bdcam[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bdcam.exe
Size

6.7MB
MD5

2fe6b5b8951681f63885ca2e33e2ab06
SHA1

5d5599c0e6b19304e46ddf703d4d0be16f74d19d
SHA256

d0198d9d3fea9f19024a97d1cfc588185e95de3a1599eb0ce3185b5a22f9555f
SHA512

eb47e7df0b47028e6a88da266c09073582dd2d7b50dac20d4662196692c31e271be224135a5f522dc8c2ebbf0f41714d28013a029c05dd2d38d0bf6d870b1aca
SSDEEP

98304:afBXJMLVYgsfx8vyImYjYxm7I+cA4+rdmGJtWXzl6FTgxtYxANVGWHSGC:pLVFPYIc1+tWjl6FTgxeA7GWHSH

Score

1^/10

Malware Config

Signatures

Files

bdcam.exe
.exe windows:6 windows x86 arch:x86

23bed5a10e524b6aed9564c18e327df4

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

22/12/2017, 00:00

Not After

19/02/2021, 23:59

Subject

CN=Bandicam Company,O=Bandicam Company,L=Yeoungdeungpo-=gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

22/12/2017, 00:00

Not After

19/02/2021, 23:59

Subject

CN=Bandicam Company,O=Bandicam Company,L=Yeoungdeungpo-=gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e8:f0:b7:8f:2a:87:96:11:95:0d:1e:18:23:87:e4:45:6a:38:50:db:1a:46:9b:5b:80:08:df:91:22:1d:e0:5c
Signer

Actual PE Digest

e8:f0:b7:8f:2a:87:96:11:95:0d:1e:18:23:87:e4:45:6a:38:50:db:1a:46:9b:5b:80:08:df:91:22:1d:e0:5c

Digest Algorithm

sha256

PE Digest Matches

true

cd:6c:fb:ff:a6:c4:c9:40:a9:86:8e:e7:9e:52:94:8b:fd:bd:11:ee
Signer

Actual PE Digest

cd:6c:fb:ff:a6:c4:c9:40:a9:86:8e:e7:9e:52:94:8b:fd:bd:11:ee

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetStdHandle
VirtualQuery
HeapQueryInformation
GetCommandLineW
GetCommandLineA
FindFirstFileExW
InitializeSListHead
FreeLibraryAndExitThread
ExitThread
RtlUnwind
LCMapStringW
GetCPInfo
GetStringTypeW
LoadLibraryExA
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetDriveTypeW
IsValidCodePage
GetACP
GetFileType
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
GetStartupInfoW
WaitForSingleObjectEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetProfileIntW
SearchPathW
VerifyVersionInfoW
VerSetConditionMask
GetFileAttributesExW
VirtualProtect
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GlobalGetAtomNameW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CompareStringA
ResumeThread
UnlockFile
SetEndOfFile
LockFile
GetThreadLocale
IsDebuggerPresent
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
EncodePointer
LoadLibraryA
GetModuleHandleA
CopyFileW
DuplicateHandle
lstrcmpiW
GetThreadPriority
WaitForMultipleObjects
SwitchToThread
LoadLibraryExW
GetModuleHandleExW
SetErrorMode
SetUnhandledExceptionFilter
DecodePointer
MoveFileW
FormatMessageW
GetDateFormatW
CreateThread
ReadDirectoryChangesW
SleepEx
GetLocalTime
GetUserDefaultLCID
LCIDToLocaleName
GetUserDefaultLangID
CompareStringW
QueryFullProcessImageNameW
GetTickCount
GetSystemWow64DirectoryW
RaiseException
GetCurrentThreadId
InitializeCriticalSectionEx
CreateFileMappingW
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateMutexW
VirtualFree
VirtualAlloc
CreateEventW
GlobalSize
GlobalUnlock
GlobalLock
FlushFileBuffers
ExitProcess
FileTimeToLocalFileTime
lstrcmpA
LocalAlloc
ResetEvent
SetEvent
CreateEventA
GetWindowsDirectoryW
lstrlenA
QueryPerformanceFrequency
GetTickCount64
QueryPerformanceCounter
FindResourceExW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
MulDiv
lstrcmpW
WriteFile
SetThreadPriority
Sleep
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetVersionExW
GetSystemInfo
TerminateProcess
OpenProcess
GetLastError
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
IsDBCSLeadByteEx
MultiByteToWideChar
WideCharToMultiByte
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
LocalFree
GetFileSizeEx
GetFileSize
GetFileAttributesW
DeleteFileW
GetTempFileNameW
GetTempPathW
GetCurrentDirectoryW
GetSystemDirectoryW
GetModuleFileNameW
GetDiskFreeSpaceW
GlobalFree
GlobalAlloc
GetCurrentThread
GetCurrentProcess
FreeLibrary
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetVolumeInformationW
SetLastError
FindClose
FindNextFileW
lstrcpyW
FindFirstFileW
lstrcpynW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetFileTime
FindResourceW
LoadResource
LockResource
SizeofResource
ReadFile
SetFilePointer
CreateFileW
OutputDebugStringA
OutputDebugStringW
lstrlenW
CloseHandle
SetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

BeginDeferWindowPos
SetWindowPlacement
IsChild
IsMenu
GetMessageTime
GetMessagePos
InsertMenuW
GetMenuState
MsgWaitForMultipleObjects
GetQueueStatus
PostThreadMessageW
GetActiveWindow
GetMessageW
SetMenuDefaultItem
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetWindow
WindowFromPoint
GetCursor
GetCursorInfo
ShowCursor
FillRect
AppendMenuW
CreatePopupMenu
GetDoubleClickTime
SetCursorPos
UpdateLayeredWindowIndirect
GetCapture
EnableMenuItem
RemoveMenu
UpdateLayeredWindow
SetParent
CheckMenuItem
DeleteMenu
CheckMenuRadioItem
DrawIconEx
LoadImageW
SetClassLongW
GetAsyncKeyState
TranslateAcceleratorW
DrawIcon
LoadAcceleratorsW
GetClassInfoW
EnumDisplayDevicesW
MessageBoxW
EnumDisplayMonitors
GetWindowTextLengthW
GetFocus
IsWindowEnabled
TrackPopupMenuEx
DestroyMenu
LoadMenuW
TrackMouseEvent
SetWindowRgn
GetClassInfoExW
RegisterClassExW
UnregisterClassW
SetFocus
InflateRect
GetCursorPos
GetWindowDC
SetScrollInfo
DeferWindowPos
SetScrollPos
CreateWindowExW
EndPaint
BeginPaint
CharUpperW
PostQuitMessage
GetSysColor
GetKeyState
IsZoomed
MessageBeep
SendMessageW
SetWindowContextHelpId
DestroyWindow
UnionRect
IsClipboardFormatAvailable
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetTopWindow
SetTimer
ShowWindow
CallWindowProcW
RemovePropW
GetPropW
SetPropW
SetLayeredWindowAttributes
SetActiveWindow
IntersectRect
RegisterClassW
LoadIconW
DefWindowProcW
GetSysColorBrush
InvalidateRect
SetCursor
LoadCursorW
SetCapture
RedrawWindow
ReleaseCapture
GetLastActivePopup
GetScrollInfo
GetNextDlgTabItem
WinHelpW
MonitorFromWindow
CheckDlgButton
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
DrawTextExW
GrayStringW
EndDeferWindowPos
PtInRect
GetClientRect
GetDlgItem
GetMenu
SetMenu
TrackPopupMenu
UpdateWindow
ValidateRect
ScrollWindow
GetScrollPos
GetScrollRange
ShowScrollBar
SetScrollRange
AdjustWindowRectEx
SystemParametersInfoW
GetWindowRect
MonitorFromRect
GetMonitorInfoW
CopyRect
MonitorFromPoint
OffsetRect
EqualRect
MoveWindow
GetWindowLongW
SetWindowPos
ScreenToClient
ClientToScreen
PeekMessageW
TranslateMessage
DispatchMessageW
IsWindow
GetParent
GetDesktopWindow
FindWindowExW
GetWindowThreadProcessId
IsWindowVisible
IsIconic
GetWindowTextW
GetWindowPlacement
GetForegroundWindow
SetForegroundWindow
BringWindowToTop
GetDC
ReleaseDC
RegisterWindowMessageW
DestroyIcon
DrawTextW
ExitWindowsEx
PostMessageW
IsRectEmpty
MapDialogRect
ShowOwnedPopups
SendDlgItemMessageA
DrawStateW
GetKeyNameTextW
MapVirtualKeyW
CopyImage
RealChildWindowFromPoint
InsertMenuItemW
TabbedTextOutW
CreateDialogIndirectParamW
EndDialog
GetClassNameW
DefFrameProcW
GetClassLongW
SetRectEmpty
SetRect
GetDlgCtrlID
SetWindowTextW
MapWindowPoints
SetWindowLongW
EnumChildWindows
GetMenuItemCount
GetMenuStringW
GetMenuItemID
ModifyMenuW
GetMenuItemInfoW
GetSubMenu
wsprintfW
EnableWindow
KillTimer
UnpackDDElParam
ReuseDDElParam
GetSystemMenu
NotifyWinEvent
WaitMessage
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
RegisterClipboardFormatW
LockWindowUpdate
CharNextW
InvalidateRgn
GetNextDlgGroupItem
GetMenuDefaultItem
EnableScrollBar
DrawEdge
DrawFrameControl
DrawFocusRect
CharUpperBuffW
CopyIcon
FrameRect
DrawMenuBar
GetWindowRgn
GetComboBoxInfo
DestroyCursor
CreateMenu
InvertRect
HideCaret
GetIconInfo
GetUpdateRect
SubtractRect
MapVirtualKeyExW
IsCharLowerW
TranslateMDISysAccel
DefMDIChildProcW
GetSystemMetrics

gdi32

CreateRectRgnIndirect
FillRgn
CopyMetaFileW
CreateBitmap
CreateHatchBrush
CreatePatternBrush
Escape
GetClipBox
GetObjectType
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
PtVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
GetPixel
PatBlt
GetMapMode
SetRectRgn
DPtoLP
CreateDIBitmap
GetTextCharsetInfo
GetDIBits
RealizePalette
SetPixel
SetDIBColorTable
CreateRoundRectRgn
GetRgnBox
GetTextColor
GetBkColor
EnumFontFamiliesExW
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
LPtoDP
RoundRect
ExtFloodFill
SetPaletteEntries
GetViewportOrgEx
GetWindowOrgEx
FrameRgn
GetBoundsRect
PtInRegion
GetTextFaceW
SetPixelV
Rectangle
CreatePen
CreateDCW
CreateSolidBrush
ExtCreateRegion
LineTo
MoveToEx
CombineRgn
OffsetRgn
CreateRectRgn
ExcludeClipRect
SetWindowOrgEx
CreateCompatibleBitmap
TextOutW
SetTextCharacterExtra
AbortPath
GetPath
EndPath
CloseFigure
BeginPath
StretchBlt
BitBlt
CreateDIBSection
CreateFontIndirectW
GetDeviceCaps
SelectObject
SetTextColor
SetBkMode
CreateCompatibleDC
DeleteDC
CreateFontW
DeleteObject
ExtTextOutW
SetBkColor
EnumFontFamiliesW
GetObjectW
GetStockObject
GetTextMetricsW
ScaleWindowExtEx
RectVisible
GetTextExtentPoint32W

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetOpenFileNameW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

InitializeSecurityDescriptor
OpenProcessToken
AllocateAndInitializeSid
FreeSid
SetEntriesInAclW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueW
RegEnumKeyW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityDescriptorDacl
RegQueryInfoKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
SetNamedSecurityInfoW

shell32

SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetMalloc
SHAppBarMessage
DragFinish
DragQueryFileW
SHGetFileInfoW
ExtractIconExW
CommandLineToArgvW
SHChangeNotify
Shell_NotifyIconW
ShellExecuteW
ord155
SHOpenFolderAndSelectItems
ord190
SHBrowseForFolderW
SHGetPathFromIDListW

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathFindFileNameW
PathFindExtensionW
StrStrW
PathIsDirectoryW
StrFormatKBSizeW

uxtheme

GetThemeSysColor
IsAppThemed
DrawThemeText
DrawThemeParentBackground
DrawThemeBackground
IsThemeBackgroundPartiallyTransparent
OpenThemeData
CloseThemeData
GetThemePartSize
GetThemeColor
GetCurrentThemeName
GetWindowTheme

ole32

RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleUninitialize
OleInitialize
OleLockRunning
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CreateStreamOnHGlobal
CoDisconnectObject
CoCreateGuid
CLSIDFromString
CoInitializeEx
ReleaseStgMedium
OleDuplicateData
CoFreeUnusedLibraries
CoTaskMemAlloc
PropVariantClear
CoInitialize
CoTaskMemFree
CoCreateInstance
OleSetContainedObject
OleCreate
CoUninitialize
CoRevokeClassObject
CoRegisterMessageFilter
CLSIDFromProgID

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString
SafeArrayDestroy
VariantCopy
VarBstrFromDate
LoadTypeLi
OleCreateFontIndirect
OleCreatePropertyFrame
VariantChangeType
SysStringLen
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime

oledlg

OleUIBusyW

urlmon

CoInternetCombineUrl

gdiplus

GdipSetPenStartCap
GdipSetPenEndCap
GdipDrawLineI
GdipCreateAdjustableArrowCap
GdipDeleteCustomLineCap
GdipSetPenCustomEndCap
GdipDrawRectangleI
GdipFillEllipse
GdipGetDC
GdipCreateFontFromDC
GdipCreateFontFromLogfontW
GdipReleaseDC
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipCreateImageAttributes
GdipDeletePen
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdiplusShutdown
GdipFlush
GdipCreateFromHDC
GdipDrawEllipseI
GdipGetDpiX
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreatePath
GdipDeletePath
GdipAddPathEllipseI
GdipSetClipPath
GdipDrawImageI
GdipFillEllipseI
GdipCreateRegion
GdipDeleteRegion
GdipAddPathRectangleI
GdipCreateRegionPath
GdipSetClipRegion
GdipCreateRegionRectI
GdipCombineRegionRectI
GdipFillRegion
GdipSetPenWidth
GdipSetPenDashArray
GdipSetEmpty
GdipCombineRegionRegion
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectI
GdipImageRotateFlip
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreatePen1
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipFillRectangleI
GdipResetClip
GdipSetClipRectI
GdipDrawString
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipSetTextRenderingHint
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipGraphicsClear
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdiplusStartup
GdipSetPenMode
GdipDisposeImageAttributes
GdipCreateBitmapFromHBITMAP

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wininet

InternetSetCookieW
HttpEndRequestW
HttpOpenRequestA
InternetCanonicalizeUrlW
InternetOpenW
InternetSetOptionW
InternetWriteFile
HttpSendRequestExW
HttpAddRequestHeadersW
InternetConnectA
InternetCrackUrlA
HttpSendRequestW
InternetQueryOptionW
HttpOpenRequestW
InternetConnectW
InternetCrackUrlW
InternetCloseHandle
InternetReadFile
InternetQueryDataAvailable
HttpQueryInfoW
InternetOpenUrlW
InternetCreateUrlW

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CertGetNameStringW
CryptMsgGetParam
CryptQueryObject
CryptDecodeObject

httpapi

HttpInitialize
HttpCreateHttpHandle
HttpAddUrl
HttpRemoveUrl
HttpTerminate
HttpReceiveHttpRequest
HttpSendHttpResponse

psapi

GetModuleFileNameExW
EnumProcessModules

winmm

timeBeginPeriod
timeEndPeriod
PlaySoundW
waveOutSetVolume
timeSetEvent
timeKillEvent

msvfw32

ICInfo
ICOpen
ICClose
ICGetInfo
ICSendMessage

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

Exports

Exports

�zh[f��D� =��O3N��yB68�P��?��R�C� ��0x�q�$;mT�(�%��i6w��;]��`ϞCF��Hpw�0 MUl�H�} ��?@�H��7P?V�.p�J��_{<ީ��O� �� ?J��H��B/v�b�b��̿x6�>�u?r� ��wLIS��ǲMv��$(�, ��$�A��B<es��H�m��z�k�G�v ��7sA�-�>,�h��U�� `?d-��P�Җܦ�ߧ��Y�gA�>я��ؙ�Gѿؑ+��Sx/�a;��?�Nd��.�i��|��_w��7@چ(�`m��w�mėk7 �o{R��r�u�A�>��yW8�^GY'`��)K+i��d���y�ނ��A��jM5��S5�-�(p� %S�\�e^�K�e�&�1f�<Q�%�$��^q��6�R�Ɠ��Yh(�BԮ,ˣGަi븊�^yq�c ��I�TuT7�d��=��鶺��=1��zS<��]i�>t��y�w6��N��{X��B;�pd�~��y#�ݰ1�N��'��*;�T�ir+囐�a�E�<n��41��=��V+��{|��S��T�D� Y�f|,sZ�"M�f�b�L|�Ai�7W]��1ώ�P-6��~8��"�Y� �j�^��?T�dR��S �M�Yr�~��E��v��9�� k�y��٤�c+��t��gH��f��';�ǩ!Z�/��k"kϭp�C�8lp�SI5M��2��e%2#{��\�[^]��{��8��,u��~<�z�Iv�c�rٲ�n��po�p��Ly� o�T�a��oШ?�$�0��=��tĊ��f��ߜ�J� ]�S�B��T��.<�i:,�y��2�ߴ<fP��>y��g��d�y�W��XA:��z�Y��r�_D&�@��(ۧL��+� I�+�u��O؉^��k�Ҏ��&��o_��bӡ3�)�l� "�Y��w ~��6 %g�E^��诼��P�FXd��:{��Fu��51Id�MZ#�_ ��瀨��Gx�)�?�N�-�ܾ,@�d�L��0��=ܻ��9� ��SU��e�;��@�V�M��x�X6�Q�?�- ��$�b��uG+�e L��[yvL7�Veg��]Fd��.)�|�W?1]�?��P��L��7n<��d.7�&�H�FRӷ�=��Gj��\��a�0��Q�/��w-�8��8�f��|:�P��e��2��/Şz_��*p�Zc��IC��U`3*�@κz܊��O9l4��o�O&P1Y��8]'�?b�vϧ�ۡG4�b��m�\�]L)��2�^��|8?q�OFE��W�j1�=�V�"��]ƒ!�b�r��M��C��(��h�O�� B~�鹏U��RE�f��%9FT6l,PU�x��ҀN�$��y-�Y�U��¥%W-sL�q�Y\.d��O��䧷V6>�T��n7��o�~��[�"N��L��( �1��I�O��}j]r�e�@D6��t�t��nW-&��zL��Fi2�& 4A'��S� ��grɻ�� N\�[7]�]�K�<:�N� �f|��l��r5��KnEZ�e^I4�*s 5v�V��M�=��&u�ӡ+*A��+L��IC�&MwI+��/��iR��̢C�KuxEP��1;"��V�v<��b�Fr��b%�ڀ%��pw��ш�V�39��v@.�o��)o~��-r��8��l�O�gZ��5#�A��^�÷�J�� :��3({bo�^��_tC)I�Fv��\��4��,>{�j�q� ��M_q��'��ɒIycAn�!ac��[��L��4��-��-<�<��4�=�t�eh��=��M:�-��q @��ٮ�RhL�E�o)&dD��=�=l��W��®8�1��2篒�3��fQ��o�쑙dgC�QE&q��'d�5��5�+�s��r{�n�":Í�|��Qj��?%;v1dU��h�!:6}�#�D�=Zn��U�muO�d9��'�鼼mD�t��-:N��4�W��[�@<��H��JD��D�[W$��_��nX]χ��D��0Z �vu0��$��E��':�<ŗ5w��h��u���:�%�*��@,v�5�7�ό�{R�2 �m\�NbBc��:�"��o�0ѐ=9\x �x2V[6}��x�~�Z=#��$�� cyW�SC�.��$�S��\��x�Ү�m�X��TLOsM�X��}t��ހ��z�k��},��ӿ;�w��c��E�Y?��K�H�]��˂u��ud�x��r<�7%��|��p��r~,ME��5�A71H��Yo��f��S��)l��"��W�C��4tw�RGL�r��p�$��.��D��G��=��u��:BW#f��h��&z��-C҂��3�^��-�޻��{q)ū�y��Zp<��=#7L�XjZ��E:$�h��nОE�U��Sl�Y��,�;��!K��9J��!��~��a��$:|�qǕU�_�w��(�xB6��A] �?w�*��N�e��$��=w�r�H��/PObhTU�aEP®pW��?��[�>��׻l��E��7\�ҍ�Ɓ��%�:�? 9�>cǆ?Ĝ~�2H��ʅ�7��83�r|rI�2i%��uύ,c�o�˼�ݶ�h�r=�IL}v�(? ,��{unT��.��U�@��o�_�� ՔKL#��Gf�{��ϙ �8�e��o���L%�֝Ɲ��;�J؋�5y��+��ƞ{ᇰGM�+

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 677KB - Virtual size: 677KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 245KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BANDISH
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BANDI0
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.BANDI1
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 241KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 709KB - Virtual size: 709KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23bed5a10e524b6aed9564c18e327df4

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

e8:f0:b7:8f:2a:87:96:11:95:0d:1e:18:23:87:e4:45:6a:38:50:db:1a:46:9b:5b:80:08:df:91:22:1d:e0:5cSigner

cd:6c:fb:ff:a6:c4:c9:40:a9:86:8e:e7:9e:52:94:8b:fd:bd:11:eeSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

urlmon

gdiplus

version

wininet

crypt32

httpapi

psapi

winmm

msvfw32

oleacc

imm32

Exports

Exports

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 677KB - Virtual size: 677KB

.data Size: 245KB - Virtual size: 273KB

.BANDISH Size: 512B - Virtual size: 16B

.BANDI0 Size: 1.6MB - Virtual size: 1.6MB

.BANDI1 Size: 99KB - Virtual size: 99KB

.reloc Size: 241KB - Virtual size: 241KB

.rsrc Size: 709KB - Virtual size: 709KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

e8:f0:b7:8f:2a:87:96:11:95:0d:1e:18:23:87:e4:45:6a:38:50:db:1a:46:9b:5b:80:08:df:91:22:1d:e0:5c
Signer

cd:6c:fb:ff:a6:c4:c9:40:a9:86:8e:e7:9e:52:94:8b:fd:bd:11:ee
Signer

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 677KB - Virtual size: 677KB

.data
Size: 245KB - Virtual size: 273KB

.BANDISH
Size: 512B - Virtual size: 16B

.BANDI0
Size: 1.6MB - Virtual size: 1.6MB

.BANDI1
Size: 99KB - Virtual size: 99KB

.reloc
Size: 241KB - Virtual size: 241KB

.rsrc
Size: 709KB - Virtual size: 709KB