2024-02-04_774f62c5e63df3cf9c21151d5e4696ef_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-02-04_774f62c5e63df3cf9c21151d5e4696ef_ryuk
Size

8.6MB
MD5

774f62c5e63df3cf9c21151d5e4696ef
SHA1

bc53fcfcdf56f82200b78191b09060a5ea94db83
SHA256

65a7e759515bf2fc3af37269e296e5761b39b859c269305078696511db9e1500
SHA512

2e7dcc100b912f898500f4a61f205bc467785b480f33b71debb3f5d06c88511b5b235f1a934605376c27c4c5fe140ac15f1141201c01449ab21d91ac369f97f6
SSDEEP

98304:l6PUn1tpgOne62kMPj48EAPGWtPEqrEMJorLoqj+5eHLhCq0zyYgnd:AsRgMUvs8Ee/rHorLPKN8

Score

1^/10

Malware Config

Signatures

Files

2024-02-04_774f62c5e63df3cf9c21151d5e4696ef_ryuk
.exe windows:6 windows x64 arch:x64

90dbafc65205a08e712a5e93c7b55705

Code Sign

0e:72:84:63:a4:52:67:33:eb:cd:51:d4:43:a8:48:b3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/04/2017, 00:00

Not After

14/10/2017, 23:59

Subject

CN=Everyzone Inc.,O=Everyzone Inc.,L=Mapo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2d:27:be:8d:b0:fa:e9:9b:f4:55:5e:d0:08:0b:5b:43
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/04/2017, 00:00

Not After

11/09/2017, 23:59

Subject

CN=Everyzone Inc.,O=Everyzone Inc.,L=Mapo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

76:f9:19:20:c0:09:3c:fb:a3:0b:5f:21:b2:0a:fd:52:8e:03:04:52:76:dd:80:ba:cc:22:05:3e:04:bf:8d:62
Signer

Actual PE Digest

76:f9:19:20:c0:09:3c:fb:a3:0b:5f:21:b2:0a:fd:52:8e:03:04:52:76:dd:80:ba:cc:22:05:3e:04:bf:8d:62

Digest Algorithm

sha256

PE Digest Matches

true

db:36:4f:cd:e8:e4:e0:72:d1:99:f8:d9:be:b4:cb:5f:0f:05:40:f4
Signer

Actual PE Digest

db:36:4f:cd:e8:e4:e0:72:d1:99:f8:d9:be:b4:cb:5f:0f:05:40:f4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\Source\Audit-MAN\Audit-MAN\Update\x64\Release\AmUpdate.pdb

Imports

wldap32

ord33
ord35
ord32
ord30
ord200
ord27
ord143
ord26
ord46
ord211
ord60
ord50
ord41
ord79
ord22
ord301

kernel32

GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
VirtualFree
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
IsValidLocale
LCMapStringW
GetStringTypeW
GetConsoleCP
SetThreadAffinityMask
GetConsoleMode
ExitProcess
SetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
HeapQueryInformation
GetCommandLineW
GetCommandLineA
GetDriveTypeW
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
CreateThread
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
RtlPcToFileHeader
QueryPerformanceFrequency
TryEnterCriticalSection
GetACP
lstrcpynW
GetTimeFormatW
GetDateFormatW
lstrlenW
EnumSystemLocalesW
GetSystemDefaultLCID
RegisterWaitForSingleObject
UnregisterWait
ReadConsoleW
GetThreadTimes
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ResetEvent
GetUserDefaultLCID
SearchPathW
GetProfileIntW
GetTempPathW
GetTempFileNameW
FindResourceExW
GetWindowsDirectoryW
GetTickCount
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
SetErrorMode
lstrcpyW
VirtualProtect
lstrcmpiW
GetCurrentProcess
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
FileTimeToSystemTime
GlobalGetAtomNameW
GetThreadLocale
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GlobalFindAtomW
EncodePointer
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileIntW
ResumeThread
SetThreadPriority
CreateEventW
SetEvent
GetCurrentProcessId
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
LoadLibraryW
GetModuleHandleExW
OutputDebugStringA
CopyFileW
FormatMessageW
MulDiv
LocalFree
GlobalUnlock
GlobalSize
GlobalFree
FreeResource
CompareStringA
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
LoadLibraryExW
GetCurrentThreadId
GetCurrentThread
VerifyVersionInfoA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
ExpandEnvironmentStringsA
WaitForMultipleObjects
FreeLibrary
PeekNamedPipe
GetFileType
GetStdHandle
WaitForSingleObjectEx
FormatMessageA
SleepEx
Sleep
InitializeCriticalSectionEx
SetLastError
GetTickCount64
WaitForSingleObject
GetSystemDirectoryW
DeleteFileW
GetVersionExW
WideCharToMultiByte
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetFileAttributesW
CreateFileW
SetFilePointer
SetFileTime
WriteFile
ReadFile
CreateDirectoryW
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetVersionExA
GetLastError
MultiByteToWideChar
HeapSize
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
HeapFree
GetPrivateProfileStringW
GetModuleFileNameW
VerSetConditionMask
VerifyVersionInfoW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateMutexW
CloseHandle
OpenMutexW
OutputDebugStringW
IsValidCodePage

user32

MessageBeep
GetNextDlgGroupItem
IsRectEmpty
SetRect
InvalidateRgn
CopyAcceleratorTableW
ReleaseCapture
SetCapture
CharNextW
InvalidateRect
KillTimer
SetTimer
RealChildWindowFromPoint
DeleteMenu
SystemParametersInfoW
CopyImage
SetRectEmpty
SendDlgItemMessageA
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
UnhookWindowsHookEx
GetTopWindow
GetClassNameW
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
PtInRect
EqualRect
GetSysColorBrush
LoadCursorW
InflateRect
GetTabbedTextExtentW
DestroyCursor
GetClassInfoExW
GetClassInfoW
MapWindowPoints
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
SetForegroundWindow
GetForegroundWindow
UpdateWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
IsChild
LoadMenuW
GetDialogBaseUnits
DestroyIcon
CharUpperW
DestroyMenu
GetMenuItemInfoW
GetAsyncKeyState
TrackMouseEvent
LoadImageW
RegisterClipboardFormatW
CreatePopupMenu
GetMenuDefaultItem
WindowFromPoint
DrawFocusRect
IsMenu
CreateWindowExW
DrawIconEx
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongPtrW
SetWindowRgn
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
SetCursor
ShowOwnedPopups
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
SetParent
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
DrawEdge
DrawFrameControl
IsZoomed
FillRect
GetSysColor
ScreenToClient
ClientToScreen
EndPaint
BeginPaint
EnableWindow
LoadIconW
SendMessageW
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
PostMessageW
SystemParametersInfoA
CountClipboardFormats
GetClipboardData
SetCaretPos
GetWindowContextHelpId
GetCaretPos
ShowCaret
DestroyCaret
SetClassLongW
GetClassLongW
IntersectRect
OffsetRect
GetWindowPlacement
UnregisterClassW
GetWindowRect
MessageBoxW
PostQuitMessage
SetWindowPos
SetWindowContextHelpId
GetParent
GetWindow
GetWindowDC
MapDialogRect
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
IsWindow
GetKeyNameTextW
MapVirtualKeyW
GetDC
ReleaseDC
CopyRect
DestroyWindow
CreateDialogIndirectParamW
EndDialog
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
FrameRect
PostThreadMessageW
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
EnumChildWindows
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
SendNotifyMessageW
CreateMenu
WindowFromDC
GetWindowRgn
GetDlgItem
GetNextDlgTabItem
GetActiveWindow
IsWindowEnabled
SetActiveWindow
GetWindowLongW
GetDesktopWindow
GetWindowThreadProcessId
GetLastActivePopup
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW

gdi32

PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextColor
SetTextAlign
SetArcDirection
ExtCreatePen
GetObjectW
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetBkColor
GetTextColor
GetRgnBox
CombineRgn
CreateFontIndirectW
LineTo
SetRectRgn
DPtoLP
GetTextExtentPoint32W
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetDIBits
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
OffsetRgn
GetCharWidthW
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextFaceW
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetCurrentPositionEx
ExcludeClipRect
Escape
DeleteObject
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
DeleteDC
GetClipBox
GetDCOrgEx
CopyMetaFileW
CreateDCW
GetDeviceCaps
CreateRectRgnIndirect
PatBlt
BitBlt
CreateBitmap
CreateCompatibleDC
PolyBezier
CreateEllipticRgnIndirect
Arc
UnrealizeObject
SetBrushOrgEx
CreateHatchBrush
Ellipse
OffsetClipRgn
GetMapMode
CreatePen

msimg32

TransparentBlt
AlphaBlend

winspool.drv

DeviceCapabilitiesW
ClosePrinter
OpenPrinterW
EnumPrintersW
ord203
DocumentPropertiesW

advapi32

RegSetValueExW
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptGetHashParam
CryptImportKey
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
InitializeSecurityDescriptor
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptEncrypt

shell32

ExtractIconExW
ShellExecuteW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHAppBarMessage
DragFinish
DragQueryFileW
SHBrowseForFolderW
SHGetMalloc
DragAcceptFiles

comctl32

ImageList_GetImageCount
ImageList_Add
ImageList_AddMasked
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_ReplaceIcon
ImageList_Draw
ImageList_GetIconSize
ImageList_Remove
ord17

shlwapi

PathAddBackslashW
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathRemoveFileSpecW

uxtheme

GetThemePartSize
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor

ole32

CoUninitialize
CoCreateGuid
GetHGlobalFromILockBytes
OleGetIconOfClass
OleSetContainedObject
OleSaveToStream
OleSave
OleLoad
OleCreateFromFile
OleCreateLinkToFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreate
WriteClassStm
CreateItemMoniker
CreateGenericComposite
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateFileMoniker
OleLockRunning
OleSetMenuDescriptor
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CreateStreamOnHGlobal
CoInitializeEx
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoDisconnectObject
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoInitialize
CoCreateInstance
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
WriteClassStg
ReadClassStg
CreateBindCtx
CoTreatAsClass
CoTaskMemFree
OleDraw
CoTaskMemAlloc
StringFromCLSID
CLSIDFromProgID
CLSIDFromString
OleCreateFromData

oleaut32

VarBstrFromDate
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
LoadTypeLi
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
OleCreateFontIndirect
VariantChangeType
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
VarUdateFromDate
VariantInit

oledlg

OleUIInsertObjectW
OleUIPasteSpecialW
OleUIObjectPropertiesW
OleUIBusyW

gdiplus

GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageDecoders
GdipGetImageDecodersSize
GdipSaveImageToStream
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown

ws2_32

freeaddrinfo
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
getaddrinfo
WSAIoctl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundW

comdlg32

GetFileTitleW

Sections

.text
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 807KB - Virtual size: 806KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90dbafc65205a08e712a5e93c7b55705

Code Sign

0e:72:84:63:a4:52:67:33:eb:cd:51:d4:43:a8:48:b3Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

2d:27:be:8d:b0:fa:e9:9b:f4:55:5e:d0:08:0b:5b:43Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

76:f9:19:20:c0:09:3c:fb:a3:0b:5f:21:b2:0a:fd:52:8e:03:04:52:76:dd:80:ba:cc:22:05:3e:04:bf:8d:62Signer

db:36:4f:cd:e8:e4:e0:72:d1:99:f8:d9:be:b4:cb:5f:0f:05:40:f4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wldap32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ws2_32

oleacc

imm32

winmm

comdlg32

Sections

.text Size: 5.4MB - Virtual size: 5.4MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 68KB - Virtual size: 131KB

.pdata Size: 275KB - Virtual size: 274KB

.gfids Size: 114KB - Virtual size: 113KB

.giats Size: 512B - Virtual size: 16B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 807KB - Virtual size: 806KB

.reloc Size: 158KB - Virtual size: 157KB

0e:72:84:63:a4:52:67:33:eb:cd:51:d4:43:a8:48:b3
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

2d:27:be:8d:b0:fa:e9:9b:f4:55:5e:d0:08:0b:5b:43
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

76:f9:19:20:c0:09:3c:fb:a3:0b:5f:21:b2:0a:fd:52:8e:03:04:52:76:dd:80:ba:cc:22:05:3e:04:bf:8d:62
Signer

db:36:4f:cd:e8:e4:e0:72:d1:99:f8:d9:be:b4:cb:5f:0f:05:40:f4
Signer

.text
Size: 5.4MB - Virtual size: 5.4MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 68KB - Virtual size: 131KB

.pdata
Size: 275KB - Virtual size: 274KB

.gfids
Size: 114KB - Virtual size: 113KB

.giats
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 807KB - Virtual size: 806KB

.reloc
Size: 158KB - Virtual size: 157KB