36a0ae62c0f6bc65c2eb3dfcf9a29919e35e44089c25ae708c9588412ffc5647

Sharing

Copy URL Twitter E-mail

General

Target

36a0ae62c0f6bc65c2eb3dfcf9a29919e35e44089c25ae708c9588412ffc5647
Size

5.9MB
MD5

273f5b1b2a6dafd31afaf608f673e5e2
SHA1

fc3a6624e950ab217297088541a1b28e4dfd6a32
SHA256

36a0ae62c0f6bc65c2eb3dfcf9a29919e35e44089c25ae708c9588412ffc5647
SHA512

42d24f7d74768cb6191b2b52edb5a0c3904052796b8172fabc75c65f515edd4b9a8c932e339041510c3b5d4cd2a7d03911f4663c4f29e3127812253ba5b8c17a
SSDEEP

98304:TvxuankaBR1zSS2e6Ob+1xhq21C4ScfSfNyLO2vJCPy/7peyfSVNSspSVfmb3:Tv0HiR1z3F6OqbhqUhFENz2N/UyOzpa8

Score

10^/10

Malware Config

Signatures

Nirsoft 2 IoCs

resource	yara_rule
static1/unpack001/W10DigitalActivation.exe	Nirsoft
static1/unpack001/W10DigitalActivation_x64.exe	Nirsoft

Files

36a0ae62c0f6bc65c2eb3dfcf9a29919e35e44089c25ae708c9588412ffc5647
.zip
423Down.com.url
.url
W10DigitalActivation.exe
.exe windows:4 windows x86 arch:x86

62b4b03760f194276de24bb639c9cf3c

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

Issuer

CN=WZTeam

Not Before

02/11/2016, 18:47

Not After

31/12/2039, 23:59

Subject

CN=WZTeam

Extended Key Usages

ExtKeyUsageCodeSigning

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

aa:8a:14:6c:60:18:50:79:ea:5c:5e:bf:41:76:a4:fd:a7:ad:b7:04:c9:17:0d:ce:2b:47:d2:62:e3:92:de:cd
Signer

Actual PE Digest

aa:8a:14:6c:60:18:50:79:ea:5c:5e:bf:41:76:a4:fd:a7:ad:b7:04:c9:17:0d:ce:2b:47:d2:62:e3:92:de:cd

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
setlocale
memcpy
log10
_wfopen
fseek
fclose
wcslen
wcscpy
wcscat
wcscmp
memmove
memcmp
strlen
strcpy
strcat
_stricmp
strncpy
_CIfmod
fread
longjmp
_setjmp3
malloc
free
_wcsicmp
wcsncmp
wcsncpy
_snwprintf
tolower
floor
gmtime
localtime
mktime
_wcsnicmp
_itow
abs
sqrt
fmod
ftell
pow
??3@YAXPAX@Z
wcsstr
_wcsdup
frexp
modf
_CIpow
fopen
_errno
strerror
abort
atof
fflush
fwrite
exit
sprintf
__p__iob
fprintf
ferror
getenv
sscanf
_vsnwprintf
cos
sin
ceil

kernel32

GetModuleHandleW
HeapCreate
GetEnvironmentVariableW
GetUserDefaultLangID
HeapDestroy
ExitProcess
SystemTimeToFileTime
LocalFileTimeToFileTime
FindResourceW
LoadResource
LockResource
SizeofResource
CreateToolhelp32Snapshot
CloseHandle
GetLogicalDriveStringsW
QueryDosDeviceW
FileTimeToLocalFileTime
FileTimeToSystemTime
ExpandEnvironmentStringsW
GetCurrentProcess
GetSystemDefaultLangID
MultiByteToWideChar
GetProcAddress
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
GetCurrentProcessId
OpenProcess
GetLastError
FormatMessageW
GetVolumeInformationW
FindFirstFileW
FindNextFileW
FindClose
WideCharToMultiByte
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
CreateProcessW
Process32FirstW
Process32NextW
Beep
CreateFileW
CreateSemaphoreW
DeviceIoControl
GetCommandLineW
GetComputerNameW
GetDateFormatW
GetDiskFreeSpaceExW
GetExitCodeProcess
GetFileTime
GetPrivateProfileStringW
GetShortPathNameW
GetSystemDirectoryW
GetSystemPowerStatus
GetTimeZoneInformation
GetUserDefaultLCID
GetWindowsDirectoryW
GlobalMemoryStatus
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
SetComputerNameW
SetFileTime
SetLastError
SetSystemTime
SetVolumeLabelW
Sleep
TerminateProcess
WritePrivateProfileStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateThread
HeapAlloc
HeapFree
FreeLibrary
LoadLibraryW
GetCurrentThreadId
DuplicateHandle
CreatePipe
GetStdHandle
PeekNamedPipe
ReadFile
GetModuleFileNameW
SetEnvironmentVariableW
HeapReAlloc
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
TlsAlloc
TlsSetValue
GetTickCount
TlsGetValue
DeleteFileW
GetVersionExW
GetDriveTypeW
GetFileAttributesW
SetCurrentDirectoryW
CreateDirectoryW
SetFileAttributesW
RemoveDirectoryW
GetTempPathW
CopyFileW
MoveFileW
MulDiv
GetLocalTime
GlobalFree
GlobalAlloc
HeapSize
TlsFree
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject

user32

OemToCharW
GetSysColor
GetDlgCtrlID
CallWindowProcW
SetWindowLongW
GetWindowLongW
GetClientRect
FillRect
GetClassNameW
GetWindow
SetWindowPos
InvalidateRect
SendMessageW
EnableWindow
IsWindowEnabled
RedrawWindow
SetClassLongW
GetClassLongW
GetWindowRect
OffsetRect
IsRectEmpty
MapWindowPoints
SubtractRect
IsWindow
GetParent
GetDC
ReleaseDC
BeginPaint
EndPaint
DefWindowProcW
GetAsyncKeyState
KillTimer
GetCursorPos
ScreenToClient
SetTimer
DrawTextW
FrameRect
InflateRect
FindWindowW
FindWindowExW
DrawFrameControl
EnumWindows
GetWindowThreadProcessId
GetForegroundWindow
SetCursorPos
AnimateWindow
AttachThreadInput
BlockInput
ChangeDisplaySettingsW
CharToOemW
CreateWindowExW
DrawMenuBar
EnableMenuItem
EnumDisplaySettingsW
ExitWindowsEx
FlashWindow
GetDesktopWindow
GetFocus
GetKeyState
GetLastInputInfo
GetSystemMenu
GetSystemMetrics
GetWindowTextW
LoadCursorW
LockWorkStation
MessageBeep
PostMessageW
RegisterHotKey
RemoveMenu
SetFocus
SetForegroundWindow
ShowWindow
UnregisterHotKey
UpdateWindow
WaitForInputIdle
keybd_event
mouse_event
LoadIconW
RegisterClassExW
MessageBoxW
IsWindowVisible
DestroyWindow
SystemParametersInfoW
SetWindowTextW
GetWindowTextLengthW
MoveWindow
GetIconInfo
ReleaseCapture
DrawStateW
SetCapture
SetRect
SetCursor
GetMessagePos
RemovePropW
GetPropW
SetPropW
SetScrollPos
GetWindowDC
ClientToScreen
GetSysColorBrush
EnumPropsExW
SetActiveWindow
DestroyIcon
IsZoomed
IsIconic
RegisterClassW
AdjustWindowRectEx
UnregisterClassW
CreateAcceleratorTableW
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DefFrameProcW
DestroyAcceleratorTable
EnumChildWindows
IsChild
RegisterWindowMessageW
DrawIconEx
CopyImage
CreateIconFromResourceEx
CreateIconFromResource
CharUpperW
CharLowerW

gdi32

CreatePen
CreateSolidBrush
SelectObject
DeleteDC
DeleteObject
CreatePatternBrush
CreateRoundRectRgn
GetPixel
CreateCompatibleDC
SetBkMode
SetTextColor
SelectClipRgn
BitBlt
GetStockObject
RoundRect
SetDCBrushColor
SetBrushOrgEx
CreateDCW
CreateCompatibleBitmap
CreateFontIndirectW
GetObjectType
GetObjectW
GetTextExtentPoint32W
CreateRectRgnIndirect
TextOutW
MoveToEx
LineTo
ExcludeClipRect
SetBkColor
GetClipRgn
ExtSelectClipRgn
GetDeviceCaps
SelectPalette
RealizePalette
GetDIBits
SetPixelV
Rectangle
Ellipse
SetStretchBltMode
StretchDIBits
StretchBlt
SetROP2
ExtFloodFill
SetTextAlign
GetTextMetricsW
GdiGetBatchLimit
GdiSetBatchLimit
CreateDIBSection
CreateBitmap
SetPixel
CreateFontW

advapi32

RegOpenKeyExW
RegOpenKeyW
RegConnectRegistryW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
LookupAccountNameW
IsValidSid
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
LookupAccountSidW
GetSidSubAuthorityCount
GetSidSubAuthority
ChangeServiceConfigW
CloseServiceHandle
ControlService
CreateProcessAsUserW
CryptAcquireContextW
CryptCreateHash
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptHashData
CryptReleaseContext
DuplicateTokenEx
GetLengthSid
GetSecurityInfo
GetUserNameW
ImpersonateLoggedOnUser
LogonUserW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
RegEnumValueW
RevertToSelf
SetSecurityInfo
SetTokenInformation
StartServiceW

oleaut32

SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetElement

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateGuid
StringFromGUID2
RevokeDragDrop

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
ExtractIconExW
ExtractIconW
ord66
ord524
SHAddToRecentDocs
SHFileOperationW
SHFormatDrive
SHGetFileInfoW
ShellAboutW
Shell_NotifyIconW
ShellExecuteExW

ws2_32

WSAStartup
gethostbyname
WSACleanup
gethostbyaddr
inet_addr
closesocket
gethostname
htons
select
__WSAFDIsSet
ioctlsocket
recvfrom
socket
connect
recv
bind

winmm

timeBeginPeriod

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY

icmp

IcmpCloseHandle
IcmpCreateFile
IcmpSendEcho

imagehlp

MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo
GetNetworkParams

msi

ord45
ord70

netapi32

NetApiBufferFree
NetLocalGroupAdd
NetLocalGroupDel
NetLocalGroupEnum
NetUserDel
NetUserGetInfo
NetUserSetInfo

setupapi

SetupIterateCabinetW

urlmon

URLDownloadToFileW
UrlMkSetSessionOption

userenv

GetDefaultUserProfileDirectoryW

uxtheme

SetWindowTheme

wininet

DeleteUrlCacheEntryW
InternetCloseHandle
InternetGetConnectedState
InternetOpenUrlW
InternetOpenW
InternetReadFile
UnlockUrlCacheEntryFileW

winspool.drv

ClosePrinter
DeletePrinter
OpenPrinterW
SetPrinterW

comctl32

InitCommonControlsEx
ImageList_Replace
ImageList_Add
ImageList_ReplaceIcon
ImageList_Remove
ImageList_AddMasked
ImageList_Destroy
ImageList_Create

Sections

.code
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 356KB - Virtual size: 355KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

'.text'
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
W10DigitalActivation_x64.exe
.exe windows:5 windows x64 arch:x64

6ed1b19f8aadd1074d2cd40843849906

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

Issuer

CN=WZTeam

Not Before

02/11/2016, 18:47

Not After

31/12/2039, 23:59

Subject

CN=WZTeam

Extended Key Usages

ExtKeyUsageCodeSigning

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2f:1d:35:eb:fb:59:cb:ea:93:9b:8c:37:ca:91:13:32:45:32:73:7c:f2:a2:45:d7:85:32:59:49:f5:7b:b3:9b
Signer

Actual PE Digest

2f:1d:35:eb:fb:59:cb:ea:93:9b:8c:37:ca:91:13:32:45:32:73:7c:f2:a2:45:d7:85:32:59:49:f5:7b:b3:9b

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memset
setlocale
memcpy
log10
_wfopen
fseek
fclose
wcslen
wcscpy
wcscat
wcscmp
memmove
memcmp
strlen
strcpy
strcat
_stricmp
strncpy
fmod
fread
longjmp
setjmp
malloc
free
_wcsicmp
wcsncmp
wcsncpy
_snwprintf
tolower
floor
_gmtime64
_localtime64
_mktime64
_wcsnicmp
_itow
sqrtf
abs
fmodf
ftell
pow
??3@YAXPEAX@Z
wcsstr
_wcsdup
frexp
modf
fopen
_errno
strerror
abort
atof
fflush
fwrite
exit
sprintf
__iob_func
fprintf
ferror
getenv
sscanf
_vsnwprintf
sinf
cosf
ceil

kernel32

GetModuleHandleW
HeapCreate
GetEnvironmentVariableW
GetUserDefaultLangID
HeapDestroy
ExitProcess
SystemTimeToFileTime
LocalFileTimeToFileTime
FindResourceW
LoadResource
LockResource
SizeofResource
CreateToolhelp32Snapshot
CloseHandle
GetLogicalDriveStringsW
QueryDosDeviceW
FileTimeToLocalFileTime
FileTimeToSystemTime
ExpandEnvironmentStringsW
GetCurrentProcess
GetSystemDefaultLangID
MultiByteToWideChar
GetProcAddress
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
GetCurrentProcessId
OpenProcess
GetLastError
FormatMessageW
GetVolumeInformationW
FindFirstFileW
FindNextFileW
FindClose
WideCharToMultiByte
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
CreateProcessW
Process32FirstW
Process32NextW
Beep
CreateFileW
CreateSemaphoreW
DeviceIoControl
GetCommandLineW
GetComputerNameW
GetDateFormatW
GetDiskFreeSpaceExW
GetExitCodeProcess
GetFileTime
GetPrivateProfileStringW
GetShortPathNameW
GetSystemDirectoryW
GetSystemPowerStatus
GetTimeZoneInformation
GetUserDefaultLCID
GetWindowsDirectoryW
GlobalMemoryStatus
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
RtlZeroMemory
SetComputerNameW
SetFileTime
SetLastError
SetSystemTime
SetVolumeLabelW
Sleep
TerminateProcess
WritePrivateProfileStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateThread
HeapAlloc
HeapFree
FreeLibrary
LoadLibraryW
GetCurrentThreadId
DuplicateHandle
CreatePipe
GetStdHandle
PeekNamedPipe
ReadFile
GetModuleFileNameW
SetEnvironmentVariableW
HeapReAlloc
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
TlsAlloc
TlsSetValue
GetTickCount
TlsGetValue
DeleteFileW
GetVersionExW
GetDriveTypeW
GetFileAttributesW
SetCurrentDirectoryW
CreateDirectoryW
SetFileAttributesW
RemoveDirectoryW
GetTempPathW
CopyFileW
MoveFileW
MulDiv
GetLocalTime
GlobalFree
GlobalAlloc
HeapSize
TlsFree
DeleteCriticalSection
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject

user32

OemToCharW
GetSysColor
GetDlgCtrlID
CallWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
FillRect
GetClassNameW
GetWindow
SetWindowPos
InvalidateRect
SendMessageW
EnableWindow
IsWindowEnabled
RedrawWindow
SetClassLongPtrW
GetClassLongPtrW
GetWindowRect
OffsetRect
IsRectEmpty
MapWindowPoints
SubtractRect
IsWindow
GetParent
GetDC
ReleaseDC
BeginPaint
EndPaint
DefWindowProcW
GetAsyncKeyState
KillTimer
GetCursorPos
ScreenToClient
SetTimer
DrawTextW
FrameRect
InflateRect
FindWindowW
FindWindowExW
DrawFrameControl
EnumWindows
GetWindowThreadProcessId
GetForegroundWindow
SetCursorPos
AnimateWindow
AttachThreadInput
BlockInput
ChangeDisplaySettingsW
CharToOemW
CreateWindowExW
DrawMenuBar
EnableMenuItem
EnumDisplaySettingsW
ExitWindowsEx
FlashWindow
GetDesktopWindow
GetFocus
GetKeyState
GetLastInputInfo
GetSystemMenu
GetSystemMetrics
GetWindowTextW
LoadCursorW
LockWorkStation
MessageBeep
PostMessageW
RegisterHotKey
RemoveMenu
SetFocus
SetForegroundWindow
ShowWindow
UnregisterHotKey
UpdateWindow
WaitForInputIdle
keybd_event
mouse_event
LoadIconW
RegisterClassExW
MessageBoxW
IsWindowVisible
DestroyWindow
SystemParametersInfoW
SetWindowTextW
GetWindowTextLengthW
MoveWindow
GetIconInfo
ReleaseCapture
DrawStateW
SetCapture
SetRect
SetCursor
GetMessagePos
RemovePropW
GetPropW
SetPropW
SetScrollPos
GetWindowDC
ClientToScreen
GetSysColorBrush
EnumPropsExW
SetActiveWindow
DestroyIcon
IsZoomed
IsIconic
RegisterClassW
AdjustWindowRectEx
UnregisterClassW
CreateAcceleratorTableW
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DefFrameProcW
DestroyAcceleratorTable
EnumChildWindows
IsChild
RegisterWindowMessageW
DrawIconEx
CopyImage
CreateIconFromResourceEx
CreateIconFromResource
CharUpperW
CharLowerW

gdi32

CreatePen
CreateSolidBrush
SelectObject
DeleteDC
DeleteObject
CreatePatternBrush
CreateRoundRectRgn
GetPixel
CreateCompatibleDC
SetBkMode
SetTextColor
SelectClipRgn
BitBlt
GetStockObject
RoundRect
SetDCBrushColor
SetBrushOrgEx
CreateDCW
CreateCompatibleBitmap
CreateFontIndirectW
GetObjectType
GetObjectW
GetTextExtentPoint32W
CreateRectRgnIndirect
TextOutW
MoveToEx
LineTo
ExcludeClipRect
SetBkColor
GetClipRgn
ExtSelectClipRgn
GetDeviceCaps
SelectPalette
RealizePalette
GetDIBits
SetPixelV
Rectangle
Ellipse
SetStretchBltMode
StretchDIBits
StretchBlt
SetROP2
ExtFloodFill
SetTextAlign
GetTextMetricsW
GdiGetBatchLimit
GdiSetBatchLimit
CreateDIBSection
CreateBitmap
SetPixel
CreateFontW

advapi32

RegOpenKeyExW
RegOpenKeyW
RegConnectRegistryW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
LookupAccountNameW
IsValidSid
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
LookupAccountSidW
GetSidSubAuthorityCount
GetSidSubAuthority
ChangeServiceConfigW
CloseServiceHandle
ControlService
CreateProcessAsUserW
CryptAcquireContextW
CryptCreateHash
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptHashData
CryptReleaseContext
DuplicateTokenEx
GetLengthSid
GetSecurityInfo
GetUserNameW
ImpersonateLoggedOnUser
LogonUserW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
RegEnumValueW
RevertToSelf
SetSecurityInfo
SetTokenInformation
StartServiceW

oleaut32

SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetElement

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateGuid
StringFromGUID2
RevokeDragDrop

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
ExtractIconExW
ExtractIconW
ord66
ord524
SHAddToRecentDocs
SHFileOperationW
SHFormatDrive
SHGetFileInfoW
ShellAboutW
Shell_NotifyIconW
ShellExecuteExW

ws2_32

WSAStartup
gethostbyname
WSACleanup
gethostbyaddr
inet_addr
closesocket
gethostname
htons
select
__WSAFDIsSet
ioctlsocket
recvfrom
socket
connect
recv
bind

winmm

timeBeginPeriod

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY

icmp

IcmpCloseHandle
IcmpCreateFile
IcmpSendEcho

imagehlp

MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo
GetNetworkParams

msi

ord45
ord70

netapi32

NetApiBufferFree
NetLocalGroupAdd
NetLocalGroupDel
NetLocalGroupEnum
NetUserDel
NetUserGetInfo
NetUserSetInfo

setupapi

SetupIterateCabinetW

urlmon

URLDownloadToFileW
UrlMkSetSessionOption

userenv

GetDefaultUserProfileDirectoryW

uxtheme

SetWindowTheme

wininet

DeleteUrlCacheEntryW
InternetCloseHandle
InternetGetConnectedState
InternetOpenUrlW
InternetOpenW
InternetReadFile
UnlockUrlCacheEntryFileW

winspool.drv

ClosePrinter
DeletePrinter
OpenPrinterW
SetPrinterW

comctl32

InitCommonControlsEx
ImageList_Replace
ImageList_Add
ImageList_ReplaceIcon
ImageList_Remove
ImageList_AddMasked
ImageList_Destroy
ImageList_Create

Sections

.code
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 422KB - Virtual size: 421KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

62b4b03760f194276de24bb639c9cf3c

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9eCertificate

Extended Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

aa:8a:14:6c:60:18:50:79:ea:5c:5e:bf:41:76:a4:fd:a7:ad:b7:04:c9:17:0d:ce:2b:47:d2:62:e3:92:de:cdSigner

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

advapi32

oleaut32

ole32

shell32

ws2_32

winmm

gdiplus

icmp

imagehlp

iphlpapi

msi

netapi32

setupapi

urlmon

userenv

uxtheme

wininet

winspool.drv

comctl32

Sections

.code Size: 85KB - Virtual size: 84KB

.text Size: 356KB - Virtual size: 355KB

'.text' Size: 512B - Virtual size: 21B

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 4.5MB - Virtual size: 4.5MB

.rsrc Size: 68KB - Virtual size: 68KB

6ed1b19f8aadd1074d2cd40843849906

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9eCertificate

Extended Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

2f:1d:35:eb:fb:59:cb:ea:93:9b:8c:37:ca:91:13:32:45:32:73:7c:f2:a2:45:d7:85:32:59:49:f5:7b:b3:9bSigner

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

advapi32

oleaut32

ole32

shell32

ws2_32

winmm

gdiplus

icmp

imagehlp

iphlpapi

msi

netapi32

setupapi

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

aa:8a:14:6c:60:18:50:79:ea:5c:5e:bf:41:76:a4:fd:a7:ad:b7:04:c9:17:0d:ce:2b:47:d2:62:e3:92:de:cd
Signer

.code
Size: 85KB - Virtual size: 84KB

.text
Size: 356KB - Virtual size: 355KB

'.text'
Size: 512B - Virtual size: 21B

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 4.5MB - Virtual size: 4.5MB

.rsrc
Size: 68KB - Virtual size: 68KB

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

2f:1d:35:eb:fb:59:cb:ea:93:9b:8c:37:ca:91:13:32:45:32:73:7c:f2:a2:45:d7:85:32:59:49:f5:7b:b3:9b
Signer

.code
Size: 138KB - Virtual size: 137KB

.text
Size: 422KB - Virtual size: 421KB

.rdata
Size: 73KB - Virtual size: 72KB

.pdata
Size: 23KB - Virtual size: 22KB

.data
Size: 4.4MB - Virtual size: 4.4MB

.rsrc
Size: 68KB - Virtual size: 68KB