2024-02-23_195d7d14e05ac56c432e8f17088eb7f9_icedid

Sharing

Copy URL

Twitter E-mail

General

Target

2024-02-23_195d7d14e05ac56c432e8f17088eb7f9_icedid
Size

9.4MB
MD5

195d7d14e05ac56c432e8f17088eb7f9
SHA1

8281be4c9e5713235e94e7920a593a18d0f799a3
SHA256

234336d07deb4cf867126bd5a743a9a47193a9da32c761d2a838521b61184655
SHA512

7be6ee906db36049d1cbdf4188a9b6a6e05a0dfbabea9f6cd457202d3c523dd145c22e306ae9b5ec4a09c6b6772bc624cf2f145646e48ebbd6662b630f6a8cd7
SSDEEP

196608:rRYM6Pql7WgQpgJYxn10505qrp52+nWbQ4RRMfkAr8EdFe3c:rOMLWg/qNIpM2X4R2z7

Score

1^/10

Malware Config

Signatures

Files

2024-02-23_195d7d14e05ac56c432e8f17088eb7f9_icedid
.exe windows:5 windows x86 arch:x86

0d383e9fceca8590db4b642e74fdf8d7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:df:c7:a7:b0:6d:9b:40:f5:39:5d:b0:84:7e:8a:81
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19/11/2015, 00:00

Not After

18/11/2018, 23:59

Subject

CN=国信证券股份有限公司,OU=IT Dept,O=国信证券股份有限公司,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:ad:61:0c:ab:74:88:d8:88:e0:bd:d5:1e:28:5c:9f:b6:03:21:01
Signer

Actual PE Digest

72:ad:61:0c:ab:74:88:d8:88:e0:bd:d5:1e:28:5c:9f:b6:03:21:01

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipDeleteGraphics
GdipDeleteFont
GdipCreateSolidFill
GdipCreateLineBrushFromRect
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateFromHDC
GdipCreateBitmapFromStream
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateStringFormat
GdipCreateBitmapFromHBITMAP
GdipSetInterpolationMode
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipSetStringFormatLineAlign
GdipGetImagePalette
GdipSetLinePresetBlend
GdipAlloc
GdipFree
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipFillRectangle
GdipMeasureString
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneBrush
GdipCreatePath
GdipDeletePath
GdipFillPath
GdipCreatePen1
GdipDeletePen
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipDrawPolygonI
GdipDrawString
GdipGetFontSize
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipGetImageWidth
GdipGetImageHeight
GdipFillPolygonI
GdipDrawImageRectRect
GdipLoadImageFromFile
GdipDeleteRegion
GdipCombineRegionRegion
GdipCombineRegionPath
GdipFillRegion
GdipSetClipRect
GdipCreateRegionRect
GdipCreateRegionHrgn
GdipGetImageThumbnail
GdipSetPenLineJoin
GdipDrawLines
GdipCreateTexture
GdipCreateRegionPath
GdipSetPenDashArray
GdipSetClipRegion
GdipGetClip
GdipCreateRegion
GdipCreateRegionRectI
GdipDrawImageRectI
GdipSetClipRectI
GdipDrawImageRectRectI
GdipDrawEllipseI
GdipCreateLineBrushFromRectI
GdipDrawLine
GdipDrawLinesI
GdipSetPixelOffsetMode
GdipGraphicsClear
GdipFillPieI
GdipResetClip
GdipSetClipHrgn
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipSetPenDashStyle
GdipCreateHBITMAPFromBitmap
GdipCloneImage
GdipDrawImageI
GdipDrawCachedBitmap
GdipCreateBitmapFromFile
GdipDisposeImage
GdipDeleteCachedBitmap
GdipCreateCachedBitmap
GdipAddPathPolygon
GdipAddPathArcI
ord1
GdipAddPathLine2
GdipAddPathLine
GdipSetStringFormatTrimming
GdipSetStringFormatHotkeyPrefix
GdipSetStringFormatFlags
GdiplusStartup
GdiplusShutdown
GdipSetCompositingQuality
GdipAddPathLineI
GdipClosePathFigure
GdipGetFontStyle
GdipGetFamily
GdipDrawArcI
GdipAddPathString
GdipGetPathWorldBounds
GdipFillEllipseI
GdipAddPathRectangleI
GdipFillRectangleI
GdipDeleteBrush

psapi

GetModuleBaseNameA

dataclientapi

ord20
ord9
ord2
ord1
ord21
ord8
ord19
ord4
ord3

dataparser

DestroyResponseDecHandle
GetRow
GetColsInfoForOneSet
GetResultSetCnt
CreateResponseDecHandle
GetColCntForOneSet
??1TPacketHeadExUnit@@QAE@XZ
GetRowCntForOneSet

clientsession

?Connect@CClientSession@@QAE_NABV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H0@Z
?AsyncSendData@CClientSession@@QAE?AW4SESSION_SENDRESULT@xtgsession@@PAXH@Z
?SetProxy@CClientSession@@QAEXABW4SESSION_PROXY_TYPE@xtgsession@@ABV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H_N11@Z
??1CClientSession@@UAE@XZ
?SendHeartBeat@CClientSession@@QAEXXZ
?GetSendIdleTime@CClientSession@@QAEKXZ
?GetServerPort@CClientSession@@QAEHXZ
?GetServerName@CClientSession@@QAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetReceiveIdleTime@CClientSession@@QAEKXZ
?GetServerIp@CClientSession@@QAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetSpeedTime@CClientSession@@QAEHXZ
?GetState@CClientSession@@QAE?AW4SESSION_STATE@xtgsession@@XZ
?GetSocketMAC@CClientSession@@QAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetSocketName@CClientSession@@QAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
??0CClientSession@@QAE@W4SESSION_TYPE@xtgsession@@ABV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAVCSessionResponseHandler@@@Z

kernel32

FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
FileTimeToSystemTime
CreateActCtxW
ReleaseActCtx
GetModuleFileNameW
VirtualProtect
GetModuleHandleW
InterlockedExchange
GetLocaleInfoA
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
FileTimeToLocalFileTime
CreateMutexA
ReleaseMutex
GetFileAttributesExA
GetFileSizeEx
InterlockedIncrement
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCPInfo
GetOEMCP
GetACP
SetErrorMode
GetUserDefaultLCID
GetTempFileNameA
FindResourceExW
GetTempPathA
GetNumberFormatA
InitializeCriticalSectionAndSpinCount
GetProfileIntA
SearchPathA
RaiseException
EncodePointer
DecodePointer
RtlUnwind
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
HeapFree
HeapAlloc
HeapReAlloc
FindFirstFileExA
GetConsoleCP
GetConsoleMode
VirtualAlloc
VirtualQuery
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
HeapSetInformation
GetStartupInfoW
ExitThread
SetStdHandle
GetFileType
HeapQueryInformation
HeapSize
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
GetStdHandle
GetLocaleInfoW
GetStringTypeW
GetTimeZoneInformation
SetHandleCount
HeapCreate
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetDriveTypeW
CompareStringW
EnumSystemLocalesA
IsValidLocale
MoveFileA
GetCurrentDirectoryW
SetFilePointer
LoadLibraryW
lstrcmpW
GlobalGetAtomNameA
GlobalSize
FormatMessageA
LocalFree
VirtualUnlock
VirtualLock
GetProcessHeap
GlobalMemoryStatus
GetThreadTimes
GetProcessTimes
GetProcessWorkingSetSize
GetStartupInfoA
InterlockedDecrement
GetSystemInfo
GlobalMemoryStatusEx
GetCurrentDirectoryA
FindResourceA
DeleteCriticalSection
InitializeCriticalSection
FindAtomA
GlobalDeleteAtom
GlobalAddAtomA
SetUnhandledExceptionFilter
ExitProcess
CreateThread
GetCurrentProcessId
GetCurrentThread
CreateProcessA
lstrcmpiA
lstrcatA
WinExec
GetWindowsDirectoryA
LoadLibraryExA
FreeLibrary
WriteFile
Sleep
GetPrivateProfileIntA
GetPrivateProfileSectionA
EnterCriticalSection
LeaveCriticalSection
GetLocalTime
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CopyFileA
GetFileTime
SetFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
WritePrivateProfileStringA
lstrcmpA
lstrcpyA
GetVersion
GetCommandLineA
CreateEventA
SetEvent
WaitForSingleObject
SetThreadLocale
SetCurrentDirectoryA
GlobalFindAtomA
GetFileAttributesA
lstrlenW
GetVersionExA
GetCurrentProcess
SetPriorityClass
CreateFileA
CloseHandle
lstrlenA
DeviceIoControl
FindFirstFileA
DeleteFileA
FindNextFileA
FindClose
CreateDirectoryA
GetModuleFileNameA
MulDiv
ActivateActCtx
GetLastError
DeactivateActCtx
SetLastError
GetCurrentThreadId
GetModuleHandleA
lstrcpynA
GetTickCount
LoadLibraryA
GetProcAddress
SetEnvironmentVariableA
MultiByteToWideChar
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
SizeofResource
GetThreadLocale
GetStringTypeExA
SuspendThread
ReadFile
ResumeThread
SetThreadPriority
FreeResource
CreateFileW
CompareStringA
ResetEvent

user32

GetClassLongA
IsChild
SendDlgItemMessageA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
CheckDlgButton
GetDlgItemInt
SetDlgItemInt
SetDlgItemTextA
IsDlgButtonChecked
IsDialogMessageA
ValidateRect
BeginPaint
EndPaint
GetMenuItemInfoA
CharUpperA
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
GetKeyNameTextA
MapVirtualKeyA
MapDialogRect
PostQuitMessage
ShowOwnedPopups
SetWindowContextHelpId
WaitMessage
RegisterClipboardFormatA
NotifyWinEvent
EnumDisplayMonitors
SetLayeredWindowAttributes
RealChildWindowFromPoint
DeleteMenu
GetSystemMenu
UnionRect
UnregisterClassA
CopyAcceleratorTableA
InvalidateRgn
CharNextA
IsClipboardFormatAvailable
PostThreadMessageA
DestroyAcceleratorTable
SetClassLongA
ToAsciiEx
GetKeyboardLayout
LoadAcceleratorsW
CreateAcceleratorTableA
GetMenuDefaultItem
InvertRect
EnableScrollBar
CopyImage
UpdateLayeredWindow
IsMenu
LoadImageW
CharUpperBuffA
GetDoubleClickTime
IsCharLowerA
MapVirtualKeyExA
SubtractRect
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
MessageBoxA
GetClassInfoExA
RegisterClassA
DeferWindowPos
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
WinHelpA
SetFocus
GetWindowThreadProcessId
GetDlgItem
LoadAcceleratorsA
InsertMenuItemA
SetMenu
TranslateAcceleratorA
GetMenuStringA
GetClipboardOwner
GetClipboardViewer
GetInputState
GetMessageTime
GetOpenClipboardWindow
GetProcessWindowStation
GetQueueStatus
LockWindowUpdate
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
DrawIcon
GetCaretPos
wvsprintfA
EnableMenuItem
LoadCursorW
GetActiveWindow
keybd_event
DrawIconEx
GetAsyncKeyState
UnregisterHotKey
RegisterHotKey
GetCursorInfo
ShowCursor
ChildWindowFromPoint
IsWindowEnabled
RemovePropA
LoadImageA
CopyIcon
DestroyIcon
CreateIconIndirect
GetIconInfo
GetDlgCtrlID
AdjustWindowRectEx
DrawEdge
MessageBeep
DrawFrameControl
ClipCursor
MapWindowPoints
GetMessageA
EqualRect
GetMenu
FindWindowExA
FrameRect
SetCursorPos
HideCaret
GetKeyboardState
SetKeyboardState
MonitorFromPoint
MonitorFromRect
GetLastActivePopup
GetDesktopWindow
ShowScrollBar
GetClassInfoA
GetSysColorBrush
PeekMessageA
DispatchMessageA
GetPropA
GetTabbedTextExtentA
SetPropA
GetUpdateRect
DrawFocusRect
RegisterWindowMessageA
LoadIconA
SetForegroundWindow
BringWindowToTop
IsIconic
GetWindow
GetComboBoxInfo
wsprintfA
LoadIconW
RedrawWindow
GetMessagePos
SetRect
GetScrollInfo
SetWindowTextA
GetWindowTextA
SystemParametersInfoA
SetCapture
SetRectEmpty
GetSysColor
LoadMenuW
RemoveMenu
ModifyMenuA
InsertMenuA
GetMenuState
GetMenuItemID
LoadBitmapW
DrawStateA
SetWindowsHookExA
CallNextHookEx
SetWindowRgn
CallWindowProcA
GetMenuItemCount
UnhookWindowsHookEx
MonitorFromWindow
GetMonitorInfoA
SetActiveWindow
GetWindowDC
IsZoomed
EnumChildWindows
SetCursor
GetNextDlgGroupItem
WindowFromPoint
ReleaseCapture
SetParent
GetFocus
FillRect
SetMenuDefaultItem
UpdateWindow
ClientToScreen
GetSubMenu
CheckMenuItem
GetDC
ReleaseDC
TranslateMessage
TrackMouseEvent
IsRectEmpty
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ScreenToClient
InflateRect
CopyRect
GetSystemMetrics
IsWindow
GetKeyState
IntersectRect
CreateWindowExA
SetWindowLongA
SetWindowPos
DestroyWindow
GetWindowLongA
ShowWindow
MoveWindow
GetWindowRgn
DefWindowProcA
LoadCursorA
GetClassNameA
IsWindowVisible
GetWindowRect
PostMessageA
CreateMenu
EnableWindow
GetCursorPos
GetParent
KillTimer
SetTimer
InvalidateRect
GetClientRect
AppendMenuA
CreatePopupMenu
OffsetRect
PtInRect
SendMessageA
GetWindowTextLengthA
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
ScrollWindow
DestroyCursor
TrackPopupMenu
GetCapture

gdi32

GetDIBits
OffsetRgn
CreatePolygonRgn
SelectClipRgn
FrameRgn
SetTextJustification
GetTextExtentPoint32W
SetBkColor
CreateBitmap
StretchBlt
RealizePalette
SelectPalette
Arc
CreatePalette
GetCurrentObject
SetPixel
GetTextColor
FillRgn
SetTextColor
CombineRgn
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
StartDocA
DPtoLP
AngleArc
CreateDIBitmap
Ellipse
CreateDCA
CreateFontA
GetDeviceCaps
PatBlt
GetBkColor
CreateRectRgnIndirect
GetBkMode
RoundRect
SetBkMode
Polygon
MoveToEx
LineTo
GetTextMetricsA
GetStockObject
CreateFontIndirectA
EnumFontsA
Rectangle
CreatePen
GetLayout
SetLayout
GetViewportExtEx
GetWindowExtEx
GetPixel
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
GetObjectType
CreateHatchBrush
SetRectRgn
GetMapMode
CreateEllipticRgn
LPtoDP
GetCharWidthA
StretchDIBits
GetViewportOrgEx
EnumFontFamiliesA
GetTextCharsetInfo
GetRgnBox
EnumFontFamiliesExA
SetROP2
GetTextFaceA
GetWindowOrgEx
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
SetDIBColorTable
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
SetPolyFillMode
RestoreDC
SaveDC
CreateRoundRectRgn
GetTextExtentPoint32A
CopyMetaFileA
StrokeAndFillPath
EndPath
BeginPath
Polyline
CreateSolidBrush
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateDIBSection
SelectObject
DeleteDC
SetTextAlign
IntersectClipRect
CreateRectRgn
PtInRegion
DeleteObject
GetObjectA
ExcludeClipRect
GetClipBox
SetMapMode
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

GetJobA
OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegQueryValueA
RegFlushKey
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegEnumKeyA
RegEnumValueA
RegCloseKey

shell32

SHAddToRecentDocs
SHGetFileInfoA
DragQueryFileA
CommandLineToArgvW
Shell_NotifyIconA
ShellExecuteA
DragFinish
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderA
SHGetPathFromIDListA

comctl32

_TrackMouseEvent
ord13
ImageList_GetIconSize
ImageList_AddMasked
ImageList_Create
ord17
ImageList_Replace
ImageList_GetImageCount
ImageList_GetIcon

shlwapi

PathFindFileNameA
PathFindExtensionA
PathIsUNCA
PathStripToRootA
StrToIntExA
PathFileExistsA
PathRemoveFileSpecW

ole32

CoSetProxyBlanket
RevokeDragDrop
RegisterDragDrop
DoDragDrop
OleGetClipboard
CoLockObjectExternal
OleLockRunning
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoDisconnectObject
CoInitializeEx
CoUninitialize
OleRun
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CLSIDFromString
CLSIDFromProgID
CreateStreamOnHGlobal
OleDraw
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
CoCreateGuid
CoInitialize
CoCreateInstance

oleaut32

VariantCopy
GetErrorInfo
OleCreateFontIndirect
LoadTypeLi
VarBstrFromDate
VariantTimeToSystemTime
VarUdateFromDate
SysFreeString
VarBstrCat
SysStringLen
SysAllocStringLen
SysAllocString
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
VariantInit
SystemTimeToVariantTime
VarDateFromStr
SysAllocStringByteLen
VariantChangeType
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy

oledlg

ord8

ws2_32

socket
WSACleanup
closesocket
WSAStartup
WSAAsyncSelect
recvfrom
inet_addr
WSASetLastError
bind
htonl
select
accept
WSAGetLastError
connect
gethostbyname
htons
ntohs
recv
send
sendto

netapi32

Netbios

gxapplinker

?CreateSingleLoginURL@@YAPBDPBD0000000@Z
?DestroySingleLoginURL@@YAXPBD@Z

cefbrowser

?LoadURL@CCefInterface@@SAXPAVCCefBrowser@@PBD@Z
?ResizeBrowser@CCefInterface@@SAXPAVCCefBrowser@@PAUtagRECT@@@Z
?CreateBrowser@CCefInterface@@SAHPAUHWND__@@PAUtagRECT@@PBDH@Z
??1CCefResourceHandlerImp@@UAE@XZ
?SetString@CMBSToUTF8@@QAEXPBDI@Z
??_7CCefResourceHandlerImp@@6B@
??1CMBSToUTF8@@UAE@XZ
??0CMBSToUTF8@@QAE@PBDI@Z
?ExitInstance@CCefInterface@@SAXXZ
?SetCefHandlerFactory@CCefInterface@@SAXPAVCCefHandlerFactory@@@Z
?SetBeforeClosedBrowserMessage@CCefInterface@@SAXH@Z
?SetAfterCreatedBrowserMessage@CCefInterface@@SAXH@Z
?SetDebugLevel@CCefInterface@@SAXW4ECefDebugLevel@@@Z
?InitInstance@CCefInterface@@SAXPAUHINSTANCE__@@PBDH1@Z
?ExecuteJavaScript@CCefInterface@@SAHPAVCCefBrowser@@PBDH@Z
?SetFromUtf8@CMBSToUTF8@@QAEXPBDI@Z

winmm

PlaySoundA
timeGetTime

dbghelp

SymCleanup
SymFunctionTableAccess64
SymGetModuleBase64
SymInitialize
MiniDumpWriteDump
StackWalk64

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

imm32

ImmReleaseContext
ImmAssociateContext
ImmGetContext
ImmGetOpenStatus

Exports

Exports

??0Cell@@QAE@XZ
??0ColsInfo@@QAE@XZ
??0IndexArray@@QAE@XZ
??0KeyValuePair@@QAE@XZ
??0LenVal@@QAE@XZ
??0TPacketHeadExUnit@@QAE@XZ
??4TColInfo@@QAEAAU0@ABU0@@Z

Sections

.text
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 594KB - Virtual size: 690KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 242KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d383e9fceca8590db4b642e74fdf8d7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

7b:df:c7:a7:b0:6d:9b:40:f5:39:5d:b0:84:7e:8a:81Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

72:ad:61:0c:ab:74:88:d8:88:e0:bd:d5:1e:28:5c:9f:b6:03:21:01Signer

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

psapi

dataclientapi

dataparser

clientsession

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

ws2_32

netapi32

gxapplinker

cefbrowser

winmm

dbghelp

version

oleacc

imm32

Exports

Exports

Sections

.text Size: 6.8MB - Virtual size: 6.8MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 594KB - Virtual size: 690KB

.rsrc Size: 242KB - Virtual size: 242KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

7b:df:c7:a7:b0:6d:9b:40:f5:39:5d:b0:84:7e:8a:81
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

72:ad:61:0c:ab:74:88:d8:88:e0:bd:d5:1e:28:5c:9f:b6:03:21:01
Signer

.text
Size: 6.8MB - Virtual size: 6.8MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 594KB - Virtual size: 690KB

.rsrc
Size: 242KB - Virtual size: 242KB