785727b19960ad1f3d1db6fa199181a2[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

785727b19960ad1f3d1db6fa199181a2.bin
Size

2.6MB
MD5

785727b19960ad1f3d1db6fa199181a2
SHA1

0097b3be1fd566b66326d408df3ba45c6f689e0b
SHA256

73f3b921fef4bcfb55c1ab08c88ef6a037d064e623a44dec499fe68c79fb15ab
SHA512

a7e3b6606e3b028adcf9cc1e4f77df1b9759d50fa8d7a9c2235ef421b58ee794fc9b72c2e852daf2f6f00317c2c76b22fd3ed7ffcda879efa8a675305f43abe1
SSDEEP

49152:PivhN4gla3MkkpAxSH+kx+69MgC4Lu+Q10Sl+rY0b:avh8MGAekxhC4lQ10Slg

Score

1^/10

Malware Config

Signatures

Files

785727b19960ad1f3d1db6fa199181a2.bin
.exe windows:6 windows x86 arch:x86

94b6344c86904889dbf6278fe7e27304

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0a:5a:39:6d:03:ea:60:cd:53:68:b3:d7:ba:f7:a6
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

21/09/2023, 00:00

Not After

15/09/2026, 23:59

Subject

CN=Winsider Seminars & Solutions Inc.,O=Winsider Seminars & Solutions Inc.,L=Montréal,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

00:cf:d0:3c:a2:53:32:b3:d3:3e:b5:71:37:d9:13:da:dd:51:2f:d9:c3:94:e2:06:ab:1e:7a:62:de:ad:60:53
Signer

Actual PE Digest

00:cf:d0:3c:a2:53:32:b3:d3:3e:b5:71:37:d9:13:da:dd:51:2f:d9:c3:94:e2:06:ab:1e:7a:62:de:ad:60:53

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

CreatePropertySheetPageW
InitCommonControlsEx
ord345
ImageList_CoCreateInstance
ord381
PropertySheetW

ntdll

NtSetInformationToken
NtPowerInformation
NtTestAlert
NtSetInformationThread
RtlSizeHeap
NtIsProcessInJob
NtQuerySystemInformationEx
RtlRegisterWait
RtlDeregisterWaitEx
RtlCreateSecurityDescriptor
RtlCreateAcl
RtlAddAccessAllowedAce
NtAcceptConnectPort
NtReplyWaitReceivePort
RtlSetDaclSecurityDescriptor
NtCreatePort
RtlValidRelativeSecurityDescriptor
RtlSelfRelativeToAbsoluteSD2
NtConnectPort
NtRequestWaitReplyPort
RtlAbsoluteToSelfRelativeSD
NtCreateSection
RtlQueryElevationFlags
NtDeleteKey
NtReleaseSemaphore
NtFreeVirtualMemory
RtlExitUserProcess
NtSuspendThread
NtQueryInformationProcess
NtRemoveProcessDebug
NtSetSystemPowerState
NtOpenThreadToken
NtQueryEvent
NtQuerySemaphore
RtlQueryPerformanceFrequency
RtlNtStatusToDosErrorNoTeb
NtCreateDirectoryObject
RtlTimeFieldsToTime
RtlGUIDFromString
NtDuplicateToken
RtlRandomEx
RtlTimeToTimeFields
RtlCreateProcessReflection
RtlGetAce
RtlGetFullPathName_UEx
NtDelayExecution
RtlFindMessage
RtlStringFromGUID
RtlQueryPerformanceCounter
RtlCreateProcessParameters
NtQueryDefaultLocale
RtlCreateUserProcess
RtlGetDaclSecurityDescriptor
NtTerminateProcess
RtlExpandEnvironmentStrings_U
RtlFirstEntrySList
RtlUnicodeToMultiByteN
RtlDowncaseUnicodeChar
NtCreateThreadEx
NtAllocateVirtualMemory
RtlReAllocateHeap
TpSimpleTryPost
RtlUTF8ToUnicodeN
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteSize
RtlUnicodeToUTF8N
RtlInterlockedPopEntrySList
RtlGetVersion
NtUnlockFile
NtSetInformationFile
NtLockFile
NtFlushBuffersFile
NtQueryInformationFile
NtGetContextThread
NtQueryKey
NtOpenProcessToken
NtOpenThread
NtOpenSymbolicLinkObject
NtEnumerateKey
NtGetNextProcess
NtUnloadDriver
NtEnumerateValueKey
NtQueueApcThread
NtOpenKey
RtlGetSaclSecurityDescriptor
RtlDosPathNameToNtPathName_U_WithStatus
RtlConvertSidToUnicodeString
NtQuerySymbolicLinkObject
NtOpenProcess
NtTerminateThread
NtCreateNamedPipeFile
NtGetNextThread
NtQueryInformationJobObject
NtSetSecurityObject
NtDeleteValueKey
NtQueryAttributesFile
NtDeviceIoControlFile
NtOpenDirectoryObject
RtlGetUnloadEventTraceEx
NtFsControlFile
NtQueryDirectoryObject
NtAdjustGroupsToken
NtSetSystemEnvironmentValueEx
NtSetHighEventPair
NtTraceControl
NtQuerySystemEnvironmentValueEx
RtlInitializeBitMap
RtlNumberOfSetBits
NtLoadKeyEx
NtCreateKey
NtEnumerateSystemEnvironmentValuesEx
NtQueueApcThreadEx
NtQuerySecurityAttributesToken
NtQueryObject
NtCreateFile
NtQueryDirectoryFile
NtOpenSection
NtQuerySecurityObject
NtSetValueKey
RtlQueryEnvironmentVariable
NtOpenFile
NtQueryValueKey
NtQueryFullAttributesFile
NtReleaseKeyedEvent
NtWaitForKeyedEvent
NtCreateKeyedEvent
LdrFindResource_U
LdrAccessResource
RtlLengthSecurityDescriptor
RtlValidSecurityDescriptor
NtClearEvent
NtCreateSemaphore
NtFlushInstructionCache
RtlSetOwnerSecurityDescriptor
RtlGetControlSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlSetControlSecurityDescriptor
RtlSetGroupSecurityDescriptor
TpWaitForIoCompletion
TpAllocIoCompletion
TpReleasePool
TpReleaseIoCompletion
TpAllocPool
TpSetPoolMinThreads
TpCancelAsyncIoOperation
TpStartAsyncIoOperation
TpSetPoolMaxThreads
NtSetTimer
NtAlertThread
NtCreateTimer
RtlUnwind
NtCancelTimer
NtPulseEvent
NtSetLowEventPair
NtQueryTimer
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlInterlockedFlushSList
RtlInterlockedPushEntrySList
RtlCreateHeap
RtlFreeHeap
RtlAllocateHeap
RtlDestroyHeap
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
NtSetSystemInformation
NtQuerySystemInformation
NtWriteVirtualMemory
NtCreateMutant
RtlSetCurrentDirectory_U
RtlSetUnhandledExceptionFilter
NtAdjustPrivilegesToken
NtOpenMutant
NtSystemDebugControl
NtTerminateJobObject
NtAssignProcessToJobObject
NtQueryMutant
NtQueryVolumeInformationFile
NtMapViewOfSection
NtQuerySection
NtQueryOpenSubKeysEx
NtQueryVirtualMemory
NtResetEvent
NtProtectVirtualMemory
RtlSetHeapInformation
RtlInitializeCriticalSection
RtlDeleteCriticalSection
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlUpcaseUnicodeChar
NtWaitForMultipleObjects
NtSetEvent
NtCreateEvent
NtAlpcQueryInformation
NtReadVirtualMemory
NtReadFile
NtWriteFile
NtQueryInformationThread
NtSuspendProcess
NtResumeThread
NtWaitForSingleObject
NtSetInformationDebugObject
NtUnmapViewOfSection
RtlRaiseStatus
NtSetInformationProcess
NtShutdownSystem
NtDuplicateObject
NtInitiatePowerAction
NtClose
NtQueryInformationToken
NtResumeProcess

kernel32

LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetCPInfo
MultiByteToWideChar
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
GetLastError
SetConsoleCtrlHandler
FreeConsole
GetConsoleWindow
AllocConsole
LoadLibraryExW
LocalFree
SearchPathW
GetTimeFormatEx
GetLocaleInfoW
GetDateFormatEx
FormatMessageW
GetNumberFormatW
TlsSetValue
TlsAlloc
TlsGetValue
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
SetLastError
IsProcessorFeaturePresent
FreeLibrary
GetCurrentProcess
LocalAlloc
GlobalSize
SetStdHandle
WideCharToMultiByte
SetEndOfFile
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetCommandLineW
GetProcessHeap
FlushFileBuffers
WriteConsoleW
HeapSize
HeapFree
HeapAlloc
SetFilePointerEx
GetFileSizeEx
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
GetFileType
CreateFileW
GetConsoleOutputCP
WriteFile
CloseHandle
ReadConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
GetProcAddress
ReadFile
CreateProcessW
GetConsoleMode
DecodePointer

user32

DrawIconEx
FrameRect
TrackMouseEvent
GetCapture
RegisterClassExW
UnregisterClassW
GetDC
GetFocus
CallWindowProcW
DefWindowProcW
LoadImageW
PostQuitMessage
KillTimer
SetCursor
TranslateMessage
IsDialogMessageW
SetTimer
DispatchMessageW
GetMessageW
SetWindowTextW
TranslateAcceleratorW
IsChild
LoadAcceleratorsW
SendMessageTimeoutW
UpdateWindow
OpenWindowStationW
OpenDesktopW
CreateMenu
EndDeferWindowPos
ChangeWindowMessageFilterEx
IntersectRect
SetMenu
CloseDesktop
BeginDeferWindowPos
IsWindow
GetWindowPlacement
CreateWindowExW
CloseWindowStation
GetWindow
ShowWindowAsync
DeferWindowPos
MoveWindow
GetMonitorInfoW
IsHungAppWindow
SetActiveWindow
MonitorFromWindow
MonitorFromPoint
GetForegroundWindow
GetDoubleClickTime
CreateIconIndirect
GetGuiResources
GetProcessWindowStation
EnumDesktopsW
ReleaseCapture
PtInRect
SetCapture
GetAsyncKeyState
SetWindowPlacement
GetGUIThreadInfo
PeekMessageW
MsgWaitForMultipleObjects
MonitorFromRect
MessageBoxW
GetScrollBarInfo
GetWindowDC
SetMenuInfo
GetIconInfo
FindWindowExW
GetWindowTextW
SystemParametersInfoW
CreateDialogIndirectParamW
GetDesktopWindow
LookupIconIdFromDirectoryEx
GetUserObjectInformationW
SetClipboardData
EnumWindows
LoadMenuIndirectW
DialogBoxIndirectParamW
InternalGetWindowText
EmptyClipboard
CloseClipboard
GetWindowInfo
OpenClipboard
GetActiveWindow
GetThreadDesktop
GetSystemMetrics
EnumChildWindows
GetPropW
CreateIconFromResourceEx
GetWindowTextLengthW
DestroyMenu
TrackPopupMenu
CreatePopupMenu
InsertMenuItemW
SetScrollPos
ShowCaret
EnableScrollBar
DestroyCaret
DragDetect
GetClipboardData
CreateCaret
SetCaretPos
GetScrollInfo
RegisterClipboardFormatW
SetScrollInfo
SetCursorPos
ScrollWindowEx
GetUpdateRect
GetMessageTime
DrawFocusRect
InvalidateRgn
WaitMessage
MessageBeep
GetClassInfoExW
GetUpdateRgn
GetMessagePos
DrawFrameControl
GetAncestor
GetDCEx
ReleaseDC
BeginPaint
EndPaint
GetSystemMenu
DeleteMenu
BringWindowToTop
EnableMenuItem
SetFocus
MapDialogRect
GetWindowRect
SetWindowPos
MapWindowPoints
FillRect
GetSysColor
DrawTextW
GetSysColorBrush
GetWindowLongW
GetMenuItemInfoW
GetKeyState
PostMessageW
GetMenu
GetMenuItemCount
ScreenToClient
GetSubMenu
RedrawWindow
DestroyIcon
ClientToScreen
SetLayeredWindowAttributes
FindWindowW
SetWindowLongW
GetClientRect
InvalidateRect
GetCursorPos
GetClassNameW
EndDialog
IsWindowEnabled
GetParent
EnableWindow
GetWindowThreadProcessId
GetShellWindow
AllowSetForegroundWindow
IsWindowVisible
ExitWindowsEx
LockWorkStation
DestroyWindow
SendMessageW
ShowWindow
GetDlgItem
SetForegroundWindow
IsIconic
DrawEdge

gdi32

CreateSolidBrush
SetBkMode
SetTextColor
DeleteDC
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
SetDCBrushColor
GetStockObject
RectVisible
GetObjectW
GetTextExtentPoint32W
SetBkColor
GetTextColor
GetTextMetricsW
SetDCPenColor
Polyline
CreateFontW
CreateDIBSection
ExcludeClipRect
PatBlt
CombineRgn
CreateRectRgn
GdiAlphaBlend
GetDeviceCaps
GetDIBits
Rectangle
GetCharWidthW
TextOutW
SetBoundsRect
IntersectClipRect
RestoreDC
SelectClipRgn
GetClipRgn
SaveDC
DeleteObject
CreateFontIndirectW

advapi32

CloseServiceHandle
GetEffectiveRightsFromAclW
LsaSetSecurityObject
OpenSCManagerW
LsaClose
LsaAddAccountRights
CreateServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
CreateProcessAsUserW
LogonUserW
CreateProcessWithLogonW
InitiateShutdownW
QueryServiceObjectSecurity
QueryServiceStatusEx
OpenServiceW
QueryServiceConfig2W
ChangeServiceConfigW
QueryServiceConfigW
EnumServicesStatusExW
StartServiceW
EnumDependentServicesW
ControlService
SetServiceObjectSecurity
DeleteService
ChangeServiceConfig2W
LsaQuerySecurityObject
LsaLookupPrivilegeName
LsaEnumeratePrivileges
LsaOpenPolicy
LsaLookupNames2
LsaLookupPrivilegeDisplayName
LsaLookupPrivilegeValue
LsaFreeMemory
LsaLookupSids
GetInheritanceSourceW
GetSecurityInfo
SetSecurityInfo

ole32

CoSetProxyBlanket
CoUninitialize
CoTaskMemFree
CoInitializeEx

Exports

Exports

KphEnumerateProcessHandles2
KphLevel
PhAddElementAvlTree
PhAddEntryHashtable
PhAddEntryHashtableEx
PhAddItemArray
PhAddItemList
PhAddItemPointerList
PhAddItemSimpleHashtable
PhAddItemsArray
PhAddItemsList
PhAddJsonArrayObject
PhAddJsonObject
PhAddJsonObject2
PhAddJsonObjectInt64
PhAddJsonObjectUInt64
PhAddJsonObjectValue
PhAddLayoutItem
PhAddLayoutItemEx
PhAddListViewColumn
PhAddListViewGroup
PhAddListViewGroupItem
PhAddListViewItem
PhAddPlusMaxMemorySingles
PhAddSetting
PhAddSettings
PhAddTabControlTab
PhAdjustPrivilege
PhAdjustRectangleToBounds
PhAdjustRectangleToWorkingArea
PhAllocate
PhAllocateExSafe
PhAllocateFromFreeList
PhAllocatePage
PhAllocateSafe
PhAppResolverGetAppIdForWindow
PhAppendBytesBuilder
PhAppendBytesBuilder2
PhAppendBytesBuilderEx
PhAppendCharStringBuilder
PhAppendCharStringBuilder2
PhAppendFormatStringBuilder
PhAppendFormatStringBuilder_V
PhAppendStringBuilder
PhAppendStringBuilderEx
PhAutoDereferenceObject
PhBitmapSetAlpha
PhBoostProvider
PhBufferToHexString
PhBufferToHexStringEx
PhCallKphQueryFileInformationWithTimeout
PhCenterRectangle
PhCenterWindow
PhChangeServiceConfig2
PhClearArray
PhClearCacheDirectory
PhClearCircularBuffer_FLOAT
PhClearCircularBuffer_PVOID
PhClearCircularBuffer_ULONG
PhClearCircularBuffer_ULONG64
PhClearHashtable
PhClearIgnoredSettings
PhClearList
PhCloseServiceHandle
PhCompareStringRef
PhCompareStringZNatural
PhCompareUnicodeStringZIgnoreMenuPrefix
PhConcatStringRef2
PhConcatStringRef3
PhConcatStrings
PhConcatStrings2
PhConcatStrings_V
PhConnectPipe
PhConvertIgnoredSettings
PhConvertMultiByteToUtf16
PhConvertMultiByteToUtf16Ex
PhConvertUtf16ToAsciiEx
PhConvertUtf16ToMultiByte
PhConvertUtf16ToMultiByteEx
PhConvertUtf16ToUtf8
PhConvertUtf16ToUtf8Buffer
PhConvertUtf16ToUtf8Ex
PhConvertUtf16ToUtf8Size
PhConvertUtf8ToUtf16
PhConvertUtf8ToUtf16Buffer
PhConvertUtf8ToUtf16Ex
PhConvertUtf8ToUtf16Size
PhCopyBytesZ
PhCopyCircularBuffer_FLOAT
PhCopyCircularBuffer_PVOID
PhCopyCircularBuffer_ULONG
PhCopyCircularBuffer_ULONG64
PhCopyConvertCircularBufferULONG
PhCopyStringZ
PhCopyStringZFromBytes
PhCopyStringZFromMultiByte
PhCountStringZ
PhCreateAlloc
PhCreateBytes
PhCreateBytesEx
PhCreateCacheFile
PhCreateDialog
PhCreateDirectoryFullPathWin32
PhCreateDirectoryWin32
PhCreateEMenu
PhCreateEMenuItem
PhCreateFile
PhCreateFileStream
PhCreateFileStream2
PhCreateFileWin32
PhCreateFileWin32Ex
PhCreateHashtable
PhCreateJsonArray
PhCreateJsonObject
PhCreateJsonParser
PhCreateJsonParserEx
PhCreateKey
PhCreateList
PhCreateNamedPipe
PhCreateObject
PhCreateObjectType
PhCreateObjectTypeEx
PhCreateOpenFileDialog
PhCreatePipe
PhCreatePointerList
PhCreateProcess
PhCreateProcessAsUser
PhCreateProcessRedirection
PhCreateProcessWin32
PhCreateProcessWin32Ex
PhCreateSaveFileDialog
PhCreateSecurityPage
PhCreateSimpleHashtable
PhCreateString
PhCreateString3
PhCreateStringEx
PhCreateSymbolProvider
PhCreateThread
PhCreateThread2
PhCreateThreadEx
PhCreateXmlNode
PhCreateXmlOpaqueNode
PhDecodeUnicodeDecoder
PhDelayExecution
PhDeleteArray
PhDeleteAutoPool
PhDeleteBytesBuilder
PhDeleteCacheFile
PhDeleteCallback
PhDeleteCircularBuffer_FLOAT
PhDeleteCircularBuffer_PVOID
PhDeleteCircularBuffer_ULONG
PhDeleteCircularBuffer_ULONG64
PhDeleteDirectoryWin32
PhDeleteFastLock
PhDeleteFile
PhDeleteFileWin32
PhDeleteFreeList
PhDeleteGraphState
PhDeleteImageVersionInfo
PhDeleteLayoutManager
PhDeleteProviderThread
PhDeleteStringBuilder
PhDeleteValueKey
PhDeleteWorkQueue
PhDereferenceObject
PhDereferenceObjectDeferDelete
PhDereferenceObjectEx
PhDestroyEMenu
PhDestroyEMenuItem
PhDestroyWindowRemote
PhDetermineDosPathNameType
PhDevFreeObjects
PhDevGetObjects
PhDeviceIoControlFile
PhDialogBox
PhDisconnectNamedPipe
PhDivideSinglesBySingle
PhDnsFree
PhDnsQuery
PhDnsQuery2
PhDoesFileExist
PhDoesFileExistWin32
PhDosErrorToNtStatus
PhDosPathNameToNtPathName
PhDrainAutoPool
PhDrawGraphDirect
PhDrawTrayIconText
PhDuplicateBytesZ
PhDuplicateBytesZSafe
PhDuplicateStringZ
PhEditSecurity
PhEllipsisString
PhEllipsisStringPath
PhEncodeUnicode
PhEnumAvlTree
PhEnumChildWindows
PhEnumDependentServices
PhEnumDirectoryFile
PhEnumDirectoryObjects
PhEnumFileStreams
PhEnumFirmwareEnvironmentValues
PhEnumGenericModules
PhEnumHashtable
PhEnumKernelModules
PhEnumNextProcess
PhEnumNextThread
PhEnumObjectIdInformation
PhEnumObjectTypes
PhEnumPagefiles
PhEnumPointerListEx
PhEnumProcessEnvironmentVariables
PhEnumProcesses
PhEnumProcessesEx
PhEnumReparsePointInformation
PhEnumWindows
PhEnumerateKey
PhEnumeratePrivileges
PhEnumerateValueKey
PhEqualStringRef
PhEscapeCommandLinePart
PhEscapeStringForMenuPrefix
PhExpandEnvironmentStrings
PhExponentiate
PhExponentiate64
PhExtractIcon
PhExtractIconEx
PhFillMemoryUlong
PhFinalArrayItems
PhFinalBytesBuilderBytes
PhFinalHash
PhFinalStringBuilderString
PhFindCharInStringRef
PhFindEMenuItem
PhFindElementAvlTree
PhFindEntryHashtable
PhFindItemList
PhFindItemPointerList
PhFindItemSimpleHashtable
PhFindLastCharInStringRef
PhFindListViewItemByFlags
PhFindListViewItemByParam
PhFindProcessInformation
PhFindProcessInformationByImageName
PhFindStringInStringRef
PhFindXmlObject
PhFlushFileStream
PhFormat
PhFormatBytes
PhFormatBytes_V
PhFormatDate
PhFormatDateTime
PhFormatDecimal
PhFormatGuid
PhFormatImageVersionInfo
PhFormatNativeKeyName
PhFormatSize
PhFormatString
PhFormatString_V
PhFormatTime
PhFormatTimeSpan
PhFormatTimeSpanRelative
PhFormatToBuffer
PhFormatUInt64
PhFree
PhFreeFileDialog
PhFreeJsonObject
PhFreeLibrary
PhFreeLibraryAsImageResource
PhFreePage
PhFreeToFreeList
PhFreeXmlObject
PhGenerateGuid
PhGenerateGuidFromName
PhGenerateRandomAlphaString
PhGenerateRandomNumber64
PhGetAccessEntries
PhGetAccessString
PhGetActiveProcessorCount
PhGetApplicationDataFileName
PhGetApplicationDirectory
PhGetApplicationDirectoryFileName
PhGetApplicationDirectoryWin32
PhGetApplicationFileNameWin32
PhGetBaseDirectory
PhGetBaseName
PhGetClassObject
PhGetComboBoxString
PhGetDeviceType
PhGetDialogItemValue
PhGetDllFileName
PhGetDllHandle
PhGetDpi
PhGetDpiValue
PhGetDrawInfoGraphBuffers
PhGetEnabledProvider
PhGetEtwPublisherName
PhGetFileDialogFileName
PhGetFileDialogFilterIndex
PhGetFileDialogOptions
PhGetFileName
PhGetFilePosition
PhGetFileSize
PhGetFileVersionFixedInfo
PhGetFileVersionInfo
PhGetFileVersionInfoEx
PhGetFileVersionInfoLangCodePage
PhGetFileVersionInfoString
PhGetFileVersionInfoString2
PhGetFirmwareEnvironmentVariable
PhGetFullPath
PhGetGenericTreeNewLines
PhGetGlobalWorkQueue
PhGetHandleInformation
PhGetHandleInformationEx
PhGetIntegerPairStringRefSetting
PhGetIntegerStringRefSetting
PhGetJobProcessIdList
PhGetJsonArrayIndexObject
PhGetJsonArrayLength
PhGetJsonArrayLong64
PhGetJsonArrayString
PhGetJsonObject
PhGetJsonObjectAsArrayList
PhGetJsonObjectBool
PhGetJsonObjectLength
PhGetJsonObjectType
PhGetJsonValueAsInt64
PhGetJsonValueAsString
PhGetJsonValueAsUInt64
PhGetKernelFileName
PhGetKernelFileName2
PhGetKnownFolderPath
PhGetKnownLocation
PhGetLineFromAddress
PhGetListBoxString
PhGetListViewItemImageIndex
PhGetListViewItemParam
PhGetListViewItemText
PhGetMessage
PhGetModuleFromAddress
PhGetModuleProcAddress
PhGetMonitorDpi
PhGetNamedPipeClientComputerName
PhGetNamedPipeClientProcessId
PhGetNamedPipeServerProcessId
PhGetNtMessage
PhGetObjectSecurity
PhGetObjectType
PhGetObjectTypeInformation
PhGetObjectTypeName
PhGetOwnTokenAttributes
PhGetPositionFileStream
PhGetPrimeNumber
PhGetProcedureAddress
PhGetProcedureAddressRemote
PhGetProcessCommandLine
PhGetProcessDepStatus
PhGetProcessDeviceMap
PhGetProcessEnvironment
PhGetProcessImageFileName
PhGetProcessImageFileNameByProcessId
PhGetProcessImageFileNameWin32
PhGetProcessIsDotNet
PhGetProcessIsDotNetEx
PhGetProcessMappedFileName
PhGetProcessPackageFullName
PhGetProcessPebString
PhGetProcessPriority
PhGetProcessUnloadedDlls
PhGetProcessWindowTitle
PhGetProcessWorkingSetInformation
PhGetProcessWsCounters
PhGetScalableIntegerPairStringRefSetting
PhGetSeObjectSecurity
PhGetSelectedListViewItemParam
PhGetSelectedListViewItemParams
PhGetServiceConfig
PhGetServiceConfigFileName
PhGetServiceDescription
PhGetServiceDllParameter
PhGetServiceErrorControlInteger
PhGetServiceErrorControlString
PhGetServiceNameFromTag
PhGetServiceStartTypeInteger
PhGetServiceStartTypeString
PhGetServiceStateString
PhGetServiceTypeInteger
PhGetServiceTypeString
PhGetSidFullName
PhGetSizeDpiValue
PhGetStatusMessage
PhGetStockApplicationIcon
PhGetStringRefSetting
PhGetSymbolFromAddress
PhGetSymbolFromName
PhGetSystemDirectory
PhGetSystemDpi
PhGetSystemMetrics
PhGetSystemParametersInfo
PhGetSystemRoot
PhGetTaskbarDpi
PhGetTemporaryDirectoryRandomAlphaFileName
PhGetThreadServiceTag
PhGetTokenGroups
PhGetTokenIntegrityLevel
PhGetTokenIntegrityLevelRID
PhGetTokenOwner
PhGetTokenPrimaryGroup
PhGetTokenPrivileges
PhGetTokenUser
PhGetTreeNewText
PhGetWin32Message
PhGetWindowContext
PhGetWindowDpi
PhGetWindowText
PhGetWindowTextEx
PhGetXmlInterface
PhGetXmlNodeAttributeByIndex
PhGetXmlNodeAttributeCount
PhGetXmlNodeAttributeText
PhGetXmlNodeElementText
PhGetXmlNodeFirstChild
PhGetXmlNodeNextChild
PhGetXmlNodeOpaqueText
PhGetXmlObject
PhGraphStateGetDrawInfo
PhHashBytes
PhHashStringRef
PhHashStringRefEx
PhHexStringToBuffer
PhHexStringToBufferEx
PhHttpDnsQuery
PhHttpSocketAddRequestHeaders
PhHttpSocketBeginRequest
PhHttpSocketClose
PhHttpSocketConnect
PhHttpSocketCreate
PhHttpSocketDestroy
PhHttpSocketDownloadString
PhHttpSocketEndRequest
PhHttpSocketGetErrorMessage
PhHttpSocketParseUrl
PhHttpSocketQueryHeaderString
PhHttpSocketQueryHeaderUlong
PhHttpSocketQueryHeaderUlong64
PhHttpSocketQueryHeaders
PhHttpSocketQueryOptionString
PhHttpSocketReadData
PhHttpSocketReadDataToBuffer
PhHttpSocketSendRequest
PhHttpSocketSetCredentials
PhHttpSocketSetFeature
PhHttpSocketSetSecurity
PhHttpSocketWriteData
PhHungWindowFromGhostWindow
PhIconToBitmap
PhImageListAddBitmap
PhImageListAddIcon
PhImageListCreate
PhImageListDestroy
PhImageListDrawEx
PhImageListDrawIcon
PhImageListGetIcon
PhImageListRemoveIcon
PhImageListReplace
PhImageListSetBkColor
PhImageListSetIconSize
PhImageListSetImageCount
PhImpersonateToken
PhIndexOfEMenuItem
PhInitializeArray
PhInitializeAutoPool
PhInitializeAvlTree
PhInitializeBytesBuilder
PhInitializeCallback
PhInitializeCircularBuffer_FLOAT
PhInitializeCircularBuffer_PVOID
PhInitializeCircularBuffer_ULONG
PhInitializeCircularBuffer_ULONG64
PhInitializeFastLock
PhInitializeFreeList
PhInitializeGraphState
PhInitializeHash
PhInitializeImageVersionInfo
PhInitializeImageVersionInfoEx
PhInitializeLayoutManager
PhInitializeProviderThread
PhInitializeStringBuilder
PhInitializeWindowTheme
PhInitializeWorkQueue
PhInitializeWorkQueueEnvironment
PhInsertEMenuItem
PhInsertItemList
PhInsertItemsList
PhInsertStringBuilder
PhInsertStringBuilder2
PhInsertStringBuilderEx
PhIntegerToString64
PhInvokeCallback

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 548KB - Virtual size: 547KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.si3rc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.si3rd
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

94b6344c86904889dbf6278fe7e27304

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:0a:5a:39:6d:03:ea:60:cd:53:68:b3:d7:ba:f7:a6Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

00:cf:d0:3c:a2:53:32:b3:d3:3e:b5:71:37:d9:13:da:dd:51:2f:d9:c3:94:e2:06:ab:1e:7a:62:de:ad:60:53Signer

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

ntdll

kernel32

user32

gdi32

advapi32

ole32

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 548KB - Virtual size: 547KB

.data Size: 20KB - Virtual size: 37KB

.didat Size: 4KB - Virtual size: 256B

.si3rc Size: 8KB - Virtual size: 4KB

.si3rd Size: 4KB - Virtual size: 12B

.rsrc Size: 288KB - Virtual size: 287KB

.reloc Size: 96KB - Virtual size: 93KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:0a:5a:39:6d:03:ea:60:cd:53:68:b3:d7:ba:f7:a6
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

00:cf:d0:3c:a2:53:32:b3:d3:3e:b5:71:37:d9:13:da:dd:51:2f:d9:c3:94:e2:06:ab:1e:7a:62:de:ad:60:53
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 548KB - Virtual size: 547KB

.data
Size: 20KB - Virtual size: 37KB

.didat
Size: 4KB - Virtual size: 256B

.si3rc
Size: 8KB - Virtual size: 4KB

.si3rd
Size: 4KB - Virtual size: 12B

.rsrc
Size: 288KB - Virtual size: 287KB

.reloc
Size: 96KB - Virtual size: 93KB