response_status
OCSP_response_get1_basic
OCSP_resp_find_status
OCSP_check_validity
OCSP_BASICRESP_free
OCSP_RESPONSE_free
d2i_OCSP_RESPONSE
OCSP_CERTID_free
OCSP_response_status_str
OCSP_cert_status_str
OCSP_crl_reason_str
OCSP_basic_verify
UI_get0_user_data
UI_OpenSSL
UI_create_method
UI_destroy_method
UI_method_set_opener
UI_method_set_writer
UI_method_set_reader
UI_method_set_closer
UI_method_get_opener
UI_method_get_writer
UI_method_get_reader
UI_method_get_closer
UI_get_string_type
UI_get_input_flags
UI_set_result
ENGINE_get_first
ENGINE_get_next
ENGINE_by_id
ENGINE_ctrl
ENGINE_ctrl_cmd
ENGINE_free
ENGINE_get_id
ENGINE_init
ENGINE_finish
ENGINE_load_private_key
ENGINE_set_default
MD5_Init
MD5_Update
MD5_Final
DES_ecb_encrypt
DES_set_odd_parity
DES_set_key_unchecked
EVP_DigestInit_ex
MD4_Init
MD4_Update
MD4_Final
PEM_read_bio_X509_AUX

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wtsapi32

WTSEnumerateSessionsA
WTSFreeMemoryExW
WTSFreeMemory
WTSEnumerateProcessesA
WTSEnumerateProcessesExW

wldap32

ord35
ord33
ord32
ord27
ord26
ord22
ord30
ord50
ord45
ord60
ord211
ord46
ord217
ord143
ord200
ord79
ord41
ord301

crypt32

CertCloseStore
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore

normaliz

IdnToAscii
IdnToUnicode

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_name
__std_exception_destroy
strstr
memset
__std_exception_copy
__std_type_info_compare
__current_exception
_purecall
__current_exception_context
strchr
memcmp
memchr
strrchr
__C_specific_handler
__std_terminate
_CxxThrowException
memmove
memcpy

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh
_set_new_mode
calloc
realloc

api-ms-win-crt-runtime-l1-1-0

__p___argc
_exit
_initterm_e
_invalid_parameter_noinfo
_initterm
_get_initial_narrow_environment
__p___argv
_set_app_type
_seh_filter_exe
_cexit
_register_thread_local_exe_atexit_callback
_errno
_beginthreadex
terminate
__sys_errlist
strerror
system
__sys_nerr
exit
_crt_atexit
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_c_exit

api-ms-win-crt-convert-l1-1-0

strtoul
strtoll
strtol
atoi
strtoull
strtod
wcstombs

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

api-ms-win-crt-stdio-l1-1-0

setvbuf
ungetc
fsetpos
fputc
fgetpos
fgetc
fflush
fgets
_lseeki64
_fseeki64
_get_stream_buffer_pointers
_open
fopen
__stdio_common_vsscanf
ftell
feof
fputs
__p__commode
fseek
_read
fopen_s
fwrite
_write
__stdio_common_vfprintf
_fileno
fclose
_close
_set_fmode
__acrt_iob_func
__stdio_common_vsprintf
fread

api-ms-win-crt-math-l1-1-0

_dsign
_fdopen
_dclass
__setusermatherr

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s
_lock_file
_stat64
_access
_unlock_file
_unlink
_fstat64

api-ms-win-crt-multibyte-l1-1-0

_mbsstr
_mbsncpy_s
_mbsrchr
_mbscmp

api-ms-win-crt-string-l1-1-0

_wcsicmp
tolower
strcspn
strcpy_s
strnlen
strncpy
_stricmp
strpbrk
strspn
strcat_s
strcmp
_strdup
iswdigit
strncmp

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64
_time64
_localtime64

api-ms-win-crt-utility-l1-1-0

qsort

bcrypt

BCryptGenRandom

libssl-1_1-x64

SSL_CTX_sess_set_new_cb
SSL_CTX_set_alpn_protos
SSL_get0_alpn_selected
SSL_CTX_set_keylog_callback
SSL_CTX_set_cipher_list
SSL_CTX_new
SSL_CTX_free
SSL_CTX_get_cert_store
SSL_CTX_set_cert_store
SSL_get_current_cipher
SSL_CIPHER_get_name
SSL_pending
SSL_set_bio
SSL_CTX_set_ciphersuites
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_CTX_use_certificate_chain_file
SSL_SESSION_free
SSL_set_session
SSL_get_peer_certificate
SSL_get_peer_cert_chain
SSL_CTX_set_verify
SSL_CTX_use_PrivateKey
SSL_CTX_use_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
SSL_new
SSL_free
SSL_connect
SSL_read
SSL_write
SSL_ctrl
SSL_CTX_ctrl
SSL_get_error
SSL_get_version
TLS_client_method
SSL_shutdown
SSL_CTX_set_post_handshake_auth
SSL_alert_desc_string_long
SSL_CTX_add_client_CA
SSL_set_connect_state
SSL_get_certificate
SSL_get_privatekey
SSL_get_shutdown
SSL_get_verify_result
SSL_set_ex_data
SSL_get_ex_data
OPENSSL_init_ssl
SSL_CTX_set_msg_callback
SSL_CTX_set_options

Sections

.text
Size: 916KB - Virtual size: 915KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 233KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b7bb2c79ab738f62b5387d0c6adecba

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140

ws2_32

tdh

shlwapi

libcrypto-1_1-x64

version

userenv

wtsapi32

wldap32

crypt32

normaliz

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

bcrypt

libssl-1_1-x64

Sections

.text Size: 916KB - Virtual size: 915KB

.rdata Size: 233KB - Virtual size: 232KB

.data Size: 22KB - Virtual size: 25KB

.pdata Size: 38KB - Virtual size: 38KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 916KB - Virtual size: 915KB

.rdata
Size: 233KB - Virtual size: 232KB

.data
Size: 22KB - Virtual size: 25KB

.pdata
Size: 38KB - Virtual size: 38KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB