2024-02-12_77a09a62615f9bbfb7458d212fb696ed_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-12_77a09a62615f9bbfb7458d212fb696ed_mafia
Size

1.7MB
MD5

77a09a62615f9bbfb7458d212fb696ed
SHA1

0bbe9148dcac3e3d7f62fb41ac3d967702261acd
SHA256

a9c4c71f88892c594078dd697213a7a1a553a2381f80b2f9679cf762dbf92326
SHA512

54237816d93fbc724ec8f495148869ffd4b70f6f0b111322118ec1a6469d1ceef8316b7f88dd00ccb7583714f4b56a7d23d0f92154de1d42a6986b5dc4e6fc4f
SSDEEP

24576:m8DGw64fr0LBFJ5YjjG4mm9G/4iP+RhfCnB3atGlZ2b3wBDF7XQPwPk9AxfRS:m8DGw6wr0teG4mz+RhfCnBrdPk9MS

Score

1^/10

Malware Config

Signatures

Files

2024-02-12_77a09a62615f9bbfb7458d212fb696ed_mafia
.exe windows:5 windows x86 arch:x86

b9a9d1ee25943b1259024f9e63950f03

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/05/2019, 00:00

Not After

23/05/2022, 23:59

Subject

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/05/2019, 00:00

Not After

23/05/2022, 23:59

Subject

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b8:e3:09:30:c5:75:b2:40:59:f7:60:62:83:c7:2d:6c:69:c0:61:d4:c9:ae:10:f4:8e:53:fb:37:27:28:1b:a0
Signer

Actual PE Digest

b8:e3:09:30:c5:75:b2:40:59:f7:60:62:83:c7:2d:6c:69:c0:61:d4:c9:ae:10:f4:8e:53:fb:37:27:28:1b:a0

Digest Algorithm

sha256

PE Digest Matches

false

3d:e3:bb:15:b9:2d:5c:20:83:97:7c:da:8c:26:0c:42:97:5f:f4:0e
Signer

Actual PE Digest

3d:e3:bb:15:b9:2d:5c:20:83:97:7c:da:8c:26:0c:42:97:5f:f4:0e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
CloseHandle
LockResource
GetTempPathW
GetSystemTimeAsFileTime
GetModuleFileNameW
LoadLibraryExW
HeapFree
LoadResource
GetCurrentThreadId
GetCommandLineW
FindResourceExW
SizeofResource
MultiByteToWideChar
FreeLibrary
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
lstrlenW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetProcessHeap
HeapAlloc
GetCurrentProcessId
DeleteFileW
SetCurrentDirectoryW
MoveFileExW
CreateEventA
SetEvent
FindResourceW
LoadLibraryA
GetStringTypeExW
SetEnvironmentVariableA
SetEndOfFile
CreateFileW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
LoadLibraryW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStdHandle
WriteFile
ExitProcess
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
CompareStringW
DeleteFileA
CreateThread
ExitThread
GetDateFormatA
GetTimeFormatA
GetDateFormatW
GetTimeFormatW
GetStartupInfoW
HeapSetInformation
GetCPInfo
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
GetUserDefaultLangID
CreateMutexW
GetCurrentProcess
VerifyVersionInfoW
VerSetConditionMask
WideCharToMultiByte
lstrlenA
WaitForSingleObject
TerminateProcess
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ProcessIdToSessionId
GetExitCodeProcess
CreateProcessW
QueryDosDeviceW
GetLogicalDriveStringsW
Sleep
LocalFree
InterlockedCompareExchange
FlushInstructionCache
SetLastError
CreateSemaphoreA
DuplicateHandle
OpenEventA
ResetEvent
ExpandEnvironmentStringsW
GetFileAttributesExW
GetFileAttributesW
TerminateThread
WaitForMultipleObjects
InterlockedExchange
OpenThread
CreateEventW
GetVersionExW
InitializeCriticalSection
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpW
MulDiv
GetTempFileNameW
ReleaseSemaphore
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
ResumeThread
SystemTimeToFileTime
SetWaitableTimer
CreateWaitableTimerA
QueryPerformanceFrequency
QueryPerformanceCounter
FormatMessageA
GetStringTypeW
GetLocaleInfoW
EncodePointer
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException

user32

LoadImageW
CopyRect
IsRectEmpty
SetRectEmpty
IntersectRect
MonitorFromPoint
FindWindowW
GetLastInputInfo
DialogBoxParamW
GetActiveWindow
IsWindow
IsWindowVisible
SetWindowLongW
GetWindowLongW
SetWindowPos
GetParent
SendMessageW
SetPropW
CharNextW
BeginPaint
EndPaint
EnumChildWindows
ScreenToClient
GetWindowRect
GetDC
GetClientRect
PostMessageW
SetWindowTextW
SetFocus
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindow
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
PostThreadMessageW
CreateDialogParamW
ShowWindow
GetClassInfoExW
LoadCursorW
DestroyIcon
RegisterClassExW
CreateWindowExW
InvalidateRect
CallWindowProcW
DefWindowProcW
GetWindowTextW
GetWindowTextLengthW
IsWindowEnabled
TrackMouseEvent
DestroyCursor
ReleaseCapture
GetFocus
SetCursor
ReleaseDC
FillRect
GetIconInfo
DrawIconEx
LoadBitmapW
SetTimer
KillTimer
GetKeyState
GetSysColor
MoveWindow
ClientToScreen
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetDlgItem
GetClassNameW
GetDesktopWindow
DestroyAcceleratorTable
CreateAcceleratorTableW
RegisterWindowMessageW
EndDialog
UnregisterClassA
LoadStringW
GetPropW

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoMarshalInterface
CoUnmarshalInterface
OleUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
CreateStreamOnHGlobal
CoSetProxyBlanket
CoInitializeSecurity

oleaut32

OleCreateFontIndirect
SysAllocStringByteLen
SysAllocString
SysStringByteLen
VariantChangeType
SysStringLen
VariantCopy
DispCallFunc
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringLen
VariantInit
SafeArrayCreate
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysFreeString
VariantClear

advapi32

RegQueryValueExW
CloseServiceHandle
QueryServiceStatus
StartServiceW
ChangeServiceConfigW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
LookupAccountSidW
ConvertStringSidToSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
UnlockServiceDatabase
LockServiceDatabase
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
CryptDeriveKey
CryptReleaseContext
CryptDestroyKey
CryptDecrypt

shlwapi

PathFileExistsW
UrlEscapeW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

msimg32

AlphaBlend

psapi

GetProcessImageFileNameW

winhttp

WinHttpSendRequest
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpSetCredentials
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration
WinHttpOpenRequest
WinHttpSetOption
WinHttpReadData
WinHttpOpen
WinHttpConnect
WinHttpQueryAuthSchemes

wininet

InternetGetConnectedState
HttpSendRequestW
InternetSetOptionW
HttpOpenRequestW
HttpQueryInfoW
InternetConnectW
InternetOpenW
InternetReadFile
InternetQueryDataAvailable
InternetCloseHandle

gdiplus

GdipCreateSolidFill
GdipFillRectangleI
GdipCloneBrush
GdipGetStringFormatFlags
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipGetFamilyName
GdipGetFamily
GdipDeleteGraphics
GdipDeleteBrush
GdiplusStartup
GdipDeleteFont
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDisposeImageAttributes
GdipGetImageWidth
GdipGetImageHeight
GdipGetFontStyle
GdipGetFontSize
GdipCreateBitmapFromFile
GdipStringFormatGetGenericTypographic
GdipSetStringFormatAlign
GdipCreateBitmapFromScan0
GdipSetImageAttributesWrapMode
GdipGetImageGraphicsContext
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdipGetStringFormatAlign
GdipDrawImageRectRectI
GdipDeleteStringFormat
GdipAlloc
GdipFree
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipGetStringFormatLineAlign
GdipGetStringFormatTrimming
GdipSetTextRenderingHint
GdipGetDpiY
GdipDrawString
GdipMeasureString
GdipGetFontHeight
GdipCreateImageAttributes
GdipCloneFont
GdipCreateFromHWND
GdipCreateStringFormat
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromResource
GdipCloneImage

urlmon

CoInternetSetFeatureEnabled

gdi32

GetObjectW
StretchBlt
SetStretchBltMode
GetBitmapBits
CreateSolidBrush
RestoreDC
SaveDC
GetDeviceCaps
GetStockObject
SelectObject
DeleteDC
DeleteObject
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC

shell32

SHGetFolderPathW
ShellExecuteW
DuplicateIcon

Exports

Exports

??0?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@QAE@XZ
??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@23@XZ@51
??_B?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ@51
?get_const_instance@?$singleton@V?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@23@XZ
?get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ
?instance@?$singleton@V?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@23@A
?instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@3@A
?instance@?$singleton@V?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@3@A
?instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@A
?instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@A
?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@3@A
?instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@A
?is_destroyed@?$singleton@V?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@VCNextCheckDelayManager@Utils@IPMUtility@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vtext_iarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vnaked_text_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vtext_oarchive@archive@boost@@VCNextCheckDelayManager@Utils@IPMUtility@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@detail@34@A

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 117KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9a9d1ee25943b1259024f9e63950f03

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

b8:e3:09:30:c5:75:b2:40:59:f7:60:62:83:c7:2d:6c:69:c0:61:d4:c9:ae:10:f4:8e:53:fb:37:27:28:1b:a0Signer

3d:e3:bb:15:b9:2d:5c:20:83:97:7c:da:8c:26:0c:42:97:5f:f4:0eSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

oleaut32

advapi32

shlwapi

wtsapi32

version

msimg32

psapi

winhttp

wininet

gdiplus

urlmon

gdi32

shell32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 239KB - Virtual size: 239KB

.data Size: 117KB - Virtual size: 131KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 26KB - Virtual size: 25KB

.reloc Size: 165KB - Virtual size: 164KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

b8:e3:09:30:c5:75:b2:40:59:f7:60:62:83:c7:2d:6c:69:c0:61:d4:c9:ae:10:f4:8e:53:fb:37:27:28:1b:a0
Signer

3d:e3:bb:15:b9:2d:5c:20:83:97:7c:da:8c:26:0c:42:97:5f:f4:0e
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 239KB - Virtual size: 239KB

.data
Size: 117KB - Virtual size: 131KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 26KB - Virtual size: 25KB

.reloc
Size: 165KB - Virtual size: 164KB