08e1883287e5420870b8d1c21a892f6d

Sharing

Copy URL Twitter E-mail

General

Target

08e1883287e5420870b8d1c21a892f6d
Size

1.1MB
MD5

08e1883287e5420870b8d1c21a892f6d
SHA1

18b53dc58854dae05ab955c3e4d791160a592b19
SHA256

117c33500a6b8f1dbc6fc73b0531ba89e026f3a9dd0dc47394a0a09ebeadfdb5
SHA512

bbd3187ae631ca208e4d31c4feb753f5d98f3fab2cd50e8f52e5f2063707948129f8e4d66b87f271af21bd6f8b1b1268d93dd9d03ba00adca4da87bf8e91ca8a
SSDEEP

12288:9oG9bM/Hq2mLlSBkS4WN3JTKDCI9uc9LMbZMT5SsMQDyW3u0K5NZAE2r8p:9XQXZTtMT5RQEu0K/a8p

Score

1^/10

Malware Config

Signatures

Files

08e1883287e5420870b8d1c21a892f6d
.exe windows:4 windows x86 arch:x86

ef38ddc7f58ca16c4a9a530a53228e76

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27/02/2012, 00:00

Not After

26/02/2015, 23:59

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

bdlogicutils

?GetBDCrashCatcher@BDLogicUtils@@YAPAVIBDCrashCatcher@1@XZ
?GetBDLogicTaskMgr@BDLogicUtils@@YAPAVIBDLogicTaskMgr@1@XZ
?GetBDWhiteListMgr@BDLogicUtils@@YAPAVIBDWhiteListMgr@1@XZ
?BDLogicUtilsLibrary_Init@BDLogicUtils@@YAHXZ
?GetBDMReportMgr@BDLogicUtils@@YAPAVIBDMReportMgr@1@XZ

bdmframework

?Init@CEventHookManager@@QAEHXZ
?SetAPCParam@CEventHookManager@@QAEXKPAXPAUHWND__@@@Z
?Init@CServiceManager@@QAEHXZ
?Instance@?$CSingleton@VCServiceManager@@@utils@@SAPAVCServiceManager@@XZ
?SetAPCParam@CServiceManager@@QAEXKPAXPAUHWND__@@@Z
?Init@TComFactory@@QAEHXZ
?CreateServiceFunctionObjParam@@YGPAXPB_WP6GHPAXIJJ@Z1J@Z
?Instance@?$CSingleton@VTComFactory@@@utils@@SAPAVTComFactory@@XZ
?Start@TComFactory@@QAEHXZ
?Stop@TComFactory@@QAEHXZ
?Stop@CServiceManager@@QAEHXZ
?Stop@CEventHookManager@@QAEHXZ
?Instance@?$CSingleton@VCIpcServer@IPC@@@utils@@SAPAVCIpcServer@IPC@@XZ
?CallHookSubscribers@@YGHPAXIJ@Z
_TAddObj@12
_TCreateObj@8
?Set@CEvent@utils@@QAEXXZ
?GetEvent@CEvent@utils@@QBEPAXXZ
?_b_SetIpcNodeServerName@CIpcServer@IPC@@QAEXPB_W@Z
??0CManualResetEvent@utils@@QAE@PAU_SECURITY_ATTRIBUTES@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?Init@InstanceHandler@utils@@QAEHPB_WPAU_SECURITY_ATTRIBUTES@@@Z
??1InstanceHandler@utils@@QAE@XZ
??0InstanceHandler@utils@@QAE@XZ
?Stop@CIpcServer@IPC@@QAEHXZ
?CallService@@YGHPB_WIJ@Z
??1CManualResetEvent@utils@@UAE@XZ
?Start@CIpcServer@IPC@@QAEHXZ
?Init@CIpcServer@IPC@@QAEHXZ
?CreateServiceFunctionParam@@YGPAXPB_WP6GHIJJ@ZJ@Z
?DestroyHookableEvent@@YGHPAX@Z
?DestroyServiceFunction@@YGHPAX@Z
?HookEvent@@YGPAXPB_WP6GHIJ@Z@Z
?HookEventMessage@@YGPAXPB_WPAUHWND__@@I@Z
?HookEventObj@@YGPAXPB_WP6GHPAXIJ@Z1@Z
?HookEventObjParam@@YGPAXPB_WP6GHPAXIJJ@Z1J@Z
?HookEventParam@@YGPAXPB_WP6GHIJJ@ZJ@Z
?KillObjectEventHooks@@YGXPAX@Z
?KillObjectServices@@YGXPAX@Z
?NotifyEventHooks@@YGHPAXIJ@Z
?ServiceExists@@YGHPB_W@Z
?SetHookDefaultForHookableEvent@@YGHPAXP6GHIJ@Z@Z
?UnhookEvent@@YGHPAX@Z
_TQueryByCreateObj@16
_TQueryObj@8
?CallFunctionAsync@@YGHP6GXPAX@Z0@Z
?CallServiceSync@@YGHPB_WIJ@Z
?CreateHookableEvent@@YGPAXPB_W@Z
?CreateServiceFunction@@YGPAXPB_WP6GHIJ@Z@Z
?CreateServiceFunctionObj@@YGPAXPB_WP6GHPAXIJ@Z1@Z
?Instance@?$CSingleton@VCEventHookManager@@@utils@@SAPAVCEventHookManager@@XZ

shlwapi

StrChrW
SHDeleteKeyW
StrRStrIW
SHGetValueW
PathAppendW
PathAddBackslashW
StrFormatByteSizeW
StrFormatKBSizeW
StrFromTimeIntervalW
PathCombineW
StrRChrW
PathRemoveFileSpecW
PathIsDirectoryW
PathFileExistsW
wnsprintfW

bdmskin

?SetResourceZip@IResourceManager@ExpandInterface@BDMSkin@@SAXPB_W@Z
?BDMSkinLibInit@BDMSkin@@YAHPB_W00@Z
?GetData@CStdString@Utils@BDMSkin@@QBEPB_WXZ
??1CStdString@Utils@BDMSkin@@QAE@XZ
??0CStdString@Utils@BDMSkin@@QAE@PB_W@Z
??YCStdString@Utils@BDMSkin@@QAEABV012@PB_W@Z
?BDMLangGetLangMgr@BDMSkin@@YAPAVIBDMLangMgr@1@XZ

kernel32

LoadLibraryW
ExpandEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
DeviceIoControl
GetSystemInfo
FreeLibrary
GetExitCodeProcess
HeapFree
TerminateProcess
GetProcessHeap
HeapAlloc
GetWindowsDirectoryW
GetCurrentDirectoryW
InterlockedDecrement
GetSystemDefaultLangID
InterlockedIncrement
GetSystemWindowsDirectoryW
DebugBreak
GetFileSizeEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MoveFileW
GetBinaryTypeW
IsBadReadPtr
GetSystemWow64DirectoryW
ReleaseMutex
GetNumberFormatW
GetDateFormatW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCurrencyFormatW
SystemTimeToFileTime
GetTimeFormatW
GetCurrentProcessId
GetLocaleInfoW
GetDiskFreeSpaceW
ReleaseSemaphore
CreateSemaphoreW
CreateThread
GetModuleHandleW
GetProcAddress
Process32NextW
ProcessIdToSessionId
Process32FirstW
CreateToolhelp32Snapshot
GetSystemTimeAsFileTime
SetProcessWorkingSetSize
OpenEventW
WaitForMultipleObjects
CreateProcessW
GetCurrentProcess
OpenProcess
ReadFile
GetFileSize
CreateFileW
GetFileAttributesW
lstrlenW
GetModuleFileNameW
CreateEventW
LocalFree
MultiByteToWideChar
lstrlenA
GetLocalTime
WideCharToMultiByte
WriteFile
SetEvent
ResetEvent
WaitForSingleObject
CreateMutexW
CloseHandle
HeapDestroy
HeapReAlloc
HeapSize
InterlockedExchange
InterlockedCompareExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
FormatMessageA
Sleep
GetTickCount
GetLastError
DeleteFileW
MoveFileExW
FindClose
FindNextFileW
FindFirstFileW
lstrcmpiW
GetVersionExW
SetConsoleCtrlHandler
ExpandEnvironmentStringsA
CreateEventA
TerminateThread
CopyFileW
LocalAlloc
OutputDebugStringA
GetSystemDirectoryW

user32

GetWindowLongW
DefWindowProcW
RegisterClassExW
CreateWindowExW
SetWindowLongW
DestroyWindow
GetMessageW
IsWindow
RegisterClassW
KillTimer
DispatchMessageW
TranslateMessage
ShowWindow
PostMessageW
SendMessageW
DestroyIcon

advapi32

OpenServiceW
CloseServiceHandle
QueryServiceStatusEx
ControlService
RegCreateKeyExW
RegDeleteKeyW
RegGetKeySecurity
RegNotifyChangeKeyValue
RegFlushKey
RegDeleteValueW
RegSetKeySecurity
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceW
DeleteService
ChangeServiceConfig2W
CreateServiceW
QueryServiceStatus
StartServiceCtrlDispatcherW
RegCloseKey
CreateProcessAsUserW
DuplicateTokenEx
LookupPrivilegeValueW
GetTokenInformation
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
OpenSCManagerW

shell32

SHGetFolderPathW
ShellExecuteW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHFileOperationW

ole32

StgIsStorageFile
StgOpenStorage
StgCreateDocfile
CoCreateGuid
CoInitialize
CoUninitialize

msvcp80

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0ABV12@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V32@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@PBD1@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?destroy@?$allocator@D@std@@QAEXPAD@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V32@0@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0PBD1@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?construct@?$allocator@D@std@@QAEXPADABD@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?uncaught_exception@std@@YA_NXZ
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z

psapi

EnumProcesses
GetProcessImageFileNameW

ws2_32

getsockopt
recv
__WSAFDIsSet
htonl
ntohl
WSAGetLastError
send
sendto
htons
gethostbyname
ioctlsocket
recvfrom
WSAStartup
select
closesocket
socket
connect

msvcr80

_itoa_s
memset
isalpha
memmove
fputc
fseek
fopen_s
ftell
_wfopen_s
ferror
fclose
fread
strerror
_controlfp_s
_invoke_watson
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
memcpy
_CxxThrowException
__iob_func
fprintf
fflush
_snprintf
__CxxFrameHandler3
isprint
_wstat64
_wmkdir
_wsplitpath_s
strcspn
ispunct
tolower
isalnum
??8type_info@@QBE_NABV0@@Z
isspace
isupper
??3@YAXPAX@Z
??2@YAPAXI@Z
_time64
_wcsicmp
wprintf
??_V@YAXPAX@Z
wcsncpy
wcsncat
wcsrchr
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_invalid_parameter_noinfo
_purecall
??0exception@std@@QAE@XZ
memmove_s
_beginthreadex
_snwprintf
wcsstr
_wcsupr
_wtoi
_wcsnicmp
wcscpy_s
swscanf_s
wcsncpy_s
atoi
swprintf_s
vswprintf_s
wcsncat_s
wcsncmp
wcstoul
_snwprintf_s
_snprintf_s
wcschr
_strnicmp
strncmp
malloc
free
_errno
strtoul
rand
_wtol
putchar
wcstol
putwchar
strchr
realloc
isdigit
_vsnwprintf_s
_mktime64
_vsnprintf_s
__RTDynamicCast
memcpy_s
strstr
strcpy_s
??0exception@std@@QAE@ABQBDH@Z
sprintf
_stricmp
_i64toa_s
_itoa
_except_handler3
_atoi64
printf

userenv

CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

imagehlp

UnMapAndLoad
MapAndLoad

wininet

HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetCrackUrlW
HttpSendRequestW
InternetCloseHandle
InternetReadFile
HttpQueryInfoW

netapi32

Netbios

Exports

Exports

??4_Init_locks@std@@QAEAAV01@ABV01@@Z

Sections

.text
Size: 476KB - Virtual size: 475KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 340KB - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef38ddc7f58ca16c4a9a530a53228e76

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3aCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

bdlogicutils

bdmframework

shlwapi

bdmskin

kernel32

user32

advapi32

shell32

ole32

msvcp80

psapi

ws2_32

msvcr80

userenv

wtsapi32

imagehlp

wininet

netapi32

Exports

Exports

Sections

.text Size: 476KB - Virtual size: 475KB

.rdata Size: 136KB - Virtual size: 133KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 340KB - Virtual size: 337KB

.reloc Size: 48KB - Virtual size: 46KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 476KB - Virtual size: 475KB

.rdata
Size: 136KB - Virtual size: 133KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 340KB - Virtual size: 337KB

.reloc
Size: 48KB - Virtual size: 46KB