70518a2074b72bbf7340336867f2a51d44204ea1d73fc0eb2de5b70815082310

Sharing

Copy URL Twitter E-mail

General

Target

70518a2074b72bbf7340336867f2a51d44204ea1d73fc0eb2de5b70815082310
Size

2.5MB
MD5

be420b8078e309c91e4063365041c2f7
SHA1

fc9e696c3f17d730ade4ffbaa4871f32070d3006
SHA256

70518a2074b72bbf7340336867f2a51d44204ea1d73fc0eb2de5b70815082310
SHA512

372bd28c42006f2d257075f6be6751b70d7fdc2867b649a9475c8010335c41c28a697f239de92e1eaa3d9419f4abfb2f9131b17af5171148b3d43fd4949c7ec0
SSDEEP

49152:KXbjS+fZxQYJcbCKRJ976LjAGjF+8i0H440kMjpXhyjYEXQ6v2rEi3wv9nJCnS6:KXbjXvQYJcB7gz5+1SUkMZW9v2r0FYnT

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
70518a2074b72bbf7340336867f2a51d44204ea1d73fc0eb2de5b70815082310
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/out.upx

Files

70518a2074b72bbf7340336867f2a51d44204ea1d73fc0eb2de5b70815082310
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 133KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupLib.dll
.dll windows:6 windows x86 arch:x86

1c326b518f92a7bcf049e8fa323b3174

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

21/08/2024, 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a1:a3:ae:a7:39:fe:ed:11:44:8f:ad:b6:f0:55:e6:9a:68:dc:09:23:e4:76:e4:b4:47:ae:57:a7:f7:80:29:1e
Signer

Actual PE Digest

a1:a3:ae:a7:39:fe:ed:11:44:8f:ad:b6:f0:55:e6:9a:68:dc:09:23:e4:76:e4:b4:47:ae:57:a7:f7:80:29:1e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-8e18b00276fd470e835a1e79d9eeecd4\src\bin\Release_Win32\SetupLib.pdb

Imports

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

wininet

HttpAddRequestHeadersW
HttpOpenRequestA
InternetReadFile
InternetConnectA
InternetCloseHandle
HttpSendRequestExW
HttpEndRequestW
InternetOpenW
InternetCrackUrlA
InternetErrorDlg
HttpAddRequestHeadersA
InternetSetOptionW
InternetQueryOptionW
InternetWriteFile

shlwapi

StrRetToBufW
SHDeleteKeyW
StrToIntW
PathFileExistsW
PathMatchSpecW

shell32

ShellExecuteW
CommandLineToArgvW
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetFileInfoW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetKnownFolderPath
SHFileOperationW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

advapi32

BuildExplicitAccessWithNameW
CryptEncrypt
CryptImportKey
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
SystemFunction036
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
GetTokenInformation
RegDeleteValueW
LookupAccountSidW
LookupAccountNameW
AddAccessAllowedAce
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
GetFileSecurityW
AddAce
SetSecurityDescriptorSacl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
LookupPrivilegeValueW
EqualSid
GetAce
GetAclInformation
SetFileSecurityW
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW
RegEnumValueW
RegOpenKeyW
ConvertSidToStringSidW
RegCreateKeyW
RegLoadKeyW
RegUnLoadKeyW
OpenProcessToken
RegEnumKeyExW
RegSaveKeyW
RegFlushKey
RegQueryInfoKeyW
RegEnumKeyW
AdjustTokenPrivileges
CryptSetKeyParam

kernel32

CreateProcessW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
GetTickCount
GetExitCodeProcess
Sleep
DeleteFileW
Process32FirstW
GlobalAlloc
LockResource
Process32NextW
MultiByteToWideChar
CreateToolhelp32Snapshot
OpenProcess
UnmapViewOfFile
GetSystemDirectoryW
GetCurrentThreadId
CreateFileW
WaitForSingleObject
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
EnterCriticalSection
SizeofResource
ReadFile
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
GetModuleFileNameW
GetTempPathW
LoadLibraryExW
GetEnvironmentVariableW
GlobalHandle
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
InitOnceComplete
InitOnceBeginInitialize
GetNativeSystemInfo
CreateFileMappingA
DebugBreak
FreeLibrary
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
MoveFileExW
GetProcAddress
DecodePointer
FindResourceW
lstrcpyW
lstrcatW
WaitNamedPipeW
SetNamedPipeHandleState
CreateFileA
OutputDebugStringA
LoadResource
FindResourceExW
RaiseException
CreateIoCompletionPort
PostQueuedCompletionStatus
GetCurrentProcessId
GetQueuedCompletionStatus
SetThreadContext
GetThreadContext
SuspendThread
VirtualQuery
VirtualProtect
HeapAlloc
LoadLibraryW
OutputDebugStringW
GetLastError
LocalAlloc
FindClose
lstrlenA
InitializeCriticalSectionAndSpinCount
lstrlenW
FindNextFileW
GetFullPathNameW
SetLastError
HeapFree
FindFirstFileW
RtlCaptureStackBackTrace
GetLongPathNameW
CloseHandle
LocalFree
GlobalFree
TransactNamedPipe
GetCommandLineW
TerminateThread
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
QueryDosDeviceW
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
GetLogicalDriveStringsW
FileTimeToSystemTime
GlobalLock
GetTempFileNameW
GlobalUnlock
CreateDirectoryW
GetProcessId
GetFileAttributesExW
SystemTimeToFileTime
CopyFileW
GetFileTime
WriteFile
SetFilePointer
DuplicateHandle
ExitThread
CreateEventW
FormatMessageW
CreateThread
GetFileSize
OpenMutexW
CreateMutexW
ReleaseMutex
GetVersionExW
OpenFileMappingW
GetWindowsDirectoryW
FlushFileBuffers
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
VirtualFree
VirtualAlloc
GetCurrentThread
GetExitCodeThread
SetThreadPriority
lstrcmpiW
GetDiskFreeSpaceExW
OpenEventW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
FormatMessageA
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
LoadLibraryExA
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetTimeZoneInformation
ExitProcess
GetStdHandle
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
SetConsoleCtrlHandler
GetFileSizeEx
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetConsoleOutputCP
SetEndOfFile
WriteConsoleW
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
MoveFileExA
CompareFileTime
GetEnvironmentVariableA
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
SetConsoleMode
ReadConsoleA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTime
GetLocalTime
GetSystemInfo
GetCurrentDirectoryW

user32

ClientToScreen
PtInRect
OffsetRect
ExitWindowsEx
SetCursor
GetProcessWindowStation
PostQuitMessage
wvsprintfW
GetMessageW
SetActiveWindow
SetRect
SetFocus
IsIconic
DestroyWindow
GetUserObjectInformationW
SetForegroundWindow
GetParent
GetPropW
FindWindowW
MessageBoxIndirectW
SystemParametersInfoW
GetDesktopWindow
NotifyWinEvent
IsWindowEnabled
GetForegroundWindow
AttachThreadInput
GetMonitorInfoW
ShowWindow
CharNextW
LoadStringW
UnregisterClassW
DestroyIcon
EndPaint
BeginPaint
InvalidateRect
LoadImageW
SetWindowLongW
CopyRect
SetTimer
FillRect
GetWindowRect
CallWindowProcW
DefWindowProcW
GetWindowLongW
GetClassInfoExW
UnloadKeyboardLayout
GetClientRect
LoadCursorW
LoadKeyboardLayoutW
GetKeyboardLayoutList
IsWindow
RegisterClassExW
SendMessageW
CreateWindowExW
MessageBoxW
FindWindowExW
GetWindowTextW
RegisterWindowMessageW
SubtractRect
IntersectRect
GetMessagePos
GetFocus
UpdateLayeredWindow
DrawTextW
LoadIconW
SetParent
DispatchMessageW
GetKeyState
InsertMenuItemW
ScreenToClient
CreatePopupMenu
GetWindowPlacement
TrackPopupMenu
SetMenuItemInfoW
TrackMouseEvent
DestroyMenu
SetPropW
SetCapture
AppendMenuW
PeekMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
WindowFromPoint
SetRectEmpty
MoveWindow
ReleaseCapture
GetWindowThreadProcessId
GetCursorPos
WaitMessage
CallMsgFilterW
GetQueueStatus
EnableWindow
KillTimer
SetWindowTextW
GetWindowTextLengthW
GetDlgItem
wsprintfW
MonitorFromPoint
GetDC
IsWindowVisible
SetWindowPos
MonitorFromWindow
GetSystemMetrics
DeleteMenu
GetMenuItemInfoW
GetSystemMenu
PostMessageW
SendMessageTimeoutW
GetMenuItemCount
ReleaseDC

gdi32

CreateDIBSection
SetViewportOrgEx
GetTextExtentExPointW
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
DeleteDC
DeleteObject
SetTextCharacterExtra
SetBkMode
SetTextColor
GetObjectW
GetStockObject
CreateFontIndirectW
GetFontData

ole32

CoTaskMemFree
OleSetContainedObject
OleCreate
CoCreateGuid
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantClear

imm32

ImmDisableIME
ImmGetIMEFileNameW
ImmInstallIMEW
ImmGetContext
ImmNotifyIME
ImmSetOpenStatus

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

msimg32

AlphaBlend

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty

wldap32

ord41
ord22
ord60
ord301
ord200
ord211
ord46
ord30
ord79
ord35
ord26
ord27
ord33
ord32
ord50
ord143
ord217

bcrypt

BCryptGenRandom

winhttp

WinHttpSetOption
WinHttpQueryOption
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpOpen
WinHttpWriteData
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpConnect
WinHttpCrackUrl

ws2_32

htonl
listen
recv
getaddrinfo
freeaddrinfo
connect
sendto
getpeername
ioctlsocket
gethostname
bind
accept
select
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
__WSAFDIsSet
socket
getsockname
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
setsockopt
WSAIoctl
recvfrom
htons
closesocket
WSAWaitForMultipleEvents

oleacc

AccessibleObjectFromWindow
LresultFromObject

winmm

timeGetTime

Exports

Exports

AddAccess
AddAccessExec
AddAccessOnReg
AddAccess_RX
AddIE7ElevationPolicy
AddSogouImeMgrSchTasks
AttachProgressBar
BackupExe
BackupOtherFile
BackupSysDict
CancelDelayDelDir
CancleDelayDelDirWrap
CheckAccess
CheckInDelayDir
CheckRegKeyIsVolatile
CmpFile
CopyRegToArm32
CorrectSmartInfoUsed
CreateSmartInfoUid
CreateSogouInputUid
DefaultBrowserIsIE
DelBackupExe
DelayDelFile
DelayDelReg
DelayDeleteSogouImeFile
DeleteShortcut
DeleteShortcutWithPath
DeleteVolatileRegKey
DownloadQuiet
ExecWait
FilterSid
GetAppDataPath
GetArm32SysPath
GetBDInfo
GetCheckBoxState
GetFeedBackContact
GetFeedBackReason
GetFinishIds
GetFinishStats
GetHWID
GetHandleVerifier
GetHwndImage
GetHwndMain
GetImeInstallMutex
GetInstallPath
GetOSVersionTime
GetPPName
GetQQStatistics
GetRealOsVersion
GetSmartInfoOption
GetVerifyText
GuiInitAndAttach
HideChildWindows
ImageInstallingStart
InitResource
InstSuccessUserNetSchedule
InstallIME
InstalledIMEIsPre30b1
IsArmArch
IsFinishCheckBoxShow
IsFinishCloseBtnClicked
IsFullScreenActivated
IsInWin8
IsInX64
IsInXP
IsReadScreenEnable
IsRecommendTimeout
IsShowOpenMedal
IsSmartInfoEnable
IsSogouExplorerInstalled
IsSogouMobileInstalled
KillProcess
MonitorUninstallCompleted
MonitorVerifyUninstallSelect
MoveImeDir
MoveUrlGuideIcon
OnAbort
OnPageLeave
OnPagePre
OnPageShow
OpenPage
Ping
PluginToComp
QQMgrSetIESP
ReadIniStr
ReadSmartInfoOption
RemoveAppDataDir
RemoveCommonDir
RemoveDir
RemoveFireWall
RemoveIE7ElevationPolicy
RemoveSogouImeMgrSchTasks
SECheckOSInstalled
SaveInstallTime
SetAccessRights
SetCheckBoxState
SetGuideQQUrl
SetLowLabel
SetMutex
SetPathAccessRightsRecursive
SetQQShowType
SetReboot
SetRecommendTime
SetShowQQ
SetSmartInfoOption
SetUrlInvite
SetWithType
ShowQQOrNot
SwitchIme
UnGuiInitAndAttach
UninstallInstPath
UninstallReg
UninstallUsrReg
UpdateFireWall
WaitAccountThread

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 123KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 231KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.7MB

UPX1 Size: 23KB - Virtual size: 24KB

.rsrc Size: 133KB - Virtual size: 136KB

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

1c326b518f92a7bcf049e8fa323b3174

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

a1:a3:ae:a7:39:fe:ed:11:44:8f:ad:b6:f0:55:e6:9a:68:dc:09:23:e4:76:e4:b4:47:ae:57:a7:f7:80:29:1eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wtsapi32

wininet

shlwapi

shell32

version

advapi32

kernel32

user32

gdi32

ole32

oleaut32

imm32

psapi

msimg32

crypt32

wldap32

bcrypt

winhttp

ws2_32

oleacc

winmm

Exports

Exports

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 123KB - Virtual size: 294KB

UPX0
Size: - Virtual size: 2.7MB

UPX1
Size: 23KB - Virtual size: 24KB

.rsrc
Size: 133KB - Virtual size: 136KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

a1:a3:ae:a7:39:fe:ed:11:44:8f:ad:b6:f0:55:e6:9a:68:dc:09:23:e4:76:e4:b4:47:ae:57:a7:f7:80:29:1e
Signer

.text
Size: 4.5MB - Virtual size: 4.5MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 123KB - Virtual size: 294KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.rsrc
Size: 1024B - Virtual size: 736B

.reloc
Size: 231KB - Virtual size: 231KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 590B

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 2.1MB

.rsrc
Size: 134KB - Virtual size: 133KB