2024-02-03_09ade31786327e228114688a8d090615_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-02-03_09ade31786327e228114688a8d090615_mafia
Size

4.8MB
MD5

09ade31786327e228114688a8d090615
SHA1

f175e50e078a8d970eb34db6224b33f4860f43f5
SHA256

eff6cd8d7ec3cbfa6f191b9f7570c4e53299761085173c4a51bb4d61d65e7f26
SHA512

fd16c07928982c1c2d93e2a52425490cd89ddf4ff324420a4b1b261fe7434c27da394fed574238a6e33fb170e7e88377fda72d7941a25b5c350d7068a544123f
SSDEEP

98304:LXRyHkdYaQHcBKz0Mw2VL2FqWoEhoRA1ChcBqP3y/iwM5YrL8qsg5:rQH0YHzr1uCiK55YrLDsg5

Score

1^/10

Malware Config

Signatures

Files

2024-02-03_09ade31786327e228114688a8d090615_mafia
.exe windows:5 windows x86 arch:x86

36497f76d1952a84f22a9a98cbc79c22

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2e:d7:e7:ed:fe:8b:4e:9d:fd:b0:98:34:85:50:e6:b0
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

06-05-2014 00:00

Not After

06-05-2015 23:59

Subject

CN=Fiorentino Media Inc.,O=Fiorentino Media Inc.,POSTALCODE=85250,STREET=Suite A110-430+STREET=7904 E. Chaparral Rd.,L=Scottsdale,ST=AZ,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

32:94:dc:f9:11:9d:10:53:7c:8c:e9:a0:dc:0a:b2:dc:6d:4c:73:25
Signer

Actual PE Digest

32:94:dc:f9:11:9d:10:53:7c:8c:e9:a0:dc:0a:b2:dc:6d:4c:73:25

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Working\Clients\SpeedyPC Pro\3.2.8\bin\Release\SpeedyPC.pdb

Imports

winmm

PlaySoundW
timeGetTime

rpcrt4

UuidCreateSequential

wininet

HttpSendRequestW
HttpQueryInfoW
InternetReadFile
HttpAddRequestHeadersW
InternetOpenUrlW
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
HttpOpenRequestW
InternetQueryDataAvailable
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
InternetCloseHandle
InternetConnectW
InternetOpenW

shfolder

SHGetFolderPathW

shell32

SHGetDiskFreeSpaceExW
SHGetFileInfoW
SHQueryRecycleBinW
SHEmptyRecycleBinW
DragFinish
DragQueryFileW
SHGetDesktopFolder
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHGetSpecialFolderLocation
SHGetMalloc
SHAppBarMessage
SHFileOperationW
ord165
SHCreateDirectoryExW

ole32

OleInitialize
CoTaskMemFree
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
OleDraw
CreateStreamOnHGlobal
CoCreateGuid
CoFreeUnusedLibraries
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
DoDragDrop
OleLockRunning
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
StringFromGUID2
CoInitializeSecurity
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
OleUninitialize

shlwapi

PathAddExtensionW
PathFindFileNameW
PathAppendW
PathIsUNCW
PathStripToRootW
PathStripPathW
PathGetCharTypeW
SHDeleteKeyW
PathFindOnPathW
PathRemoveFileSpecW
PathIsNetworkPathW
StrFormatByteSizeW
PathFindExtensionW
PathIsDirectoryW
PathFileExistsW
UrlUnescapeW
ord215
ord217
PathUnquoteSpacesW

gdi32

ExtFloodFill
EnumFontFamiliesExW
GetSystemPaletteEntries
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
OffsetRgn
CreateRoundRectRgn
Rectangle
SetPixel
StretchBlt
RealizePalette
GetDIBits
SetDIBColorTable
GetRgnBox
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
GetTextMetricsW
Polygon
Polyline
GetTextColor
GetBkColor
CreatePolygonRgn
Ellipse
CreateEllipticRgn
PatBlt
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateHatchBrush
GetObjectType
SelectPalette
CreateBitmap
ExtSelectClipRgn
SetPaletteEntries
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetPixel
CreateRectRgn
SelectClipRgn
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CopyMetaFileW
GetStockObject
CreatePatternBrush
CreateDIBSection
CreatePen
SetTextColor
CreateDCA
GetObjectA
SetBkColor
DeleteDC
GetTextExtentPoint32W
CreateDCW
GetDeviceCaps
SelectObject
CreateFontIndirectW
GetObjectW
GetCurrentObject
DeleteObject
CreateSolidBrush
BitBlt
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
CreateCompatibleDC
LPtoDP
CreateCompatibleBitmap
GetMapMode
GetWindowExtEx
GetViewportExtEx
DPtoLP
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
GetViewportOrgEx
GetTextFaceW
SetPixelV
GetWindowOrgEx
GetBitmapBits

comctl32

ImageList_GetIconSize
InitCommonControlsEx
ImageList_Draw

user32

GetScrollRange
ValidateRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetMenu
GetDlgCtrlID
IsDlgButtonChecked
SendDlgItemMessageW
GetDesktopWindow
SetActiveWindow
GetNextDlgTabItem
SetScrollRange
SetMenu
GetKeyState
ScrollWindow
MapWindowPoints
GetMessageTime
GetTopWindow
EndDeferWindowPos
SetMenuDefaultItem
GetCursorPos
TrackPopupMenu
IsCharLowerW
CharUpperBuffW
FrameRect
HideCaret
InvertRect
GetDoubleClickTime
CopyIcon
SetCursorPos
LockWindowUpdate
SetClassLongW
CreateAcceleratorTableW
DestroyAcceleratorTable
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
PostThreadMessageW
GetMenuDefaultItem
NotifyWinEvent
DeleteMenu
IsMenu
MonitorFromPoint
UpdateLayeredWindow
EnableScrollBar
UnionRect
CharNextW
InvalidateRgn
CopyAcceleratorTableW
SetLayeredWindowAttributes
EnumDisplayMonitors
RealChildWindowFromPoint
UnregisterClassW
GetSysColorBrush
DrawFrameControl
DrawEdge
UnpackDDElParam
LoadAcceleratorsW
BeginDeferWindowPos
CreatePopupMenu
BringWindowToTop
TranslateAcceleratorW
ShowOwnedPopups
SetWindowContextHelpId
MapDialogRect
RegisterClipboardFormatW
GetMenuItemInfoW
CharUpperW
DrawStateW
WindowFromPoint
LoadImageW
CopyImage
GetNextDlgGroupItem
SetRectEmpty
SetWindowRgn
MapVirtualKeyW
GetKeyNameTextW
IntersectRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
CheckMenuItem
GetMessageW
ClientToScreen
SendDlgItemMessageA
IsChild
GetCapture
SetWindowsHookExW
GetForegroundWindow
RemovePropW
GetPropW
RegisterWindowMessageW
CallWindowProcW
EnumChildWindows
IsIconic
DestroyMenu
DrawFocusRect
DestroyWindow
WaitMessage
DispatchMessageW
TranslateMessage
IsDialogMessageW
PeekMessageW
CreateDialogIndirectParamW
GetWindow
GetAsyncKeyState
SetClipboardData
EmptyClipboard
GetWindowTextW
WinHelpW
SetWindowTextW
MoveWindow
SetWindowPos
SetFocus
CheckDlgButton
GetSystemMenu
GetClassNameW
SetWindowLongW
GetDlgItem
GetSystemMetrics
GetDialogBaseUnits
EndPaint
GetWindowLongW
DrawIcon
BeginPaint
MessageBeep
GetLastActivePopup
GetActiveWindow
MessageBoxW
UpdateWindow
SetForegroundWindow
ShowWindow
LoadIconW
DefWindowProcW
FindWindowExW
SetParent
PostQuitMessage
ExitWindowsEx
FillRect
EnableMenuItem
GetSubMenu
LoadMenuW
DrawIconEx
DestroyIcon
ShowScrollBar
OffsetRect
SystemParametersInfoW
ReleaseCapture
LoadCursorW
SetCursor
SetCapture
SetRect
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
ScreenToClient
GetMessagePos
IsWindow
TrackMouseEvent
InflateRect
GetDC
LoadStringW
PostMessageW
RedrawWindow
PtInRect
CopyRect
GetParent
GetSysColor
SetTimer
KillTimer
IsWindowVisible
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
EnableWindow
GetFocus
ReleaseDC
SendMessageW
GetWindowRect
GetWindowDC
InvalidateRect
GetClientRect
SetPropW
MapVirtualKeyExW
GetClassLongW
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
GetUpdateRect
SubtractRect
CreateMenu
DestroyCursor
GetWindowRgn
GetIconInfo
EndDialog
GetWindowTextLengthW
GetScrollPos
SetScrollPos
GetWindowThreadProcessId
IsWindowEnabled
UnhookWindowsHookEx
GetMenuState
GetMenuStringW
InsertMenuItemW
ReuseDDElParam
AppendMenuW
GetScrollInfo
IsRectEmpty
MonitorFromWindow
GetMonitorInfoW
IsZoomed
wsprintfW
RemoveMenu
GetMenuItemCount
InsertMenuW
GetMenuItemID
CallNextHookEx

kernel32

GetProcessHeap
HeapFree
SetCurrentDirectoryW
CreateMutexW
GetLocalTime
MulDiv
GlobalAlloc
LocalAlloc
LocalLock
LocalFree
CreateFileW
GetSystemTime
lstrcmpiW
FindResourceExW
DeviceIoControl
SetEvent
WaitForMultipleObjects
CreateEventW
CreateTimerQueue
DeleteTimerQueueTimer
DeleteTimerQueue
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetEnvironmentVariableW
GetSystemDirectoryW
GetWindowsDirectoryW
GetFileSize
SetFilePointer
WriteFile
VirtualAlloc
VirtualFree
FindFirstFileW
FindNextFileW
FindClose
GetFileSizeEx
GetTimeZoneInformation
MoveFileExW
GetSystemTimes
ExpandEnvironmentStringsW
SetFileAttributesW
GetLongPathNameW
ResetEvent
FormatMessageW
GlobalSize
CopyFileW
GlobalFree
CreateActCtxW
ReleaseActCtx
InterlockedDecrement
FreeResource
lstrcmpW
InitializeCriticalSectionAndSpinCount
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GetCurrentThreadId
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
SetThreadPriority
ResumeThread
SuspendThread
lstrcmpA
lstrlenA
GetThreadLocale
MoveFileW
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetFullPathNameW
GetShortPathNameW
InterlockedExchange
LoadLibraryExW
CompareStringA
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GlobalGetAtomNameW
RaiseException
InterlockedIncrement
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
lstrcpyW
GetUserDefaultLCID
SetFileTime
GetFileTime
GetCurrentDirectoryW
GetFileAttributesExW
SetErrorMode
GetNumberFormatW
GetProfileIntW
HeapAlloc
VirtualProtect
GetCommandLineW
HeapSetInformation
GetStartupInfoW
ExitProcess
DecodePointer
EncodePointer
ExitThread
CreateThread
GetTimeFormatW
GetDateFormatW
HeapReAlloc
RtlUnwind
GetCPInfo
SetStdHandle
GetFileType
GetSystemInfo
VirtualQuery
HeapQueryInformation
HeapSize
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
HeapDestroy
QueryPerformanceCounter
UnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetStringTypeW
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
GetFileInformationByHandle
PeekNamedPipe
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
CreateFileA
GetFullPathNameA
SetEnvironmentVariableA
ReadFile
GetLocaleInfoW
GetVersionExW
TerminateProcess
OpenProcess
GetCurrentProcessId
TryEnterCriticalSection
ActivateActCtx
GetLastError
DeactivateActCtx
SetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
WideCharToMultiByte
WaitForSingleObject
DeleteFileW
GetTempFileNameW
GetTempPathW
OutputDebugStringW
GlobalUnlock
MultiByteToWideChar
GlobalLock
GetModuleFileNameW
CreateDirectoryW
GetFileAttributesW
GlobalMemoryStatusEx
GetModuleHandleW
GetDiskFreeSpaceW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetCurrentProcess
GetProcessTimes
GetSystemTimeAsFileTime
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
Sleep
TerminateThread
ReleaseMutex
SetEnvironmentVariableW
GetExitCodeThread
FindResourceW
LoadResource
LockResource
SizeofResource
lstrlenW
SearchPathW
GetProcessId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
LoadLibraryA
InterlockedCompareExchange
FlushConsoleInputBuffer
ReadConsoleInputA
SetConsoleMode
GetCurrentThread
SetFilePointerEx
RemoveDirectoryW
SleepEx
GetFileAttributesA
LockFileEx
GetVersionExA
GetTempPathA
AreFileApisANSI
DeleteFileA
GetDriveTypeA
FindFirstFileExA
LocalUnlock
GetVersion
GlobalMemoryStatus

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegQueryValueW
RegEnumKeyW
RegisterEventSourceA
SetSecurityDescriptorOwner
ReportEventA
SetSecurityDescriptorGroup
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
OpenThreadToken
GetTokenInformation
CreateWellKnownSid
SetEntriesInAclW
FreeSid
AllocateAndInitializeSid
ConvertSidToStringSidW
RegCloseKey
DeregisterEventSource
LookupAccountSidW
LookupAccountNameW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityW
GetUserNameW
RegEnumValueW
RegDeleteValueW
RegNotifyChangeKeyValue
RegEnumKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyW
RegQueryInfoKeyW
RegDeleteKeyW

oleaut32

SysStringLen
SafeArrayRedim
SafeArrayGetDim
SafeArrayAccessData
SafeArrayUnaccessData
VariantCopy
VariantChangeType
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SafeArrayCreate
SafeArrayGetUBound
SafeArrayGetLBound
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
VarBstrFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
OleCreateFontIndirect
SafeArrayGetElemsize

gdiplus

GdipDrawLineI
GdipSetStringFormatTabStops
GdipSetStringFormatFlags
GdipCreateFromHWND
GdipCreatePath
GdipDeletePath
GdipAddPathLine2I
GdipCreateMatrix2
GdipDeleteMatrix
GdipCreateMatrix
GdipScaleMatrix
GdipTransformPath
GdipGetPathWorldBounds
GdipTranslateMatrix
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdiplusShutdown
GdiplusStartup
GdipSetInterpolationMode
GdipDrawImageRectRectI
GdipResetClip
GdipDeletePen
GdipCreatePen1
GdipMeasureString
GdipDrawImageRectI
GdipDrawString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipCreateStringFormat
GdipAddPathEllipse
GdipCreatePen2
GdipSetLineWrapMode
GdipSetClipRect
GdipAddPathRectangle
GdipDrawEllipse
GdipFillEllipse
GdipCreateFontFromLogfontW
GdipSetStringFormatHotkeyPrefix
GdipSetPathGradientFocusScales
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterPoint
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipClosePathFigure
GdipAddPathLine
ord1
GdipCreateLineBrushFromRect
GdipCombineRegionRect
GdipDeleteRegion
GdipCreateRegionPath
GdipSetTextRenderingHint
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipClonePath
GdipAddPathArcI
GdipCreateBitmapFromHBITMAP
GdipGetLogFontW
GdipImageGetFrameCount
GdipDrawLine
GdipCreateLineBrushFromRectI
GdipReleaseDC
GdipGetDC
GdipCreateHICONFromBitmap
GdipCreateBitmapFromFile
GdipDrawRectangleI
GdipFillRectangleI
GdipGetFontSize
GdipGetFontStyle
GdipGetFontUnit
GdipCreateFont
GdipGetFamily
GdipDeleteFontFamily
GdipDrawImage
GdipGraphicsClear
GdipDeleteFont
GdipLoadImageFromFile
GdipGetFontHeight
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCloneImage
GdipDisposeImage
GdipDrawRectangle
GdipFillPath
GdipDrawPath
GdipAddPathPath
GdipAddPathLineI
GdipAddPathPolygonI
GdipFillRectangle
GdipCloneBrush
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRect
GdipDeleteGraphics
GdipCreateFromHDC
GdipImageSelectActiveFrame

oledlg

OleUIBusyW

psapi

GetProcessMemoryInfo

crypt32

CertGetNameStringW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

msimg32

TransparentBlt
AlphaBlend

wintrust

WTHelperProvDataFromStateData
CryptCATAdminEnumCatalogFromHash
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
WinVerifyTrust

litezip

ZipAddBufferW
ZipAddFileW
ZipClose
ZipCreateFileW

sbte

SBCSGetDefVersionW
SBCSResetScanOptions
SBCSSetScanProgressStateCallback
SBCSSetScanProgressDetailCallbackW
SBCSSetScanOption
SBCSRunScanner
SBCSGetScannerResultsSizeW
SBCSGetScannerResultsW
SBCSRunCleanerW
SBCSGetCleanerResultsSizeW
SBCSGetCleanerResultsW
SBCSCloseThreatEngine
SBCSOpenThreatEngineW
SBCSGetDefReleaseDateW

spursdownload

ThreatUpdate

7zipdll

GetNumberOfFormats
GetHandlerProperty2
GetNumberOfMethodsDLL
GetMethodProperty
SetLargePageMode
CreateObject

msi

ord217
ord173

ws2_32

connect
getprotobyname
setsockopt
getsockopt
bind
getsockname
ioctlsocket
send
ntohs
select
__WSAFDIsSet
inet_addr
socket
gethostname
htons
inet_ntoa
recv
WSAResetEvent
WSAEnumNetworkEvents
WSAConnect
WSAGetLastError
WSASocketW
WSACloseEvent
closesocket
WSACleanup
WSAStartup
GetAddrInfoW
FreeAddrInfoW
WSASetLastError
WSASetEvent
WSAEventSelect
accept
listen
sendto
WSACreateEvent
recvfrom
WSASend
WSAGetOverlappedResult
WSARecv
shutdown
gethostbyname

setupapi

SetupDiGetClassDescriptionW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupFindNextMatchLineW
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
SetupFindNextLine
SetupEnumInfSectionsW
SetupDiGetDeviceInstanceIdW
SetupGetLineTextW

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 799KB - Virtual size: 799KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 98KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 271KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 331KB - Virtual size: 330KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36497f76d1952a84f22a9a98cbc79c22

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

2e:d7:e7:ed:fe:8b:4e:9d:fd:b0:98:34:85:50:e6:b0Certificate

Extended Key Usages

Key Usages

32:94:dc:f9:11:9d:10:53:7c:8c:e9:a0:dc:0a:b2:dc:6d:4c:73:25Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winmm

rpcrt4

wininet

shfolder

shell32

ole32

shlwapi

gdi32

comctl32

user32

kernel32

comdlg32

winspool.drv

advapi32

oleaut32

gdiplus

oledlg

psapi

crypt32

version

oleacc

imm32

iphlpapi

msimg32

wintrust

litezip

sbte

spursdownload

7zipdll

msi

ws2_32

setupapi

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 799KB - Virtual size: 799KB

.data Size: 98KB - Virtual size: 147KB

.rsrc Size: 271KB - Virtual size: 270KB

.reloc Size: 331KB - Virtual size: 330KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

2e:d7:e7:ed:fe:8b:4e:9d:fd:b0:98:34:85:50:e6:b0
Certificate

32:94:dc:f9:11:9d:10:53:7c:8c:e9:a0:dc:0a:b2:dc:6d:4c:73:25
Signer

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 799KB - Virtual size: 799KB

.data
Size: 98KB - Virtual size: 147KB

.rsrc
Size: 271KB - Virtual size: 270KB

.reloc
Size: 331KB - Virtual size: 330KB