12029[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

12029.exe
Size

3.3MB
MD5

de1eea564341f54778fad64cfe63cba0
SHA1

6e75f5dfe0991877df85a6a993059fef47a1ab46
SHA256

7024a42f9603f626380fb0f26105ee53a1562d3dd94a5907b7d64ce7194745e9
SHA512

fbca78b60cd39b32dedc528048dd80c25de62016303814df5b400da8284cbe725b5e898fa5382dbab15cb3dbab42a190b8541290578228369744b3fa438e769d
SSDEEP

98304:mi++qX8iuivYw7Kx0tJI7dKeZICH0dTzdD:9cNuyYw7RtJI7ZZhH4x

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
12029.exe
unpack001/$PLUGINSDIR/Checker.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/Zip.dll
unpack001/uninst.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

Files

12029.exe
.exe windows:4 windows x86 arch:x86

671f2a1f8aee14d336bab98fea93d734

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyExA
RegCreateKeyExA

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteExA

ole32

OleUninitialize
OleInitialize
IIDFromString
CoCreateInstance
CoTaskMemFree

comctl32

ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create

user32

SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcA
GetMessagePos
CheckDlgButton
LoadCursorA
SetCursor
GetSysColor
SetWindowPos
GetWindowLongA
IsWindowEnabled
SetClassLongA
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetDlgItemTextA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
MessageBoxIndirectA
CharPrevA
PeekMessageA
GetClassInfoA
DispatchMessageA
TrackPopupMenu

gdi32

GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor

kernel32

CreateFileA
GetTempFileNameA
ReadFile
RemoveDirectoryA
CreateProcessA
CreateDirectoryA
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceA
lstrcpynA
SetErrorMode
GetVersionExA
lstrlenA
GetCommandLineA
GetTempPathA
GetWindowsDirectoryA
WriteFile
ExitProcess
CopyFileA
GetCurrentProcess
GetModuleFileNameA
GetFileSize
GetTickCount
Sleep
SetFileAttributesA
GetFileAttributesA
SetCurrentDirectoryA
MoveFileA
GetFullPathNameA
GetShortPathNameA
SearchPathA
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
GetModuleHandleA
LoadLibraryExA
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
lstrcpyA
MoveFileExA
lstrcatA
WideCharToMultiByte
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
SetEnvironmentVariableA

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Checker.dll
.dll windows:5 windows x86 arch:x86

bfceb0f183878f4518365886b7d71401

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GlobalFree
lstrlenA
GlobalAlloc
lstrcpynA
lstrcmpiA
GetModuleHandleA
LoadLibraryA
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
GetCurrentThreadId
DecodePointer
GetCommandLineA
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
HeapAlloc
RaiseException
LCMapStringW
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
HeapSize
WriteFile
GetModuleFileNameW
RtlUnwind
HeapReAlloc
IsProcessorFeaturePresent

user32

wsprintfA

Exports

Exports

Crc32
ProcExists
Slt

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

9a079f888d926e801862cbd30cf63229

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GlobalUnlock
GetPrivateProfileIntA
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalLock
GlobalAlloc

user32

PtInRect
MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
LoadCursorA
GetClientRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
GetSysColor
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
OpenClipboard

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

240ca92ecc1c291801c451c447e16c12

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 654B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Zip.dll
.dll windows:5 windows x86 arch:x86

f0c197e0535d3d99e3ef50015c863f9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
CreateFileA
ReadFile
CloseHandle
lstrcpyA
GlobalFree
GlobalAlloc
lstrcpynA
VirtualAlloc
GetFileSizeEx
DosDateTimeToFileTime
GetCurrentDirectoryA
LocalFileTimeToFileTime
WriteFile
LoadLibraryW
RtlUnwind
GetLastError
HeapFree
HeapAlloc
EncodePointer
DecodePointer
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetProcAddress
RaiseException
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
ExitProcess
GetStdHandle
GetModuleFileNameW
Sleep
HeapSize
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringW
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc

user32

wsprintfA

shlwapi

ord12

Exports

Exports

Un
UnzipAndInstall

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$R1
SumatraPDF.exe
.exe windows:5 windows x86 arch:x86

88ba4820f2d988b7dd9d9a4e95060122

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c5:47:16:b6:73:13:b3:03:5e:03:d1:e7:8d:30:88:63
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/04/2012, 00:00

Not After

13/04/2015, 23:59

Subject

CN=Krzysztof Kowalczyk,O=Krzysztof Kowalczyk,POSTALCODE=94110,STREET=\#202+STREET=3388 17th St,L=San Francisco,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b9:25:21:06:fe:1f:8a:7a:f6:3a:67:ae:6a:86:b2:1d:b8:c6:95:82
Signer

Actual PE Digest

b9:25:21:06:fe:1f:8a:7a:f6:3a:67:ae:6a:86:b2:1d:b8:c6:95:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\kkowalczyk\src\sumatrapdf30\obj-rel\SumatraPDF.pdb

Imports

advapi32

RegCloseKey
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
RegOpenKeyExW
RegEnumKeyW

kernel32

SetUnhandledExceptionFilter
GetCurrentProcess
HeapFree
GetVersionExW
HeapDestroy
HeapCreate
TerminateProcess
GetEnvironmentVariableA
GlobalMemoryStatusEx
Module32FirstW
GetSystemInfo
CreateToolhelp32Snapshot
GetCurrentThreadId
OutputDebugStringA
Module32NextW
GetLogicalDrives
GetUserDefaultUILanguage
AllocConsole
CreateProcessW
VerSetConditionMask
SetConsoleScreenBufferSize
FormatMessageA
LoadLibraryW
GetModuleFileNameW
VerifyVersionInfoW
GetStdHandle
GetConsoleScreenBufferInfo
lstrcpyW
GetTempFileNameW
GetDriveTypeW
CreateDirectoryW
WriteFile
GetVolumePathNameW
ReadFile
CreateFileW
WritePrivateProfileStringW
GetTempPathW
GetPrivateProfileIntW
GetFileSizeEx
GetLongPathNameW
GetFileTime
GetFileAttributesExW
GetShortPathNameW
DeleteFileW
GetFileInformationByHandle
RaiseException
CompareFileTime
ReadDirectoryChangesW
WaitForMultipleObjectsEx
QueueUserAPC
CancelIo
WideCharToMultiByte
MultiByteToWideChar
GetThreadContext
VirtualQuery
GetCurrentThread
Thread32First
Thread32Next
OpenThread
GetModuleHandleA
SuspendThread
ResumeThread
GetEnvironmentVariableW
GetExitCodeProcess
TryEnterCriticalSection
GetACP
SetFilePointer
lstrcpynW
CompareStringW
WriteConsoleW
GetTimeZoneInformation
CreateProcessA
GetProcessHeap
SetEndOfFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryW
CreateFileA
PeekNamedPipe
LCMapStringW
SetHandleCount
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetCPInfo
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapSize
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetFileType
InitializeCriticalSectionAndSpinCount
SetStdHandle
FindFirstFileExW
SetConsoleCtrlHandler
GetStartupInfoW
HeapSetInformation
GetCommandLineA
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
DuplicateHandle
RtlUnwind
FileTimeToLocalFileTime
FileTimeToSystemTime
MoveFileA
DecodePointer
EncodePointer
GetFullPathNameW
ExitProcess
GetCommandLineW
MapViewOfFile
UnmapViewOfFile
SetErrorMode
MoveFileExW
QueryPerformanceCounter
GetModuleHandleW
GetSystemTimeAsFileTime
Sleep
FileTimeToDosDateTime
CopyFileW
FormatMessageW
GetFileAttributesW
MulDiv
GetLastError
CreateFileMappingW
QueryPerformanceFrequency
CloseHandle
GetCurrentProcessId
LocalFree
SetFileAttributesW
EnterCriticalSection
CreateEventA
InitializeCriticalSection
InterlockedExchange
WaitForSingleObject
LeaveCriticalSection
ResetEvent
SetEvent
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
GetModuleFileNameA
GetTickCount
GetFullPathNameA
GetFileAttributesA
FindClose
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
DeleteCriticalSection
CreateThread
GetSystemDirectoryW
GetWindowsDirectoryW
GlobalDeleteAtom
GlobalAddAtomW
FindFirstFileW
FindNextFileW
GetProcAddress
GetDateFormatW
GetLocaleInfoW
GetTimeFormatW
CreateEventW
SystemTimeToFileTime
SetThreadExecutionState
GetSystemTime
FindResourceW
LoadResource
SizeofResource
LockResource
HeapReAlloc
GetLocaleInfoA
HeapAlloc

user32

IsDlgButtonChecked
CheckRadioButton
SetDlgItemTextW
EnableWindow
GetWindow
IsCharAlphaNumericW
GetUpdateRect
ValidateRect
CloseClipboard
EmptyClipboard
OpenClipboard
GetSystemMenu
GetWindowDC
TrackMouseEvent
InvalidateRgn
DrawEdge
GetMenuItemInfoW
OffsetRect
ReleaseDC
GetMenuItemCount
SetMenuDefaultItem
DrawFrameControl
RedrawWindow
GetMessagePos
GetWindowTextLengthW
ShowWindowAsync
ReuseDDElParam
SetForegroundWindow
MessageBeep
IsWindowUnicode
UnpackDDElParam
HideCaret
LoadImageW
ShowCaret
SetClassLongW
CallWindowProcW
PostMessageW
SetActiveWindow
DrawTextW
CopyImage
TrackPopupMenu
GetMenuItemID
CreateMenu
ModifyMenuW
GetMenu
CheckMenuRadioItem
AppendMenuW
EnableMenuItem
CreatePopupMenu
GetPropW
SetLayeredWindowAttributes
ClientToScreen
DdeInitializeW
EnumDisplayMonitors
DdeCreateStringHandleW
GetWindowInfo
DdeFreeStringHandle
CheckDlgButton
RemoveMenu
DispatchMessageW
MoveWindow
GetWindowThreadProcessId
DefWindowProcW
GetScrollPos
SetScrollInfo
EndDeferWindowPos
DestroyMenu
UpdateWindow
SendMessageW
AllowSetForegroundWindow
IsWindowVisible
GetSystemMetrics
BeginDeferWindowPos
ReleaseCapture
MessageBoxW
DeferWindowPos
GetCursor
CreateWindowExW
ShowScrollBar
FindWindowExW
IsWindow
LoadBitmapW
SetMenu
ShowWindow
SetWindowPos
GetSysColor
SetWindowLongW
SystemParametersInfoW
GetAncestor
GetWindowLongW
InvalidateRect
GetScrollInfo
LoadIconW
RegisterClassExW
GetForegroundWindow
LoadAcceleratorsW
TranslateMessage
GetCapture
CharLowerW
IsCharUpperW
BeginPaint
SetFocus
GetClientRect
FindWindowW
SetParent
LoadCursorW
GetParent
GetFocus
GetKeyState
IsZoomed
KillTimer
SetCapture
FillRect
IsIconic
PostQuitMessage
GetMessageW
SendDlgItemMessageW
EndDialog
GetDlgItem
DialogBoxParamW
DialogBoxIndirectParamW
wsprintfA
GetDC
MonitorFromRect
DdeFreeDataHandle
RemovePropW
DdeUninitialize
MonitorFromWindow
GetDesktopWindow
GetCursorPos
AdjustWindowRectEx
DdeClientTransaction
DdeConnect
SetClipboardData
SetMenuItemInfoW
DdeDisconnect
SetPropW
GetWindowRect
ScreenToClient
SetTimer
MapVirtualKeyW
TranslateAcceleratorW
SetCursor
DestroyWindow
EndPaint
CheckMenuItem
MapWindowPoints
InsertMenuW
GetMonitorInfoW

gdi32

PatBlt
SetBrushOrgEx
CreateBitmap
CreatePatternBrush
SetROP2
ExtTextOutW
MoveToEx
SetGraphicsMode
LineTo
CreateDIBSection
GetDIBits
SetDIBColorTable
CreateCompatibleBitmap
SetDIBits
GetDIBColorTable
GetObjectW
CreateFontIndirectW
SetBkColor
SetWorldTransform
IntersectClipRect
GetObjectA
BitBlt
SetViewportOrgEx
ExcludeClipRect
CreateRectRgn
GetClipBox
ExtSelectClipRgn
SetLayout
GetTextExtentPoint32W
SetBkMode
SelectClipRgn
CreateRoundRectRgn
RoundRect
TextOutW
EndPage
StartPage
GetDeviceCaps
CreateDCW
SetMapMode
SetStretchBltMode
StartDocW
EndDoc
AbortDoc
SetTextColor
DeleteDC
StretchBlt
DeleteObject
SelectObject
CreateCompatibleDC
Rectangle
CreatePen
GetStockObject
CreateSolidBrush

comdlg32

CommDlgExtendedError
PrintDlgExW
GetSaveFileNameW
GetOpenFileNameW

shell32

SHBindToParent
SHGetFolderPathW
ShellExecuteExW
SHGetDesktopFolder
DragFinish
DragQueryFileW
DragAcceptFiles
SHGetFileInfoW
SHAddToRecentDocs
SHChangeNotify

gdiplus

GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCreateBitmapFromGraphics
GdipDrawRectangleI
GdipAddPathLine
GdipGetImageHorizontalResolution
GdipDrawImageRectRect
GdipDrawRectangle
GdipDrawLine
GdipGetFamilyName
GdipSetPenDashArray
GdipSetWorldTransform
GdipGetFamily
GdipTransformMatrixPoints
GdipInvertMatrix
GdipSetPenDashOffset
GdipSetImageAttributesWrapMode
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipGetFontCollectionFamilyList
GdipSetImageAttributesColorMatrix
GdipGetEmHeight
GdipAddPathPath
GdipFillPolygon
GdipPrivateAddFontFile
GdipSetClipRect
GdipDrawImagePointsRect
GdipSetPageScale
GdipGetDpiY
GdipGetFontCollectionFamilyCount
GdipGetMatrixElements
GdipTransformRegion
GdipGraphicsClear
GdipCreateRegionRectI
GdipSetPenLineCap197819
GdipDeleteFontFamily
GdipIsStyleAvailable
GdipSaveGraphics
GdipCreateMatrix2
GdipSetImagePalette
GdipNewPrivateFontCollection
GdipGetWorldTransform
GdipDeletePrivateFontCollection
GdipSetPenTransform
GdipGetCellAscent
GdipGetLogFontW
GdipCloneFontFamily
GdipSetPixelOffsetMode
GdipSetPenLineJoin
GdipGetClipBounds
GdiplusShutdown
GdiplusStartup
GdipFree
GdipGetImageHeight
GdipAlloc
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipSaveImageToFile
GdipCloneImage
GdipGetImageWidth
GdipRotateMatrix
GdipSetStringFormatMeasurableCharacterRanges
GdipGetImageEncodersSize
GdipTranslateMatrix
GdipBitmapUnlockBits
GdipGetRegionBounds
GdipBitmapSetResolution
GdipCreateBitmapFromStream
GdipMeasureString
GdipGetStringFormatFlags
GdipScaleMatrix
GdipCloneBitmapAreaI
GdipFillEllipseI
GdipCreateLineBrushFromRect
GdipDeleteMatrix
GdipFillRectangle
GdipClonePath
GdipTransformPath
GdipGetPathWorldBoundsI
GdipSetPenMiterLimit
GdipSetPenMode
GdipCreateMatrix
GdipCreateStringFormat
GdipMeasureCharacterRanges
GdipDrawImageI
GdipCreateBitmapFromGdiDib
GdipSetPropertyItem
GdipReleaseDC
GdipWidenPath
GdipGetDC
GdipDeleteBrush
GdipDeletePen
GdipCreateRegion
GdipSetClipRectI
GdipGetClip
GdipSetClipRegion
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDrawImageRectRectI
GdipCreateFontFromDC
GdipCreateFromHWND
GdipDeleteStringFormat
GdipSetStringFormatTrimming
GdipGetPathData
GdipSetCompositingQuality
GdipSetSolidFillColor
GdipTranslateWorldTransform
GdipSetCompositingMode
GdipCloneStringFormat
GdipBitmapLockBits
GdipStringFormatGetGenericTypographic
GdipRestoreGraphics
GdipGetImageEncoders
GdipDrawString
GdipTransformPointsI
GdipDeleteRegion
GdipSetPageUnit
GdipResetWorldTransform
GdipCreateRegionPath
GdipSetPenWidth
GdipSetPenColor
GdipDeletePathIter
GdipPathIterNextMarkerPath
GdipAddPathArcI
GdipCreatePen2
GdipCreatePathIter
GdipAddPathLineI
GdipClosePathFigure
GdipSetSmoothingMode
GdipAddPathEllipseI
GdipDeleteFont
GdipSetTextRenderingHint
GdipSetPathMarker
GdipIsVisiblePathPointI
GdipStartPathFigure
GdipSetStringFormatLineAlign
GdipStringFormatGetGenericDefault
GdipCreatePath2
GdipGetRegionHRgn
GdipPathIterRewind
GdipCreateFontFromLogfontA
GdipIsVisibleRectI
GdipGetPointCount
GdipSetStringFormatFlags
GdipCreatePath
GdipFillPath
GdipDeletePath
GdipDrawPath
GdipWindingModeOutline
GdipAddPathRectangleI
GdipCreatePen1
GdipDrawLineI
GdipFillRectangleI
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteGraphics
GdipCloneBrush
GdipGetFontHeight

ole32

CoCreateInstance
ReleaseStgMedium
CoGetMalloc
CoTaskMemFree
CoInitialize
CreateStreamOnHGlobal
CoUninitialize
CoTaskMemAlloc
OleInitialize

comctl32

ord412
ord410
ord413
InitCommonControlsEx
CreatePropertySheetPageW
ImageList_Create
ImageList_AddMasked
ImageList_GetIconSize
ImageList_Draw
ImageList_Destroy

msimg32

GradientFill

winspool.drv

OpenPrinterW
DocumentPropertiesW
GetPrinterW
ClosePrinter
DeviceCapabilitiesW
ord203

wininet

HttpSendRequestA
HttpOpenRequestW
HttpQueryInfoW
InternetSetOptionW
InternetConnectW
InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCloseHandle

urlmon

CoInternetGetSession

oleaut32

SysAllocString
SafeArrayCreateVector
SafeArrayPutElement
VariantInit
VariantClear
SysFreeString

shlwapi

ord219
PathIsRelativeW
StrStrW
StrRStrIW
StrStrIW
SHGetValueW
SHDeleteKeyW
PathAppendW
SHSetValueW
PathIsNetworkPathW
SHDeleteValueW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 159KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninst.exe
.exe windows:4 windows x86 arch:x86

671f2a1f8aee14d336bab98fea93d734

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyExA
RegCreateKeyExA

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteExA

ole32

OleUninitialize
OleInitialize
IIDFromString
CoCreateInstance
CoTaskMemFree

comctl32

ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create

user32

SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcA
GetMessagePos
CheckDlgButton
LoadCursorA
SetCursor
GetSysColor
SetWindowPos
GetWindowLongA
IsWindowEnabled
SetClassLongA
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetDlgItemTextA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
MessageBoxIndirectA
CharPrevA
PeekMessageA
GetClassInfoA
DispatchMessageA
TrackPopupMenu

gdi32

GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor

kernel32

CreateFileA
GetTempFileNameA
ReadFile
RemoveDirectoryA
CreateProcessA
CreateDirectoryA
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceA
lstrcpynA
SetErrorMode
GetVersionExA
lstrlenA
GetCommandLineA
GetTempPathA
GetWindowsDirectoryA
WriteFile
ExitProcess
CopyFileA
GetCurrentProcess
GetModuleFileNameA
GetFileSize
GetTickCount
Sleep
SetFileAttributesA
GetFileAttributesA
SetCurrentDirectoryA
MoveFileA
GetFullPathNameA
GetShortPathNameA
SearchPathA
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
GetModuleHandleA
LoadLibraryExA
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
lstrcpyA
MoveFileExA
lstrcatA
WideCharToMultiByte
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
SetEnvironmentVariableA

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

671f2a1f8aee14d336bab98fea93d734

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 105KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 6KB - Virtual size: 6KB

bfceb0f183878f4518365886b7d71401

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 20KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 4KB - Virtual size: 4KB

9a079f888d926e801862cbd30cf63229

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

240ca92ecc1c291801c451c447e16c12

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 104B

.reloc Size: 1024B - Virtual size: 654B

f0c197e0535d3d99e3ef50015c863f9a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 105KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 6KB - Virtual size: 6KB

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 1024B - Virtual size: 654B

.text
Size: 47KB - Virtual size: 47KB

.rdata
Size: 18KB - Virtual size: 18KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 5KB - Virtual size: 5KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

c5:47:16:b6:73:13:b3:03:5e:03:d1:e7:8d:30:88:63
Certificate

b9:25:21:06:fe:1f:8a:7a:f6:3a:67:ae:6a:86:b2:1d:b8:c6:95:82
Signer

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 3.2MB - Virtual size: 3.2MB

.data
Size: 159KB - Virtual size: 216KB

.rsrc
Size: 140KB - Virtual size: 139KB

.reloc
Size: 135KB - Virtual size: 134KB

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 105KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 6KB - Virtual size: 6KB