Hear[.]1[.]3[.]0[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

Hear.1.3.0.rar
Size

10.6MB
MD5

8cad228a8bba4e07699f5c5810f54c70
SHA1

49c96bcaac5e42408f481d2cf1af2c01c4575904
SHA256

303f07630e2eff3d2a3ea577f0d4f1708b43a375778c679e836c6b29ae1545fa
SHA512

7bb3125cf4ffed8d1fae6adcf3b8b7121c709f033fc703561cbeb0f88374a6e670ae525db430546c0ceacbc493957d52a8a9fb1e89a2be9d36dd237cd9a1269d
SSDEEP

196608:qZs+peQjWihLD2iTkRXymZQvMLMv4kQPD8kJcYjz0fUKS45IPv9s:qWkeQKiD9T0CmM2MVQtJDjpKSRPvi

Score

1^/10

Malware Config

Signatures

Files

Hear.1.3.0.rar
.rar

Password: soft98.ir
Hear.1.3.0/Crack/x64/Hear.exe
.exe windows:6 windows x64 arch:x64

Password: soft98.ir

2f89bac285bc3b9904516cd670bcff21

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:e7:15
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

01/01/2014, 07:00

Not After

30/05/2031, 07:00

Subject

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03/02/2015, 00:00

Not After

03/03/2026, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

40:40:ad:38:09:4c:88:0f
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

02/02/2016, 22:33

Not After

02/05/2019, 21:18

Subject

CN=Prosoft Engineering\, Inc.,O=Prosoft Engineering\, Inc.,L=Livermore,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

26:b7:e1:22:5d:f2:e8:ab:6b:40:6a:72:b8:83:7f:97:68:1b:c5:e1
Signer

Actual PE Digest

26:b7:e1:22:5d:f2:e8:ab:6b:40:6a:72:b8:83:7f:97:68:1b:c5:e1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Source\hearwin\Hear\x64\Release\hearProgram.pdb

Imports

winhttp

WinHttpOpenRequest
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpOpen
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpSendRequest
WinHttpConnect
WinHttpQueryHeaders
WinHttpSetTimeouts

kernel32

GetSystemTime
GetLastError
ReadFile
SetLastError
TerminateProcess
GetModuleFileNameW
WaitForSingleObject
Sleep
ExitProcess
GetEnvironmentVariableW
GetSystemTimeAsFileTime
WideCharToMultiByte
GetCurrentProcessId
ResetEvent
CloseHandle
MultiByteToWideChar
CreateEventW
SetEndOfFile
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetProcessHeap
ReadConsoleW
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
GetFileType
GetACP
GetStdHandle
CreateDirectoryW
SetThreadAffinityMask
TryEnterCriticalSection
GetVolumeInformationW
FindFirstFileW
SetPriorityClass
EnterCriticalSection
GetCommandLineW
FindNextFileW
GetCurrentProcess
WriteFile
RemoveDirectoryW
WaitForMultipleObjects
SetThreadPriority
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetTempPathW
CreateMutexW
FindClose
CreateFileW
GetFileAttributesW
GetCurrentThreadId
GetVersionExW
ReleaseMutex
GetLogicalDriveStringsW
GetFileAttributesExW
OutputDebugStringW
GlobalSize
SetEvent
GetCurrentThread
TerminateThread
LoadLibraryA
QueryPerformanceFrequency
GetThreadPriority
GlobalAlloc
DeleteFileW
LoadLibraryW
GetCurrentDirectoryW
GetPriorityClass
GetProcAddress
GlobalLock
IsProcessorFeaturePresent
DeleteCriticalSection
GetModuleHandleW
FreeLibrary
QueryPerformanceCounter
GetTickCount
GlobalUnlock
MoveFileW
GetDriveTypeW
IsDebuggerPresent
FlushFileBuffers
FormatMessageW
RtlPcToFileHeader
EncodePointer
DecodePointer
RaiseException
DuplicateHandle
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
ReleaseSemaphore
UnregisterWaitEx
RegisterWaitForSingleObject
SignalObjectAndWait
SwitchToThread
CreateThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualFree
VirtualProtect
LocalFree
RtlUnwindEx
GetTimeZoneInformation
ExitThread
GetModuleHandleExW
HeapAlloc
HeapFree
HeapReAlloc
GetModuleFileNameA

user32

RegisterWindowMessageW
GetWindowLongW
GetWindowTextW
EndPaint
BeginPaint
GetCursorPos
ReleaseDC
SetCursorPos
GetAncestor
InvalidateRect
SetForegroundWindow
ReleaseCapture
GetParent
SystemParametersInfoW
EnableMenuItem
GetDesktopWindow
ShowCaret
SetCursor
SetClipboardData
SetCapture
DestroyCaret
LoadCursorW
GetClipboardData
TranslateMessage
SetFocus
GetMessageTime
EnumWindows
GetForegroundWindow
AttachThreadInput
CreateCursor
TrackMouseEvent
CreateCaret
IsChild
PeekMessageW
EmptyClipboard
CloseClipboard
CreateIconIndirect
GetWindowInfo
DestroyIcon
DispatchMessageW
GetCapture
OpenClipboard
ShowWindow
GetActiveWindow
SetCaretPos
DestroyCursor
GetWindowPlacement
WindowFromPoint
RegisterClassExW
GetWindowLongPtrW
MessageBeep
SetWindowTextW
UnregisterClassW
GetSystemMetrics
SendMessageW
GetIconInfo
CreateWindowExW
EnumDisplayMonitors
SetWindowLongPtrW
SetWindowPos
GetDC
DestroyWindow
GetFocus
SendMessageTimeoutW
GetWindowRect
MapVirtualKeyW
PostMessageW
GetMessagePos
GetUpdateRgn
GetKeyState
GetSystemMenu
DefWindowProcW
GetMessageW
GetWindowThreadProcessId

ole32

RevokeDragDrop
RegisterDragDrop
OleInitialize
DoDragDrop
CoTaskMemFree
CoCreateInstance
PropVariantClear
OleUninitialize
CoInitialize
CoTaskMemAlloc

winmm

midiInGetDevCapsW
midiOutUnprepareHeader
midiInPrepareHeader
midiInReset
midiOutOpen
midiOutPrepareHeader
midiOutGetDevCapsW
midiInOpen
midiInUnprepareHeader
midiOutGetVolume
PlaySoundW
waveOutReset
waveOutPause
midiInStart
midiInClose
midiInAddBuffer
timeBeginPeriod
midiInGetNumDevs
midiOutSetVolume
midiOutShortMsg
midiOutGetNumDevs
midiOutLongMsg
midiOutClose
midiInStop
midiOutReset
waveOutOpen
mixerSetControlDetails
mixerClose
waveInClose
waveInStop
waveInGetNumDevs
mixerOpen
mixerGetLineControlsW
mixerGetControlDetailsW
waveOutGetNumDevs
waveOutGetDevCapsW
mixerGetLineInfoW
waveOutClose
waveInReset
waveInGetDevCapsW

msvfw32

DrawDibOpen
DrawDibDraw

wininet

HttpOpenRequestW
InternetCloseHandle
HttpSendRequestW
InternetReadFile
InternetGetConnectedState
InternetConnectW
InternetOpenW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

gdi32

CreateBitmap
SetMapMode
DeleteObject
GetGlyphOutlineW
RestoreDC
SetStretchBltMode
ExcludeClipRect
GetObjectW
GetGlyphIndicesW
SelectPalette
CreateFontIndirectW
GetRegionData
SetMapperFlags
DeleteDC
CreateRectRgn
GetPixel
GetTextMetricsW
GetDeviceCaps
CreateRectRgnIndirect
StretchDIBits
RealizePalette
GetOutlineTextMetricsW
CreateHalftonePalette
SaveDC
CreateCompatibleBitmap
CombineRgn
SelectObject
CreateDIBSection
GetKerningPairsW
CreateCompatibleDC
SetPixel

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

ConvertStringSidToSidW
LookupAccountSidW
RegQueryValueExW
SystemFunction036
RegQueryValueExA
CryptCreateHash
CryptHashData
CryptDestroyHash
RegOpenKeyExA
CryptGetHashParam
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW

shell32

SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
ExtractAssociatedIconW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHBrowseForFolderW

Exports

Exports

get_ospi
utf8proc_NFC
utf8proc_NFD
utf8proc_NFKC
utf8proc_NFKD
utf8proc_category
utf8proc_category_string
utf8proc_charwidth
utf8proc_codepoint_valid
utf8proc_decompose
utf8proc_decompose_char
utf8proc_encode_char
utf8proc_errmsg
utf8proc_get_property
utf8proc_grapheme_break
utf8proc_iterate
utf8proc_map
utf8proc_reencode
utf8proc_tolower
utf8proc_toupper
utf8proc_utf8class
utf8proc_version

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Hear.1.3.0/Crack/x86/Hear.exe
.exe windows:6 windows x86 arch:x86

Password: soft98.ir

b2edb480691ecdc0190eba6846d53d56

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:e7:15
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

01/01/2014, 07:00

Not After

30/05/2031, 07:00

Subject

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03/02/2015, 00:00

Not After

03/03/2026, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

40:40:ad:38:09:4c:88:0f
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

02/02/2016, 22:33

Not After

02/05/2019, 21:18

Subject

CN=Prosoft Engineering\, Inc.,O=Prosoft Engineering\, Inc.,L=Livermore,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:fa:4d:fe:4a:5a:1b:7f:4c:ea:5f:01:bd:b3:90:c2:ad:ea:5d:41
Signer

Actual PE Digest

fe:fa:4d:fe:4a:5a:1b:7f:4c:ea:5f:01:bd:b3:90:c2:ad:ea:5d:41

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Source\hearwin\Hear\Win32\Release\hearProgram.pdb

Imports

winhttp

WinHttpOpenRequest
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpOpen
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpSendRequest
WinHttpConnect
WinHttpQueryHeaders
WinHttpSetTimeouts

kernel32

GetSystemTime
GetLastError
ReadFile
SetLastError
TerminateProcess
GetModuleFileNameW
WaitForSingleObject
Sleep
ExitProcess
GetEnvironmentVariableW
GetSystemTimeAsFileTime
WideCharToMultiByte
GetCurrentProcessId
ResetEvent
CloseHandle
MultiByteToWideChar
CreateEventW
SetEndOfFile
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetProcessHeap
ReadConsoleW
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
GetFileType
GetACP
GetStdHandle
CreateDirectoryW
SetThreadAffinityMask
TryEnterCriticalSection
GetVolumeInformationW
FindFirstFileW
SetPriorityClass
EnterCriticalSection
GetCommandLineW
FindNextFileW
GetCurrentProcess
WriteFile
RemoveDirectoryW
WaitForMultipleObjects
SetThreadPriority
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetTempPathW
CreateMutexW
FindClose
CreateFileW
GetFileAttributesW
GetCurrentThreadId
GetVersionExW
ReleaseMutex
GetLogicalDriveStringsW
GetFileAttributesExW
OutputDebugStringW
GlobalSize
SetEvent
GetCurrentThread
TerminateThread
LoadLibraryA
QueryPerformanceFrequency
GetThreadPriority
GlobalAlloc
DeleteFileW
LoadLibraryW
GetCurrentDirectoryW
GetPriorityClass
GetProcAddress
GlobalLock
IsProcessorFeaturePresent
DeleteCriticalSection
GetModuleHandleW
FreeLibrary
QueryPerformanceCounter
GetTickCount
GlobalUnlock
MoveFileW
GetDriveTypeW
IsDebuggerPresent
FlushFileBuffers
FormatMessageW
EncodePointer
DecodePointer
RaiseException
DuplicateHandle
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
ReleaseSemaphore
UnregisterWaitEx
RegisterWaitForSingleObject
SignalObjectAndWait
SwitchToThread
CreateThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualFree
VirtualProtect
LocalFree
RtlUnwind
GetTimeZoneInformation
ExitThread
GetModuleHandleExW
HeapAlloc
HeapFree
HeapReAlloc
GetModuleFileNameA

user32

RegisterWindowMessageW
GetWindowLongW
GetWindowTextW
EndPaint
BeginPaint
GetCursorPos
ReleaseDC
SetCursorPos
GetAncestor
InvalidateRect
SetForegroundWindow
ReleaseCapture
GetParent
SystemParametersInfoW
EnableMenuItem
GetDesktopWindow
ShowCaret
SetWindowLongW
SetCursor
SetClipboardData
SetCapture
DestroyCaret
LoadCursorW
GetClipboardData
TranslateMessage
SetFocus
GetMessageTime
EnumWindows
GetForegroundWindow
AttachThreadInput
CreateCursor
TrackMouseEvent
CreateCaret
IsChild
PeekMessageW
EmptyClipboard
CloseClipboard
CreateIconIndirect
GetWindowInfo
DestroyIcon
DispatchMessageW
GetCapture
OpenClipboard
ShowWindow
GetActiveWindow
SetCaretPos
DestroyCursor
GetWindowPlacement
WindowFromPoint
RegisterClassExW
MessageBeep
SetWindowTextW
UnregisterClassW
GetSystemMetrics
SendMessageW
GetIconInfo
CreateWindowExW
EnumDisplayMonitors
SetWindowPos
GetDC
DestroyWindow
GetFocus
SendMessageTimeoutW
GetWindowRect
MapVirtualKeyW
PostMessageW
GetMessagePos
GetUpdateRgn
GetKeyState
GetSystemMenu
DefWindowProcW
GetMessageW
GetWindowThreadProcessId

ole32

RevokeDragDrop
RegisterDragDrop
OleInitialize
DoDragDrop
CoTaskMemFree
CoCreateInstance
PropVariantClear
OleUninitialize
CoInitialize
CoTaskMemAlloc

winmm

midiInGetDevCapsW
midiOutUnprepareHeader
midiInPrepareHeader
midiInReset
midiOutOpen
midiOutPrepareHeader
midiOutGetDevCapsW
midiInOpen
midiInUnprepareHeader
midiOutGetVolume
PlaySoundW
waveOutReset
waveOutPause
midiInStart
midiInClose
midiInAddBuffer
timeBeginPeriod
midiInGetNumDevs
midiOutSetVolume
midiOutShortMsg
midiOutGetNumDevs
midiOutLongMsg
midiOutClose
midiInStop
midiOutReset
waveOutOpen
mixerSetControlDetails
mixerClose
waveInClose
waveInStop
waveInGetNumDevs
mixerOpen
mixerGetLineControlsW
mixerGetControlDetailsW
waveOutGetNumDevs
waveOutGetDevCapsW
mixerGetLineInfoW
waveOutClose
waveInReset
waveInGetDevCapsW

msvfw32

DrawDibOpen
DrawDibDraw

wininet

HttpOpenRequestW
InternetCloseHandle
HttpSendRequestW
InternetReadFile
InternetGetConnectedState
InternetConnectW
InternetOpenW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

gdi32

CreateBitmap
SetMapMode
DeleteObject
GetGlyphOutlineW
RestoreDC
SetStretchBltMode
ExcludeClipRect
GetObjectW
GetGlyphIndicesW
SelectPalette
CreateFontIndirectW
GetRegionData
SetMapperFlags
DeleteDC
CreateRectRgn
GetPixel
GetTextMetricsW
GetDeviceCaps
CreateRectRgnIndirect
StretchDIBits
RealizePalette
GetOutlineTextMetricsW
CreateHalftonePalette
SaveDC
CreateCompatibleBitmap
CombineRgn
SelectObject
CreateDIBSection
GetKerningPairsW
CreateCompatibleDC
SetPixel

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

ConvertStringSidToSidW
LookupAccountSidW
RegQueryValueExW
SystemFunction036
RegQueryValueExA
CryptCreateHash
CryptHashData
CryptDestroyHash
RegOpenKeyExA
CryptGetHashParam
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW

shell32

SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
ExtractAssociatedIconW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHBrowseForFolderW

Exports

Exports

get_ospi
utf8proc_NFC
utf8proc_NFD
utf8proc_NFKC
utf8proc_NFKD
utf8proc_category
utf8proc_category_string
utf8proc_charwidth
utf8proc_codepoint_valid
utf8proc_decompose
utf8proc_decompose_char
utf8proc_encode_char
utf8proc_errmsg
utf8proc_get_property
utf8proc_grapheme_break
utf8proc_iterate
utf8proc_map
utf8proc_reencode
utf8proc_tolower
utf8proc_toupper
utf8proc_utf8class
utf8proc_version

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Hear.1.3.0/Hear.1.3.0_Soft98.iR.exe
.exe windows:1 windows x86 arch:x86

Password: soft98.ir

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:e7:15
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

01/01/2014, 07:00

Not After

30/05/2031, 07:00

Subject

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

40:40:ad:38:09:4c:88:0f
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

02/02/2016, 22:33

Not After

02/05/2019, 21:18

Subject

CN=Prosoft Engineering\, Inc.,O=Prosoft Engineering\, Inc.,L=Livermore,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

45:7c:04:87:72:1a:9b:3e:2c:3c:15:0c:e9:88:30:9e:f2:10:1d:ba
Signer

Actual PE Digest

45:7c:04:87:72:1a:9b:3e:2c:3c:15:0c:e9:88:30:9e:f2:10:1d:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Hear.1.3.0/Soft98.iR.url

Sharing

General

Malware Config

Signatures

Files

Password: soft98.ir

Password: soft98.ir

2f89bac285bc3b9904516cd670bcff21

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

1b:e7:15Certificate

Key Usages

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

40:40:ad:38:09:4c:88:0fCertificate

Extended Key Usages

Key Usages

26:b7:e1:22:5d:f2:e8:ab:6b:40:6a:72:b8:83:7f:97:68:1b:c5:e1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winhttp

kernel32

user32

ole32

winmm

msvfw32

wininet

version

gdi32

comdlg32

advapi32

shell32

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 2.0MB - Virtual size: 2.0MB

.data Size: 34KB - Virtual size: 51KB

.pdata Size: 93KB - Virtual size: 92KB

.gfids Size: 3KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 21B

_RDATA Size: 3KB - Virtual size: 2KB

.rsrc Size: 138KB - Virtual size: 138KB

.reloc Size: 34KB - Virtual size: 33KB

Password: soft98.ir

b2edb480691ecdc0190eba6846d53d56

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

1b:e7:15Certificate

Key Usages

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

40:40:ad:38:09:4c:88:0fCertificate

Extended Key Usages

Key Usages

fe:fa:4d:fe:4a:5a:1b:7f:4c:ea:5f:01:bd:b3:90:c2:ad:ea:5d:41Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winhttp

kernel32

user32

ole32

winmm

msvfw32

wininet

version

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

1b:e7:15
Certificate

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

07
Certificate

40:40:ad:38:09:4c:88:0f
Certificate

26:b7:e1:22:5d:f2:e8:ab:6b:40:6a:72:b8:83:7f:97:68:1b:c5:e1
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 34KB - Virtual size: 51KB

.pdata
Size: 93KB - Virtual size: 92KB

.gfids
Size: 3KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 21B

_RDATA
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 138KB - Virtual size: 138KB

.reloc
Size: 34KB - Virtual size: 33KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

1b:e7:15
Certificate

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

07
Certificate

40:40:ad:38:09:4c:88:0f
Certificate

fe:fa:4d:fe:4a:5a:1b:7f:4c:ea:5f:01:bd:b3:90:c2:ad:ea:5d:41
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 24KB - Virtual size: 36KB

.gfids
Size: 3KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 13B

_RDATA
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 138KB - Virtual size: 138KB

.reloc
Size: 91KB - Virtual size: 91KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

1b:e7:15
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

07
Certificate

40:40:ad:38:09:4c:88:0f
Certificate

45:7c:04:87:72:1a:9b:3e:2c:3c:15:0c:e9:88:30:9e:f2:10:1d:ba
Signer

CODE
Size: 40KB - Virtual size: 40KB

DATA
Size: 1024B - Virtual size: 592B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 143KB - Virtual size: 142KB