2024-01-28_63bbde846192893d2e4e39fe5688eec9_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-28_63bbde846192893d2e4e39fe5688eec9_icedid
Size

8.8MB
MD5

63bbde846192893d2e4e39fe5688eec9
SHA1

2258aa6fa77d612de227aaf9ea488010943698c3
SHA256

de73ce96cb0cc080648188dfbe0208d5cf36d6ab55de24a2d9b9f140ff2ac568
SHA512

0281cec39ab367492bc464d24b433dc3a4c97aa67f0c8c7ab8ce9eb57b27bceb9e6341ee776d047d3ca0fab0312777d02fc64f2af479507a4ae5f17b583d3821
SSDEEP

196608:DS2/878dNlEE8FnLV19isfZYXaPf7tDF7IBwr:vS8dTEFFLV19IXAjZFcBwr

Score

1^/10

Malware Config

Signatures

Files

2024-01-28_63bbde846192893d2e4e39fe5688eec9_icedid
.exe windows:6 windows x86 arch:x86

ada0329d1bc9185f4bb18f7c4c409e71

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ec:8e:4d:a0:9c:b5:89:45:35:4f:74:64:bc:20:c2:29
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

09/09/2021, 00:00

Not After

08/09/2024, 23:59

Subject

CN=Florian Heidenreich,O=Florian Heidenreich,ST=Sachsen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

66:7a:1a:69:e9:b4:ac:0f:d9:04:74:ae:f7:d8:53:04:9d:bc:a1:a1:d6:66:d3:2a:64:e5:1a:c7:42:c3:7b:b0
Signer

Actual PE Digest

66:7a:1a:69:e9:b4:ac:0f:d9:04:74:ae:f7:d8:53:04:9d:bc:a1:a1:d6:66:d3:2a:64:e5:1a:c7:42:c3:7b:b0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Y:\build\binaries\mp3tag\Mp3tag.pdb

Imports

shlwapi

PathIsRelativeW
StrCmpLogicalW
PathCompactPathW
PathStripToRootW
PathRemoveFileSpecW
PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW
ord219
PathQuoteSpacesW
PathIsUNCW
PathSearchAndQualifyW
PathRelativePathToW
ord12

uxtheme

CloseThemeData
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetThemeMargins
GetThemeInt
GetThemeBackgroundContentRect
DrawThemeBackground
EndBufferedPaint
BufferedPaintSetAlpha
BeginBufferedPaint
GetThemeColor
OpenThemeData
SetWindowTheme
DrawThemeText
DrawThemeParentBackground

kernel32

Beep
CompareStringOrdinal
LoadLibraryExW
VirtualProtect
GetACP
OutputDebugStringA
GetModuleHandleA
EncodePointer
lstrcmpW
GlobalFindAtomW
CompareStringW
GetVersionExW
lstrcmpA
CompareStringA
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
SuspendThread
ResumeThread
GetProfileIntW
GetDiskFreeSpaceW
ReplaceFileW
FlushFileBuffers
LockFile
UnlockFile
DuplicateHandle
GetThreadLocale
GetFileSizeEx
LocalFileTimeToFileTime
CreateSemaphoreW
GetAtomNameW
GlobalFlags
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
SetErrorMode
FindResourceExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
RegisterWaitForSingleObject
SetThreadGroupAffinity
GetThreadGroupAffinity
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformationEx
GetLogicalProcessorInformation
GetCurrentProcessorNumberEx
SwitchToThread
SignalObjectAndWait
SystemTimeToTzSpecificLocalTime
GetFileType
ExpandEnvironmentStringsW
FileTimeToSystemTime
GetVolumeInformationW
GetDiskFreeSpaceExW
GetNativeSystemInfo
TryEnterCriticalSection
HeapCreate
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
DeleteFileA
HeapCompact
LockFileEx
GetTickCount
GetConsoleScreenBufferInfo
AreFileApisANSI
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
SystemTimeToFileTime
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
IsValidLocale
ExitProcess
GetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
SetStdHandle
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
HeapQueryInformation
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetCPInfo
CompareStringEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateEventExW
InitOnceExecuteOnce
SetFileInformationByHandle
LCMapStringEx
GetLocaleInfoEx
RtlCaptureStackBackTrace
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
TryAcquireSRWLockExclusive
FormatMessageA
RaiseException
GetWindowsDirectoryW
GetSystemDirectoryW
VerifyVersionInfoW
VerSetConditionMask
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetThreadPriority
ReadDirectoryChangesW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
InitializeCriticalSectionAndSpinCount
WriteFile
ReadFile
SetEndOfFile
SetFilePointer
CreateProcessW
lstrcatW
GetCommandLineW
SetCurrentDirectoryW
GetCurrentDirectoryW
RemoveDirectoryW
CreateDirectoryW
OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFullPathNameW
SetFileTime
GetFileTime
GetLongPathNameW
GetShortPathNameW
GetFileAttributesExW
GetFileSize
MoveFileExW
GetTickCount64
MoveFileW
SetFileAttributesW
CopyFileW
DeleteFileW
SetConsoleCtrlHandler
CreateMutexW
SleepEx
SetEvent
GetCurrentThread
SetThreadPriority
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
HeapDestroy
DecodePointer
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
NormalizeString
IsNormalizedString
GetTempFileNameW
LCMapStringW
GetStringTypeExW
LCMapStringA
LoadLibraryA
GetStringTypeExA
GetUserDefaultLCID
CreateSemaphoreExW
CreateMutexExW
GlobalGetAtomNameW
GetVersion
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
OutputDebugStringW
IsDebuggerPresent
FindNextFileW
lstrcpynW
GetEnvironmentVariableW
WaitForMultipleObjects
MulDiv
Sleep
GetFileAttributesW
TerminateThread
CreateThread
QueryPerformanceFrequency
QueryPerformanceCounter
lstrcpyW
GlobalUnlock
LocalAlloc
GlobalLock
GlobalFree
GlobalAlloc
GlobalSize
WaitForSingleObject
ResetEvent
CreateEventW
FreeLibrary
GetDriveTypeW
SetLastError
LocalFree
WideCharToMultiByte
lstrcmpiW
lstrlenW
EnumSystemLocalesW
FindClose
FindFirstFileW
GetLocaleInfoW
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapFree
GetModuleHandleW
HeapAlloc
GetProcessHeap
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
GlobalDeleteAtom
TzSpecificLocalTimeToSystemTime
GlobalAddAtomW
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
GetLastError
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
GetTempPathW
GetProcAddress
LoadLibraryW
GetModuleFileNameW
SetUnhandledExceptionFilter
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
UnregisterWait
GetThreadTimes
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
InterlockedPopEntrySList
QueryDepthSList
GetFileInformationByHandle
PeekNamedPipe
GetSystemTime

user32

SetWindowRgn
IsZoomed
GetScrollInfo
GetClassLongW
GetWindowRgn
LockWindowUpdate
CopyImage
RealChildWindowFromPoint
SetPropW
MapWindowPoints
IsMenu
AdjustWindowRectEx
DeferWindowPos
TrackMouseEvent
FrameRect
FillRect
SetRect
CopyIcon
DrawEdge
UnionRect
DestroyCursor
GetComboBoxInfo
SetWindowPos
PostThreadMessageW
CreateWindowExW
RegisterClassW
DestroyWindow
DefWindowProcW
MonitorFromRect
MsgWaitForMultipleObjects
CharUpperBuffW
SendMessageTimeoutW
GetLastActivePopup
MsgWaitForMultipleObjectsEx
PeekMessageW
EndPaint
BeginPaint
InvalidateRgn
DrawTextW
GetIconInfo
CreateIconIndirect
DrawIconEx
CreateMenu
GetMenuItemInfoW
GetMenuState
DeleteMenu
ModifyMenuW
LoadMenuW
SetMenuDefaultItem
SendDlgItemMessageA
SetRectEmpty
UnregisterClassA
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
IsWindowEnabled
GetMessageTime
CallWindowProcW
GetClassInfoW
GetClassInfoExW
IsChild
IsWindowUnicode
GetMessageW
GetMessageA
DispatchMessageA
DestroyAcceleratorTable
LoadAcceleratorsW
DestroyMenu
SetActiveWindow
GetActiveWindow
OpenClipboard
SetWindowLongW
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
CharUpperW
CharLowerW
UnregisterClassW
GetDialogBaseUnits
EnableWindow
SendMessageW
MessageBoxW
UpdateWindow
GetAsyncKeyState
KillTimer
SetTimer
PostMessageW
SendDlgItemMessageW
GetDlgItemTextW
MonitorFromWindow
GetMonitorInfoW
CopyRect
SystemParametersInfoW
GetWindowRect
CreatePopupMenu
AppendMenuW
SetDlgItemTextW
GetDlgItem
GetClientRect
InsertMenuW
GetWindow
LoadIconW
GetFocus
GetMessagePos
RegisterClipboardFormatW
IsClipboardFormatAvailable
GetClipboardData
EmptyClipboard
SetClipboardData
GetPriorityClipboardFormat
ReleaseDC
GetDC
DragDetect
GetParent
CheckMenuRadioItem
EnumClipboardFormats
CheckMenuItem
CloseClipboard
GetSubMenu
GetWindowPlacement
SetWindowPlacement
SetFocus
GetCapture
GetMenu
SetMenu
TrackPopupMenuEx
GetForegroundWindow
ValidateRect
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
GetPropW
RemovePropW
GetTopWindow
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetScrollInfo
WinHelpW
ShowWindow
MoveWindow
SetDlgItemInt
GetDlgItemInt
CheckDlgButton
CheckRadioButton
IsDlgButtonChecked
ScrollWindowEx
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
GetMenuStringW
RemoveMenu
GetKeyNameTextW
MapVirtualKeyW
PostQuitMessage
WaitMessage
ScreenToClient
PtInRect
GetMenuItemCount
GetMenuItemID
ClientToScreen
GetSysColor
WindowFromPoint
SetCursor
LoadCursorW
TranslateMessage
DispatchMessageW
InvalidateRect
GetDlgCtrlID
IsWindow
DestroyIcon
RedrawWindow
GetWindowDC
MapDialogRect
SetCapture
ReleaseCapture
GetSystemMetrics
MessageBeep
IntersectRect
EqualRect
RegisterWindowMessageW
EnableMenuItem
GetClassNameW
IsWindowVisible
IsIconic
SetForegroundWindow
GetCursorPos
TrackPopupMenu
GetMenuInfo
GetSysColorBrush
SetMenuInfo
GetWindowThreadProcessId
DrawMenuBar
MonitorFromPoint
LoadStringA
LoadImageW
LoadStringW
BeginDeferWindowPos
EndDeferWindowPos
GetDesktopWindow
GetKeyState
InflateRect
OffsetRect
CharLowerBuffW
IsRectEmpty
GetWindowLongW
GetDCEx
SetParent
GetSystemMenu
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
InsertMenuItemW
TranslateAcceleratorW
BringWindowToTop
DrawIcon
TabbedTextOutW
GrayStringW
DrawTextExW
ShowOwnedPopups

gdi32

IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
GetWindowExtEx
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
MoveToEx
TextOutW
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetMapMode
DPtoLP
CreateEllipticRgn
CreateDIBSection
LPtoDP
GetBkColor
CreateFontW
GetCharWidthW
StretchDIBits
EnumFontFamiliesExW
GetViewportExtEx
GetObjectType
GetCurrentPositionEx
GetClipRgn
GetClipBox
Escape
CreatePatternBrush
CreateHatchBrush
CreateDIBPatternBrushPt
CreateDCW
CopyMetaFileW
SetPixelV
SetDIBits
GetDIBits
Ellipse
ExcludeClipRect
SetPixel
SetBkMode
ExtTextOutW
SetBkColor
CreatePolygonRgn
GetPixel
CreateBitmap
GetWindowOrgEx
FillRgn
CombineRgn
SetRectRgn
OffsetRgn
CreateRectRgn
CreateRectRgnIndirect
ExtCreatePen
CreatePen
SetTextColor
GetStockObject
PatBlt
GetTextColor
DeleteObject
GetDeviceCaps
SelectObject
CreateCompatibleDC
GetObjectW
CreateCompatibleBitmap
BitBlt
DeleteDC
CreateSolidBrush
GetTextExtentPoint32W
CreateDIBitmap
CreateFontIndirectW
GetTextMetricsW
StartDocW
GetCurrentObject

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

SetFileSecurityW
CryptReleaseContext
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
RegEnumKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegEnumValueW
RegSetValueW
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
GetFileSecurityW
GetUserNameW

shell32

SHCreateShellItem
DragQueryFileW
ShellExecuteW
SHGetFileInfoW
SHCreateItemFromIDList
SHParseDisplayName
SHCreateShellItemArrayFromIDLists
ord155
ord190
SHOpenFolderAndSelectItems
FindExecutableW
SHBindToParent
SHGetDataFromIDListW
SHGetIDListFromObject
SHFileOperationW
SHAddToRecentDocs
ExtractIconW
DragFinish
Shell_NotifyIconW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteExW
SHGetMalloc

comctl32

ord410
ImageList_SetBkColor
ImageList_ReplaceIcon
ord345
ord413
ImageList_DragMove
ImageList_DragShowNolock
ImageList_BeginDrag
ImageList_DragEnter
ImageList_GetImageInfo
ImageList_AddMasked
ImageList_DragLeave
ImageList_EndDrag
ord412
ImageList_GetIcon
ImageList_Draw

ole32

ReadFmtUserTypeStg
OleDuplicateData
OleRegGetUserType
SetConvertStg
CoCreateGuid
CoInitializeEx
OleSetClipboard
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
PropVariantCopy
CoLockObjectExternal
WriteFmtUserTypeStg
OleGetClipboard
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CoDisconnectObject
StringFromGUID2
CLSIDFromString
CoGetClassObject
CoRegisterClassObject
CoRevokeClassObject
CoRegisterMessageFilter
CLSIDFromProgID
OleRun
RevokeDragDrop
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
RegisterDragDrop
ReleaseStgMedium
CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CreateBindCtx

oleaut32

VariantClear
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
SysReAllocStringLen
SysStringLen
VariantInit
SysFreeString
SysAllocString
VariantCopy
SystemTimeToVariantTime
VarDecFromStr
VarBstrFromDec
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
VariantTimeToSystemTime
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayCreate
SafeArrayAllocData
SafeArrayAllocDescriptor

oledlg

OleUIBusyW

ws2_32

socket
inet_addr
gethostbyname
WSASetLastError
connect
send
recv
closesocket
select
gethostname
accept
bind
getpeername
htons
getsockname
htonl
inet_ntoa
WSAAsyncSelect
WSAGetLastError
WSACleanup
WSAStartup
sendto
recvfrom
ntohs

gdiplus

GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDrawRectangleI
GdipCreateBitmapFromScan0
GdipSetInterpolationMode
GdipGraphicsClear
GdipSaveImageToStream
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectI
GdipBitmapUnlockBits
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipGetImagePixelFormat
GdipCreateFromHDC
GdipGetImageFlags
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreatePen1
GdipDeletePen
GdipSetPenDashStyle
GdipCreatePath
GdipDeletePath
GdipResetPath
GdipStartPathFigure
GdipClosePathFigure
GdipAddPathArcI
GdipDrawPath
GdipBitmapLockBits
GdipDeleteGraphics

winmm

mciSendCommandW
mciGetErrorStringW

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

tak_deco_lib

tak_SSD_GetStreamInfo
tak_SSD_Valid
tak_SSD_Create_FromStream
tak_SSD_GetEncoderInfo
tak_SSD_Destroy

crypt32

CryptUnprotectMemory
CertFreeCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptProtectMemory

winhttp

WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryAuthSchemes
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpSetOption
WinHttpQueryOption
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpAddRequestHeaders
WinHttpGetDefaultProxyConfiguration
WinHttpSetCredentials

bcrypt

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash

Sections

.text
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ada0329d1bc9185f4bb18f7c4c409e71

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

ec:8e:4d:a0:9c:b5:89:45:35:4f:74:64:bc:20:c2:29Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

66:7a:1a:69:e9:b4:ac:0f:d9:04:74:ae:f7:d8:53:04:9d:bc:a1:a1:d6:66:d3:2a:64:e5:1a:c7:42:c3:7b:b0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

uxtheme

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

oledlg

ws2_32

gdiplus

winmm

oleacc

tak_deco_lib

crypt32

winhttp

bcrypt

Sections

.text Size: 5.9MB - Virtual size: 5.9MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 103KB - Virtual size: 144KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

ec:8e:4d:a0:9c:b5:89:45:35:4f:74:64:bc:20:c2:29
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

66:7a:1a:69:e9:b4:ac:0f:d9:04:74:ae:f7:d8:53:04:9d:bc:a1:a1:d6:66:d3:2a:64:e5:1a:c7:42:c3:7b:b0
Signer

.text
Size: 5.9MB - Virtual size: 5.9MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 103KB - Virtual size: 144KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB