452a5d10eb1a6c7ace0db387c560ac2641a10e3ec7e1d36d26f2f1da24205bb2

Sharing

Copy URL Twitter E-mail

General

Target

452a5d10eb1a6c7ace0db387c560ac2641a10e3ec7e1d36d26f2f1da24205bb2
Size

3.6MB
MD5

bf99ae14b3771d27e511904cb243cbdd
SHA1

4a96078e48bfa0898cac89bc645d3048d1262e4f
SHA256

452a5d10eb1a6c7ace0db387c560ac2641a10e3ec7e1d36d26f2f1da24205bb2
SHA512

2fd8b75d7e323dad9436b1f33b23831547dfd9f7d8bb83fd8ef99218d00a2e14cbf5ff51e1dd23773762b7c69dde18a063fd5c9f92ad0d374147e0bb1a7d0a43
SSDEEP

49152:21meNNsLXPKDFW758DOiczdW9Dp2HXQBZ57+JDiE3MqCP2hzScyARi1Suv2WYgTT:21meNNsLXS5Wa5l7+JDhPwcd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
452a5d10eb1a6c7ace0db387c560ac2641a10e3ec7e1d36d26f2f1da24205bb2

Files

452a5d10eb1a6c7ace0db387c560ac2641a10e3ec7e1d36d26f2f1da24205bb2
.dll windows:6 windows x86 arch:x86

4c643d15c2b414645615020087dd9eac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libcef

cef_string_utf16_clear
cef_string_list_append
cef_string_list_value
cef_string_list_size
cef_list_value_create
cef_binary_value_create
cef_dictionary_value_create
cef_post_task
cef_currently_on
cef_string_list_free
cef_string_list_alloc
cef_string_userfree_utf16_free
cef_parse_json_buffer
cef_string_utf16_to_utf8
cef_string_utf8_to_utf16
cef_string_utf8_clear
cef_string_utf16_cmp
cef_string_utf16_set

fbrowsercef3lib

?FBroString_WSize@@YAHV?$scoped_refptr@VFBroString@@@@@Z
?FBroString_GetWcharData@@YAXV?$scoped_refptr@VFBroString@@@@PA_W@Z
?FBroDoubleString_ToNext@@YAHV?$scoped_refptr@VFBroDoubleString@@@@@Z
?FBroDoubleString_ToBegin@@YAXV?$scoped_refptr@VFBroDoubleString@@@@@Z
?FBroDoubleString_GetCurrentData_Key@@YA?AV?$scoped_refptr@VFBroString@@@@V?$scoped_refptr@VFBroDoubleString@@@@@Z
?FBroDoubleString_GetCurrentData_Value@@YA?AV?$scoped_refptr@VFBroString@@@@V?$scoped_refptr@VFBroDoubleString@@@@@Z
?FBroDoubleString_Size@@YAHV?$scoped_refptr@VFBroDoubleString@@@@@Z
?FBroSetVipEvent@@YGXV?$scoped_refptr@VFBroVIPEvent@@@@@Z
?FBroString_Creat@@YA?AV?$scoped_refptr@VFBroString@@@@PBD@Z
?FBroString_Creat@@YA?AV?$scoped_refptr@VFBroString@@@@V?$CefStringBase@UCefStringTraitsUTF16@@@@@Z

ntdll

RtlUnwind
NtQueryInformationProcess

ws2_32

gethostbyname
WSAStartup
send
socket
connect
recv
htons
closesocket
shutdown
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
inet_addr
gethostname
getpeername
sendto
recvfrom
freeaddrinfo
getaddrinfo
listen
htonl
getsockname
bind
accept
select
__WSAFDIsSet
WSAIoctl
setsockopt
WSACleanup
WSASetLastError
ntohs
WSAGetLastError
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
getsockopt
ioctlsocket

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26

crypt32

CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertCloseStore

advapi32

ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

kernel32

GetTimeZoneInformation
HeapAlloc
HeapFree
SetConsoleCtrlHandler
SetFilePointerEx
GetTimeFormatW
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
GetFileSizeEx
HeapReAlloc
FlushFileBuffers
GetEnvironmentStringsW
GetCommandLineW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
HeapSize
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetFileAttributesExW
GetCommandLineA
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetEndOfFile
WriteConsoleW
GetDateFormatW
ConvertFiberToThread
GetCurrentProcessId
UnmapViewOfFile
CloseHandle
CreateFileMappingA
MapViewOfFile
GetCurrentProcess
TerminateProcess
Sleep
DeleteFileA
WaitForMultipleObjects
CreateEventW
GetLastError
SetEvent
CreateFileMappingW
ReadFile
VirtualFree
CreatePipe
GetVolumeInformationA
WaitForSingleObject
GetStartupInfoA
CreateProcessA
GetProcAddress
GetModuleHandleW
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
OpenFileMappingW
GetModuleFileNameA
OpenFileMappingA
CreateEventA
IsDebuggerPresent
CheckRemoteDebuggerPresent
SetLastError
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
WaitForSingleObjectEx
GetStringTypeW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
InitializeSRWLock
CompareStringEx
GetCPInfo
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
InitializeSListHead
GetStartupInfoW
FormatMessageW
GetTickCount
GetSystemDirectoryW
LoadLibraryW
MoveFileExW
CompareFileTime
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
SleepEx
VerSetConditionMask
GetModuleHandleA
VerifyVersionInfoW
GetModuleHandleExW
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiberEx
GetSystemDirectoryA
LoadLibraryA
WriteFile
GetACP
DeleteFileW
ConvertThreadToFiberEx
FindClose
FindFirstFileW
FindNextFileW
GetSystemTime
SystemTimeToFileTime
CreateFileW
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
RaiseException
InterlockedFlushSList
InterlockedPushEntrySList

bcrypt

BCryptGenRandom

user32

MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation

Exports

Exports

?AesDecryptString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@0@Z
?AesEncryptString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@0@Z
?FBroHsBrowserHost_AddDevToolsMessageObserver@@YGHV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VFBroHsDevToolsMessageObserver@@@@@Z
?FBroHsBrowserHost_AddDevToolsMessageObserverStatic@@YGHV?$scoped_refptr@VCefBrowser@@@@PAVFBroHsDevToolsMessageObserver@@@Z
?FBroHsBrowserHost_DeleteDevToolsMessageObserver@@YGHV?$scoped_refptr@VCefBrowser@@@@@Z
?FBroHsBrowserHost_ExecuteDevToolsMethod@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@V?$scoped_refptr@VCefDictionaryValue@@@@@Z
?FBroHsBrowserHost_ExecuteDevToolsMethod_Syn@@YG?AV?$scoped_refptr@VCefBinaryValue@@@@V?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@V?$scoped_refptr@VCefDictionaryValue@@@@H@Z
?FBroHsBrowserHost_SendDevToolsMessage@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_EnableWebsocketClientHook@@YGXV?$scoped_refptr@VCefBrowser@@@@@Z
?FBroHsBrowser_GetExpirationTime@@YG?AV?$scoped_refptr@VFBroString@@@@XZ
?FBroHsBrowser_GetFunctionStr@@YG?AV?$scoped_refptr@VFBroString@@@@XZ
?FBroHsBrowser_GetRegistrationTime@@YG?AV?$scoped_refptr@VFBroString@@@@XZ
?FBroHsBrowser_GetVersionStr@@YG?AV?$scoped_refptr@VFBroString@@@@XZ
?FBroHsBrowser_SetAudioFingerPrint_constant@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetAudioFingerPrint_random@@YGXV?$scoped_refptr@VCefBrowser@@@@HHH@Z
?FBroHsBrowser_SetCanvasFingerPrint_constant@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetCanvasFingerPrint_random@@YGXV?$scoped_refptr@VCefBrowser@@@@HHH@Z
?FBroHsBrowser_SetEmitTouchEventsForMouse@@YGXV?$scoped_refptr@VCefBrowser@@@@HH@Z
?FBroHsBrowser_SetLicenceKey@@YGXABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetPlugins@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetTouchEventEmulationEnabled@@YGXV?$scoped_refptr@VCefBrowser@@@@HH@Z
?FBroHsBrowser_SetVirAcceptlanguages@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirAppCodeName@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirAppName@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirAppVersion@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirAudioInput@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirAudioOutput@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirBatteryManagerCharging@@YGXV?$scoped_refptr@VCefBrowser@@@@H@Z
?FBroHsBrowser_SetVirBatteryManagerChargingTime@@YGXV?$scoped_refptr@VCefBrowser@@@@N@Z
?FBroHsBrowser_SetVirBatteryManagerDischargingTime@@YGXV?$scoped_refptr@VCefBrowser@@@@N@Z
?FBroHsBrowser_SetVirBatteryManagerLevel@@YGXV?$scoped_refptr@VCefBrowser@@@@N@Z
?FBroHsBrowser_SetVirCSSFontFingerprint@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HH@Z
?FBroHsBrowser_SetVirCanvas2DFontFingerprint@@YGXV?$scoped_refptr@VCefBrowser@@@@N@Z
?FBroHsBrowser_SetVirCookieEnabled@@YGXV?$scoped_refptr@VCefBrowser@@@@H@Z
?FBroHsBrowser_SetVirDeviceMemory@@YGXV?$scoped_refptr@VCefBrowser@@@@H@Z
?FBroHsBrowser_SetVirDevicePixelRatio@@YGXV?$scoped_refptr@VCefBrowser@@@@N@Z
?FBroHsBrowser_SetVirHardwareConcurrency@@YGXV?$scoped_refptr@VCefBrowser@@@@H@Z
?FBroHsBrowser_SetVirJavaEnabled@@YGXV?$scoped_refptr@VCefBrowser@@@@H@Z
?FBroHsBrowser_SetVirLanguages@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirLongitudeAndLatitude@@YGXV?$scoped_refptr@VCefBrowser@@@@NN@Z
?FBroHsBrowser_SetVirOnLine@@YGXV?$scoped_refptr@VCefBrowser@@@@H@Z
?FBroHsBrowser_SetVirPlatform@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirProduct@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirProductSub@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirRectFingerprint@@YGXV?$scoped_refptr@VCefBrowser@@@@HHHH@Z
?FBroHsBrowser_SetVirScreenHeightAndWidth@@YGXV?$scoped_refptr@VCefBrowser@@@@HH@Z
?FBroHsBrowser_SetVirScreenXAndY@@YGXV?$scoped_refptr@VCefBrowser@@@@HH@Z
?FBroHsBrowser_SetVirScreenavailHeightAndWidth@@YGXV?$scoped_refptr@VCefBrowser@@@@HH@Z
?FBroHsBrowser_SetVirScreencolorDepth@@YGXV?$scoped_refptr@VCefBrowser@@@@H@Z
?FBroHsBrowser_SetVirScreenpixelDepth@@YGXV?$scoped_refptr@VCefBrowser@@@@H@Z
?FBroHsBrowser_SetVirTimeZone@@YGXV?$scoped_refptr@VCefBrowser@@@@HHABV?$CefStringBase@UCefStringTraitsUTF16@@@@1H@Z
?FBroHsBrowser_SetVirUserAgent@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@11@Z
?FBroHsBrowser_SetVirVendor@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirVendorSub@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirVideoInput@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirViewport@@YGXV?$scoped_refptr@VCefBrowser@@@@HHHH@Z
?FBroHsBrowser_SetVirWebdriver@@YGXV?$scoped_refptr@VCefBrowser@@@@H@Z
?FBroHsBrowser_SetVirWebglrenderer@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirWebglvendor@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetVirWebrtcIP@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@H1H@Z
?FBroHsBrowser_SetVirisTrusted@@YGXV?$scoped_refptr@VCefBrowser@@@@H@Z
?FBroHsBrowser_SetWebGLFingerPrint_constant@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsBrowser_SetWebGLFingerPrint_random@@YGXV?$scoped_refptr@VCefBrowser@@@@HHH@Z
?FBroHsDevToolsDOM_disable@@YGXV?$scoped_refptr@VCefBrowser@@@@@Z
?FBroHsDevToolsDOM_discardSearchResults@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsDevToolsDOM_enable@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsDevToolsDOM_focusElement@@YGXV?$scoped_refptr@VCefBrowser@@@@H@Z
?FBroHsDevToolsDOM_getAttributes@@YGXV?$scoped_refptr@VCefBrowser@@@@HV?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsDOM_getAttributesStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@HPAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsDevToolsDOM_getContainerForNode@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@V?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsDOM_getContainerForNodeStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@PAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsDevToolsDOM_getDocument@@YGXV?$scoped_refptr@VCefBrowser@@@@HHV?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsDOM_getDocumentStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@HHPAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsDevToolsDOM_getOuterHTML@@YGXV?$scoped_refptr@VCefBrowser@@@@HV?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsDOM_getOuterHTMLStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@HPAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsDevToolsDOM_getSearchResults@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HHV?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsDOM_getSearchResultsStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HHPAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsDevToolsDOM_performSearch@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HV?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsDOM_performSearchStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HPAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsDevToolsDOM_querySelector@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@V?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsDOM_querySelectorAll@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@V?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsDOM_querySelectorAllStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@PAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsDevToolsDOM_querySelectorStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@PAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsDevToolsDOM_removeAttribute@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsDevToolsDOM_removeNode@@YGXV?$scoped_refptr@VCefBrowser@@@@H@Z
?FBroHsDevToolsDOM_setAttributeValue@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@1@Z
?FBroHsDevToolsDOM_setAttributesAsText@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@1@Z
?FBroHsDevToolsDOM_setNodeName@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@V?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsDOM_setNodeNameStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@PAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsDevToolsDOM_setNodeValue@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsDevToolsDOM_setOuterHTML@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsDevToolsMessageFunction_DispatchDragEvent@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HHH11111H@Z
?FBroHsDevToolsMessageFunction_DispatchKeyEvent@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@H11111HHHHHH@Z
?FBroHsDevToolsMessageFunction_DispatchMouseEvent@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HHH1HHHH1@Z
?FBroHsDevToolsMessageFunction_DispatchTouchEvent@@YGXV?$scoped_refptr@VCefBrowser@@@@HPAUE_DEV_TOUCHPOINT@@H@Z
?FBroHsDevToolsMessageFunction_PageCaptureScreenshot@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HPAUVIEWPORT@@HHV?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsMessageFunction_PageCaptureScreenshotStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HPAUVIEWPORT@@HHPAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsDevToolsMessageFunction_PageGetContextID@@YGXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsMessageFunction_PageGetContextIDStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@PAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsDevToolsMessageFunction_RuntimeEvaluate@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HHHHHHHV?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsMessageFunction_RuntimeEvaluateStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HHHHHHHPAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsDevToolsMessageFunction_RuntimeEvaluate_FrameID@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HHH1HHHHHV?$scoped_refptr@VFBroHsGeneralResultCallback@@@@PAXJ@Z
?FBroHsDevToolsMessageFunction_RuntimeEvaluate_FrameIDStatic@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@HHH1HHHHHPAVFBroHsGeneralResultCallback@@PAXJ@Z
?FBroHsOnlineLicenseControl_GetShowLicenseDevTool@@YG?AV?$scoped_refptr@VFBroString@@@@XZ
?FBroHsOnlineLicenseControl_GetShowLicenseEndDate@@YG?AV?$scoped_refptr@VFBroString@@@@XZ
?FBroHsOnlineLicenseControl_GetShowLicenseFunction@@YG?AV?$scoped_refptr@VFBroString@@@@XZ
?FBroHsOnlineLicenseControl_GetShowLicenseStartDate@@YG?AV?$scoped_refptr@VFBroString@@@@XZ
?FBroHsOnlineLicenseControl_GetShowLicenseSysVersion@@YG?AV?$scoped_refptr@VFBroString@@@@XZ
?FBroHsOnlineLicenseControl_GetShowLicenseType@@YG?AV?$scoped_refptr@VFBroString@@@@XZ
?FBroHsOnlineLicenseControl_SetKey@@YGHABV?$CefStringBase@UCefStringTraitsUTF16@@@@_N@Z
?FBroHsOnlineLicenseControl_SetLocalLicence@@YGXABV?$CefStringBase@UCefStringTraitsUTF16@@@@HH00@Z
?FBroHsVIPGlobal_ClearAllS5Auth@@YGXXZ
?FBroHsVIPGlobal_ClearS5Auth@@YGXABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsVIPGlobal_SetS5Auth@@YGXABV?$CefStringBase@UCefStringTraitsUTF16@@@@00@Z
?FBroHsVIPRequestContext_EnableExtensionPlus@@YGXXZ
?FBroHsVIPResourceHandler_AddChangeData@@YGXHABV?$CefStringBase@UCefStringTraitsUTF16@@@@0V?$scoped_refptr@VFBroDoubleString@@@@PAXI@Z
?FBroHsVIPResourceHandler_AddChangeFile@@YGXHABV?$CefStringBase@UCefStringTraitsUTF16@@@@0V?$scoped_refptr@VFBroDoubleString@@@@0@Z
?FBroHsVIPResourceHandler_Browser_AddChangeData@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@1V?$scoped_refptr@VFBroDoubleString@@@@PAXI@Z
?FBroHsVIPResourceHandler_Browser_AddChangeFile@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@1V?$scoped_refptr@VFBroDoubleString@@@@1@Z
?FBroHsVIPResourceHandler_Browser_DeleteAllData@@YGXV?$scoped_refptr@VCefBrowser@@@@@Z
?FBroHsVIPResourceHandler_Browser_DeleteChangeData@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsVIPResourceHandler_DeleteAllData@@YGXXZ
?FBroHsVIPResourceHandler_DeleteChangeData@@YGXABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsVIPResponseFilter_AddChangeData@@YGXHABV?$CefStringBase@UCefStringTraitsUTF16@@@@H00@Z
?FBroHsVIPResponseFilter_Browser_AddChangeData@@YGXV?$scoped_refptr@VCefBrowser@@@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@H11@Z
?FBroHsVIPResponseFilter_Browser_DeleteAllData@@YGXV?$scoped_refptr@VCefBrowser@@@@@Z
?FBroHsVIPResponseFilter_Browser_DeleteChangeData@@YGXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?FBroHsVIPResponseFilter_DeleteAllData@@YGXXZ
?FBroHsVIPResponseFilter_DeleteChangeData@@YGXABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?GenerateStrKey@@YAXIAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?RSADecryptString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@0@Z
?RSAEncryptString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@0@Z
ClearFingerPrintFromID
FBroBrowserHost_AddDevToolsMessageObserver
FBroBrowserHost_DeleteDevToolsMessageObserver
FBroBrowserHost_ExecuteDevToolsMethod
FBroBrowserHost_ExecuteDevToolsMethod_Syn
FBroBrowserHost_SendDevToolsMessage
FBroBrowser_EnableWebsocketClientHook
FBroBrowser_GetExpirationTime
FBroBrowser_GetFunctionStr
FBroBrowser_GetRegistrationTime
FBroBrowser_GetVersionStr
FBroBrowser_IsLicenceKey
FBroBrowser_SetAudioFingerPrint_constant
FBroBrowser_SetAudioFingerPrint_random
FBroBrowser_SetCanvasFingerPrint_constant
FBroBrowser_SetCanvasFingerPrint_random
FBroBrowser_SetEmitTouchEventsForMouse
FBroBrowser_SetLicenceKey
FBroBrowser_SetPlugins
FBroBrowser_SetTouchEventEmulationEnabled
FBroBrowser_SetVirAcceptlanguages
FBroBrowser_SetVirAppCodeName
FBroBrowser_SetVirAppName
FBroBrowser_SetVirAppVersion
FBroBrowser_SetVirAudioInput
FBroBrowser_SetVirAudioOutput
FBroBrowser_SetVirBatteryManagerCharging
FBroBrowser_SetVirBatteryManagerChargingTime
FBroBrowser_SetVirBatteryManagerDischargingTime
FBroBrowser_SetVirBatteryManagerLevel
FBroBrowser_SetVirCSSFontFingerprint
FBroBrowser_SetVirCanvas2DFontFingerprint
FBroBrowser_SetVirCookieEnabled
FBroBrowser_SetVirDeviceMemory
FBroBrowser_SetVirDevicePixelRatio
FBroBrowser_SetVirHardwareConcurrency
FBroBrowser_SetVirJavaEnabled
FBroBrowser_SetVirLanguages
FBroBrowser_SetVirLongitudeAndLatitude
FBroBrowser_SetVirOnLine
FBroBrowser_SetVirPlatform
FBroBrowser_SetVirProduct
FBroBrowser_SetVirProductSub
FBroBrowser_SetVirRectFingerprint
FBroBrowser_SetVirScreenHeightAndWidth
FBroBrowser_SetVirScreenXAndY
FBroBrowser_SetVirScreenavailHeightAndWidth
FBroBrowser_SetVirScreencolorDepth
FBroBrowser_SetVirScreenpixelDepth
FBroBrowser_SetVirTimeZone
FBroBrowser_SetVirUserAgent
FBroBrowser_SetVirVendor
FBroBrowser_SetVirVendorSub
FBroBrowser_SetVirVideoInput
FBroBrowser_SetVirViewport
FBroBrowser_SetVirWebdriver
FBroBrowser_SetVirWebglrenderer
FBroBrowser_SetVirWebglvendor
FBroBrowser_SetVirWebrtcIP
FBroBrowser_SetVirisTrusted
FBroBrowser_SetWebGLFingerPrint_constant
FBroBrowser_SetWebGLFingerPrint_random
FBroDevToolsDOM_disable
FBroDevToolsDOM_discardSearchResults
FBroDevToolsDOM_enable
FBroDevToolsDOM_focusElement
FBroDevToolsDOM_getAttributes
FBroDevToolsDOM_getContainerForNode
FBroDevToolsDOM_getDocument
FBroDevToolsDOM_getOuterHTML
FBroDevToolsDOM_getSearchResults
FBroDevToolsDOM_performSearch
FBroDevToolsDOM_querySelector
FBroDevToolsDOM_querySelectorAll
FBroDevToolsDOM_removeAttribute
FBroDevToolsDOM_removeNode
FBroDevToolsDOM_setAttributeValue
FBroDevToolsDOM_setAttributesAsText
FBroDevToolsDOM_setNodeName
FBroDevToolsDOM_setNodeValue
FBroDevToolsDOM_setOuterHTML
FBroDevToolsMessageFunction_DispatchDragEvent
FBroDevToolsMessageFunction_DispatchKeyEvent
FBroDevToolsMessageFunction_DispatchMouseEvent
FBroDevToolsMessageFunction_DispatchTouchEvent
FBroDevToolsMessageFunction_PageCaptureScreenshot
FBroDevToolsMessageFunction_PageGetContextID
FBroDevToolsMessageFunction_RuntimeEvaluate
FBroDevToolsMessageFunction_RuntimeEvaluate_FrameID
FBroHsBrowserHost_GetDevToolsMessgeID
FBroOnlineLicenseControl_GetShowLicenseDevTool
FBroOnlineLicenseControl_GetShowLicenseEndDate
FBroOnlineLicenseControl_GetShowLicenseFunction
FBroOnlineLicenseControl_GetShowLicenseStartDate
FBroOnlineLicenseControl_GetShowLicenseSysVersion
FBroOnlineLicenseControl_GetShowLicenseType
FBroOnlineLicenseControl_SetKey
FBroOnlineLicenseControl_SetLocalLicence
FBroVIPControl_Close
FBroVIPGlobal_ClearAllS5Auth
FBroVIPGlobal_ClearS5Auth
FBroVIPGlobal_SetS5Auth
FBroVIPRequestContext_EnableExtensionPlus
FBroVIPResourceHandler_AddChangeData
FBroVIPResourceHandler_AddChangeFile
FBroVIPResourceHandler_Browser_AddChangeData
FBroVIPResourceHandler_Browser_AddChangeFile
FBroVIPResourceHandler_Browser_DeleteAllData
FBroVIPResourceHandler_Browser_DeleteChangeData
FBroVIPResourceHandler_DeleteAllData
FBroVIPResourceHandler_DeleteChangeData
FBroVIPResponseFilter_AddChangeData
FBroVIPResponseFilter_Browser_AddChangeData
FBroVIPResponseFilter_Browser_DeleteAllData
FBroVIPResponseFilter_Browser_DeleteChangeData
FBroVIPResponseFilter_DeleteAllData
FBroVIPResponseFilter_DeleteChangeData
HookEVIPEvent

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 742KB - Virtual size: 741KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c643d15c2b414645615020087dd9eac

Headers

DLL Characteristics

File Characteristics

Imports

libcef

fbrowsercef3lib

ntdll

ws2_32

wldap32

crypt32

advapi32

kernel32

bcrypt

user32

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 742KB - Virtual size: 741KB

.data Size: 42KB - Virtual size: 58KB

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 138KB - Virtual size: 137KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 742KB - Virtual size: 741KB

.data
Size: 42KB - Virtual size: 58KB

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 138KB - Virtual size: 137KB