2024-04-24_c995551bcc8ec978e96031d4456a916c_icedid_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-04-24_c995551bcc8ec978e96031d4456a916c_icedid_magniber
Size

4.1MB
MD5

c995551bcc8ec978e96031d4456a916c
SHA1

dca801b45e841db451a2b4515a1ae078b99d5c0a
SHA256

003b80c100c1803d916c94307b8a8301ec9a3946158d19a65f9cb8e2efc953a9
SHA512

a7d2a41c0b4bf7c62435f8b3d651546efc07541939eeef1e347b9918993c6fdc86b4136f439e43cd4d798fb94496cfa20226d112ac5e759f7ec26b8c68753edb
SSDEEP

98304:OV/iQMYI4W6BrI/oAW7SdS0UVChEi08ODb3BSqz1XZjq/KlG:w6Q6TzM+Gi08OFJq/t

Score

1^/10

Malware Config

Signatures

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

Files

2024-04-24_c995551bcc8ec978e96031d4456a916c_icedid_magniber
.exe windows:6 windows x86 arch:x86

be49b1c0181118498f5d97f3b763eea1

Code Sign

48:0c:ba:c8:80:b1:f8:35:63:cb:c2:08:da:92:a3:26
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-05-2017 00:00

Not After

23-05-2018 23:59

Subject

CN=SIMMERSON SERVICES LIMITED,O=SIMMERSON SERVICES LIMITED,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:0c:ba:c8:80:b1:f8:35:63:cb:c2:08:da:92:a3:26
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-05-2017 00:00

Not After

23-05-2018 23:59

Subject

CN=SIMMERSON SERVICES LIMITED,O=SIMMERSON SERVICES LIMITED,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a4:7f:c9:67:e1:14:8d:63:ae:45:5a:66:b1:c7:51:d5:67:77:96:0d:e7:82:71:a2:6f:c5:ef:36:7f:44:1e:9c
Signer

Actual PE Digest

a4:7f:c9:67:e1:14:8d:63:ae:45:5a:66:b1:c7:51:d5:67:77:96:0d:e7:82:71:a2:6f:c5:ef:36:7f:44:1e:9c

Digest Algorithm

sha256

PE Digest Matches

true

7f:6b:a8:18:ac:93:b0:5b:c6:5e:cb:d3:4b:83:0e:aa:47:e8:29:ae
Signer

Actual PE Digest

7f:6b:a8:18:ac:93:b0:5b:c6:5e:cb:d3:4b:83:0e:aa:47:e8:29:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

RpcBindingInqAuthClientExW
RpcStringFreeA
NdrConformantVaryingArrayFree
RpcServerRegisterAuthInfoW
RpcNetworkInqProtseqsW

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

SetStdHandle
QueryPerformanceFrequency
HeapQueryInformation
VirtualAlloc
GetSystemInfo
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
ExitProcess
VirtualQuery
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetStringTypeW
LCMapStringW
CompareStringW
SwitchToThread
OutputDebugStringW
GetFileType
GetStdHandle
GetDateFormatW
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetTimeZoneInformation
FindFirstFileExA
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SearchPathA
GetProfileIntA
GetTempPathA
GetUserDefaultLCID
ReplaceFileA
GetTempFileNameA
GetDiskFreeSpaceA
VerifyVersionInfoA
VerSetConditionMask
SystemTimeToTzSpecificLocalTime
SetFileAttributesA
GetFileTime
GetFileSizeEx
GetFileAttributesExA
FileTimeToLocalFileTime
SetErrorMode
GetCPInfo
GetOEMCP
VirtualProtect
FileTimeToSystemTime
GetAtomNameA
GetStringTypeExA
GetThreadLocale
GetVolumeInformationA
MoveFileA
GetShortPathNameA
LoadLibraryExA
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetFullPathNameA
GetTimeFormatW
GetFileSize
FlushFileBuffers
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetACP
lstrcmpiA
LocalUnlock
LocalLock
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GlobalFlags
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreA
ReleaseMutex
ReleaseSemaphore
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
FormatMessageA
MulDiv
GlobalSize
GlobalAddAtomA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
CompareStringA
lstrcmpA
GlobalDeleteAtom
GlobalAlloc
GetVersionExA
GetCurrentThread
ResumeThread
SuspendThread
SetThreadPriority
CreateEventA
SetEvent
GlobalFree
GlobalUnlock
GlobalLock
LoadLibraryW
LoadLibraryExW
GetModuleFileNameW
GetSystemDirectoryW
SetLastError
EncodePointer
OutputDebugStringA
FindClose
FindNextFileA
FindFirstFileA
CopyFileA
LocalFree
LocalAlloc
GetCurrentThreadId
FindResourceExW
MultiByteToWideChar
GetVolumeInformationW
FindFirstVolumeW
SystemTimeToFileTime
SetFileTime
SetFilePointer
LocalFileTimeToFileTime
GetFileAttributesA
GetCurrentDirectoryA
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
RaiseException
DecodePointer
TerminateThread
Process32First
CreateToolhelp32Snapshot
OpenFileMappingA
UnmapViewOfFile
MapViewOfFile
lstrcpynA
ReadFile
GetBinaryTypeA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CreateDirectoryA
CreateProcessA
WaitForSingleObject
WriteFile
DeleteFileA
CreateFileA
LoadLibraryA
lstrlenA
lstrcatA
lstrcpyA
WinExec
FreeLibrary
GetWindowsDirectoryA
WideCharToMultiByte
FindResourceA
SizeofResource
LockResource
LoadResource
EnumSystemGeoID
CreateFileW
GetCalendarInfoW
QueryDosDeviceA
FindResourceW
SetFirmwareEnvironmentVariableW
WaitForMultipleObjects
SwitchToFiber
SetProcessAffinityMask
GetModuleHandleW
CreateThreadpoolWait
ReadProcessMemory
GetNativeSystemInfo
GetExitCodeThread
GetCurrentProcessId
Sleep
CreateMutexA
AcquireSRWLockExclusive
GetLastError
CloseHandle
GetCommandLineW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetConsoleCtrlHandler
WriteConsoleW
CreateThread

user32

GetTopWindow
GetClassLongA
EqualRect
MapWindowPoints
AdjustWindowRectEx
GetWindowTextA
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
UpdateWindow
TrackPopupMenuEx
TrackPopupMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
IsChild
IsMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
RegisterWindowMessageA
OffsetRect
SetRectEmpty
SendDlgItemMessageA
FillRect
ClientToScreen
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutA
GrayStringA
DrawTextExA
DrawTextA
UnhookWindowsHookEx
RemoveMenu
AppendMenuA
InsertMenuA
LoadIconA
SetScrollInfo
GetScrollInfo
GetDoubleClickTime
ModifyMenuA
RegisterClipboardFormatA
CharUpperBuffA
GetUpdateRect
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringA
CopyRect
MapVirtualKeyA
GetKeyNameTextA
GetLastActivePopup
ShowOwnedPopups
PostQuitMessage
CallNextHookEx
SetWindowsHookExA
GetCursorPos
ValidateRect
GetKeyState
IsWindowVisible
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
GetDesktopWindow
GetWindowLongA
SetActiveWindow
IsWindowEnabled
GetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamA
DestroyWindow
LoadBitmapW
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
GetWindowThreadProcessId
AllowSetForegroundWindow
LockSetForegroundWindow
AttachThreadInput
GetForegroundWindow
SystemParametersInfoA
SetForegroundWindow
UnregisterClassA
PostMessageA
wsprintfA
CopyIcon
WinHelpA
MonitorFromWindow
GetMonitorInfoA
ShowWindow
MoveWindow
SetDlgItemInt
GetDlgItemInt
SetDlgItemTextA
GetDlgItemTextA
CheckDlgButton
CheckRadioButton
IsDlgButtonChecked
ScrollWindowEx
SetWindowTextA
IsDialogMessageA
IntersectRect
WindowFromPoint
MsgWaitForMultipleObjectsEx
RealChildWindowFromPoint
GetSysColorBrush
IsClipboardFormatAvailable
GetTabbedTextExtentA
SetRect
GetDialogBaseUnits
CopyImage
DeleteMenu
DestroyIcon
CharUpperA
WaitMessage
SetCapture
ReleaseCapture
LoadCursorW
LoadCursorA
SetWindowLongA
TrackMouseEvent
LoadImageW
DestroyMenu
GetMenuItemInfoA
GetAsyncKeyState
MapDialogRect
CreatePopupMenu
GetMenuDefaultItem
BringWindowToTop
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
InsertMenuItemA
LoadImageA
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
GetWindow
GetDCEx
SendMessageCallbackA
ChangeClipboardChain
GetSystemMetrics
SetMenu
EnumPropsA
GetWindowTextLengthA
SetMenuContextHelpId
MessageBoxA
SetCursorPos
HideCaret
SetClassLongA
GetParent
GetClassNameA
GetClassNameW
ChangeDisplaySettingsA
SendMessageA
IsIconic
EnableWindow
DrawIcon
GetClientRect
GetWindowRect
GetSysColor
LoadIconW
GetMessagePos
IsWindow
SetTimer
KillTimer
GetDC
ReleaseDC
InvalidateRect
MessageBeep
SetCursor
ScreenToClient
InflateRect
PtInRect
EnumChildWindows
DrawMenuBar
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
SetMenuDefaultItem
SubtractRect
SendNotifyMessageA
MonitorFromRect
InSendMessage
CreateMenu
WindowFromDC
GetWindowRgn
DestroyCursor
GetTabbedTextExtentW
LockWindowUpdate
CopyAcceleratorTableA
DestroyAcceleratorTable
CreateAcceleratorTableA
LoadAcceleratorsW
ToAsciiEx
GetKeyboardState
MapVirtualKeyExA
IsCharLowerA
GetKeyboardLayout
PostThreadMessageA
GetComboBoxInfo
MonitorFromPoint
UpdateLayeredWindow
UnionRect
FrameRect
GetSystemMenu
LoadMenuW
IsZoomed
DrawFrameControl
DrawEdge
SetParent
SetWindowRgn
DrawStateA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
SetLayeredWindowAttributes
NotifyWinEvent
InvertRect
EnableScrollBar
GetIconInfo
DrawIconEx
IsRectEmpty
DrawFocusRect
GetNextDlgGroupItem

gdi32

SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextColor
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
StartDocA
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
MoveToEx
TextOutA
ExtTextOutA
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
GetMapMode
SetRectRgn
DPtoLP
GetCharWidthA
GetTextMetricsA
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
CreateCompatibleBitmap
CreateFontA
StretchDIBits
CreatePalette
GetLayout
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
GetDIBits
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
CreateRoundRectRgn
LPtoDP
EnumFontFamiliesExA
Rectangle
GetRgnBox
OffsetRgn
GetCurrentObject
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
CloseMetaFile
CreateMetaFileA
DeleteMetaFile
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextExtentPointA
GetTextExtentPoint32W
GetTextFaceA
SetLayout
SetMapMode
SetGraphicsMode
SetMapperFlags
SetBkMode
SetBkColor
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
PlayMetaFile
OffsetClipRgn
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetCurrentPositionEx
GetClipRgn
GetClipBox
ExcludeClipRect
Escape
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateDIBPatternBrushPt
CreateCompatibleDC
BitBlt
GetDeviceCaps
CreateDCA
CopyMetaFileA
PatBlt
CreateRectRgnIndirect
CreateBitmap
GetObjectA
GetTextExtentPoint32A
GetStockObject
CreateFontIndirectA
SetICMProfileA
Polyline
SetDIBits
GetNearestPaletteIndex
GetObjectType
CreateMetaFileW

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterA
ClosePrinter
GetJobA
DocumentPropertiesA

advapi32

ChangeServiceConfig2A
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetFileSecurityA
SetFileSecurityA
RegEnumKeyExA
RegEnumValueA
RegSetValueA
RegQueryValueA
GetUserNameA
RegSetValueExA
CryptEncrypt
CryptReleaseContext
CryptDestroyKey
CryptDecrypt
CryptGetKeyParam
CryptSetKeyParam
CryptImportKey
CryptAcquireContextA
RegOpenKeyExW
StartServiceA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
PerfSetULongLongCounterValue
RegUnLoadKeyA
RegLoadKeyA
LookupPrivilegeValueA
OpenProcessToken
RegDeleteValueA
RegDeleteKeyA
GetMultipleTrusteeOperationW
RegSaveKeyExA
RegRestoreKeyW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyW
RegEnumKeyA
RegCreateKeyExA
RegCloseKey
SetTokenInformation
SetKernelObjectSecurity
IsTokenRestricted
ImpersonateSelf
ImpersonateLoggedOnUser
AccessCheckByTypeResultListAndAuditAlarmW
AccessCheck

shell32

ExtractIconA
DragFinish
CommandLineToArgvW
SHCreateProcessAsUserW
SHEmptyRecycleBinW
SHLoadNonloadedIconOverlayIdentifiers
SHGetLocalizedName
InitNetworkAddressControl
SHCreateItemWithParent
SHGetIconOverlayIndexW
ord19
ord153
ord152
ord27
ord51
ShellExecuteExA
SHAppBarMessage
SHBrowseForFolderA
SHGetMalloc
DragQueryFileA
SHGetDesktopFolder
ord62
SHGetPathFromIDListA
SHGetFileInfoA
SHGetSpecialFolderLocation
SHAddToRecentDocs
SHGetFolderPathA
SHGetSpecialFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathA
ShellExecuteA

comctl32

InitCommonControlsEx

shlwapi

StrFormatKBSizeA
StrRStrIA
PathAppendA
PathStripToRootW
ord2
SHDeleteKeyW
SHDeleteKeyA
PathFileExistsA
SHDeleteValueA
SHSetValueA
SHGetValueA
PathFindFileNameA
PathFindExtensionA
PathRemoveExtensionA
PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA

uxtheme

GetThemeSysColor
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme

ole32

CreateDataAdviseHolder
DoDragDrop
OleIsCurrentClipboard
OleSetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleSetMenuDescriptor
OleLockRunning
StgCreateDocfile
OleRun
StgOpenStorage
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
CreateFileMoniker
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleRegGetMiscStatus
OleRegEnumVerbs
StgCreateDocfileOnILockBytes
WriteClassStm
GetHGlobalFromILockBytes
CreateGenericComposite
CreateItemMoniker
OleCreate
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleGetClipboard
PropVariantCopy
CreateStreamOnHGlobal
CoInitializeEx
CLSIDFromString
StringFromGUID2
CoDisconnectObject
SetConvertStg
OleRegGetUserType
OleCreateLinkToFile
OleCreateFromFile
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemAlloc
StringFromCLSID
CoInitialize
CoCreateInstance
CoUninitialize
CoCreateGuid
CoTaskMemFree
OleCreateMenuDescriptor
OleCreateLinkFromDataEx
StgIsStorageFile
CoFreeUnusedLibrariesEx
CreateOleAdviseHolder
GetRunningObjectTable
OleIsRunning
CoGetMalloc
OleQueryLinkFromData
OleQueryCreateFromData
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CoGetClassObject
CoRegisterClassObject
OleLoad
CLSIDFromProgID
OleSave
OleSaveToStream
OleSetContainedObject
CoRegisterMessageFilter
OleGetIconOfClass
CoRevokeClassObject
OleFlushClipboard

oleaut32

VarCyRound
VarUI1FromI4
VarI2FromI8
VarUI4FromDisp
SysAllocString
VarDecFromStr
VarBstrFromDec
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
VariantCopy
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayCreate
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen
SysStringLen
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
VariantChangeType
VariantClear
VariantInit
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysAllocStringLen

oledlg

ord8

wtsapi32

WTSEnumerateSessionsA
WTSUnRegisterSessionNotificationEx
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
WTSVirtualChannelPurgeOutput
WTSWaitSystemEvent
WTSShutdownSystem
WTSLogoffSession
WTSDisconnectSession
WTSSetUserConfigA
WTSTerminateProcess
WTSOpenServerA
WTSEnumerateSessionsW

wininet

InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetQueryOptionA
InternetReadFile
InternetOpenUrlA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpQueryInfoA

netapi32

NetUserEnum
NetApiBufferFree

gdiplus

GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipDeleteGraphics
GdiplusShutdown
GdipAlloc
GdipDrawImageI
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipFree

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundA

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 556KB - Virtual size: 555KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be49b1c0181118498f5d97f3b763eea1

Code Sign

48:0c:ba:c8:80:b1:f8:35:63:cb:c2:08:da:92:a3:26Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

48:0c:ba:c8:80:b1:f8:35:63:cb:c2:08:da:92:a3:26Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

a4:7f:c9:67:e1:14:8d:63:ae:45:5a:66:b1:c7:51:d5:67:77:96:0d:e7:82:71:a2:6f:c5:ef:36:7f:44:1e:9cSigner

7f:6b:a8:18:ac:93:b0:5b:c6:5e:cb:d3:4b:83:0e:aa:47:e8:29:aeSigner

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

version

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

wtsapi32

wininet

netapi32

gdiplus

oleacc

imm32

winmm

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 556KB - Virtual size: 555KB

.data Size: 37KB - Virtual size: 61KB

.rsrc Size: 1.0MB - Virtual size: 1.0MB

48:0c:ba:c8:80:b1:f8:35:63:cb:c2:08:da:92:a3:26
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

48:0c:ba:c8:80:b1:f8:35:63:cb:c2:08:da:92:a3:26
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

a4:7f:c9:67:e1:14:8d:63:ae:45:5a:66:b1:c7:51:d5:67:77:96:0d:e7:82:71:a2:6f:c5:ef:36:7f:44:1e:9c
Signer

7f:6b:a8:18:ac:93:b0:5b:c6:5e:cb:d3:4b:83:0e:aa:47:e8:29:ae
Signer

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 556KB - Virtual size: 555KB

.data
Size: 37KB - Virtual size: 61KB

.rsrc
Size: 1.0MB - Virtual size: 1.0MB