BtTray[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BtTray.exe
Size

476KB
MD5

c0ed5ed3f88355e0eaf3d833a453a48c
SHA1

6b11317dffd09da905a051ecf01fa323c2e7cf0c
SHA256

1dcdbd3253d1008ef9e47334c3ea4a9dd56e4f35699a2c2e2484b834e2eade39
SHA512

5a59d8b6ffffeb313e46e86d16190021fc7cd347d7834095ec8f8fae236e2d71caffe3733f194dc612eff6ac3d350524b37832172d03cc9e1d63ae5d814fe2ef
SSDEEP

12288:c7tQfDF+sHUdjZtFV4r6FXPK4D1mTXHhe71KMt5lD5OOQ3CBkOIL:kIH8Qq0HE0MfQ3lL

Score

1^/10

Malware Config

Signatures

Files

BtTray.exe
.exe windows:5 windows x86 arch:x86

58959a27a726a9b5a88112a215a061a9

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

78:72:21:a2:bf:ff:fa:99:d5:b7:19:fc:91:97:76:f0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/07/2014, 00:00

Not After

15/09/2017, 23:59

Subject

CN=IVT CORPORATION,O=IVT CORPORATION,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ea:0a:57:9a:cc:fe:6b:44:a2:98:2b:2c:fd:97:fb:77:7a:6d:ea:a7
Signer

Actual PE Digest

ea:0a:57:9a:cc:fe:6b:44:a2:98:2b:2c:fd:97:fb:77:7a:6d:ea:a7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

bssdk

Btsdk_IsNTServiceRunning
Btsdk_IsServerConnected
Btsdk_StopBluetooth
Btsdk_GetAllIncomingConnections
Btsdk_IsBluetoothHardwareExisted
Btsdk_BIPRegisterDealReceiveFileCB
Btsdk_FTPRegisterDealReceiveFileCB
Btsdk_OPPRegisterDealReceiveFileCB
Btsdk_A2DPRegVaudioCbk
Btsdk_AVRCP_TGRegCommandCbk
Btsdk_AVRCP_RegPassThrCmdCbk
Btsdk_AVRCP_RegIndCbk
Btsdk_HFAP_APPRegCbk
Btsdk_AGAP_APPRegCbk
Btsdk_PAN_RegIndCbk
Btsdk_SetStatusInfoFlag
Btsdk_SetHlpStatusInfoFlag
Btsdk_RegisterGetStatusInfoCB
Btsdk_InitBlueSoleilSession
Btsdk_IsSNLicensed
Btsdk_IsHardwareLicensed
Btsdk_IsSupportBLEFunction
Btsdk_Is5MBLimit
Btsdk_ShowTipStartUpdate
Btsdk_Init
Btsdk_IsBsHelpCsConnected
Btsdk_ConnectShortCutEx
Btsdk_ClientHIDInit
Btsdk_RegisterPANService
Btsdk_GetPrivateProfileStruct
Btsdk_IsCurrentUserProcess
Btsdk_IsWinXPorLater
Btsdk_StartDeviceDiscovery
Btsdk_RecoverRemoteDeviceLinkKey
Btsdk_AddRemoteDevice
Btsdk_EnumRemoteService
Btsdk_GetRemoteLinkKey
Btsdk_UpdateRemoteDeviceName
Btsdk_PIMDeleteContactsCache
Btsdk_DeEnumAudioDriver
Btsdk_ReConnectBsHelpCS
Btsdk_PinCodeReply
Btsdk_GetServerAttributes
Btsdk_IOCapReqReply
Btsdk_GetAllShortCuts
Btsdk_FindComPort
Btsdk_BLERegisterCallBack
Btsdk_RegisterCallback
Btsdk_GetDiscoveryMode
Btsdk_ConnectEx
Btsdk_A2DPVAUDIO_Stop
Btsdk_AVRCP_PassThroughReq
Btsdk_A2DPStreamSuspend
Btsdk_A2DP_SNKSetPlayerVolume
Btsdk_A2DPVAUDIO_Start
Btsdk_A2DPStreamStart
Btsdk_AGAP_GetAGState
Btsdk_SCO_Stop
Btsdk_SCO_Start
Btsdk_AVRCP_GeneralRejectRsp
Btsdk_AVRCP_GetCapabilitiesRsp
Btsdk_AVRCP_GetElementAttrRsp
Btsdk_AVRCP_GetPlayStatusRsp
Btsdk_AVRCP_GetCurPlayerAppSetValRsp
Btsdk_AVRCP_SetCurPlayerAppSetValRsp
Btsdk_BIPWriteFile
Btsdk_BIPGetImage
Btsdk_BIPGetImageList
Btsdk_BIPConnectObjSvr
Btsdk_BIPGetPartialImage
Btsdk_BLEGetServiceConfiguration
Btsdk_StartNtService
Btsdk_RegisterPrinterService
Btsdk_BPPRegisterSvrCallback
Btsdk_RegisterRefObjService
Btsdk_RegisterImagingService
Btsdk_BIPRegisterImageRoutines
Btsdk_BIPCreateStorage
Btsdk_SetDiscoveryMode
Btsdk_OPPPushObjRsp
Btsdk_FTPPutFileRsp
Btsdk_FTPDelDirRsp
Btsdk_StartBluetooth
Btsdk_FTPDelFileRsp
Btsdk_FTPCreateDirRsp
Btsdk_FreeMemory
Btsdk_RegisterFTPService
Btsdk_RegisterOPPService
Btsdk_WritePrivateProfileString
Btsdk_WritePrivateProfileInt
Btsdk_UpdateServerAttributes
Btsdk_RegisterA2DPSRCService
Btsdk_RegisterAVRCPTGService
Btsdk_RegisterA2DPSNKService
Btsdk_PlugInVcommByRecord
Btsdk_RegisterSPPService
Btsdk_AddServer
Btsdk_IsBluetoothReady
Btsdk_RegOpenKey
Btsdk_RegQueryIntValue
Btsdk_RegCloseKey
Btsdk_StartUpdate
Btsdk_IsLicensed
Btsdk_StartEnumRemoteDevice
Btsdk_EnumRemoteDevice
Btsdk_EndEnumRemoteDevice
Btsdk_GetDefaultShortCut
Btsdk_GetShortCutByConnectionHandle
Btsdk_IsOEMCustomizationVer
Btsdk_Activate
Btsdk_GetPrivateProfileString
Btsdk_CheckOLInfo
BsPA_GetSN
Btsdk_EncryptString
Btsdk_BrowseRemoteServices
Btsdk_GetRemoteServices
Btsdk_GetRemoteServiceAttributes
Btsdk_GetShortCutByServiceHandle
Btsdk_Hid_ClntUnPluggedDev
Btsdk_StopServer
Btsdk_StartEnumLocalServer
Btsdk_EnumLocalServer
Btsdk_GetServerStatus
Btsdk_StartServer
Btsdk_EndEnumLocalServer
Btsdk_GetRemoteDeviceName
Btsdk_GetConnectionProperty
Btsdk_StartEnumConnection
Btsdk_EnumConnection
Btsdk_EndEnumConnection
Btsdk_AGAP_IsAudioConnExisted
Btsdk_GetRemoteDeviceAddress
Btsdk_Hid_ClntGetPlugFlag
Btsdk_UnPairDevice
Btsdk_PairDevice
Btsdk_GetRemoteDeviceClass
Btsdk_IsDevicePaired
Btsdk_SetSupervisionTimeout
Btsdk_GetPrivateProfileInt
Btsdk_GetShortCutProperty
Btsdk_Disconnect
Btsdk_CommNumToSerialNum
Btsdk_PlugOutVComm
Btsdk_DeinitCommObj
Btsdk_SetShortCutProperty
Btsdk_InitAmpTransportLayer
Btsdk_FreeAmpTransportLayer
Btsdk_AVRCP_EventPlayPosChanged
Btsdk_AVRCP_EventPlayerAppSetChanged
Btsdk_AVRCP_EventPlayStatusChanged
Btsdk_Done
Btsdk_GetShortCutByDeviceHandle
Btsdk_PIMParseContactDetails2
Btsdk_OPPExchangeObj
Btsdk_OPPPullObj
Btsdk_OPPPushObj
Btsdk_GetAllOutgoingConnections
Btsdk_EnumAudioDriver
Btsdk_GetShortCutByServiceClass
Btsdk_ConnectShortCut
Btsdk_AGAP_AudioConnTrans
Btsdk_RegSetIntValue
Btsdk_GetLocalLMPInfo
Btsdk_IsBTHValueExist
Btsdk_HidDevice_StartServer
Btsdk_RegCreateKey
Btsdk_RegEnumValue
Btsdk_EndEnumRemoteService
Btsdk_StartEnumRemoteService
Btsdk_GetRemoteDeviceHandle
Btsdk_AVRCP_EventTrackChanged

ws2_32

gethostname
inet_addr
ntohl
WSAStartup
WSACleanup

shlwapi

PathFileExistsA
PathFileExistsW
StrStrA
StrStrIA
StrStrIW

bscommon

BsCm_SyncSend2btShcForMultiUser
BsCm_GetShortcutsByComPort
BsCm_SendSMS
BsCm_StartUpSkySoleil
BsCm_StartUpISend
BsCm_SupportUartDeviceFlag
BsCm_OpenBsuiExe
BsCm_OpenBsuiDll
BsCm_IsShortcutConnected
BsCm_PostMsg2Bttray
BsCm_IsSNExpired
BsCm_IsSupportBPPFunction
BsCm_IsWindowsVistaAbove
BsCm_ChangeMsgFiter
BsCm_GetOutlookContactInfo
BsCm_AllocContactItemEx
BsCm_AllocPBAPContactItemEx
BsCm_CopyPBAPContactItemEx
BsCm_FreePBAPContactItemEx
BsCm_FreeContactItemEx
BsCm_SyncSend2btShc
BsCm_RegisterWindowToBttray
BsCm_GetDeviceModel
BsCm_IsMatchSymbianModelExist
BsCm_SendFilestoBtDevice
BsCm_ParseDeviceAddressFromString
BsCm_IsServiceStarted
BsCm_ControlA2DPService
BsCm_GetRmoteDeviniPath
BsCm_GetPersonalSettingFilePath
BsCm_LocalToUTF8
BsCm_GetLocalSPPSvrComPort
BsCm_ShouldFilterCurProfile
BsCm_GetCustomVersion
BsCm_IsX64Platform
BsCm_GetLangDepResLib
BsCm_IsMobileActive
BsCm_GetVersionMajorNum
BsCm_GetInstallDir
BsCm_GetSvcIconID
BsCm_CreateShortCut
BsCm_IsMobileDUNActive
BsCm_DoCancelAllPrintJob
BsCm_DeleteMyPrinterByBDAddr
BsCm_GetCommonSettingFilePath
BsCm_GetServiceClass
BsCm_IsConnectingPANOnThisDevice
BsCm_GetRmtSvcDisplayNameW
BsCm_GetServiceClsNameStringID
BsCm_SetDefaultShortCut
BsCm_GetShortCutPath
BsCm_GetComPortByShortcut
BsCm_ShouldShowThisRemoteService
BsCm_IsMobileDevice
Bscm_GetWindowLong
BsCm_CloseFtpClassicUI
BsCm_IsFtpClassicUIVer
BsCm_ControlA2DPHFPService
BsCm_GetImgProp
BsCm_CreateThumbFile
Bscm_SetWindowLong

bscdlg

BscDlg_ShowFileSelectDialog
BscDlg_SendFilesToRmtDev
BscDlg_ShowImageSelectDialog
BscDlg_SendImagesToRmtDev
BscDlg_ShowFTPFileProp
BscDlg_ShowPrintFileSelectDialog
BscDlg_SendPrintFilesToRmtDev
BscDlg_ShowAVANWizardPanel
BscDlg_ShowInterfaceConfigDlg
BscDlg_ShowLifeUpdateDlg
BscDlg_ShowPBAPContactProp
Bscdlg_ShowHeadsetSettingDlg
BscDlg_ShowPairNotifyDlg
BscDlg_PinCodeReqInd
BscDlg_OBEXAuthenticationReqInd
BscDlg_AuthorizationReqInd
BscDlg_ShowHeadSetTestDlg
BscDlg_ShowAnswerCallDlg
BscDlg_ShowLockDlg
BscDlg_CloseLockDlg
BscDlg_ShowSync
BscDlg_ShowNotifyInfoDlg
BscDlg_SendContactsToMobilePhone
BscDlg_StartSMSEditor
Bscdlg_ShowExtendControlBTFunc
Bscdlg_ShowOBEXReceiveNotificationDlg
Bscdlg_ShowSetPincodeDlg
Bscdlg_ShowAddDevByAddrDlg
BscDlg_ShowGamiiDlg
BscDlg_ShowRecognitionDlg
BscDlg_ShowLicenseInfoDlg
BscDlg_GetFreeSN
BscDlg_ShowTransSendWizard
BscDlg_ShowAVRCPControlPanel
BscDlg_ShowActivateDlg
BscDlg_ShowRegisterDlg
BscDlg_InitializeOnlinePayment
BscDlg_ShowRestartDlg
Bscdlg_ShowAddinManagerDlg
BscDlg_ShowFeedbackDlg
BscDlg_ShowAboutDlg
BscDlg_ConnDlgStart
BscDlg_ConnDlgFinish
BscDlg_ConnDlgRefresh
BscDlg_ShowLocDevProp
BscDlg_ShowRmtDevProp
BscDlg_ShowRmtDevRename
BscDlg_ShowRmtSvcProp
BscDlg_ShowSvcStatus
BscDlg_ShowLocSvcProp
BscDlg_ShowBLESvcProp

bslangindepres

BsRes_GetResIcon

bstrace

??0CBsTraceFunc@@QAE@KPAD@Z
??1CBsTraceFunc@@QAE@XZ
?BsTrace_UserDef@@YAXKPBDZZ
?BsTrace_SetTraceSwitch@@YAHH@Z

bsprofilefunc

BsProfile_DeleteRmtDevice
BsProfile_AppOutConnect
BsProfile_PreAppOutConnect
BsProfile_MuteOffAudioDevice
BsProfile_MuteOnAudioDevice
BsProfile_AppOutDisc
BsProfile_PreAppOutDisc
BsProfile_DiscAvrcpAppConn
BsProfile_ExistPanAppConn
BsProfile_GetCurrPanRole
BsProfile_DiscAllPanAppOutConn
BsProfile_HCRP_AddAndSetPrintPort
BsProfile_GetDefaultRenderDevice
BsProfile_GetSNKAudioDevices
BsProfile_SetDefaultAudioDevice
BsProfile_HangUpAllRasConnection
BsProfile_PostAppOutDisc
BsProfile_SetDefaultAudioDevValue
BsProfile_GetAudioConnections
BsProfile_SetDefaultAudioDeviceByName
BsProfile_RecordCurrAudioDevice
BsProfile_BPP_GetRefObjRsp
BsProfile_BPP_GetSendDocRsp
BsProfile_PostAppOutConnect

versit

Parse_MIME
deleteVObject
newVObject
addPropValue
writeVObjectToFile
initPropIterator
moreIteration
nextVObject
isAPropertyOf
vObjectStringZValue
vObjectName
nextVObjectInList
cleanVObject
vObjectUStringZValue
fakeCString
deleteStr
FinishParse
addProp

iphlpapi

GetAdaptersInfo

winmm

PlaySoundW

mfc90u

ord6696
ord663
ord1552
ord6813
ord6359
ord5770
ord3187
ord3221
ord305
ord6633
ord1608
ord310
ord2696
ord818
ord821
ord2703
ord2539
ord5868
ord900
ord4521
ord911
ord2481
ord2082
ord5941
ord3186
ord4406
ord6014
ord2327
ord4237
ord1268
ord826
ord485
ord316
ord300
ord4294
ord484
ord2155
ord5943
ord3604
ord400
ord4325
ord2677
ord5859
ord601
ord1370
ord1357
ord4512
ord2282
ord3577
ord261
ord406
ord2490
ord2501
ord3018
ord1553
ord665
ord4490
ord2479
ord6666
ord2130
ord4774
ord6604
ord3674
ord797
ord3286
ord595
ord2069
ord2597
ord2592
ord2593
ord1354
ord3543
ord3537
ord290
ord1183
ord5851
ord6065
ord6577
ord6780
ord3741
ord4131
ord6579
ord1047
ord6187
ord5664
ord4044
ord2106
ord790
ord2283
ord1719
ord3355
ord6411
ord1493
ord4660
ord3654
ord586
ord2326
ord778
ord5767
ord1243
ord1707
ord6811
ord2571
ord6822
ord5778
ord3589
ord2447
ord1098
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord6035
ord4179
ord1048
ord5548
ord6741
ord5830
ord4213
ord2087
ord3217
ord5674
ord5676
ord4347
ord4996
ord2480
ord5663
ord6018
ord3115
ord4905
ord4681
ord3670
ord589
ord794
ord4967
ord4043
ord5632
ord4630
ord5166
ord5324
ord5008
ord2208
ord1810
ord1809
ord1675
ord3353
ord6408
ord1754
ord1751
ord4345
ord1492
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord5653
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord967
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord2139
ord1792
ord1791
ord1727
ord5650
ord2771
ord2983
ord3112
ord4728
ord2966
ord3140
ord2774
ord2893
ord2764
ord3236
ord4080
ord4081
ord4071
ord2891
ord4348
ord4910
ord4682
ord3498
ord639
ord1137
ord1254
ord1250
ord1248
ord531
ord2222
ord1871
ord1599
ord3220
ord285
ord6630
ord3185
ord6702
ord909
ord1607
ord280
ord813
ord6415
ord811
ord935
ord5734
ord938
ord4324
ord286
ord1603
ord296
ord2537
ord2694
ord600
ord441
ord690
ord5559
ord1556
ord2084
ord265
ord266
ord1064
ord799
ord801
ord1604
ord5895
ord1600
ord6514
ord782
ord5680
ord580
ord969
ord1272

msvcr90

__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
__p__fmode
_encode_pointer
__set_app_type
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
__RTDynamicCast
realloc
free
_chdir
_mktemp
_localtime64_s
_mktime64
strncmp
fseek
_fileno
_filelength
strstr
fopen
fread
remove
strtok
_access
wcscmp
wcsstr
labs
_recalloc
calloc
wcsrchr
memcpy_s
_resetstkoflw
_wfopen
fwrite
fclose
_gmtime64_s
wcsftime
wcslen
_time64
strcmp
atoi
wcscat
strcat
strcpy
_swprintf
_vswprintf
memcpy
sprintf
wcscpy
_stricmp
_wcsicmp
_wcsupr
_strnicmp
_CxxThrowException
strlen
memcmp
__CxxFrameHandler3
_purecall
malloc
memset
isdigit

kernel32

UnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
GetCurrentProcess
TerminateProcess
InitializeCriticalSection
lstrcmpiA
GetProcessHeap
HeapFree
WinExec
lstrcpyW
LoadLibraryW
CreateMutexW
lstrlenW
GetVersionExW
ReleaseSemaphore
CreateSemaphoreW
InterlockedExchange
EnterCriticalSection
LeaveCriticalSection
GetLastError
CreateDirectoryW
GetWindowsDirectoryW
lstrcatW
DeleteFileW
GetPrivateProfileStringW
TerminateThread
FreeLibrary
GetSystemDefaultUILanguage
GetProcAddress
OpenMutexW
MultiByteToWideChar
Sleep
SetEvent
WideCharToMultiByte
CreateThread
WaitForSingleObject
CloseHandle
InterlockedDecrement
InterlockedIncrement
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
InterlockedCompareExchange
GetTimeZoneInformation
GetTempPathA
GetVersion
CreateFileA
GetCurrentProcessId
RaiseException
lstrlenA
GetFileAttributesW
SetFileAttributesW
CreateEventW
OutputDebugStringW
OutputDebugStringA
CreateProcessA
SetUnhandledExceptionFilter

user32

GetParent
DispatchMessageW
TranslateMessage
GetMessageW
GetDesktopWindow
RegisterWindowMessageW
UnregisterDeviceNotification
GetWindowTextW
GetClassNameW
EnumWindows
SetWindowPos
RegisterDeviceNotificationW
GetDoubleClickTime
SetCapture
CreatePopupMenu
AppendMenuW
CheckMenuItem
SetMenuDefaultItem
EnumChildWindows
SendInput
MessageBoxA
SetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
wsprintfW
FindWindowW
RedrawWindow
InvalidateRect
ReleaseDC
GetDC
GetClientRect
GetWindowRect
SendMessageW
InflateRect
PtInRect
LoadCursorW
CopyIcon
IsWindow
SetCursor
ReleaseCapture
MessageBeep
GetSysColor
GetCursorPos
EnableWindow
LoadStringW
GetForegroundWindow
MessageBoxW
KillTimer
SetTimer
RegisterHotKey
PostMessageW

gdi32

SetMapMode
GetMapMode
StartPage
StartDocW
CreateCompatibleDC
DeleteObject
CreateDIBSection
SetDIBColorTable
GetStockObject
CreateFontIndirectW
GetTextExtentPoint32W
GetDeviceCaps
SelectObject
GetObjectW
SetStretchBltMode
StretchBlt
EndPage
EndDoc
DeleteDC

advapi32

RegCloseKey
RegQueryValueExW
GetUserNameW
RegQueryValueW
RegSetValueExW
RegOpenKeyW
RegOpenKeyExW

shell32

ord25
ShellExecuteW
SHGetSpecialFolderPathA
Shell_NotifyIconW
SHChangeNotify
ord196
ShellExecuteA
ord155
SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetFolderPathA

ole32

CoReleaseMarshalData
CoUnmarshalInterface
CreateStreamOnHGlobal
CoMarshalInterface
OleRun
CLSIDFromString
CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

LoadRegTypeLi
SysAllocString
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
GetErrorInfo
VariantChangeType
VariantInit
SetErrorInfo
CreateErrorInfo
SysFreeString

wininet

InternetOpenW
InternetOpenUrlW
InternetCloseHandle

gdiplus

GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipGetImageWidth
GdiplusStartup
GdiplusShutdown
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipFree
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipAlloc
GdipDisposeImage
GdipCloneImage

adpush

?fnCloseTipWnd@@YAXXZ
?fnShowTipWnd@@YAHPAD@Z

mfc90

ord6154
ord1247
ord2953
ord2948
ord1760
ord1183
ord403

Exports

Exports

_GetDecryptProc@4
_GetEncryptProc@4
_SetDecryptionKey@4

Sections

.text
Size: 350KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

58959a27a726a9b5a88112a215a061a9

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

78:72:21:a2:bf:ff:fa:99:d5:b7:19:fc:91:97:76:f0Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

ea:0a:57:9a:cc:fe:6b:44:a2:98:2b:2c:fd:97:fb:77:7a:6d:ea:a7Signer

Headers

DLL Characteristics

File Characteristics

Imports

bssdk

ws2_32

shlwapi

bscommon

bscdlg

bslangindepres

bstrace

bsprofilefunc

versit

iphlpapi

winmm

mfc90u

msvcr90

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

gdiplus

adpush

mfc90

Exports

Exports

Sections

.text Size: 350KB - Virtual size: 349KB

.rdata Size: 109KB - Virtual size: 109KB

.data Size: 5KB - Virtual size: 21KB

.rsrc Size: 6KB - Virtual size: 5KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

78:72:21:a2:bf:ff:fa:99:d5:b7:19:fc:91:97:76:f0
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

ea:0a:57:9a:cc:fe:6b:44:a2:98:2b:2c:fd:97:fb:77:7a:6d:ea:a7
Signer

.text
Size: 350KB - Virtual size: 349KB

.rdata
Size: 109KB - Virtual size: 109KB

.data
Size: 5KB - Virtual size: 21KB

.rsrc
Size: 6KB - Virtual size: 5KB