1a9add9e71db5cc1148f520b0d0064801d254c7b6fdb2730a53db1bb48fb9091

Sharing

Copy URL Twitter E-mail

General

Target

1a9add9e71db5cc1148f520b0d0064801d254c7b6fdb2730a53db1bb48fb9091
Size

6.4MB
MD5

d4f170b776865bba1bc8bb9aa7b193af
SHA1

934ca67e807ca483bb41b0d53d64f9c0ff929824
SHA256

1a9add9e71db5cc1148f520b0d0064801d254c7b6fdb2730a53db1bb48fb9091
SHA512

7941603a31269d781af241e49de8a89dd9ae1d2ac8001b8f40dba1110380ac82d13890d5fd97a51f15549a0c61f8b09c52608374da12bc6c5e4ca11e30d8fda5
SSDEEP

98304:SifoC9H6JmjHIPhzdGciBgUFwp+ltHoEG8NetR4zmhDvs0:nft9ZjHezJ0gZpkobOe7pDvf

Score

1^/10

Malware Config

Signatures

Files

1a9add9e71db5cc1148f520b0d0064801d254c7b6fdb2730a53db1bb48fb9091
.dll regsvr32 windows:6 windows x86 arch:x86

9e0d4ec7f609b9a2ae153c46b9bd530b

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

28/07/2022, 08:56

Not After

27/07/2033, 08:56

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

20/12/2022, 08:57

Not After

18/03/2025, 08:54

Subject

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

20/12/2022, 08:57

Not After

18/03/2025, 08:54

Subject

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:4f:96:03:6d:21:9b:9a:53:68:ec:ef:d7:ea:55:eb:a7:5b:f4:5a:ca:0a:16:fa:18:56:f1:95:0e:ee:62:bb
Signer

Actual PE Digest

2c:4f:96:03:6d:21:9b:9a:53:68:ec:ef:d7:ea:55:eb:a7:5b:f4:5a:ca:0a:16:fa:18:56:f1:95:0e:ee:62:bb

Digest Algorithm

sha256

PE Digest Matches

false

b6:2d:1c:1f:05:0b:83:04:cb:9d:0d:4a:64:2f:ae:da:d3:78:9d:3b
Signer

Actual PE Digest

b6:2d:1c:1f:05:0b:83:04:cb:9d:0d:4a:64:2f:ae:da:d3:78:9d:3b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

bull140u

?XLogMonitor@BULL@@YAJ_KPB_W11111111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W111111111111@Z
?GetLogController@BULL@@YAJPAPAUILogController@1@@Z
?RegisterObject@BULL@@YAJABU_GUID@@0P6GJPAX0PAPAX@ZPB_W@Z
?MultiByteToWideChar@BULL@@YAJIPBDPAPA_W@Z
?MD5@BULL@@YAJPAUIGeneralBuffer@1@PAPAU21@@Z
?Base64Decode@BULL@@YAJPA_WPAPAUIGeneralBuffer@1@@Z
?Base64Encode@BULL@@YAJPAUIGeneralBuffer@1@PAPA_WK@Z
?RC4Decrypt@BULL@@YAJPA_W0PAPA_W@Z
?RC4Encrypt@BULL@@YAJPA_W0PAPA_W@Z
?MultiByteToWideChar@BULL@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@IPBD@Z
?WideCharToMultiByte@BULL@@YA?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@IPB_W@Z
?CreateGuid@BULL@@YA?AU_GUID@@XZ
?GuidToString@BULL@@YAPA_WABU_GUID@@@Z
?KillTimer@BULL@@YAJK@Z
?SetTimer@BULL@@YAJK_NPAUICallbackTimer@1@KPAK@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W1111111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W111111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W11111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W1111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W11@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W1@Z
?GetNamedObject@BULL@@YAJPA_WABU_GUID@@1PAPAX@Z
?XLogV@BULL@@YAXIPB_W0PAD@Z
?AssertOut@BULL@@YAJPB_WH_N0@Z
?XLogMonitor@BULL@@YAJ_KPB_W11111111111@Z
?CreateObjectNative@BULL@@YAJABU_GUID@@0PAPAX@Z

ws2_32

recv
closesocket
WSACleanup
WSACreateEvent
send
WSASetLastError
WSAGetLastError

crypt32

CertOpenStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertCloseStore
CertGetNameStringW
CertFreeCertificateContext

ximage

?Save@CxImage@@QAE_NPB_WK@Z
?Crop@CxImage@@QAE_NJJJJPAV1@@Z
?Thumbnail@CxImage@@QAE_NJJUtagRGBQUAD@@PAV1@@Z
?Load@CxImage@@QAE_NPB_WK@Z
?GetTypeIdFromName@CxImage@@SAKPB_W@Z
?GetHeight@CxImage@@QBEKXZ
?DestroyFrames@CxImage@@QAE_NXZ
?Destroy@CxImage@@QAE_NXZ
??0CxImage@@QAE@K@Z
?GetWidth@CxImage@@QBEKXZ

kernel32

InitializeSListHead
IsProcessorFeaturePresent
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetTickCount
FindResourceExW
FreeLibrary
GetProcAddress
LoadResource
LockResource
SizeofResource
LoadLibraryW
FindResourceW
GetLastError
GetVersionExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
GetTempPathW
CloseHandle
WaitForSingleObjectEx
QueueUserAPC
CreateFileW
GetLongPathNameW
CancelIo
SetEvent
ResetEvent
WaitForSingleObject
SleepEx
CreateEventW
GetCurrentProcess
WaitForMultipleObjects
lstrlenW
ReadDirectoryChangesW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFullPathNameW
SetLastError
Sleep
RemoveDirectoryW
FlushFileBuffers
GetFileSize
SetEndOfFile
SetFilePointer
FlushInstructionCache
GetModuleHandleW
LoadLibraryExA
VirtualFree
OutputDebugStringW
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
GlobalFree
DecodePointer
RaiseException
QueueUserWorkItem
GetSystemTimeAsFileTime
GetCurrentThreadId
EncodePointer
LoadLibraryExW
lstrcmpiW
GetThreadLocale
SetThreadLocale
GetVolumeInformationW
GetSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCurrentProcessId
IsDebuggerPresent
CreateThread
CopyFileW
MoveFileExW
SetFileAttributesW
SetUnhandledExceptionFilter
QueryPerformanceCounter
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
GetModuleHandleExW
DeleteFiber
ConvertFiberToThread
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
LoadLibraryA
TerminateProcess
UnhandledExceptionFilter
InterlockedPopEntrySList
ReadFile
InterlockedPushEntrySList
CreateProcessW
WriteFile
VirtualAlloc

user32

EnumClipboardFormats
PostMessageW
WaitForInputIdle
DefWindowProcW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
MsgWaitForMultipleObjectsEx
GetQueueStatus
CallMsgFilterW
PostQuitMessage
WaitMessage
PeekMessageW
KillTimer
SetTimer
DispatchMessageW
TranslateMessage
CopyRect
CharNextW
LoadCursorW
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
keybd_event
IsClipboardFormatAvailable
EmptyClipboard
GetClipboardFormatNameW
CallWindowProcW
RegisterClipboardFormatW
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
IsRectEmpty
IsWindow
CharLowerBuffW
SetWindowLongW
GetWindowLongW
wsprintfW

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
RegQueryValueExW
OpenProcessToken

shell32

SHCreateDirectoryExW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetFolderPathW
DragQueryFileW

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
CLSIDFromString
CoTaskMemRealloc

oleaut32

SafeArrayGetVartype
SysFreeString
SafeArrayDestroy
VarBstrCmp
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
LoadRegTypeLi
LoadTypeLi
SysStringLen
VariantClear
VariantInit
SafeArrayGetUBound
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SysAllocString

shlwapi

StrStrIW
PathFindFileNameW
PathIsDirectoryW
PathAppendW

msvcp140

?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@PB_W4@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z
??1?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ
?_Getcat@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Syserror_map@std@@YAPBDH@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAM@Z
?id@?$numpunct@_W@std@@2V0locale@2@A
?id@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAN@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAO@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?classic@locale@std@@SAABV12@XZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Getcat@facet@locale@std@@SAIPAPBV123@PBV23@@Z
??0id@locale@std@@QAE@I@Z
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
_Mbrtowc
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?uncaught_exception@std@@YA_NXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ

apputil

?TransformUtf8HttpMemoryBlockToBSTR@Misc@AppUtil@@YAJPAUIHttpMemoryBlock@BULL@@PAPA_W@Z
?TransformUtf8StringToWString@Misc@AppUtil@@YAJV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@AAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@4@@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAI@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAH@Z
GetInt64FromJsonDataShim
?Parse@JsonLib@@YAJPA_WPAPAUIGeneralData@BULL@@@Z
?GetDoubleFromJsonDataShim@Misc@AppUtil@@YAJPA_WPAUIGeneralData@BULL@@PAN@Z
?GetTeraBoxTempPath@Misc@AppUtil@@YAJPAPA_W@Z
?WinMsgPeek@Misc@AppUtil@@YAJXZ
?RSA_Public_Encrypt@Misc@AppUtil@@YAJV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@0PAPAUIGeneralBuffer@BULL@@@Z
?TransUidToString@Misc@AppUtil@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAV34@@Z
?GetCurrentLangId@Misc@AppUtil@@YAJAAK@Z
?GetUrl@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@HW4EDomainType@1@AAV23@@Z
?IsTeraBoxDomain@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAH@Z
?GetProxyInfo@HelpProxySetting@@YAJPAKPAPA_WPAG@Z
?JsonEncode@JsonLib@@YAJPAUIGeneralData@BULL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
?GetDomain@HelpAppSetting@@YAJW4EDomainType@1@AAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetTime@Misc@AppUtil@@YA_JXZ
?VersionInfoDecode@Misc@AppUtil@@YAJPAPA_WH@Z
?CurURLEncode@Misc@AppUtil@@YAJPBDAAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
?CurURLEncode@Misc@AppUtil@@YAJPB_WAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?RawURLEncode@Misc@AppUtil@@YAJPBDAAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
?JsonEncode@JsonLib@@YAJPAUIGeneralArray@BULL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AA_J@Z
?GetChannelInfo@Misc@AppUtil@@YAJPAPA_W@Z
?TransformWStringToUtf8String@Misc@AppUtil@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@4@@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAV23@H@Z
?SetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@00H@Z

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain

iphlpapi

NotifyAddrChange
NotifyRouteChange

pdh

PdhCloseQuery
PdhCollectQueryData
PdhRemoveCounter
PdhOpenQueryW
PdhAddCounterW
PdhGetFormattedCounterValue

wininet

InternetQueryOptionW

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

bcrypt

BCryptGenRandom

vcruntime140

__std_type_info_destroy_list
_purecall
__std_terminate
memmove
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
wcsstr
_except_handler4_common
wcsrchr
wcschr
__std_exception_copy
__std_exception_destroy
memchr
strchr
__RTDynamicCast
strrchr
strstr
__vcrt_InitializeCriticalSectionEx

api-ms-win-crt-runtime-l1-1-0

_cexit
_crt_atexit
_initterm
_initterm_e
_beginthreadex
_invalid_parameter_noinfo
_errno
signal
terminate
_seh_filter_dll
strerror_s
raise
_execute_onexit_table
_configure_narrow_argv
_register_onexit_function
_initialize_narrow_environment
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_exit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
fread
feof
__stdio_common_vswscanf
__stdio_common_vswprintf_s
__stdio_common_vswprintf
fputs
fopen
__stdio_common_vsnwprintf_s
ferror
_get_stream_buffer_pointers
fclose
fflush
fgetc
fgetpos
fputc
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
fgets
__stdio_common_vsscanf
__stdio_common_vfprintf
_setmode
ftell
fseek
__acrt_iob_func
__stdio_common_vfwprintf
_fileno
__stdio_common_vsprintf_s
_wfopen

api-ms-win-crt-string-l1-1-0

iswspace
isspace
ispunct
wcsncpy_s
wcscpy_s
_wcslwr_s
_wcsnicmp
wcscat_s
wcsspn
wcsncmp
_stricmp
isalpha
isdigit
tolower
wcscspn
strncpy
iswdigit
_wcsupr_s
_strnicmp
strnlen
wmemcpy_s
strcspn
strncmp
strspn
wcsnlen
strcmp
_wcsicmp

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64
_mktime64
_gmtime64_s

api-ms-win-crt-heap-l1-1-0

_recalloc
free
realloc
_callnewh
calloc
malloc

api-ms-win-crt-convert-l1-1-0

strtoul
_wtoi
_atoi64
_wtoi64
atoi
wcstol
_wtoll
strtol

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_waccess
_wmkdir
_stat64i32
_unlock_file

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp
_mbslwr_s
_mbscmp
_mbsrchr

api-ms-win-crt-utility-l1-1-0

ldiv
srand
qsort
rand

api-ms-win-crt-math-l1-1-0

ceil
_libm_sse2_cos_precise
_except1

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 987KB - Virtual size: 986KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 165KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e0d4ec7f609b9a2ae153c46b9bd530b

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:c8:cb:43:1d:57:65:77:57:fb:47:fcCertificate

Extended Key Usages

Key Usages

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:c8:cb:43:1d:57:65:77:57:fb:47:fcCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

2c:4f:96:03:6d:21:9b:9a:53:68:ec:ef:d7:ea:55:eb:a7:5b:f4:5a:ca:0a:16:fa:18:56:f1:95:0e:ee:62:bbSigner

b6:2d:1c:1f:05:0b:83:04:cb:9d:0d:4a:64:2f:ae:da:d3:78:9d:3bSigner

Headers

DLL Characteristics

File Characteristics

Imports

bull140u

ws2_32

crypt32

ximage

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcp140

apputil

wintrust

iphlpapi

pdh

wininet

winmm

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

2c:4f:96:03:6d:21:9b:9a:53:68:ec:ef:d7:ea:55:eb:a7:5b:f4:5a:ca:0a:16:fa:18:56:f1:95:0e:ee:62:bb
Signer

b6:2d:1c:1f:05:0b:83:04:cb:9d:0d:4a:64:2f:ae:da:d3:78:9d:3b
Signer

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 987KB - Virtual size: 986KB

.data
Size: 165KB - Virtual size: 177KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 72B

.vmp0
Size: 2.1MB - Virtual size: 2.1MB

.reloc
Size: 205KB - Virtual size: 205KB

.rsrc
Size: 21KB - Virtual size: 20KB