d960f22ca49f0d9bf28013126e86df425828ee8291fa3a3a6640a7180907a5ad

Sharing

Copy URL Twitter E-mail

General

Target

d960f22ca49f0d9bf28013126e86df425828ee8291fa3a3a6640a7180907a5ad
Size

11.8MB
MD5

2fe66c69b14d4ea0270b728eb5f70c26
SHA1

9202294bbf6549194e41f3247e5984eea0c60bdf
SHA256

d960f22ca49f0d9bf28013126e86df425828ee8291fa3a3a6640a7180907a5ad
SHA512

993865886472e4b1da357cfa06b7d44360f44a64e5ff93d002012d45187f5da28f6afd71b97ef9973b364b4863df1b5bd9c1a4b837ff2d252d4323fa47d24743
SSDEEP

196608:1giEQXsNh9MbDFO13ntgJQWvsyiJcJa/z70wqxcAHXVC9jD9:L3GuDYhntYQWbiCM/epF8/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d960f22ca49f0d9bf28013126e86df425828ee8291fa3a3a6640a7180907a5ad

Files

d960f22ca49f0d9bf28013126e86df425828ee8291fa3a3a6640a7180907a5ad
.dll windows:6 windows x64

c13acdb2999b41e35600fa7247de587b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

itunesgsapro

?getSrpKey@iTunesGsaPro@iTunesGsaAPI@@QEAAHPEAPEADPEAH@Z
??0iTunesGsaPro@iTunesGsaAPI@@QEAA@PEB_W@Z
?buildA2K@iTunesGsaPro@iTunesGsaAPI@@QEAAHPEAPEAD@Z
?buildM1@iTunesGsaPro@iTunesGsaAPI@@QEAAHPEAPEADPEBD11H1HH@Z
?ParseSpd@iTunesGsaPro@iTunesGsaAPI@@QEAAHPEAPEADPEBDK@Z
?gsaFree@iTunesGsaPro@iTunesGsaAPI@@QEAAXPEAX@Z
?getMidAndOtp@iTunesGsaPro@iTunesGsaAPI@@QEAAHPEAPEAEPEAI01@Z
?getCpim@iTunesGsaPro@iTunesGsaAPI@@QEAAHPEADHPEAPEADPEAH2@Z
?getAdiPb@iTunesGsaPro@iTunesGsaAPI@@QEAAHPEADH0HH@Z

plist-2.0

plist_array_append_item
plist_new_dict
plist_to_xml
plist_get_uint_val
plist_new_bool
plist_from_xml
plist_dict_get_item
plist_new_array
plist_dict_set_item
plist_new_data
plist_free
plist_get_data_val
plist_new_uint
plist_from_bin
plist_get_data_ptr
plist_get_string_val
plist_new_string

cpr

?Get@Session@cpr@@QEAA?AVResponse@2@XZ
?Put@Session@cpr@@QEAA?AVResponse@2@XZ
?SetOption@Session@cpr@@QEAAX$$QEAVBody@2@@Z
?urlDecode@util@cpr@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV34@@Z
??RCaseInsensitiveCompare@cpr@@QEBA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
??0Session@cpr@@QEAA@XZ
??1Session@cpr@@QEAA@XZ
?SetOption@Session@cpr@@QEAAXAEBVVerifySsl@2@@Z
?SetOption@Session@cpr@@QEAAXAEBVConnectTimeout@2@@Z
?SetOption@Session@cpr@@QEAAXAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@UCaseInsensitiveCompare@cpr@@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@Z
?SetOption@Session@cpr@@QEAAXAEBVUrl@2@@Z
?Post@Session@cpr@@QEAA?AVResponse@2@XZ

libprotobuf

?WriteBoolToArray@WireFormatLite@internal@protobuf@google@@SAPEAEH_NPEAE@Z
?WriteEnumToArray@WireFormatLite@internal@protobuf@google@@SAPEAEHHPEAE@Z
?Int32Size@WireFormatLite@internal@protobuf@google@@SA_KH@Z
?Int64Size@WireFormatLite@internal@protobuf@google@@SA_K_J@Z
?UInt32Size@WireFormatLite@internal@protobuf@google@@SA_KI@Z
?UInt64Size@WireFormatLite@internal@protobuf@google@@SA_K_K@Z
?EnumSize@WireFormatLite@internal@protobuf@google@@SA_KH@Z
?StringSize@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?BytesSize@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?WriteDoubleToArray@WireFormatLite@internal@protobuf@google@@SAPEAEHNPEAE@Z
?LengthDelimitedSize@WireFormatLite@internal@protobuf@google@@SA_K_K@Z
?PushLimit@EpsCopyInputStream@internal@protobuf@google@@QEAAHPEBDH@Z
?PopLimit@EpsCopyInputStream@internal@protobuf@google@@QEAA_NH@Z
?WriteFloatToArray@WireFormatLite@internal@protobuf@google@@SAPEAEHMPEAE@Z
?Get@CachedSize@internal@protobuf@google@@QEBAHXZ
?Set@CachedSize@internal@protobuf@google@@QEAAXH@Z
??0UnknownFieldSet@protobuf@google@@QEAA@XZ
??1UnknownFieldSet@protobuf@google@@QEAA@XZ
?Clear@UnknownFieldSet@protobuf@google@@QEAAXXZ
?GetReflection@Message@protobuf@google@@QEBAPEBVReflection@23@XZ
??0Message@protobuf@google@@IEAA@PEAVArena@12@@Z
??0Message@protobuf@google@@QEAA@XZ
?WriteUInt64ToArray@WireFormatLite@internal@protobuf@google@@SAPEAEH_KPEAE@Z
?WriteUInt32ToArray@WireFormatLite@internal@protobuf@google@@SAPEAEHIPEAE@Z
??1Message@protobuf@google@@UEAA@XZ
??0CachedSize@internal@protobuf@google@@QEAA@XZ
??0?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@PEAVArena@12@@Z
??1?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAA@XZ
?size@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBAHXZ
?Get@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?Add@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Clear@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAXXZ
?MergeFrom@?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@QEAAXAEBV123@@Z
?InitializationErrorString@Message@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?DiscardUnknownFields@Message@protobuf@google@@UEAAXXZ
?SpaceUsedLong@Message@protobuf@google@@UEBA_KXZ
?GetTypeName@Message@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?CheckTypeAndMergeFrom@Message@protobuf@google@@UEAAXAEBVMessageLite@23@@Z
?MergeFrom@UnknownFieldSet@protobuf@google@@QEAAXAEBV123@@Z
?AddVarint@UnknownFieldSet@protobuf@google@@QEAAXH_K@Z
?ReadSizeFallback@internal@protobuf@google@@YA?AU?$pair@PEBDH@std@@PEBDI@Z
?AddDescriptors@internal@protobuf@google@@YAXPEBUDescriptorTable@123@@Z
?DestroyMessage@internal@protobuf@google@@YAXPEBX@Z
?ReadTagFallback@internal@protobuf@google@@YA?AU?$pair@PEBDI@std@@PEBDI@Z
?Mutable@ArenaStringPtr@internal@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEmptyDefault@1234@PEAVArena@34@@Z
?Merge@ReflectionOps@internal@protobuf@google@@SAXAEBVMessage@34@PEAV534@@Z
?InlineGreedyStringParser@internal@protobuf@google@@YAPEBDPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDPEAVParseContext@123@@Z
?ComputeUnknownFieldsSize@internal@protobuf@google@@YA_KAEBVInternalMetadata@123@_KPEAVCachedSize@123@@Z
?OnShutdownRun@internal@protobuf@google@@YAXP6AXPEBX@Z0@Z
?InternalSerializeUnknownFieldsToArray@WireFormat@internal@protobuf@google@@SAPEAEAEBVUnknownFieldSet@34@PEAEPEAVEpsCopyOutputStream@io@34@@Z
?fixed_address_empty_string@internal@protobuf@google@@3TEmptyString@123@A
?AllocateAlignedAndAddCleanup@ArenaImpl@internal@protobuf@google@@QEAAPEAX_KP6AXPEAX@Z@Z
?VarintParseSlow64@internal@protobuf@google@@YA?AU?$pair@PEBD_K@std@@PEBDI@Z
?VarintParseSlow32@internal@protobuf@google@@YA?AU?$pair@PEBDI@std@@PEBDI@Z
?WriteInt64ToArray@WireFormatLite@internal@protobuf@google@@SAPEAEH_JPEAE@Z
?UnknownFieldParse@internal@protobuf@google@@YAPEBD_KPEAVUnknownFieldSet@23@PEBDPEAVParseContext@123@@Z
?AssignDescriptors@internal@protobuf@google@@YAXPEBUDescriptorTable@123@_N@Z
?VerifyVersion@internal@protobuf@google@@YAXHHPEBD@Z
?WriteInt32ToArray@WireFormatLite@internal@protobuf@google@@SAPEAEHHPEAE@Z
?InitSCCImpl@internal@protobuf@google@@YAXPEAUSCCInfoBase@123@@Z
?WriteStringOutline@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z
?Get@ArenaStringPtr@internal@protobuf@google@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetArena@MessageLite@protobuf@google@@QEBAPEAVArena@23@XZ
?size@RepeatedPtrFieldBase@internal@protobuf@google@@IEBAHXZ
?ParseFromArray@MessageLite@protobuf@google@@QEAA_NPEBXH@Z
?SerializeToString@MessageLite@protobuf@google@@QEBA_NPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Set@ArenaStringPtr@internal@protobuf@google@@QEAAXUEmptyDefault@1234@$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z
?Set@ArenaStringPtr@internal@protobuf@google@@QEAAXUEmptyDefault@1234@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z
?Reserve@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXH@Z
?WriteTagToArray@WireFormatLite@internal@protobuf@google@@SAPEAEHW4WireType@1234@PEAE@Z
?MergeFromInternal@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAXAEBV1234@P81234@EAAXPEAPEAX1HH@Z@Z
??1RepeatedPtrFieldBase@internal@protobuf@google@@IEAA@XZ
?InternalGetTable@MessageLite@protobuf@google@@EEBAPEBXXZ
?DestroyNoArena@ArenaStringPtr@internal@protobuf@google@@QEAAXPEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ClearNonDefaultToEmpty@ArenaStringPtr@internal@protobuf@google@@QEAAXXZ
?EnsureSpace@EpsCopyOutputStream@io@protobuf@google@@QEAAPEAEPEAE@Z
?WriteStringMaybeAliased@EpsCopyOutputStream@io@protobuf@google@@QEAAPEAEIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z
?WriteBytesMaybeAliased@EpsCopyOutputStream@io@protobuf@google@@QEAAPEAEIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z
?WriteVarint32ToArray@CodedOutputStream@io@protobuf@google@@SAPEAEIPEAE@Z
?RecordAlloc@ArenaImpl@internal@protobuf@google@@QEBAXPEBVtype_info@@_K@Z
?AllocateAligned@Arena@protobuf@google@@AEAAPEAX_K@Z
?UnsafeSetDefault@ArenaStringPtr@internal@protobuf@google@@QEAAXPEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Done@ParseContext@internal@protobuf@google@@QEAA_NPEAPEBD@Z

libcrypto-3-x64

EVP_MD_CTX_free
ASN1_UTF8STRING_it
ASN1_GENERALIZEDTIME_it
EVP_aes_128_cfb128
ERR_error_string
OSSL_PARAM_construct_octet_string
EVP_DigestSignUpdate
EVP_PKEY_free
HMAC
EC_GROUP_free
EC_POINT_new
OSSL_PARAM_construct_utf8_string
EVP_DecryptFinal
EVP_DigestInit
EVP_DigestSignInit
EC_POINT_free
OSSL_PARAM_construct_end
EVP_KDF_fetch
EVP_DecryptInit
ASN1_item_d2i
EVP_CIPHER_CTX_ctrl
EVP_KDF_derive
BN_CTX_new
EVP_KDF_CTX_new
EC_GROUP_new_by_curve_name
EVP_aes_128_gcm
BN_CTX_free
ASN1_INTEGER_it
BN_num_bits
BN_bin2bn
EVP_KDF_CTX_free
EVP_CIPHER_CTX_free
ASN1_OCTET_STRING_it
EVP_DigestSignFinal
EVP_DecryptInit_ex
EVP_DigestUpdate
EC_POINT_get_affine_coordinates
EVP_sha256
BN_clear
EC_POINT_set_compressed_coordinates
EVP_aes_128_cbc
EVP_aes_128_ecb
ERR_get_error
EVP_get_digestbyname
EVP_KDF_free
EC_POINT_mul
EVP_MD_CTX_new
EVP_PKEY_new_mac_key
EVP_DecryptFinal_ex
EVP_DigestFinal
BN_bn2bin
ASN1_item_free
EVP_DecryptUpdate
OPENSSL_buf2hexstr_ex
EVP_aes_256_cbc
EVP_CIPHER_CTX_new
PKCS5_PBKDF2_HMAC
BN_new

kernel32

GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CopyFileW
SetLastError
GetLastError
AreFileApisANSI
RemoveDirectoryW
GetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
FindClose
DeleteFileW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CloseHandle
WideCharToMultiByte
MoveFileW
MultiByteToWideChar
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount

msvcp140

?id@?$ctype@_W@std@@2V0locale@2@A
?_Winerror_map@std@@YAHH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Winerror_message@std@@YAKKPEADK@Z
?_Syserror_map@std@@YAPEBDH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
??Bid@locale@std@@QEAA_KXZ
?_Xbad_alloc@std@@YAXXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

vcruntime140

__std_terminate
__std_exception_destroy
__std_exception_copy
_purecall
wcsrchr
__std_type_info_compare
__std_type_info_name
__C_specific_handler
__std_type_info_destroy_list
_CxxThrowException
memset
memcpy
memcmp
__CxxFrameHandler3
__RTDynamicCast
memchr
memmove

api-ms-win-crt-heap-l1-1-0

_callnewh
free
_aligned_free
calloc
malloc
_aligned_malloc

api-ms-win-crt-time-l1-1-0

_localtime64_s
_ftime64

api-ms-win-crt-convert-l1-1-0

strtoll
wcstombs

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_execute_onexit_table
_initterm_e
_invalid_parameter_noinfo
_initterm
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_cexit
_invalid_parameter_noinfo_noreturn
_errno
terminate

api-ms-win-crt-stdio-l1-1-0

_fseeki64
fsetpos
ungetc
setvbuf
ftell
fgetpos
fflush
fputc
_wsopen_s
_write
_close
_lseeki64
fread
_get_stream_buffer_pointers
fopen
fwrite
fclose
fseek
fgetc

api-ms-win-crt-string-l1-1-0

strcmp
tolower

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file
_wunlink

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

wtsapi32

WTSSendMessageW

user32

GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation

Exports

Exports

��̢2�qڕ�R>E��@�<c��T/ �^`y��'��yJ�W��N)$��Ǡ��zU�l��g�I�<��n��/yȯ)l(f��yˑ�/�$~4A�Q}s�$f�,Eȓ,��(��.D�n�E��g� +��;��ԊБs��l��^��x��s��L7�9�Hkw�$,jkͼ�%ь��Uh ��.^|�]3��(RZ��$X��{��>[�?]��w��u.U��(�IQs��h�xr<��I0��1��M[�=~��;��D�_��K��*�T8��Cft]5�;��_ ��P�_h�i[��z��8�v�y��٭9-ڏo��Y�H,��N�� f{m�)Pڿ"��~��` t�� 3��ݓ� d�6�eҿ��< �Py=]eL��p}�=)��f�[�wd^g�q�,,J�9��&�f�gߔ��QB��I�OR�eō�<��K�xb��h��Jb��]i@ %�(_]$�[Y_�eČ5��x��R�dJ��[��JQn(��P�/�a��a �if��.��,+��a��y�#4�3�ǑA�ݎ��}�85O&� !��FME��LD��Z�nЁğ}KMn��o�⿇�� v>W��j6�Y�:��.��9I�Y��tp,��@WǕ?��P��#}��z<+=��b��{|Ԫv-��2Q�V�ɏM5��Qrxo�[�EM�߶ 5��P0��˒��2De�b�>��.2�ҥ� �dD-��Όh�jR��8|��?��S Y憯ҽ�,�q��z��E�V�/n-$��c�L��:r��*1�(vn��\�]O�>�GP>�Z�"��ݗ�I��C��*��}��k�΀We:sO{t!�qU AW\��Dq(��.Ef��l1>we�!v��k��[:��s�Kw��P1S*O��*4s��R�s�9G*E�e�� e�j�`6a��ցc��9��r��3�e^\�o��-�@L��C�+s�b��,�7��/�q��J��c�s��0ʓ�i�e"9!^!)�A4� 7pl��@@A�U��\�(�Y��r��B�̸g��c��h��[I1��o!.��(��+w� �}�It9:7?��U?�/H��E�J�Е�#X��zR��E0�]��ac��gM@!)K�綼rH.��(]�{h�( �k��;j��UyL8'rl-�S��r{�筕J��x�� ]%�D-G�7'x�|�h͘��3#0�I,�� ŏ�@�̃ v;*H��/|��w��TX��S^ԭ��޴~��qN6��w$t�K��v�gL�j�b��[�;�saԇ��"�U�E��N��{PN�5��~ڶ��t`e9��-8��i�9R��f��p��Cͪ�8Ѿ�"%V2��؇ʂE)�IA�C#`i͞ialB��U��-�[\9�",��"��LA��k��Jl#�U�e5sh �}"W�ΧB2��븾�!��Y�V��qmy ч��T�݂v�VmLO��.N�0��[��nw�eY��p��!x��"��*�oԻ523�Z�q5��k�~�� Ef� o5N}y. �U��Cw�)L=�r��ح��8|�bore�`p�� Ӈ+7R*��?s*�xA+��x R��7W*�J 2,>�"!�K>��s�I$9rg��C��hU_�e��!�� .�K�W#�ޣ��y�� s�@�W��R�8��K �I �F^% ��;ƙ��3Y�1�=δgġ�|��?�譠.E�m��ҙ5�x�X��S��Z0L6A��Pt��c-��j2�a�0Fj��ؿZ|�O�_X%��BCļ��?d@��,d<~5��u��D��s��OP6��Hy�Y(�o9Np��E��8l��lG��5�4�`�e(��c5b��eY=�-�g�oǦ�Su�p�&��8!�1�Z�:��>kX,j�*�?��R4�� z!��6��i춃�5x��EAZ�H�;�9*��d�j�Ȼ��a2b��0IXyM��w��XC�F:��H8�Vi��?�j��jpp�#�uw�Ŷ�!�V��uV�F:��(SN�9K.튬��x1O��e�5ME�DVk%C(`/7v_��~-�-H��-�Wqф��d��_X��L��x��^�s��A��&1E ��a�z^s�>�H��m:�F�-��ԗO�4(1R-9�m=0M�K�Z<&u� >�ЎJZ��{'�"|��~iŨ��b }��F�y+��{�#}`(��'��,�mn��&bK��b�;?��H��ъ��>��g�E��q�+r#"�R,6 %֮�8�&�ػ�I�L��(��dk�k�/�W~/�و%�԰/�=��Y��P� B�|�C�V��k�n�x�n�[��u�L�ї[� �� S�M �fU��;9�^�̙��A\��u��D��0p�8��k#Mi�o&�?�L�`-�t�6��]ǵ��Qq:*��y�^��v�If4+�vx?g��J �3��99�wT:��s�TN� ��T�ߦ4v ;'��Îh �{^ {7P�5K'��*�I�RU9��s�I deԂ�H��gH{�T�ͿS��:�U��iU*�\q"�,B��;q�K�pb/m��$z�{#�)��r�|�?l��ˆ��tmpT��F7��9.r ��!t�O: �r��@(4��'}��фg� �N��=K�� c��z�P!plڗ�A,è��DH��X��7��i�+�(�'�S��X�$�烜,M&)�M�f��/��LV�Ұ I��z�N9k,k�u�"�2rA��x��#�@j�_!?Ѿ�� źx��һanT��AB��>�X
?decrypt_ios_whatsapp_backup@@YAHPEBD00@Z
?decrypt_ios_whatsapp_e2e_backup@@YAHPEBD00@Z
?decrypt_ios_whatsapp_e2e_backup_media@@YAHPEBD00@Z
?icloudkit_manager_creater@@YAPEAViCloudKitManager@@XZ
?icloudkit_manager_diposer@@YAXPEAViCloudKitManager@@@Z
?read_ios_whatsapp_type@@YAHPEBD@Z
?transfer_ios_whatsapp_backup2crypt14@@YAHPEBD00@Z

Sections

.text
Size: 576KB - Virtual size: 576KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.???0
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.???1
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c13acdb2999b41e35600fa7247de587b

Headers

DLL Characteristics

File Characteristics

Imports

itunesgsapro

plist-2.0

cpr

libprotobuf

libcrypto-3-x64

kernel32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

user32

Exports

Exports

Sections

.text Size: 576KB - Virtual size: 576KB

.rdata Size: 200KB - Virtual size: 200KB

.data Size: 24KB - Virtual size: 24KB

.pdata Size: 28KB - Virtual size: 28KB

.???0 Size: 4.5MB - Virtual size: 4.5MB

.???1 Size: 6.4MB - Virtual size: 6.4MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.l1 Size: 36KB - Virtual size: 36KB

.text
Size: 576KB - Virtual size: 576KB

.rdata
Size: 200KB - Virtual size: 200KB

.data
Size: 24KB - Virtual size: 24KB

.pdata
Size: 28KB - Virtual size: 28KB

.???0
Size: 4.5MB - Virtual size: 4.5MB

.???1
Size: 6.4MB - Virtual size: 6.4MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.l1
Size: 36KB - Virtual size: 36KB