2024-04-28_a665272eab4e34d4e5a849ee9329ebfb_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-28_a665272eab4e34d4e5a849ee9329ebfb_mafia
Size

7.3MB
MD5

a665272eab4e34d4e5a849ee9329ebfb
SHA1

8c7ecb42e1472391554953bbd3cb5e3e8f6e5892
SHA256

4e835d7968376b6e99e89cb9dcd6d6b53ae426b0bd07abe70c0e04f3fca65222
SHA512

b7e3aa984d256d7fbc46d1866a9238ffe0c2dd08676ae5835b5733232dfc955572c3ef0c5f282d03e71a40316a5cd50e428e2157d98749423f5efb9c96d90c69
SSDEEP

196608:5lSeMU3xgr+KqkFhpc8pfiO0ojDIg9Cbk/V8o:5ReFhpXXD

Score

1^/10

Malware Config

Signatures

Files

2024-04-28_a665272eab4e34d4e5a849ee9329ebfb_mafia
.exe windows:5 windows x86 arch:x86

3efa28d52bfec80f64997f5eff88e091

Code Sign

04:00:00:00:00:01:20:19:c1:90:66
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/03/2009, 11:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Not Before

21/12/2009, 09:32

Not After

22/12/2020, 09:32

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:67:58:c1:f4:25:4a:a0:28:c9:f1:3f:31:8a:cb:4c
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

07/01/2011, 00:00

Not After

06/01/2013, 23:59

Subject

CN=厦门美图网科技有限公司,OU=产品部,O=厦门美图网科技有限公司,L=Xiamen,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:e1:ae:36:ed:6e:f6:5b:e9:71:34:5e:f9:de:5d:dc:be:5c:64:d6
Signer

Actual PE Digest

7e:e1:ae:36:ed:6e:f6:5b:e9:71:34:5e:f9:de:5d:dc:be:5c:64:d6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\MTXX3\MTXX\2012.01.16 3.0.7.1001正式版MTXX\xiuxiu\XiuXiu.pdb

Imports

pcfile

?OnSaveHDJpeg@PC_File@@SAHPB_WPAVBitmap@Gdiplus@@HHPAVCObjProgress@@HH@Z
?OnLoadImage@PC_File@@SAPAVBitmap@Gdiplus@@HHPAK@Z
?OnLoadImage@PC_File@@SAPAVBitmap@Gdiplus@@PB_WPAVCObjProgress@@HH0@Z
?GetImageFormat@PC_File@@SA?AW4MT_IMAGE_FORMAT@@XZ
?GetImageInfo@PC_File@@SAPAUtag_ImageInfo@@XZ
?OnLoadImage@PC_File@@SAPAVBitmap@Gdiplus@@PB_WHHPAVCObjProgress@@HH@Z
?ImageSaveTobinary@PC_File@@SAHPAVBitmap@Gdiplus@@PB_WPAVCObjProgress@@HH@Z
?ImageReadFrombinary@PC_File@@SAPAVBitmap@Gdiplus@@PB_WPAVCObjProgress@@HH@Z
?OnSaveQuick@PC_File@@SAHPB_WPAVBitmap@Gdiplus@@W4MT_IMAGE_FORMAT@@H@Z
?OnLoadImage@PC_File@@SAPAVBitmap@Gdiplus@@PAEHW4MT_IMAGE_FORMAT@@PAVCObjProgress@@HH@Z
?GetEncoderClsid@PC_File@@SAHPB_WPAU_GUID@@@Z
?OnSaveQuick@PC_File@@SAHPB_WPAVBitmap@Gdiplus@@HHW4MT_IMAGE_FORMAT@@H@Z

pcdsp

?UsmSharp@PC_Dsp@@SAHPAEHHMMPAVCObjProgress@@HH@Z
?GeneralGifByBmp@PC_Dsp@@SAHPAPAVBitmap@Gdiplus@@HHHV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAHPAVCObjProgress@@HH@Z
?RedEyeRemove@PC_Dsp@@SAHPAVBitmap@Gdiplus@@ABUtagRECT@@@Z
?GaussIIRBlur@PC_Dsp@@SAHPAVBitmap@Gdiplus@@HHPAVCObjProgress@@HH@Z
?Clone@PC_Dsp@@SAHPAVBitmap@Gdiplus@@HHHHPAPAV23@@Z
?ResizeBitmap@PC_Dsp@@SAHPAPAVBitmap@Gdiplus@@HH@Z
?WC2MB@PC_Dsp@@SAPADPB_W@Z
?CreatNetWord@PC_Dsp@@SAHAAUtagFontObj@@AAUtagPathObj@@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAVCObjProgress@@HHPB_W@Z
?GetWordSize@PC_Dsp@@SAHPAUHWND__@@AAUtagFontObj@@AAUtagPathObj@@H@Z
?CompositeWord@PC_Dsp@@SAHPAVGraphics@Gdiplus@@PAUtagFontObj@@PAUtagPathObj@@HNNMM@Z
?CreateArray@PC_Dsp@@SAHPAEJJ@Z
?DisplayImageUseGDIPLUS@PC_Dsp@@SAHPAVGraphics@Gdiplus@@PAVBitmap@3@HHNHN@Z
?GetBits@CyImage@@QAEPAEK@Z
?GetBpp@CyImage@@QBEGXZ
?CalSuitRectForScene@PC_Dsp@@SAHHHHHPAUtagRECT@@AAN@Z
??0CyImage@@QAE@XZ
??1CyImage@@UAE@XZ
?CreateFromHBITMAP@CyImage@@QAE_NPAUHBITMAP__@@PAUHPALETTE__@@@Z
??0CyImage@@QAE@ABV0@_N11@Z
?GaussDenoise@PC_Dsp@@SAHPAVBitmap@Gdiplus@@HNNNNPAVCObjProgress@@HH@Z
?SimilarTopaz@PC_Dsp@@SAHPAVBitmap@Gdiplus@@PAVCObjProgress@@HH@Z
?CurveDenoise@PC_Dsp@@SAHPAVBitmap@Gdiplus@@HHHPAVCObjProgress@@HH@Z
?SkinDenoise@PC_Dsp@@SAHPAVBitmap@Gdiplus@@HHHHPAVCObjProgress@@HH@Z
?GrayScale@PC_Dsp@@SAHPAVBitmap@Gdiplus@@PAVCObjProgress@@HH@Z
?BitCrop@PC_Dsp@@SAPAVBitmap@Gdiplus@@PAV23@HHHH@Z
?WhiteBank@PC_Dsp@@SAHPAVBitmap@Gdiplus@@@Z
?IncreaseBpp@PC_Dsp@@SAHPAPAVBitmap@Gdiplus@@H@Z
?Negative@PC_Dsp@@SAHPAVBitmap@Gdiplus@@PAVCObjProgress@@HH@Z
?Mix@PC_Dsp@@SAHPAVBitmap@Gdiplus@@0JJ@Z
?GetBitDib@PC_Dsp@@SAPAUtagBITMAPINFOHEADER@@PAVBitmap@Gdiplus@@AAH@Z
?CropBitmap@PC_Dsp@@SAHPAPAVBitmap@Gdiplus@@HHHH@Z
?DrawImage@PC_Dsp@@SAHPAVBitmap@Gdiplus@@PAPAV23@HHHH@Z
?CompositeColor@PC_Dsp@@SAHPAVBitmap@Gdiplus@@EEEPAVCObjProgress@@HH@Z
?Skinbeautify@PC_Dsp@@SAHPAVBitmap@Gdiplus@@HHHNHPAVCObjProgress@@HH@Z
?Mosaic@PC_Dsp@@SAHPAVBitmap@Gdiplus@@HPAVCObjProgress@@HH@Z
?CreatSmallestRegion@PC_Dsp@@SAHHHPAUtagPOINT@@HPAUtagRECT@@@Z
?GeneralGifByCxs@PC_Dsp@@SAHPAPAVCyImage@@HHHV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAHPAVCObjProgress@@HH@Z
?GeneralGifByCxs@PC_Dsp@@SAHPAPAVCyImage@@HHV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAHPAVCObjProgress@@HH@Z
?CropImageByPoint@PC_Dsp@@SAPAVBitmap@Gdiplus@@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAUtagPOINT@@HAAUtagRECT@@@Z
?CalSuitNewRat@PC_Dsp@@SAHHHHHAAN@Z
?CalSuitNewPosition@PC_Dsp@@SAHHHHHAAH0@Z
?SetPaletteColor@CyImage@@QAEXEUtagRGBQUAD@@@Z
?ColorEqual@PC_Dsp@@SAHUtagRGBQUAD@@0@Z
?SetPixelIndex@CyImage@@QAEXJJE@Z
?SetTransColor@CyImage@@QAEXUtagRGBQUAD@@@Z
??0CQuantizer@@QAE@II@Z
??1CQuantizer@@UAE@XZ
?SetColorTable@CQuantizer@@QAEXPAUtagRGBQUAD@@@Z
?ProcessImage@CQuantizer@@QAEHPAX@Z
?DecreaseBpp@CyImage@@QAE_NK_NPAUtagRGBQUAD@@KPAVCObjProgress@@HH@Z
?ConvertTo32Bits@PC_Dsp@@SAHPAPAVBitmap@Gdiplus@@@Z
?Light@PC_Dsp@@SAHPAVBitmap@Gdiplus@@JJPAVCObjProgress@@HH@Z
?Multiple@PC_Dsp@@SAHPAVBitmap@Gdiplus@@0PAVCObjProgress@@HH@Z
?SetColorWithBitmap@PC_Dsp@@SAHPAVBitmap@Gdiplus@@EEE@Z
?DrawByAlphaChange@PC_Dsp@@SAHPAVBitmap@Gdiplus@@0N@Z
?ExpandFrame@PC_Dsp@@SAHPAPAVBitmap@Gdiplus@@HHHHUtagRGBQUAD@@@Z
?ShowShadow@PC_Dsp@@SAHPAPAVBitmap@Gdiplus@@HHHHHK@Z
?SetNewCrop@PC_Dsp@@SAHPAPAVBitmap@Gdiplus@@HHHHHHHH@Z
??0CCUSMSharp@@QAE@XZ
??1CCUSMSharp@@QAE@XZ
?useEffect@CCUSMSharp@@QAEPAVBitmap@Gdiplus@@PAV23@MM@Z
?CreateGif@PC_Dsp@@SAHV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAPAVBitmap@Gdiplus@@HHPAVCObjProgress@@HH@Z
?Light@PC_Dsp@@SAHPAEHHJJPAVCObjProgress@@HH@Z
?Saturateconst@PC_Dsp@@SAHPAEHHJJPAVCObjProgress@@HH@Z
?SetHue@PC_Dsp@@SAHPAEHHHPAVCObjProgress@@HH@Z
?SetColor@PC_Dsp@@SAHPAEHHHHHPAVCObjProgress@@HH@Z
?AutoColorLevel@PC_Dsp@@SAHPAVBitmap@Gdiplus@@HPAVCObjProgress@@HH@Z
?AutoConstrast@PC_Dsp@@SAHPAVBitmap@Gdiplus@@PAVCObjProgress@@HH@Z
?AutoColor@PC_Dsp@@SAHPAVBitmap@Gdiplus@@HHPAVCObjProgress@@HH@Z
?MultiRotateEx@PC_Dsp@@SAPAVBitmap@Gdiplus@@PAV23@HHHHEEE@Z
?MultiRotate@PC_Dsp@@SAPAVBitmap@Gdiplus@@PAV23@HHHHH@Z
?SingleRotate@PC_Dsp@@SAHPAVBitmap@Gdiplus@@W4RotateFlipType@3@@Z
?CompositeAlphaLevel@PC_Dsp@@SAHPAVBitmap@Gdiplus@@0PAVCObjProgress@@HH@Z

pceffect

?ResizeMainToSuit@CMathDefine@@SAHHHHHPAVCRect@@AAN@Z
?PtChangeByRotate@CMathDefine@@SAXAAVPoint@Gdiplus@@HHN@Z
?AverageRandom@CMathDefine@@SAHHH@Z
?Cartoon@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?LOMO@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_3@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?FullSaturation@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_6@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_2@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_12@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?PictureSketch@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_9@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_5@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?GrayScaleEn@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_1@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_13@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_15@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_16@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_4@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_12@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?oldPhoto@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_6@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_7@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_8@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_9@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_4@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_8@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_13@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_11@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?Studio_0@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_4@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_11@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_9@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewLOMO_10@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_14@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_10@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_8@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_3@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_7@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_2@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_5@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_5@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_1@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewGt_4@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewGt_6@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?RainbowColor@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewGt_2@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewGt_5@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewGt_1@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewGt_7@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewGt_3@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_1@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?Jieri_1@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?Jieri_2@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_12@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_13@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_14@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?addNoisy@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?UnColor@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?BackLight@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?ComposeLight@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_6@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_7@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_3@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_11@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?Jieri_3@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?LifeSketch@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?ClassicSketch@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?TvLine@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?Emboss@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?Warmer@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?Sharpen@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?SoftEn@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?Dehazing@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?quxian_2@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?HalfSaturation@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?paper@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z
?NewStd_10@CEffect@@SAHPAEHHPAXPAVCObjProgress@@HH@Z

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

LoadLibraryW
GetProcAddress
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource
FreeLibrary
GetPrivateProfileIntW
CopyFileW
SetEvent
WritePrivateProfileStringW
SetLastError
DeactivateActCtx
GetModuleHandleW
ActivateActCtx
GetVersion
InterlockedDecrement
InterlockedIncrement
GetFileAttributesW
lstrlenW
WideCharToMultiByte
lstrcpynA
LCMapStringA
GlobalFree
GetVersionExW
lstrlenA
GetCPInfo
lstrcmpiW
GetModuleFileNameW
CreateDirectoryW
CreateFileW
ReadFile
SetFilePointer
WriteFile
CloseHandle
RemoveDirectoryW
GlobalMemoryStatus
GetFileSize
FormatMessageW
GetProcessHeap
HeapFree
CreateFileA
HeapAlloc
ResetEvent
GetCurrentThreadId
CreateThread
WaitForSingleObject
lstrcpyW
VirtualAlloc
VirtualFree
GlobalMemoryStatusEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetTickCount
InitializeCriticalSection
OutputDebugStringW
CreateSemaphoreW
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
TerminateProcess
Process32NextW
lstrcpynW
lstrcatW
LocalFree
GlobalReAlloc
GlobalSize
LocalAlloc
GetWindowsDirectoryW
SetFileAttributesW
DeviceIoControl
LoadLibraryA
ResumeThread
CreateEventW
MulDiv
GetExitCodeThread
GetLocalTime
GetCurrentProcess
GetProcessTimes
FileTimeToSystemTime
FileTimeToLocalFileTime
AreFileApisANSI
lstrcmpW
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
CreateMutexW
ReleaseMutex
GetCurrentProcessId
SetThreadPriority
SuspendThread
CreateActCtxW
ReleaseActCtx
lstrcmpA
DeleteCriticalSection
FindNextFileW
FindFirstFileW
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
GlobalGetAtomNameW
InterlockedExchange
CompareStringA
GetLocaleInfoW
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GetCurrentThread
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetUserDefaultLCID
GetFileTime
GetTempFileNameW
SetErrorMode
GetFileAttributesExW
GetFileSizeEx
GetCurrentDirectoryW
GetNumberFormatW
GetTempPathW
GetProfileIntW
SearchPathW
VirtualProtect
FindResourceExW
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
ExitProcess
GetSystemTimeAsFileTime
GetTimeFormatW
GetDateFormatW
ExitThread
RtlUnwind
RaiseException
HeapReAlloc
HeapQueryInformation
HeapSize
GetSystemInfo
VirtualQuery
SetStdHandle
GetFileType
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
QueryPerformanceCounter
UnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
WriteConsoleW
GetDriveTypeW
SetEnvironmentVariableA
DeleteFileW
GetPrivateProfileStringW
FindResourceW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
TerminateThread
InitializeCriticalSectionAndSpinCount
GetLastError
FindClose
MultiByteToWideChar
Sleep
InterlockedCompareExchange

user32

IsClipboardFormatAvailable
SetMenuDefaultItem
SetParent
LockWindowUpdate
CharNextW
InvalidateRgn
CopyAcceleratorTableW
SetLayeredWindowAttributes
EnumDisplayMonitors
UnregisterClassW
RealChildWindowFromPoint
ShowOwnedPopups
DrawStateW
SetWindowContextHelpId
MapDialogRect
MessageBeep
PostQuitMessage
MonitorFromPoint
IsZoomed
GetSystemMenu
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
BringWindowToTop
TranslateAcceleratorW
DestroyAcceleratorTable
NotifyWinEvent
CharUpperW
DrawIcon
DestroyMenu
MapVirtualKeyW
GetKeyNameTextW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
CheckDlgButton
ValidateRect
GetActiveWindow
CreateDialogIndirectParamW
EndDialog
EndPaint
BeginPaint
GetWindowThreadProcessId
IsWindowEnabled
GetMenuStringW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
GetWindowTextLengthW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
WaitMessage
TrackPopupMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetClassInfoExW
GetClassInfoW
RegisterClassW
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
CheckMenuItem
UpdateLayeredWindow
GetWindowDC
GetIconInfo
WindowFromPoint
GetWindowRgn
CreateWindowExW
RegisterClassExW
DefWindowProcW
GetCursorPos
RegisterClipboardFormatW
LoadMenuW
GetFocus
GetNextDlgTabItem
ClipCursor
DestroyCursor
LoadImageW
GetMessagePos
GetCapture
FrameRect
DrawFrameControl
InflateRect
SetRectEmpty
DrawFocusRect
SetForegroundWindow
ShowWindow
IsIconic
FindWindowW
IsMenu
EnumWindows
GetClientRect
InvalidateRect
GrayStringW
DrawTextExW
DrawTextW
UnhookWindowsHookEx
RemovePropW
SetWindowsHookExW
LoadIconW
OffsetRect
MoveWindow
GetMenu
GetWindowTextW
EnableMenuItem
SetFocus
DestroyWindow
ReleaseCapture
SetCapture
EqualRect
UnionRect
IsRectEmpty
SetClassLongW
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
GetMenuDefaultItem
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
CharUpperBuffW
SetCursorPos
EnumChildWindows
IntersectRect
TranslateMessage
GetMessageW
PostThreadMessageW
IsWindowVisible
GetClassNameW
AdjustWindowRectEx
CallWindowProcW
EnumDisplaySettingsW
wsprintfW
GetDlgItem
GetSubMenu
CopyImage
GetNextDlgGroupItem
InvertRect
HideCaret
CopyIcon
GetDoubleClickTime
GetUpdateRect
SubtractRect
IsCharLowerW
MapVirtualKeyExW
TabbedTextOutW
SendMessageW
SetTimer
SetMenu
PtInRect
SetCursor
LoadCursorW
KillTimer
EnableWindow
SetWindowPos
GetDC
GetWindowRect
GetWindowLongW
SetWindowLongW
ReleaseDC
GetKeyState
GetParent
ScreenToClient
PostMessageW
UpdateWindow
RedrawWindow
IsWindow
ClientToScreen
GetWindow
MessageBoxW
PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjects
SetWindowRgn
SetRect
GetSystemMetrics
GetAsyncKeyState
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
CopyRect
FillRect
DrawEdge
GetSysColor
GetMenuItemInfoW
SystemParametersInfoW
DrawIconEx
DestroyIcon
GetDesktopWindow
AppendMenuW
GetMenuItemCount
InsertMenuW
ModifyMenuW
GetMenuState
GetMenuItemID
CreateMenu
CreatePopupMenu
GetSysColorBrush
LoadBitmapW
RemoveMenu
DeleteMenu
EnableScrollBar

gdi32

PatBlt
CreateHatchBrush
Rectangle
CreatePolygonRgn
PtInRegion
CreateEllipticRgn
GetClipBox
CreateBitmap
CreatePalette
RealizePalette
GetTextMetricsW
Polygon
LineDDA
SetPixelV
CreateFontW
GetDIBits
GetSystemPaletteEntries
SelectPalette
CreateDIBitmap
SetDIBColorTable
SetStretchBltMode
StretchBlt
GetPaletteEntries
CreateDCW
SetPaletteEntries
GetNearestPaletteIndex
SetMapMode
SetBkColor
FillRgn
EnumFontsW
SetBkMode
SetTextColor
CopyMetaFileW
SaveDC
RestoreDC
SetPolyFillMode
SetROP2
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
CreatePen
GetLayout
SetLayout
SelectClipRgn
SetViewportOrgEx
OffsetViewportOrgEx
SetPixel
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
GetObjectType
CreateRectRgnIndirect
SetRectRgn
EnumFontFamiliesW
GetTextCharsetInfo
GetRgnBox
GetTextColor
OffsetRgn
Polyline
GetWindowOrgEx
GetBoundsRect
GetViewportOrgEx
ExtFloodFill
GetTextFaceW
GetPixel
CreateDIBSection
GetDeviceCaps
FrameRgn
CreateSolidBrush
EnumFontFamiliesExW
CombineRgn
CreateRectRgn
GetObjectW
GetStockObject
CreateRoundRectRgn
DeleteDC
DeleteObject
SelectObject
GetTextExtentPoint32W
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
CreateCompatibleDC
LPtoDP
CreateCompatibleBitmap
Ellipse
CreateFontIndirectW
SetViewportExtEx
GetBkMode
GetMapMode
GetWindowExtEx
GetViewportExtEx
DPtoLP
GetBkColor
BitBlt

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegEnumKeyW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueW
RegEnumValueW
RegOpenKeyExW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ShellExecuteExW
DragQueryFileW
DragFinish
SHGetFileInfoW
SHAppBarMessage
SHGetDesktopFolder
SHGetSpecialFolderLocation
ShellExecuteW
SHGetMalloc

comctl32

_TrackMouseEvent
ImageList_GetIconSize
InitCommonControlsEx

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW
SHGetValueW
SHSetValueW
PathRemoveArgsW
PathUnquoteSpacesW
PathStripToRootW
PathIsUNCW

ole32

ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
CoInitializeEx
OleDraw
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleLockRunning
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
DoDragDrop
RevokeDragDrop
CoLockObjectExternal
CLSIDFromProgID
CoCreateInstance
CoTaskMemFree
CoCreateGuid
CoUninitialize
CoInitialize
RegisterDragDrop
OleGetClipboard
IsAccelerator
CreateStreamOnHGlobal
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantChangeType
OleLoadPicture
VariantClear
VarBstrCmp
SysStringLen
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysAllocString
OleCreateFontIndirect
VarBstrFromDate
SafeArrayGetLBound

oledlg

OleUIBusyW

urlmon

FindMimeFromData

wininet

InternetOpenW
InternetOpenUrlW
HttpQueryInfoW
InternetReadFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetQueryDataAvailable
InternetCrackUrlW
HttpOpenRequestW
InternetGetConnectedState
InternetSetOptionW
HttpSendRequestExW
InternetConnectW
HttpEndRequestW
InternetWriteFile
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCloseHandle
HttpSendRequestW

gdiplus

GdipSetClipRectI
GdipCreateHBITMAPFromBitmap
GdipFillEllipseI
GdipDrawPolygonI
GdipDrawPath
GdipResetPath
GdipAddPathEllipseI
GdipSetPenEndCap
GdipSetPenMode
GdipSetPenLineJoin
GdipDrawLinesI
GdipSetStringFormatFlags
GdipAddPathString
GdipGetGenericFontFamilySerif
GdipSetImagePalette
GdipAddPathLine2I
GdipCreateRegionPath
GdipCreateRegionRectI
GdipCombineRegionRegion
GdipIsEmptyRegion
GdipDrawImagePointsI
GdipSetPenDashStyle
GdipDrawImageRect
GdipDrawLine
GdipSetSolidFillColor
GdipTransformMatrixPoints
GdiplusShutdown
GdiplusStartup
GdipAddPathLineI
GdipCreateHatchBrush
GdipAddPathRectangleI
GdipAddPathArcI
GdipGetPointCount
GdipMeasureString
GdipCreateBitmapFromHBITMAP
GdipBitmapSetResolution
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipLoadImageFromFile
GdipCreateLineBrushFromRectI
GdipSetLineBlend
GdipGetPathData
GdipGetPageUnit
GdipGetDpiX
GdipGetDpiY
GdipGetImagePaletteSize
GdipGetImagePalette
GdipDrawEllipseI
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetImageHeight
GdipGetImageWidth
GdipCreateTexture2
GdipDeleteBrush
GdipCloneBrush
GdipTranslateTextureTransform
GdipFillRectangle
GdipCreateFont
GdipDeleteFont
GdipSetTextRenderingHint
GdipDrawImageRectI
GdipCreateSolidFill
GdipDrawString
GdipReleaseDC
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipLoadImageFromStream
GdipDrawImagePointRectI
GdipImageSelectActiveFrame
GdipFillRectangleI
GdipCreateBitmapFromScan0
GdipDeleteRegion
GdipCreateRegionHrgn
GdipFillRegion
GdipGraphicsClear
GdipSetInterpolationMode
GdipCreatePen1
GdipDeletePen
GdipDrawLineI
GdipCreatePen2
GdipDrawRectangleI
GdipCreateStringFormat
GdipDeleteStringFormat
GdipAddPathStringI
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilyMonospace
GdipCreatePath
GdipDeletePath
GdipGetPathWorldBounds
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipTransformPath
GdipClonePath
GdipGetImageGraphicsContext
GdipSetSmoothingMode
GdipFillPath
GdipAddPathPath
GdipScaleMatrix
GdipCreateLineBrushI
GdipSaveImageToStream
GdipSaveAddImage
GdipSaveAdd
GdipCreateBitmapFromStream
GdipTransformMatrixPointsI
GdipRotateMatrix
GdipSetWorldTransform
GdipDrawImageRectRectI
GdipImageRotateFlip
GdipCloneBitmapAreaI
GdipGetImagePixelFormat
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipSetImageAttributesWrapMode
GdipSetCompositingMode
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipResetWorldTransform
GdipDrawImageRectRect
GdipDrawImageI
GdipGetInterpolationMode
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateTexture

crashreport

TrySwitch
Install
Unstall

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersAddresses

winmm

PlaySoundW

netapi32

Netbios

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 902KB - Virtual size: 901KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 126KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 428KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3efa28d52bfec80f64997f5eff88e091

Code Sign

04:00:00:00:00:01:20:19:c1:90:66Certificate

Key Usages

01:00:00:00:00:01:25:b0:b4:cc:01Certificate

Extended Key Usages

Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

1e:67:58:c1:f4:25:4a:a0:28:c9:f1:3f:31:8a:cb:4cCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

7e:e1:ae:36:ed:6e:f6:5b:e9:71:34:5e:f9:de:5d:dc:be:5c:64:d6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

pcfile

pcdsp

pceffect

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

urlmon

wininet

gdiplus

crashreport

setupapi

iphlpapi

winmm

netapi32

oleacc

imm32

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rdata Size: 902KB - Virtual size: 901KB

.data Size: 126KB - Virtual size: 184KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 428KB - Virtual size: 428KB

04:00:00:00:00:01:20:19:c1:90:66
Certificate

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

1e:67:58:c1:f4:25:4a:a0:28:c9:f1:3f:31:8a:cb:4c
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

7e:e1:ae:36:ed:6e:f6:5b:e9:71:34:5e:f9:de:5d:dc:be:5c:64:d6
Signer

.text
Size: 4.5MB - Virtual size: 4.5MB

.rdata
Size: 902KB - Virtual size: 901KB

.data
Size: 126KB - Virtual size: 184KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 428KB - Virtual size: 428KB