2024-02-04_f696bd9c8af14a59c0a71d31febc3849_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-04_f696bd9c8af14a59c0a71d31febc3849_ryuk
Size

16.5MB
MD5

f696bd9c8af14a59c0a71d31febc3849
SHA1

2599a825efd8189f0202d8f5df2ce17ed7294674
SHA256

f421db96f8bcaaee840d89625fe870b3228bdb28f2115d0a4ba0e05ec7ccaded
SHA512

62b8f86cb1dcd635b193d0dd193941fe5e2a11761b67c90317db1ffbbf513c60504482d5beb7174e6de270a008db8c548b8062a99add169844210ca01e2407b0
SSDEEP

393216:aloW1qQom7Oy+fL9lO5tgHAjk62QMb1hYuInmm9pA:amOA62V3xS9pA

Score

1^/10

Malware Config

Signatures

Files

2024-02-04_f696bd9c8af14a59c0a71d31febc3849_ryuk
.exe windows:6 windows x64 arch:x64

fa8e9724f2b3ea86cf466e597fe4d928

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:84:a5:71:22:7a:38:d1:eb:58:99:b8:69:32:94:54
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

24/01/2023, 00:00

Not After

05/03/2025, 23:59

Subject

CN=O&O Software GmbH,O=O&O Software GmbH,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:84:a5:71:22:7a:38:d1:eb:58:99:b8:69:32:94:54
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

24/01/2023, 00:00

Not After

05/03/2025, 23:59

Subject

CN=O&O Software GmbH,O=O&O Software GmbH,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24/12/1999, 17:50

Not After

24/07/2029, 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22/07/2015, 19:02

Not After

22/06/2029, 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

19/01/2024, 16:46

Not After

01/06/2029, 00:00

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:58:6d:6d:95:2c:20:0a:f7:7c:11:84:73:5e:16:0f:8c:2e:a4:c6:29:42:09:e1:64:74:36:65:37:6a:4b:e3
Signer

Actual PE Digest

43:58:6d:6d:95:2c:20:0a:f7:7c:11:84:73:5e:16:0f:8c:2e:a4:c6:29:42:09:e1:64:74:36:65:37:6a:4b:e3

Digest Algorithm

sha256

PE Digest Matches

true

53:ee:00:7c:77:5f:25:a7:bd:b5:e4:81:02:c0:91:69:71:56:53:7d
Signer

Actual PE Digest

53:ee:00:7c:77:5f:25:a7:bd:b5:e4:81:02:c0:91:69:71:56:53:7d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\jenkins-slave\workspace\oodi\18\OO\OODI-BIN\src\applications\mainapp\app\v140\x64\ThinClient Release\oodic.pdb

Imports

kernel32

GetModuleFileNameW
CopyFileExW
PulseEvent
GetProcAddress
SetEnvironmentVariableW
FindNextFileW
FindFirstFileW
SetEvent
ResetEvent
MapViewOfFile
CreateFileMappingW
GetVersionExW
WaitForSingleObject
WriteFile
HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
ReadConsoleA
SetConsoleMode
ConvertFiberToThread
DeleteFiber
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetConsoleCtrlHandler
SetFilePointerEx
ReadConsoleW
GetConsoleMode
SetFilePointer
SetEnvironmentVariableA
GetOEMCP
IsValidCodePage
EnumSystemLocalesW
CreateProcessW
PeekNamedPipe
GetStdHandle
QueryPerformanceFrequency
VirtualQuery
VirtualAlloc
HeapQueryInformation
HeapDestroy
SetStdHandle
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
GetACP
InterlockedFlushSList
InterlockedPushEntrySList
ExpandEnvironmentStringsA
LoadLibraryExA
TerminateThread
ExitThread
WriteProcessMemory
GetSystemTime
GetSystemInfo
OpenMutexW
GetComputerNameW
FindFirstFileExW
GetEnvironmentVariableW
LCMapStringW
GetCPInfo
GetStringTypeW
ExitProcess
GetUserDefaultLangID
GetPrivateProfileSectionNamesW
LoadLibraryA
EnumResourceLanguagesW
EnumResourceTypesW
EnumResourceNamesW
lstrcpynW
CreateThread
lstrlenW
CreateDirectoryW
GetTimeFormatW
GetDateFormatW
GetModuleHandleA
OutputDebugStringW
GetTimeZoneInformation
K32GetModuleFileNameExW
IsValidLocale
GetCurrentProcess
WaitForMultipleObjects
GetCurrentProcessId
UnmapViewOfFile
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
DeleteCriticalSection
SizeofResource
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetShortPathNameW
GetFileSize
FlushFileBuffers
DeleteFileW
lstrcmpA
GlobalGetAtomNameW
SuspendThread
SetThreadPriority
InitializeCriticalSection
LeaveCriticalSection
MultiByteToWideChar
FreeLibrary
LoadLibraryW
GetWindowsDirectoryW
CreateEventW
GetOverlappedResult
GetProcessHeap
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
GetDriveTypeW
GetComputerNameExW
GetLocaleInfoW
GetNumberFormatW
GetFullPathNameW
GetTempFileNameW
FormatMessageW
LocalFree
GetTickCount
WideCharToMultiByte
GetFileAttributesW
GetExitCodeProcess
HeapCreate
GetModuleHandleW
GetCurrentThreadId
TryEnterCriticalSection
CopyFileW
FileTimeToLocalFileTime
FindClose
GetLocalTime
LocalAlloc
LocalLock
LocalUnlock
GlobalSize
GlobalFree
SetLastError
OutputDebugStringA
EncodePointer
GetSystemDirectoryW
FreeResource
GetModuleHandleExW
LoadLibraryExW
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomW
GlobalFindAtomW
CreateActCtxW
ActivateActCtx
UnlockFile
DuplicateHandle
lstrcmpiW
MoveFileW
GetStringTypeExW
GetThreadLocale
GetCurrentThread
CompareStringA
ReleaseSemaphore
ReleaseMutex
AllocConsole
FormatMessageA
DeactivateActCtx
InitOnceExecuteOnce
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableSRW
OpenThread
RtlCaptureStackBackTrace
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
CreateFileA
ConnectNamedPipe
CancelIo
CreateNamedPipeA
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
VirtualFree
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
FindActCtxSectionStringW
CreateMutexW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetDiskFreeSpaceW
GetFileTime
SetFileTime
ReplaceFileW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
SearchPathW
GetProfileIntW
GetTempPathW
VerifyVersionInfoW
VerSetConditionMask
GetCurrentDirectoryW
SetErrorMode
SetFileAttributesW
LocalFileTimeToFileTime
GetFileSizeEx
lstrcpyW
FindResourceExW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
CompareStringW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetUserDefaultLCID
GetFileType
SystemTimeToFileTime
ReadDirectoryChangesW
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
VirtualProtect
GetConsoleCP
FileTimeToSystemTime
CloseHandle
DeviceIoControl
CreateFileW
GetExitCodeThread
ResumeThread
ExpandEnvironmentStringsW
Sleep
GetLastError
FindResourceW
LoadResource
LockResource
QueryActCtxW

user32

LoadBitmapW
DestroyIcon
PtInRect
GetDesktopWindow
SetRect
IsWindow
ReleaseDC
GetDC
RedrawWindow
GetActiveWindow
IsWindowVisible
IsDialogMessageW
SendDlgItemMessageW
CloseWindow
InvalidateRect
GetWindowRect
CopyRect
OffsetRect
SendMessageW
PostMessageW
GetParent
EnableWindow
IsDlgButtonChecked
CheckRadioButton
SetDlgItemTextW
SetDlgItemInt
ShowWindow
SetWindowRgn
SetCapture
SetMenuItemInfoW
DrawStateW
SetMenuItemBitmaps
MapVirtualKeyW
GetMessageW
BringWindowToTop
TranslateAcceleratorW
CreatePopupMenu
DestroyMenu
InsertMenuItemW
LoadImageW
UnpackDDElParam
CheckMenuItem
ClientToScreen
SendDlgItemMessageA
MapDialogRect
CreateMenu
LoadMenuW
SetMenuDefaultItem
RegisterClassExW
MonitorFromPoint
UpdateLayeredWindow
LockWindowUpdate
GetDCEx
IsZoomed
DrawEdge
RemoveMenu
UnregisterClassW
GetClassNameW
GetKeyboardLayoutNameW
ShowScrollBar
GetClientRect
EqualRect
GetAsyncKeyState
CopyIcon
FillRect
CreateIconIndirect
SetCursor
GetCapture
ReleaseCapture
LoadCursorW
GetKeyNameTextW
GetMenuCheckMarkDimensions
CreateDialogIndirectParamW
GetSubMenu
GetMenuItemCount
PostThreadMessageW
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
GetUpdateRect
DrawMenuBar
GetSystemMenu
EnableMenuItem
GetForegroundWindow
InflateRect
GetFocus
RegisterWindowMessageW
PostQuitMessage
GetComboBoxInfo
CopyAcceleratorTableW
LoadAcceleratorsW
MonitorFromWindow
SetForegroundWindow
GetLastActivePopup
FlashWindowEx
GetWindowThreadProcessId
GetSystemMetrics
SystemParametersInfoW
MonitorFromRect
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
ReuseDDElParam
WindowFromPoint
CharUpperW
ShowOwnedPopups
GetMenuItemInfoW
SetCursorPos
SubtractRect
GetWindowRgn
DestroyCursor
CreateAcceleratorTableW
DestroyAcceleratorTable
GetCursorPos
WaitMessage
IsClipboardFormatAvailable
GetSysColorBrush
CopyImage
RealChildWindowFromPoint
TrackMouseEvent
DeleteMenu
SetParent
GetMenuDefaultItem
GetNextDlgGroupItem
GetIconInfo
InvertRect
WinHelpW
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetTopWindow
GetClassLongPtrW
MapWindowPoints
MessageBoxW
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
CreateIconFromResourceEx
wsprintfW
OpenInputDesktop
CloseDesktop
GetUserObjectInformationW
GetKeyboardLayoutList
GetCursor
IsWindowUnicode
GetWindowLongPtrA
SetWindowLongPtrA
TabbedTextOutW
GrayStringW
DrawTextExW
GetMonitorInfoW
IsRectEmpty
GetMenuItemID
InsertMenuW
KillTimer
SetTimer
GetDlgCtrlID
UpdateWindow
GetWindowLongPtrW
GetSysColor
GetWindowDC
IsWindowEnabled
FrameRect
ShowCaret
HideCaret
CloseClipboard
GetClipboardData
OpenClipboard
SetClipboardData
EmptyClipboard
GetKeyState
MessageBeep
GetWindowLongW
DrawIconEx
UnionRect
DrawAnimatedRects
FindWindowW
EnumChildWindows
GetMessagePos
ScreenToClient
DrawFocusRect
mouse_event
GetDialogBaseUnits
DestroyWindow
PeekMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
EnumWindows
GetWindowTextW
SetRectEmpty
GetClassInfoW
DefWindowProcW
IntersectRect
BeginDeferWindowPos
EndDeferWindowPos
MoveWindow
GetNextDlgTabItem
DrawFrameControl
GetWindow
AppendMenuW
IsChild
SendNotifyMessageW
DrawTextW
EnableScrollBar
SetFocus
SetWindowLongW
SetWindowPos
SetClassLongPtrW
EnumDisplayMonitors
SetLayeredWindowAttributes
NotifyWinEvent
GetTabbedTextExtentW
LoadIconW
IsIconic
DrawIcon
DialogBoxIndirectParamW
SetWindowLongPtrW
GetDlgItem
CheckDlgButton
BeginPaint
EndPaint
EndDialog
SetWindowTextW
GetMenuStringW
GetMenuState
GetMessageTime
CallWindowProcW
RegisterClassW
GetClassInfoExW
CreateWindowExW
IsMenu
GetWindowPlacement
SetWindowPlacement
DeferWindowPos
GetMenu
SetMenu
TrackPopupMenu
SetActiveWindow
ValidateRect
InvalidateRgn
SetWindowContextHelpId
GetProcessWindowStation
CharNextW
ExitWindowsEx
LoadStringW
SendMessageTimeoutW
GetTabbedTextExtentA
GetClipboardFormatNameW
LookupIconIdFromDirectoryEx
GetClassLongW

gdi32

GetTextAlign
GetStretchBltMode
GetPolyFillMode
GetNearestColor
GetBkMode
GetROP2
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
OffsetRgn
GetRgnBox
CreateRoundRectRgn
Polyline
Polygon
CreatePolygonRgn
SetDIBColorTable
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
SetAbortProc
AbortDoc
EndPage
StartPage
EndDoc
StretchDIBits
CreateFontW
EnumFontFamiliesExW
GetCharWidthW
LPtoDP
Ellipse
CreateEllipticRgn
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
PolyBezierTo
TextOutW
ExtCreatePen
StartDocW
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetObjectType
EqualRgn
GetCurrentPositionEx
GetClipRgn
GetClipBox
ExcludeClipRect
Escape
CreateHatchBrush
DPtoLP
SetRectRgn
PatBlt
GetMapMode
CreateRectRgnIndirect
CreateRectRgn
CreatePatternBrush
CombineRgn
CopyMetaFileW
GetBitmapDimensionEx
ExtTextOutW
SetTextColor
GetTextMetricsW
SetBkColor
SetPixel
GetTextExtentPointW
FloodFill
GetCurrentObject
StrokeAndFillPath
EndPath
LineTo
MoveToEx
BeginPath
CreateCompatibleBitmap
SetDIBits
GetDIBits
SetStretchBltMode
CreateDCW
GetTextColor
RoundRect
StretchBlt
BitBlt
GetPixel
CreateBitmap
DeleteDC
SelectObject
CreateCompatibleDC
CreateDIBSection
GetDeviceCaps
Rectangle
GetStockObject
CreatePen
GetBkColor
GetTextExtentPoint32W
CreateFontIndirectW
CreateSolidBrush
DeleteObject
GetObjectW
GetTextFaceW
StrokePath
ExtCreateRegion
GetBitmapBits
SetBrushOrgEx
GetTextExtentPoint32A
CloseFigure
FillPath
GetObjectA

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetSaveFileNameW

winspool.drv

DocumentPropertiesW
ClosePrinter
GetJobW
OpenPrinterW

advapi32

RegOpenKeyExW
RegNotifyChangeKeyValue
QueryServiceStatusEx
CloseServiceHandle
StartServiceW
ChangeServiceConfigW
RegEnumValueW
RegSetValueW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegEnumKeyW
RegQueryValueW
GetFileSecurityW
SetFileSecurityW
RegEnumKeyExW
RegOpenKeyW
RegQueryValueExW
OpenSCManagerW
OpenServiceW
RegCreateKeyExW
AllocateAndInitializeSid
IsTextUnicode
ImpersonateLoggedOnUser
RevertToSelf
LogonUserW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegLoadKeyW
RegUnLoadKeyW
RegFlushKey
ControlService
FreeSid
LookupAccountSidW
LookupAccountNameW
EqualSid
GetLengthSid
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid
ConvertStringSidToSidW
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTokenInformation
RegDeleteKeyExW
RegQueryInfoKeyW
OpenThreadToken
GetUserNameW
RegGetKeySecurity
RegSetKeySecurity
RegOpenKeyExA
RegQueryValueExA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom
CryptImportKey

shell32

Shell_NotifyIconW
ExtractIconExW
SHChangeNotify
ord59
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathW
ShellExecuteW
SHAppBarMessage
SHCreateDirectoryExW
SHFileOperationW
SHGetSpecialFolderLocation
SHGetMalloc
SHGetDesktopFolder
SHGetFileInfoW
DragQueryFileW
DragFinish
ExtractIconW

comctl32

ImageList_GetImageCount
ImageList_DrawEx
_TrackMouseEvent
ImageList_Draw
ImageList_AddMasked
ImageList_GetIcon
InitCommonControlsEx
ImageList_GetImageInfo
ImageList_GetIconSize
ImageList_Destroy
ImageList_Create
ImageList_Add
ImageList_ReplaceIcon

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathFindExtensionW
PathRemoveBackslashW
PathStripPathW
ord176
PathIsUNCW
PathGetDriveNumberW
PathBuildRootW
PathAppendW
PathCompactPathExW
PathIsUNCServerShareW
PathIsRelativeW
PathStripToRootW
PathIsRootW
PathCombineW
PathSetDlgItemPathW
PathRemoveExtensionW
PathFindFileNameW
UrlUnescapeW
StrFormatKBSizeW

uxtheme

IsThemeBackgroundPartiallyTransparent
IsAppThemed
DrawThemeParentBackground
DrawThemeText
GetThemePartSize
GetCurrentThemeName
GetWindowTheme
GetThemeSysColor
DrawThemeBackground
GetThemeColor
SetWindowTheme
OpenThemeData
CloseThemeData

ole32

OleInitialize
CoTaskMemFree
OleUninitialize
CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoGetCallContext
CoInitialize
StringFromCLSID
CoTaskMemAlloc
OleDuplicateData
ReleaseStgMedium
CoDisconnectObject
CoCreateGuid
CLSIDFromProgID
CoRegisterMessageFilter
CoRevokeClassObject
CoGetClassObject
CoFreeUnusedLibraries
OleRun
StgCreateDocfileOnILockBytes
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CreateStreamOnHGlobal
CLSIDFromString
StringFromGUID2

oleaut32

VariantChangeTypeEx
SafeArrayDestroy
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SysStringLen
LoadTypeLi
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
VarDateFromStr
VarUdateFromDate
OleLoadPicturePath
SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
OleCreateFontIndirect
SafeArrayGetElemsize
VarCmp
GetErrorInfo
SafeArrayAccessData
SafeArrayUnaccessData
VarBstrFromDate
VariantCopy
SysAllocString

oledlg

OleUIBusyW
OleUIAddVerbMenuW

urlmon

URLDownloadToFileW

winmm

PlaySoundW

oosu

?ShowProgress@CSplashUpControl@@QEAAXEEE@Z
?SetResDll@CSplashUpControl@@QEAAXPEB_WAEAU_tagSVersionTag@@@Z
??1CSplashUpControlImpl@@UEAA@XZ
??0CSplashUpControlImpl@@QEAA@XZ
?SetApp@CSplashUpControl@@QEAAXPEB_WAEAU_tagSVersionTag@@@Z
?Hide@CSplashUpControlImpl@@UEAAXXZ
?Update@CSplashUpControlImpl@@QEAAXPEB_WH@Z

activeds

ord13
ord9
ord6
ord3

mpr

WNetGetUniversalNameW
WNetGetLastErrorW
WNetGetConnectionW
WNetCancelConnectionW
WNetDisconnectDialog
WNetConnectionDialog
WNetAddConnection2W
WNetCancelConnection2W
WNetAddConnection3W

netapi32

NetLocalGroupEnum
NetLocalGroupGetMembers
NetGetDCName
NetApiBufferFree
NetGroupGetUsers

setupapi

SetupDiEnumDeviceInterfaces
SetupOpenInfFileW
SetupOpenAppendInfFileW
SetupCloseInfFile
SetupFindFirstLineW
SetupOpenFileQueue
SetupCloseFileQueue
SetupCommitFileQueueW
SetupPromptReboot
SetupInitDefaultQueueCallbackEx
SetupTermDefaultQueueCallback
SetupDefaultQueueCallbackW
SetupInstallFromInfSectionW
SetupInstallFilesFromInfSectionW
SetupInstallServicesFromInfSectionW
SetupDiDestroyDeviceInfoList
SetupDiGetActualSectionToInstallW
SetupGetStringFieldW
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW

ws2_32

WSARecv
shutdown
WSAIoctl
ioctlsocket
WSACleanup
WSAStartup
socket
send
recv
htons
connect
closesocket
WSAGetLastError
getsockname
getsockopt
inet_ntop
inet_pton
ntohs
getaddrinfo
setsockopt
listen
bind
WSASetLastError
freeaddrinfo

wininet

InternetWriteFile
InternetReadFile
InternetFindNextFileW
InternetCloseHandle
InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetGetLastResponseInfoW
InternetSetStatusCallbackW
FtpFindFirstFileW
FtpDeleteFileW
FtpOpenFileW
InternetOpenA
InternetSetOptionA
FtpCreateDirectoryW
FtpRemoveDirectoryW
HttpOpenRequestA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetConnectA
FtpCommandW
HttpSendRequestExW
HttpEndRequestW
FtpPutFileEx
FtpGetFileSize
InternetConnectW

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

gdiplus

GdiplusShutdown
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipFillPieI
GdipFillRectangleI
GdipSetSmoothingMode
GdipSetPathGradientBlend
GdipGetPathGradientPointCount
GdipSetPathGradientCenterPointI
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipSetLineBlend
GdipCreateLineBrushI
GdipCreateLineBrush
GdipAddPathEllipseI
GdipDeletePath
GdipCreatePath
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillRectangle
GdipSetCompositingQuality
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipSetCompositingMode

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

ntdll

RtlInitializeCriticalSection
RtlDeleteCriticalSection
RtlEnterCriticalSection
RtlLeaveCriticalSection
NtTerminateThread
NtWaitForMultipleObjects
NtCreateEvent
NtClose
NtSetEvent
RtlNtStatusToDosError
_setjmp
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
NtAllocateVirtualMemory
NtFreeVirtualMemory
RtlGetCompressionWorkSpaceSize
RtlCompressBuffer
RtlDecompressBuffer
NtOpenFile
NtDeviceIoControlFile
NtCreateKey
NtSetValueKey
RtlDetermineDosPathNameType_U
RtlInitializeGenericTable
RtlDeleteElementGenericTable
RtlEnumerateGenericTable
RtlNumberGenericTableElements
RtlIsGenericTableEmpty
RtlInsertElementGenericTable
RtlLookupElementGenericTable
RtlTimeToTimeFields
NtResetEvent
RtlStringFromGUID
RtlGUIDFromString
NtQuerySystemTime
RtlSystemTimeToLocalTime
NtQueryAttributesFile
NtQuerySystemInformation
LdrUnloadDll
NtOpenProcess
RtlInitAnsiString
RtlAdjustPrivilege
RtlCompareMemory
RtlDosPathNameToNtPathName_U
NtQueryObject
NtDuplicateObject
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtWaitForSingleObject
NtDeleteFile
LdrGetProcedureAddress
LdrLoadDll
RtlInitString
NtFsControlFile
NtQueryVolumeInformationFile
NtQueryInformationFile
NtSetInformationFile
NtQueryDirectoryFile
RtlEqualUnicodeString
RtlCreateUnicodeString
NtCreateFile
NtFlushBuffersFile
NtReadFile
NtWriteFile
NtSetVolumeInformationFile
RtlPcToFileHeader
RtlQueryEnvironmentVariable_U
RtlUnwindEx
strrchr
RtlInitUnicodeString

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wintrust

WinVerifyTrust

userenv

GetUserProfileDirectoryW

crypt32

CryptStringToBinaryA
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CryptDecodeObjectEx
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CryptQueryObject

bcrypt

BCryptImportKeyPair
BCryptSignHash
BCryptVerifySignature
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptExportKey
BCryptImportKey
BCryptDestroyKey
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptGenRandom
BCryptEncrypt

winhttp

WinHttpSetTimeouts
WinHttpWriteData
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpCloseHandle
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpConnect
WinHttpSetOption

ncrypt

NCryptFreeObject
NCryptImportKey
NCryptOpenStorageProvider

secur32

EncryptMessage
FreeContextBuffer
QueryContextAttributesW
ApplyControlToken
DeleteSecurityContext
AcceptSecurityContext
InitializeSecurityContextA
AcquireCredentialsHandleA
DecryptMessage

Exports

Exports

GetCommunicationInstance

Sections

.text
Size: 10.6MB - Virtual size: 10.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 327KB - Virtual size: 555KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 552KB - Virtual size: 552KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 59B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 296KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa8e9724f2b3ea86cf466e597fe4d928

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:84:a5:71:22:7a:38:d1:eb:58:99:b8:69:32:94:54Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

07:84:a5:71:22:7a:38:d1:eb:58:99:b8:69:32:94:54Certificate

Extended Key Usages

Key Usages

38:63:de:f8Certificate

Key Usages

58:da:13:ff:00:00:00:00:51:ce:0d:f7Certificate

Extended Key Usages

Key Usages

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04Certificate

Extended Key Usages

Key Usages

43:58:6d:6d:95:2c:20:0a:f7:7c:11:84:73:5e:16:0f:8c:2e:a4:c6:29:42:09:e1:64:74:36:65:37:6a:4b:e3Signer

53:ee:00:7c:77:5f:25:a7:bd:b5:e4:81:02:c0:91:69:71:56:53:7dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

urlmon

winmm

oosu

activeds

mpr

netapi32

setupapi

ws2_32

wininet

oleacc

gdiplus

imm32

ntdll

version

wintrust

userenv

crypt32

bcrypt

winhttp

ncrypt

secur32

Exports

Exports

Sections

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:84:a5:71:22:7a:38:d1:eb:58:99:b8:69:32:94:54
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

07:84:a5:71:22:7a:38:d1:eb:58:99:b8:69:32:94:54
Certificate

38:63:de:f8
Certificate

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Certificate

43:58:6d:6d:95:2c:20:0a:f7:7c:11:84:73:5e:16:0f:8c:2e:a4:c6:29:42:09:e1:64:74:36:65:37:6a:4b:e3
Signer

53:ee:00:7c:77:5f:25:a7:bd:b5:e4:81:02:c0:91:69:71:56:53:7d
Signer

.text
Size: 10.6MB - Virtual size: 10.6MB

.rdata
Size: 4.4MB - Virtual size: 4.4MB

.data
Size: 327KB - Virtual size: 555KB

.pdata
Size: 552KB - Virtual size: 552KB

.gfids
Size: 112KB - Virtual size: 112KB

.giats
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 59B

.rsrc
Size: 296KB - Virtual size: 296KB

.reloc
Size: 243KB - Virtual size: 243KB