PhotoScissors_9[.]2[.]1___Crack[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

PhotoScissors_9.2.1___Crack.zip
Size

179.6MB
MD5

e247e09393a26d779744d25279d16226
SHA1

1f37cb31063e579a4b462d87294e644d7199dd6f
SHA256

ac04a26b6cf5fde6a1395481233436d755bef7cd67210f1e859c16a8ce729ef2
SHA512

af71c7b100234d61959a52607228fbc5795152aa74b636f15e9aed5e51159a97f6220f5232e745fc387e615b3d050aac4877addf9a1b28ba388cd034020cc88b
SSDEEP

3145728:TVyoVZJ5Fmw16ihxB6Lvw7mhp2PChFjIH2dlIGM2T6H53ZfBs0DkyfyLTSy2:TnZj9n6GmLpfkH2rIG3mH5pfBs5AyLTG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/PhotoScissors.exe

Files

PhotoScissors_9.2.1___Crack.zip
.zip
Crack/Crack.zip
.zip
PhotoScissors.exe
.exe windows:6 windows x64 arch:x64

f4a4a861d36a670b84d4c9878c3caed7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetEnvironmentVariableA
FindNextChangeNotification
FindFirstChangeNotificationW
GetModuleFileNameA
WriteConsoleW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapSize
HeapReAlloc
GetFileSizeEx
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
HeapFree
HeapAlloc
SetEnvironmentVariableW
SetConsoleCtrlHandler
SetStdHandle
SetFileAttributesW
GetConsoleOutputCP
GetCommandLineA
ExitThread
ExitProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
RtlUnwind
RtlUnwindEx
CreateTimerQueue
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
FindCloseChangeNotification
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
LoadLibraryExW
InitializeCriticalSection
GetThreadTimes
InitializeSListHead
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetLocaleInfoEx
LCMapStringEx
DecodePointer
EncodePointer
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CreateMutexW
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceComplete
InitOnceBeginInitialize
GetStringTypeW
InitOnceExecuteOnce
RaiseException
RtlPcToFileHeader
FormatMessageA
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeSRWLock
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetLastError
SetConsoleMode
ReadConsoleW
ReadConsoleA
GetConsoleMode
GetEnvironmentVariableW
GlobalMemoryStatus
GetTickCount
ConvertThreadToFiber
ConvertFiberToThread
GetSystemTimeAsFileTime
CreateFiber
DeleteFiber
SwitchToFiber
GetStdHandle
SetHandleInformation
GlobalFree
LocalAlloc
GetUserGeoID
GetGeoInfoW
GetTimeZoneInformation
FindNextFileW
FindFirstFileExW
GetModuleHandleExW
MultiByteToWideChar
RegisterWaitForSingleObject
UnregisterWaitEx
SetFilePointerEx
SetEndOfFile
GetVolumeInformationW
GetFileType
GetDriveTypeW
FlushFileBuffers
GetModuleFileNameW
GetFileInformationByHandleEx
SystemTimeToFileTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
MoveFileExW
MoveFileW
CopyFileW
DeviceIoControl
SetErrorMode
GetVolumePathNamesForVolumeNameW
GetTempPathW
SetFileTime
RemoveDirectoryW
GetLongPathNameW
GetLogicalDrives
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesW
FindFirstFileW
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
GetLocalTime
GetSystemTime
GetFileAttributesExW
GetUserPreferredUILanguages
GetUserDefaultLCID
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
ResetEvent
GetSystemDirectoryW
WaitForSingleObjectEx
IsProcessorFeaturePresent
TerminateProcess
OutputDebugStringW
GetConsoleWindow
GetStartupInfoW
GetCommandLineW
GetSystemInfo
FreeLibraryWhenCallbackReturns
CreateDirectoryA
GetFileAttributesA
GetFinalPathNameByHandleW
CreateFile2
ReleaseMutex
FreeLibraryAndExitThread
DebugBreak
GetLogicalProcessorInformationEx
SetThreadGroupAffinity
GetSystemTimePreciseAsFileTime
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForSingleObject
LoadLibraryA
GetModuleHandleA
FindNextFileA
FindFirstFileExA
FindClose
LoadLibraryW
GetProcAddress
FreeLibrary
Sleep
GetLastError
CloseHandle
UnlockFileEx
LockFileEx
GetFileAttributesExA
CreateFileA
GetNativeSystemInfo
GetExitCodeProcess
GetCurrentProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathA
CreateThread
QueryDepthSList
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
TerminateThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
SwitchToThread
WaitForMultipleObjects
CreateEventW
SetEvent
DuplicateHandle
GetTickCount64
GetCurrentThreadId
GetModuleHandleW
LocalFree
FormatMessageW
WTSGetActiveConsoleSessionId
ExpandEnvironmentStringsW
CreateProcessW
CheckRemoteDebuggerPresent
OpenProcess
GlobalAlloc
GlobalUnlock
GlobalLock
GetLocaleInfoW
GlobalSize
GetCurrentProcessId
CreateFileW
ReadFile
WriteFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
GetUserDefaultLangID
CompareStringEx
QueryPerformanceCounter
QueryPerformanceFrequency
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

dwmapi

DwmEnableBlurBehindWindow
DwmIsCompositionEnabled

gdi32

GetStockObject
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
GetTextMetricsW
GetTextFaceW
CreateDIBSection
GdiFlush
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetFontData
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW
GetDIBits
CombineRgn
CreateRectRgn
DeleteObject
OffsetRgn
SelectClipRgn
SetLayout
BitBlt
GetDeviceCaps
EnumFontFamiliesExW
CreateFontIndirectW
GetObjectW
GetBitmapBits
SwapBuffers
SetPixelFormat
GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
CreateBitmap
GetCharABCWidthsI
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
DeleteDC

oleaut32

SysAllocString
SafeArrayCreateVector
SafeArrayPutElement

imm32

ImmGetDefaultIMEWnd
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetOpenStatus
ImmGetVirtualKey
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmNotifyIME

winmm

timeSetEvent
timeKillEvent
PlaySoundW

ws2_32

getsockopt
WSASetLastError
send
recv
getnameinfo
WSASendTo
WSASend
WSARecvFrom
WSARecv
WSANtohs
WSANtohl
WSAIoctl
WSAHtonl
WSAConnect
WSAAccept
WSAGetLastError
gethostname
WSAStartup
WSACleanup
freeaddrinfo
WSAAsyncSelect
getaddrinfo
htonl
__WSAFDIsSet
WSASocketW
setsockopt
select
listen
htons
getsockname
getpeername
closesocket
bind
ntohl

ole32

CoCreateInstance
OleIsCurrentClipboard
CoLockObjectExternal
RegisterDragDrop
CoTaskMemFree
OleInitialize
CoGetMalloc
CoCreateGuid
StringFromGUID2
OleGetClipboard
DoDragDrop
RevokeDragDrop
ReleaseStgMedium
OleUninitialize
CoUninitialize
CoInitializeEx
CoInitialize
OleSetClipboard
OleFlushClipboard

user32

KillTimer
SetTimer
MsgWaitForMultipleObjectsEx
GetQueueStatus
DispatchMessageW
TranslateMessage
MessageBoxW
ChangeWindowMessageFilterEx
RealGetWindowClassW
EnumWindows
GetWindowTextW
CloseTouchInputHandle
GetTouchInputInfo
GetAsyncKeyState
GetMessageExtraInfo
TrackMouseEvent
GetClipboardFormatNameW
EnumDisplayDevicesW
RegisterClassW
GetCursorInfo
GetIconInfo
CreateIconIndirect
CreateCursor
LoadCursorW
GetCursor
SetCursorPos
TrackPopupMenuEx
GetMenu
MapVirtualKeyW
ToUnicode
ToAscii
GetKeyboardState
GetKeyState
IsZoomed
PeekMessageW
FindWindowA
SetCaretPos
ShowCaret
HideCaret
DestroyCaret
CreateCaret
IsWindowEnabled
RegisterWindowMessageW
GetKeyboardLayout
RegisterClipboardFormatW
ChangeClipboardChain
SetClipboardViewer
IsHungAppWindow
LoadIconW
GetSysColor
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromWindow
SetMenuItemInfoW
GetMenuItemInfoW
TrackPopupMenu
RemoveMenu
ModifyMenuW
AppendMenuW
InsertMenuW
DestroyMenu
CreatePopupMenu
SetWindowsHookExW
DrawMenuBar
SetMenu
LoadImageW
GetSysColorBrush
ChildWindowFromPointEx
WindowFromPoint
GetCursorPos
GetFocus
RegisterClassExW
GetClassInfoW
UnregisterClassW
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
GetKeyboardLayoutList
GetAncestor
MonitorFromPoint
DestroyIcon
DestroyCursor
GetWindow
GetWindowThreadProcessId
SetParent
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
ScreenToClient
ClientToScreen
SetCursor
AdjustWindowRectEx
GetWindowRect
GetClientRect
SetWindowTextW
InvalidateRect
SetWindowRgn
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
GetForegroundWindow
EnableMenuItem
GetSystemMenu
GetSystemMetrics
ReleaseCapture
SetCapture
GetCapture
IsTouchWindow
UnregisterTouchWindow
RegisterTouchWindow
SetFocus
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
FlashWindowEx
SetLayeredWindowAttributes
UpdateLayeredWindow
ShowWindow
DestroyWindow
IsChild
CreateWindowExW
DefWindowProcW
AttachThreadInput
PostMessageW
SendMessageW
UpdateLayeredWindowIndirect
SystemParametersInfoW
GetDesktopWindow
GetCaretBlinkTime
MessageBeep
IsWindow
GetDoubleClickTime
UnhookWindowsHookEx
CallNextHookEx
CharNextExA
DrawIconEx
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetProcessWindowStation
GetUserObjectInformationW
CreateMenu

advapi32

AllocateAndInitializeSid
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegNotifyChangeKeyValue
BuildTrusteeWithSidW
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW
LookupAccountSidW
MapGenericMask
GetTokenInformation
GetLengthSid
FreeSid
DuplicateToken
CopySid
AccessCheck
OpenProcessToken
SystemFunction036
RegSetValueExW
RegQueryInfoKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

shell32

SHGetMalloc
SHCreateItemFromParsingName
SHCreateItemFromIDList
SHGetKnownFolderIDList
ord727
SHGetStockIconInfo
SHGetFileInfoW
SHBrowseForFolderW
Shell_NotifyIconW
Shell_NotifyIconGetRect
SHGetPathFromIDListW
SHGetKnownFolderPath
CommandLineToArgvW
ShellExecuteW

iphlpapi

ConvertInterfaceLuidToGuid
GetAdaptersAddresses
ConvertInterfaceNameToLuidW
ConvertInterfaceLuidToIndex
ConvertInterfaceLuidToNameW
ConvertInterfaceIndexToLuid

netapi32

NetApiBufferFree
NetShareEnum

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

userenv

GetUserProfileDirectoryW

crypt32

CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateContext
CertCreateCertificateContext
CertOpenSystemStoreW
CertFindCertificateInStore
CertCloseStore

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathCchRemoveBackslash

Sections

.text
Size: - Virtual size: 22.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 8.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 882KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 884KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: - Virtual size: 693B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.)"Y
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.\N{
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.&V_
Size: 14.7MB - Virtual size: 14.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
HaxNode.Net.url
.url
Read Me.txt
Setup/PhotoScissorsSetup.exe
.exe windows:6 windows x86 arch:x86

5a594319a0d69dbc452e748bcf05892e

Code Sign

36:e5:f8:33:c9:c6:a8:3c:a0:ee:f2:e8:d2:a5:c1:37
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

18/11/2020, 00:00

Not After

17/02/2024, 23:59

Subject

CN=Maxim Gapchenko,O=Maxim Gapchenko,POSTALCODE=445037,STREET=Frunze 10A-105,L=Tolyatti,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:e2:ba:a4:4f:e9:1e:1c:4d:72:70:0b:e1:ee:0b:d8:93:5a:81:2c:5a:f1:b0:9e:34:72:8c:07:83:9a:d9:1a
Signer

Actual PE Digest

4a:e2:ba:a4:4f:e9:1e:1c:4d:72:70:0b:e1:ee:0b:d8:93:5a:81:2c:5a:f1:b0:9e:34:72:8c:07:83:9a:d9:1a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale

comctl32

InitCommonControls

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

user32

CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW

oleaut32

SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate

netapi32

NetWkstaGetInfo
NetApiBufferFree

advapi32

RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 718KB - Virtual size: 717KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 27KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4a4a861d36a670b84d4c9878c3caed7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

wtsapi32

dwmapi

gdi32

oleaut32

imm32

winmm

ws2_32

ole32

user32

advapi32

shell32

iphlpapi

netapi32

version

userenv

crypt32

api-ms-win-core-path-l1-1-0

Sections

.text Size: - Virtual size: 22.4MB

.rdata Size: - Virtual size: 8.0MB

.data Size: - Virtual size: 882KB

.pdata Size: - Virtual size: 884KB

.qtmetad Size: - Virtual size: 693B

_RDATA Size: - Virtual size: 3KB

.)"Y Size: - Virtual size: 1.3MB

.\N{ Size: 7KB - Virtual size: 6KB

.&V_ Size: 14.7MB - Virtual size: 14.7MB

.reloc Size: 512B - Virtual size: 252B

.rsrc Size: 109KB - Virtual size: 108KB

5a594319a0d69dbc452e748bcf05892e

Code Sign

36:e5:f8:33:c9:c6:a8:3c:a0:ee:f2:e8:d2:a5:c1:37Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

4a:e2:ba:a4:4f:e9:1e:1c:4d:72:70:0b:e1:ee:0b:d8:93:5a:81:2c:5a:f1:b0:9e:34:72:8c:07:83:9a:d9:1aSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

comctl32

version

user32

oleaut32

netapi32

advapi32

Exports

Exports

Sections

.text Size: 718KB - Virtual size: 717KB

.itext Size: 6KB - Virtual size: 5KB

.data Size: 14KB - Virtual size: 13KB

.bss Size: - Virtual size: 27KB

.idata Size: 4KB - Virtual size: 3KB

.didata Size: 512B - Virtual size: 420B

.edata Size: 512B - Virtual size: 154B

.tls Size: - Virtual size: 24B

.rdata Size: 512B - Virtual size: 93B

.text
Size: - Virtual size: 22.4MB

.rdata
Size: - Virtual size: 8.0MB

.data
Size: - Virtual size: 882KB

.pdata
Size: - Virtual size: 884KB

.qtmetad
Size: - Virtual size: 693B

_RDATA
Size: - Virtual size: 3KB

.)"Y
Size: - Virtual size: 1.3MB

.\N{
Size: 7KB - Virtual size: 6KB

.&V_
Size: 14.7MB - Virtual size: 14.7MB

.reloc
Size: 512B - Virtual size: 252B

.rsrc
Size: 109KB - Virtual size: 108KB

36:e5:f8:33:c9:c6:a8:3c:a0:ee:f2:e8:d2:a5:c1:37
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

4a:e2:ba:a4:4f:e9:1e:1c:4d:72:70:0b:e1:ee:0b:d8:93:5a:81:2c:5a:f1:b0:9e:34:72:8c:07:83:9a:d9:1a
Signer

.text
Size: 718KB - Virtual size: 717KB

.itext
Size: 6KB - Virtual size: 5KB

.data
Size: 14KB - Virtual size: 13KB

.bss
Size: - Virtual size: 27KB

.idata
Size: 4KB - Virtual size: 3KB

.didata
Size: 512B - Virtual size: 420B

.edata
Size: 512B - Virtual size: 154B

.tls
Size: - Virtual size: 24B

.rdata
Size: 512B - Virtual size: 93B

.rsrc
Size: 67KB - Virtual size: 67KB