05ac925e5d699919cfec1c98ea9edd69

Sharing

Copy URL Twitter E-mail

General

Target

05ac925e5d699919cfec1c98ea9edd69
Size

717KB
MD5

05ac925e5d699919cfec1c98ea9edd69
SHA1

532a25618069bcce5539b27c6a557dd28b3a70b4
SHA256

5dab7d679c028b2b23914fc56946f584ede4352cd56803bd77d0d3b3f28b9060
SHA512

a431c45c9bcc43fed25230074f063687a2f21fdd75d0bdb411d7da2520cc53e73ad77dffb32baca51cbce5eec44440a5de496453a8a6f7f129bfe4cf5e71e642
SSDEEP

12288:OE7lxvz1jGIvCCmBam2X8Xv+gxgeAU6UKcY6KeknmDtPj22S8u1OovvuIub:Pfz1jEBamegrAU6UyxewmDtPj2/8u1Of

Score

1^/10

Malware Config

Signatures

Files

05ac925e5d699919cfec1c98ea9edd69
.exe regsvr32 windows:4 windows x86 arch:x86

d4b5237d08742b52f6efafb2dc4104b2

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c1:a9:58:0b:4b:e7:44:13:d0:22:9b:3d:f1:5c:fe:63:b8:ca:de:34
Signer

Actual PE Digest

c1:a9:58:0b:4b:e7:44:13:d0:22:9b:3d:f1:5c:fe:63:b8:ca:de:34

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htonl
WSAStartup
htons

common

??0CTXBSTR@@QAE@XZ
??4CTXStringW@@QAEAAV0@ABVCTXBSTR@@@Z
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?CombinePath@FS@Util@@YA?AVCTXStringW@@ABV3@0@Z
?IsFileExist@FS@@YAHPB_W@Z
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?GetFileHash@FS@Util@@YAHPB_WAAVCTXBuffer@@AAK@Z
?RemoveFileSystem@FS@@YAHPB_W@Z
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
?AddFileSystem@FS@@YAJW4FILESYSTEM_TYPE@@PB_W1HHH@Z
?AddPlugin@CoreCenter@Util@@YAHPA_WPAUITXData@@@Z
?InitPluginFileSystem@Boot@Util@@YAHPA_W@Z
?InitPluginI18NConfig@Boot@Util@@YAHPA_W@Z
?InitPluginGFConfig@Boot@Util@@YAHPA_W@Z
?EnablePlugin@CoreCenter@Util@@YAHPA_W@Z
?ToLower@CTXBSTR@@QAEJXZ
?QueryPluginCore@CoreCenter@Util@@YAHPA_WPAPAUITXPluginCore@@@Z
??4CTXBSTR@@QAEAAV0@PB_W@Z
??YCTXBSTR@@QAEAAV0@PB_W@Z
??YCTXBSTR@@QAEAAV0@ABV0@@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?GetString@CTXStringW@@QBEPB_WXZ
??YCTXStringW@@QAEAAV0@ABV0@@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?ReleaseBuffer@CTXStringW@@QAEXH@Z
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
??0CTXStringW@@QAE@PA_W@Z
??0CTXStringW@@QAE@PB_W@Z
?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z
??0CTXHttpDownload@@QAE@XZ
?SetUIInterface@CTXHttpDownload@@QAEXPAVCTXHttpDownloadSink@@@Z
?Run@CTXHttpDownload@@EAEIXZ
?SetEventMask@CTXHttpDownload@@QAEXE@Z
?Download@CTXHttpDownload@@QAEHPB_WPAU_SYSTEMTIME@@0H@Z
??1CTXHttpDownload@@UAE@XZ
?GetResponseFileName@CTXHttpDownload@@QAEHAAVCTXStringW@@@Z
?MoveDownloadFile@CTXHttpDownload@@QAEHPB_WH@Z
?CancelDownload@CTXHttpDownload@@QAEXXZ
?OnRedirected@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@PB_W@Z
?OnDownloadStart@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@KK@Z
??0CTXHttpDownloadSink@@IAE@XZ
?OnConnected@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@@Z
??1CTXHttpDownloadSink@@UAE@XZ
?OnConnecting@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@PB_W@Z
??8CTXBSTR@@QBE_NPB_W@Z
?GetPlatformCore@CoreCenter@Util@@YAHPAPAUITXPlatformCore@@@Z
?GetPlatformTpc@CoreCenter@Util@@YAHPAPAUITXDataRead@@@Z
??M@YA_NABVCTXStringW@@0@Z
?TrimLeft@CTXStringW@@QAEAAV1@PB_W@Z
?Compare@CTXStringW@@QBEHPB_W@Z
?IsEmpty@CTXBSTR@@QAEHXZ
?Find@CTXStringW@@QBEHPB_WH@Z
?GetParentDir@File@Util@@YA?AVCTXStringW@@ABV3@@Z
?GetFileName@FS@Util@@YA?AVCTXStringW@@ABV3@@Z
?SplitQNC@FS@@YAHPB_WAAVCTXStringW@@1@Z
??ICTXBSTR@@QAEPAPA_WXZ
??BCTXBSTR@@QBEPA_WXZ
??1CTXBSTR@@QAE@XZ
?Format@CTXStringW@@QAAXPB_WZZ
??H@YA?AVCTXStringW@@ABV0@0@Z
?RecordTransEnd@Perf@Util@@YAJ_JPB_WHH11H@Z
??0CTXStringW@@QAE@XZ
??4CTXStringW@@QAEAAV0@PB_W@Z
??BCTXStringW@@QBEPB_WXZ
?Replace@CTXStringW@@QAEHPB_W0@Z
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?InitBugReport@TXBugReport@@YAXPB_W000GGKHHKKP6GHPAUtagBugReportInfo@1@PBD200PAPAXPAKPAX@Z@Z
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??1CTXStringW@@QAE@XZ
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
??0CTXBSTR@@QAE@PB_W@Z
?AddIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
?NotifyIdle@TXTimer@@YAXXZ
?RecordTransBegin@Perf@Util@@YA_JPB_WHH00@Z
?DeleteDirectory@FS@@YAHPB_W@Z
?IsDirectoryExist@FS@@YAHPB_W@Z
?GetLocalePath@TXI18N@@YA?AVCTXStringW@@PB_W@Z
?GetBuffer@CTXStringW@@QAEPA_WXZ
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
??0CTXStringW@@QAE@ABV0@@Z
?SetBugReportUin@TXBugReport@@YAXKPB_W@Z
?ValidateBugReport@TXBugReport@@YAXXZ
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?OnExitCoreCenter@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?OnUninitCom@Misc@Util@@YAXXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?DelIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
?GetLength@CTXStringW@@QBEHXZ
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?IsEmpty@CTXStringW@@QBE_NXZ

gf

?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z
?SetUseWSCAPTIONInWin7@GF@Util@@YAXH@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@0@Z
?GetService@GF@Util@@YAJABU_GUID@@PA_WPAPAX@Z
?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z

xgraphic32

DeleteTexture
CanvasToTexture
FillSolidRect
SetCanvasFilter
GetTextureSize
SetTextureMode
SetTextureFilter
GetTextureFilter
CreateTexture
LockTextureBits
UnlockTextureBits
CreateCanvas
DrawTexture

mfc80u

ord5222
ord4255
ord4475
ord3943
ord2638
ord3703
ord3713
ord3712
ord2984
ord2527
ord2640
ord2534
ord2832
ord2708
ord4301
ord2829
ord2725
ord2531
ord5562
ord5209
ord5226
ord4562
ord3942
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord5096
ord1007
ord5579
ord2009
ord2054
ord4320
ord6274
ord3795
ord6272
ord4008
ord4032
ord762
ord577
ord870
ord283
ord776
ord774
ord280
ord1472
ord6700
ord282
ord1479
ord4101
ord4100
ord293
ord5524
ord2260
ord899
ord2311
ord2461
ord2121
ord566
ord757
ord1121
ord1049
ord2239
ord3800
ord265
ord1908
ord1079
ord1182
ord266
ord1176
ord1178
ord764
ord909
ord1198
ord3327

msvcr80

wcsrchr
_time64
malloc
free
wcscpy_s
wcsncpy_s
memset
__CxxFrameHandler3
_snwprintf
wcsncat
wcslen
memcpy
_wcsicmp
_purecall
_recalloc
__argc
__wargv
_invalid_parameter_noinfo
_unlink
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
wcsncpy
_snprintf_s
fflush
_vsnprintf_s
_memicmp
_vsnprintf
setlocale
_vsnwprintf_s
fclose
strncpy_s
fwrite
_except_handler3
strchr
fopen_s
strrchr
_wsplitpath_s
swscanf_s
_wtoi64
memmove_s
calloc
_wtoi
atof
wcsncat_s
wcsncmp
_wtof
memmove
realloc
fopen
fseek
rename
_localtime64
_wtol
wcstoul
vswprintf_s
_vswprintf
wcsstr
_beginthreadex
wcscat_s
_wfopen_s
ferror
fputc
fprintf
fread
ftell
swprintf_s
wcstol
wcschr
isspace
tolower
isalpha
isalnum
strncmp
_wcsupr
ldiv
putchar
putwchar
_wcsupr_s
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock

kernel32

GetProcessHeap
HeapFree
GetVersionExA
DeleteTimerQueueTimer
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
SetUnhandledExceptionFilter
GetStartupInfoW
OpenProcess
SwitchToThread
QueryPerformanceCounter
lstrcpynW
GetCommandLineW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
GetOverlappedResult
ConnectNamedPipe
CreateNamedPipeW
SetNamedPipeHandleState
WaitNamedPipeW
ResetEvent
TerminateThread
GetTimeFormatW
GetDateFormatW
GetCurrencyFormatW
GetNumberFormatW
GetLocaleInfoW
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
GetLocaleInfoA
QueueUserAPC
GetSystemDirectoryW
lstrlenA
GetACP
FormatMessageW
InterlockedExchangeAdd
CreateTimerQueueTimer
GetTempPathW
WaitForMultipleObjects
GetProcessTimes
ReleaseMutex
CreateFileMappingW
LocalFileTimeToFileTime
SetFileTime
GetCurrentDirectoryW
CreateDirectoryW
MultiByteToWideChar
ReadFile
SystemTimeToFileTime
SetFilePointer
DeleteFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WaitForSingleObject
CreateEventW
FindFirstFileW
GetFileAttributesW
GetSystemTimeAsFileTime
CopyFileW
CreateFileW
LoadLibraryW
GetPrivateProfileStringW
WriteFile
FreeLibrary
LoadLibraryA
Sleep
GetSystemDefaultLangID
GetSystemInfo
GetVersionExW
VirtualQuery
UnmapViewOfFile
MapViewOfFile
CloseHandle
GetLocalTime
SetEvent
OpenEventW
InterlockedCompareExchange
OpenFileMappingW
SetLastError
WideCharToMultiByte
InterlockedExchange
IsBadReadPtr
GetThreadLocale
SetThreadLocale
SetDllDirectoryW
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
GetCurrentThread
DuplicateHandle
GetTickCount
lstrcmpiW
CreateProcessW
GetCurrentProcessId
ProcessIdToSessionId
lstrlenW
GetModuleFileNameW
SleepEx
CreateMutexW
GetModuleHandleW
GetProcAddress
GetCurrentProcess
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
LeaveCriticalSection
EnterCriticalSection

user32

DefWindowProcW
ShowWindow
UnregisterClassA
RedrawWindow
SetForegroundWindow
FindWindowW
SetWindowLongW
MessageBoxW
SendMessageW
LoadStringW
CharNextW
CreateWindowExW
DispatchMessageW
PostThreadMessageW
TranslateMessage
PeekMessageW
GetMessageW
WaitMessage
RegisterClassExW
GetWindowLongW
RegisterWindowMessageW
DestroyWindow
MoveWindow
GetWindowRect
GetDesktopWindow
IsIconic
IsWindow
SendMessageTimeoutW
FindWindowA
SystemParametersInfoW
SetPropW
GetPropW
CallWindowProcW
PostMessageW

advapi32

RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey

shell32

SHGetFileInfoW
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteW
SHCreateDirectoryExW

comctl32

InitCommonControlsEx

shlwapi

StrFromTimeIntervalW
StrFormatKBSizeW
StrFormatByteSizeW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
PathRemoveExtensionW
PathFindFileNameW
PathIsDirectoryW

ole32

CoLoadLibrary
CoRegisterClassObject
CLSIDFromString
CoFreeLibrary
CoCreateInstance
CoInitialize
CoUninitialize
StringFromCLSID
CoTaskMemFree

oleaut32

VariantClear
SysAllocString
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
SysFreeString

atl80

ord23
ord58
ord32
ord31
ord30
ord15
ord18
ord22
ord64
ord61

msvcp80

?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??0?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAK@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??_D?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?uncaught_exception@std@@YA_NXZ
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHABV12@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?data@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?ends@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??0strstreambuf@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??1strstreambuf@std@@UAE@XZ
?freeze@strstreambuf@std@@QAEX_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ

psapi

GetModuleFileNameExW
EnumProcessModules
GetModuleBaseNameW
EnumProcesses

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 456KB - Virtual size: 454KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d4b5237d08742b52f6efafb2dc4104b2

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

c1:a9:58:0b:4b:e7:44:13:d0:22:9b:3d:f1:5c:fe:63:b8:ca:de:34Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

common

gf

xgraphic32

mfc80u

msvcr80

kernel32

user32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

atl80

msvcp80

psapi

version

Exports

Exports

Sections

.text Size: 456KB - Virtual size: 454KB

.rdata Size: 152KB - Virtual size: 150KB

.data Size: 20KB - Virtual size: 24KB

.rsrc Size: 28KB - Virtual size: 26KB

.reloc Size: 52KB - Virtual size: 51KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

c1:a9:58:0b:4b:e7:44:13:d0:22:9b:3d:f1:5c:fe:63:b8:ca:de:34
Signer

.text
Size: 456KB - Virtual size: 454KB

.rdata
Size: 152KB - Virtual size: 150KB

.data
Size: 20KB - Virtual size: 24KB

.rsrc
Size: 28KB - Virtual size: 26KB

.reloc
Size: 52KB - Virtual size: 51KB