2024-04-29_25d8440a0473e1e357f235576d78d76d_mafia_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-29_25d8440a0473e1e357f235576d78d76d_mafia_magniber
Size

9.8MB
MD5

25d8440a0473e1e357f235576d78d76d
SHA1

5ade10b1fb32f65bd9c77e04bc3e00b25b1e7597
SHA256

9b7ae1f4bbed29519369a01fc8b4178b92fe70518d3ecd218dd15d9b2b34254b
SHA512

b9c0d2bbeacca7ee165da616f25886919d1aea3a26ab15fcab041cab6a5dffc02a7aa4a325f65805e15172d88015a7b86950f3f1422330fe2f6cd2d650f07587
SSDEEP

196608:AuNMejTrg5mbCEDftBzzP+A8hmrqNltYamsWvPhlTSleyH6m:XNMwrgmnDFJzWA8hmrqNlt5WvZ4lj

Score

1^/10

Malware Config

Signatures

Files

2024-04-29_25d8440a0473e1e357f235576d78d76d_mafia_magniber
.exe windows:5 windows x86 arch:x86

19fc6c8b1d6a63f89b29d95eddd7132e

Code Sign

07:68:20:0e:7f:5a:53:46:17:03:ae:57:7d:98:9c:30
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/10/2014, 00:00

Not After

18/01/2017, 23:59

Subject

CN=LULU SOFTWARE LIMITED,O=LULU SOFTWARE LIMITED,L=Ta'Xbiex,ST=XBX,C=MT

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:ab:7a:3c:53:8d:45:08:17:c0:d3:dc:19:6f:ff:cc:d2:a5:04:5f
Signer

Actual PE Digest

52:ab:7a:3c:53:8d:45:08:17:c0:d3:dc:19:6f:ff:cc:d2:a5:04:5f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

W:\TemporaryBuilds\28\175\src\Trunk\_bin\Win32\Release\GlamInstallerCom\GlamInstallerCom.pdb

Imports

ws2_32

recvfrom
listen
__WSAFDIsSet
select
sendto
getservbyport
gethostbyaddr
getservbyname
htonl
inet_ntoa
gethostbyname
WSACleanup
inet_addr
WSASetLastError
socket
connect
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
recv
WSAGetLastError
closesocket
WSAStartup
accept
shutdown
gethostname
ioctlsocket

wldap32

ord35
ord32
ord41
ord30
ord26
ord79
ord60
ord143
ord211
ord22
ord200
ord46
ord33
ord301
ord50
ord27

wininet

InternetQueryOptionA
InternetSetOptionA
InternetErrorDlg
HttpSendRequestA
InternetOpenW
InternetSetOptionW
InternetConnectW
HttpOpenRequestW
InternetOpenA
HttpQueryInfoA
InternetGetLastResponseInfoA
HttpOpenRequestA
InternetReadFile
HttpQueryInfoW
InternetCloseHandle
InternetCombineUrlA
HttpSendRequestW
InternetConnectA

oleacc

AccessibleObjectFromWindow
LresultFromObject

winmm

timeSetEvent
timeKillEvent
timeGetTime
PlaySoundA
timeGetDevCaps

imm32

ImmAssociateContextEx
ImmGetCompositionStringW
ImmReleaseContext
ImmSetCandidateWindow
ImmNotifyIME
ImmIsIME
ImmGetContext

comctl32

ImageList_DrawEx
ImageList_GetIconSize
ImageList_GetImageInfo

urlmon

FindMimeFromData

kernel32

GetTempPathW
CreateEventA
InterlockedDecrement
CloseHandle
SetEvent
WideCharToMultiByte
GetLastError
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
lstrlenA
lstrlenW
LocalFree
LocalAlloc
GetCurrentProcess
GetDriveTypeW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
RaiseException
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetModuleHandleW
WaitForSingleObject
CreateThread
CreateEventW
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
OutputDebugStringW
GetFileSize
SetUnhandledExceptionFilter
CreateFileW
ReadFile
GetModuleFileNameW
GetTickCount
InterlockedExchange
WaitForSingleObjectEx
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
GetVersionExW
GetFullPathNameW
DeleteFileW
SetFileAttributesW
WriteFile
CopyFileW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
RemoveDirectoryW
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentDirectoryW
Sleep
ReleaseSemaphore
CreateSemaphoreA
GetSystemTimeAsFileTime
WaitForMultipleObjectsEx
lstrcmpiW
InterlockedIncrement
FreeLibrary
LoadLibraryExW
CreateMutexW
CreateDirectoryW
GetUserDefaultLCID
IsWow64Process
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetExitCodeProcess
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
ReleaseMutex
CreateMutexA
GetModuleFileNameA
GetSystemInfo
FormatMessageW
GetComputerNameA
SetConsoleTextAttribute
GetWindowsDirectoryA
GetStdHandle
GetConsoleScreenBufferInfo
OutputDebugStringA
GetTempPathA
QueryPerformanceCounter
lstrcpynW
SetLastError
SystemTimeToFileTime
GetLocalTime
GetSystemTime
GetTimeZoneInformation
GetDateFormatW
FileTimeToSystemTime
GetThreadLocale
GetLocaleInfoW
MulDiv
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
GetLocaleInfoA
LoadLibraryA
GetTempFileNameA
GlobalSize
ExitThread
GetVersionExA
FindResourceA
SetEndOfFile
SetFilePointer
UnmapViewOfFile
FlushViewOfFile
MapViewOfFile
CreateFileMappingA
GetCPInfo
SetThreadLocale
CompareStringW
GetFileAttributesW
LocalFileTimeToFileTime
GetFileInformationByHandle
GetNumberFormatW
GetCurrencyFormatW
GetStringTypeW
GetStringTypeA
SleepEx
GetSystemDirectoryA
PeekNamedPipe
WaitForMultipleObjects
GetFileType
ExpandEnvironmentStringsA
FormatMessageA
GetModuleHandleA
GetVersion
GlobalMemoryStatus
FlushConsoleInputBuffer
InterlockedCompareExchange
EncodePointer
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
OpenEventA
ResetEvent
ResumeThread
SetWaitableTimer
CreateWaitableTimerA
DeviceIoControl
GetFileAttributesExW
AreFileApisANSI
GetStringTypeExA
GetStringTypeExW
LCMapStringA
LCMapStringW
RtlUnwind
GetTimeFormatA
GetDateFormatA
SetConsoleCtrlHandler
UnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
VirtualQuery
HeapSetInformation
GetStartupInfoW
CreateProcessA
DuplicateHandle
GetFileAttributesA
WriteConsoleW
GetConsoleCP
GetConsoleMode
GetTimeFormatW
ExitProcess
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
CreateFileA
ReadConsoleInputA
SetConsoleMode
IsProcessorFeaturePresent
HeapCreate
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
FlushFileBuffers
EnumSystemLocalesA
IsValidLocale
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
CreatePipe
LoadLibraryW
GetFullPathNameA
SetEnvironmentVariableA
IsDBCSLeadByteEx
FoldStringW
DeleteFileA

user32

InvertRect
GetSysColorBrush
DrawEdge
DrawFrameControl
GetIconInfo
DrawIconEx
CreateIconFromResourceEx
SetScrollInfo
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
ScrollDC
ScrollWindowEx
IsChild
GetActiveWindow
CreateWindowExA
GetKeyboardLayout
DestroyCaret
SetCaretPos
CreateCaret
RegisterClipboardFormatW
CloseClipboard
EmptyClipboard
OpenClipboard
EnumClipboardFormats
CountClipboardFormats
SetClipboardData
GetClipboardData
IsClipboardFormatAvailable
SendMessageTimeoutA
AdjustWindowRectEx
MessageBeep
GetKeyState
GetCaretBlinkTime
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
LoadStringW
IsWindowUnicode
PeekMessageA
MoveWindow
ClientToScreen
IsWindowEnabled
SetWindowsHookExA
CallNextHookEx
GetSysColor
LoadCursorFromFileA
DestroyIcon
SetCursor
GetMessageA
TranslateMessage
DispatchMessageA
NotifyWinEvent
GetWindowPlacement
LoadStringA
DrawTextW
WindowFromPoint
GetFocus
SetFocus
SetTimer
GetScrollInfo
SetCapture
GetCapture
ReleaseCapture
LoadCursorA
CreateCursor
UnhookWindowsHookEx
SystemParametersInfoA
GetDoubleClickTime
GetWindowLongA
GetWindowDC
GetSystemMetrics
InflateRect
OffsetRect
GetClassLongA
FillRect
DefWindowProcA
ReleaseDC
GetAsyncKeyState
GetDlgCtrlID
EndPaint
BeginPaint
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
SetParent
EndDialog
DialogBoxIndirectParamW
DestroyMenu
GetCursorPos
AppendMenuW
CreatePopupMenu
RegisterWindowMessageW
SetWindowTextW
IsZoomed
DestroyWindow
DefWindowProcW
GetWindowLongW
SetWindowLongW
RegisterClassExW
GetClassInfoExW
SystemParametersInfoW
CreateWindowExW
UpdateWindow
LoadIconW
CharUpperW
SendMessageA
EnumWindows
PostMessageA
IsIconic
CharNextW
DrawTextA
SetWindowRgn
PtInRect
SetWindowPlacement
IntersectRect
PostQuitMessage
DispatchMessageW
GetMessageW
GetDC
RegisterWindowMessageA
UnregisterClassW
RegisterClassW
ExitWindowsEx
UnregisterClassA
RegisterClassExA
RegisterClassA
KillTimer
SetWindowLongA
ShowWindow
PostMessageW
GetWindowThreadProcessId
FindWindowW
GetWindowRect
IsWindow
SetForegroundWindow
GetSystemMenu
EnableMenuItem
TrackPopupMenu
PostThreadMessageW
SetWindowPos
GetParent
SendMessageW
GetDesktopWindow
MessageBoxW
ScreenToClient
InvalidateRect

gdi32

CreatePen
GetTextMetricsA
GetWindowOrgEx
TextOutA
TextOutW
SetTextAlign
GetTextAlign
SetBkMode
CreateBitmap
SetPixel
GetPixel
SetBrushOrgEx
CreateHatchBrush
Rectangle
GetTextExtentPoint32W
GetTextExtentPoint32A
RectVisible
PatBlt
CreatePatternBrush
CreateRoundRectRgn
GetTextExtentExPointW
GetCharacterPlacementW
GetFontLanguageInfo
CreateDIBPatternBrushPt
CreateDIBSection
StretchDIBits
SetStretchBltMode
StretchBlt
GetDIBits
GetClipBox
CreateFontA
AddFontMemResourceEx
GdiFlush
GetKerningPairsA
GetCurrentObject
GetGlyphOutlineW
CreateRectRgn
GetDeviceCaps
GetObjectA
SetTextColor
IntersectClipRect
CreateRectRgnIndirect
CombineRgn
ExcludeClipRect
CreateSolidBrush
SetWindowOrgEx
BitBlt
DeleteDC
CreateCompatibleDC
LPtoDP
CreateCompatibleBitmap
SelectObject
GetStockObject
GetMapMode
SetViewportOrgEx
DPtoLP
SetViewportExtEx
SetMapMode
GetWindowExtEx
SetWindowExtEx
GetViewportExtEx
RestoreDC
SetBkColor
SaveDC
SetLayout
EnumFontFamiliesExA
DeleteObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW

shell32

SHGetPathFromIDListW
DragQueryFileW
SHGetFileInfoW
ord74
SHChangeNotify
Shell_NotifyIconW
SHGetSpecialFolderPathW
ShellExecuteW
SHBrowseForFolderW

ole32

CoRegisterClassObject
CoInitialize
CoCreateInstance
OleRun
CoUninitialize
CoInitializeEx
DoDragDrop
CoAddRefServerProcess
CoReleaseServerProcess
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoRevokeClassObject
StringFromGUID2
CoCreateGuid
RevokeDragDrop
RegisterDragDrop
ReleaseStgMedium

oleaut32

GetErrorInfo
RegisterTypeLi
UnRegisterTypeLi
VariantClear
LoadTypeLi
VarUI4FromStr
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantInit
LoadRegTypeLi
SysAllocStringLen

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

msi

ord117
ord92
ord160
ord159
ord32
ord158
ord116
ord88
ord137
ord45
ord141
ord43
ord111
ord70
ord14
ord205
ord8

shlwapi

UrlEscapeA
PathFileExistsW

psapi

GetModuleFileNameExW

dbghelp

MiniDumpWriteDump

winhttp

WinHttpGetIEProxyConfigForCurrentUser

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust
WTHelperGetProvSignerFromChain

crypt32

CertGetNameStringW

Exports

Exports

??0?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@QAE@XZ
??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UtagRECT@@@23@XZ@51
??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ@51
??_B?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ@51
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtagRECT@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UtagRECT@@@23@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ
?get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@UtagRECT@@@23@A
?instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@A
?instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@A
?instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@A
?instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@A
?instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@A
?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@A
?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@A
?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UtagRECT@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@634@A

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 965KB - Virtual size: 964KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 201KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 428KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19fc6c8b1d6a63f89b29d95eddd7132e

Code Sign

07:68:20:0e:7f:5a:53:46:17:03:ae:57:7d:98:9c:30Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

52:ab:7a:3c:53:8d:45:08:17:c0:d3:dc:19:6f:ff:cc:d2:a5:04:5fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

wldap32

wininet

oleacc

winmm

imm32

comctl32

urlmon

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

version

msi

shlwapi

psapi

dbghelp

winhttp

wintrust

crypt32

Exports

Exports

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 965KB - Virtual size: 964KB

.data Size: 201KB - Virtual size: 297KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 3.8MB - Virtual size: 3.8MB

.reloc Size: 428KB - Virtual size: 428KB

07:68:20:0e:7f:5a:53:46:17:03:ae:57:7d:98:9c:30
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

52:ab:7a:3c:53:8d:45:08:17:c0:d3:dc:19:6f:ff:cc:d2:a5:04:5f
Signer

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 965KB - Virtual size: 964KB

.data
Size: 201KB - Virtual size: 297KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

.reloc
Size: 428KB - Virtual size: 428KB