2024-04-24_57d2fc17496be12e320f2ed7bbec35db_icedid_vidar

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-24_57d2fc17496be12e320f2ed7bbec35db_icedid_vidar
Size

17.4MB
MD5

57d2fc17496be12e320f2ed7bbec35db
SHA1

aab8619f6b41d1274df05c99ce1b00ac362b9ada
SHA256

bac310b36656a82357c0a3d51e6841f8ecf596fa3fd11d860b66bc0cc7c954f2
SHA512

019ee3dfd8fdf3799548f5bd14428ae4cf820219b248c314d8de3e7ec9308338f0fa60ea2653494acf4c021f60a560358d394a009c0f256c1b1570cc19d79057
SSDEEP

393216:3cbavUeJ2deJjwDfETQ0vjdqYeqwbZ4tAszcRtqfZPjYv:sba8SvdqLqs4t5+AfK

Score

1^/10

Malware Config

Signatures

Files

2024-04-24_57d2fc17496be12e320f2ed7bbec35db_icedid_vidar
.exe windows:5 windows x86 arch:x86

53b3f0b7f814f19b5fd1a267c9b44ec4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:69:50:d0:a0:5a:1c:d6:31:64:d1:e1:eb:1f:fb:8a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/06/2014, 00:00

Not After

20/06/2015, 23:59

Subject

CN=Elex do Brasil Participações Ltda,O=Elex do Brasil Participações Ltda,L=São Paulo,ST=São Paulo,C=BR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:09:f0:24:93:0f:ab:26:3c:ea:f7:d9:8f:81:05:24:c3:98:e3:bc
Signer

Actual PE Digest

c9:09:f0:24:93:0f:ab:26:3c:ea:f7:d9:8f:81:05:24:c3:98:e3:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\FeiQ2012\source\Client\FeiQClient\Win32\Release\FeiQ.pdb

Imports

shlwapi

PathCombineW
PathStripToRootW
PathRemoveExtensionW
PathIsDirectoryW
PathFindExtensionW
PathIsRelativeW
PathFindFileNameW
PathRemoveFileSpecW
PathCanonicalizeW
PathAddBackslashW
PathAddExtensionW
PathAppendW
PathRenameExtensionW
PathRemoveBackslashW
PathStripPathW
PathIsDirectoryEmptyW
PathGetDriveNumberW
UrlUnescapeW
PathIsUNCW
StrToIntW
PathFileExistsW

winmm

waveOutOpen
timeBeginPeriod
timeGetTime
timeEndPeriod
sndPlaySoundA
mixerOpen
waveInClose
mixerGetID
waveInOpen
mixerGetLineControlsW
mixerGetLineInfoW
mixerClose
waveOutClose
waveInAddBuffer
waveInPrepareHeader
waveInUnprepareHeader
waveInReset
waveInStart
waveInGetErrorTextW
waveOutUnprepareHeader
mixerGetNumDevs
PlaySoundW
waveOutGetErrorTextW
waveOutWrite
waveOutPrepareHeader

iphlpapi

SendARP
GetAdaptersInfo
GetIfTable

ws2_32

WSARecv
WSASend
WSASendTo
WSAIoctl
ntohs
shutdown
__WSAFDIsSet
getsockopt
getpeername
connect
accept
recvfrom
sendto
WSAAsyncSelect
WSACleanup
WSAStartup
socket
WSASetLastError
getsockname
bind
ioctlsocket
setsockopt
listen
inet_ntoa
WSAGetLastError
recv
closesocket
select
send
inet_addr
gethostbyname
htonl
ntohl
htons
gethostname

kernel32

CompareFileTime
SetCurrentDirectoryW
RemoveDirectoryW
InterlockedExchange
QueryPerformanceFrequency
LocalFileTimeToFileTime
InterlockedExchangeAdd
CreateMutexW
GetModuleHandleA
OutputDebugStringA
SetFilePointerEx
TryEnterCriticalSection
GetCurrentThread
IsDebuggerPresent
GetEnvironmentVariableW
lstrlenA
GetComputerNameW
OpenProcess
TerminateProcess
CompareStringW
MoveFileW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
LockFileEx
PulseEvent
WaitForSingleObjectEx
ReleaseSemaphore
OpenMutexW
CreateSemaphoreW
OpenSemaphoreW
GetDiskFreeSpaceExW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
MapViewOfFileEx
Module32FirstW
VirtualProtect
FlushInstructionCache
VirtualQuery
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
CreateActCtxW
ReleaseActCtx
GetThreadLocale
SuspendThread
lstrcmpA
GetStringTypeExW
DuplicateHandle
GlobalGetAtomNameW
GetAtomNameW
GetFileSizeEx
GetUserDefaultLCID
ReplaceFileW
CompareStringA
GetLocaleInfoW
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GetPrivateProfileIntW
GlobalFlags
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
LocalUnlock
LocalLock
FindResourceExW
GetNumberFormatW
SearchPathW
HeapSetInformation
RtlUnwind
DecodePointer
EncodePointer
HeapReAlloc
GetTimeFormatW
GetDateFormatW
VirtualAlloc
GetConsoleCP
GetConsoleMode
GetStringTypeW
GetCPInfo
HeapSize
SetStdHandle
GetFileType
HeapQueryInformation
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
HeapDestroy
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetOEMCP
IsValidCodePage
LCMapStringW
FatalAppExitA
GetTimeZoneInformation
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
WriteConsoleW
SetEnvironmentVariableA
FlushFileBuffers
GetFileAttributesA
FormatMessageA
GetSystemTimeAsFileTime
UnlockFileEx
LockFile
UnlockFile
InterlockedCompareExchange
QueryPerformanceCounter
CreateFileA
MoveFileExW
LocalAlloc
GetExitCodeThread
GetLongPathNameW
GetLogicalDriveStringsW
QueryDosDeviceW
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetPrivateProfileStringW
GetACP
SetEvent
ResetEvent
CreateEventW
GetShortPathNameW
LocalFlags
GetSystemTime
GetComputerNameA
TerminateThread
InterlockedIncrement
GetCommandLineW
CreateMutexA
ReleaseMutex
SetUnhandledExceptionFilter
lstrcmpiW
LoadLibraryExW
RaiseException
InitializeCriticalSectionAndSpinCount
GetWindowsDirectoryW
lstrcatW
GetDriveTypeW
FindNextFileW
CreatePipe
GetStartupInfoW
CreateProcessW
ReadFile
FormatMessageW
LocalFree
IsDBCSLeadByte
GetFullPathNameW
GetFullPathNameA
FindFirstFileW
GetFileInformationByHandle
GetFileAttributesW
SystemTimeToFileTime
GlobalReAlloc
GetLocalTime
GetSystemDirectoryW
FindClose
GetProfileStringW
WriteProfileStringW
GetProfileIntW
GetCurrentProcessId
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcpyW
IsBadCodePtr
lstrcpynW
GlobalAlloc
GlobalUnlock
GlobalFree
GetCurrentThreadId
GetProcessHeap
HeapAlloc
HeapFree
GetVersionExW
GetVolumeInformationW
SetPriorityClass
DeviceIoControl
DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryW
SetThreadLocale
ExitThread
EnterCriticalSection
LeaveCriticalSection
WriteFile
CreateFileW
SetFilePointer
SetEndOfFile
SetFileAttributesW
IsBadReadPtr
WideCharToMultiByte
FreeResource
GlobalSize
GlobalLock
Sleep
GetTickCount
MulDiv
WinExec
GetModuleFileNameW
ExitProcess
GetCurrentProcess
SetProcessWorkingSetSize
CopyFileW
FreeLibrary
SetFileTime
InterlockedDecrement
GetTempPathW
GetTempFileNameW
lstrlenW
WaitForSingleObject
CloseHandle
CreateThread
SetThreadPriority
ResumeThread
MultiByteToWideChar
DeleteFileW
LoadResource
LockResource
SizeofResource
FindResourceW
GetModuleHandleW
LoadLibraryW
ActivateActCtx
GetProcAddress
GetLastError
DeactivateActCtx
SetLastError
GetVersion
GetCurrentDirectoryW
DeleteFileA
AreFileApisANSI
GetTempPathA
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
LoadLibraryA
GetDiskFreeSpaceW
GetTimeFormatA
GetDateFormatA
WritePrivateProfileStringW

user32

SubtractRect
GetDoubleClickTime
CharUpperBuffW
SendNotifyMessageW
SetMenuDefaultItem
CreateMenu
MapVirtualKeyExW
IsCharLowerW
InSendMessage
MonitorFromPoint
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
DestroyAcceleratorTable
InvertRect
GetMenuDefaultItem
SetParent
GetNextDlgGroupItem
CopyAcceleratorTableW
SetLayeredWindowAttributes
UnregisterClassW
GetDialogBaseUnits
RealChildWindowFromPoint
UnpackDDElParam
ReuseDDElParam
GetMenuBarInfo
LoadAcceleratorsW
InsertMenuItemW
TranslateAcceleratorW
TranslateMDISysAccel
DrawMenuBar
DefFrameProcW
WaitMessage
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
NotifyWinEvent
ValidateRect
RemoveMenu
GetMenuStringW
ScrollWindowEx
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SendDlgItemMessageW
SendDlgItemMessageA
GetWindowTextLengthW
GetMessageTime
MonitorFromWindow
MapWindowPoints
ScrollWindow
GetClassInfoExW
SetWindowPlacement
GetWindowPlacement
MapVirtualKeyW
GetKeyNameTextW
SetActiveWindow
CreateDialogIndirectParamW
GetComboBoxInfo
MenuItemFromPoint
SetScrollRange
GetScrollRange
GetScrollPos
SetScrollPos
AnimateWindow
WindowFromDC
GetWindowLongA
GetWindowRgn
SetWindowTextW
GetDlgItem
UpdateLayeredWindow
SetMenu
GetScrollInfo
SetScrollInfo
EnableScrollBar
GetClassLongW
GetTopWindow
EnumChildWindows
GetUpdateRect
CharUpperW
CharLowerW
GetWindowInfo
IsWindowEnabled
CreateIconIndirect
EndPaint
GetLastActivePopup
DialogBoxIndirectParamW
BeginPaint
EndDialog
LoadStringW
WinHelpW
EnumDisplayMonitors
EnumClipboardFormats
GetKeyboardLayout
CountClipboardFormats
GetKeyboardLayoutList
GetMonitorInfoW
ExitWindowsEx
RegisterClassW
WaitForInputIdle
CallWindowProcA
GetAsyncKeyState
TrackMouseEvent
LockWindowUpdate
PostThreadMessageW
SetWindowRgn
ClipCursor
HideCaret
GetSysColorBrush
GetClassInfoW
DestroyWindow
RegisterClassExW
CreateWindowExW
DefWindowProcW
CallWindowProcW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetMenuItemRect
IsMenu
SetMenuItemInfoW
SetPropW
GetMenuItemInfoW
InsertMenuW
keybd_event
mouse_event
GetWindowDC
EnumThreadWindows
RemovePropW
SetClassLongW
FindWindowW
GetSystemMenu
CharNextW
CopyIcon
GetCursor
IsChild
AdjustWindowRectEx
UnionRect
DrawEdge
ChildWindowFromPoint
DrawFocusRect
GetMessagePos
DrawIconEx
SetWindowLongA
GetWindowRect
SendMessageW
InvalidateRect
GrayStringW
DrawTextExW
TabbedTextOutW
GetDlgCtrlID
DrawFrameControl
ScrollDC
DrawTextW
GetTabbedTextExtentW
GetMenuState
LoadImageW
DrawStateW
FrameRect
TrackPopupMenuEx
WindowFromPoint
GetActiveWindow
GetNextDlgTabItem
DestroyMenu
SetWindowPos
FillRect
InvalidateRgn
IsRectEmpty
EmptyClipboard
DrawIcon
DestroyCursor
ShowScrollBar
wsprintfA
PostQuitMessage
RedrawWindow
GetSysColor
OffsetRect
GetForegroundWindow
AttachThreadInput
CopyImage
GetCapture
SetCapture
UpdateWindow
GetDCEx
EqualRect
ReleaseCapture
SetRect
SetCursor
InflateRect
LoadCursorW
SetRectEmpty
RegisterClipboardFormatW
SetClipboardData
GetDC
ReleaseDC
CheckMenuItem
ModifyMenuW
TrackPopupMenu
GetMessageW
MoveWindow
SetFocus
GetLastInputInfo
GetClassNameW
GetWindowThreadProcessId
ShowWindow
EnumWindows
FindWindowExW
DestroyIcon
GetCursorPos
GetSubMenu
LoadMenuW
EnableWindow
LoadIconW
SetWindowLongW
GetWindowLongW
GetClientRect
SetTimer
SetForegroundWindow
BringWindowToTop
GetDesktopWindow
KillTimer
UnregisterHotKey
RegisterHotKey
IsWindowVisible
IsWindow
RegisterWindowMessageW
GetMenuItemID
GetMenuItemCount
GetMenu
AppendMenuW
DeleteMenu
EnableMenuItem
PostMessageW
LoadBitmapW
GetIconInfo
GetSystemMetrics
IsZoomed
GetKeyState
ScreenToClient
CopyRect
DispatchMessageW
TranslateMessage
PeekMessageW
SetCursorPos
GetParent
GetFocus
IsIconic
DefMDIChildProcW
FlashWindow
MessageBeep
GetPropW
SystemParametersInfoW
CreatePopupMenu
ClientToScreen
IntersectRect
GetWindow
GetClipboardData
IsClipboardFormatAvailable
CloseClipboard
OpenClipboard
PtInRect
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
MessageBoxW
wsprintfW
GetWindowTextW

gdi32

CreateSolidBrush
CreateFontW
SetTextColor
SetBkColor
GetBkColor
GetDIBColorTable
CreateHalftonePalette
GetClipBox
GetCurrentObject
GetTextColor
SetPixel
PtVisible
RectVisible
TextOutW
ExtTextOutW
CreateRectRgnIndirect
Polygon
FrameRgn
CreatePolygonRgn
PtInRegion
Arc
SetDIBitsToDevice
StretchDIBits
CreateMetaFileW
CloseMetaFile
GetTextMetricsW
EndDoc
AbortDoc
SetAbortProc
EndPage
Escape
CombineRgn
SelectObject
SetPixelV
GetTextFaceW
GetTextAlign
GetStretchBltMode
GetROP2
CreateCompatibleBitmap
CreateRectRgn
GetPolyFillMode
GetBkMode
GetNearestColor
SetPaletteEntries
StretchBlt
BitBlt
CreateCompatibleDC
GetPixel
GetTextExtentPoint32W
CreateFontIndirectW
CreatePen
Rectangle
UnrealizeObject
PatBlt
CreateBitmap
CreatePatternBrush
CreatePalette
StartPage
Polyline
GetSystemPaletteEntries
GetNearestPaletteIndex
GetPaletteEntries
GetRgnBox
GetTextCharsetInfo
GetCharWidthW
GetMapMode
SetRectRgn
CreateHatchBrush
ExtCreatePen
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
CreateDIBitmap
DeleteObject
GetObjectW
Ellipse
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetBoundsRect
GetViewportOrgEx
DeleteDC
GetDeviceCaps
DeleteMetaFile
CreateDCW
ScaleWindowExtEx
OffsetWindowOrgEx
ScaleViewportExtEx
OffsetViewportOrgEx
StartDocW
SetColorAdjustment
SetArcDirection
SetLayout
GetLayout
SetMapperFlags
SetTextCharacterExtra
SetTextAlign
OffsetClipRgn
IntersectClipRect
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetPolyFillMode
CopyMetaFileW
GetTextExtentPointW
BeginPath
EndPath
SelectClipPath
LPtoDP
DPtoLP
GetViewportExtEx
GetWindowExtEx
SetROP2
OffsetRgn
GetBitmapDimensionEx
SetDIBColorTable
SetDIBits
ExcludeClipRect
SetMapMode
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
GetClipRgn
SelectClipRgn
SaveDC
ExtSelectClipRgn
RestoreDC
CreateDIBPatternBrushPt
SetBrushOrgEx
CreateDIBSection
SetTextJustification
SetBkMode
EnumFontFamiliesExW
EnumFontFamiliesW
CreateICW
ExtCreateRegion
GetDCOrgEx
FillRgn
MoveToEx
LineTo
CreateEllipticRgn
RoundRect
CreateRoundRectRgn
ExtFloodFill
PolyBezier
SetStretchBltMode
GetWindowOrgEx

msimg32

GradientFill
TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
GetJobW
DocumentPropertiesW

advapi32

RegFlushKey
RegCloseKey
RegOpenKeyExW
RegQueryValueW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegRestoreKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
IsTextUnicode
RegEnumKeyW
GetFileSecurityW
SetFileSecurityW
RegSetValueW
RegQueryValueExW
GetUserNameW
RegEnumValueW
GetUserNameA
RegSaveKeyW
OpenProcessToken

shell32

SHAppBarMessage
SHGetDesktopFolder
SHAddToRecentDocs
SHGetMalloc
CommandLineToArgvW
SHGetFolderPathW
ord680
SHGetSpecialFolderLocation
Shell_NotifyIconW
ExtractIconW
ShellExecuteExW
SHChangeNotify
SHGetSpecialFolderPathW
DragQueryFileW
DragFinish
SHFileOperationW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW

comctl32

_TrackMouseEvent
ImageList_Draw
ImageList_GetIcon
ImageList_GetIconSize
ord17
ImageList_AddMasked
ImageList_Create
ImageList_GetImageCount
ImageList_GetImageInfo
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_DrawEx

ole32

CreateStreamOnHGlobal
GetHGlobalFromStream
OleRun
CoCreateInstance
CoCreateGuid
OleSetContainedObject
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleCreateFromFile
OleCreateLinkToFile
OleGetIconOfClass
CreateItemMoniker
CreateGenericComposite
OleRegEnumVerbs
OleQueryCreateFromData
OleQueryLinkFromData
OleIsRunning
GetRunningObjectTable
CoGetMalloc
CreateOleAdviseHolder
CreateDataAdviseHolder
OleSave
CoRegisterMessageFilter
OleSetMenuDescriptor
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
StgIsStorageFile
StgOpenStorage
CreateFileMoniker
StgCreateDocfile
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
WriteClassStm
StgOpenStorageOnILockBytes
CoGetClassObject
OleGetClipboard
DoDragDrop
GetHGlobalFromILockBytes
OleLoad
OleCreate
OleCreateLinkFromData
OleCreateFromData
OleSaveToStream
OleIsCurrentClipboard
OleSetClipboard
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleDraw
CoDisconnectObject
PropVariantCopy
CoTreatAsClass
CreateBindCtx
ReadClassStg
ReleaseStgMedium
OleDuplicateData
OleCreateStaticFromData
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoInitialize
StringFromGUID2
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
StringFromCLSID
CLSIDFromString
CLSIDFromProgID
ProgIDFromCLSID
SetConvertStg
WriteFmtUserTypeStg
WriteClassStg
OleRegGetUserType
OleRegGetMiscStatus
ReadFmtUserTypeStg
OleFlushClipboard

oleaut32

SetErrorInfo
CreateErrorInfo
SysStringLen
SafeArrayCreate
VariantChangeType
VarDateFromStr
SafeArrayGetLBound
SafeArrayDestroy
SafeArrayUnlock
SafeArrayRedim
SafeArrayLock
SafeArrayGetVartype
SafeArrayCopy
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SysReAllocStringLen
OleLoadPicture
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarBstrFromDate
OleCreateFontIndirect
SafeArrayCreateVector
RegisterTypeLi
VarUI4FromStr
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SystemTimeToVariantTime
VariantTimeToSystemTime
VarUdateFromDate
VariantCopy
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
VariantClear
SysFreeString
LoadRegTypeLi
UnRegisterTypeLi
VarCyFromStr
LoadTypeLi
SafeArrayPutElement
GetErrorInfo

oledlg

OleUIBusyW

gdiplus

GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipCreateFromHDC
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP

wininet

FtpCreateDirectoryW
HttpOpenRequestW
InternetOpenUrlW
GopherOpenFileW
InternetConnectW
FtpFindFirstFileW
GopherCreateLocatorW
FtpCommandW
FtpOpenFileW
GopherGetAttributeW
HttpSendRequestExW
HttpEndRequestW
HttpSendRequestW
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
GopherFindFirstFileW
InternetCloseHandle
InternetFindNextFileW
HttpQueryInfoW
HttpAddRequestHeadersW
InternetErrorDlg
FtpGetFileW
FtpPutFileW
FtpGetCurrentDirectoryW
FtpSetCurrentDirectoryW
FtpRemoveDirectoryW
FtpRenameFileW
FtpDeleteFileW
InternetSetOptionExW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetGetCookieW
InternetSetCookieW
InternetQueryOptionW
InternetTimeFromSystemTimeW
DeleteUrlCacheEntryW
CreateUrlCacheEntryW
CommitUrlCacheEntryW
SetUrlCacheEntryInfoW
GetUrlCacheEntryInfoW
InternetQueryDataAvailable

netapi32

NetShareEnum

odbc32

ord154
ord31
ord30
ord49
ord48
ord43
ord29
ord9
ord140
ord13
ord18
ord141
ord167
ord111
ord20
ord59
ord108
ord139
ord24
ord170
ord166
ord165
ord147
ord153
ord119
ord156
ord16
ord4
ord136
ord160
ord75
ord12
ord72
ord107
ord176

dbghelp

SymSetOptions
SymFunctionTableAccess64
SymGetLineFromAddr64
SymInitialize
StackWalk64
SymFromAddr
SymGetModuleBase64

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoA
VerQueryValueA

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext
ImmIsIME

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

sensapi

IsNetworkAlive

Sections

.text
Size: 10.5MB - Virtual size: 10.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 114KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

53b3f0b7f814f19b5fd1a267c9b44ec4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

5c:69:50:d0:a0:5a:1c:d6:31:64:d1:e1:eb:1f:fb:8aCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

c9:09:f0:24:93:0f:ab:26:3c:ea:f7:d9:8f:81:05:24:c3:98:e3:bcSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

winmm

iphlpapi

ws2_32

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

oledlg

gdiplus

wininet

netapi32

odbc32

dbghelp

version

imm32

oleacc

sensapi

Sections

.text Size: 10.5MB - Virtual size: 10.5MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 114KB - Virtual size: 191KB

.rsrc Size: 5.2MB - Virtual size: 5.2MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

5c:69:50:d0:a0:5a:1c:d6:31:64:d1:e1:eb:1f:fb:8a
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

c9:09:f0:24:93:0f:ab:26:3c:ea:f7:d9:8f:81:05:24:c3:98:e3:bc
Signer

.text
Size: 10.5MB - Virtual size: 10.5MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 114KB - Virtual size: 191KB

.rsrc
Size: 5.2MB - Virtual size: 5.2MB