30e96fb1f35fe52716003634b980e4bb

Sharing

Copy URL Twitter E-mail

General

Target

30e96fb1f35fe52716003634b980e4bb
Size

1.2MB
MD5

30e96fb1f35fe52716003634b980e4bb
SHA1

67351c691ef77c835e3e1320f899f82bcb408174
SHA256

21eeecbbd1a4782782d757bc77a5a521a3461dc75adc149a8864a2deb53a2c87
SHA512

d095c56e23637f473fc8b072da6f06ebb05fee270e23808891467e25be38649e69b0aab2be6775273b2087c636d0089298c67395047bbca008bf1a1a2d9f1e57
SSDEEP

24576:uiFAa2uO+iZf6pdSqJpbyCzonNSoaeEH:GrEiNoPGCzonNSo6

Score

1^/10

Malware Config

Signatures

Files

30e96fb1f35fe52716003634b980e4bb
.exe windows:4 windows x86 arch:x86

b23b14622e478b5e8b5278e2fbf7e8cd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/01/2013, 00:00

Not After

16/02/2016, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:72:37:54:d4:f4:bf:d1:df:76:fc:84:02:de:e4:8c:7f:bd:8f:0c
Signer

Actual PE Digest

8d:72:37:54:d4:f4:bf:d1:df:76:fc:84:02:de:e4:8c:7f:bd:8f:0c

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

EnumProcessModules
GetProcessImageFileNameW
EnumProcesses
GetModuleBaseNameW
GetModuleFileNameExW

common

??H@YA?AVCTXStringW@@ABV0@0@Z
??0CTXHttpDownloadSink@@IAE@XZ
??1CTXHttpDownloadSink@@UAE@XZ
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
?SetUIInterface@CTXHttpDownload@@QAEXPAVCTXHttpDownloadSink@@@Z
??0CTXStringW@@QAE@PB_W@Z
?IsEmpty@CTXBSTR@@QAEHXZ
?RecordTransEnd@Perf@Util@@YAJ_JPB_WHH11H@Z
?CancelDownload@CTXHttpDownload@@QAEXXZ
?Download@CTXHttpDownload@@QAEHPB_WPAU_SYSTEMTIME@@0H@Z
?TXAssert@@YAXPB_W0H@Z
?MoveDownloadFile@CTXHttpDownload@@QAEHPB_WH@Z
?Run@CTXHttpDownload@@EAEIXZ
?OnError@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@K@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?OnRedirected@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@PB_W@Z
?OnProgress@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@KK@Z
??0CTXBSTR@@QAE@XZ
?OnDownloadStart@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@KK@Z
??0CTXStringW@@QAE@XZ
??ICTXBSTR@@QAEPAPA_WXZ
?OnConnected@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@@Z
??1CTXStringW@@QAE@XZ
??0CTXHttpDownload@@QAE@XZ
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
??8@YA_NPB_WABVCTXBSTR@@@Z
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
??0CTXTime@@QAE@ABV0@@Z
?GetYear@CTXTime@@QBEHXZ
?GetMonth@CTXTime@@QBEHXZ
?GetDay@CTXTime@@QBEHXZ
?GetHour@CTXTime@@QBEHXZ
?GetMinute@CTXTime@@QBEHXZ
?GetTime@CTXTime@@QBE_JXZ
?IsEmpty@CTXStringW@@QBE_NXZ
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?OnExitCoreCenter@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
??BCTXStringW@@QBEPB_WXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?GetBuffer@CTXStringW@@QAEPA_WH@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?RecordTransBegin@Perf@Util@@YA_JPB_WHH00@Z
??1CTXHttpDownload@@UAE@XZ
?OnConnecting@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@PB_W@Z
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?MakeLower@CTXStringW@@QAEAAV1@XZ
?Find@CTXStringW@@QBEHPB_WH@Z
?ClearDeadQueue@Misc@Util@@YAXXZ
?DelIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
?GetLength@CTXStringW@@QBEHXZ
??YCTXStringW@@QAEAAV0@ABV0@@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
??0CTXStringW@@QAE@ABV0@@Z
?RemoveFileSystem@FS@@YAHPB_W@Z
??M@YA_NABVCTXStringW@@0@Z
?AddFileSystem@FS@@YAJW4FILESYSTEM_TYPE@@PB_W1HHH@Z
?IsDirectoryExist@FS@@YAHPB_W@Z
?SplitQNC@FS@@YAHPB_WAAVCTXStringW@@1@Z
?GetFileName@FS@Util@@YA?AVCTXStringW@@ABV3@@Z
?GetParentDir@File@Util@@YA?AVCTXStringW@@ABV3@@Z
?Format@CTXStringW@@QAAXPB_WZZ
?GetAsSystemTime@CTXTime@@QBE_NAAU_SYSTEMTIME@@@Z
??0CTXTime@@QAE@ABU_SYSTEMTIME@@H@Z
?NotifyIdle@TXTimer@@YAXXZ
?AddIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
??0CTXBSTR@@QAE@PB_W@Z
??BCTXBSTR@@QBEPA_WXZ
??0CTXTime@@QAE@XZ
??4CTXTime@@QAEAAV0@V0@@Z
?GetTickCount@CTXTime@@SA?AV1@XZ
??1CTXBSTR@@QAE@XZ
?ValidateBugReport@TXBugReport@@YAXXZ
?SetBugReportUin@TXBugReport@@YAXKPB_W@Z
?InitBugReport@TXBugReport@@YAXPB_W000GGKHHKKP6GHPAUtagBugReportInfo@1@PBD200PAPAXPAKPAX@Z@Z
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?Replace@CTXStringW@@QAEHPB_W0@Z
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
?GetBuffer@CTXStringW@@QAEPA_WXZ
?GetPlatformTpc@CoreCenter@Util@@YAHPAPAUITXDataRead@@@Z
?GetPlatformCore@CoreCenter@Util@@YAHPAPAUITXPlatformCore@@@Z
?GetLocalePath@TXI18N@@YA?AVCTXStringW@@PB_W@Z
??8CTXBSTR@@QBE_NPB_W@Z
??4CTXStringW@@QAEAAV0@ABVCTXBSTR@@@Z
?TrimLeft@CTXStringW@@QAEAAV1@PB_W@Z
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
??0CTXStringW@@QAE@PA_W@Z
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?OnUninitCom@Misc@Util@@YAXXZ

gf

?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z
?ScreenPoint2ClientPoint@GF@Util@@YAXPAUIGFFrame@@AAUtagPOINT@@@Z
?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@0H@Z

xgraphic32

GetCanvasHandle

kernel32

ReadFile
IsBadWritePtr
VirtualProtect
MoveFileExW
MoveFileW
lstrcpynW
lstrcmpiW
Sleep
ReleaseMutex
CloseHandle
LoadLibraryW
GetProcAddress
GetModuleFileNameW
SetUnhandledExceptionFilter
FreeLibrary
CreateMutexW
GetCommandLineW
ExpandEnvironmentStringsW
SetFilePointer
WriteFile
IsDebuggerPresent
UnhandledExceptionFilter
QueryPerformanceCounter
GetStartupInfoW
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
GetProcessHeap
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
PulseEvent
SetThreadPriority
TerminateThread
SetThreadContext
GetThreadContext
GetExitCodeThread
SuspendThread
FindClose
FindNextFileW
FindFirstFileW
SetFileAttributesW
CreateDirectoryW
RemoveDirectoryW
SetLastError
GetFileSize
GetModuleHandleExW
ResetEvent
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
GetCurrentProcess
InterlockedCompareExchange
InterlockedExchange
GetSystemTimeAsFileTime
GetProcessTimes
UnmapViewOfFile
MapViewOfFile
FormatMessageW
LoadLibraryA
GetSystemDefaultLangID
GetSystemInfo
VirtualQuery
CreateFileW
OpenFileMappingW
SwitchToThread
HeapSize
GetLocalTime
CreateFileMappingW
GetPrivateProfileIntW
InitializeCriticalSection
InterlockedExchangeAdd
WideCharToMultiByte
GetVersionExW
MultiByteToWideChar
IsBadReadPtr
WaitForSingleObject
TerminateProcess
GetCurrentThreadId
GetTempPathW
InterlockedDecrement
InterlockedIncrement
GetTickCount
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
GetSystemDirectoryW
VirtualAllocEx
OpenProcess
GetFileAttributesW
LeaveCriticalSection
EnterCriticalSection
SleepEx
WaitForMultipleObjects
SetDllDirectoryW
OpenEventW
DeleteFileW
ResumeThread
CreateProcessW
GetModuleHandleW
SetEvent
CreateEventW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
lstrlenW
ProcessIdToSessionId
GetCurrentProcessId
DeleteCriticalSection
RaiseException
GetLastError

user32

IsWindow
DestroyWindow
SendMessageTimeoutW
SetWindowPos
SetForegroundWindow
RedrawWindow
ShowWindow
FindWindowW
LoadStringW
MessageBoxW
CreateWindowExW
SetWindowLongW
WaitMessage
FindWindowA
RegisterWindowMessageW
GetClassNameW
GetAsyncKeyState
WindowFromPoint
GetClientRect
BeginPaint
FillRect
EndPaint
KillTimer
SetTimer
MoveWindow
SetParent
BringWindowToTop
SetFocus
GetMessageW
IsWindowVisible
RegisterClassExW
LoadCursorW
GetIconInfo
GetWindowRect
GetDesktopWindow
DrawIconEx
WaitForInputIdle
SetPropW
CallWindowProcW
GetPropW
PtInRect
GetWindow
GetParent
GetWindowLongW
GetCursorPos
GetForegroundWindow
GetSystemMetrics
PostThreadMessageW
ClientToScreen
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
PrivateExtractIconsW
FindWindowExW
DestroyIcon
ExitWindowsEx
UnregisterClassA
SendMessageW
GetWindowThreadProcessId
PostMessageW
DefWindowProcW

gdi32

CreateSolidBrush
CreateCompatibleDC
DeleteObject
SelectObject
DeleteDC
CreateDIBSection

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegNotifyChangeKeyValue
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegDeleteKeyW
RegDeleteValueW
RegFlushKey
RegEnumKeyExW
RegEnumValueW
RegGetKeySecurity
RegSetKeySecurity
RegQueryInfoKeyW

shell32

ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetFileInfoW
SHGetDesktopFolder
ord68
SHFileOperationW
ord680

ole32

CoGetClassObject
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoTaskMemFree
CoUninitialize
CoInitialize

oleaut32

SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
LoadRegTypeLi
SysStringLen
LoadTypeLi
VarBstrCmp
VariantClear
VariantInit

atl80

ord30
ord32
ord58
ord31

shlwapi

PathCombineW
PathRemoveFileSpecW
SHGetValueW
PathFileExistsW
PathFindExtensionW
PathAddBackslashW
SHSetValueW
StrRetToBufW
PathFindFileNameW
PathAppendW
PathQuoteSpacesW

msvcp80

?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?data@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V32@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z

msimg32

AlphaBlend

msvcr80

fread
wcstol
sscanf
_unlink
??3@YAXPAX@Z
tolower
_invalid_parameter_noinfo
_wtoi
wcscat_s
??_V@YAXPAX@Z
free
_snprintf
wcsncpy
memcpy_s
memmove_s
wcsrchr
_snwprintf
vswprintf_s
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@XZ
_wcsicmp
_vscwprintf
wcscpy_s
wcsstr
wcsncat
wcsncmp
_purecall
wcsncat_s
__RTDynamicCast
_time64
_wcslwr_s
_vsnwprintf_s
_snwprintf_s
atoi
realloc
malloc
memmove
_wcsupr_s
_mbsicmp
strncpy
fwrite
fflush
fclose
fopen
fseek
rename
_localtime64
strncpy_s
wcsncpy_s
_CxxThrowException
swprintf_s
__CxxFrameHandler3
_recalloc
memset
_beginthreadex
_wtoi64
wcschr
wcstok_s
memcpy
strchr
_snprintf_s
strrchr
_vsnprintf_s
_memicmp
swscanf_s
_time32
_wsplitpath_s
_wtol
sprintf_s
strncat_s
isxdigit
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
ftell
_wfopen_s
_except_handler3

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

imagehlp

ImageUnload
ImageRvaToSection
ImageLoad

comctl32

InitCommonControlsEx

Exports

Exports

??4_Init_locks@std@@QAEAAV01@ABV01@@Z

Sections

.text
Size: 632KB - Virtual size: 628KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 294KB - Virtual size: 314KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b23b14622e478b5e8b5278e2fbf7e8cd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

8d:72:37:54:d4:f4:bf:d1:df:76:fc:84:02:de:e4:8c:7f:bd:8f:0cSigner

Headers

File Characteristics

Imports

psapi

common

gf

xgraphic32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

atl80

shlwapi

msvcp80

msimg32

msvcr80

version

imagehlp

comctl32

Exports

Exports

Sections

.text Size: 632KB - Virtual size: 628KB

.rdata Size: 224KB - Virtual size: 221KB

.data Size: 44KB - Virtual size: 46KB

.rsrc Size: 20KB - Virtual size: 16KB

.reloc Size: 294KB - Virtual size: 314KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

8d:72:37:54:d4:f4:bf:d1:df:76:fc:84:02:de:e4:8c:7f:bd:8f:0c
Signer

.text
Size: 632KB - Virtual size: 628KB

.rdata
Size: 224KB - Virtual size: 221KB

.data
Size: 44KB - Virtual size: 46KB

.rsrc
Size: 20KB - Virtual size: 16KB

.reloc
Size: 294KB - Virtual size: 314KB