Malware_MSEXE_de1513aba05c8fcd8f26867f7aaf58ccadf45440f2393f91adba16fa2419ea4f[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

Malware_MSEXE_de1513aba05c8fcd8f26867f7aaf58ccadf45440f2393f91adba16fa2419ea4f.zip
Size

44KB
MD5

aef435b9c1d27b68167600ccca656b7c
SHA1

e5fffc7c97cc8b3826a3e1f10fbb35c16048e39e
SHA256

86d59a533ff51fe8b793f38c6d81221f2e4ed3facd516d39fee1487ca0be798e
SHA512

25bd3bd3afeaca2d99d5be89c80fbb4a50fc2a0e1ba5ab31a674fcf824fb2649513cd3d505dbadb0053ea6a10740af4aec3469686e353d2e0be3ef93db954010
SSDEEP

768:HJuW9KkhdO2AyHNqyQl/oveyYzCV4NzjXi8rZ+31uC0nWFPAMFKpJ8:HJ/9zdMVoGyCCUjXiUK8C0KFKw

Score

1^/10

Malware Config

Signatures

Files

Malware_MSEXE_de1513aba05c8fcd8f26867f7aaf58ccadf45440f2393f91adba16fa2419ea4f.zip
.zip

Password: infected
Malware_MSEXE_de1513aba05c8fcd8f26867f7aaf58ccadf45440f2393f91adba16fa2419ea4f
.exe windows:6 windows x64 arch:x64

2c956b36f42839519961a3a60e8a42cb

Code Sign

0a:3d:2d:f5:02:51:04:16:9e:00:31:5d:78:df:c8:a4
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

22/10/2019, 00:00

Not After

27/10/2022, 23:59

Subject

CN=ETM professional control GmbH,O=ETM professional control GmbH,L=Eisenstadt,ST=Burgenland,C=AT

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:53:43:27:ac:be:63:25:e9:5a:1b:0a:6c:18:57:85:55:a8:7d:29:26:17:4e:51:1c:4a:54:b5:f0:a7:5b:6f
Signer

Actual PE Digest

01:53:43:27:ac:be:63:25:e9:5a:1b:0a:6c:18:57:85:55:a8:7d:29:26:17:4e:51:1c:4a:54:b5:f0:a7:5b:6f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\work\WinCCOA\build\windows-64\build\bin\WCCILdist.pdb

Imports

libmanagerv317

??0HotLinkWaitForAnswer@@QEAA@XZ
??1HotLinkWaitForAnswer@@UEAA@XZ
?sigHdl@Manager@@SAXH@Z
??1Manager@@UEAA@XZ
?dpSet@Manager@@SAIAEBVDpIdentifier@@AEBVVariable@@AEBVManagerIdentifier@@PEAVWaitForAnswer@@I@Z
?dpSet@Manager@@SAIAEBVDpIdValueList@@AEBVManagerIdentifier@@PEAVWaitForAnswer@@I@Z
?dpConnect@Manager@@SAIAEBVDpIdentifier@@AEBVManagerIdentifier@@PEAVWaitForAnswer@@I@Z
?getId@Manager@@SAIPEBDAEAVDpIdentifier@@@Z
?installServer@Manager@@SAXH@Z
?dispatch@Manager@@SAXXZ
?dispatch@Manager@@SAXAEAJ0@Z
??0Manager@@QEAA@AEBVManagerIdentifier@@@Z
?isEvConnOpen@Manager@@SAIXZ
?isConnOpen@Manager@@SAIAEBVManagerIdentifier@@@Z
?abortConnection@Manager@@SAIAEBVManagerIdentifier@@@Z
?closeConnection@Manager@@SAIAEBVManagerIdentifier@@@Z
?send@Manager@@SAIAEAVMsg@@@Z
?send@Manager@@SAIAEAVSysMsg@@@Z
?send@Manager@@SAIAEAVSysMsg@@AEBVManagerIdentifier@@@Z
?send@Manager@@SAIAEAVDpMsg@@PEAVWaitForAnswer@@I@Z
?send@Manager@@SAIAEAVDpMsg@@AEBVManagerIdentifier@@PEAVWaitForAnswer@@I@Z
?getFirstConnection@Manager@@SAPEAVManagerIdentifier@@XZ
?getNextConnection@Manager@@SAPEAVManagerIdentifier@@XZ
?reportStatus@Manager@@UEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?prefixConnectFromServer@Manager@@UEAAIAEAVManagerIdentifier@@0@Z
?connectToData@Manager@@KAIEPEBW4DpConfigNrType@@I@Z
?connectToEvent@Manager@@KAII@Z
?handleManagerConnect@Manager@@MEAAXAEBVManagerIdentifier@@I@Z
?addCheckedManager@Manager@@IEAAIAEBVCharString@@GAEBVManagerIdentifier@@1@Z
?doReceive@Manager@@MEAAXPEAVDpMsg@@@Z
?doReceive@Manager@@MEAAXAEAVDpMsg@@@Z
?doReceive@Manager@@MEAAXPEAVSysMsg@@@Z
?doReceive@Manager@@MEAAXAEAVSysMsg@@@Z
?doRefresh@Manager@@MEAAXAEBVManagerIdentifier@@@Z
?handleInitToken@Manager@@MEAAIAEBVManagerIdentifier@@AEBVCharString@@1@Z
?addInitToken@Manager@@MEAAXAEBVManagerIdentifier@@AEAVInitSysMsg@@@Z
?instance@MsgItcDispatcher@@SAPEAV1@XZ
?isConnOpen@MsgItcDispatcher@@QEBAIAEBVManagerIdentifier@@@Z
?getVersion@MsgItcDispatcher@@QEBAIAEBVManagerIdentifier@@AEAG@Z
?dpIdentificationPtr@Manager@@0PEAVDpIdentification@@EA
?manPtr@Manager@@0PEAV1@EA
?managerState@Manager@@1W4ManagerState@1@A
?dataId@Manager@@2VManagerIdentifier@@A
?eventId@Manager@@2VManagerIdentifier@@A
?useServerTime@Manager@@MEAA_NXZ
?setupSystem@Manager@@UEBAIAEAVMsg@@@Z
?reduSwitchManagerStateLogic@Manager@@UEAAXAEBVManagerIdentifier@@I@Z
?reduSwitchConnectionStateLogic@Manager@@UEAAXAEBVManagerIdentifier@@I@Z
?reduSendMsgLogic@Manager@@UEAAIAEBVManagerIdentifier@@AEBVMsg@@@Z
?reduRecvMsgLogic@Manager@@UEAAIAEBVManagerIdentifier@@AEBVMsg@@@Z
?prefixConnectFromServer@Manager@@UEAAIAEAVManagerIdentifier@@0AEBVInitSysMsg@@AEAVErrClass@@@Z
?prefixConnectFromServer@Manager@@UEAAIAEAVManagerIdentifier@@0AEBVInitSysMsg@@@Z
?prefixConnectFromClient@Manager@@UEAAIAEAVManagerIdentifier@@0@Z
?notifyFileList@Manager@@UEAAIAEBVManagerIdentifier@@AEBVDynVar@@1@Z
?newDiagWaitObject@Manager@@UEAAPEAVHotLinkWaitForAnswer@@AEAVDiagItcIOHandler@@@Z
?needRefresh@WaitForAnswer@@UEAAIPEAVDpMsg@@@Z
?loopHook@Manager@@UEAAXXZ
?isEvInitialized@Manager@@UEAAIXZ
?isAuthorizedToConnect@Manager@@UEAAIAEBVManagerIdentifier@@AEBVCharString@@AEBVDynVar@@AEAG@Z
?isA@HotLinkWaitForAnswer@@UEAA?AW4answerType@WaitForAnswer@@XZ
?hotLinkCallBack@HotLinkWaitForAnswer@@UEAAXAEBVDpMsg@@AEAVDpHLGroup@@@Z
?handleShutDownReceived@Manager@@MEAAXAEBVManagerIdentifier@@AEBVErrClass@@@Z
?handleNameServerSysMsg@Manager@@MEAAIAEBVNameServerSysMsg@@@Z
?handleManagerUpdate@Manager@@MEAAXAEBVManagerIdentifier@@I@Z
?handleFileTransferSysMsg@Manager@@MEAAXAEAVFileTransferSysMsg@@@Z
?handleBCMBufferOverflow@Manager@@UEAAIAEBVManagerIdentifier@@@Z
?getUserDefinedType@WaitForAnswer@@UEAAIXZ
?getAttribut@Manager@@UEBAPEAVVariable@@AEBVDpIdentifier@@I@Z
?dpTypeDoomed@Manager@@MEAAXVSystemNumType@@F@Z
?dpTypeDeleted@Manager@@MEAAXVSystemNumType@@F@Z
?dpTypeCreated@Manager@@MEAAXVSystemNumType@@AEBVDpType@@@Z
?dpTypeChanged@Manager@@MEAAXVSystemNumType@@AEBVDpType@@@Z
?dpRenamed@Manager@@MEAAXVSystemNumType@@AEBVCharString@@AEBVDpIdentifier@@@Z
?dpDeleted@Manager@@MEAAXVSystemNumType@@I@Z
?dpCreated@Manager@@MEAAXVSystemNumType@@AEBVCharString@@AEBVDpIdentifier@@@Z
?doSystemDisconnect@Manager@@MEAAXVSystemNumType@@@Z
?doInitConfig@Manager@@MEBAXPEBVDpICGroup@@PEBVDpConfig@@@Z
?doHandleNoCallBackAnswer@Manager@@EEAAXPEAVDpMsgAnswer@@@Z
?doConnectionClose@Manager@@MEAAXAEBVManagerIdentifier@@@Z
?checkConnections@Manager@@MEAAIXZ
?callBack@HotLinkWaitForAnswer@@UEAAXAEAVDpMsgAnswer@@@Z
?getSendBufferLength@MsgItcDispatcher@@QEAAHAEBVManagerIdentifier@@@Z
?getConnectionState@MsgItcDispatcher@@QEBAIAEBVManagerIdentifier@@@Z
?getManagerState@MsgItcDispatcher@@QEBAIAEBVManagerIdentifier@@@Z
?exit@Manager@@SAXH@Z

libmessagesv317

?getNewMsgId@Msg@@QEAAXXZ
?getOriginTime@Msg@@QEBA?AVTimeVar@@XZ
?routeMsg@Msg@@QEAAXAEBVManagerIdentifier@@@Z
?redirectMsg@Msg@@QEAAXAEBVManagerIdentifier@@@Z
?forwardMsg@Msg@@QEAAXAEBVManagerIdentifier@@@Z
??0SysMsg@@QEAA@AEBVManagerIdentifier@@W4SysMsgType@@E@Z
??1SysMsg@@UEAA@XZ
?allocate@DpMsg@@SAPEAV1@W4MsgType@@@Z
?getNext@?$DynPtrArray@VAnswerItem@@@@QEBAPEAVAnswerItem@@XZ
?getFirstItem@AnswerGroup@@QEBAPEAVAnswerItem@@XZ
??0DpMsgAnswer@@QEAA@AEBVDpMsg@@@Z
??1DpMsgAnswer@@UEAA@XZ
?insertGroup@DpMsgAnswer@@QEAAIPEAVErrClass@@@Z
??0StartDpInitSysMsg@@QEAA@XZ
??0StartDpInitSysMsg@@QEAA@AEBVManagerIdentifier@@IPEBW4DpConfigNrType@@@Z
??1StartDpInitSysMsg@@UEAA@XZ
?getTimestamps@StartDpInitSysMsg@@QEBAPEBVMappingVar@@XZ
?getTimestamp@StartDpInitSysMsg@@QEBA_KVSystemNumType@@@Z
?getMsgName@Msg@@SAPEBDW4MsgType@@@Z
?addData@InitSysMsg@@QEAAXAEBVCharString@@0@Z
??0DpMsgTypeContainer@@QEAA@XZ
??0DpMsgTypeContainer@@QEAA@AEBVManagerIdentifier@@@Z
??1DpMsgTypeContainer@@UEAA@XZ
?getDpId@DpMsgManipDp@@QEBAAEBVDpIdentifier@@XZ
??1DpMsgManipDp@@UEAA@XZ
?setTypeContainer@DpMsgTypeContainer@@QEAAXPEAVDpTypeContainer@@@Z
??0DpMsgIdentification@@QEAA@XZ
??0DpMsgIdentification@@QEAA@AEBVManagerIdentifier@@@Z
??1DpMsgIdentification@@UEAA@XZ
?getTimestamp@DpMsgIdentification@@QEBA_KVSystemNumType@@@Z
?setIdentification@DpMsgIdentification@@QEAAXPEAVDpIdentification@@@Z
?inflateIdentification@DpMsgIdentification@@AEAA_NXZ
??0DpMsgManipDp@@QEAA@AEBVDpIdentifier@@AEBVCharString@@I@Z
??0DpMsgManipDp@@QEAA@AEBVDpIdentifier@@I@Z
?setTimestamp@StartDpInitSysMsg@@QEAAXVSystemNumType@@_K@Z

libdatapointv317

?remove@DpIdentification@@QEAA_NI@Z
?numberOfDpIdentifications@DpIdentification@@QEAAKXZ
?getAt@DpIdentification@@QEAAAEAVDpIdentificationProSystem@@I@Z
?getDefaultSystem@DpIdentification@@SA?AVSystemNumType@@XZ
?getTimestamp@DpIdentification@@QEBA_KVSystemNumType@@@Z
?typeContArray@DpTypeContainer@@0V?$SimplePtrArray@VDpTypeContainer@@V?$SimpleStorage@VDpTypeContainer@@@@@@A

libbasicsv317

?addVersionInfo@Resources@@0VCharString@@A
?remoteSysUsesUTF8Enc@Resources@@0VBitVec@@A
?generateMXProxyEntries@Resources@@0_NA
?enforceAccessControl@Resources@@0IA
?requestedCNSViews_@Resources@@1VCharString@@A
?refuseCNS_@Resources@@1_NA
?proxyPort@Resources@@1GA
?getKeyWord@Resources@@KAAEBVCharString@@XZ
?getCfgState@Resources@@KA?AW4CfgState@1@XZ
?unknownKeyWordError@Resources@@KAXXZ
?setCfgError@Resources@@KAXXZ
?getCfgStream@Resources@@KAAEAV?$basic_istream@DU?$char_traits@D@std@@@std@@XZ
?getNextEntry@Resources@@KAXXZ
?printHelpReport@Resources@@SAXXZ
?printHelpDbg@Resources@@SAXXZ
?printHelp@Resources@@SAXXZ
?readGeneralKeyWords@Resources@@SAII@Z
?end@Resources@@SAXAEAHQEAPEAD@Z
?generalSection@Resources@@SAIXZ
?error@ErrHdl@@SAXW4ErrPrio@ErrClass@@W4ErrType@3@IPEBD22@Z
?helpFlag@Resources@@1IA
?helpDbgFlag@Resources@@1IA
?helpReportFlag@Resources@@1IA
?distributed@Resources@@0IA
??0Codepoint@@QEAA@K@Z
?alloc@Allocator@@QEAAPEAX_K@Z
??0CharString@@QEAA@XZ
??0CharString@@QEAA@AEBV0@@Z
??0CharString@@QEAA@PEBD_K@Z
??0CharString@@QEAA@_K@Z
??1CharString@@QEAA@XZ
??4CharString@@QEAAAEBV0@AEBV0@@Z
??8CharString@@QEBAHPEBD@Z
??ACharString@@QEAAAEAD_K@Z
??H@YA?AVCharString@@AEBV0@0@Z
??H@YA?AVCharString@@AEBV0@PEBD@Z
??H@YA?AVCharString@@PEBDAEBV0@@Z
?format@CharString@@QEAAXPEBDZZ
?icmp@CharString@@QEBAHPEBD@Z
?setCharStr@CharString@@QEAAXPEBD_K@Z
?getLogString@ManagerIdentifier@@QEBA?AVCharString@@XZ
??6@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AEAV01@AEBVManagerIdentifier@@@Z
??8ManagerIdentifier@@QEBAHAEBV0@@Z
?getReplica@ManagerIdentifier@@QEBAEXZ
?setReplica@ManagerIdentifier@@QEAAXE@Z
?toggleReplica@ManagerIdentifier@@QEAAXXZ
??0DpIdentifier@@QEAA@XZ
??1DpIdentifier@@UEAA@XZ
?compare@DpIdentifier@@QEBAHAEBV1@G@Z
?isA@Variable@@QEBA?AW4VariableType@@XZ
??0DynVar@@QEAA@W4VariableType@@@Z
??1DynVar@@UEAA@XZ
??3DynVar@@SAXPEAX@Z
?append@DynVar@@QEAAIPEAVVariable@@@Z
??HPVSSTime@@QEBA?AV0@AEBV0@@Z
??6@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AEAV01@AEBVPVSSTime@@@Z
??0TimeVar@@QEAA@XZ
??0TimeVar@@QEAA@AEBVPVSSTime@@@Z
??3TimeVar@@SAXPEAX@Z
??1TimeVar@@UEAA@XZ
??0TextVar@@QEAA@AEBVCharString@@@Z
??1TextVar@@UEAA@XZ
??0ErrClass@@QEAA@W4ErrPrio@0@W4ErrType@0@PEBDIAEBVManagerIdentifier@@222@Z
??0ErrClass@@QEAA@W4ErrPrio@0@W4ErrType@0@IAEBVManagerIdentifier@@PEBD33@Z
??1ErrClass@@UEAA@XZ
?error@ErrHdl@@SAXAEBVErrClass@@@Z
?error@ErrHdl@@SAXW4ErrPrio@ErrClass@@W4ErrType@3@PEBDI222222222@Z
?error@ErrHdl@@SAXW4ErrPrio@ErrClass@@W4ErrType@3@IAEBVDpIdentifier@@AEBVManagerIdentifier@@GPEBD44@Z
??0DpIdValueList@@QEAA@XZ
??1DpIdValueList@@UEAA@XZ
?appendItem@DpIdValueList@@UEAAIAEBVDpIdentifier@@AEBVVariable@@@Z
?appendItem@DpIdValueList@@UEAAIAEBVDpIdentifier@@PEAVVariable@@@Z
?isLogFlagCerr@DebugOutput@@YA_NXZ
?isDbgFlag@DebugOutput@@YA_NF@Z
?registerDbgFlag@DebugOutput@@YAFAEBVCharString@@PEBD@Z
?getDbgFlagName@DebugOutput@@YA?AVCharString@@F@Z
?isReportFlag@DebugOutput@@YA_NAEBVCharString@@@Z
??0UIntegerVar@@QEAA@I@Z
??3UIntegerVar@@SAXPEAX@Z
??1UIntegerVar@@UEAA@XZ
?getProgNameAndTime@Resources@@SA?AVCharString@@XZ
?holdDpIdentification@Resources@@SAIVSystemNumType@@@Z
??0DblPtrList@@QEAA@XZ
??1DblPtrList@@UEAA@XZ
?append@DblPtrList@@QEAAXPEAVDblPtrListItem@@@Z
?cutFirst@DblPtrList@@QEAAPEAVDblPtrListItem@@XZ
??0StringToken@@QEAA@PEBDVCodepoint@@@Z
??0StringToken@@QEAA@AEBVCharString@@VCodepoint@@@Z
?getFirst@StringToken@@QEAA?AVCharString@@XZ
?getNext@StringToken@@QEAA?AVCharString@@XZ
??4DynVar@@UEAAAEAV0@AEBV0@@Z
??4DynVar@@UEAAAEAVVariable@@AEBV1@@Z
??4TimeVar@@UEAAAEAVVariable@@AEBV1@@Z
??4UIntegerVar@@UEAAAEAVVariable@@AEBV1@@Z
??8DynVar@@UEBAHAEBVVariable@@@Z
??8TimeVar@@UEBAHAEBVVariable@@@Z
??8UIntegerVar@@UEBAHAEBVVariable@@@Z
??MTimeVar@@UEBAHAEBVVariable@@@Z
??MUIntegerVar@@UEBAHAEBVVariable@@@Z
??MVariable@@UEBAHAEBV0@@Z
??OTimeVar@@UEBAHAEBVVariable@@@Z
??OUIntegerVar@@UEBAHAEBVVariable@@@Z
??OVariable@@UEBAHAEBV0@@Z
?allocate@DynVar@@UEBAPEAVVariable@@XZ
?allocate@TimeVar@@UEBAPEAVVariable@@XZ
?allocate@UIntegerVar@@UEBAPEAVVariable@@XZ
?clone@DynVar@@UEBAPEAVVariable@@XZ
?clone@TimeVar@@UEBAPEAVVariable@@XZ
?clone@UIntegerVar@@UEBAPEAVVariable@@XZ
?convert@DynVar@@UEBA?AW4ConvertResult@Variable@@W4VariableType@@AEAPEAV3@@Z
?convert@TimeVar@@UEBA?AW4ConvertResult@Variable@@W4VariableType@@AEAPEAV3@@Z
?convert@UIntegerVar@@UEBA?AW4ConvertResult@Variable@@W4VariableType@@AEAPEAV3@@Z
?debug@DynVar@@UEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@H@Z
?debug@TimeVar@@UEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@H@Z
?debug@Variable@@UEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@H@Z
?formatValue@DynVar@@UEBA?AVCharString@@AEBV2@@Z
?formatValue@DynVar@@UEBAHAEBVCharString@@PEAD_K@Z
?formatValue@TimeVar@@UEBA?AVCharString@@AEBV2@@Z
?formatValue@TimeVar@@UEBAHAEBVCharString@@PEAD_K@Z
?formatValue@UIntegerVar@@UEBA?AVCharString@@AEBV2@@Z
?formatValue@UIntegerVar@@UEBAHAEBVCharString@@PEAD_K@Z
?getTarget@Variable@@UEBAPEAV1@XZ
?inFromFile@DynVar@@UEAAXAEAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z
?inFromFile@TimeVar@@UEAAXAEAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z
?inFromFile@UIntegerVar@@UEAAXAEAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z
?inNdrUb@DynVar@@UEAAXAEAVitcNdrUbReceive@@@Z
?inNdrUb@TimeVar@@UEAAXAEAVitcNdrUbReceive@@@Z
?inNdrUb@UIntegerVar@@EEAAXAEAVitcNdrUbReceive@@@Z
?isA@ErrClass@@UEBA?AW4ErrType@1@XZ
?isAUncached@DynVar@@UEBA?AW4VariableType@@W42@@Z
?isAUncached@DynVar@@UEBA?AW4VariableType@@XZ
?isAUncached@TimeVar@@UEBA?AW4VariableType@@W42@@Z
?isAUncached@TimeVar@@UEBA?AW4VariableType@@XZ
?isAUncached@UIntegerVar@@UEBA?AW4VariableType@@W42@@Z
?isAUncached@UIntegerVar@@UEBA?AW4VariableType@@XZ
?isDynDynVar@DynVar@@UEBAIXZ
?isDynDynVar@Variable@@UEBAIXZ
?isDynVar@DynVar@@UEBAIXZ
?isDynVar@Variable@@UEBAIXZ
?isTrue@TimeVar@@UEBAIXZ
?isTrue@UIntegerVar@@UEBAIXZ
?isTrue@Variable@@UEBAIXZ
?outNdrUb@DynVar@@UEBAXAEAVitcNdrUbSend@@@Z
?outNdrUb@TimeVar@@UEBAXAEAVitcNdrUbSend@@@Z
?outNdrUb@UIntegerVar@@EEBAXAEAVitcNdrUbSend@@@Z
?outStream@ErrClass@@UEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?outToFile@DynVar@@UEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?outToFile@TimeVar@@UEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?outToFile@UIntegerVar@@UEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
??_7DpIdentifier@@6B@
?alc@DynVar@@2VAllocator@@A
?alc@TimeVar@@2VAllocator@@A
?alc@UIntegerVar@@2VAllocator@@A
?ownManId@Resources@@1VManagerIdentifier@@A
?bcmBufferLimit@Resources@@1HA
?redundancy@Resources@@0IA
?redActive@Resources@@0IA
?fromUtf8@Codepoint@@QEAA_KPEBD@Z
??3CharString@@SAXPEAX@Z
??0CharString@@QEAA@K@Z
??BCharString@@QEBAPEADXZ
?resetLen@CharString@@QEAAXXZ
??YCharString@@QEAAAEBV0@AEBV0@@Z
??5@YAAEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAV01@AEAVCharString@@@Z
?trim@CharString@@QEAAAEAV1@_N@Z
?tokenize@CharString@@QEBAIAEAV?$vector@VCharString@@V?$allocator@VCharString@@@std@@@std@@PEBD@Z
?registerReportFlag@DebugOutput@@YAFAEBVCharString@@PEBD@Z
??1PtrListItem@@UEAA@XZ
??0PtrList@@QEAA@XZ
??1PtrList@@UEAA@XZ
?append@PtrList@@QEAAXPEAVPtrListItem@@@Z
??0BitVec@@QEAA@G@Z
??1BitVec@@QEAA@XZ
?set@BitVec@@QEAAIG@Z
?clear@BitVec@@QEAAIG@Z
?get@BitVec@@QEBAIG@Z
?addMxProxyDefaults@Resources@@KAXAEAVStringToken@@G@Z
?begin@Resources@@SAXAEAHQEAPEAD@Z
?isSection@Resources@@SAIAEBVCharString@@@Z

libbcmv317

?ndr_char@itcNDR@@0W4NDR_character@1@A

msvcp140

_Mbrtowc
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?_Xbad_alloc@std@@YAXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAK@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z

vcruntime140

memset
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__C_specific_handler
memmove
__std_terminate
memcpy
__CxxFrameHandler3
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
_set_new_mode
calloc

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_seh_filter_dll
_cexit
_seh_filter_exe
_set_app_type
_crt_at_quick_exit
_execute_onexit_table
_initialize_narrow_environment
_initterm
_initterm_e
exit
_exit
_initialize_onexit_table
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
terminate
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_register_onexit_function
signal

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vsprintf
__p__commode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
RtlCaptureContext
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

2c956b36f42839519961a3a60e8a42cb

Code Sign

0a:3d:2d:f5:02:51:04:16:9e:00:31:5d:78:df:c8:a4Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

01:53:43:27:ac:be:63:25:e9:5a:1b:0a:6c:18:57:85:55:a8:7d:29:26:17:4e:51:1c:4a:54:b5:f0:a7:5b:6fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libmanagerv317

libmessagesv317

libdatapointv317

libbasicsv317

libbcmv317

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Sections

.text Size: 49KB - Virtual size: 48KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 1KB - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 428B

0a:3d:2d:f5:02:51:04:16:9e:00:31:5d:78:df:c8:a4
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

01:53:43:27:ac:be:63:25:e9:5a:1b:0a:6c:18:57:85:55:a8:7d:29:26:17:4e:51:1c:4a:54:b5:f0:a7:5b:6f
Signer

.text
Size: 49KB - Virtual size: 48KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 1KB - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 428B