HorizonZeroDawn[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

HorizonZeroDawn.exe
Size

44.6MB
MD5

36adf310ea80406358414299f80e4d24
SHA1

9dd108553c39640f1e611cc6f4a0d21b9409575f
SHA256

e1002a537bdfc41b61d24c3256ebc2a5e4b2993779fe68cd9f3ce49d7ea9ce21
SHA512

cd725593cb25a53daafca745bb90c8e79c2f59ba4efe174983ab9235ffc2786e7d82b89dd622010518c5b7584946925479de4588be55b62bfb2388ed855b6a6f
SSDEEP

393216:zwkHaYrwnfYLKrIAgdS4NtfWPsltLqOvGwdECTQ19IQWCYxyF9z5XEWsMTpOxk:zwXc4GcsRvlWsJJyF9tXEjMd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HorizonZeroDawn.exe

Files

HorizonZeroDawn.exe
.exe windows:6 windows x64

d1544107af4072a271e1a38c0066d342

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

InitializeConditionVariable
WakeAllConditionVariable
WaitForSingleObjectEx
WideCharToMultiByte
GetCurrentThreadId
SetEvent
CreateEventExA
SetHandleInformation
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
GetActiveProcessorCount
GetCurrentThread
SleepConditionVariableSRW
DuplicateHandle
GetCurrentProcess
SetThreadPriority
SetThreadAffinityMask
SetThreadGroupAffinity
ResumeThread
SwitchToThread
GetLogicalProcessorInformationEx
GetUserDefaultLocaleName
FlushFileBuffers
CreateNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
CreateFileMappingA
GetCurrentDirectoryA
GetCommandLineW
GetModuleHandleExA
GetComputerNameA
GetComputerNameExA
IsDebuggerPresent
SetUnhandledExceptionFilter
SetThreadExecutionState
VirtualQueryEx
CreateToolhelp32Snapshot
Process32Next
Process32First
GlobalAlloc
GlobalFree
MultiByteToWideChar
RtlCaptureStackBackTrace
SetCurrentDirectoryA
LoadLibraryExA
GetVersionExA
ExpandEnvironmentStringsA
CreateProcessA
TerminateThread
GetExitCodeProcess
SetNamedPipeHandleState
CreatePipe
MapViewOfFile
SetConsoleTitleA
TlsAlloc
TlsSetValue
TlsFree
DebugBreak
LocalFree
GetPhysicallyInstalledSystemMemory
TlsGetValue
LoadLibraryW
GetFileSize
GetProcessTimes
OpenThread
GetThreadTimes
GetSystemTimes
GlobalMemoryStatusEx
K32GetProcessMemoryInfo
GetLogicalDrives
GetThreadPriority
ExitThread
GetExitCodeThread
FileTimeToSystemTime
GetStdHandle
OutputDebugStringW
SetConsoleTextAttribute
EnumResourceNamesA
GetProcessAffinityMask
GetTimeFormatA
GetDateFormatA
GlobalUnlock
GlobalLock
FreeResource
CreateWaitableTimerW
EnumResourceTypesA
FindResourceA
SizeofResource
LockResource
LoadResource
GetModuleHandleA
CreateSemaphoreA
ReleaseSemaphore
ReleaseMutex
CreateMutexA
CreateThread
WaitForSingleObject
SleepEx
Sleep
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileExW
FindFirstFileW
ExpandEnvironmentStringsW
GetDiskFreeSpaceA
SetFileAttributesW
GetFileAttributesW
GetFileAttributesA
GetFullPathNameW
GetFullPathNameA
GetLongPathNameA
GetCurrentDirectoryW
RemoveDirectoryW
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleHandleExW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
OpenFile
CreateWaitableTimerA
CancelWaitableTimer
SetWaitableTimer
GetThreadId
GetLogicalProcessorInformation
SleepConditionVariableCS
VerifyVersionInfoA
lstrcmpW
GetLocalTime
InitializeCriticalSectionAndSpinCount
MoveFileExW
GetNamedPipeInfo
GetFileSizeEx
WaitNamedPipeW
CreateNamedPipeW
TransactNamedPipe
ReadProcessMemory
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
GetVersion
FlushInstructionCache
CreateEventW
GetFileType
CreateSemaphoreW
CreateMutexW
VirtualUnlock
GetLargePageMinimum
VirtualProtect
FlsSetValue
FlsAlloc
VerifyVersionInfoW
lstrcmpA
LocalAlloc
LoadLibraryExW
GetModuleHandleW
GetSystemDirectoryW
CreateProcessW
CompareFileTime
VerSetConditionMask
ReadDirectoryChangesW
QueryDosDeviceA
GetCommandLineA
CreateDirectoryW
CopyFileW
PulseEvent
GetDriveTypeA
MoveFileW
DeleteFileW
SetFileTime
SetFilePointer
SetEndOfFile
ReadFile
WriteFile
CreateFileW
CreateFileA
ResetEvent
CreateEventA
GetOverlappedResult
GetTimeZoneInformation
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
LoadLibraryA
GetProcAddress
FreeLibrary
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeSRWLock
GlobalMemoryStatus
VirtualQuery
GetSystemInfo
GetTickCount
FormatMessageA
VirtualFree
VirtualAlloc
LeaveCriticalSection
TryEnterCriticalSection
EnterCriticalSection
InitializeCriticalSection
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
TerminateProcess
OpenProcess
GetCurrentProcessId
CloseHandle
GetModuleFileNameA
SignalObjectAndWait

user32

GetMessageA
TranslateMessage
DispatchMessageA
PeekMessageA
MonitorFromWindow
GetMonitorInfoA
GetDoubleClickTime
MapVirtualKeyA
GetKeyState
ClipCursor
PostThreadMessageA
GetKeyboardLayout
RegisterRawInputDevices
GetRawInputData
SetWindowsHookExA
UnhookWindowsHookEx
EnumDisplayMonitors
UnregisterClassA
EnumDisplaySettingsA
SetCursorPos
GetCursorPos
MessageBoxW
MessageBoxA
CallWindowProcA
GetWindowRect
SetProcessDpiAwarenessContext
InflateRect
PtInRect
LoadImageA
GetClassInfoA
IsWindow
BeginDeferWindowPos
CallNextHookEx
GetSystemMetrics
SetCapture
ReleaseCapture
LoadIconA
ScreenToClient
BeginPaint
EndPaint
FillRect
PostQuitMessage
CreateWindowExA
WindowFromPoint
SetForegroundWindow
RegisterClassA
SetWindowPos
SetWindowTextA
AdjustWindowRectEx
SystemParametersInfoA
IsWindowVisible
PostMessageA
MoveWindow
OpenClipboard
CloseClipboard
CountClipboardFormats
EmptyClipboard
GetScrollRange
GetWindowLongPtrA
GetDlgItem
SendMessageA
SetActiveWindow
BringWindowToTop
GetActiveWindow
GetLastActivePopup
GetDesktopWindow
GetClassNameA
GetWindowLongA
SetFocus
RegisterClassExA
GetDlgCtrlID
GetFocus
GetAsyncKeyState
EnableWindow
UpdateWindow
InvalidateRect
GetWindow
IsDialogMessageA
DialogBoxIndirectParamA
EndDialog
SendDlgItemMessageA
DeferWindowPos
EndDeferWindowPos
ReleaseDC
OffsetRect
IsRectEmpty
EqualRect
EnumChildWindows
DestroyCursor
LoadBitmapW
GetDC
RedrawWindow
SetRect
DrawEdge
ShowScrollBar
UnionRect
FrameRect
CreatePopupMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuA
AppendMenuA
RemoveMenu
GetMenuItemInfoA
GetTopWindow
GetWindowPlacement
SetWindowLongPtrA
ShowCursor
LoadCursorA
SetCursor
GetClientRect
FlashWindowEx
ClientToScreen
ShowWindow
IsIconic
DefWindowProcA
GetForegroundWindow
GetSysColor
DestroyWindow
EnumDisplayDevicesA
GetWindowDC
GetCapture
CharLowerBuffA
GetParent

gdi32

SetPixelV
GetTextColor
CreateCompatibleBitmap
FillRgn
CombineRgn
StretchBlt
CreateSolidBrush
CreateRectRgn
GetTextExtentPoint32A
GetObjectA
StretchDIBits
SetDIBitsToDevice
CreateCompatibleDC
CreateFontIndirectA
DeleteDC
DeleteObject
GetGlyphOutlineA
GetGlyphOutlineW
GetGlyphIndicesW
AddFontMemResourceEx
PatBlt
CreatePolyPolygonRgn
RemoveFontMemResourceEx
SelectObject
Polyline
GetStockObject
BitBlt
CreateBitmapIndirect
CreateDIBitmap
CreatePen
GetBitmapBits
GetDIBits
GetPixel
Rectangle
SetBitmapBits
Polygon
SetDIBits

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

advapi32

SystemFunction036
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildExplicitAccessWithNameW
BuildSecurityDescriptorW
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
ReportEventA
RegisterEventSourceA
DeregisterEventSource
GetUserNameW
RegOpenKeyA
CredFree
CredWriteA
CredReadA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExA
RegSetValueExA
GetUserNameA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegEnumKeyA

shell32

SHGetFolderPathA
ShellExecuteA
SHCreateDirectoryExA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderPathW
SHBrowseForFolderA

ole32

CoInitializeEx
OleUninitialize
OleInitialize
CoSetProxyBlanket
CoQueryProxyBlanket
CoUninitialize
CoInitialize
OleSetContainedObject
OleCreate
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
PropVariantClear
CoCreateGuid
CLSIDFromString

oleaut32

SysStringLen
SafeArrayDestroy
SafeArrayAccessData
VariantInit
SysAllocString
SafeArrayCreate
SysFreeString
VariantClear

iphlpapi

GetNetworkParams
GetAdaptersAddresses
GetUdpStatistics
GetAdaptersInfo

shlwapi

ord219

dbghelp

MiniDumpWriteDump

d3d12

ord102
ord101
D3D12SerializeRootSignature

dxgi

CreateDXGIFactory1
CreateDXGIFactory
CreateDXGIFactory2

gdiplus

GdipAlloc
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenDashStyle
GdipSetPenDashArray
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipCreateBitmapFromGraphics
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawLinesI
GdipDrawRectangle
GdipFillRectangle
GdipDrawImageI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipDrawString
GdipCreateRegion
GdipDeleteRegion
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetDC
GdipReleaseDC
GdipDrawRectangleI
GdipSetClipRectI
GdipSetClipRegion
GdipGetClip
GdipSetSolidFillColor
GdipGetImageWidth
GdipGetImageHeight
GdipFillRectangleI
GdipFillPolygonI
GdipFree

winmm

timeEndPeriod
timeSetEvent
timeKillEvent
waveOutGetNumDevs
waveOutGetDevCapsA
waveOutGetErrorTextA
timeGetTime
waveOutClose
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
waveOutPause
waveOutRestart
waveOutReset
waveOutGetPosition
waveOutMessage
waveInGetNumDevs
waveInGetDevCapsA
waveInGetErrorTextA
waveInOpen
waveInClose
waveInPrepareHeader
waveInUnprepareHeader
waveInAddBuffer
timeGetDevCaps
timeBeginPeriod
waveInStart
waveInReset
waveInMessage
waveOutOpen

winhttp

WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpSetTimeouts
WinHttpConnect
WinHttpReceiveResponse
WinHttpOpen
WinHttpSetStatusCallback
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpCloseHandle

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoUninitialize
RoInitialize

ws2_32

inet_ntop
inet_pton
freeaddrinfo
getaddrinfo
gethostname
WSASetLastError
gethostbyaddr
gethostbyname
__WSAFDIsSet
accept
bind
closesocket
connect
ioctlsocket
getpeername
getsockname
getsockopt
htonl
listen
recv
select
setsockopt
shutdown
socket
WSAStartup
WSACleanup
WSAGetLastError
WSAIoctl
WSARecv
WSARecvFrom
WSASend
WSASendTo
htons
WSASocketW
inet_addr
inet_ntoa
recvfrom
send
sendto
ntohl
ntohs

api-ms-win-core-versionansi-l1-1-0

VerQueryValueA

api-ms-win-core-errorhandling-l1-1-0

SetLastError

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA
GetEnvironmentVariableW

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetSystemTime
GetWindowsDirectoryA

api-ms-win-core-registry-l1-1-0

RegDeleteValueA
RegQueryValueExW
RegSetValueExW

api-ms-win-core-console-l1-1-0

GetConsoleCP
GetConsoleMode
SetConsoleMode

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-localization-l1-2-0

GetACP
FormatMessageW

api-ms-win-core-file-l1-1-0

SetFileAttributesA
GetLongPathNameW
GetFileTime
GetFileInformationByHandle
FindFirstFileA
RemoveDirectoryA
UnlockFileEx
LockFileEx
SetFilePointerEx

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime

comctl32

ord17

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?_Xout_of_range@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Xbad_alloc@std@@YAXXZ
_Mbrtowc
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
??_7ios_base@std@@6B@
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@

mfc140

ord2917
ord8788
ord4086
ord3157
ord6565
ord13784
ord8432
ord2182
ord2305
ord5225
ord5331
ord6698
ord7153
ord4420
ord2349
ord1409
ord13459
ord3261
ord3147
ord6557
ord7204
ord446
ord3705
ord10075
ord5227
ord1448
ord983
ord8781
ord1504
ord2899
ord1053
ord361
ord1367
ord878
ord1084
ord4021
ord4489
ord4490
ord13479
ord12707
ord12708
ord438
ord2471
ord4710
ord6527
ord2473
ord2207
ord1118
ord2796
ord14146
ord11981
ord12670
ord11594
ord488
ord5547
ord10636
ord8944
ord8773
ord8670
ord10175
ord11375
ord9912
ord9789
ord7431
ord10239
ord11109
ord14070
ord7566
ord5409
ord3944
ord1119
ord489
ord5986
ord6287
ord5731
ord8692
ord10656
ord8779
ord1051
ord4069
ord3051
ord6230
ord10117
ord7364
ord1450
ord12652
ord13876
ord4715
ord6595
ord4711
ord12390
ord5729
ord1686
ord4760
ord4836
ord4821
ord8780
ord8401
ord4070
ord9941
ord4993
ord12952
ord3052
ord6233
ord12913
ord6749
ord5752
ord8785
ord1156
ord7749
ord4075
ord7744
ord13242
ord6322
ord4334
ord4326
ord2264
ord8784
ord1155
ord2687
ord14113
ord12692
ord3740
ord2902
ord8404
ord4074
ord3091
ord6321
ord1421
ord11761
ord5980
ord13327
ord2695
ord8863
ord11802
ord1087
ord8693
ord10657
ord11037
ord3943
ord7519
ord3300
ord3066
ord305
ord5896
ord5982
ord13331
ord3205
ord3202
ord9903
ord7881
ord2696
ord14279
ord9933
ord9935
ord9934
ord9932
ord9936
ord5435
ord11365
ord11366
ord8792
ord11719
ord3710
ord11575
ord14128
ord8618
ord11850
ord6703
ord10644
ord8909
ord3166
ord13438
ord11892
ord11888
ord1695
ord1717
ord1743
ord1729
ord1750
ord4765
ord4832
ord4777
ord4795
ord4789
ord4783
ord4842
ord4826
ord4771
ord4848
ord4803
ord4741
ord4756
ord4817
ord4351
ord5566
ord9343
ord4343
ord2962
ord14136
ord7620
ord14134
ord14047
ord8413
ord6607
ord11357
ord13284
ord5704
ord5224
ord2627
ord11754
ord3804
ord3270
ord13680
ord3271
ord3165
ord11798
ord988
ord3591
ord7430
ord6226
ord3748
ord6299
ord14197
ord12035
ord14144
ord11978
ord4648
ord1507
ord1032
ord316
ord6483
ord2338
ord2342
ord2344
ord8131
ord7363
ord1446
ord8050
ord11877
ord10079
ord12552
ord12490
ord4436
ord7685
ord7989
ord5167
ord10026
ord2437
ord12171
ord12170
ord14135
ord7619
ord14133
ord9049
ord4002
ord3941
ord12571
ord7637
ord2004
ord11615
ord11614
ord14007
ord12160
ord7688
ord14207
ord6100
ord14209
ord6102
ord14208
ord6101
ord981
ord6590
ord3723
ord5687
ord11869
ord7888
ord11881
ord11849
ord5064
ord5347
ord5536
ord9001
ord5323
ord5539
ord5067
ord5213
ord310
ord1674
ord5691
ord6229
ord357
ord6292
ord13689
ord8471
ord13683
ord13135
ord2684
ord2310
ord2217
ord6533
ord3138
ord3258
ord1381
ord5221
ord448
ord6612
ord13493
ord12667
ord13492
ord11544
ord6544
ord886
ord8465
ord8029
ord8009
ord9118
ord7396
ord14114
ord300
ord6340
ord3795
ord4714
ord2477
ord4077
ord8405
ord6237
ord3053
ord8403
ord4072
ord2901
ord3738
ord6264
ord1055
ord7420
ord5211
ord7890
ord9898
ord3299
ord8862
ord5049
ord10144
ord3689

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

imm32

ImmAssociateContext

version

GetFileVersionInfoSizeA
GetFileVersionInfoA

psapi

GetModuleBaseNameA
EnumProcesses
EnumProcessModules

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiSetDeviceInstallParamsA
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW

vcruntime140

_set_purecall_handler
_purecall
strstr
memmove
memcpy
memcmp
strchr
strrchr
__std_terminate
memset
_CxxThrowException
longjmp
memchr
__C_specific_handler
__RTDynamicCast
wcschr
wcsrchr
wcsstr
__CxxFrameHandler3
__current_exception
__current_exception_context
__intrinsic_setjmp
__std_type_info_destroy_list

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

_aligned_free
_msize
calloc
_recalloc
realloc
_aligned_malloc
_aligned_msize
malloc
free
_set_new_mode

api-ms-win-crt-string-l1-1-0

strcmp
strncmp
isdigit
strncpy
strncat
strpbrk
strtok_s
strncat_s
_memccpy
islower
isupper
isalpha
isspace
strcspn
strcoll
strcat_s
strcpy_s
strncpy_s
_wcsnicmp
ispunct
isalnum
iscntrl
isxdigit
_wcsicmp
isprint
toupper
tolower
_stricmp
wcstok
_wcsupr
wcsncpy_s
_strnicmp
wcscpy_s

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_crt_atexit
_initialize_onexit_table
_endthreadex
_beginthreadex
_initialize_narrow_environment
_crt_at_quick_exit
_exit
_cexit
_clearfp
terminate
_seh_filter_exe
abort
_configure_narrow_argv
_seh_filter_dll
signal
_beginthread
_get_narrow_winmain_command_line
_register_onexit_function
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
exit
_endthread
_wassert
_set_app_type
_c_exit
_register_thread_local_exe_atexit_callback
_controlfp
_errno
strerror

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s
_getcwd
_setmode
_write
_read
_open
_lseek
_close
__p__commode
_set_fmode
_setmaxstdio
setbuf
_lseeki64
_wsopen_dispatch
clearerr
ferror
_wopen
fflush
fgets
_wsopen_s
fputs
fputc
__stdio_common_vsprintf
fopen
fwrite
getc
_pclose
ftell
fseek
fread
feof
fclose
fopen_s
_popen
setvbuf
ungetc
__stdio_common_vfscanf
_pipe
_get_osfhandle
_get_stream_buffer_pointers
fgetc
fgetpos
fsetpos
_fseeki64
_wfopen
__stdio_common_vsprintf_s
putchar
_fileno
__stdio_common_vfwprintf_s
__stdio_common_vsprintf_p
__stdio_common_vfprintf_p
__stdio_common_vfprintf_s
__stdio_common_vswscanf
__stdio_common_vswprintf_p
__stdio_common_vswprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__stdio_common_vfwscanf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsscanf
freopen

api-ms-win-crt-math-l1-1-0

_copysignf
log10
asin
sqrtf
log
ldexp
roundf
tanf
sinhf
log10f
coshf
expf
exp
__setusermatherr
_finite
floor
fmod
pow
floorf
powf
ceil
modf
atanf
tan
ceilf
cosf
hypot
fmin
fmax
modff
fmodf
acos
acosf
asinf
atan2f
atan
atan2
cos
sin
sqrt
logf
sinf

api-ms-win-crt-convert-l1-1-0

strtoul
strtod
atof
strtoll
strtoull
strtol
atoi
_strtoi64
_strtod_l
_strtoui64_l
_strtoi64_l

api-ms-win-crt-time-l1-1-0

_mkgmtime64
__tzname
_ctime64
_time64
_gmtime64_s
strftime
_localtime64
_gmtime64
asctime
clock
_mktime64

api-ms-win-crt-multibyte-l1-1-0

_mbctolower
_mbsnbcpy

api-ms-win-crt-utility-l1-1-0

_lfind
qsort
rand
rand_s
abs
bsearch

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_fstat64i32
_umask
_mkdir
_rmdir
_wrmdir
_wmkdir
_findnext64i32
_findfirst64i32
_findclose
_wfindnext64i32
_wfindfirst64i32
_lock_file
_wstat64
_stat64
_fstat64
_unlock_file
rename
_fullpath
_makepath_s
_wrename
_wunlink
_wchmod
_splitpath_s
_unlink
_chmod

api-ms-win-crt-environment-l1-1-0

_putenv
_wgetenv_s
getenv
_wgetcwd

api-ms-win-crt-locale-l1-1-0

localeconv
_create_locale
_configthreadlocale

api-ms-win-crt-conio-l1-1-0

_cputs

hid

HidD_GetHidGuid
HidD_GetSerialNumberString
HidD_GetProductString
HidD_GetManufacturerString
HidD_SetFeature
HidD_GetFeature
HidP_GetCaps
HidP_GetValueCaps
HidD_GetAttributes
HidD_GetPreparsedData
HidD_FreePreparsedData

Exports

Exports

sceAjmBatchCancel
sceAjmBatchErrorDump
sceAjmBatchJobControlBufferRa
sceAjmBatchJobInlineBuffer
sceAjmBatchJobRunBufferRa
sceAjmBatchJobRunSplitBufferRa
sceAjmBatchStartBuffer
sceAjmBatchWait
sceAjmDecMp3ParseFrame
sceAjmFinalize
sceAjmInitialize
sceAjmInstanceCodecType
sceAjmInstanceCreate
sceAjmInstanceDestroy
sceAjmInstanceExtend
sceAjmInstanceSwitch
sceAjmMemoryRegister
sceAjmMemoryUnregister
sceAjmModuleRegister
sceAjmModuleUnregister
sceAjmStrError

Sections

.text
Size: 26.2MB - Virtual size: 26.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8.8MB - Virtual size: 8.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7.0MB - Virtual size: 106.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 729B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CPADinfo
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 623KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1544107af4072a271e1a38c0066d342

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

shlwapi

dbghelp

d3d12

dxgi

gdiplus

winmm

winhttp

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

ws2_32

api-ms-win-core-versionansi-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-timezone-l1-1-0

comctl32

msvcp140

mfc140

wtsapi32

imm32

version

psapi

setupapi

vcruntime140

vcruntime140_1

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-conio-l1-1-0

hid

Exports

Exports

Sections

.text Size: 26.2MB - Virtual size: 26.2MB

.rdata Size: 8.8MB - Virtual size: 8.8MB

.data Size: 7.0MB - Virtual size: 106.1MB

.pdata Size: 1.7MB - Virtual size: 1.7MB

.tls Size: 1024B - Virtual size: 729B

.gfids Size: 1024B - Virtual size: 800B

CPADinfo Size: 512B - Virtual size: 56B

_RDATA Size: 18KB - Virtual size: 17KB

.rsrc Size: 207KB - Virtual size: 207KB

.reloc Size: 623KB - Virtual size: 623KB

.text
Size: 26.2MB - Virtual size: 26.2MB

.rdata
Size: 8.8MB - Virtual size: 8.8MB

.data
Size: 7.0MB - Virtual size: 106.1MB

.pdata
Size: 1.7MB - Virtual size: 1.7MB

.tls
Size: 1024B - Virtual size: 729B

.gfids
Size: 1024B - Virtual size: 800B

CPADinfo
Size: 512B - Virtual size: 56B

_RDATA
Size: 18KB - Virtual size: 17KB

.rsrc
Size: 207KB - Virtual size: 207KB

.reloc
Size: 623KB - Virtual size: 623KB