NEAS[.]1e626903591e512f4f48a4afce00cd60_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1e626903591e512f4f48a4afce00cd60_JC.exe
Size

6.7MB
MD5

1e626903591e512f4f48a4afce00cd60
SHA1

db52d665d079014c8cb07190240b2d5f8f4e47f5
SHA256

cdd49b96bc4635b1b6fba7267c1287f842aec2dbfe7e94cc7ab6b43942ab700f
SHA512

ca7828cac3cfc69ba1ccd40f3cf88f3c6ce651cdb79a81c33263b456a4ed1758fb0caec52ba8ba226e2d568182f00806029a8b19386e397a061d7282e4fbdf92
SSDEEP

98304:Xo1f1mxqDENotOUT5oqQujbZtwSagpKTRQM6NvgW61tap:Af1mID0WdoqQujbZtwBgpKQM6co

Score

1^/10

Malware Config

Signatures

Files

NEAS.1e626903591e512f4f48a4afce00cd60_JC.exe
.dll windows:6 windows x86

5450eb3b06cfe3a8cad7618a247ad2ec

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:57:97:42:a9:53:ba:d9:0d:42:37:a3:f3:e3:8c:5e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/05/2022, 00:00

Not After

04/05/2024, 23:59

Subject

SERIALNUMBER=2853894,CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:52:5c:df:5c:a9:9f:24:48:9a:cb:07:ec:71:7c:91:a2:ea:39:35:22:f8:96:e6:62:58:f2:5c:c1:34:39:16
Signer

Actual PE Digest

65:52:5c:df:5c:a9:9f:24:48:9a:cb:07:ec:71:7c:91:a2:ea:39:35:22:f8:96:e6:62:58:f2:5c:c1:34:39:16

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

api-ms-win-crt-stdio-l1-1-0

ferror
setvbuf
fopen
__stdio_common_vfscanf
fread
rewind
_open_osfhandle
_setmode
__stdio_common_vfprintf
fgets
fgetc
_commit
_chsize
_wfopen
_wfreopen
fwrite
_wpopen
fseek
__acrt_iob_func
_fileno
fflush
_wmktemp_s
_wopen
_get_osfhandle
fclose
_lseek
_read
freopen
feof
getc
__stdio_common_vsprintf
__stdio_common_vswprintf
__stdio_common_vsscanf
fputs
_close

api-ms-win-crt-heap-l1-1-0

calloc
_aligned_free
_aligned_malloc
_callnewh
realloc
malloc
free

api-ms-win-crt-string-l1-1-0

_stricmp
strncpy
iscntrl
strncmp
isdigit
wcsncpy
_strdup
isspace
isalpha
strcspn
towupper
wcscspn
wcsspn
_strnicmp
tolower
wcsncat
strncat
islower
_strlwr
_strupr
isalnum
_wcsicmp
toupper
wcsncpy_s
strpbrk
_wcsdup
strtok
strspn
isxdigit
strtok_s
isprint
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
terminate
signal
_initterm
set_terminate
strerror
_wperror
abort
_getpid
_cexit
_crt_atexit
_invalid_parameter_noinfo_noreturn
_set_invalid_parameter_handler
_execute_onexit_table
_errno

api-ms-win-crt-utility-l1-1-0

qsort
bsearch
srand
rand

api-ms-win-crt-time-l1-1-0

_time64
_mktime64
_ftime64
_get_timezone
_localtime64
_gmtime64
strftime

api-ms-win-crt-math-l1-1-0

frexp
ceil
_libm_sse2_sqrt_precise
floor
_libm_sse2_pow_precise
_fdopen
modf

api-ms-win-crt-convert-l1-1-0

strtod
strtoul
_strtoui64
atol
wcrtomb
atoi
_ecvt_s
_fcvt_s
strtol
atof
_strtoi64
mbtowc
_wtoi

api-ms-win-crt-environment-l1-1-0

getenv
_putenv_s
_wgetenv
_wgetdcwd

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-filesystem-l1-1-0

_wmkdir
_wrmdir
_fstat64i32
remove
_wchdir
_wfullpath
_waccess
_wchmod
_wsplitpath_s
_wunlink
_wstat64
_wrename

vcruntime140

memcpy
strchr
memset
__std_exception_copy
__std_exception_destroy
_except_handler4_common
__current_exception_context
longjmp
set_unexpected
memchr
memmove
wcsrchr
wcschr
strrchr
strstr
_CxxThrowException
__CxxFrameHandler3
wcsstr
_set_purecall_handler
__current_exception
__std_type_info_destroy_list
_setjmp3

ws2_32

setsockopt
shutdown
WSAIoctl
WSAAddressToStringA
GetAddrInfoW
FreeAddrInfoW
GetNameInfoW
htons
inet_addr
ntohl
inet_pton
WSASetLastError
socket
listen
getsockopt
getsockname
ioctlsocket
connect
gethostname
closesocket
bind
accept
send
select
recv
__WSAFDIsSet
WSAPoll
ntohs
WSAEnumNetworkEvents
inet_ntop
recvfrom
freeaddrinfo
WSAStartup
WSACleanup
getaddrinfo
gethostbyname
WSADuplicateSocketW
WSAEventSelect
htonl
WSASocketW
WSAGetLastError

kernel32

GetModuleHandleW
LoadLibraryExW
FormatMessageW
MoveFileExW
GetTimeFormatEx
GetDateFormatEx
VerSetConditionMask
CloseHandle
GetCurrentProcess
GetExitCodeProcess
OpenProcess
GlobalMemoryStatusEx
GetSystemInfo
GetNativeSystemInfo
GetProductInfo
IsWow64Process
FreeLibrary
GetProcAddress
VerifyVersionInfoA
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32First
Process32Next
GetDriveTypeA
WideCharToMultiByte
GetFileAttributesA
GetShortPathNameW
OutputDebugStringW
MapViewOfFile
CreateSemaphoreW
CreateFileMappingA
FindClose
FindFirstFileExW
GetModuleHandleExW
LoadLibraryA
lstrlenA
GetVersionExA
MultiByteToWideChar
GetACP
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetCurrentDirectoryW
FindFirstChangeNotificationW
GetDiskFreeSpaceW
GetDriveTypeW
GetLogicalDriveStringsW
GetVolumeInformationW
GetVolumePathNameW
QueryDosDeviceW
GetTempPathW
GetVolumeNameForVolumeMountPointW
GetCompressedFileSizeW
CreateNamedPipeW
WaitNamedPipeW
CreateProcessW
GetSystemDirectoryW
GetComputerNameExW
GetVersionExW
CreateFileMappingW
FindResourceW
BeginUpdateResourceW
UpdateResourceW
CopyFileW
CopyFileExW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateFileA
TerminateProcess
GetCurrentThread
ExitThread
LocalFree
SetDllDirectoryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
OpenSemaphoreW
OpenEventW
CreateMutexW
OutputDebugStringA
SetFileAttributesW
RemoveDirectoryW
GetLongPathNameW
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileAttributesExW
GetDiskFreeSpaceExW
DeleteFileW
CreateFileW
CreateDirectoryW
SetCurrentDirectoryW
GetTickCount64
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThreadId
GetTimeZoneInformation
GetSystemTime
FlushFileBuffers
SetLastError
GetLastError
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
LoadLibraryW
VirtualQuery
IsBadReadPtr
CreateEventW
GetModuleHandleA
VirtualProtect
BackupRead
CreatePipe
WaitForMultipleObjects
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemDefaultLangID
GetUserDefaultLangID
SetThreadPriority
ExitProcess
SetErrorMode
GlobalLock
GlobalUnlock
GlobalAlloc
ProcessIdToSessionId
GlobalFree
ConnectNamedPipe
FormatMessageA
GetFileSizeEx
TerminateThread
CreateThread
ResetEvent
SetEvent
GetHandleInformation
ReleaseSemaphore
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
TransactNamedPipe
ReleaseSRWLockExclusive
InitializeSRWLock
InitOnceExecuteOnce
SetConsoleMode
GetSystemFirmwareTable
GetDynamicTimeZoneInformation
GetLocalTime
AttachConsole
FreeConsole
AllocConsole
LocalAlloc
CreateEventA
WaitForSingleObject
CancelIo
GetOverlappedResult
GetFileAttributesW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
WriteConsoleW
SleepConditionVariableCS
GetConsoleMode
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetStdHandle
GetModuleFileNameW
UnmapViewOfFile
GetTickCount
TryEnterCriticalSection
SetHandleInformation
InitializeCriticalSectionAndSpinCount
GetFileInformationByHandle
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
DuplicateHandle
FindNextFileW
GetFileTime
SetFileTime
DeviceIoControl
GetProcessTimes

user32

PostThreadMessageA
RegisterWindowMessageW
ReleaseDC
CloseDesktop
GetDC
SetKeyboardState
GetKeyboardState
SetClipboardData
MsgWaitForMultipleObjectsEx
OpenClipboard
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
MsgWaitForMultipleObjects
DispatchMessageA
LoadCursorW
OpenDesktopW
MessageBoxW
SetWindowTextW
GetClipboardFormatNameW
CreateWindowExW
LoadStringW
GetSystemMetrics
PeekMessageA
PostMessageA
GetIconInfo
CloseClipboard
LoadImageW
CreateDesktopW
GetDesktopWindow

advapi32

GetUserNameW
RegQueryValueExW
RegRestoreKeyW
RegSaveKeyW
GetNamedSecurityInfoW
RegSetValueExW
RegUnLoadKeyW
RegSetValueExA
ImpersonateSelf
RevertToSelf
AddAccessAllowedAceEx
CheckTokenMembership
CreateWellKnownSid
GetSecurityDescriptorControl
SetKernelObjectSecurity
GetFileSecurityW
GetExplicitEntriesFromAclW
DeleteService
CloseServiceHandle
ChangeServiceConfig2W
RegOpenKeyExA
MapGenericMask
MakeSelfRelativeSD
GetTokenInformation
EqualSid
CopySid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
InitializeAcl
GetLengthSid
FreeSid
DuplicateToken
AllocateAndInitializeSid
AddAccessAllowedAce
AccessCheck
OpenThreadToken
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
SetSecurityInfo
LookupPrivilegeValueA
SetSecurityDescriptorControl
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegLoadKeyW
RegisterEventSourceW
RegOpenKeyExW
DeregisterEventSource
ChangeServiceConfigW
ControlService
EnumDependentServicesW
LockServiceDatabase
QueryServiceConfigW
QueryServiceLockStatusW
QueryServiceStatus
StartServiceA
UnlockServiceDatabase
DuplicateTokenEx
ImpersonateLoggedOnUser
AdjustTokenPrivileges
RegGetValueW
LogonUserW
ReportEventW
LookupAccountSidW
LookupAccountNameW
CreateServiceW
CryptAcquireContextW
OpenServiceW
OpenSCManagerW

shell32

SHGetFolderPathW
DragQueryFileW

api-ms-win-crt-multibyte-l1-1-0

_mbslwr

ole32

CoInitialize
CoQueryProxyBlanket
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoGetObject
StringFromGUID2
CoInitializeSecurity
CoInitializeEx

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

libssl-3

SSL_set_bio
OPENSSL_init_ssl
SSL_get_ex_data_X509_STORE_CTX_idx
SSL_get_ex_data
SSL_set_ex_data
SSL_CTX_load_verify_locations
SSL_CTX_set_quiet_shutdown
SSL_CTX_get0_certificate
SSL_set_alpn_protos
SSL_CTX_set_cipher_list
SSL_CTX_new
SSL_set_accept_state
SSL_set_connect_state
SSL_shutdown
TLS_method
SSL_get_error
SSL_CTX_ctrl
SSL_ctrl
SSL_write
SSL_read
SSL_connect
SSL_accept
SSL_free
SSL_new
SSL_CTX_check_private_key
SSL_CTX_use_certificate
SSL_CTX_use_PrivateKey
SSL_CTX_set_verify
SSL_CTX_set_options
SSL_CTX_use_certificate_file
SSL_CTX_use_PrivateKey_file
SSL_set_verify
SSL_CTX_set_ciphersuites
SSL_set_fd
SSL_pending
SSL_CIPHER_get_name
SSL_CIPHER_get_bits
SSL_get_current_cipher
SSL_want
SSL_CTX_set_cert_store
SSL_CTX_get_cert_store
SSL_CTX_free

libcrypto-3

X509_get_version
ERR_reason_error_string
PEM_read_bio_PKCS7
PEM_read_bio_X509_CRL
X509_NAME_ENTRY_get_object
X509_NAME_entry_count
PKCS7_verify
PKCS7_get_signer_info
PKCS7_cert_from_signer_info
X509_VERIFY_PARAM_set_flags
X509_LOOKUP_ctrl
X509_STORE_add_crl
X509_LOOKUP_file
X509_LOOKUP_hash_dir
X509_STORE_add_lookup
X509_STORE_set_verify_cb
X509_STORE_get0_param
ASN1_STRING_print
BIO_new_mem_buf
BIO_s_file
OPENSSL_sk_push
OPENSSL_sk_free
OPENSSL_sk_new_null
HMAC_Final
HMAC_Update
HMAC_Init_ex
HMAC_CTX_free
HMAC_CTX_new
EVP_sha512
EVP_sha384
EVP_sha224
EVP_sha1
BIO_read
BIO_ctrl_pending
PKCS7_free
ISSUING_DIST_POINT_free
DIST_POINT_free
GENERAL_NAME_get0_value
X509_CRL_get_ext_d2i
X509_CRL_get_issuer
OSSL_HTTP_parse_url
OSSL_HTTP_REQ_CTX_set_max_response_length
OSSL_HTTP_REQ_CTX_set_expected
OSSL_HTTP_REQ_CTX_add1_header
OSSL_HTTP_REQ_CTX_set_request_line
OSSL_HTTP_REQ_CTX_free
OSSL_HTTP_REQ_CTX_new
X509_CRL_load_http
X509_CRL_verify
X509_STORE_CTX_get_by_subject
X509_STORE_CTX_get_cert_crl
X509_STORE_CTX_get_verify_cb
X509_OBJECT_get0_X509
X509_OBJECT_free
X509_OBJECT_new
X509_check_trust
ASN1_ITEM_lookup
ASN1_item_i2d_mem_bio
BIO_new_connect
CRYPTO_free
ASN1_STRING_get0_data
X509_CRL_match
d2i_X509_CRL
X509_CRL_free
X509_CRL_dup
EVP_sha256
EVP_Digest
OSSL_PROVIDER_set_default_search_path
X509_check_ip_asc
X509_check_host
X509_get_key_usage
X509_get_extension_flags
RAND_status
ERR_error_string_n
ERR_clear_error
ERR_peek_last_error
ERR_get_error
PEM_read_bio_PrivateKey
PEM_write_bio_X509
PEM_read_bio_X509
X509_get_ext_d2i
X509_NAME_ENTRY_get_data
X509_NAME_get_entry
X509_NAME_get_index_by_NID
X509_NAME_cmp
X509_get_pubkey
X509_get_subject_name
X509_get_issuer_name
EVP_PKEY_get_id
X509_get_signature_nid
i2d_X509
d2i_X509
X509_free
X509_digest
X509_verify_cert_error_string
X509_VERIFY_PARAM_get_flags
X509_STORE_CTX_get0_param
X509_STORE_CTX_get0_chain
X509_STORE_CTX_get_error_depth
X509_STORE_CTX_set_error
X509_STORE_CTX_get_error
X509_STORE_CTX_get_ex_data
X509_STORE_add_cert
X509_STORE_CTX_get0_cert
X509_STORE_CTX_get0_store
X509_STORE_CTX_init
X509_STORE_CTX_free
X509_STORE_CTX_new
X509_STORE_get_ex_data
X509_STORE_set_ex_data
X509_STORE_set_check_revocation
X509_STORE_free
X509_STORE_new
X509_verify_cert
EVP_PKEY_free
EVP_PKEY_get_bits
EVP_get_digestbyname
BIO_f_base64
EVP_default_properties_enable_fips
EVP_default_properties_is_fips_enabled
OBJ_obj2nid
ASN1_OBJECT_free
BIO_s_mem
BIO_free_all
BIO_push
BIO_ctrl
BIO_write
BIO_free
BIO_new
OSSL_LIB_CTX_load_config
OPENSSL_init_crypto
CRYPTO_get_ex_new_index
OpenSSL_version_num
OPENSSL_sk_pop_free
OPENSSL_sk_value
OPENSSL_sk_num

libxml2

xmlCheckVersion
xmlFreeDoc
xmlNewChild
xmlDocGetRootElement
xmlUnlinkNode
xmlFreeNode
xmlSetProp
xmlGetProp
xmlNodeSetContent
xmlDocDumpMemory
xmlParseMemory
xmlFree
xmlXPathFreeContext
xmlXPathEvalExpression
xmlXPathRegisterNs
xmlXPathNewContext
xmlXPathFreeObject
xmlParseFile
xmlInitParser
xmlEncodeEntitiesReentrant
xmlSaveFile
xmlNewTextChild
xmlStrEqual
xmlNewDoc
xmlNewProp
xmlCopyDoc
xmlNewNode
xmlNewText
xmlDocSetRootElement
xmlAddChild
xmlAddPrevSibling
xmlNodeListGetString
xmlDocDumpFormatMemory
xmlSetGenericErrorFunc

zlib1

deflate
deflateEnd
deflateInit2_
inflate
inflateEnd
inflateReset
inflateInit2_
zlibVersion
deflateInit_
inflateInit_
zError
adler32
crc32
deflateReset
inflateReset2
inflateValidate

iphlpapi

LookupPersistentUdpPortReservation

msvcp140

?_Xlength_error@std@@YAXPBD@Z

gdi32

SelectPalette
SelectObject
RealizePalette
GetSystemPaletteEntries
GetDIBits
StretchBlt
GetObjectA
DeleteDC
CreatePalette
CreateDIBitmap
CreateCompatibleDC
CreateDIBSection
GetDeviceCaps
CreateCompatibleBitmap
DeleteObject

winmm

timeEndPeriod
timeBeginPeriod
waveOutGetDevCapsW
waveOutGetNumDevs
timeGetTime

wininet

InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
InternetCrackUrlW

mpr

WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
WNetAddConnection2W
WNetGetLastErrorW

userenv

UnloadUserProfile
LoadUserProfileW

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

bcrypt

BCryptDestroyKey
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptDecrypt
BCryptEncrypt
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGenRandom

crypt32

CertFreeCertificateContext
CertCreateCertificateContext
CertOpenSystemStoreA
CryptProtectData
CryptUnprotectData
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CryptAcquireCertificatePrivateKey
CryptExportPKCS8
CertAddEncodedCertificateToStore
CertFreeCertificateChain
CertGetCertificateChain

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpGetProxyForUrl

cryptui

CryptUIDlgViewCertificateW

winscard

SCardGetStatusChangeA
SCardListReadersA
SCardReconnect
SCardDisconnect
SCardConnectW
g_rgSCardRawPci
SCardCancel
SCardEndTransaction
SCardStatusA
SCardTransmit
SCardReleaseContext
g_rgSCardT0Pci
g_rgSCardT1Pci
SCardEstablishContext
SCardBeginTransaction

Exports

Exports

ACE_Cleanup
ACE_IsManagedVM
ACE_UseVM
AIOMgr_Cleanup
AIOMgr_Close
AIOMgr_Err2MsgString
AIOMgr_Err2String
AIOMgr_ForceSyncMode
AIOMgr_GetAllocSize
AIOMgr_GetFlags
AIOMgr_Init
AIOMgr_IsHandleAsync
AIOMgr_Open
AIOMgr_OpenWithRetry
AIOMgr_Queue
AIOMgr_SetAllocSize
AIOMgr_Sync
AIOMgr_Truncate
AIOMgr_Wait
AIOMgr_Win32Ioctl
AsyncProxySocket_Exit
AsyncProxySocket_Init
AsyncSocket_AttachToSSLSock
AsyncSocket_CancelCbForClose
AsyncSocket_Close
AsyncSocket_Connect
AsyncSocket_ConnectNamedPipe
AsyncSocket_ConnectVMCI
AsyncSocket_CreateNamedPipe
AsyncSocket_Err2String
AsyncSocket_Flush
AsyncSocket_GetFd
AsyncSocket_GetGenericErrno
AsyncSocket_GetID
AsyncSocket_GetINETIPStr
AsyncSocket_GetPort
AsyncSocket_GetState
AsyncSocket_Init
AsyncSocket_Listen
AsyncSocket_ListenVMCI
AsyncSocket_MsgError
AsyncSocket_Recv
AsyncSocket_RecvBlocking
AsyncSocket_RecvPartial
AsyncSocket_RecvPassedFd
AsyncSocket_Send
AsyncSocket_SetErrorFn
AsyncSocket_SetOption
AsyncSocket_UseNodelay
AsyncSocket_WaitForConnection
Auth_AuthenticateUser
Auth_CloseToken
Auth_RetrieveAccountInformationForVM
AutoInstall_AddFileToFloppyImg
AutoInstall_AddTools_Linux
AutoInstall_GetInstallConfigInfo
AutoInstall_GetPrettyWindowsName
AutoInstall_IsSupportedGuest
AutoInstall_MakeFloppyImg
AutoInstall_MakeFloppyImg_Linux
AutoInstall_MasterISO
AutoInstall_NeedsFloppy_Linux
AutoInstall_PrepareAnswerFileEx
AutoInstall_PrepareAnswerFileEx_Linux
AutoInstall_ScanDisk
AutoInstall_ScanISO
AutoInstall_ValidateName
AutoInstall_ValidatePassword
AutoInstall_ValidateShortName
Base64_DecodeFixed
Base64_DecodedLength
Base64_EasyDecode
Base64_EasyEncode
Base64_Encode
Base64_EncodedLength
BitVector_Alloc
BitVector_Duplicate
BitVector_Free
BitVector_GetExtent
BitVector_IsZero
BitVector_MaxSize
BitVector_Merge
BitVector_MergeAtOffset
BitVector_NextBit
BitVector_NextBit64
BitVector_NextExtent
BitVector_NextExtent64
BitVector_NumBitsSet
BitVector_PrevBit
BitVector_PrevBit64
BitVector_Resize
BitVector_SafeAlloc
BitVector_SafeDuplicate
BitVector_SetExtent
BitVector_SetExtentFast
CPClipboard_Changed
CPClipboard_Clear
CPClipboard_ClearItem
CPClipboard_Copy
CPClipboard_Destroy
CPClipboard_GetItem
CPClipboard_GetTotalSize
CPClipboard_Init
CPClipboard_IsEmpty
CPClipboard_ItemExists
CPClipboard_Serialize
CPClipboard_SetChanged
CPClipboard_SetItem
CPClipboard_Unserialize
CPNameUtil_CharReplace
CPNameUtil_ConvertToRoot
CertCreateCertificateContext
CertFreeCertificateContext
CityHash64
CityHash_HashPage
CityHash_HashQuads
CnxUtil_Connect
CnxUtil_MKSDisplayProtocolToString
CnxUtil_UnmungePassword
CnxWin32_FindSocket
CnxWin32_PassFD
Cnx_ClientUsedProxyCmd
Cnx_Connect
Cnx_CreateSocketPair
Cnx_EnforceEarlyAuthdTimeout
Cnx_FreeConnectParams
Cnx_FreeConnection
Cnx_GetClientRandom
Cnx_GetClientRandomParam
Cnx_GetConnectionFD
Cnx_GetHostId
Cnx_GetIPAddress
Cnx_GetLastError
Cnx_GetMKSDisplayProtocol
Cnx_GetNextVerifyParam
Cnx_GetSessionId
Cnx_GetWaitFD
Cnx_IsSSLRequired
Cnx_NewConnectParams
Cnx_NewConnection
Cnx_SetAuthdResponseTimeOut
Cnx_SetClientRandom
Cnx_SetLocalConnectionParams
Cnx_SetNfcConnectParams
Cnx_SetProxyServiceConnectParams
Cnx_SetRemoteConnectionParams2
Cnx_SetRemoteOutboundParams
Cnx_SetSSLRequired
Cnx_SetTCPTimeouts
Cnx_SetVmxConnectParams
Cnx_SetVpxaConnectParams
CoCreateInstanceAsAdmin
CodeSet_CurrentToUtf16le
CodeSet_CurrentToUtf8
CodeSet_GenericToGeneric
CodeSet_GetCurrentCodeSet
CodeSet_Init
CodeSet_Utf16leToCurrent
CodeSet_Utf16leToUtf8
CodeSet_Utf8ToCurrent
CodeSet_Utf8ToUtf16le
CodeSet_Validate
Config_Get
Config_GetBool
Config_GetInt64
Config_GetLong
Config_GetPathName
Config_GetString
Config_GetStringPlain
Config_GetStringSecure
Config_Set
Config_SetBool
Config_SetInt64
Config_SetLong
Config_SetString
Config_SetStringPlain
Config_SetStringSecure
Config_WriteNoMsg
CoreDump_InstallExtraExceptionHandlers
CoreDump_LogFullBacktraceToFunc
CoreDump_LogModules
CoreDump_SetMaxDumpCount
CoreDump_SetUnhandledExceptionFilter
CryptUIDlgViewCertificateW
CryptoCipher_CreateIV
CryptoCipher_FromString
CryptoCipher_GetIVSize
CryptoCipher_GetKeySize
CryptoCipher_InitIV
CryptoCipher_IsAead
CryptoCipher_IsAes
CryptoCipher_SupportsXTS
CryptoCipher_ToString
CryptoDict_CreateAndImport
CryptoDict_Free
CryptoDict_Get
CryptoError_ToMsgString
CryptoError_ToString
CryptoFile_ImportFromFile
CryptoHashState_Create
CryptoHashState_Finish
CryptoHashState_Process
CryptoHash_Compute
CryptoHash_ComputeMD5
CryptoHash_ComputeSHA1
CryptoHash_ComputeSHA256
CryptoHash_FinalMD5
CryptoHash_FinalSHA1
CryptoHash_FinalSHA256
CryptoHash_FromString
CryptoHash_GetOutputSize
CryptoHash_InitMD5
CryptoHash_InitSHA1
CryptoHash_InitSHA256
CryptoHash_SHA1
CryptoHash_SHA256
CryptoHash_SHA512
CryptoHash_ToString
CryptoHash_UpdateMD5
CryptoHash_UpdateSHA1
CryptoHash_UpdateSHA256
CryptoKey_Clone
CryptoKey_Create
CryptoKey_DecryptWithMAC
CryptoKey_EncryptWithMAC
CryptoKey_Export
CryptoKey_Free
CryptoKey_Generate
CryptoKey_GetCipher
CryptoKey_GetKeyData
CryptoKey_Import
CryptoKeyedHash_Compute
CryptoKeyedHash_ComputeIov
CryptoKeyedHash_FromString
CryptoKeyedHash_GetOutputSize
CryptoKeyedHash_HMAC_SHA1
CryptoKeyedHash_HMAC_SHA256
CryptoKeyedHash_ToString
CryptoPass2Key_Compute
CryptoPass2Key_FromString
CryptoPass2Key_MakeKey
CryptoRandom_GetBytes
CryptoSector_CipherCtxCreate
CryptoSector_CipherCtxExpansion
CryptoSector_CipherCtxGenerate
CryptoSector_CipherCtxGetCipher
CryptoSector_CipherCtxGetIV
CryptoSector_CipherCtxGetIVSize
CryptoSector_CipherCtxGetKey
CryptoSector_CipherCtxGrab
CryptoSector_CipherCtxRelease
CryptoSector_Crypt
CryptoSector_HMACDecrypt
CryptoSector_HMACEncrypt
Crypto_Alloc
Crypto_ClearEncryptedPassword
Crypto_DecryptPassword
Crypto_EncryptPassword
Crypto_Free
Crypto_FreeString
Crypto_GetPassword
Crypto_Init
Crypto_InitializeEncryptedPassword
Crypto_ManglePassphrase
Crypto_PasswordUnwrapData
Crypto_PasswordWrapData
Crypto_PasswordWrapDataControl
DDBCreate
DDBDestroy
DDBEnumerate
DDBGet
DDBSet
DataTransform_CreateGZipCompressor
DataTransform_CreateGZipDecompressor
DataTransform_CreateProgrammaticSource
DataTransform_CreateSectorDecryptor
DataTransform_CreateSectorEncryptor
DataTransform_CreateSinkFromFd
DataTransform_CreateSinkFromFile
DataTransform_CreateSourceFromFd
DataTransform_CreateSourceFromFile
DataTransform_CreateZlibCompressor
DataTransform_CreateZlibDecompressor
DataTransform_Destroy
DataTransform_Read
DataTransform_SourceFd
DataTransform_Write
DictLL_ReadLine
DictLL_WriteLine
Dict_GetBool
Dict_GetBoolPlain
Dict_GetBoolSecure
Dict_GetDouble
Dict_GetDoublePlain
Dict_GetDoubleSecure
Dict_GetInt64
Dict_GetInt64Plain
Dict_GetInt64Secure
Dict_GetLong
Dict_GetLongPlain
Dict_GetLongSecure
Dict_GetString
Dict_GetStringEnum
Dict_GetStringPlain
Dict_GetStringSecure
Dict_SetAny
Dict_SetBool
Dict_SetBoolPlain
Dict_SetBoolSecure
Dict_SetDouble
Dict_SetDoublePlain
Dict_SetDoubleSecure
Dict_SetInt64
Dict_SetInt64Plain
Dict_SetInt64Secure
Dict_SetLong
Dict_SetLongPlain
Dict_SetLongSecure
Dict_SetString
Dict_SetStringPlain
Dict_SetStringSecure
Dict_Unset
Dictionary_Clear
Dictionary_ClearPreserveKeys
Dictionary_Clone
Dictionary_Create
Dictionary_Free
Dictionary_Get
Dictionary_GetAsString
Dictionary_IsDefined
Dictionary_IsDefinedWithPrefix
Dictionary_IsEncrypted
Dictionary_Iterate
Dictionary_Load
Dictionary_LoadAndUnlock
Dictionary_LoadEx
Dictionary_LoadFile
Dictionary_LoadFromBuffer
Dictionary_LoadFromBufferEx
Dictionary_LoadFromBufferWithDefaultEncoding
Dictionary_LoadWithDefaultUtf8
Dictionary_NotSet
Dictionary_NumberOfEntries
Dictionary_Rekey
Dictionary_SetEncoding
Dictionary_SetFromString
Dictionary_StringToBool
Dictionary_Unlock
Dictionary_Unset
Dictionary_UnsetWithPrefix
Dictionary_Write
Dictionary_WriteFile
Dictionary_WriteToBuffer
DiskLibCryptoCreateParam_Create
DiskLibCryptoCreateParam_Destroy
DiskLibCryptoCreateParam_GetUserRing
DiskLibCryptoCreateParam_SetCipher
DiskLibCryptoCreateParam_SetCipherFromCipher
DiskLibCryptoCreateParam_SetUserRing
DiskLib_Attach
DiskLib_BaseDBSet
DiskLib_BlockTrackActivate
DiskLib_BlockTrackClone
DiskLib_BlockTrackComputeChanges
DiskLib_BlockTrackDeactivate
DiskLib_BlockTrackEndSession
DiskLib_BlockTrackFileName
DiskLib_BlockTrackFlush
DiskLib_BlockTrackFreeChangeInfo
DiskLib_BlockTrackGetBlockSize
DiskLib_BlockTrackGetChanges
DiskLib_BlockTrackGetEpoch
DiskLib_BlockTrackGetFD
DiskLib_BlockTrackIncrementEpoch
DiskLib_BlockTrackIsActive
DiskLib_BlockTrackMakeFileName
DiskLib_BlockTrackMapAllChanges
DiskLib_BlockTrackMerge
DiskLib_BlockTrackMergeChanges
DiskLib_BlockTrackQuerySession
DiskLib_BlockTrackRdmClone
DiskLib_BlockTrackReset
DiskLib_BlockTrackSetChanges
DiskLib_BlockTrackSetFD
DiskLib_BlockTrackSetFileName
DiskLib_BlockTrackStartCombine
DiskLib_BlockTrackStartSession
DiskLib_BottomLinkSpaceUsed
DiskLib_ChainDBSet
DiskLib_ChangeFilterPolicy
DiskLib_ChangePolicy
DiskLib_ChangePolicyWithHandle
DiskLib_Check
DiskLib_CheckResultsFree
DiskLib_CleanupCryptoCreateParams
DiskLib_Clone
DiskLib_CloneChild
DiskLib_CloneChildWithDestParent
DiskLib_CloneChildWithWorldID
DiskLib_CloneCreateObjExtParams
DiskLib_CloneCreateParam
DiskLib_CloneFilters
DiskLib_CloneWithWorldID
DiskLib_Close
DiskLib_Combine
DiskLib_CombineCancel
DiskLib_CombineNextChunk
DiskLib_ConsolidateVVolDisks
DiskLib_ConvertAllocationType
DiskLib_ConvertCancel
DiskLib_ConvertCommit
DiskLib_ConvertStart
DiskLib_CopyData
DiskLib_CopyObjExtParams
DiskLib_Create
DiskLib_CreateChild
DiskLib_CreateChildCreateParam
DiskLib_CreateChildOrCloneCrypto
DiskLib_CreateDigestObjExtParams
DiskLib_CreateObjExtParams
DiskLib_CreateParamGetOrSet
DiskLib_CreateSibling
DiskLib_CreateTypeStr
DiskLib_DBCopy
DiskLib_DBCopyIgnoreKey
DiskLib_DBEntriesRemove
DiskLib_DBEntriesSet
DiskLib_DBEnum
DiskLib_DBGet
DiskLib_DBGetUint32
DiskLib_DBRemove
DiskLib_DBRemoveDelayed
DiskLib_DBSet
DiskLib_DBSetDelayed
DiskLib_DBSetDelimited
DiskLib_Defragment
DiskLib_DigestCheck
DiskLib_DigestDisable
DiskLib_DigestDiskAttach
DiskLib_DigestEnable
DiskLib_DigestEnableWithParam
DiskLib_DigestFreeDiskError
DiskLib_DigestFreeInfo
DiskLib_DigestGetDefaultConfigOptions
DiskLib_DigestGetHashByOffset
DiskLib_DigestGetInfo
DiskLib_DigestNeedRecompute
DiskLib_DigestRecompute
DiskLib_DigestRecomputeWithParam
DiskLib_DigestReconstructChain
DiskLib_DisableUpit
DiskLib_DiskSpaceUsed
DiskLib_DoFilterPrivateOp
DiskLib_EnableUpit
DiskLib_EnumExtents
DiskLib_EnumExtentsFilesOnly
DiskLib_EnumExtentsFromHandle
DiskLib_EnumIOFilters
DiskLib_EnumIOFiltersWithHandle
DiskLib_Err2MsgString
DiskLib_Err2Name
DiskLib_Err2String
DiskLib_Exit
DiskLib_FileAllocTypeIsThin
DiskLib_FileAllocTypeToAllocType
DiskLib_FinalizeCopiedChild
DiskLib_FixDescriptorAfterCombine
DiskLib_FlushFilters
DiskLib_ForceLoadFilters
DiskLib_FreeInfo
DiskLib_FreeObjExtParams
DiskLib_FreePartitionList
DiskLib_FreeSpaceUsedNodeArray
DiskLib_GenerateDigestFileName
DiskLib_GenerateUUID
DiskLib_GetAdapterType
DiskLib_GetAllocatedChunks
DiskLib_GetAllocatedChunksAll
DiskLib_GetAllocatedChunksBeginHint
DiskLib_GetAllocatedChunksEndHint
DiskLib_GetCompressAlgorithm
DiskLib_GetContentID
DiskLib_GetDigestAttachOptions
DiskLib_GetDigestDiskHandle
DiskLib_GetDiskCreateTypeAtOffset
DiskLib_GetDiskFHIDAtOffset
DiskLib_GetDiskPathAtOffset
DiskLib_GetEncryptionKey
DiskLib_GetFileAllocTypeAtOffset
DiskLib_GetFiltLibContext
DiskLib_GetFragmentation
DiskLib_GetGeometry
DiskLib_GetInfo
DiskLib_GetKeyID
DiskLib_GetKeySafe
DiskLib_GetNASVAAISupportStatus
DiskLib_GetObjectId
DiskLib_GetObjectIdByFilename
DiskLib_GetParentFullPath
DiskLib_GetPartitionListFromDevice

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 291KB - Virtual size: 531KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 329KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5450eb3b06cfe3a8cad7618a247ad2ec

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:57:97:42:a9:53:ba:d9:0d:42:37:a3:f3:e3:8c:5eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

65:52:5c:df:5c:a9:9f:24:48:9a:cb:07:ec:71:7c:91:a2:ea:39:35:22:f8:96:e6:62:58:f2:5c:c1:34:39:16Signer

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

vcruntime140

ws2_32

kernel32

user32

advapi32

shell32

api-ms-win-crt-multibyte-l1-1-0

ole32

oleaut32

libssl-3

libcrypto-3

libxml2

zlib1

iphlpapi

msvcp140

gdi32

winmm

wininet

mpr

userenv

setupapi

bcrypt

crypt32

winhttp

cryptui

winscard

Exports

Exports

Sections

.text Size: 4.3MB - Virtual size: 4.3MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 291KB - Virtual size: 531KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 329KB - Virtual size: 328KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:57:97:42:a9:53:ba:d9:0d:42:37:a3:f3:e3:8c:5e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

65:52:5c:df:5c:a9:9f:24:48:9a:cb:07:ec:71:7c:91:a2:ea:39:35:22:f8:96:e6:62:58:f2:5c:c1:34:39:16
Signer

.text
Size: 4.3MB - Virtual size: 4.3MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 291KB - Virtual size: 531KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 329KB - Virtual size: 328KB