c739e1596274a038f8e05704a45022d0734fb00a966eb1dcc449946586da0d76

Sharing

Copy URL Twitter E-mail

General

Target

c739e1596274a038f8e05704a45022d0734fb00a966eb1dcc449946586da0d76
Size

4.2MB
MD5

51a16e807759fb3f8091ee2a3a4bbcb0
SHA1

5671c445eab125fbd8bbf392373dfc2f3a404c77
SHA256

c739e1596274a038f8e05704a45022d0734fb00a966eb1dcc449946586da0d76
SHA512

b5c3bf847c17752c845a636f02eca91a8871d162bed0521cc9b8d37130ea71231de185380c7ce8073ea4347663b2e984b75272ed4fa7ab9dc4aff81ea465e0fb
SSDEEP

49152:V2Fzpm+dwScD/Rn4pfvs4kNSovXcmwewE8M1VjvJLmcV:Gm+dwSSuMNSovXJwewNE

Score

1^/10

Malware Config

Signatures

Files

c739e1596274a038f8e05704a45022d0734fb00a966eb1dcc449946586da0d76
.exe windows:6 windows x86 arch:x86

d231e76b59e81626214410b666e513df

Code Sign

45:fc:63:dd:77:9a:22:91:40:2f:20:60:3c:eb:40:cd
Certificate

Issuer

CN=soyal.com

Not Before

13/05/2023, 08:33

Not After

13/05/2024, 08:53

Subject

CN=soyal.com

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:da:26:51:ef:4f:c9:47:ce:98:0e:af:35:14:44:1a:00:72:4c:39:0c:53:4f:66:d1:d1:42:79:47:51:b4:4e
Signer

Actual PE Digest

4c:da:26:51:ef:4f:c9:47:ce:98:0e:af:35:14:44:1a:00:72:4c:39:0c:53:4f:66:d1:d1:42:79:47:51:b4:4e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libxl

xlCreateXMLBookW

opencv_world420

?resize@cv@@YAXABV_InputArray@1@ABV_OutputArray@1@V?$Size_@H@1@NNH@Z
?read@VideoCapture@cv@@UAE_NABV_OutputArray@2@@Z
?release@VideoCapture@cv@@UAEXXZ
?isOpened@VideoCapture@cv@@UBE_NXZ
?open@VideoCapture@cv@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
??0VideoCapture@cv@@QAE@XZ
?copyTo@Mat@cv@@QBEXABV_OutputArray@2@@Z
?imwrite@cv@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV_InputArray@1@ABV?$vector@HV?$allocator@H@std@@@3@@Z
?updateContinuityFlag@Mat@cv@@QAEXXZ
?deallocate@Mat@cv@@QAEXXZ
?error@cv@@YAXHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD1H@Z
?fastFree@cv@@YAXPAX@Z
??1VideoCapture@cv@@UAE@XZ

winspool.drv

ord203

mfc140u

ord7510
ord5985
ord13862
ord6356
ord4616
ord5589
ord4360
ord3683
ord7819
ord10428
ord6788
ord3864
ord13289
ord8032
ord2886
ord4735
ord2381
ord2384
ord290
ord13062
ord4171
ord7487
ord7130
ord14530
ord11468
ord10142
ord10595
ord11735
ord10531
ord9017
ord9120
ord9292
ord10994
ord5771
ord13085
ord13087
ord4649
ord3182
ord12141
ord2865
ord8345
ord11633
ord7066
ord985
ord2029
ord3905
ord346
ord1060
ord2874
ord1705
ord7815
ord7125
ord898
ord3954
ord12953
ord12867
ord13084
ord7146
ord12105
ord3175
ord3342
ord4223
ord1162
ord9130
ord277
ord1003
ord13966
ord8054
ord12646
ord1477
ord2257
ord14127
ord4571
ord11100
ord5813
ord6592
ord551
ord8505
ord1655
ord12691
ord1182
ord2224
ord324
ord1052
ord5533
ord7686
ord14047
ord4890
ord1476
ord2345
ord2223
ord14600
ord2222
ord2390
ord2350
ord8817
ord567
ord3960
ord1194
ord5890
ord360
ord13960
ord1067
ord8100
ord7410
ord6834
ord3257
ord4236
ord9135
ord7672
ord14547
ord8225
ord6495
ord8738
ord6842
ord3260
ord3366
ord4239
ord1454
ord9138
ord9463
ord7642
ord6117
ord853
ord12526
ord12887
ord9508
ord9985
ord9990
ord9513
ord9525
ord1374
ord5781
ord9133
ord4226
ord6590
ord7166
ord7891
ord5851
ord5319
ord4094
ord509
ord1078
ord9527
ord376
ord9467
ord10047
ord11146
ord9011
ord11122
ord3869
ord14046
ord8365
ord8811
ord13086
ord6795
ord1450
ord13964
ord974
ord2996
ord1690
ord1526
ord11267
ord5881
ord5879
ord12092
ord13925
ord2756
ord4010
ord11464
ord11428
ord12806
ord3851
ord14479
ord4316
ord1922
ord2782
ord13927
ord8789
ord2895
ord11968
ord1418
ord934
ord7384
ord12905
ord12907
ord12912
ord2380
ord1460
ord984
ord1447
ord13628
ord968
ord7514
ord11545
ord9239
ord3835
ord13708
ord13710
ord5035
ord3845
ord11798
ord11804
ord9353
ord12108
ord7808
ord3278
ord7178
ord10376
ord9175
ord9302
ord9270
ord5955
ord12948
ord1788
ord5039
ord7138
ord10383
ord6865
ord7441
ord5961
ord1474
ord997
ord1413
ord2008
ord929
ord2203
ord4856
ord3236
ord14657
ord12405
ord6751
ord7509
ord6977
ord13654
ord5837
ord7165
ord1133
ord6549
ord7654
ord11080
ord14476
ord14328
ord5210
ord358
ord4882
ord9377
ord7107
ord4485
ord3685
ord12763
ord9468
ord8773
ord4881
ord5882
ord2750
ord8067
ord1171
ord4884
ord3183
ord540
ord3957
ord13366
ord594
ord5582
ord3808
ord3807
ord6812
ord4723
ord12640
ord3678
ord3802
ord1524
ord1055
ord3337
ord3142
ord6470
ord8360
ord12921
ord14417
ord1213
ord7649
ord10150
ord10149
ord12088
ord12123
ord9226
ord6876
ord2681
ord1468
ord10048
ord11746
ord8913
ord8923
ord10509
ord11118
ord9526
ord9991
ord9986
ord9514
ord9524
ord9509
ord11279
ord11276
ord8304
ord4130
ord991
ord7432
ord11392
ord13293
ord13089
ord5765
ord7501
ord9212
ord9979
ord11743
ord9363
ord11139
ord11138
ord10721
ord10251
ord10431
ord5368
ord5377
ord14511
ord4088
ord4138
ord1128
ord12093
ord12964
ord2718
ord9484
ord4703
ord12660
ord12418
ord2558
ord13352
ord2843
ord7655
ord8395
ord11252
ord12575
ord5577
ord12786
ord9197
ord11024
ord10976
ord3857
ord9081
ord14490
ord6199
ord5609
ord2858
ord13832
ord14065
ord481
ord7121
ord13149
ord1355
ord2006
ord12678
ord824
ord6752
ord14604
ord12348
ord291
ord287
ord2413
ord2342
ord2378
ord2205
ord2307
ord2209
ord816
ord8470
ord7653
ord1472
ord8386
ord12247
ord10433
ord12928
ord12865
ord4589
ord7997
ord8324
ord5357
ord10151
ord10147
ord10144
ord2486
ord12542
ord12541
ord14589
ord7922
ord14595
ord9398
ord4152
ord4090
ord12947
ord7941
ord12027
ord2034
ord11983
ord11982
ord1866
ord14466
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord13911
ord8462
ord995
ord6860
ord1072
ord366
ord3852
ord5918
ord12239
ord8217
ord12251
ord12219
ord6300
ord5763
ord10250
ord6956
ord1521
ord14421
ord7511
ord11543
ord3834
ord11802
ord5956
ord11797
ord1789
ord12180
ord3940
ord8400
ord12106
ord7692
ord3191
ord558
ord7175
ord10402
ord11495
ord12081
ord9237
ord4587
ord3843
ord5369
ord11795
ord9213
ord8209
ord1151
ord9352
ord8831
ord11430
ord4495
ord2557
ord5938
ord13707
ord5939
ord13709
ord13700
ord5934
ord12460
ord6130
ord5034
ord5033
ord3174
ord14128
ord7810
ord12419
ord4797
ord3849
ord7327
ord2178
ord1105
ord7656
ord14055
ord3162
ord6526
ord1462
ord1405
ord3359
ord3237
ord6801
ord5850
ord1403
ord908
ord5380
ord906
ord5580
ord5962
ord9039
ord11014

kernel32

InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
OutputDebugStringW
CopyFileW
LoadLibraryW
FormatMessageW
LocalFree
LocalAlloc
GetProcAddress
GetModuleFileNameW
FreeLibrary
GetProcessHeap
HeapFree
HeapAlloc
GetCurrentDirectoryW
SetCurrentDirectoryW
GlobalFree
GlobalUnlock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
GetStartupInfoW
CreateProcessW
TerminateThread
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
CancelSynchronousIo
GetLastError
CloseHandle
ReadFile
DeleteFileW
Sleep
GetLocaleInfoW
GetACP
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryW
GetTickCount64
lstrcpynW
MulDiv
GlobalHandle
GlobalSize
GlobalReAlloc
FreeResource
FindResourceW
SizeofResource
LockResource
LoadResource
CreateDirectoryW
Beep
GlobalLock
GlobalAlloc
GetProfileIntW
HeapSize
HeapReAlloc
HeapDestroy
LoadLibraryExW
RaiseException
DecodePointer
OpenSemaphoreW
CreateSemaphoreW
WaitForSingleObject
ReleaseSemaphore
lstrlenW
lstrcatW
lstrcpyW
GetModuleHandleW
GetVersionExA
SetThreadPriority
GetSystemDefaultLangID
SetLastError
IsDebuggerPresent
SetThreadLocale

user32

UnregisterClassW
LoadIconW
SystemParametersInfoA
SystemParametersInfoW
GetCursorPos
ScreenToClient
DrawFocusRect
FillRect
IsZoomed
SetParent
GetTopWindow
LoadImageW
InflateRect
LoadBitmapW
RegisterWindowMessageW
DrawFrameControl
IsWindow
GetCapture
DrawStateW
RedrawWindow
FrameRect
SetRectEmpty
UnionRect
IsRectEmpty
EqualRect
DestroyIcon
CreateIconFromResource
CreateIconIndirect
GetIconInfo
GetKeyState
GetMessagePos
GetDlgItem
GetDialogBaseUnits
GetMenuItemCount
MessageBoxW
SendMessageW
EnableWindow
PostMessageW
BringWindowToTop
LoadMenuW
GetSubMenu
InvalidateRect
GetClientRect
GetWindowRect
MapWindowPoints
SetRect
CopyRect
PtInRect
GetWindowLongW
GetParent
FindWindowW
GetClassNameW
GetWindow
IsWindowVisible
IsIconic
UpdateWindow
GetDesktopWindow
GetLastActivePopup
wsprintfW
GetFocus
SetCapture
ReleaseCapture
SetTimer
KillTimer
SetCursor
ClientToScreen
OffsetRect
LoadCursorW
SetWindowTextW
MessageBeep
SetWindowLongW
GetSystemMenu
EnableMenuItem
GetMenuItemID
GetSysColor
GetWindowPlacement
GetSystemMetrics
CheckMenuItem
ModifyMenuW
RemoveMenu
DrawTextW
GetDC
ReleaseDC
GetClassLongW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPos
ShowWindow
GetClassInfoExW
SetWindowRgn
DestroyWindow
GetActiveWindow
WindowFromPoint
CallWindowProcW
IntersectRect

gdi32

SetDIBitsToDevice
PatBlt
CreateCompatibleDC
DeleteDC
DeleteObject
GetDeviceCaps
GetMapMode
SelectObject
StretchBlt
CreateDIBSection
SetDIBColorTable
StartDocW
EndDoc
StartPage
EndPage
AbortDoc
GetObjectW
CreateDIBitmap
CreatePalette
GetDIBits
RealizePalette
SelectPalette
StretchDIBits
CreateHalftonePalette
GetTextMetricsW
CreateFontIndirectW
GetClipBox
SetBkMode
SetStretchBltMode
SetTextColor
GetDCOrgEx
CreateSolidBrush
GetCurrentObject
GetTextExtentPoint32W
CreatePen
GetBkColor
GetStockObject
GetTextCharacterExtra
GetTextColor
DPtoLP
BitBlt
CreateBitmap
CreateCompatibleBitmap
GetPaletteEntries
GetSystemPaletteEntries
CreateRectRgn
CreateFontW
Ellipse
GetCharWidthW
CreatePolygonRgn
GetPixel
GetTextExtentPointW
CreateRectRgnIndirect
ExtCreatePen
CombineRgn

advapi32

RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

shell32

SHGetDesktopFolder
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW

comctl32

ord17
ImageList_SetBkColor
ImageList_AddMasked
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_Draw
ImageList_Replace
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_GetBkColor

ole32

CreateStreamOnHGlobal

oleaut32

SysFreeString
VarUdateFromDate
VariantTimeToSystemTime
SystemTimeToVariantTime

ws2_32

gethostname

odbc32

ord176
ord157
ord154
ord139
ord119
ord136
ord111
ord110
ord108
ord107
ord72
ord63
ord75
ord20
ord49
ord48
ord18
ord43
ord31
ord30
ord13
ord12
ord9
ord26
ord4
ord24

gdiplus

GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipLoadImageFromStreamICM
GdipLoadImageFromFileICM
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageI
GdipDrawImageRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipDeleteFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipCreateFontFamilyFromName

csmsgv11

ord9
ord19
ord32
ord48
ord65
ord72
ord3
ord107
ord2
ord78

csmtpv11

ord27
ord35
ord46
ord47
ord48
ord59
ord2
ord64
ord67
ord3
ord21

cswskv11

ord3
ord31
ord39
ord78
ord86
ord121
ord133
ord167
ord171
ord2

toolkitpro1700vc140u

?SetPopupPos@CXTPPopupControl@@QAEXVCPoint@@@Z
??1CXTPPopupControl@@UAE@XZ
??0CXTPPopupControl@@QAE@H@Z
?GetCheck@CXTPCheckListBox@@QAEHH@Z
?SetCheck@CXTPCheckListBox@@QAEXHH@Z
??1CXTPCheckListBox@@UAE@XZ
??0CXTPCheckListBox@@QAE@H@Z
??0CXTPListBox@@QAE@XZ
?GetSelPath@CXTPBrowseDialog@@QAEPB_WXZ
?SetSelPath@CXTPBrowseDialog@@QAEXPB_W@Z
?SetTitle@CXTPBrowseDialog@@QAEXPB_W@Z
?DoModal@CXTPBrowseDialog@@UAEHXZ
??1CXTPBrowseDialog@@UAE@XZ
??0CXTPBrowseDialog@@QAE@PAVCWnd@@@Z
??1CXTPListBox@@UAE@XZ
?OnExpanding@CXTPPopupControl@@MAEXH@Z
?OnItemInserted@CXTPPopupItem@@MAEXXZ
?OnSetPreviewMode@?$CXTPFrameWndBase@VCMDIFrameWnd@@@@UAEXHPAUCPrintPreviewState@@@Z
?OnShow@CXTPPopupControl@@MAEXXZ
?OnToolBarAdded@CXTPCommandBars@@MAEXPAVCXTPToolBar@@@Z
?OnToolBarRemoved@CXTPCommandBars@@MAEXPAVCXTPToolBar@@@Z
?OnTrackingModeChanged@CXTPCommandBars@@UAEXPAVCXTPCommandBar@@H@Z
?OnTrayNotification@CXTPTrayIcon@@MAEJIJ@Z
?OnWndMsg@?$CXTPCommandBarsSiteBase@VCMDIFrameWnd@@@@MAEHIIJPAJ@Z
?OnWndMsg@CXTPPopupControl@@MAEHIIJPAJ@Z
?PostNcDestroy@CXTPPopupControl@@MAEXXZ
?PreTranslateMessage@?$CXTPCommandBarsSiteBase@VCMDIFrameWnd@@@@MAEHPAUtagMSG@@@Z
?RecalcFrameLayout@CXTPCommandBars@@UAEXH@Z
?RemoveAnimationIcons@CXTPTrayIcon@@UAEXXZ
?RestoreCommandBarList@CXTPCommandBars@@MAEXPAVCXTPCommandBarList@@H@Z
?SaveCommandBarList@CXTPCommandBars@@MAEHPAVCXTPPropExchange@@PAVCXTPCommandBarList@@@Z
?SaveCommandBars@?$CXTPCommandBarsSiteBase@VCMDIFrameWnd@@@@UAEXPB_W@Z
?SetAnimationIcons@CXTPTrayIcon@@UAEXPBIPBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
?SetAnimationIcons@CXTPTrayIcon@@UAE_NPBIHPBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetTimer@CXTPTrayIcon@@UAEXII@Z
?SetTooltip@CXTPTrayIcon@@UAEXPB_W@Z
?SetTrayIcon@CXTPTrayIcon@@UAEXIK@Z
?StartAnimation@CXTPTrayIcon@@UAEXI@Z
?StopAnimation@CXTPTrayIcon@@UAEXXZ
?WindowProc@CXTPTrayIcon@@MAEJIIJ@Z
??0CXTButton@@QAE@PAUCRuntimeClass@@@Z
??1CXTButton@@UAE@XZ
?GetPopupPos@CXTPPopupControl@@QBE?AVCPoint@@XZ
?SetPopupSize@CXTPPopupControl@@QAEXVCSize@@@Z
?GetPopupSize@CXTPPopupControl@@QBE?AVCSize@@XZ
?Show@CXTPPopupControl@@QAEHPAVCWnd@@H@Z
?Close@CXTPPopupControl@@QAEHXZ
?SetTransparency@CXTPPopupControl@@QAEXE@Z
?SetShowDelay@CXTPPopupControl@@QAEXK@Z
?SetAnimateDelay@CXTPPopupControl@@QAEXK@Z
?SetPopupAnimation@CXTPPopupControl@@QAEXW4XTPPopupAnimation@@@Z
?GetPopupState@CXTPPopupControl@@QBE?AW4XTPPopupState@@XZ
?SetTheme@CXTPPopupControl@@QAEXW4XTPPopupPaintTheme@@@Z
?RedrawControl@CXTPPopupControl@@QAEXXZ
?AddItem@CXTPPopupControl@@QAEPAVCXTPPopupItem@@PAV2@@Z
?RemoveAllItems@CXTPPopupControl@@QAEXXZ
?AllowMove@CXTPPopupControl@@QAEXH@Z
?OnCollapsing@CXTPPopupControl@@MAEXXZ
?SetAutoDelete@CXTPPopupControl@@QAEXH@Z
??0CXTPPopupItem@@QAE@PAUtagRECT@@PB_WKK@Z
??1CXTPPopupItem@@UAE@XZ
?SetButton@CXTPPopupItem@@QAEXH@Z
?SetID@CXTPPopupItem@@QAEXH@Z
?GetID@CXTPPopupItem@@QBEHXZ
?SetTextColor@CXTPPopupItem@@QAEXKK@Z
?SetTextAlignment@CXTPPopupItem@@QAEXH@Z
?SetHyperLink@CXTPPopupItem@@QAEXH@Z
?SetBold@CXTPPopupItem@@QAEXH@Z
?SetIcon@CXTPPopupItem@@QAEHPAUHICON__@@W4XTPPopupItemIcon@@@Z
?GetPopupControl@CXTPPopupItem@@QBEPAVCXTPPopupControl@@XZ
??0CXTPTrayIcon@@QAE@XZ
??1CXTPTrayIcon@@UAE@XZ
?GetThisMessageMap@CXTPTrayIcon@@KGPBUAFX_MSGMAP@@XZ
?SetTheme@CXTPPaintManager@@SAXW4XTPPaintTheme@@@Z
??0CXTPCommandBars@@IAE@XZ
??1CXTPCommandBars@@MAE@XZ
?SetMenu@CXTPCommandBars@@QAEPAVCXTPMenuBar@@PB_WI@Z
?Add@CXTPCommandBars@@QAEPAVCXTPToolBar@@PB_WW4XTPBarPosition@@PAUCRuntimeClass@@@Z
?GetSite@CXTPCommandBars@@QBEPAVCWnd@@XZ
?GetActiveDocTemplate@CXTPCommandBars@@UAEIXZ
?GetThisClass@CXTPCommandBars@@SGPAUCRuntimeClass@@XZ
?OnClick@CXTPPopupControl@@MAEXPAVCXTPPopupItem@@@Z
?Notify@CXTPPopupControl@@MAEXIJ@Z
?LoadFrame@?$CXTPFrameWndBase@VCMDIFrameWnd@@@@UAEHIKPAVCWnd@@PAUCCreateContext@@@Z
?LoadCommandBars@?$CXTPCommandBarsSiteBase@VCMDIFrameWnd@@@@UAEXPB_WH@Z
?LoadCommandBarList@CXTPCommandBars@@MAEHPAVCXTPPropExchange@@PAVCXTPCommandBarList@@@Z
?KillTimer@CXTPTrayIcon@@UAEXXZ
?IsControlHidden@CXTPCommandBars@@UAEHPAVCXTPControl@@@Z
?GetCommandBars@?$CXTPCommandBarsSiteBase@VCMDIFrameWnd@@@@QBEPAVCXTPCommandBars@@XZ
??0CXTPMDIFrameWnd@@QAE@XZ
?OnCmdMsg@CXTPMDIFrameWnd@@UAEHIHPAXPAUAFX_CMDHANDLERINFO@@@Z
??1CXTPMDIFrameWnd@@UAE@XZ
??0CXTPTabClientWnd@@QAE@XZ
??1CXTPTabClientWnd@@UAE@XZ
?Attach@CXTPTabClientWnd@@QAEHPAVCXTPMDIFrameWnd@@H@Z
?GetChild@CXTPDockingPane@@QBEPAVCWnd@@XZ
??0CXTPDockingPaneManager@@QAE@XZ
??1CXTPDockingPaneManager@@UAE@XZ
?GetActivePane@CXTPDockingPaneManager@@QBEPAVCXTPDockingPane@@XZ
?AddCustomBar@CXTPCommandBars@@UAEPAVCXTPToolBar@@PB_WIH@Z
?ContextMenu@CXTPCommandBars@@UAEXPAVCXTPToolBar@@VCPoint@@@Z
?Create@CXTPPopupControl@@EAEHPB_W0KABUtagRECT@@PAVCWnd@@IPAUCCreateContext@@@Z
?Create@CXTPPopupControl@@MAEHPAVCWnd@@@Z
?Create@CXTPTrayIcon@@EAEHPB_W0KABUtagRECT@@PAVCWnd@@IPAUCCreateContext@@@Z
?Create@CXTPTrayIcon@@UAE_NPB_WKPAVCWnd@@I@Z
?Create@CXTPTrayIcon@@UAE_NPB_WPAVCWnd@@III_N@Z
?CreateKeyboardTips@CXTPCommandBars@@UAEXPAVCXTPCommandBar@@@Z
?Draw@CXTPPopupItem@@UAEXPAVCDC@@@Z
?GenerateCommandBarList@CXTPCommandBars@@MAEXPAVCXTPCommandBarList@@PAUXTP_COMMANDBARS_PROPEXCHANGE_PARAM@@@Z
?GetAddOrRemovePopup@CXTPCommandBars@@UAEXPAVCXTPToolBar@@PAVCXTPCommandBar@@@Z
?GetHiddenControls@CXTPCommandBars@@UAEXPAVCXTPToolBar@@PAVCXTPCommandBar@@@Z
?GetMenuBar@CXTPCommandBars@@UBEPAVCXTPMenuBar@@XZ
?GetMessageMap@CXTPPopupControl@@MBEPBUAFX_MSGMAP@@XZ
?GetRuntimeClass@CXTPPopupItem@@UBEPAUCRuntimeClass@@XZ
?GetTextFont@CXTPPopupItem@@UAEPAVCFont@@XZ
?IsCommandHidden@CXTPCommandBars@@UAEHI@Z
?InstallIconPending@CXTPTrayIcon@@UAEXXZ
?GetToolbarsPopup@CXTPCommandBars@@UAEPAVCXTPPopupBar@@XZ
?InitCommandBars@?$CXTPCommandBarsSiteBase@VCMDIFrameWnd@@@@UAEHPAUCRuntimeClass@@@Z

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?_Xbad_alloc@std@@YAXXZ

winmm

waveOutPrepareHeader
waveOutClose
waveOutOpen
waveOutGetErrorTextW
PlaySoundW
waveOutGetNumDevs
waveOutUnprepareHeader
waveOutGetPosition
waveOutReset
waveOutPause
waveOutWrite

vcruntime140

__std_type_info_destroy_list
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
wcsrchr
wcsstr
wcschr
memchr
__std_exception_destroy
__std_exception_copy
strchr
memset
memcpy
_purecall
__std_terminate
memmove
_CxxThrowException
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_controlfp_s
_execute_onexit_table
_register_onexit_function
_crt_at_quick_exit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_errno
_resetstkoflw
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
exit
terminate
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
_exit
_seh_filter_exe
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
__stdio_common_vsprintf
__stdio_common_vsscanf
__stdio_common_vsprintf_p
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s
__stdio_common_vfscanf
fgetws
fgets
__stdio_common_vswprintf_s
__stdio_common_vfprintf_p
__stdio_common_vfprintf_s
__stdio_common_vfprintf
__stdio_common_vswprintf_p
__stdio_common_vswscanf
__stdio_common_vsnwprintf_s
__stdio_common_vfwscanf
__stdio_common_vswprintf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf_s
__acrt_iob_func
__stdio_common_vfwprintf

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
calloc
_recalloc
malloc

api-ms-win-crt-math-l1-1-0

_libm_sse2_sin_precise
_ftol
modf
ceil
floor
_libm_sse2_cos_precise
_dtest
_finite
_isnan
_libm_sse2_sqrt_precise
_except1
__setusermatherr

api-ms-win-crt-string-l1-1-0

isxdigit
wcscat_s
wcscpy_s
wcsncmp
_wcsicmp
isalnum
wcsncpy_s

api-ms-win-crt-time-l1-1-0

_localtime64_s
wcsftime
_time64

api-ms-win-crt-convert-l1-1-0

_wtoll
_wtoi64
_wtoi

api-ms-win-crt-multibyte-l1-1-0

_mbschr

api-ms-win-crt-filesystem-l1-1-0

_wremove
_wrename
_wsplitpath_s
_wfindfirst64i32
_wfindnext64i32
_findclose

api-ms-win-crt-utility-l1-1-0

ldiv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 348KB - Virtual size: 348KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d231e76b59e81626214410b666e513df

Code Sign

45:fc:63:dd:77:9a:22:91:40:2f:20:60:3c:eb:40:cdCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

4c:da:26:51:ef:4f:c9:47:ce:98:0e:af:35:14:44:1a:00:72:4c:39:0c:53:4f:66:d1:d1:42:79:47:51:b4:4eSigner

Headers

DLL Characteristics

File Characteristics

Imports

libxl

opencv_world420

winspool.drv

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

ws2_32

odbc32

gdiplus

csmsgv11

csmtpv11

cswskv11

toolkitpro1700vc140u

msvcp140

winmm

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 348KB - Virtual size: 348KB

.data Size: 19KB - Virtual size: 549KB

.idata Size: 36KB - Virtual size: 35KB

.gfids Size: 1KB - Virtual size: 1KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 260B

.rsrc Size: 2.2MB - Virtual size: 2.2MB

.reloc Size: 120KB - Virtual size: 119KB

45:fc:63:dd:77:9a:22:91:40:2f:20:60:3c:eb:40:cd
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

4c:da:26:51:ef:4f:c9:47:ce:98:0e:af:35:14:44:1a:00:72:4c:39:0c:53:4f:66:d1:d1:42:79:47:51:b4:4e
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 348KB - Virtual size: 348KB

.data
Size: 19KB - Virtual size: 549KB

.idata
Size: 36KB - Virtual size: 35KB

.gfids
Size: 1KB - Virtual size: 1KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 260B

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

.reloc
Size: 120KB - Virtual size: 119KB