d870f795ad15ea544fe3341c8b7e389783cf132493edaf13202cf32c3f09205f

Sharing

Copy URL Twitter E-mail

General

Target

d870f795ad15ea544fe3341c8b7e389783cf132493edaf13202cf32c3f09205f
Size

4.4MB
MD5

15a159b3014bc117dea0fa7857517967
SHA1

0a5f0cfdedc1e0c620ea7701d2ef4f06f16bb494
SHA256

d870f795ad15ea544fe3341c8b7e389783cf132493edaf13202cf32c3f09205f
SHA512

3739e6dcc1e2371264cdd8aa901c6c852c51c2de3c8fe1bd2f848573854cae4bcecd69c0a9055a12f632b1b78a36310a2b404583075ff5824d9deebaadf27634
SSDEEP

98304:7ck2StWdo0bo8WPD1jwVxX/Ip+VFngRe:32StWdosojwH/Ip+Lng

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d870f795ad15ea544fe3341c8b7e389783cf132493edaf13202cf32c3f09205f

Files

d870f795ad15ea544fe3341c8b7e389783cf132493edaf13202cf32c3f09205f
.exe windows:6 windows x86 arch:x86

fe9c6789670db0162276613ee7151f6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

utilities

?SouiCalloc@soui_mem_wrapper@SOUI@@SAPAXII@Z
?OnInitFinished@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UAEXVxml_node@pugi@@@Z
?GetObjectType@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UBEHXZ
?SetAttribute@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UAEJPBD0H@Z
?SetAttribute@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UAEJABV?$TStringT@DUchar_traits@SOUI@@@2@0H@Z
?GetBuffer@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEPA_WH@Z
?Format@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAA?AV12@PB_WZZ
?GetClassType@IObject@SOUI@@SAHXZ
?Right@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBE?AV12@H@Z
?Compare@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBEHPB_W@Z
??Y?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEABV01@PB_W@Z
??4?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEAAV01@PB_W@Z
??4?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEAAV01@ABV01@@Z
?IsEmpty@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBE_NXZ
??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@ABV01@@Z
??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@XZ
?ConcatCopy@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@IAE_NHPB_WH0@Z
?SafeStrlen@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@SAHPB_W@Z
??B?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBEPB_WXZ
?GetLength@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBEHXZ
??1?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@XZ
??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@PB_W@Z
??1?$TStringT@DUchar_traits@SOUI@@@SOUI@@QAE@XZ
??0?$TStringT@DUchar_traits@SOUI@@@SOUI@@QAE@PBD@Z
?GetData@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@IBEPAUTStringData@2@XZ
?GetData@?$TStringT@DUchar_traits@SOUI@@@SOUI@@IBEPAUTStringData@2@XZ
?Mid@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBE?AV12@HH@Z
??A?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBE_WH@Z
?Mid@?$TStringT@DUchar_traits@SOUI@@@SOUI@@QBE?AV12@HH@Z
??B?$TStringT@DUchar_traits@SOUI@@@SOUI@@QBEPBDXZ
??A?$TStringT@DUchar_traits@SOUI@@@SOUI@@QBEDH@Z
?GetLength@?$TStringT@DUchar_traits@SOUI@@@SOUI@@QBEHXZ
?SouiFree@soui_mem_wrapper@SOUI@@SAXPAX@Z

soui

?GetLayoutParam@SWindow@SOUI@@UBEPAUILayoutParam@2@XZ
?GetName@SWindow@SOUI@@UBEPB_WXZ
?GetID@SWindow@SOUI@@UBEHXZ
?IsSiblingsAutoGroupped@SWindow@SOUI@@UAEHXZ
?GetSelectedSiblingInGroup@SWindow@SOUI@@UAEPAV12@XZ
?IsClipClient@SWindow@SOUI@@UAEHXZ
?OnUpdateFloatPosition@SWindow@SOUI@@UAEXABVCRect@2@@Z
?SwndProc@SWindow@SOUI@@MAEHIIJAAJ@Z
?ProcessSwndMessage@SWindow@SOUI@@MAEHIIJAAJ@Z
?SetAttribute@SWindow@SOUI@@UAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0H@Z
?GetClassNameW@SStatic@SOUI@@SAPB_WXZ
?GetClassNameW@SProgress@SOUI@@SAPB_WXZ
?GetClassNameW@STabCtrl@SOUI@@SAPB_WXZ
?GetClassNameW@SRichEdit@SOUI@@SAPB_WXZ
?GetObjectType@SwndContainerImpl@SOUI@@UBEHXZ
?FrameToHost@SwndContainerImpl@SOUI@@MAEXAAUtagRECT@@@Z
?GetAcceleratorMgr@SwndContainerImpl@SOUI@@MAEPAUIAcceleratorMgr@2@XZ
?DestroyWindow@CSimpleWnd@SOUI@@QAEHXZ
?GetObjectClass@SHostWnd@SOUI@@UBEPB_WXZ
?GetObjectType@SHostWnd@SOUI@@UBEHXZ
?IsClass@SHostWnd@SOUI@@UBEHPB_W@Z
?IsLayeredWindow@SHostWnd@SOUI@@MBEHXZ
?_HandleEvent@SHostWnd@SOUI@@UAEHPAVEventArgs@2@@Z
?ProcessWindowMessage@SHostWnd@SOUI@@UAEHPAUHWND__@@IIJAAJK@Z
?OnFinalRelease@?$TObjRefImpl2@UIObjRef@@VSWindow@SOUI@@@SOUI@@UAEXXZ
?getSingleton@?$SSingleton@VSApplication@SOUI@@@SOUI@@SAAAVSApplication@2@XZ
?Release@?$TObjRefImpl@UIObjRef@@@SOUI@@UAEJXZ
?AddRef@?$TObjRefImpl@UIObjRef@@@SOUI@@UAEJXZ
?getSingletonPtr@?$SSingleton@VSApplication@SOUI@@@SOUI@@SAPAVSApplication@2@XZ
??0SHostWnd@SOUI@@QAE@PB_W@Z
??1SHostWnd@SOUI@@UAE@XZ
?Create@SHostWnd@SOUI@@QAEPAUHWND__@@PAU3@KKHHHH@Z
?InitFromXml@SHostWnd@SOUI@@UAEHVxml_node@pugi@@@Z
?DestroyWindow@SHostWnd@SOUI@@QAEHXZ
?SetTimer@SHostWnd@SOUI@@QAEIII@Z
?KillTimer@SHostWnd@SOUI@@QAEHI@Z
?GetClientRect@SHostWnd@SOUI@@UBE?AVCRect@2@XZ
?OnDestroy@SHostWnd@SOUI@@IAEXXZ
?OnFireEvent@SHostWnd@SOUI@@MAEHAAVEventArgs@2@@Z
?GetContainerRect@SHostWnd@SOUI@@MAE?AVCRect@2@XZ
?GetHostHwnd@SHostWnd@SOUI@@MAEPAUHWND__@@XZ
?GetTranslatorContext@SHostWnd@SOUI@@MBEABV?$TStringT@_WUwchar_traits@SOUI@@@2@XZ
?OnGetRenderTarget@SHostWnd@SOUI@@MAEPAUIRenderTarget@2@ABVCRect@2@K@Z
?OnReleaseRenderTarget@SHostWnd@SOUI@@MAEXPAUIRenderTarget@2@ABVCRect@2@K@Z
?OnRedraw@SHostWnd@SOUI@@MAEXABVCRect@2@@Z
?OnReleaseSwndCapture@SHostWnd@SOUI@@MAEHXZ
?OnSetSwndCapture@SHostWnd@SOUI@@MAEKK@Z
?IsTranslucent@SHostWnd@SOUI@@MBEHXZ
?IsSendWheel2Hover@SHostWnd@SOUI@@MBEHXZ
?OnCreateCaret@SHostWnd@SOUI@@MAEHKPAUHBITMAP__@@HH@Z
?OnShowCaret@SHostWnd@SOUI@@MAEHH@Z
?OnSetCaretPos@SHostWnd@SOUI@@MAEHHH@Z
?UpdateWindow@SHostWnd@SOUI@@MAEHXZ
?UpdateTooltip@SHostWnd@SOUI@@MAEXXZ
?RegisterTimelineHandler@SHostWnd@SOUI@@MAEHPAUITimelineHandler@2@@Z
?UnregisterTimelineHandler@SHostWnd@SOUI@@MAEHPAUITimelineHandler@2@@Z
?GetMsgLoop@SHostWnd@SOUI@@MAEPAVSMessageLoop@2@XZ
?GetScriptModule@SHostWnd@SOUI@@MAEPAUIScriptModule@2@XZ
?GetScale@SHostWnd@SOUI@@MBEHXZ
?BeforePaint@SHostWnd@SOUI@@MAEXPAUIRenderTarget@2@AAVSPainter@2@@Z
?AfterPaint@SHostWnd@SOUI@@MAEXPAUIRenderTarget@2@AAVSPainter@2@@Z
?UpdateLayout@SHostWnd@SOUI@@MAEXXZ
?OnLanguageChanged@SHostWnd@SOUI@@MAEJXZ
?OnScaleChanged@SHostWnd@SOUI@@MAEXH@Z
?RequestRelayout@SHostWnd@SOUI@@UAEXKH@Z
?onRootResize@SHostWnd@SOUI@@UAE_NPAVEventArgs@2@@Z
?SetValue@SProgress@SOUI@@QAEHH@Z
?GetWindowTextW@SWindow@SOUI@@UAE?AV?$TStringT@_WUwchar_traits@SOUI@@@2@H@Z
?SetWindowTextW@SWindow@SOUI@@UAEXPB_W@Z
?SetToolTipText@SWindow@SOUI@@UAEXPB_W@Z
?GetToolTipText@SWindow@SOUI@@UAE?AV?$TStringT@_WUwchar_traits@SOUI@@@2@XZ
?GetClientRect@SWindow@SOUI@@UBEXPAUtagRECT@@@Z
?IsContainPoint@SWindow@SOUI@@UBEHABUtagPOINT@@H@Z
?OnColorize@SWindow@SOUI@@MAEXK@Z
?FindChildByName@SWindow@SOUI@@QAEPAV12@PB_WH@Z
?CreateChildren@SWindow@SOUI@@UAEHVxml_node@pugi@@@Z
?GetObjectType@SWindow@SOUI@@UBEHXZ
?CenterWindow@CSimpleWnd@SOUI@@QAEHPAUHWND__@@@Z
?OnSetCursor@SWindow@SOUI@@UAEHABVCPoint@2@@Z
?OnUpdateToolTip@SWindow@SOUI@@UAEHVCPoint@2@AAUSwndToolTipInfo@2@@Z
?OnStateChanging@SWindow@SOUI@@UAEXKK@Z
?OnStateChanged@SWindow@SOUI@@UAEXKK@Z
?OnContentChanged@SWindow@SOUI@@UAEXXZ
?tr@SWindow@SOUI@@UAE?AV?$TStringT@_WUwchar_traits@SOUI@@@2@ABV32@@Z
?SwndFromPoint@SWindow@SOUI@@UAEKVCPoint@2@H@Z
?FireEvent@SWindow@SOUI@@UAEHAAVEventArgs@2@@Z
?OnGetDlgCode@SWindow@SOUI@@UAEIXZ
?IsFocusable@SWindow@SOUI@@UAEHXZ
?OnNcHitTest@SWindow@SOUI@@UAEHVCPoint@2@@Z
?UpdateChildrenPosition@SWindow@SOUI@@UAEXXZ
?OnRelayout@SWindow@SOUI@@UAEHABVCRect@2@@Z
?GetChildrenLayoutRect@SWindow@SOUI@@UAE?AVCRect@2@XZ
?GetDesiredSize@SWindow@SOUI@@UAE?AVCSize@2@HH@Z
?GetDesiredSize@SWindow@SOUI@@UAE?AVCSize@2@PBUtagRECT@@@Z
?NeedRedrawWhenStateChange@SWindow@SOUI@@UAEHXZ
?GetTextRect@SWindow@SOUI@@UAEXPAUtagRECT@@@Z
?DrawTextW@SWindow@SOUI@@UAEXPAUIRenderTarget@2@PB_WHPAUtagRECT@@I@Z
?DrawFocus@SWindow@SOUI@@UAEXPAUIRenderTarget@2@@Z
?GetTrCtx@SWindow@SOUI@@UBEABV?$TStringT@_WUwchar_traits@SOUI@@@2@XZ
?CreateCaret@SWindow@SOUI@@UAEHPAUHBITMAP__@@HH@Z
?ShowCaret@SWindow@SOUI@@UAEXH@Z
?SetCaretPos@SWindow@SOUI@@UAEXHH@Z
?IsDrawToCache@SWindow@SOUI@@MBE_NXZ
?DefAttributeProc@SWindow@SOUI@@MAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0H@Z
?AfterAttribute@SWindow@SOUI@@MAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0HJ@Z
?GetAttribute@SWindow@SOUI@@MBE?AV?$TStringT@_WUwchar_traits@SOUI@@@2@ABV32@@Z
?RegisterDragDrop@SwndContainerImpl@SOUI@@MAEHKPAUIDropTarget@@@Z
?RevokeDragDrop@SwndContainerImpl@SOUI@@MAEHK@Z
?DoFrameEvent@SwndContainerImpl@SOUI@@MAEJIIJ@Z
?OnSetSwndFocus@SwndContainerImpl@SOUI@@MAEXK@Z
?OnGetSwndCapture@SwndContainerImpl@SOUI@@MAEKXZ
?GetFocus@SwndContainerImpl@SOUI@@MAEKXZ
?GetHover@SwndContainerImpl@SOUI@@MAEKXZ
?RegisterTrackMouseEvent@SwndContainerImpl@SOUI@@MAEHK@Z
?UnregisterTrackMouseEvent@SwndContainerImpl@SOUI@@MAEHK@Z
?MarkWndTreeZorderDirty@SwndContainerImpl@SOUI@@MAEXXZ
?BuildWndTreeZorder@SwndContainerImpl@SOUI@@MAEXXZ
?OnNextFrame@SwndContainerImpl@SOUI@@UAEXXZ
?GetLogManager@SApplication@SOUI@@QAEPAUILog4zManager@2@XZ
?SetCurSel@STabCtrl@SOUI@@QAEHH@Z
?ReflectNotifications@CSimpleWnd@SOUI@@QAEJIIJAAH@Z
?OnFinalMessage@CSimpleWnd@SOUI@@MAEXPAUHWND__@@@Z
??0SObjectInfo@SOUI@@QAE@ABV?$TStringT@_WUwchar_traits@SOUI@@@1@H@Z
?RegisterSystemObjects@SApplication@SOUI@@MAEXXZ
??0SObjectDefaultRegister@SOUI@@QAE@XZ
?GetClassType@SSkinObjBase@SOUI@@SAHXZ
?GetObjectType@SSkinObjBase@SOUI@@UBEHXZ
?GetAlpha@SSkinObjBase@SOUI@@UBEEXZ
?SetAlpha@SSkinObjBase@SOUI@@UAEXE@Z
?Draw@SSkinObjBase@SOUI@@UAEXPAUIRenderTarget@2@PBUtagRECT@@KE@Z
?Draw@SSkinObjBase@SOUI@@UAEXPAUIRenderTarget@2@PBUtagRECT@@K@Z
?GetScale@SSkinObjBase@SOUI@@UBEHXZ
?Scale@SSkinObjBase@SOUI@@UAEPAVISkinObj@2@H@Z
?GetName@SSkinObjBase@SOUI@@UBEPB_WXZ
?GetClassType@SSkinImgList@SOUI@@SAHXZ
?GetObjectType@SSkinImgList@SOUI@@UBEHXZ
?SetStates@SSkinImgList@SOUI@@UAEXH@Z
?SetImage@SSkinImgList@SOUI@@UAE_NPAUIBitmap@2@@Z
?GetImage@SSkinImgList@SOUI@@UAEPAUIBitmap@2@XZ
?SetTile@SSkinImgList@SOUI@@UAEXH@Z
?IsTile@SSkinImgList@SOUI@@UAEHXZ
?SetVertical@SSkinImgList@SOUI@@UAEXH@Z
?IsVertical@SSkinImgList@SOUI@@UAEHXZ
?GetClassNameW@SSkinScrollbar@SOUI@@SAPB_WXZ
?GetClassType@SSkinScrollbar@SOUI@@SAHXZ
?GetObjectType@SSkinScrollbar@SOUI@@UBEHXZ
?IsClass@SSkinScrollbar@SOUI@@UBEHPB_W@Z
?SetAttribute@SSkinScrollbar@SOUI@@UAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0H@Z
?SendMessageW@CSimpleWnd@SOUI@@QAEJIIJ@Z
?ShowWindow@CSimpleWnd@SOUI@@QAEHH@Z
??1SSkinScrollbar@SOUI@@UAE@XZ
?OnFinalRelease@?$TObjRefImpl@V?$SObjectImpl@VISkinObj@SOUI@@@SOUI@@@SOUI@@UAEXXZ
?Release@?$TObjRefImpl@V?$SObjectImpl@VISkinObj@SOUI@@@SOUI@@@SOUI@@UAEJXZ
?AddRef@?$TObjRefImpl@V?$SObjectImpl@VISkinObj@SOUI@@@SOUI@@@SOUI@@UAEJXZ
?OnInitFinished@?$SObjectImpl@VISkinObj@SOUI@@@SOUI@@UAEXVxml_node@pugi@@@Z
?GetAttribute@?$SObjectImpl@VISkinObj@SOUI@@@SOUI@@UBE?AV?$TStringT@_WUwchar_traits@SOUI@@@2@ABV32@@Z
?GetObjectType@?$SObjectImpl@VISkinObj@SOUI@@@SOUI@@UBEHXZ
?GetSelectedChildInGroup@SWindow@SOUI@@UAEPAV12@XZ
?SSendMessage@SWindow@SOUI@@QAEJIIJPAH@Z
?SetAttribute@?$SObjectImpl@VISkinObj@SOUI@@@SOUI@@UAEJPBD0H@Z
?SetAttribute@?$SObjectImpl@VISkinObj@SOUI@@@SOUI@@UAEJABV?$TStringT@DUchar_traits@SOUI@@@2@0H@Z
?AfterAttribute@?$SObjectImpl@VISkinObj@SOUI@@@SOUI@@UAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0HJ@Z
?GetID@?$SObjectImpl@VISkinObj@SOUI@@@SOUI@@UBEHXZ
?InitFromXml@?$SObjectImpl@VISkinObj@SOUI@@@SOUI@@UAEHVxml_node@pugi@@@Z
?DefAttributeProc@?$SObjectImpl@VISkinObj@SOUI@@@SOUI@@UAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0H@Z
??1SObjectInfo@SOUI@@QAE@XZ
??0SSkinScrollbar@SOUI@@QAE@XZ
?_Draw@SSkinScrollbar@SOUI@@MAEXPAUIRenderTarget@2@PBUtagRECT@@KE@Z
?_Scale@SSkinScrollbar@SOUI@@MAEXPAVISkinObj@2@H@Z
?CreateResProvider@SOUI@@YAHW4BUILTIN_RESTYPE@1@PAPAUIObjRef@@@Z
?Create@SHostWnd@SOUI@@QAEPAUHWND__@@PAU3@HHHH@Z
?RegisterFactory@SObjectFactoryMgr@SOUI@@QAE_NAAVSObjectFactory@2@_N@Z
?CreateObject@SObjectFactoryMgr@SOUI@@UBEPAUIObject@2@ABVSObjectInfo@2@@Z
?GetSkinSize@SSkinImgList@SOUI@@UAE?AUtagSIZE@@XZ
?IgnoreState@SSkinImgList@SOUI@@UAEHXZ
?GetStates@SSkinImgList@SOUI@@UAEHXZ
?OnColorize@SSkinImgList@SOUI@@UAEXK@Z
?GetExpandMode@SSkinImgList@SOUI@@MAEIXZ
??0SApplication@SOUI@@QAE@PAUIRenderFactory@1@PAUHINSTANCE__@@PB_WABUISystemObjectRegister@1@H@Z
??1SApplication@SOUI@@UAE@XZ
?Run@SApplication@SOUI@@QAEHPAUHWND__@@@Z
?CreateWindowByName@SApplication@SOUI@@UBEPAVSWindow@2@PB_W@Z
?CreateSkinByName@SApplication@SOUI@@UBEPAVISkinObj@2@PB_W@Z
?CreateInterpolatorByName@SApplication@SOUI@@UBEPAUIInterpolator@2@PB_W@Z
?CreateAccProxy@SApplication@SOUI@@UBEPAUIAccProxy@2@PAVSWindow@2@@Z
?CreateAccessible@SApplication@SOUI@@UBEPAUIAccessible@@PAVSWindow@2@@Z
?AddResProvider@SResProviderMgr@SOUI@@QAEXPAUIResProvider@2@PB_W@Z

kernel32

GetFileAttributesW
GetDiskFreeSpaceExW
CreateDirectoryW
SystemTimeToFileTime
GetSystemTime
ReadConsoleA
SetConsoleMode
FindFirstFileW
ConvertThreadToFiberEx
ConvertFiberToThread
InitOnceBeginInitialize
DeleteFiber
GetFileInformationByHandle
VirtualLock
VirtualFree
VirtualProtect
VirtualAlloc
GetSystemInfo
GetEnvironmentVariableW
LoadLibraryA
GetSystemDirectoryA
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeSRWLock
GetFinalPathNameByHandleW
SetFileAttributesW
SetFileTime
AreFileApisANSI
CreateDirectoryExW
CopyFileW
WaitForSingleObjectEx
GetCurrentThreadId
GetFileAttributesExW
MoveFileExW
CreateHardLinkW
GetCPInfoExW
SwitchToFiber
FormatMessageA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitOnceComplete
LCMapStringEx
CompareStringEx
Sleep
WideCharToMultiByte
OutputDebugStringA
FreeLibrary
GetProcAddress
SetCurrentDirectoryW
LoadLibraryW
SwitchToThread
GetExitCodeThread
CreateFiberEx
GetModuleFileNameW
CloseHandle
SetEndOfFile
GetTimeZoneInformation
WriteConsoleW
HeapSize
SetFilePointerEx
ReadConsoleW
ReadFile
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryW
HeapReAlloc
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
OutputDebugStringW
HeapFree
HeapAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCurrentThread
SetConsoleCtrlHandler
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
GetACP
ExitProcess
GetModuleFileNameA
WriteFile
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
EncodePointer
InterlockedFlushSList
InterlockedPushEntrySList
RaiseException
RtlUnwind
CreateFileW
DeviceIoControl
CreateIoCompletionPort
TlsFree
TlsGetValue
SleepEx
CreateProcessW
DecodePointer
QueueUserAPC
TlsAlloc
TerminateThread
SetEvent
MultiByteToWideChar
CreateEventW
PostQueuedCompletionStatus
LocalAlloc
WaitForSingleObject
GetQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
CreateWaitableTimerW
SetLastError
TlsSetValue
SetWaitableTimer
lstrcmpW
GetTickCount
CreateMutexW
lstrcpynW
lstrlenW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentProcessId
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateSymbolicLinkW
GetFileInformationByHandleEx
GetModuleHandleW
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
GetTempPathW
SetFileInformationByHandle
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoEx
LocalFree
QueryPerformanceFrequency
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
GetCurrentProcess
GetLastError
GetNativeSystemInfo

user32

GetProcessWindowStation
GetUserObjectInformationW
GetActiveWindow
PostMessageW
MessageBoxW
UnregisterClassW
OffsetRect
SendMessageW

advapi32

ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegCreateKeyExW
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW

ole32

OleInitialize
OleUninitialize

ws2_32

WSAGetLastError
setsockopt
ioctlsocket
freeaddrinfo
getsockopt
WSARecv
gethostbyaddr
WSAStartup
getaddrinfo
WSASocketW
WSASetLastError
select
WSASend
closesocket
WSACleanup
getservbyname
inet_ntoa
inet_addr
htons
htonl
gethostbyname
recv
send
accept
bind
listen
socket
shutdown
getservbyport
ntohs
getsockname
connect

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces

crypt32

CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertOpenStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptMsgClose

shell32

ShellExecuteW

shlwapi

PathFileExistsW

bcrypt

BCryptGenRandom

Exports

Exports

?CfgDecrypt@Utils@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@0@Z
?CfgEncrypt@Utils@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@0@Z
?CfgInitKey@Utils@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z
?CheckFileCertSN@Utils@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$vector@EV?$allocator@E@std@@@3@@Z
?CreateDirAll@Utils@@SAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?DeleteDirSafe@Utils@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?DeleteFileSafe@Utils@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?FindWindowW@Utils@@SAPAXPB_W@Z
?GetCurrentExeDir@Utils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?GetRealMacAddress@Utils@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?HttpDownloadFile@Utils@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
?HttpDownloadString@Utils@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@@Z
?HttpRequestJson@Utils@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@1@Z
?NormalDir@Utils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV23@@Z
?NormalDir@Utils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z
?OpenBrowser@Utils@@SAKABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?ReadFileBytes@Utils@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z
?ReadFileMD5@Utils@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
?RegisterUninstall@Utils@@SAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00000@Z
?ReplaceChar@Utils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV23@_W1@Z
?SplitString@Utils@@SA?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@D@Z
?StartupProcess@Utils@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?ToolUncompress7z@Utils@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?Trim@Utils@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z
?Trim@Utils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV23@@Z
?TrimAndToLower@Utils@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z
?TrimAndToLower@Utils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV23@@Z
?WriteFileBytes@Utils@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z
?s2w@Utils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z
?w2s@Utils@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 829KB - Virtual size: 829KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe9c6789670db0162276613ee7151f6c

Headers

DLL Characteristics

File Characteristics

Imports

utilities

soui

kernel32

user32

advapi32

ole32

ws2_32

setupapi

crypt32

shell32

shlwapi

bcrypt

Exports

Exports

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 829KB - Virtual size: 829KB

.data Size: 33KB - Virtual size: 45KB

.rsrc Size: 158KB - Virtual size: 158KB

.reloc Size: 140KB - Virtual size: 140KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 829KB - Virtual size: 829KB

.data
Size: 33KB - Virtual size: 45KB

.rsrc
Size: 158KB - Virtual size: 158KB

.reloc
Size: 140KB - Virtual size: 140KB