Ardamax Keylogger[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Ardamax Keylogger.zip
Size

3.8MB
MD5

68fa47e0e4db8e51e4b8830c73d56749
SHA1

791cdc9747ad93b6b6ce01f4a3441dd9a27cc2f9
SHA256

b9875815b28aab3fe4d583df7f604c9099822b46c593c2592bc30b8774e7ea18
SHA512

b4b8e7f5f0d3671e09ae4afd28eb4f3c4155364ef131d5416a8f33651a2c474384f57d4ae5c158d970be8d9653967166e44882a8462e46e048130ec5bebb0899
SSDEEP

98304:Ncu0bsQ+riso1bjgdo8bRcvZWD8seQg+nzKYqj6L30iPVI5k:yu0yCjio6GZWDrgYlT0SIy

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Ardamax Keylogger/AKV.exe
unpack001/Ardamax Keylogger/SUS.01
unpack001/Ardamax Keylogger/SUS.02
unpack001/Ardamax Keylogger/SUS.exe
unpack001/Ardamax Keylogger/SUS.exe.BAK
unpack001/Ardamax Keylogger/Uninstall.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/Ardamax Keylogger/Uninstall.exe	nsis_installer_1
static1/unpack001/Ardamax Keylogger/Uninstall.exe	nsis_installer_2

Files

Ardamax Keylogger.zip
.zip
Ardamax Keylogger/AKV.00
Ardamax Keylogger/AKV.exe
.exe windows:5 windows x86 arch:x86

eca09c4add025206e74dcb1ce7cbcfff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveExtensionW
PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW

comctl32

ImageList_AddMasked
CreateStatusWindowW
ImageList_Draw
ImageList_Add
ImageList_Replace
ImageList_Create
InitCommonControlsEx
ImageList_Destroy
ImageList_GetImageCount

shell32

ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW

winmm

waveOutRestart
waveOutOpen
waveOutPrepareHeader
waveOutGetPosition
waveOutReset
waveOutUnprepareHeader
waveOutSetVolume
waveOutPause
waveOutWrite
waveOutClose

kernel32

GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
SetLastError
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
lstrcmpW
LoadLibraryW
CloseHandle
UnmapViewOfFile
lstrcpynA
lstrlenA
lstrcpynW
MulDiv
lstrcpyW
GetCurrentProcessId
LocalFileTimeToFileTime
SystemTimeToFileTime
MapViewOfFileEx
DuplicateHandle
WaitForSingleObject
CreateFileW
WriteFile
SetFilePointer
CreateFileMappingW
GetFileSize
FindNextFileW
FindClose
GetFullPathNameW
FindFirstFileW
Sleep
GetSystemTimeAsFileTime
HeapFree
HeapReAlloc
HeapAlloc
GlobalUnlock
CreateThread
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
ExitProcess
HeapCreate
HeapDestroy
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
RtlUnwind
VirtualQuery
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
LoadLibraryA
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateFileA
FlushFileBuffers
GetProcessHeap
InterlockedCompareExchange
IsProcessorFeaturePresent
GlobalFree
FreeResource
GetVersionExW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTimeFormatW
FileTimeToSystemTime
GetDateFormatW
FileTimeToLocalFileTime
ReadFile
GetLastError
GetLocaleInfoW
EnumResourceLanguagesW
VirtualAlloc
GetCurrentProcess
FlushInstructionCache
VirtualFree
lstrlenW
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
RaiseException
ExitThread
SetEndOfFile

user32

UpdateWindow
InvalidateRect
EnableWindow
GetDlgItem
GetDC
SetMenuItemInfoW
GetMenuItemInfoW
SetMenuDefaultItem
DestroyCursor
LoadStringW
SetFocus
PostQuitMessage
LoadStringA
CreatePopupMenu
RemoveMenu
GetMenuItemCount
MonitorFromPoint
TrackPopupMenuEx
ModifyMenuW
AppendMenuW
IsMenu
SetRectEmpty
ReleaseDC
GetWindowDC
MessageBeep
PtInRect
ScreenToClient
SetCapture
ReleaseCapture
InflateRect
FillRect
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
BeginPaint
EndPaint
GetCapture
TrackPopupMenu
EnableMenuItem
IsWindowEnabled
GetWindowTextW
SetCursor
CopyRect
GetSysColorBrush
DrawTextW
DrawEdge
SetRect
GetSysColor
OffsetRect
GetMessagePos
SystemParametersInfoW
RedrawWindow
GetDlgCtrlID
DestroyCaret
ScrollWindowEx
SetScrollPos
GetScrollInfo
SetScrollInfo
GetCursorPos
GetClassNameW
IsWindowVisible
GetWindowThreadProcessId
GetFocus
DrawFrameControl
FrameRect
WindowFromPoint
RegisterWindowMessageW
UnhookWindowsHookEx
CharLowerW
GetKeyState
CallNextHookEx
SetWindowsHookExW
GetSubMenu
DrawFocusRect
GetWindowTextLengthW
CreateDialogIndirectParamW
LoadIconW
LoadMenuW
UnregisterClassA
GetWindowPlacement
SetMenu
GetMenu
PostMessageW
GetActiveWindow
DestroyMenu
GetSystemMetrics
CallWindowProcW
SendMessageW
MoveWindow
EndDialog
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
GetParent
SetDlgItemTextW
GetDlgItemTextW
SetWindowTextW
DialogBoxIndirectParamW
CreateWindowExW
GetClassInfoExW
LoadCursorW
LoadImageW
RegisterClassExW
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DefWindowProcW
IsWindow
MessageBoxW
ShowWindow
SetWindowPlacement
DestroyWindow
GetWindowLongW
SetWindowLongW
wvsprintfW
CharUpperW
MapVirtualKeyW
GetKeyNameTextW
DispatchMessageW

gdi32

LineTo
SetBkMode
DeleteDC
GetTextExtentPoint32W
GetObjectW
CreateDIBitmap
GetDeviceCaps
GetStockObject
CreateBitmap
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
CreateSolidBrush
StretchBlt
SetStretchBltMode
BitBlt
MoveToEx
GetCurrentObject
SetBkColor
SetViewportOrgEx
SetBrushOrgEx
CreateDIBSection
CreateFontW
PatBlt
CreatePen
CreateFontIndirectW
SetTextColor
Polygon
DeleteObject
CreatePatternBrush

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW

ole32

CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx

oleaut32

VariantClear
VarUI4FromStr

Sections

.text
Size: 443KB - Virtual size: 442KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ardamax Keylogger/SUS.00
Ardamax Keylogger/SUS.01
.dll windows:5 windows x86 arch:x86

5b675782ba18eeafe18371a3084cec70

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualFree
FlushInstructionCache
GetCurrentProcess
VirtualAlloc
FreeLibrary
lstrcatW
LoadLibraryW
GetSystemDirectoryW
GetCurrentThreadId
GetCurrentProcessId
RtlUnwind
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
lstrlenW
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
RaiseException
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
CreateFileA
CloseHandle
FlushFileBuffers
GetModuleHandleW
GetProcAddress
FreeEnvironmentStringsA
WideCharToMultiByte

user32

PostMessageW
keybd_event
ToUnicodeEx
GetKeyboardState
AttachThreadInput
IsWindow
ActivateKeyboardLayout
GetKeyboardLayout
GetWindowThreadProcessId
GetForegroundWindow
GetFocus
RegisterWindowMessageW
GetKeyboardLayoutNameW
GetKeyState
GetAsyncKeyState
MapVirtualKeyW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

Exports

Exports

_fij7@0
_fmb4@4
_fml10@4
_fps5@0
_fsd6@4
_fsm11@0

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ardamax Keylogger/SUS.02
.dll windows:5 windows x86 arch:x86

5ffd58b2831a2f8f02e40a8d541e33fb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte
GetProcAddress
GetModuleHandleW
lstrlenW
VirtualFree
FlushInstructionCache
GetCurrentProcess
VirtualAlloc
GetModuleHandleA
lstrcmpW
DeleteCriticalSection
GetCurrentThreadId
GetCommandLineA
GetLastError
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Exports

Exports

fcd3
fey2

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ardamax Keylogger/SUS.exe
.exe windows:5 windows x86 arch:x86

680f0d8982f3fafa00f3bbe32cc0afc2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAddBackslashW
PathStripPathW
PathFindExtensionW
PathRenameExtensionW
PathRemoveFileSpecW
PathFindFileNameW
PathMatchSpecW
StrCpyW
UrlIsW
StrCmpIW
StrDupW
StrFormatByteSizeW
PathRemoveExtensionW
PathFileExistsW

psapi

EnumProcessModules
GetModuleFileNameExW
EnumProcesses

ws2_32

getservbyname
socket
htons
WSACleanup
WSASetLastError
shutdown
inet_ntoa
inet_addr
gethostbyname
ioctlsocket
connect
WSAGetLastError
getpeername
__WSAFDIsSet
select
recv
send
gethostname
closesocket
WSAStartup

comctl32

ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
CreatePropertySheetPageW
ImageList_DrawIndirect
ImageList_Draw
ImageList_GetIconSize
PropertySheetW
_TrackMouseEvent
DestroyPropertySheetPage
InitCommonControlsEx
ImageList_ReplaceIcon

shell32

ShellExecuteW
SHGetSpecialFolderLocation
Shell_NotifyIconW
SHBrowseForFolderW
ExtractIconW
DoEnvironmentSubstW
SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteExW
SHGetPathFromIDListW

wininet

InternetGetLastResponseInfoW
InternetOpenW
InternetConnectW
FtpSetCurrentDirectoryW
FtpDeleteFileW
FtpRemoveDirectoryW
FtpCreateDirectoryW
FtpPutFileW
InternetCloseHandle

mpr

WNetAddConnection2W
WNetCancelConnection2W

winmm

waveInOpen
waveInStart
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveInStop
waveInClose
mixerGetLineInfoW
mixerGetLineControlsW
mixerSetControlDetails
waveInGetNumDevs
waveInGetDevCapsW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

ReadConsoleInputA
SetConsoleMode
FindFirstFileA
GetDriveTypeA
GetFullPathNameA
GetCurrentDirectoryA
FlushFileBuffers
FlushConsoleInputBuffer
GetVersionExA
GlobalMemoryStatus
IsProcessorFeaturePresent
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringA
GetProcessHeap
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InterlockedExchange
InitializeCriticalSectionAndSpinCount
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
GetProcAddress
GetModuleHandleW
lstrlenW
VirtualFree
FlushInstructionCache
GetCurrentProcess
VirtualAlloc
GetLastError
MultiByteToWideChar
FreeResource
EnumResourceLanguagesW
GetLocaleInfoW
ReadFile
CloseHandle
CreateFileW
GetFileSize
lstrcpyW
FindNextFileW
FindClose
SetLastError
GetFullPathNameW
FindFirstFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetVersion
LoadLibraryW
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
LoadLibraryExW
GetModuleFileNameW
GlobalFree
GlobalUnlock
CompareStringW
CreateDirectoryW
WriteFile
lstrcatW
lstrcpynW
GetVersionExW
lstrcmpW
DeleteFileW
GlobalLock
GetDateFormatW
CreateMutexW
EnumResourceNamesW
LocalReAlloc
LocalAlloc
LocalFree
SetFilePointer
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
GetTimeFormatW
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetWindowsDirectoryW
MoveFileExW
FormatMessageW
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetEnvironmentVariableW
GetShortPathNameW
ExitProcess
SetFileAttributesW
GetCurrentProcessId
RemoveDirectoryW
GetSystemTimeAsFileTime
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
OpenProcess
GlobalSize
MoveFileW
WaitForSingleObject
TerminateThread
GetTickCount
QueryDosDeviceW
GetVolumeInformationW
OutputDebugStringA
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetStartupInfoW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetModuleHandleA
HeapCreate
HeapDestroy
HeapSize
Sleep
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
VirtualQuery
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
SetConsoleCtrlHandler
LoadLibraryA
GetLocaleInfoA
LCMapStringA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale

user32

GetWindowRect
InvalidateRect
GetParent
CopyRect
InflateRect
OffsetRect
DrawFocusRect
FillRect
DrawTextW
DrawFrameControl
GetMonitorInfoW
MonitorFromPoint
TrackPopupMenu
GetWindowDC
ReleaseDC
GetClassLongW
GetSystemMetrics
SetRectEmpty
GetSysColor
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
ScreenToClient
UpdateWindow
IsWindowEnabled
SetCapture
SetFocus
GetDlgCtrlID
IsWindow
SetWindowPos
PtInRect
SetCursor
GetCursorPos
BeginPaint
EndPaint
GetDC
ReleaseCapture
GetCapture
GetFocus
GetClassNameW
SystemParametersInfoW
GetSysColorBrush
GetDlgItemTextW
SetDlgItemTextW
MapWindowPoints
MonitorFromWindow
GetWindow
EndDialog
GetDlgItem
SetTimer
OpenClipboard
EnableWindow
LoadImageW
DialogBoxIndirectParamW
PostQuitMessage
ModifyMenuW
GetSubMenu
GetDlgItemInt
SetDlgItemInt
MessageBeep
GetActiveWindow
IsWindowVisible
ShowScrollBar
RedrawWindow
FrameRect
GetMenu
AdjustWindowRectEx
ShowWindow
CreateIconFromResource
LookupIconIdFromDirectory
KillTimer
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
MoveWindow
ScrollWindow
SetForegroundWindow
FindWindowW
GetKeyNameTextW
MapVirtualKeyW
CharUpperW
wsprintfW
BroadcastSystemMessageW
RegisterWindowMessageW
DdeUninitialize
DdeFreeStringHandle
DdeDisconnect
DdeAccessData
DdeClientTransaction
DdeGetLastError
DdeConnect
DdeCreateStringHandleW
DdeInitializeW
FindWindowExW
EnumWindows
GetAncestor
GetWindowThreadProcessId
SendMessageTimeoutW
EnumChildWindows
GetDesktopWindow
ChangeClipboardChain
SetClipboardViewer
GetForegroundWindow
GetLastInputInfo
CreatePopupMenu
InsertMenuItemW
SetMenu
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
TrackPopupMenuEx
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
IsMenu
GetMenuItemID
DrawEdge
WindowFromPoint
GetMessagePos
CharLowerW
GetKeyState
UnregisterClassA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
CallWindowProcW
DestroyMenu
DestroyIcon
RegisterHotKey
UnregisterHotKey
SendMessageW
MessageBoxW
PostMessageW
GetWindowLongW
CreateWindowExW
RegisterClassExW
DestroyWindow
CharNextW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
GetClassInfoExW
SetWindowLongW
LoadMenuW

gdi32

RealizePalette
GetDIBits
CreatePatternBrush
GetDeviceCaps
GetTextExtentPoint32W
GetCurrentObject
LineTo
MoveToEx
CreateDIBitmap
TextOutW
CreateDIBSection
CreateBitmap
DeleteObject
SetBrushOrgEx
CreateSolidBrush
CreatePen
Polygon
CombineRgn
CreateRectRgnIndirect
ExcludeClipRect
SelectObject
SetPolyFillMode
SetBkMode
PatBlt
RoundRect
SetBkColor
ExtTextOutW
CreateCompatibleBitmap
GetTextMetricsW
BitBlt
CreateCompatibleDC
CreateFontW
GetStockObject
CreateFontIndirectW
GetObjectW
DeleteDC
SetTextColor

comdlg32

GetSaveFileNameW
GetOpenFileNameW

ole32

CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx

oleaut32

VarCmp
SysFreeString
VariantClear
VarUI4FromStr
VariantInit

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 389KB - Virtual size: 389KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 466KB - Virtual size: 466KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ardamax Keylogger/SUS.exe.BAK
.exe windows:5 windows x86 arch:x86

680f0d8982f3fafa00f3bbe32cc0afc2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAddBackslashW
PathStripPathW
PathFindExtensionW
PathRenameExtensionW
PathRemoveFileSpecW
PathFindFileNameW
PathMatchSpecW
StrCpyW
UrlIsW
StrCmpIW
StrDupW
StrFormatByteSizeW
PathRemoveExtensionW
PathFileExistsW

psapi

EnumProcessModules
GetModuleFileNameExW
EnumProcesses

ws2_32

getservbyname
socket
htons
WSACleanup
WSASetLastError
shutdown
inet_ntoa
inet_addr
gethostbyname
ioctlsocket
connect
WSAGetLastError
getpeername
__WSAFDIsSet
select
recv
send
gethostname
closesocket
WSAStartup

comctl32

ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
CreatePropertySheetPageW
ImageList_DrawIndirect
ImageList_Draw
ImageList_GetIconSize
PropertySheetW
_TrackMouseEvent
DestroyPropertySheetPage
InitCommonControlsEx
ImageList_ReplaceIcon

shell32

ShellExecuteW
SHGetSpecialFolderLocation
Shell_NotifyIconW
SHBrowseForFolderW
ExtractIconW
DoEnvironmentSubstW
SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteExW
SHGetPathFromIDListW

wininet

InternetGetLastResponseInfoW
InternetOpenW
InternetConnectW
FtpSetCurrentDirectoryW
FtpDeleteFileW
FtpRemoveDirectoryW
FtpCreateDirectoryW
FtpPutFileW
InternetCloseHandle

mpr

WNetAddConnection2W
WNetCancelConnection2W

winmm

waveInOpen
waveInStart
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveInStop
waveInClose
mixerGetLineInfoW
mixerGetLineControlsW
mixerSetControlDetails
waveInGetNumDevs
waveInGetDevCapsW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

ReadConsoleInputA
SetConsoleMode
FindFirstFileA
GetDriveTypeA
GetFullPathNameA
GetCurrentDirectoryA
FlushFileBuffers
FlushConsoleInputBuffer
GetVersionExA
GlobalMemoryStatus
IsProcessorFeaturePresent
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringA
GetProcessHeap
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InterlockedExchange
InitializeCriticalSectionAndSpinCount
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
GetProcAddress
GetModuleHandleW
lstrlenW
VirtualFree
FlushInstructionCache
GetCurrentProcess
VirtualAlloc
GetLastError
MultiByteToWideChar
FreeResource
EnumResourceLanguagesW
GetLocaleInfoW
ReadFile
CloseHandle
CreateFileW
GetFileSize
lstrcpyW
FindNextFileW
FindClose
SetLastError
GetFullPathNameW
FindFirstFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetVersion
LoadLibraryW
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
LoadLibraryExW
GetModuleFileNameW
GlobalFree
GlobalUnlock
CompareStringW
CreateDirectoryW
WriteFile
lstrcatW
lstrcpynW
GetVersionExW
lstrcmpW
DeleteFileW
GlobalLock
GetDateFormatW
CreateMutexW
EnumResourceNamesW
LocalReAlloc
LocalAlloc
LocalFree
SetFilePointer
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
GetTimeFormatW
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetWindowsDirectoryW
MoveFileExW
FormatMessageW
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetEnvironmentVariableW
GetShortPathNameW
ExitProcess
SetFileAttributesW
GetCurrentProcessId
RemoveDirectoryW
GetSystemTimeAsFileTime
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
OpenProcess
GlobalSize
MoveFileW
WaitForSingleObject
TerminateThread
GetTickCount
QueryDosDeviceW
GetVolumeInformationW
OutputDebugStringA
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetStartupInfoW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetModuleHandleA
HeapCreate
HeapDestroy
HeapSize
Sleep
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
VirtualQuery
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
SetConsoleCtrlHandler
LoadLibraryA
GetLocaleInfoA
LCMapStringA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale

user32

GetWindowRect
InvalidateRect
GetParent
CopyRect
InflateRect
OffsetRect
DrawFocusRect
FillRect
DrawTextW
DrawFrameControl
GetMonitorInfoW
MonitorFromPoint
TrackPopupMenu
GetWindowDC
ReleaseDC
GetClassLongW
GetSystemMetrics
SetRectEmpty
GetSysColor
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
ScreenToClient
UpdateWindow
IsWindowEnabled
SetCapture
SetFocus
GetDlgCtrlID
IsWindow
SetWindowPos
PtInRect
SetCursor
GetCursorPos
BeginPaint
EndPaint
GetDC
ReleaseCapture
GetCapture
GetFocus
GetClassNameW
SystemParametersInfoW
GetSysColorBrush
GetDlgItemTextW
SetDlgItemTextW
MapWindowPoints
MonitorFromWindow
GetWindow
EndDialog
GetDlgItem
SetTimer
OpenClipboard
EnableWindow
LoadImageW
DialogBoxIndirectParamW
PostQuitMessage
ModifyMenuW
GetSubMenu
GetDlgItemInt
SetDlgItemInt
MessageBeep
GetActiveWindow
IsWindowVisible
ShowScrollBar
RedrawWindow
FrameRect
GetMenu
AdjustWindowRectEx
ShowWindow
CreateIconFromResource
LookupIconIdFromDirectory
KillTimer
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
MoveWindow
ScrollWindow
SetForegroundWindow
FindWindowW
GetKeyNameTextW
MapVirtualKeyW
CharUpperW
wsprintfW
BroadcastSystemMessageW
RegisterWindowMessageW
DdeUninitialize
DdeFreeStringHandle
DdeDisconnect
DdeAccessData
DdeClientTransaction
DdeGetLastError
DdeConnect
DdeCreateStringHandleW
DdeInitializeW
FindWindowExW
EnumWindows
GetAncestor
GetWindowThreadProcessId
SendMessageTimeoutW
EnumChildWindows
GetDesktopWindow
ChangeClipboardChain
SetClipboardViewer
GetForegroundWindow
GetLastInputInfo
CreatePopupMenu
InsertMenuItemW
SetMenu
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
TrackPopupMenuEx
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
IsMenu
GetMenuItemID
DrawEdge
WindowFromPoint
GetMessagePos
CharLowerW
GetKeyState
UnregisterClassA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
CallWindowProcW
DestroyMenu
DestroyIcon
RegisterHotKey
UnregisterHotKey
SendMessageW
MessageBoxW
PostMessageW
GetWindowLongW
CreateWindowExW
RegisterClassExW
DestroyWindow
CharNextW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
GetClassInfoExW
SetWindowLongW
LoadMenuW

gdi32

RealizePalette
GetDIBits
CreatePatternBrush
GetDeviceCaps
GetTextExtentPoint32W
GetCurrentObject
LineTo
MoveToEx
CreateDIBitmap
TextOutW
CreateDIBSection
CreateBitmap
DeleteObject
SetBrushOrgEx
CreateSolidBrush
CreatePen
Polygon
CombineRgn
CreateRectRgnIndirect
ExcludeClipRect
SelectObject
SetPolyFillMode
SetBkMode
PatBlt
RoundRect
SetBkColor
ExtTextOutW
CreateCompatibleBitmap
GetTextMetricsW
BitBlt
CreateCompatibleDC
CreateFontW
GetStockObject
CreateFontIndirectW
GetObjectW
DeleteDC
SetTextColor

comdlg32

GetSaveFileNameW
GetOpenFileNameW

ole32

CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx

oleaut32

VarCmp
SysFreeString
VariantClear
VarUI4FromStr
VariantInit

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 389KB - Virtual size: 389KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 466KB - Virtual size: 466KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ardamax Keylogger/Uninstall.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ardamax Keylogger/ardamax.keylogger.4.0-patch.exe
.exe windows:5 windows x86 arch:x86

dc73a9bd8de0fd640549c85ac4089b87

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6a:43:bc:c9:22:92:c6:06:2d:36:aa:3f:5e:30:23:90
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

21/05/2010, 00:00

Not After

07/08/2012, 23:59

Subject

CN=AoRE Team \ ,OU=Acunetix Development Department,O=AoRE Team \ ,L=Ta' Xbiex,ST=Malta,C=MT

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6a:85:03:b4:48:ad:4e:d8:5c:8f:31:99:e8:97:d9:01:59:8b:b1:09
Signer

Actual PE Digest

6a:85:03:b4:48:ad:4e:d8:5c:8f:31:99:e8:97:d9:01:59:8b:b1:09

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile

Sections

.text
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eca09c4add025206e74dcb1ce7cbcfff

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

comctl32

shell32

winmm

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

Sections

.text Size: 443KB - Virtual size: 442KB

.rdata Size: 109KB - Virtual size: 109KB

.data Size: 46KB - Virtual size: 120KB

.rsrc Size: 154KB - Virtual size: 154KB

5b675782ba18eeafe18371a3084cec70

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 55KB - Virtual size: 55KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 4B

.reloc Size: 6KB - Virtual size: 5KB

5ffd58b2831a2f8f02e40a8d541e33fb

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 35KB - Virtual size: 35KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 1024B - Virtual size: 528B

.reloc Size: 5KB - Virtual size: 4KB

680f0d8982f3fafa00f3bbe32cc0afc2

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

psapi

ws2_32

comctl32

shell32

wininet

mpr

winmm

version

kernel32

user32

gdi32

comdlg32

ole32

oleaut32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 389KB - Virtual size: 389KB

.data Size: 73KB - Virtual size: 278KB

.rsrc Size: 466KB - Virtual size: 466KB

680f0d8982f3fafa00f3bbe32cc0afc2

.text
Size: 443KB - Virtual size: 442KB

.rdata
Size: 109KB - Virtual size: 109KB

.data
Size: 46KB - Virtual size: 120KB

.rsrc
Size: 154KB - Virtual size: 154KB

.text
Size: 55KB - Virtual size: 55KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 4B

.reloc
Size: 6KB - Virtual size: 5KB

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1024B - Virtual size: 528B

.reloc
Size: 5KB - Virtual size: 4KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 389KB - Virtual size: 389KB

.data
Size: 73KB - Virtual size: 278KB

.rsrc
Size: 466KB - Virtual size: 466KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 389KB - Virtual size: 389KB

.data
Size: 73KB - Virtual size: 278KB

.rsrc
Size: 466KB - Virtual size: 466KB

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 92KB

.rsrc
Size: 6KB - Virtual size: 6KB

0a
Certificate

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

6a:43:bc:c9:22:92:c6:06:2d:36:aa:3f:5e:30:23:90
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

6a:85:03:b4:48:ad:4e:d8:5c:8f:31:99:e8:97:d9:01:59:8b:b1:09
Signer

.text
Size: 512B - Virtual size: 502B

.rdata
Size: 512B - Virtual size: 472B

.data
Size: 512B - Virtual size: 52B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 512B - Virtual size: 82B