775149a4a29634171db0973c90cad67d37d1688bb6feed8a1d04b4a71fdcfdeb[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

775149a4a29634171db0973c90cad67d37d1688bb6feed8a1d04b4a71fdcfdeb.exe.zip
Size

5.1MB
MD5

39bc842f649977eb1eb9a95585185af9
SHA1

d5f4e7fec1e9e08f5624aa8ff810de44dd15417f
SHA256

d40ea4745a54e2b3b538f07f4897fc085f190a716b7a03eca1f49f5d2e4c5411
SHA512

182f8550906b259c78f10801fc8512c19f65282ad0a109b0bffdd2170ec4278ca3ab262d43fd239314ac86ae16555c2352e4494ecdeab41225772024a300e5f2
SSDEEP

98304:2g/fuvrZL5cGAviyrueUEN0sVJqg6Bpji1UYl1W//EaBa:2afuvR5ivisuZEysPAvG1iY

Score

1^/10

Malware Config

Signatures

Files

775149a4a29634171db0973c90cad67d37d1688bb6feed8a1d04b4a71fdcfdeb.exe.zip
.zip

Password: infected
775149a4a29634171db0973c90cad67d37d1688bb6feed8a1d04b4a71fdcfdeb.exe
.exe windows:5 windows x86 arch:x86

41a5c69543c6e84cf77ccc0dee38b980

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:7c:62:85:72:a5:07:ec:5f:41:0d:97:a4:ed:16:67
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2020, 00:00

Not After

12/11/2023, 23:59

Subject

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:06:83:4e:a5:ef:2b:3a:66:9e:31:99:70:ab:e6:40
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/11/2020, 00:00

Not After

12/11/2023, 23:59

Subject

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:12:6d:3b:aa:13:a0:e2:df:1e:87:b8:12:13:a1:49:b9:34:fc:59:d8:fe:16:75:47:6d:3a:fb:67:03:f2:9c
Signer

Actual PE Digest

20:12:6d:3b:aa:13:a0:e2:df:1e:87:b8:12:13:a1:49:b9:34:fc:59:d8:fe:16:75:47:6d:3a:fb:67:03:f2:9c

Digest Algorithm

sha256

PE Digest Matches

true

20:e3:74:68:58:9a:58:86:ac:c0:78:40:1e:f4:cb:af:f0:42:20:81
Signer

Actual PE Digest

20:e3:74:68:58:9a:58:86:ac:c0:78:40:1e:f4:cb:af:f0:42:20:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

updateagent

update_agent_setopt
update_agent_global_init
update_agent_global_cleanup

bull140u

?GetModuleVer@BULL@@YAJPA_WPAPA_W1@Z
?EnableNamedObject@BULL@@YAJPA_WABU_GUID@@@Z
?Base64Encode@BULL@@YAJPAUIGeneralBuffer@1@PAPA_WK@Z
?Base64Decode@BULL@@YAJPA_WPAPAUIGeneralBuffer@1@@Z
?_wtoui@@YAIPB_W@Z
?LoadModuleInfo@BULL@@YAJPB_W@Z
?LoadStringTable@BULL@@YAJPA_WH@Z
?RC4Decrypt@BULL@@YAJPA_W0PAPA_W@Z
?RC4Encrypt@BULL@@YAJPA_W0PAPA_W@Z
?XLogMonitor@BULL@@YAJ_KPB_W11@Z
?MultiByteToWideChar@BULL@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@IPBD@Z
?CreateObjectNative@BULL@@YAJABU_GUID@@0PAPAX@Z
?XLogV@BULL@@YAXIPB_W0PAD@Z
?GetNamedObject@BULL@@YAJPA_WABU_GUID@@1PAPAX@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W1@Z
?GetLogController@BULL@@YAJPAPAUILogController@1@@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W11@Z
?GuidToString@BULL@@YAPA_WABU_GUID@@@Z
?CreateGuid@BULL@@YA?AU_GUID@@XZ
?RegisterObject@BULL@@YAJABU_GUID@@0P6GJPAX0PAPAX@ZPB_W@Z
?KillTimer_s@BULL@@YAXK@Z
?MD5@BULL@@YAJPAUIGeneralBuffer@1@PAPAU21@@Z
?LoadStringW@BULL@@YAPB_WH@Z
?KillTimer@BULL@@YAJK@Z
?SetTimer@BULL@@YAJK_NPAUICallbackTimer@1@KPAK@Z
?AssertOut@BULL@@YAJPB_WH_N0@Z

ximage

?Save@CxImage@@QAE_NPB_WK@Z
?Crop@CxImage@@QAE_NJJJJPAV1@@Z
?Thumbnail@CxImage@@QAE_NJJUtagRGBQUAD@@PAV1@@Z
?DestroyFrames@CxImage@@QAE_NXZ
?GetHeight@CxImage@@QBEKXZ
??0CxImage@@QAE@K@Z
?GetTypeIdFromName@CxImage@@SAKPB_W@Z
?RGBtoHSL@CxImage@@SA?AUtagRGBQUAD@@U2@@Z
?GetWidth@CxImage@@QBEKXZ
?Destroy@CxImage@@QAE_NXZ
?Load@CxImage@@QAE_NPB_WK@Z

apputil

?TransUidToString@Misc@AppUtil@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAV34@@Z
?CurURLEncode@Misc@AppUtil@@YAJPBDAAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AA_J@Z
?VersionInfoDecode@Misc@AppUtil@@YAJPAPA_WH@Z
?CurlIsIPV6@Misc@AppUtil@@YAHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetChannelInfo@Misc@AppUtil@@YAJPAPA_W@Z
?IsAllAUPackageReady@Misc@AppUtil@@YAHAAH@Z
?IsAutoUpdate@Misc@AppUtil@@YAHXZ
?SetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@00H@Z
?TransformUtf8BufferToBSTR@Misc@AppUtil@@YAJPAUIGeneralBuffer@BULL@@PAPA_W@Z
?WinMsgPeek@Misc@AppUtil@@YAJXZ
?CurURLEncode@Misc@AppUtil@@YAJPB_WAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?IsNeedAutoUpdate@Misc@AppUtil@@YAHXZ
?GetProxyInfo@HelpProxySetting@@YAJPAKPAPA_WPAG@Z
?GetUpdateLevel@Misc@AppUtil@@YAJPAH@Z
?GetForceUpdateContent@Misc@AppUtil@@YAJPAPA_W00@Z
?SetProxyInfo@HelpProxySetting@@YAJKPA_WG@Z
?IsAutoRun@Misc@AppUtil@@YAHXZ
?SetAutoRun@Misc@AppUtil@@YAJH@Z
GetInt64FromJsonDataShim
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAI@Z
?TransformWStringToUtf8String@Misc@AppUtil@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@4@@Z
?JsonEncode@JsonLib@@YAJPAUIGeneralData@BULL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAH@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAV23@H@Z
?TransformUtf8StringToWString@Misc@AppUtil@@YAJV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@AAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@4@@Z
?Parse@JsonLib@@YAJPA_WPAPAUIGeneralData@BULL@@@Z
?TransformUtf8HttpMemoryBlockToBSTR@Misc@AppUtil@@YAJPAUIHttpMemoryBlock@BULL@@PAPA_W@Z
?SetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0H@Z

kernel32

VerSetConditionMask
GlobalLock
GlobalUnlock
ExpandEnvironmentStringsW
GetFileAttributesW
SetFileAttributesW
GlobalFree
GlobalAlloc
CreateFileW
RaiseException
ReadFile
DeleteFileW
FindClose
SetLastError
GetFullPathNameW
FindFirstFileW
lstrlenW
GetComputerNameW
SetThreadExecutionState
lstrcmpiW
LoadLibraryExW
SetErrorMode
DecodePointer
MulDiv
lstrcmpW
Sleep
FindNextFileW
WriteFile
CreateThread
GetDiskFreeSpaceExW
OpenProcess
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
CopyFileW
GetSystemDirectoryW
GetLogicalDrives
GetDriveTypeW
LocalFree
WriteProcessMemory
CreateEventW
GetPrivateProfileIntW
VirtualAlloc
VirtualFree
GetExitCodeProcess
OpenMutexW
WaitForSingleObjectEx
ReleaseMutex
CreateMutexW
OpenFileMappingW
GetTempFileNameW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
OpenEventW
SetEvent
GetShortPathNameW
WinExec
GetSystemTime
FreeResource
GetCurrentProcess
GetLogicalDriveStringsW
CompareFileTime
GetSystemInfo
VerifyVersionInfoW
LeaveCriticalSection
GetModuleHandleW
MultiByteToWideChar
TerminateProcess
UnhandledExceptionFilter
WideCharToMultiByte
GetLastError
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
LoadLibraryExA
VirtualProtect
LoadLibraryA
GetModuleHandleA
GetFileTime
RemoveDirectoryW
MoveFileExW
GetStdHandle
GetFileType
GlobalMemoryStatus
FlushConsoleInputBuffer
HeapCreate
InitializeCriticalSection
lstrcpyW
DosDateTimeToFileTime
SetFilePointer
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
WaitForSingleObject
CreateProcessW
GetThreadContext
Thread32Next
CloseHandle
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentProcessId
GetVersionExW
GetEnvironmentVariableW
GetCurrentThreadId
SetUnhandledExceptionFilter
FindResourceExW
ResetEvent
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetModuleFileNameW
GetStartupInfoW
IsDebuggerPresent
EnterCriticalSection
DeleteCriticalSection
GetTempPathW
InitializeCriticalSectionAndSpinCount
GetFileSize
IsProcessorFeaturePresent

user32

EmptyClipboard
RegisterClipboardFormatW
SetActiveWindow
EnumChildWindows
GetWindowThreadProcessId
FindWindowExW
FindWindowW
UnhookWinEvent
SetWinEventHook
UnregisterDeviceNotification
RegisterDeviceNotificationW
EqualRect
SendMessageTimeoutW
RegisterWindowMessageW
GetWindowTextLengthW
IsChild
GetFocus
GetDlgItem
GetClassNameW
GetSysColor
RedrawWindow
CreateAcceleratorTableW
FillRect
InvalidateRgn
DestroyAcceleratorTable
CharNextW
GetWindowTextW
ReleaseDC
GetDC
InvalidateRect
GetClassInfoExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
SetWindowLongW
SetClipboardData
UnregisterHotKey
LoadImageW
PeekMessageW
DialogBoxParamW
CharLowerBuffW
GetKeyboardState
CallNextHookEx
GetAsyncKeyState
GetMessageTime
GetMessagePos
SetCursorPos
ChangeClipboardChain
SetClipboardViewer
FlashWindow
ExitWindowsEx
EndDialog
DrawTextW
UpdateLayeredWindow
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
OemToCharBuffW
MapVirtualKeyA
MessageBeep
GetMenuItemInfoW
TrackPopupMenu
TrackMouseEvent
InsertMenuW
DestroyMenu
CreatePopupMenu
IsMenu
EnableMenuItem
DrawIconEx
SetCaretPos
GetCaretBlinkTime
CreateCaret
EndMenu
MessageBoxW
ReleaseCapture
ClipCursor
SystemParametersInfoW
SetCapture
GetCursorInfo
GetDoubleClickTime
GetShellWindow
GetDesktopWindow
GetActiveWindow
EnableWindow
UpdateWindow
EndPaint
BeginPaint
GetWindowDC
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
CopyRect
GetForegroundWindow
UnionRect
SetRectEmpty
MonitorFromPoint
RegisterHotKey
DrawAnimatedRects
GetLastInputInfo
GetIconInfo
DestroyIcon
SetFocus
GetSystemMetrics
SetWindowTextW
KillTimer
SetTimer
CreateWindowExW
LoadCursorW
SetLayeredWindowAttributes
PrintWindow
AnimateWindow
PostThreadMessageW
DispatchMessageW
GetMessageW
GetUserObjectInformationW
GetProcessWindowStation
WaitForInputIdle
SetCursor
ScreenToClient
GetCursorPos
GetKeyState
LoadIconW
BringWindowToTop
SetWindowRgn
IsWindowEnabled
ClientToScreen
IsWindowVisible
IsIconic
PostMessageW
IsZoomed
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetWindowLongW
GetParent
MoveWindow
GetWindowRect
SendMessageW
SetRect
IsRectEmpty
PtInRect
OffsetRect
InflateRect
IntersectRect
UnregisterClassW
ShowWindow
WindowFromPoint
SetForegroundWindow
AttachThreadInput
IsWindow
DestroyWindow
SetWindowPos
AllowSetForegroundWindow
UnhookWindowsHookEx
SetWindowsHookExW
AppendMenuW
TranslateMessage
ShowCursor

gdi32

GetRgnBox
GetCurrentObject
SetViewportOrgEx
ExtTextOutW
CreateDIBSection
ExtSelectClipRgn
SelectClipRgn
Rectangle
RectInRegion
GetClipRgn
ExcludeClipRect
CreatePen
ExtCreatePen
MoveToEx
TextOutW
SetRectRgn
CombineRgn
StretchBlt
GetClipBox
CreateRectRgnIndirect
OffsetViewportOrgEx
GetTextExtentPoint32W
GetTextColor
GetTextMetricsW
SetTextColor
SetBkMode
CreateFontIndirectW
GetObjectA
GetTextExtentPointW
CreateSolidBrush
GetStockObject
GetObjectW
GetDeviceCaps
BitBlt
SelectObject
CreateCompatibleBitmap
CreateBitmap
CreateDIBitmap
GetViewportOrgEx
CreateCompatibleDC
SaveDC
RestoreDC
CreateRectRgn
OffsetRgn
RoundRect
DeleteDC
SetBkColor
LineTo
DeleteObject

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegEnumValueW
OpenProcessToken
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
LookupPrivilegeValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
AdjustTokenPrivileges
RegEnumKeyW

shell32

SHCreateDirectoryExW
DragFinish
ShellExecuteW
SHAppBarMessage
SHChangeNotify
ShellExecuteExW
SHGetFolderPathW
Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ord4
ord2
DragQueryFileW
SHGetFileInfoW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHFileOperationW
CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

RegisterDragDrop
RevokeDragDrop
CLSIDFromString
StringFromGUID2
DoDragDrop
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
CoTaskMemRealloc
CreateBindCtx
CoTaskMemAlloc
CoUninitialize
OleUninitialize
OleInitialize
OleLockRunning
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
CoLoadLibrary
CoFreeLibrary
ReleaseStgMedium
CoInitializeEx

oleaut32

SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetVartype
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SysAllocStringByteLen
VariantInit
VarBstrCmp
VariantTimeToSystemTime
VarDateFromStr
VarBstrCat
VarUI4FromStr
OleCreateFontIndirect
LoadTypeLi
VariantClear
SysAllocStringLen
LoadRegTypeLi
SysStringLen
SysAllocString
SysStringByteLen
GetErrorInfo
SysFreeString

shlwapi

StrToIntExA
StrCmpLogicalW
SHCreateStreamOnFileEx
PathFileExistsW
StrRetToBSTR
StrStrIW
PathAppendW
StrToIntW

comctl32

InitCommonControlsEx

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

gdiplus

GdipFree
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipDeletePen
GdipCreatePen1
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipCreateTexture2I
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageRotateFlip
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipImageSelectActiveFrame
GdipCloneImage
GdipDisposeImage
GdiplusStartup
GdiplusShutdown
GdipSaveImageToFile
GdipCreateBitmapFromHICON
GdipGetImageHeight
GdipGetImageWidth
GdipBitmapLockBits
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipDrawImageRectI
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipReleaseDC
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDrawString
GdipSetImageAttributesWrapMode
GdipFillRectangleI
GdipDrawImageRectRectI
GdipDrawArcI

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust

basement

?ExtractOleData@BASEGUI@@YAJPAUIDataObject@@HPAPAUIGeneralData@BULL@@@Z
?ScreenPoint2GuiCellPoint@BASEGUI@@YAJPAUIDispatch@@AAUtagPOINT@@@Z
?GuiCellPoint2WindowPoint@BASEGUI@@YAJPAUIDispatch@@AAUtagPOINT@@@Z

iphlpapi

GetAdaptersInfo

urlmon

UrlMkGetSessionOption
UrlMkSetSessionOption

psapi

GetModuleBaseNameW
EnumProcesses

wininet

InternetSetCookieExW
FindFirstUrlCacheEntryW
InternetSetCookieW
FindCloseUrlCache
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW

winmm

PlaySoundW

vcruntime140

memset
__RTDynamicCast
strstr
strchr
memcpy
memcmp
__std_terminate
memmove
wcsrchr
wcsstr
_purecall
wcschr
__std_exception_destroy
__std_exception_copy
__vcrt_InitializeCriticalSectionEx
__CxxFrameHandler3
_CxxThrowException
_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

_set_invalid_parameter_handler
_invalid_parameter_noinfo
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_control87
_seh_filter_exe
_set_app_type
_errno
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
signal
_c_exit
_register_thread_local_exe_atexit_callback
_cexit
_invalid_parameter_noinfo_noreturn
raise
_controlfp_s
terminate
_exit

api-ms-win-crt-string-l1-1-0

tolower
strncmp
_strnicmp
isupper
_stricmp
_wcsicmp
isxdigit
wcscpy_s
wcslen
strlen
isspace
isdigit
wcscmp
wcsnlen
strncpy
strnlen
_wcsicoll
wmemcpy_s
wcsspn
wcscspn
strcmp
wcsncpy_s
iswspace
strcpy
wcscpy
_wcsdup
wcsncpy
strcat
strcpy_s
_wcslwr_s
iswalnum
iswalpha
iswprint
iswxdigit
wcscat_s
_wcsupr_s
wcstok
iswdigit
wcsncmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vsnwprintf_s
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsscanf
__p__commode
__stdio_common_vswscanf
_set_fmode
_wfopen_s
__stdio_common_vfwprintf
fclose
__stdio_common_vsprintf_s
fputs
feof
__stdio_common_vswprintf_s
_wfopen
ferror
fflush
fgets
_fileno
fopen
fread
fseek
ftell
fwrite
_setmode
__stdio_common_vswprintf

api-ms-win-crt-time-l1-1-0

_gmtime64_s
wcsftime
_gmtime64
_localtime64_s
_time64
_mktime64

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh
_set_new_mode
realloc
_recalloc
calloc

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp
_mbscmp
_mbslwr_s
_mbsrchr

api-ms-win-crt-convert-l1-1-0

strtol
atoi
strtoul
atof
_wtoi64
_atoi64
_wtoi

api-ms-win-crt-utility-l1-1-0

rand
bsearch
div
qsort
abs
labs
srand

api-ms-win-crt-filesystem-l1-1-0

_waccess
_wrmdir
_findclose
_wfindnext64i32
_wremove
_wfindfirst64i32

api-ms-win-crt-math-l1-1-0

_except1
_CIfmod
_libm_sse2_sin_precise
_libm_sse2_log10_precise
ceil
__setusermatherr
_libm_sse2_cos_precise

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-conio-l1-1-0

_getch

imm32

ImmAssociateContext
ImmReleaseContext
ImmGetContext

msimg32

GradientFill
AlphaBlend

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 342KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 517KB - Virtual size: 517KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 744KB - Virtual size: 744KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

41a5c69543c6e84cf77ccc0dee38b980

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0b:7c:62:85:72:a5:07:ec:5f:41:0d:97:a4:ed:16:67Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0d:06:83:4e:a5:ef:2b:3a:66:9e:31:99:70:ab:e6:40Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

20:12:6d:3b:aa:13:a0:e2:df:1e:87:b8:12:13:a1:49:b9:34:fc:59:d8:fe:16:75:47:6d:3a:fb:67:03:f2:9cSigner

20:e3:74:68:58:9a:58:86:ac:c0:78:40:1e:f4:cb:af:f0:42:20:81Signer

Headers

DLL Characteristics

File Characteristics

Imports

updateagent

bull140u

ximage

apputil

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msvcp140

gdiplus

crypt32

wintrust

basement

iphlpapi

urlmon

psapi

wininet

winmm

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-conio-l1-1-0

imm32

msimg32

Sections

.text Size: 6.0MB - Virtual size: 6.0MB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0b:7c:62:85:72:a5:07:ec:5f:41:0d:97:a4:ed:16:67
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:06:83:4e:a5:ef:2b:3a:66:9e:31:99:70:ab:e6:40
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

20:12:6d:3b:aa:13:a0:e2:df:1e:87:b8:12:13:a1:49:b9:34:fc:59:d8:fe:16:75:47:6d:3a:fb:67:03:f2:9c
Signer

20:e3:74:68:58:9a:58:86:ac:c0:78:40:1e:f4:cb:af:f0:42:20:81
Signer

.text
Size: 6.0MB - Virtual size: 6.0MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 342KB - Virtual size: 420KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 100B

_RDATA
Size: 2KB - Virtual size: 1KB

.vmp0
Size: 1.9MB - Virtual size: 1.9MB

.reloc
Size: 517KB - Virtual size: 517KB

.rsrc
Size: 744KB - Virtual size: 744KB