1fd92dd35b8a26685d63e2c6d471ef25

Sharing

Copy URL Twitter E-mail

General

Target

1fd92dd35b8a26685d63e2c6d471ef25
Size

3.8MB
MD5

1fd92dd35b8a26685d63e2c6d471ef25
SHA1

d1588191e54e0ac723386c881ca766633df52bf1
SHA256

3daea71fdd59d35f84875da9f3bc7930946aaef956b91ce2f3256388840d8b5b
SHA512

68346f5a4a22e23d444b5d95183d4b4b553b6c71e81ad608e7867debfe2a198ce18fc5b456cd55559a32bb220ac623a4e1cc7bee0866a721e0f123e9961fad78
SSDEEP

98304:B4oHBjaaIHn4R3gyzdTOovBs993E5u4QDwCp1nC:LHRaaIHn4VgwdW9905cp1C

Score

1^/10

Malware Config

Signatures

Files

1fd92dd35b8a26685d63e2c6d471ef25
.dll windows:5 windows x86 arch:x86

3e2356ece1d06f88ee1e2ba9423fdf8e

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

30:05:7d:6e:26:0d:0a:17:ff:ad:1b:da:f6:67:eb:f4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/10/2017, 00:00

Not After

12/11/2019, 23:59

Subject

CN=Shanghai Oriental Webcasting Co. Ltd.,OU=IT,O=Shanghai Oriental Webcasting Co. Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:15:bf:0d:75:ea:66:90:38:08:05:c5:e4:5c:fa:82
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

13/10/2017, 00:00

Not After

12/11/2019, 23:59

Subject

CN=Shanghai Oriental Webcasting Co. Ltd.,OU=IT,O=Shanghai Oriental Webcasting Co. Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3d:11:99:fa:2e:42:c3:d4:0f:4f:8a:92:6e:ab:49:f3:b9:7c:f4:7f:60:02:32:ea:68:38:37:e2:83:f4:53:03
Signer

Actual PE Digest

3d:11:99:fa:2e:42:c3:d4:0f:4f:8a:92:6e:ab:49:f3:b9:7c:f4:7f:60:02:32:ea:68:38:37:e2:83:f4:53:03

Digest Algorithm

sha256

PE Digest Matches

true

cb:14:36:c3:27:4e:a1:bf:71:c2:90:f5:5b:37:c7:bf:02:67:fe:85
Signer

Actual PE Digest

cb:14:36:c3:27:4e:a1:bf:71:c2:90:f5:5b:37:c7:bf:02:67:fe:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetSetOptionA
HttpOpenRequestW
HttpSendRequestExW
HttpQueryInfoW
FtpGetFileSize
InternetErrorDlg
InternetSetCookieExW
InternetGetCookieExW
InternetSetStatusCallbackA
HttpAddRequestHeadersW
InternetCanonicalizeUrlW
InternetCombineUrlW
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
FindCloseUrlCache
DeleteUrlCacheEntryW
CreateUrlCacheEntryW
InternetConnectW
InternetOpenW
InternetCrackUrlW
InternetQueryOptionW
InternetSetOptionW
InternetGetLastResponseInfoW
FtpCommandW
InternetWriteFile
HttpSendRequestW
InternetCloseHandle
InternetQueryDataAvailable
InternetSetFilePointer
HttpEndRequestW
FtpOpenFileW
InternetReadFileExA
InternetReadFile
InternetSetStatusCallbackW

kernel32

EncodePointer
LoadLibraryExW
lstrcmpW
lstrcmpA
TlsGetValue
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetCurrentThread
GetThreadLocale
GetVolumeInformationW
lstrcmpiW
GlobalGetAtomNameW
CompareStringW
GetLocaleInfoW
GetTempPathA
GetUserDefaultUILanguage
FileTimeToLocalFileTime
GetFileSizeEx
GetFileTime
GetCurrentDirectoryW
FindResourceExW
GetProfileIntW
GetUserDefaultLCID
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
LCMapStringW
SwitchToThread
LoadLibraryExA
InterlockedPushEntrySList
InterlockedPopEntrySList
OutputDebugStringA
GlobalSize
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetFullPathNameW
GetFullPathNameA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetFileAttributesExW
DeleteFileA
UnlockFileEx
LockFileEx
LockFile
UnlockFile
FlushFileBuffers
AreFileApisANSI
InterlockedCompareExchange
LoadLibraryA
FlushInstructionCache
VirtualProtect
GetFileAttributesA
LocalFileTimeToFileTime
GetCurrentDirectoryA
GetProcessHeap
DecodePointer
HeapAlloc
HeapReAlloc
HeapSize
HeapFree
VirtualFree
VirtualAlloc
GlobalFindAtomW
lstrcpynW
FreeResource
GetWindowsDirectoryW
MulDiv
lstrcmpiA
lstrlenW
FormatMessageW
SetErrorMode
SuspendThread
SetThreadPriority
GetPrivateProfileStringA
lstrcpyW
IsValidLanguageGroup
CreateFileA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
LocalAlloc
VirtualQuery
OpenEventA
GetSystemInfo
lstrcatW
GetSystemDirectoryW
VerifyVersionInfoW
FormatMessageA
VerSetConditionMask
InterlockedExchange
TerminateProcess
GetCurrentThreadId
DuplicateHandle
OpenProcess
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
TerminateThread
GetExitCodeThread
GlobalAddAtomW
GlobalDeleteAtom
GetLocalTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GlobalFlags
GlobalUnlock
GlobalLock
CreateEventA
CreateThread
SetLastError
GetLongPathNameW
GetModuleHandleA
SetUnhandledExceptionFilter
GetModuleFileNameA
GetCurrentProcess
VirtualProtectEx
GetSystemTime
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
InitializeCriticalSectionAndSpinCount
RaiseException
GetSystemDefaultLangID
GlobalFree
ResumeThread
GetCurrentProcessId
GlobalAlloc
SearchPathW
GetFileSize
RemoveDirectoryW
LocalFree
GetVersionExW
GetFileAttributesW
MoveFileW
CopyFileW
MoveFileExW
FindClose
FindNextFileW
FindFirstFileW
OutputDebugStringW
InterlockedDecrement
InterlockedIncrement
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteFileW
TlsFree
TlsAlloc
WriteFile
ReadFile
SetFileTime
SetEndOfFile
SetFilePointer
CreateFileW
GetDiskFreeSpaceExW
SystemTimeToFileTime
SetWaitableTimer
CreateWaitableTimerW
GetTempFileNameW
GetTempPathW
GetLastError
ResetEvent
CancelWaitableTimer
WaitForMultipleObjects
GetTickCount
MultiByteToWideChar
TlsSetValue
IsBadWritePtr
IsBadReadPtr
SetEvent
CreateEventW
SetFileAttributesW
WideCharToMultiByte
CloseHandle
WaitForSingleObject
CreateProcessW
Sleep
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetStringTypeW
GetCPInfo
RtlUnwind
InterlockedFlushSList
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetCommandLineA
GetCommandLineW
HeapQueryInformation
SetStdHandle
GetFileType
QueryPerformanceFrequency
GetACP
GetStdHandle
GetConsoleMode
ReadConsoleW
IsValidLocale
EnumSystemLocalesW
SetFilePointerEx
GetConsoleCP
GetTimeZoneInformation
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
GetSystemDefaultUILanguage

user32

GetWindowPlacement
GetClassInfoW
RegisterClassW
GetMessageTime
RegisterWindowMessageW
GetMenuStringW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetLayeredWindowAttributes
CreatePopupMenu
RemoveMenu
RedrawWindow
GetMenuState
InsertMenuW
ModifyMenuW
AppendMenuW
GetMenuDefaultItem
GetMessagePos
InflateRect
DrawStateW
GetMenuItemID
GetSystemMenu
GetMenu
IsMenu
WindowFromDC
GetMenuInfo
CopyAcceleratorTableW
GetIconInfo
CopyImage
LoadBitmapW
GetSysColor
CopyIcon
GrayStringW
DrawTextExW
TabbedTextOutW
IntersectRect
IsRectEmpty
wvsprintfW
MessageBoxA
UpdateWindow
EnumDisplayMonitors
GetKeyNameTextW
MapVirtualKeyW
SystemParametersInfoW
MonitorFromPoint
MonitorFromRect
GetClipboardData
IsClipboardFormatAvailable
CloseClipboard
SetClipboardData
EmptyClipboard
IsHungAppWindow
FindWindowW
LoadStringW
GetMonitorInfoW
MonitorFromWindow
OpenClipboard
GetKeyState
GetFocus
GetWindowThreadProcessId
SetParent
SetFocus
DestroyMenu
TrackPopupMenu
CheckMenuItem
SetMenuItemInfoW
GetSubMenu
LoadMenuW
DeleteMenu
GetMenuItemInfoW
GetMenuItemCount
SetActiveWindow
BeginDeferWindowPos
GetAncestor
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
UpdateLayeredWindow
GetCapture
RegisterClassExW
GetClassInfoExW
DefWindowProcW
GetDesktopWindow
IsChild
GetWindowDC
DeferWindowPos
EndDeferWindowPos
GetDlgItem
GetWindowLongW
FindWindowExW
GetParent
GetWindowRect
ScreenToClient
MapWindowPoints
DestroyWindow
CreateWindowExW
RegisterHotKey
UnregisterHotKey
DrawTextW
MoveWindow
PostMessageW
GetClassNameW
IsZoomed
IsIconic
WindowFromPoint
FillRect
ClientToScreen
GetForegroundWindow
GetAsyncKeyState
SendMessageTimeoutW
SetWindowLongW
SetWindowLongA
PostThreadMessageW
CopyRect
GetPropW
SetPropW
RemovePropW
UnregisterClassW
GetSystemMetrics
GetClientRect
OffsetRect
SetRectEmpty
ReleaseCapture
SetCapture
DrawIconEx
LoadImageW
DestroyIcon
GetWindow
EqualRect
EndPaint
GetDlgCtrlID
SetMenu
ValidateRect
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
GetWindowTextW
GetWindowTextLengthW
AdjustWindowRectEx
MessageBoxW
GetClassLongW
GetTopWindow
GetLastActivePopup
LoadIconW
SetScrollInfo
GetScrollInfo
WinHelpW
ReleaseDC
GetDC
BeginPaint
GetCursorPos
KillTimer
BringWindowToTop
InvalidateRect
SetTimer
SetRect
SendMessageW
SetCursor
CheckDlgButton
IsWindowEnabled
SetWindowTextW
IsDialogMessageW
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetActiveWindow
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
InvalidateRgn
PostQuitMessage
WaitMessage
SetWindowContextHelpId
GetNextDlgGroupItem
MapDialogRect
DestroyCursor
CreateMenu
SetWindowPlacement
EnableWindow
IsWindowVisible
GetWindowRgn
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
SetWindowRgn
IsWindow
SetWindowPos
ShowWindow
SetForegroundWindow
PtInRect
LoadCursorW
DrawMenuBar
GetUpdateRect
CharUpperBuffW
GetDoubleClickTime
SetMenuDefaultItem
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
GetComboBoxInfo
LockWindowUpdate
DrawIcon
FrameRect
SetCursorPos
DrawFrameControl
DrawEdge
SetClassLongW
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
DrawFocusRect
UnionRect
TrackMouseEvent
RegisterClipboardFormatW
RealChildWindowFromPoint
GetSysColorBrush
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
CharUpperW
CharNextW
SendDlgItemMessageA
ShowOwnedPopups
MessageBeep
CallWindowProcW

gdi32

LineTo
RestoreDC
SaveDC
ExtSelectClipRgn
SelectPalette
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetMapMode
PatBlt
SetRectRgn
DPtoLP
IntersectClipRect
GetBkColor
GetTextColor
GetTextMetricsW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
LPtoDP
OffsetRgn
FillRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
GetWindowExtEx
GetViewportExtEx
GetObjectType
GetClipBox
ExcludeClipRect
CreatePatternBrush
CreateDCW
CopyMetaFileW
SelectClipRgn
FrameRgn
CreateHatchBrush
Rectangle
CreateRoundRectRgn
GetNearestColor
SetStretchBltMode
CreateBitmap
SetBkColor
GetDIBits
StretchBlt
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
EnumFontFamiliesExW
SetPixel
GetPixel
CreateFontW
SetDIBColorTable
CreateDIBSection
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SetTextColor
SetBkMode
CreateSolidBrush
DeleteDC
CreateFontIndirectW
GetObjectW
RoundRect
GetTextExtentPoint32W
GetStockObject
SelectObject
CreatePen
GetRegionData
DeleteObject
CombineRgn
CreateRectRgnIndirect
GetRgnBox
BitBlt
CreateRectRgn

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegOpenKeyW
RegQueryValueExW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
AllocateAndInitializeSid
SetEntriesInAclW
OpenProcessToken
SetNamedSecurityInfoW
FreeSid
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
GetUserNameW
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW

shell32

ExtractIconW
SHGetFileInfoW
CommandLineToArgvW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ord680
ShellExecuteW
SHChangeNotify
SHBrowseForFolderW
SHGetFolderPathW
DragQueryFileW
DragFinish
SHGetDesktopFolder
SHAppBarMessage
SHGetSpecialFolderPathW

comctl32

_TrackMouseEvent
InitCommonControlsEx
ImageList_GetIconSize
ImageList_GetIcon
ImageList_Draw

shlwapi

PathIsDirectoryW
PathGetDriveNumberW
PathAppendW
PathFileExistsW
StrStrIW
StrChrW
StrCmpIW
SHGetValueW
PathCombineW
StrStrIA
PathIsRootW
PathAddBackslashW
PathFindExtensionW
PathRemoveBackslashW
PathFindFileNameW
PathRemoveExtensionW
UrlGetPartW
StrStrW
SHSetValueW
SHDeleteKeyW
PathRemoveFileSpecA
PathStripToRootW
PathAppendA
PathRemoveFileSpecW
StrFormatKBSizeW
UrlUnescapeW
PathIsUNCW
SHDeleteValueW

uxtheme

DrawThemeText
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
CloseThemeData
OpenThemeData
DrawThemeParentBackground
IsAppThemed

ole32

OleCreateMenuDescriptor
CoInitialize
CoCreateInstance
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject
OleInitialize
OleUninitialize
CoTaskMemFree
CoGetMalloc
CoCreateGuid
CoTaskMemAlloc
OleDuplicateData
ReleaseStgMedium
CoGetClassObject
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
CLSIDFromString
CLSIDFromProgID
CoDisconnectObject
CoFreeUnusedLibraries
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoInitializeEx
CreateStreamOnHGlobal
DoDragDrop
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleLockRunning
OleDestroyMenuDescriptor
IsAccelerator
OleTranslateAccelerator

oleaut32

SysStringLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnaccessData
OleLoadPicturePath
VariantChangeType
SystemTimeToVariantTime
VariantTimeToSystemTime
OleCreateFontIndirect
SafeArrayCreateVector
VariantInit
VariantCopy
VarBstrFromDate
LoadTypeLi
SysAllocString
VariantClear
SysAllocStringLen
SafeArrayDestroy
SafeArrayAccessData
SysFreeString

oledlg

OleUIBusyW

urlmon

URLDownloadToFileW

crypt32

CertGetCertificateContextProperty
CertFreeCertificateChain

ws2_32

WSAStartup
WSACleanup
WSASetLastError

dsound

ord1

iphlpapi

GetAdaptersInfo

gdiplus

GdipDrawImageRectI
GdipCreateBitmapFromStream
GdiplusShutdown
GdipSetInterpolationMode
GdipFree
GdipAlloc
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenStartCap
GdipSetPenEndCap
GdipCreateFromHDC
GdipCreateFromHWND
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipFillRectangleI
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDrawImageI
GdipCloneImage
GdipSaveImageToFile
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW
waveOutWrite
midiStreamOpen

wintrust

WinVerifyTrust

Exports

Exports

TridCore
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_config
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_preload
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_step
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strnicmp
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_mbcs_to_utf8

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 576KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 486KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e2356ece1d06f88ee1e2ba9423fdf8e

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

30:05:7d:6e:26:0d:0a:17:ff:ad:1b:da:f6:67:eb:f4Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

4f:15:bf:0d:75:ea:66:90:38:08:05:c5:e4:5c:fa:82Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

3d:11:99:fa:2e:42:c3:d4:0f:4f:8a:92:6e:ab:49:f3:b9:7c:f4:7f:60:02:32:ea:68:38:37:e2:83:f4:53:03Signer

cb:14:36:c3:27:4e:a1:bf:71:c2:90:f5:5b:37:c7:bf:02:67:fe:85Signer

Headers

DLL Characteristics

File Characteristics

Imports

version

wininet

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

urlmon

crypt32

ws2_32

dsound

iphlpapi

gdiplus

oleacc

imm32

winmm

wintrust

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 576KB - Virtual size: 576KB

.data Size: 34KB - Virtual size: 486KB

.rsrc Size: 372KB - Virtual size: 371KB

.reloc Size: 199KB - Virtual size: 198KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

30:05:7d:6e:26:0d:0a:17:ff:ad:1b:da:f6:67:eb:f4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

4f:15:bf:0d:75:ea:66:90:38:08:05:c5:e4:5c:fa:82
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

3d:11:99:fa:2e:42:c3:d4:0f:4f:8a:92:6e:ab:49:f3:b9:7c:f4:7f:60:02:32:ea:68:38:37:e2:83:f4:53:03
Signer

cb:14:36:c3:27:4e:a1:bf:71:c2:90:f5:5b:37:c7:bf:02:67:fe:85
Signer

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 576KB - Virtual size: 576KB

.data
Size: 34KB - Virtual size: 486KB

.rsrc
Size: 372KB - Virtual size: 371KB

.reloc
Size: 199KB - Virtual size: 198KB