bdcam[.]exe | Triage

Resubmissions

05/03/2024, 15:28

240305-swtj6aba65 5

Sharing

Copy URL Twitter E-mail

General

Target

bdcam.exe
Size

13.2MB
MD5

519814dd446f0b34c079857ccac2af07
SHA1

eb261e8ce19604800d620c9c3bfaa3a1338e20c2
SHA256

9af00631c3753b62ed4c5d229cb12f1a803d0fc3d8db11cdf0151404b6915318
SHA512

53216086d813006cba86a655e314e5cb6850c132f8915f8fdf6e4aeb92132a5ad216094adfa78629cf55fc4009262c5d2bbf8ca2bb06a6597e94aa06d0ca54f3
SSDEEP

196608:DgeaoH82gmk6Ozji0LWc3AHsF/P8e8Eg05xsfftfYvZs9aMG1:DgeaZRm2zjxac3rHDN5x6fZYvZye

Score

1^/10

Malware Config

Signatures

Files

bdcam.exe
.exe windows:6 windows x64 arch:x64

63d58fc3d91db80a5deb5a78d19f3606

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:26:1c:84:70:ad:bb:65:80:0c:ea:f3:ea:c7:08:19
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/01/2021, 00:00

Not After

30/01/2024, 23:59

Subject

CN=Bandicam Company Corp.,O=Bandicam Company Corp.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:26:1c:84:70:ad:bb:65:80:0c:ea:f3:ea:c7:08:19
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/01/2021, 00:00

Not After

30/01/2024, 23:59

Subject

CN=Bandicam Company Corp.,O=Bandicam Company Corp.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

49:af:68:75:14:a4:9a:9f:ba:ed:3d:36:ce:73:cf:3d:87:48:22:00:3f:06:68:18:11:49:d5:1a:11:95:a3:e8
Signer

Actual PE Digest

49:af:68:75:14:a4:9a:9f:ba:ed:3d:36:ce:73:cf:3d:87:48:22:00:3f:06:68:18:11:49:d5:1a:11:95:a3:e8

Digest Algorithm

sha256

PE Digest Matches

true

0a:4d:b5:6b:dc:a9:42:30:10:fa:dd:a3:85:a8:fd:79:b4:3a:16:b6
Signer

Actual PE Digest

0a:4d:b5:6b:dc:a9:42:30:10:fa:dd:a3:85:a8:fd:79:b4:3a:16:b6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetDriveTypeW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetTimeFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStartupInfoW
GetFileType
SetStdHandle
VirtualQuery
HeapQueryInformation
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
RtlUnwind
RtlPcToFileHeader
RtlUnwindEx
LCMapStringEx
GetCPInfo
CompareStringEx
GetLocaleInfoEx
GetStringTypeW
LoadLibraryExA
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
WriteConsoleW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
WaitForSingleObjectEx
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProfileIntW
SearchPathW
VerifyVersionInfoW
VerSetConditionMask
SetErrorMode
GetFileAttributesExW
VirtualProtect
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GlobalGetAtomNameW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CompareStringA
ResumeThread
UnlockFile
SetEndOfFile
LockFile
GetThreadLocale
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
EncodePointer
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
CopyFileW
DuplicateHandle
lstrcmpiW
GetThreadPriority
WaitForMultipleObjects
SwitchToThread
LoadLibraryExW
GetModuleHandleExW
SetThreadErrorMode
SetUnhandledExceptionFilter
DecodePointer
MoveFileW
FormatMessageW
GetDateFormatW
CreateThread
ReadDirectoryChangesW
SleepEx
GetLocalTime
GetUserDefaultLCID
LCIDToLocaleName
GetTickCount
GetUserDefaultLangID
CompareStringW
QueryFullProcessImageNameW
GetSystemWow64DirectoryW
RaiseException
GetCurrentThreadId
InitializeCriticalSectionEx
CreateFileMappingW
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateMutexW
VirtualFree
VirtualAlloc
CreateEventW
GlobalSize
GlobalUnlock
GlobalLock
FlushFileBuffers
ExitProcess
FileTimeToLocalFileTime
lstrcmpA
LocalAlloc
ResetEvent
SetEvent
CreateEventA
GetWindowsDirectoryW
lstrlenA
QueryPerformanceFrequency
GetTickCount64
QueryPerformanceCounter
FindResourceExW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
MulDiv
lstrcmpW
WriteFile
SetThreadPriority
Sleep
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetVersionExW
GlobalMemoryStatusEx
GetSystemInfo
TerminateProcess
GetLastError
OpenProcess
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
IsDBCSLeadByteEx
MultiByteToWideChar
WideCharToMultiByte
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
LocalFree
GetFileSizeEx
GetFileSize
GetFileAttributesW
DeleteFileW
GetTempFileNameW
GetTempPathW
GetCurrentDirectoryW
GetSystemDirectoryW
GetModuleFileNameW
GetDiskFreeSpaceW
GlobalFree
GlobalAlloc
GetCurrentThread
GetCurrentProcess
FreeLibrary
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetVolumeInformationW
SetLastError
FindClose
FindNextFileW
lstrcpyW
FindFirstFileW
lstrcpynW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetFileTime
FindResourceW
LoadResource
LockResource
SizeofResource
ReadFile
SetFilePointer
CreateFileW
OutputDebugStringA
OutputDebugStringW
lstrlenW
CloseHandle
GetStdHandle
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetWindowPlacement
IsChild
IsMenu
GetMessageTime
GetMessagePos
InsertMenuW
GetMenuState
MsgWaitForMultipleObjects
GetQueueStatus
PostThreadMessageW
GetActiveWindow
GetMessageW
SetMenuDefaultItem
GetScrollInfo
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
EnumWindows
GetShellWindow
ClipCursor
GetCursor
GetCursorInfo
ShowCursor
FillRect
GetAncestor
WindowFromPoint
AllowSetForegroundWindow
GetWindow
UnhookWinEvent
SetWinEventHook
SetCursorPos
UpdateLayeredWindowIndirect
GetCapture
EnableMenuItem
RemoveMenu
UpdateLayeredWindow
SetParent
DeleteMenu
CheckMenuRadioItem
DrawIconEx
LoadImageW
SetClassLongW
CheckMenuItem
AppendMenuW
CreatePopupMenu
GetDoubleClickTime
TranslateAcceleratorW
DrawIcon
LoadAcceleratorsW
GetClassInfoW
MessageBoxW
EnumDisplayDevicesW
EnumDisplayMonitors
GetWindowTextLengthW
GetFocus
IsWindowEnabled
TrackPopupMenuEx
DestroyMenu
LoadMenuW
TrackMouseEvent
SetWindowRgn
GetClassInfoExW
RegisterClassExW
BeginDeferWindowPos
SetFocus
InflateRect
GetCursorPos
PostQuitMessage
IsZoomed
GetWindowDC
SetScrollInfo
MessageBeep
SetWindowContextHelpId
SendMessageW
GetSystemMetrics
SetScrollRange
SetScrollPos
CreateWindowExW
EndPaint
BeginPaint
MapDialogRect
GetWindowLongPtrW
GetKeyState
DestroyWindow
UnionRect
IsClipboardFormatAvailable
CloseClipboard
AdjustWindowRectEx
EmptyClipboard
OpenClipboard
KillTimer
SetTimer
ShowWindow
GetAsyncKeyState
CallWindowProcW
RemovePropW
GetPropW
SetPropW
SetWindowLongPtrW
SetLayeredWindowAttributes
SetActiveWindow
IntersectRect
RegisterClassW
GetClassLongPtrW
GetTopWindow
GetLastActivePopup
WinHelpW
MonitorFromWindow
CharUpperW
CheckDlgButton
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
DrawTextExW
DeferWindowPos
LoadIconW
DefWindowProcW
EndDeferWindowPos
GetDlgItem
GetMenu
SetMenu
TrackPopupMenu
UpdateWindow
ValidateRect
ScrollWindow
GetScrollPos
GetScrollRange
UnregisterClassW
ShowScrollBar
SystemParametersInfoW
GetWindowRect
MonitorFromRect
GetMonitorInfoW
CopyRect
MonitorFromPoint
OffsetRect
EqualRect
MoveWindow
GetWindowLongW
SetWindowPos
ScreenToClient
ClientToScreen
PeekMessageW
TranslateMessage
DispatchMessageW
IsWindow
GetParent
GetDesktopWindow
FindWindowExW
GetWindowThreadProcessId
IsWindowVisible
IsIconic
GetWindowTextW
GetWindowPlacement
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
BringWindowToTop
GetDC
ReleaseDC
RegisterWindowMessageW
DestroyIcon
DrawTextW
ExitWindowsEx
PostMessageW
IsRectEmpty
GetClassNameW
GetClassLongW
SetRectEmpty
SetRect
GetDlgCtrlID
SetWindowTextW
MapWindowPoints
SetWindowLongW
EnumChildWindows
ShowOwnedPopups
SendDlgItemMessageA
DrawStateW
GetKeyNameTextW
MapVirtualKeyW
CopyImage
RealChildWindowFromPoint
InsertMenuItemW
UnpackDDElParam
GrayStringW
TabbedTextOutW
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
DrawMenuBar
GetMenuItemCount
GetMenuStringW
GetMenuItemID
ModifyMenuW
GetMenuItemInfoW
GetSubMenu
wsprintfW
EnableWindow
GetClientRect
PtInRect
ReleaseCapture
RedrawWindow
SetCapture
LoadCursorW
SetCursor
InvalidateRect
GetSysColorBrush
SetClipboardData
ReuseDDElParam
GetSystemMenu
NotifyWinEvent
WaitMessage
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
RegisterClipboardFormatW
LockWindowUpdate
SetClassLongPtrW
CharNextW
InvalidateRgn
GetNextDlgGroupItem
GetMenuDefaultItem
EnableScrollBar
DrawEdge
DrawFrameControl
DrawFocusRect
CharUpperBuffW
CopyIcon
FrameRect
GetWindowRgn
GetComboBoxInfo
DestroyCursor
CreateMenu
InvertRect
HideCaret
GetIconInfo
GetUpdateRect
SubtractRect
MapVirtualKeyExW
IsCharLowerW
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
GetSysColor
CharUpperBuffW

gdi32

FillRgn
CopyMetaFileW
CreateBitmap
CreateHatchBrush
CreatePatternBrush
Escape
GetClipBox
GetObjectType
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
PtVisible
RectVisible
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
CreateRectRgnIndirect
PatBlt
GetMapMode
SetRectRgn
DPtoLP
CreateDIBitmap
GetTextCharsetInfo
GetDIBits
RealizePalette
SetPixel
SetDIBColorTable
CreateRoundRectRgn
GetRgnBox
GetTextColor
GetBkColor
EnumFontFamiliesExW
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
LPtoDP
RoundRect
ExtFloodFill
SetPaletteEntries
GetViewportOrgEx
GetWindowOrgEx
FrameRgn
GetBoundsRect
PtInRegion
GetTextFaceW
SetPixelV
GetPixel
Rectangle
CreatePen
CreateDCW
CreateSolidBrush
ExtCreateRegion
LineTo
MoveToEx
CombineRgn
OffsetRgn
CreateRectRgn
ExcludeClipRect
SetWindowOrgEx
CreateCompatibleBitmap
TextOutW
SetTextCharacterExtra
AbortPath
GetPath
EndPath
CloseFigure
BeginPath
StretchBlt
BitBlt
CreateDIBSection
CreateFontIndirectW
GetDeviceCaps
SelectObject
SetTextColor
SetBkMode
CreateCompatibleDC
DeleteDC
CreateFontW
DeleteObject
ExtTextOutW
SetBkColor
EnumFontFamiliesW
GetObjectW
GetStockObject
GetTextMetricsW
ScaleWindowExtEx
RestoreDC
GetTextExtentPoint32W

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetOpenFileNameW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

InitializeSecurityDescriptor
OpenProcessToken
AllocateAndInitializeSid
FreeSid
SetEntriesInAclW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueW
RegEnumKeyW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityDescriptorDacl
RegQueryInfoKeyW
CheckTokenMembership
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
SetNamedSecurityInfoW

shell32

SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetMalloc
SHAppBarMessage
DragFinish
DragQueryFileW
SHGetFileInfoW
ExtractIconExW
CommandLineToArgvW
SHChangeNotify
ShellExecuteExW
Shell_NotifyIconW
ord155
SHOpenFolderAndSelectItems
ord190
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathFindFileNameW
PathFindExtensionW
StrStrW
PathCanonicalizeW
PathIsDirectoryW
StrFormatKBSizeW

uxtheme

IsThemeBackgroundPartiallyTransparent
OpenThemeData
CloseThemeData
GetThemePartSize
GetThemeColor
GetCurrentThemeName
GetWindowTheme
GetThemeSysColor
IsAppThemed
DrawThemeParentBackground
DrawThemeText
DrawThemeBackground

ole32

RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
IsAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleUninitialize
OleInitialize
OleLockRunning
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CreateStreamOnHGlobal
CoDisconnectObject
CLSIDFromProgID
CoCreateGuid
CLSIDFromString
CoInitializeEx
ReleaseStgMedium
OleDuplicateData
CoFreeUnusedLibraries
CoTaskMemAlloc
StringFromGUID2
CoInitialize
CoTaskMemFree
PropVariantClear
CoCreateInstance
OleSetContainedObject
OleCreate
CoUninitialize
CoRevokeClassObject
CoRegisterMessageFilter
OleTranslateAccelerator

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringLen
SysStringLen
VariantChangeType
OleCreatePropertyFrame
SafeArrayDestroy
VariantInit
SysFreeString
VariantCopy
VarBstrFromDate
LoadTypeLi
OleCreateFontIndirect
SysAllocString
VariantClear

oledlg

OleUIBusyW

urlmon

CoInternetCombineUrl

gdiplus

GdipSetPenStartCap
GdipSetPenEndCap
GdipDrawLineI
GdipCreateAdjustableArrowCap
GdipDeleteCustomLineCap
GdipSetPenCustomEndCap
GdipDrawRectangleI
GdipFillEllipse
GdipGetDC
GdipCreateFontFromDC
GdipCreateFontFromLogfontW
GdipReleaseDC
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdiplusShutdown
GdipCreateFromHDC
GdipDrawEllipseI
GdipGetDpiX
GdipAddPathArcI
GdipSetClipPath
GdipDrawImageI
GdipFillEllipseI
GdipCreateRegion
GdipAddPathRectangleI
GdipCreateRegionRectI
GdipCombineRegionRectI
GdipFillRegion
GdipSetPenWidth
GdipSetPenDashArray
GdipSetEmpty
GdipCombineRegionRegion
GdipSetCompositingMode
GdipDrawImageRectI
GdipSetPenMode
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromHBITMAP
GdipSetInterpolationMode
GdipDeletePen
GdipAddPathLineI
GdipDeletePath
GdipCreatePath
GdipBitmapUnlockBits
GdipCreatePen1
GdipSetSmoothingMode
GdipSetClipRegion
GdipGetImageWidth
GdipDeleteRegion
GdipCreateRegionPath
GdipBitmapLockBits
GdipFlush
GdipGetImageHeight
GdipFillRectangleI
GdiplusStartup
GdipResetClip
GdipSetClipRectI
GdipDrawString
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipSetTextRenderingHint
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipGraphicsClear
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCloneImage
GdipAlloc
GdipImageRotateFlip
GdipClosePathFigure
GdipDisposeImage
GdipFree
GdipAddPathEllipseI

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

pdh

PdhOpenQueryW
PdhRemoveCounter
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhAddCounterW

wininet

InternetSetCookieW
HttpOpenRequestA
HttpEndRequestW
InternetWriteFile
HttpSendRequestExW
HttpAddRequestHeadersW
InternetConnectA
InternetCrackUrlA
InternetCreateUrlW
InternetQueryOptionW
HttpOpenRequestW
InternetConnectW
InternetCrackUrlW
InternetCloseHandle
InternetReadFile
InternetQueryDataAvailable
HttpQueryInfoW
InternetOpenUrlW
InternetSetOptionW
InternetOpenW
HttpSendRequestW
InternetCanonicalizeUrlW

dwmapi

DwmGetWindowAttribute

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CertGetNameStringW
CryptMsgGetParam
CryptQueryObject
CryptDecodeObject

httpapi

HttpCreateHttpHandle
HttpAddUrl
HttpRemoveUrl
HttpTerminate
HttpReceiveHttpRequest
HttpSendHttpResponse
HttpInitialize

propsys

PropVariantToString

psapi

EnumProcessModules
GetModuleFileNameExW

winmm

timeEndPeriod
timeSetEvent
waveOutSetVolume
timeBeginPeriod
timeKillEvent
PlaySoundW

msvfw32

ICInfo
ICOpen
ICClose
ICGetInfo
ICSendMessage

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

Exports

Exports

�/ol�=f4��/Q4 �V_)��0�:��-o�V��V ��MmN.z}A��Cl��H�`�i��T|韧��ؠ�+��]�R��o��{8li�d�=N��>��YBd &:Π0��o��~�US��*�� ٥d�{��.�׋�ko��K:�f6�&��i{��ڷ�� Gž�+|pm�@äXX�Ѩ�vݶ0��4�5wL7Rb�>釞��w��=��$E�ͬ�SM8Η(�G�%9Ӏ}W�c�UmB��~a]c�F�Y��~�}�s�S�v_�ծEUH�+��gE� X��-��$�;��ʁ/�|��d˜� ͓y��+��,��}�cdY-�sK��$��2C�k`�ݲ�kK��'zZJ�o��W�,�pU�⓱�#Ό��|Ē��/�{��958��Eȩ$�̭�(��DN��OR!��I� j ��G��*�䏏摕��{/ɲ��cD��rgGƙ�O�t�S{��;�E��Nշ6i��T�$�� .��=r��1��fI��7��T�X`�ݸ�� `(Ѥ��:m�� f"U��PO.iQ�9rK�~��üL*pYT��E��y��j�FԤZ��߬�_�}�ǲT�P��n�49��w�s�U�b��s�#� b�D �ؑ�=�l�}��E.��0�V��db��Y߬�Rf~M�M"ؓ��NN��^vuZ(�_��1��[�_�YA�~�:3Q hL+s�� $f�&��d��J�v��4��h��>֗t�k��k��M�1]��" ��5n�`+:Mu�#�G�C6�>�8�A��t )�Pٯl�7� ��׵�P�U��I�&.Y��k"�N��m��16iP��P��c��[�pPuW�N&��im�q��|�ň�@|�NەR��^��8r��bєӐ��Cκ;�CLfR�m��f��5Z�m"�>��T��m�__��'��eC�V�1��|R��?�8��ג6:�fA*��3Hީ ]�&A~��!-�!��wE��!$��4~�*�JA��a�u�S7�[ܞG�T�Z"F��o��X"��(��=l4DZ�y�k��N}-��$K=��ڄb�=]� !�7��/~��}��nq��$#)�B�!O��۶�&��iψ[m�١hYM�p��q,�p^�+��s�T4�`cA�Δw��#��1��6��A��j�gP��A��h��:�>w:R/�`26pk9W��K,K��=��4>��h�ss,��05؁.� *��E��l�[�R��]?ItC�$��ϫ��a�J��ˊ�1k`�Ym��1��h��Oq/��툃��w��ߘ.��.�_�'۫��%�)K��<��<\0f��=1��z��2. tp��h��R�(�Y�H��/�$�^�}�@�~q�+��do4��ʦ!j=��F��HA�ݳlL-��҄�e��6��U�U��!n]C�3�y��~C��1��9�ɐQ��ih��s89cN�pwQ�v�r^��d՗P�"�ԁT��,T��,V��6�Vz��1�{�Լk�i�[(��IFRv�lEߡ󞿦;S0|��g�-W65�1�gKY�� "n�,T�M6�%]�C�/��׼ڹJ�ҡB�ބ�9R�KD� ;��YiJַt��)�K( l�0�"v&F��azIk��2e/P��H�u��;s��h��x�6�^,��v\��`qEiU�N�b Ʊ�7�Ѣ��7v� e��S:��_�Ar"�1��m��}��!�G��d˭OB#��` ��jRty��hIu�;�E�9c��Gt�Y�~��rm?E[�R�ɀ�OV�ÉV[t��iݿk��3+#^�-�<��?�U��:Hn��k��u�� eB�i��0W�0f�Z��뤽��k�d뼵�aB}]��6U�7~i�+��8%8�>N۳A�0{�|,��U+?� M��G��KP�HLA=^�kZ��4WR��e ��e~��U$�5��BI5�mw�[;;�$��_Z�U�*��k�Cg�&!А�<�p��飣�Q��V&��D�@�{��R:�u�{�#��vXQL�;�!`��ܻ��]��s��T��]g��t3��HBzב�/|��8K7r0��z�[[k>��/�o�R��"�^j�*ǳ�(`�z�a�.�"�M�7��%��m��K��[�ӴD0طl�XF��]��*�}��+��k�Gf��W0I,�|)J�*�� `X%qE�j4��V�8J�5F�!͏��K�Q�Ƞ%\��`��$�=�FQS��#��x ��lTA�OyQ�~��E�>�4�K�5rP{�x�4�u��3��;�$�+K��H��U��R�)KP��U9�V��F�5QW��|i�:�;b-��Cφ��N��>۵��S��;_�Ÿ�i�T�iZ[��-�.A�/��988+j��]oKp��tx�z�u&1X�f��Ywrhߋ�i�; �\M��,y��@6��[ԟ~��@��ŷ��6��v�o�.��?y=��V��G�m�� U5�^E�P�� ρ��kj�V�*�� 6�� `mf��Yj*Kܾ;�A��s��vb$jex'Л�ab�oaa�3�L%(�� &�,��e�.�.N��n�Ke�e]�&"S�ϸ�)v5�-�� yK�M��K�I��ת�u/nm ��"�~hx��6��C��Bt/�'��y�2t�J�/��\�}0��r�$��/<q{]��e ��J_l��<if��T��#7ek�i�q梷��.m/r&��^�\kRN@�B�@b{@XS~A=Y�!� at7U��G�!��]0L��>I��ƎrB�Z�3gjr.�=Z�xls��a�

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 374KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.BANDISH
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BANDI0
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.BANDI1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BANDI2
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 769KB - Virtual size: 768KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

63d58fc3d91db80a5deb5a78d19f3606

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0d:26:1c:84:70:ad:bb:65:80:0c:ea:f3:ea:c7:08:19Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0d:26:1c:84:70:ad:bb:65:80:0c:ea:f3:ea:c7:08:19Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

49:af:68:75:14:a4:9a:9f:ba:ed:3d:36:ce:73:cf:3d:87:48:22:00:3f:06:68:18:11:49:d5:1a:11:95:a3:e8Signer

0a:4d:b5:6b:dc:a9:42:30:10:fa:dd:a3:85:a8:fd:79:b4:3a:16:b6Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

urlmon

gdiplus

version

pdh

wininet

dwmapi

crypt32

httpapi

propsys

psapi

winmm

msvfw32

oleacc

imm32

Exports

Exports

Sections

.text Size: 4.0MB - Virtual size: 4.0MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 374KB - Virtual size: 416KB

.pdata Size: 168KB - Virtual size: 167KB

_RDATA Size: 512B - Virtual size: 244B

.BANDISH Size: 512B - Virtual size: 24B

.BANDI0 Size: 4.2MB - Virtual size: 4.2MB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:26:1c:84:70:ad:bb:65:80:0c:ea:f3:ea:c7:08:19
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:26:1c:84:70:ad:bb:65:80:0c:ea:f3:ea:c7:08:19
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

49:af:68:75:14:a4:9a:9f:ba:ed:3d:36:ce:73:cf:3d:87:48:22:00:3f:06:68:18:11:49:d5:1a:11:95:a3:e8
Signer

0a:4d:b5:6b:dc:a9:42:30:10:fa:dd:a3:85:a8:fd:79:b4:3a:16:b6
Signer

.text
Size: 4.0MB - Virtual size: 4.0MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 374KB - Virtual size: 416KB

.pdata
Size: 168KB - Virtual size: 167KB

_RDATA
Size: 512B - Virtual size: 244B

.BANDISH
Size: 512B - Virtual size: 24B

.BANDI0
Size: 4.2MB - Virtual size: 4.2MB

.BANDI1
Size: 8KB - Virtual size: 8KB

.BANDI2
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 98KB - Virtual size: 97KB

.rsrc
Size: 769KB - Virtual size: 768KB