2024-01-26_f07319e29bb3f104db0e416d25bd7d5e_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-26_f07319e29bb3f104db0e416d25bd7d5e_ryuk
Size

12.0MB
MD5

f07319e29bb3f104db0e416d25bd7d5e
SHA1

fa8474ab696179a5753da5fc5b35d31e45ab6b27
SHA256

e44b0df01a0d5771ca502e121856cbb314dff75965e66a663a3a3d36ed0c48cd
SHA512

7a9dc6f5f9c9e0f5ce2419db85238118d75d10a75566c2745745bd1086232946675c173346431c687b56ac5668b3b477f86d5d9dadf1a3d60cd614c6de45dd8b
SSDEEP

393216:FrDJltspZriEP06gYKtdw28wFwNQLAsiN:FAzNF

Score

1^/10

Malware Config

Signatures

Files

2024-01-26_f07319e29bb3f104db0e416d25bd7d5e_ryuk
.exe windows:5 windows x64 arch:x64

e4bde433b5fefbe80e357c474989ce92

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:17:31:51:d3:db:31:7e:05:0e:fc:22:c5:b3:a0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/01/2016, 00:00

Not After

29/01/2019, 12:00

Subject

CN=Fotis Zafiropoulos,O=Fotis Zafiropoulos,L=ΚΑΣΤΡΙΤΣΙ,ST=ΠΑΤΡΑΣ,C=GR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:17:31:51:d3:db:31:7e:05:0e:fc:22:c5:b3:a0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/01/2016, 00:00

Not After

29/01/2019, 12:00

Subject

CN=Fotis Zafiropoulos,O=Fotis Zafiropoulos,L=ΚΑΣΤΡΙΤΣΙ,ST=ΠΑΤΡΑΣ,C=GR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:e1:a9:dc:85:0e:9c:7c:be:a1:d3:06:9b:3b:fa:73:03:51:8d:c1:88:ab:0b:c9:37:9e:24:ae:b2:7d:5d:83
Signer

Actual PE Digest

08:e1:a9:dc:85:0e:9c:7c:be:a1:d3:06:9b:3b:fa:73:03:51:8d:c1:88:ab:0b:c9:37:9e:24:ae:b2:7d:5d:83

Digest Algorithm

sha256

PE Digest Matches

false

ed:08:34:6a:32:3e:0e:ae:33:7d:c8:69:b9:08:98:8a:12:ec:3e:c2
Signer

Actual PE Digest

ed:08:34:6a:32:3e:0e:ae:33:7d:c8:69:b9:08:98:8a:12:ec:3e:c2

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdiplus

GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipSaveImageToStream
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipSaveImageToFile
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipFree
GdipAlloc
GdiplusStartup
GdipDrawImageRectI

uxtheme

DrawThemeBackground
IsThemeBackgroundPartiallyTransparent
ord61
SetWindowTheme
GetThemePartSize
IsAppThemed
DrawThemeParentBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
DrawThemeText
GetThemeSysColor
CloseThemeData
OpenThemeData

winmm

timeBeginPeriod
timeGetTime
timeSetEvent
timeKillEvent
timeEndPeriod
PlaySoundW
timeGetDevCaps
waveOutGetVolume
waveOutSetVolume
mixerSetControlDetails

kernel32

GetThreadLocale
lstrcmpA
GetProfileIntW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
VerSetConditionMask
lstrcpyW
VerifyVersionInfoW
FindResourceExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetSystemDefaultUILanguage
GlobalFlags
SetErrorMode
GetWindowsDirectoryW
SearchPathW
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
UnregisterWaitEx
GetStringTypeExW
InterlockedPopEntrySList
GetModuleHandleA
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetNumaHighestNodeNumber
GetFileSize
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetEnvironmentVariableA
FindFirstFileExW
GetConsoleCP
ReadConsoleW
EnumSystemLocalesW
IsValidLocale
GetOEMCP
IsValidCodePage
HeapQueryInformation
SetStdHandle
ExitProcess
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
SizeofResource
LockResource
LoadResource
FindResourceW
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
lstrcmpiW
UnlockFile
QueryDepthSList
LockFile
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GlobalFindAtomW
GetModuleHandleExW
EncodePointer
OutputDebugStringW
TryEnterCriticalSection
GetExitCodeThread
RtlPcToFileHeader
QueueUserWorkItem
GetStringTypeW
OutputDebugStringA
GlobalSize
OpenThread
SetThreadContext
GetThreadContext
CreateToolhelp32Snapshot
Thread32First
Thread32Next
HeapCreate
LoadLibraryA
GetTimeZoneInformation
SuspendThread
ResumeThread
GetProcessAffinityMask
GetShortPathNameW
GetLongPathNameW
RemoveDirectoryW
CreateHardLinkW
MoveFileW
SetFileAttributesW
GetSystemDirectoryW
GetConsoleMode
GetSystemTime
TzSpecificLocalTimeToSystemTime
LocalFileTimeToFileTime
SystemTimeToFileTime
FileTimeToLocalFileTime
GetFileType
GetFileTime
SetFileTime
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetStdHandle
IsDBCSLeadByte
GetCPInfo
CompareStringW
FoldStringW
AreFileApisANSI
DebugBreak
IsDBCSLeadByteEx
LocalAlloc
IsBadWritePtr
IsBadReadPtr
GlobalGetAtomNameW
FormatMessageW
FlushInstructionCache
QueryPerformanceCounter
QueryPerformanceFrequency
lstrlenW
SetThreadPriority
GetCurrentThread
GetThreadPriority
VirtualFree
VirtualAlloc
ReleaseSemaphore
CreateSemaphoreW
WaitForMultipleObjects
lstrcmpW
GetNumberFormatW
SetLastError
GetVersionExW
LCMapStringW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwindEx
ExitThread
GlobalAlloc
GlobalLock
GlobalUnlock
GetFileAttributesW
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
FormatMessageA
CreateProcessW
FreeEnvironmentStringsW
GetEnvironmentStringsW
DuplicateHandle
CreatePipe
TerminateProcess
CreateThread
GetVolumeInformationW
GetModuleFileNameW
GetTempFileNameW
DecodePointer
RaiseException
GetUserDefaultUILanguage
ReadDirectoryChangesW
GetOverlappedResult
CancelIo
GetACP
GetTimeFormatW
GetDateFormatW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileAttributesExW
GlobalDeleteAtom
GlobalAddAtomW
ReleaseMutex
CreateMutexW
SetCurrentDirectoryW
HeapSetInformation
SetDllDirectoryW
GlobalFree
DeviceIoControl
GetTempPathW
CreateFileA
WriteProcessMemory
ReadProcessMemory
IsDebuggerPresent
DeleteFileW
CopyFileW
SleepEx
HeapReAlloc
HeapSize
HeapDestroy
HeapFree
GetProcessHeap
HeapAlloc
FreeResource
GetDriveTypeW
LocalFree
GetLocaleInfoA
GetCurrentDirectoryW
FindNextFileW
GetDiskFreeSpaceExW
FindClose
FindFirstFileW
SetSystemPowerState
SetThreadExecutionState
GetLocaleInfoW
TerminateThread
WaitForSingleObject
WriteFile
GetTickCount
MulDiv
ResetEvent
SetEvent
CreateEventW
CreateDirectoryW
GetLocalTime
GetCurrentProcessId
CreateFileW
ReadFile
SetFilePointerEx
GetFileSizeEx
InitializeCriticalSection
CloseHandle
LoadLibraryExW
GetCurrentThreadId
WideCharToMultiByte
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
Sleep
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
FreeLibrary
GetLastError
GetFullPathNameW
GetCurrentProcess
SetPriorityClass
DeleteCriticalSection

user32

BringWindowToTop
IsClipboardFormatAvailable
MapVirtualKeyW
GetKeyNameTextW
CharNextW
MapDialogRect
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextW
WaitMessage
SendDlgItemMessageA
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
IsDialogMessageW
SetWindowTextW
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
IsWindowEnabled
GetNextDlgTabItem
WinHelpW
SetScrollInfo
GetLastActivePopup
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
EndPaint
BeginPaint
SetMenu
SetFocus
IsChild
GetClassInfoExW
GetMenuState
GetMenuStringW
GetIconInfo
wsprintfW
GetDCEx
SetWindowRgn
GetScrollInfo
GetClassLongPtrW
GetWindowRgn
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
InvertRect
DrawTextExW
GetMenu
CreateDialogIndirectParamW
EndDialog
DialogBoxParamW
CharUpperW
CharLowerW
CharToOemBuffW
OemToCharA
CharToOemA
OemToCharBuffA
CharLowerBuffW
DestroyWindow
RegisterClassW
LoadAcceleratorsW
GetQueueStatus
DestroyMenu
TrackPopupMenu
GetMessageW
SetParent
GetMessagePos
UnregisterClassW
SetProcessDefaultLayout
SendNotifyMessageW
EnumDisplayDevicesW
RedrawWindow
SetPropW
GetDlgCtrlID
GetWindowLongPtrW
TranslateMessage
GetDlgItemTextW
SetWindowLongPtrW
SetWindowPos
MoveWindow
FindWindowExW
CreateWindowExW
CallWindowProcW
IntersectRect
UnregisterHotKey
RegisterHotKey
RegisterRawInputDevices
GetRawInputDeviceInfoW
GetRawInputDeviceList
GetRawInputData
SetWindowPlacement
GetWindowPlacement
ShowWindow
AllowSetForegroundWindow
DefWindowProcW
LockWindowUpdate
ChangeDisplaySettingsExA
MsgWaitForMultipleObjectsEx
SetClassLongPtrW
GetDoubleClickTime
TrackMouseEvent
GetClassNameW
EnumDisplayMonitors
CallNextHookEx
DispatchMessageW
GetMessageTime
GetWindowThreadProcessId
SetWindowsHookExW
UnhookWindowsHookEx
EqualRect
MonitorFromRect
DestroyIcon
FindWindowW
MsgWaitForMultipleObjects
CheckMenuItem
AppendMenuW
RemoveMenu
CreatePopupMenu
ChangeDisplaySettingsExW
EnumDisplaySettingsW
IsMenu
MessageBeep
CheckMenuRadioItem
TranslateAcceleratorW
InsertMenuItemW
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
GetSystemMenu
SetWindowContextHelpId
ShowOwnedPopups
SetLayeredWindowAttributes
CopyImage
RealChildWindowFromPoint
CopyAcceleratorTableW
InvalidateRgn
GetNextDlgGroupItem
DrawEdge
DrawStateW
DrawFocusRect
DrawIconEx
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
SetWindowLongW
SetRectEmpty
InsertMenuW
DeleteMenu
EnableMenuItem
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
LockWorkStation
ExitWindowsEx
SystemParametersInfoW
GetActiveWindow
GetTopWindow
GetForegroundWindow
MonitorFromPoint
NotifyWinEvent
SetCursorPos
GetMenuDefaultItem
EnableScrollBar
HideCaret
CopyIcon
DrawIcon
SetMenuDefaultItem
ModifyMenuW
IsCharLowerW
MapVirtualKeyExW
CharUpperBuffW
UpdateLayeredWindow
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
GetUpdateRect
SubtractRect
CreateMenu
GetComboBoxInfo
DestroyCursor
GetAsyncKeyState
GetMonitorInfoW
GetWindowLongW
AdjustWindowRectEx
GetMenuItemRect
GetSubMenu
SetForegroundWindow
IsIconic
PostThreadMessageW
LoadMenuW
RegisterWindowMessageW
PostQuitMessage
GetFocus
GetAncestor
GetCapture
IsZoomed
RegisterClipboardFormatW
MessageBoxW
GetKeyState
GetSysColorBrush
GetCursorPos
DrawFrameControl
OffsetRect
ReleaseCapture
WindowFromPoint
ScreenToClient
ClientToScreen
SetCapture
FrameRect
FillRect
CopyRect
MonitorFromWindow
ReleaseDC
GetDC
SetTimer
KillTimer
PeekMessageW
UpdateWindow
SetActiveWindow
GetDesktopWindow
SetRect
UnionRect
SetCursor
GetSysColor
GetDlgItem
LoadIconW
PtInRect
GetSystemMetrics
InflateRect
GetWindowRect
IsRectEmpty
InvalidateRect
IsWindow
PostMessageW
MapWindowPoints
GetClientRect
IsWindowVisible
GetWindow
LoadCursorW
CreateAcceleratorTableW
DestroyAcceleratorTable
CloseClipboard
SetClipboardData
EmptyClipboard
GetParent
OpenClipboard
LoadImageW
SendMessageW
EnableWindow
GetClassInfoW

gdi32

PtVisible
RectVisible
RestoreDC
SaveDC
SelectPalette
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
ExtTextOutW
SetWindowExtEx
SetWindowOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetMapMode
DPtoLP
GetBkColor
GetCharWidthW
GetPixel
CreateDIBitmap
GetTextCharsetInfo
GetRgnBox
CreateEllipticRgn
Ellipse
Polygon
Polyline
CreateRoundRectRgn
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
LPtoDP
RoundRect
ExtFloodFill
SetPaletteEntries
FrameRgn
GetBoundsRect
PtInRegion
GetViewportOrgEx
SetPixelV
GetTextFaceW
GetWindowOrgEx
FillRgn
SetRectRgn
OffsetRgn
GdiFlush
OffsetViewportOrgEx
SelectClipRgn
AbortPath
GetPath
EndPath
CloseFigure
BeginPath
SetMapMode
AddFontResourceW
GetICMProfileW
TextOutW
SetTextColor
SetBkColor
GetCurrentObject
TranslateCharsetInfo
EnumFontFamiliesExW
CreateFontW
CombineRgn
CreateRectRgn
EnumFontFamiliesW
GetTextMetricsW
GetTextColor
GetStockObject
ExtSelectClipRgn
CreateRectRgnIndirect
SetPixel
SetBkMode
CreateFontIndirectW
SetViewportExtEx
SetViewportOrgEx
CreateDCW
DeleteObject
GetObjectW
CreateDIBSection
SelectObject
DeleteDC
CreateCompatibleDC
SetStretchBltMode
StretchBlt
BitBlt
CreatePen
Rectangle
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreatePatternBrush
CreateHatchBrush
CopyMetaFileW
PatBlt
CreatePolygonRgn
GetDeviceCaps
SetDIBColorTable
CreateSolidBrush
MoveToEx
LineTo
CreateBitmap
StretchDIBits
GetTextExtentPoint32W
CreateCompatibleBitmap

msimg32

AlphaBlend
TransparentBlt

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegSetValueA
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExA
RegCreateKeyExW
RegDeleteKeyA
RegDeleteKeyW
RegEnumKeyW
SetFileSecurityW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CryptDecrypt
CryptDestroyKey
CryptEncrypt
CryptDeriveKey
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegCloseKey
RegSetValueW
RegQueryValueW
RegQueryValueA
RegOpenKeyW
RegOpenKeyA
RegCreateKeyW
RegCreateKeyA
RegFlushKey
RegSetValueExW
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumValueW
RegEnumValueA
RegEnumKeyExW
RegEnumKeyExA
RegDeleteValueW
RegDeleteValueA

shell32

ShellExecuteW
ord680
SHChangeNotify
DragQueryFileW
DragFinish
Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW
SHAddToRecentDocs
ExtractIconExW
SHGetFolderPathW
ShellExecuteExW
SHParseDisplayName
SHOpenFolderAndSelectItems
SHFileOperationW
SHGetSpecialFolderLocation
SHGetFileInfoW
SHGetDesktopFolder
SHAppBarMessage
ExtractIconW

comctl32

ImageList_Remove
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_AddMasked
ImageList_Draw
ImageList_Add
_TrackMouseEvent
ImageList_EndDrag
ImageList_DragLeave
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragEnter
ImageList_BeginDrag
ImageList_GetImageInfo

shlwapi

PathRenameExtensionW
PathStripPathW
PathRemoveFileSpecW
StrFormatByteSizeW
PathFindExtensionW
PathSkipRootW
PathRemoveExtensionW
PathMakePrettyW
PathIsDirectoryW
PathCombineW
PathAddExtensionW
PathAddBackslashW
StrCmpLogicalW
SHCopyKeyW
PathFileExistsW
StrRetToStrW
PathAppendW
PathCompactPathW
PathRelativePathToW
PathCanonicalizeW
PathRemoveBackslashW
PathIsRelativeW
PathIsPrefixW
PathIsUNCW
PathFindFileNameW
UrlUnescapeW
PathStripToRootW
StrFormatKBSizeW

ole32

StringFromCLSID
PropVariantClear
StringFromGUID2
CoInitializeEx
CoFreeUnusedLibraries
OleDuplicateData
ReleaseStgMedium
CoLockObjectExternal
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
OleLoadFromStream
OleSaveToStream
CoUninitialize
CoInitialize
CoWaitForMultipleHandles
RegisterDragDrop
RevokeDragDrop
CreateItemMoniker
GetRunningObjectTable
CLSIDFromString
MkParseDisplayName
CreateBindCtx
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
OleGetClipboard
CoCreateGuid
CLSIDFromProgID
CoDisconnectObject
CoGetClassObject
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
OleLockRunning
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoRevokeClassObject
CoRegisterMessageFilter

oleaut32

SysFreeString
VarBstrFromDate
VariantCopy
SafeArrayDestroy
LoadTypeLi
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SysStringByteLen
SysAllocStringByteLen
OleCreatePropertyFrame
VariantChangeType
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
VariantInit
SysAllocString
VarBstrCmp
SysAllocStringLen

oledlg

OleUIBusyW

ws2_32

WSASetLastError
WSAGetLastError
WSAAsyncSelect
select
closesocket
WSACleanup
accept
listen
shutdown
recvfrom
recv
ntohs
inet_ntoa
WSAStartup
gethostbyname
socket
sendto
bind
inet_addr
getpeername
connect
htonl
getsockname
send
htons

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

wininet

InternetGetLastResponseInfoW
InternetWriteFile
InternetSetFilePointer
InternetOpenUrlW
InternetConnectW
InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetReadFile
InternetSetOptionW
InternetConnectA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
HttpAddRequestHeadersA
HttpQueryInfoW
InternetSetOptionA
InternetSetStatusCallbackW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestExW
HttpEndRequestW
HttpOpenRequestA
InternetQueryDataAvailable
InternetQueryOptionW
InternetGetConnectedState

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 8.1MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 476KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 327KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 475KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4bde433b5fefbe80e357c474989ce92

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0d:17:31:51:d3:db:31:7e:05:0e:fc:22:c5:b3:a0:ddCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0d:17:31:51:d3:db:31:7e:05:0e:fc:22:c5:b3:a0:ddCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

08:e1:a9:dc:85:0e:9c:7c:be:a1:d3:06:9b:3b:fa:73:03:51:8d:c1:88:ab:0b:c9:37:9e:24:ae:b2:7d:5d:83Signer

ed:08:34:6a:32:3e:0e:ae:33:7d:c8:69:b9:08:98:8a:12:ec:3e:c2Signer

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

uxtheme

winmm

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

ws2_32

oleacc

wininet

imm32

version

Sections

.text Size: 8.1MB - Virtual size: 8.1MB

.rdata Size: 2.7MB - Virtual size: 2.7MB

.data Size: 116KB - Virtual size: 476KB

.pdata Size: 327KB - Virtual size: 326KB

.gfids Size: 113KB - Virtual size: 112KB

.giats Size: 512B - Virtual size: 16B

.tls Size: 512B - Virtual size: 9B

_RDATA Size: 5KB - Virtual size: 4KB

.rsrc Size: 475KB - Virtual size: 474KB

.reloc Size: 128KB - Virtual size: 128KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:17:31:51:d3:db:31:7e:05:0e:fc:22:c5:b3:a0:dd
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:17:31:51:d3:db:31:7e:05:0e:fc:22:c5:b3:a0:dd
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

08:e1:a9:dc:85:0e:9c:7c:be:a1:d3:06:9b:3b:fa:73:03:51:8d:c1:88:ab:0b:c9:37:9e:24:ae:b2:7d:5d:83
Signer

ed:08:34:6a:32:3e:0e:ae:33:7d:c8:69:b9:08:98:8a:12:ec:3e:c2
Signer

.text
Size: 8.1MB - Virtual size: 8.1MB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 116KB - Virtual size: 476KB

.pdata
Size: 327KB - Virtual size: 326KB

.gfids
Size: 113KB - Virtual size: 112KB

.giats
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 9B

_RDATA
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 475KB - Virtual size: 474KB

.reloc
Size: 128KB - Virtual size: 128KB