2024-04-21_130063dd5a5173e3cf1432cda79b9bed_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-21_130063dd5a5173e3cf1432cda79b9bed_magniber
Size

24.4MB
MD5

130063dd5a5173e3cf1432cda79b9bed
SHA1

719522d86cc0b8a9fb8067d4e84c34762cc2bd2f
SHA256

062a563435ec29d1a50cabb90894d9f7118d59c69d5a49bb2efd821ac644c017
SHA512

b80c64cef6224dcc8255e80e5260413372ce2f462f5eaf25cadfec4ff6bd81464e3273bcc187e1a0f5a1643adf8d185ebdcfe24824e8e7ea68e0e0a251532f8a
SSDEEP

393216:WCZA7XFxoJZClpmarPH4MnDN2mF1FPWpTpnR8Rh4QY:QxonCl0c4MnDNt1FPWpTpshvY

Score

10^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Files

2024-04-21_130063dd5a5173e3cf1432cda79b9bed_magniber
.exe windows:5 windows x86 arch:x86

cc2335d789d07a6a45c5b0bf0e9d324d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

35:3f:70:52:0d:e1:39:0e:21:0c:dd:7a:92:cb:0d:a7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

27/02/2015, 00:00

Not After

28/05/2018, 23:59

Subject

CN=SoftOrbits,O=SoftOrbits,L=Smolensk,ST=Smolenskaya,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b9:db:16:4e:35:80:04:37:83:b3:8f:df:42:34:c3:ce:9b:99:22:b2
Signer

Actual PE Digest

b9:db:16:4e:35:80:04:37:83:b3:8f:df:42:34:c3:ce:9b:99:22:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateTimerQueueTimer
GetProcessAffinityMask
VirtualFree
SetThreadAffinityMask
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
GetThreadPriority
SignalObjectAndWait
FatalAppExitA
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetStringTypeW
IsProcessorFeaturePresent
ReleaseMutex
DeleteTimerQueueTimer
GetPriorityClass
SetPriorityClass
GetVersionExA
MoveFileExW
WinExec
GetCurrencyFormatW
GetDateFormatW
GetTimeFormatW
InterlockedCompareExchange
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapDestroy
HeapCreate
SetHandleCount
GetEnvironmentStringsW
CreateTimerQueue
GetFileAttributesA
CreateMutexW
SetConsoleCtrlHandler
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
VirtualQuery
VirtualAlloc
GetFileType
SetStdHandle
HeapQueryInformation
HeapSize
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
DebugBreak
OutputDebugStringW
SwitchToThread
CreateSemaphoreW
InterlockedFlushSList
InterlockedPopEntrySList
QueryDepthSList
InterlockedPushEntrySList
InitializeSListHead
ReleaseSemaphore
GetFullPathNameA
GetDriveTypeW
ExitProcess
HeapReAlloc
CreateThread
ExitThread
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
RtlUnwind
HeapAlloc
HeapFree
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineW
LocalLock
LocalUnlock
SearchPathW
GetTempPathW
GetNumberFormatW
GetWindowsDirectoryW
IsDBCSLeadByte
GetVersion
FindResourceExW
SetErrorMode
GlobalFlags
GetAtomNameW
TlsFree
LocalReAlloc
GlobalHandle
GlobalReAlloc
GetProfileIntW
GetShortPathNameW
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
MoveFileW
lstrcmpiW
GetThreadLocale
GetStringTypeExW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringA
InterlockedExchange
SetThreadPriority
VirtualProtect
GetDiskFreeSpaceW
GetFullPathNameW
GetTempFileNameW
ReplaceFileW
GetUserDefaultLCID
GlobalGetAtomNameW
GetFileTime
GetFileAttributesW
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileAttributesW
GetFileAttributesExW
lstrlenA
lstrcmpA
LocalAlloc
InitializeCriticalSectionAndSpinCount
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentProcessId
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
ReleaseActCtx
CreateActCtxW
CopyFileW
FormatMessageW
LocalFree
TlsAlloc
TlsGetValue
TlsSetValue
GetTempPathA
GetTempFileNameA
DeleteFileA
LeaveCriticalSection
TryEnterCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GlobalSize
GetTickCount
ActivateActCtx
DeactivateActCtx
SetLastError
FreeLibrary
FreeResource
CreateEventW
SetEvent
WaitForSingleObject
ResetEvent
DeleteFileW
FindClose
QueryPerformanceFrequency
TerminateThread
InterlockedDecrement
InterlockedIncrement
QueryPerformanceCounter
GetModuleFileNameA
GetModuleFileNameW
SetCurrentDirectoryA
FindFirstFileW
FindNextFileW
GetFileSize
ReadFile
WideCharToMultiByte
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetSystemInfo
ResumeThread
WaitForMultipleObjects
GetModuleHandleW
Sleep
SuspendThread
MulDiv
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
GetFileSizeEx
lstrcpynW
lstrcatW
GetSystemDefaultLangID
GetUserDefaultLangID
LoadLibraryW
GetProcAddress
lstrlenW
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
DeviceIoControl
GetVolumeInformationW
lstrcpyW
lstrcmpW
GetVersionExW
CreateFileA
GetLastError
CloseHandle
SleepEx

user32

TranslateAcceleratorW
GetMenuItemInfoW
CreateDialogIndirectParamW
EndDialog
IntersectRect
GetWindowThreadProcessId
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetForegroundWindow
ShowScrollBar
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
CallWindowProcW
GetMenu
GetWindowDC
UnhookWindowsHookEx
GetWindowTextLengthW
GetWindowTextW
SetFocus
ScrollWindowEx
IsWindowEnabled
MoveWindow
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
SendDlgItemMessageW
GetDlgItemTextW
GetDlgItemInt
GetDlgItem
CheckRadioButton
CheckDlgButton
BringWindowToTop
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
CreateWindowExW
GetComboBoxInfo
PtInRect
CopyImage
LoadBitmapW
SetRect
SetWindowLongW
GetKeyState
IsWindowVisible
WindowFromDC
PostQuitMessage
GetDesktopWindow
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
GetClassNameW
GetWindow
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetWindowContextHelpId
ShowOwnedPopups
CharUpperW
SystemParametersInfoW
KillTimer
GetDCEx
MessageBoxW
DestroyIcon
ReleaseDC
CreateIconIndirect
RemoveMenu
ModifyMenuW
EqualRect
SetRectEmpty
SetWindowPos
RedrawWindow
LoadIconW
ShowWindow
EnumChildWindows
BeginDeferWindowPos
ScreenToClient
DeferWindowPos
EndDeferWindowPos
GetClassInfoW
DefWindowProcW
LoadCursorW
GetSystemMetrics
CreatePopupMenu
InsertMenuItemW
IsIconic
LoadAcceleratorsW
GetMenuBarInfo
ReuseDDElParam
UnpackDDElParam
GetKeyNameTextW
MapVirtualKeyW
NotifyWinEvent
GetAsyncKeyState
MapDialogRect
ValidateRect
TranslateMessage
GetMessageW
GetFocus
IsChild
GetSystemMenu
IsWindow
SetTimer
wsprintfW
ReleaseCapture
SetCapture
UpdateWindow
EndPaint
BeginPaint
DestroyMenu
IsZoomed
SetParent
DrawEdge
IsRectEmpty
DeleteMenu
DrawIcon
GetMenuState
SetWindowRgn
GetDC
MsgWaitForMultipleObjectsEx
GetCursor
SystemParametersInfoA
GetClipboardData
IsCharAlphaNumericW
IsCharAlphaW
LoadMenuIndirectW
GetIconInfo
DrawStateW
GetKeyboardLayout
CopyRect
InflateRect
OffsetRect
FillRect
FrameRect
DrawFocusRect
SendMessageW
GetWindowRect
GetClientRect
GetSysColorBrush
ClientToScreen
InvalidateRect
UnregisterClassW
GetActiveWindow
GetNextDlgTabItem
GetParent
RealChildWindowFromPoint
WindowFromPoint
EnableWindow
GetWindowLongW
SetCursor
GetDialogBaseUnits
PostMessageW
TrackPopupMenuEx
GetSubMenu
GetSysColor
LoadImageW
DestroyCursor
LoadMenuW
EnumDisplayMonitors
SetLayeredWindowAttributes
UnionRect
MessageBeep
EnableScrollBar
UpdateLayeredWindow
MonitorFromPoint
IsMenu
SetMenuDefaultItem
GetMenuDefaultItem
GetTabbedTextExtentW
RegisterClipboardFormatW
InvalidateRgn
CreateMenu
LockWindowUpdate
CharNextW
CopyAcceleratorTableW
GetNextDlgGroupItem
InSendMessage
PostThreadMessageW
InvertRect
HideCaret
DrawIconEx
DestroyAcceleratorTable
SetClassLongW
DrawFrameControl
ToUnicodeEx
GetWindowRgn
SubtractRect
GetDoubleClickTime
GetUpdateRect
SendNotifyMessageW
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
MapVirtualKeyExW
IsCharLowerW
IsClipboardFormatAvailable
WaitMessage
CharUpperBuffW
CopyIcon
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
SetCursorPos
CreateAcceleratorTableW
GetKeyboardState
GetCursorPos

gdi32

GetEnhMetaFileHeader
SetEnhMetaFileBits
GetDIBits
PlayEnhMetaFile
RealizePalette
SelectPalette
CreatePalette
GetEnhMetaFilePaletteEntries
PatBlt
CreateDIBPatternBrushPt
RestoreDC
SetDIBitsToDevice
SetStretchBltMode
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
SaveDC
StretchDIBits
CopyMetaFileW
SetPolyFillMode
SetROP2
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetLayout
SetLayout
SetArcDirection
SetColorAdjustment
SelectClipRgn
GetClipRgn
SelectClipPath
GetViewportExtEx
GetWindowExtEx
StartDocW
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
DeleteEnhMetaFile
PolyDraw
PolylineTo
PolyBezierTo
CreatePatternBrush
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreateRectRgn
SetRectRgn
GetTextMetricsW
CreateMetaFileW
CloseMetaFile
DeleteMetaFile
CreateEllipticRgn
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetViewportOrgEx
GetCharWidthW
CreateFontW
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreateRoundRectRgn
EnumFontFamiliesExW
GetTextAlign
OffsetRgn
GetTextColor
GetRgnBox
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextFaceW
GetWindowOrgEx
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
GetCurrentObject
CreatePolygonRgn
Polyline
Polygon
SetDIBColorTable
RoundRect
ExtFloodFill
SetPaletteEntries
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
RectVisible
SetWinMetaFileBits
PtVisible
CreateDIBSection
LPtoDP
DPtoLP
GetMapMode
GetBkColor
GetNearestColor
PlgBlt
StretchBlt
LineDDA
SetPixelV
CreateHatchBrush
CreateDCW
CreateFontIndirectW
GetTextExtentPointW
Ellipse
Rectangle
CombineRgn
GetTextExtentPoint32W
SetBrushOrgEx
CreatePen
UnrealizeObject
SetBkMode
CreateSolidBrush
GetDeviceCaps
Escape
ExtTextOutW
ExtCreatePen
TextOutW
CreateCompatibleBitmap
GetObjectW
GetPixel
SetPixel
CreateCompatibleDC
SelectObject
SetBkColor
BitBlt
SetTextColor
DeleteDC
GetStockObject
ArcTo
GetDCOrgEx
ExtCreateRegion
GetTextCharset
CreateEllipticRgnIndirect
CreateBitmap
DeleteObject

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW
GetJobW

advapi32

RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyW
RegQueryValueExA
RegSetValueExW
RegOpenKeyExW
RegSetValueW
SetFileSecurityW
GetFileSecurityW
RegDeleteKeyW
RegEnumKeyW
RegQueryValueW
RegEnumKeyExW
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey

shell32

SHGetDesktopFolder
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
DragAcceptFiles
DragFinish
DragQueryFileW
SHGetMalloc
SHAppBarMessage
SHGetSpecialFolderLocation
ShellExecuteExW
ExtractIconW
SHAddToRecentDocs
SHGetFileInfoW

comctl32

ImageList_Remove
ImageList_AddMasked
ImageList_Destroy
ImageList_GetImageCount
ImageList_Create
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_GetIconSize
ord17
_TrackMouseEvent
ImageList_DrawEx

shlwapi

PathRemoveFileSpecW
PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW
PathStripToRootW
UrlUnescapeW
PathIsUNCW

ole32

IsAccelerator
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
CreateStreamOnHGlobal
DoDragDrop
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
OleSave
WriteClassStm
OleLockRunning
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreate
OleLoad
GetHGlobalFromILockBytes
OleSetContainedObject
OleCreateFromFile
OleCreateLinkToFile
OleGetIconOfClass
CreateItemMoniker
CreateGenericComposite
CreateFileMoniker
GetRunningObjectTable
CoLockObjectExternal
OleIsRunning
CoGetMalloc
StgCreateDocfile
StgOpenStorage
StgIsStorageFile
OleGetClipboard
OleSetMenuDescriptor
RegisterDragDrop
RevokeDragDrop
CoRegisterClassObject
CoRevokeClassObject
CoRegisterMessageFilter
OleQueryCreateFromData
OleTranslateAccelerator
OleRegGetMiscStatus
OleRegEnumVerbs
StgOpenStorageOnILockBytes
OleQueryLinkFromData
CoTaskMemFree
CoGetClassObject
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateDataAdviseHolder
CreateOleAdviseHolder
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleLoadFromStream
ReadClassStm
OleRun
CoInitialize
StringFromGUID2
CoDisconnectObject
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
CreateDataCache
OleSaveToStream
CoInitializeEx
CoCreateInstance
CoUninitialize
PropVariantCopy
OleDuplicateData
CoTreatAsClass
StringFromCLSID
ReleaseStgMedium
CreateBindCtx
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemAlloc

oleaut32

RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SysAllocString
VariantInit
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
VarDateFromStr
SysReAllocStringLen
VarCyFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarBstrFromDate
OleCreateFontIndirect
OleCreatePictureIndirect
OleLoadPicture
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VariantClear
SafeArrayPutElement
VariantChangeType
VarI4FromStr
OleTranslateColor
SafeArrayLock
VarR8FromStr
OleCreatePropertyFrame

oledlg

OleUIBusyW

urlmon

IsAsyncMoniker
CreateURLMoniker
CreateAsyncBindCtx
RegisterBindStatusCallback

gdiplus

GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateFromHDC
GdipFree
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipAlloc
GdipDeleteGraphics
GdiplusShutdown
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile

ws2_32

htonl
ntohs
htons
ntohl

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

wininet

HttpOpenRequestW
InternetOpenUrlW
GopherOpenFileW
InternetConnectW
FtpFindFirstFileW
GopherCreateLocatorW
FtpCommandW
FtpOpenFileW
GopherGetAttributeW
HttpSendRequestExW
HttpEndRequestW
HttpSendRequestW
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
InternetFindNextFileW
HttpQueryInfoW
HttpAddRequestHeadersW
InternetErrorDlg
FtpGetFileW
FtpPutFileW
FtpGetCurrentDirectoryW
FtpSetCurrentDirectoryW
FtpRemoveDirectoryW
FtpCreateDirectoryW
FtpRenameFileW
FtpDeleteFileW
InternetQueryDataAvailable
InternetGetCookieW
InternetSetCookieW
InternetSetOptionExW
InternetCanonicalizeUrlW
InternetCrackUrlW
GopherFindFirstFileW
InternetQueryOptionW

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

avifil32

AVIStreamSampleToTime
AVIStreamStart
AVIStreamGetFrameOpen
AVIStreamOpenFromFileW
AVIStreamInfoW
AVIStreamGetFrame
AVIStreamRelease
AVIStreamGetFrameClose
AVIFileExit
AVIFileInit
AVIStreamLength

msvfw32

DrawDibClose
DrawDibOpen
DrawDibDraw

Sections

.text
Size: 9.6MB - Virtual size: 9.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 181KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 12.7MB - Virtual size: 12.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc2335d789d07a6a45c5b0bf0e9d324d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

35:3f:70:52:0d:e1:39:0e:21:0c:dd:7a:92:cb:0d:a7Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

b9:db:16:4e:35:80:04:37:83:b3:8f:df:42:34:c3:ce:9b:99:22:b2Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

urlmon

gdiplus

ws2_32

oleacc

wininet

imm32

winmm

avifil32

msvfw32

Sections

.text Size: 9.6MB - Virtual size: 9.6MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 181KB - Virtual size: 1.5MB

.idata Size: 28KB - Virtual size: 28KB

.vmp0 Size: 117KB - Virtual size: 117KB

.rsrc Size: 12.7MB - Virtual size: 12.7MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

35:3f:70:52:0d:e1:39:0e:21:0c:dd:7a:92:cb:0d:a7
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

b9:db:16:4e:35:80:04:37:83:b3:8f:df:42:34:c3:ce:9b:99:22:b2
Signer

.text
Size: 9.6MB - Virtual size: 9.6MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 181KB - Virtual size: 1.5MB

.idata
Size: 28KB - Virtual size: 28KB

.vmp0
Size: 117KB - Virtual size: 117KB

.rsrc
Size: 12.7MB - Virtual size: 12.7MB