NEAS[.]a297a8d9ad37be01b837a4558f5def90[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.a297a8d9ad37be01b837a4558f5def90.exe
Size

5.2MB
MD5

a297a8d9ad37be01b837a4558f5def90
SHA1

73f2b8785f971bd4621f45ac4d3bb0254545e8fa
SHA256

c79408d3f8b6283803fdf0347ffa29aaf8a79b380c565376097491078cce386a
SHA512

872c0e28ef3d67e54d99b4628f889a217a29d333da62311a01c4153b12454d74866ecc1f1358c6cee2da352a7074de9072deb18ca1329eb97b10fec71b5244e2
SSDEEP

49152:2g4aaflY7iet2PTmmX2ur9EhW8bp5KQsBmUESoeQ+9dXCEetI7YGzxcG14tr+/PZ:bulucGaQomCXE5GzqGHzktITMdcf

Score

1^/10

Malware Config

Signatures

Files

NEAS.a297a8d9ad37be01b837a4558f5def90.exe
.dll windows:6 windows x64

34058eceec7b36153a4007eeca525565

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-03-2023 18:43

Not After

14-03-2024 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:90:df:4c:58:59:77:c0:2a:4f:63:b3:c5:ce:e5:be:49:b8:bf:0d:74:e6:30:9e:fe:d7:6b:68:e2:0b:cb:08
Signer

Actual PE Digest

b3:90:df:4c:58:59:77:c0:2a:4f:63:b3:c5:ce:e5:be:49:b8:bf:0d:74:e6:30:9e:fe:d7:6b:68:e2:0b:cb:08

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

boost_program_options-vc143-mt-x64-1_82

?count@?$_Tree@V?$_Tmap_traits@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Vvariable_value@program_options@boost@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Vvariable_value@program_options@boost@@@std@@@2@$0A@@std@@@std@@QEBA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
??Aabstract_variables_map@program_options@boost@@QEBAAEBVvariable_value@12@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

cpprest_2_10

?to_base64@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$vector@EV?$allocator@E@std@@@4@@Z

boost_json-vc143-mt-x64-1_82

??4value@json@boost@@QEAAAEAV012@PEBD@Z
??4value@json@boost@@QEAAAEAV012@AEBVarray@12@@Z
??4value@json@boost@@QEAAAEAV012@AEBVobject@12@@Z
?destroy@value@json@boost@@AEAA?AVstorage_ptr@23@XZ
?serialize@json@boost@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVvalue@12@@Z
??4value@json@boost@@QEAAAEAV012@V?$basic_string_view@D@core@2@@Z
?empty_@object@json@boost@@0Utable@123@A
??0value@json@boost@@QEAA@$$QEAV012@@Z
?parse@json@boost@@YA?AVvalue@12@V?$basic_string_view@D@core@2@Vstorage_ptr@12@AEBUparse_options@12@@Z
??0value@json@boost@@QEAA@V?$initializer_list@Vvalue_ref@json@boost@@@std@@Vstorage_ptr@12@@Z
??Aobject@json@boost@@QEAAAEAVvalue@12@V?$basic_string_view@D@core@2@@Z
??0object@json@boost@@QEAA@$$QEAV012@@Z
??1object@json@boost@@QEAA@XZ
?push_back@array@json@boost@@QEAAX$$QEAVvalue@23@@Z
??1array@json@boost@@QEAA@XZ
??0value@json@boost@@QEAA@AEBV012@Vstorage_ptr@12@@Z
??1value@json@boost@@QEAA@XZ
?throw_out_of_range@detail@json@boost@@YAXAEBUsource_location@3@@Z
?throw_invalid_argument@detail@json@boost@@YAXPEBDAEBUsource_location@3@@Z
?empty_@array@json@boost@@0Utable@123@A

olknh

?LogServiceTypeMismatch@Services@NativeHost@Microsoft@@YAXV?$basic_string_view@DU?$char_traits@D@std@@@std@@@Z
?Registrar@NativeHost@Microsoft@@YA?AV?$shared_ptr@UIServicesRegistrar@NativeHost@Microsoft@@@std@@XZ
?IsFlightEnabled@details@NativeHost@Microsoft@@YA_NV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?SetUserSettings@NativeHost@Microsoft@@YAXV?$weak_ptr@VPersistentStorage@NativeHost@Microsoft@@@std@@@Z
?GetTasksService@NativeHost@Microsoft@@YA?AV?$shared_ptr@UITasksService@NativeHost@Microsoft@@@std@@XZ
?GetUserSettings@UserSettings@NativeHost@Microsoft@@YA?AV?$shared_ptr@VPersistentStorage@NativeHost@Microsoft@@@std@@XZ
?CreateZipFile@NativeHost@Microsoft@@YA_NV?$span@$$CBVpath@filesystem@std@@$0?0@std@@AEBVpath@filesystem@4@@Z
?GetLocalAppDataDirectoryPath@NativeHost@Microsoft@@YA?AVpath@filesystem@std@@XZ
?IsDirectory@NativeHost@Microsoft@@YA_NAEBVpath@filesystem@std@@_K@Z
?EnsureDirectoryExists@NativeHost@Microsoft@@YAXAEBVpath@filesystem@std@@@Z
?GetUserDataBaseDirectoryPath@NativeHost@Microsoft@@YA?AVpath@filesystem@std@@XZ
?LogServicesRegistrarMissing@Services@NativeHost@Microsoft@@YAXXZ
?DeleteFilesystemObject@NativeHost@Microsoft@@YAXAEBVpath@filesystem@std@@@Z
?Log@NativeHost@Microsoft@@YAXAEBUILogEvent@Logging@12@@Z

nh

??0CheckFailureContext@ErrorChecks@NativeHost@Microsoft@@QEAA@V?$basic_string_view@DU?$char_traits@D@std@@@std@@00IUsource_location@5@@Z
??1CheckFailureContext@ErrorChecks@NativeHost@Microsoft@@QEAA@XZ
??0CheckFailureException@NativeHost@Microsoft@@QEAA@AEBUCheckFailureContext@ErrorChecks@12@@Z
?what@CheckFailureException@NativeHost@Microsoft@@UEBAPEBDXZ
?ToWString@NativeHost@Microsoft@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$basic_string_view@DU?$char_traits@D@std@@@4@@Z
?StringToHexString@NativeHost@Microsoft@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$basic_string_view@_WU?$char_traits@_W@std@@@4@@Z
?ToString@NativeHost@Microsoft@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$basic_string_view@_WU?$char_traits@_W@std@@@4@@Z
?AppSettingsRegistrar@NativeHost@Microsoft@@YA?AV?$shared_ptr@UIAppSettingsRegistrar@NativeHost@Microsoft@@@std@@XZ
?ReportCheckFailedMessage@ErrorChecks@NativeHost@Microsoft@@YAXAEBUCheckFailureContext@123@@Z
?LogCheckFailedMessage@ErrorChecks@NativeHost@Microsoft@@YAXAEBUCheckFailureContext@123@V?$optional@H@std@@@Z
??0ArgumentException@NativeHost@Microsoft@@QEAA@AEBUCheckFailureContext@ErrorChecks@12@@Z

bcrypt

BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptDestroyHash
BCryptDestroyKey
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptDecrypt

kernel32

ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
InitializeCriticalSectionAndSpinCount
InitOnceComplete
InitOnceBeginInitialize
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
FormatMessageA
FindFirstFileExW
EncodePointer
GetFinalPathNameByHandleW
DisableThreadLibraryCalls
InterlockedPopEntrySList
InterlockedPushEntrySList
IsDebuggerPresent
DebugBreak
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
FileTimeToSystemTime
SystemTimeToFileTime
LocalFree
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileSize
GetFileTime
ReadFile
SetEndOfFile
WriteFile
Sleep
MulDiv
DecodePointer
InitializeCriticalSectionEx
DeleteCriticalSection
lstrcmpiW
GetModuleFileNameW
SetEvent
CreateEventW
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
RaiseException
GlobalAlloc
GlobalUnlock
GlobalLock
lstrcmpW
CreateMutexW
ResetEvent
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
LoadLibraryW
TrySubmitThreadpoolCallback
FreeLibrary
GetFileAttributesExW

user32

ClientToScreen
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
RedrawWindow
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
DestroyAcceleratorTable
CreateAcceleratorTableW
ReleaseCapture
SetCapture
GetFocus
GetWindowLongW
CharNextW
GetDlgItem
MoveWindow
IsChild
RegisterWindowMessageW
GetClassInfoExW
CallWindowProcW
PostThreadMessageW
GetForegroundWindow
CharLowerW
GetAsyncKeyState
GetSysColor
GetWindowThreadProcessId
GetWindowRect
IsWindowVisible
LoadCursorW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
EnumWindows
GetDesktopWindow
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
SetForegroundWindow
EnableWindow
KillTimer
SetTimer
SetWindowPos
UnregisterClassW
RegisterClassW
PostMessageW
SendMessageW
IsGUIThread
IsWindow
GetActiveWindow
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
ScreenToClient
GetWindow
FillRect
SetWindowLongW
GetParent
GetClassNameW
SetFocus

gdi32

DeleteObject
DeleteDC
GetStockObject
SelectObject
GetObjectW
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
BitBlt

shell32

ShellExecuteA
ShellExecuteExW
SHGetKnownFolderPath

ole32

CoCreateInstance
OleSetContainedObject
CoUninitialize
CoGetObjectContext
CoCreateFreeThreadedMarshaler
OleLockRunning
OleUninitialize
OleInitialize
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CreateStreamOnHGlobal
CoReleaseServerProcess
CoAddRefServerProcess
CoTaskMemFree
CoGetApartmentType
CoInitializeEx

oleaut32

GetErrorInfo
OleCreateFontIndirect
SysAllocStringLen
DispCallFunc
LoadRegTypeLi
LoadTypeLi
SafeArrayCreateVector
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayDestroy
SysStringLen
VariantChangeType
VariantClear
VariantInit
SysFreeString
SysAllocString
SetErrorInfo

advapi32

CredFree
CredWriteW
CredDeleteW
RegGetValueW
RegCloseKey
RegOpenKeyExA
RegGetValueA
RegOpenCurrentUser
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
CredEnumerateW

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??Bios_base@std@@QEBA_NXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??7ios_base@std@@QEBA_NXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?id@?$collate@_W@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
_Unlock_shared_ptr_spin_lock
?setf@ios_base@std@@QEAAHHH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?id@?$numpunct@D@std@@2V0locale@2@A
_Lock_shared_ptr_spin_lock
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?exceptions@ios_base@std@@QEBAHXZ
?exceptions@ios_base@std@@QEAAXH@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Wcsxfrm
_Wcscoll
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Cnd_timedwait
_Mtx_current_owns
_Thrd_id
_Thrd_yield
_Thrd_join
_Thrd_detach
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?uncaught_exceptions@std@@YAHXZ
?_Xout_of_range@std@@YAXPEBD@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_destroy_in_situ
?_Throw_C_error@std@@YAXH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?setf@ios_base@std@@QEAAHH@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_J@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
_Thrd_sleep
_Cnd_init_in_situ
_Cnd_wait
_Cnd_signal
?_Winerror_map@std@@YAHH@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?toupper@?$ctype@_W@std@@QEBA_W_W@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Cnd_broadcast
_Cnd_register_at_thread_exit
_Cnd_unregister_at_thread_exit
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?uncaught_exception@std@@YA_NXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ

secur32

GetUserNameExA
GetUserNameExW

version

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoW

crypt32

CertCloseStore
CryptAcquireCertificatePrivateKey
CertFreeCertificateContext
CertCreateSelfSignCertificate
CertFindCertificateInStore
CertOpenStore
CryptUnprotectData
CryptProtectData
CertStrToNameW

ncrypt

NCryptOpenStorageProvider
NCryptCreatePersistedKey
NCryptSetProperty
NCryptFinalizeKey
NCryptFreeObject
NCryptOpenKey
NCryptGetProperty
NCryptExportKey
NCryptSignHash
NCryptDeleteKey
NCryptDecrypt

rpcrt4

UuidCreate

shlwapi

UrlUnescapeA

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memchr
strchr
memcmp
__std_type_info_name
memset
memmove
__current_exception
memcpy
__RTDynamicCast
__current_exception_context
_CxxThrowException
__std_type_info_compare
__std_exception_destroy
_purecall
__std_exception_copy
__std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_cexit
_initterm
_initterm_e
_execute_onexit_table
_register_onexit_function
_invalid_parameter_noinfo
_initialize_onexit_table
_errno
_beginthreadex
abort
_initialize_narrow_environment
terminate
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_seh_filter_dll

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s
__stdio_common_vswprintf
__stdio_common_vswprintf_s
_get_stream_buffer_pointers
fclose
fflush
fgetc
fgetpos
fputc
fread
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
__stdio_common_vsprintf_s
__stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

_callnewh
free
_recalloc
calloc
malloc
realloc

api-ms-win-crt-math-l1-1-0

_dsign
_dclass
_ldclass
ceilf
_fdclass

api-ms-win-crt-convert-l1-1-0

atoi
strtoul
_strtoui64
strtoull
strtod
strtoll
strtol
wcstol

api-ms-win-crt-time-l1-1-0

_gmtime64_s

api-ms-win-crt-string-l1-1-0

isblank
isalnum
tolower
isdigit
isspace
isxdigit
strnlen
toupper
iswspace

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file

api-ms-win-crt-locale-l1-1-0

localeconv
___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

wininet

HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetSetStatusCallbackW
InternetOpenA
InternetConnectA
HttpQueryInfoW
InternetSetOptionW
InternetReadFile
InternetCloseHandle

Exports

Exports

TryMakeNativeHostModule

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 350KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34058eceec7b36153a4007eeca525565

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

b3:90:df:4c:58:59:77:c0:2a:4f:63:b3:c5:ce:e5:be:49:b8:bf:0d:74:e6:30:9e:fe:d7:6b:68:e2:0b:cb:08Signer

Headers

DLL Characteristics

File Characteristics

Imports

boost_program_options-vc143-mt-x64-1_82

cpprest_2_10

boost_json-vc143-mt-x64-1_82

olknh

nh

bcrypt

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

msvcp140

secur32

version

crypt32

ncrypt

rpcrt4

shlwapi

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

wininet

Exports

Exports

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 350KB - Virtual size: 362KB

.pdata Size: 185KB - Virtual size: 184KB

.msvcjmc Size: 29KB - Virtual size: 28KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 36KB - Virtual size: 36KB

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

b3:90:df:4c:58:59:77:c0:2a:4f:63:b3:c5:ce:e5:be:49:b8:bf:0d:74:e6:30:9e:fe:d7:6b:68:e2:0b:cb:08
Signer

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 350KB - Virtual size: 362KB

.pdata
Size: 185KB - Virtual size: 184KB

.msvcjmc
Size: 29KB - Virtual size: 28KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 36KB - Virtual size: 36KB