2024-04-30_410b1de288293cf983be80730b0fbd29_avoslocker

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-30_410b1de288293cf983be80730b0fbd29_avoslocker
Size

7.5MB
MD5

410b1de288293cf983be80730b0fbd29
SHA1

02312fa9acace3a2be7ea2a3a5dcab2dcd70aaf0
SHA256

304e26dc2698681d9a7386809b51cc377ae13dd922930e289848ca81d334b972
SHA512

88a48e7e7a166a5aa6229f936338028b483f11c82552242e1a02cba5fec27d964a7e972d6b174b448f4ceff75f7df863e657163a385a2ca23d89a7b68cb17f57
SSDEEP

98304:q5qSmpogAvk9ACFicXtW8tA6IExwvCdJNkuPf0zcU24hcR:Wq3pogS2XY9C1kuX0T2ScR

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Files

2024-04-30_410b1de288293cf983be80730b0fbd29_avoslocker
.exe windows:6 windows x86 arch:x86

46a9eb36abd60bbefa988cdc9d09d9a3

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:d2:20:be:0b:f7:a3:b3:38:a3:8a:b6:f5:28:0b:b7
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

09/06/2021, 00:00

Not After

08/07/2022, 23:59

Subject

CN=Shanghai YouXin Media Studio,O=Shanghai YouXin Media Studio,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

58:39:12:af:7a:5c:c9:61:c1:2a:43:b9:e5:8e:2e:6d:43:cc:2a:a8:fc:b2:c3:8d:ff:89:03:96:f5:02:74:15
Signer

Actual PE Digest

58:39:12:af:7a:5c:c9:61:c1:2a:43:b9:e5:8e:2e:6d:43:cc:2a:a8:fc:b2:c3:8d:ff:89:03:96:f5:02:74:15

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\OrangeColorfulNote\OutPutFile\Release\OrangeNote.pdb

Imports

kernel32

GetSystemDirectoryW
GetTempPathW
RemoveDirectoryW
CreateSemaphoreW
ReleaseSemaphore
FileTimeToLocalFileTime
GlobalMemoryStatus
FileTimeToDosDateTime
LocalFileTimeToFileTime
CompareFileTime
MoveFileExW
FormatMessageW
GetExitCodeThread
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
SetProcessAffinityMask
QueryDepthSList
UnregisterWaitEx
WaitForMultipleObjectsEx
LoadLibraryA
GetModuleHandleA
FreeResource
SetLastError
GetFullPathNameW
GetVersionExA
GetVersionExW
GetTickCount
OutputDebugStringA
IsBadReadPtr
FlushInstructionCache
HeapCreate
MulDiv
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
GetCommandLineA
CreateProcessA
GetEnvironmentVariableA
WaitForSingleObject
LocalFree
SetFilePointer
WriteFile
CreateFileA
WideCharToMultiByte
SetEndOfFile
WriteConsoleW
HeapQueryInformation
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
GetACP
IsValidCodePage
SetConsoleCtrlHandler
SetStdHandle
GetTimeZoneInformation
ReadConsoleW
GetFileSizeEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
lstrlenW
TerminateProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
FindFirstFileA
CreateDirectoryA
SetCurrentDirectoryW
CreateMutexW
FindResourceExW
FindResourceW
SizeofResource
LockResource
LoadResource
FindClose
FindNextFileW
lstrcmpW
lstrcpyW
lstrcatW
GetDiskFreeSpaceExW
GetWindowsDirectoryW
CreateDirectoryW
GetFileAttributesW
WriteProcessMemory
FindCloseChangeNotification
VirtualProtect
SetUnhandledExceptionFilter
GetLocalTime
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
FreeLibrary
GetModuleFileNameW
FindFirstFileW
GetFileAttributesExW
DeleteFileW
CreateFileW
CloseHandle
LoadLibraryW
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
DecodePointer
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
FindFirstFileExW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetThreadContext
SetThreadContext
ResumeThread
InterlockedCompareExchange
VirtualQuery
VerifyVersionInfoW
VerSetConditionMask
TryEnterCriticalSection
CopyFileA
GetSystemTimes
LoadLibraryExW
CreateProcessW
K32GetProcessImageFileNameA
K32EmptyWorkingSet
K32EnumProcesses
MoveFileA
QueryDosDeviceA
FindResourceA
GlobalFree
GlobalHandle
GetModuleFileNameA
GetNativeSystemInfo
SuspendThread
FindFirstChangeNotificationW
GetLogicalDriveStringsW
InterlockedPopEntrySList
LoadLibraryExA
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
TerminateThread
CreateMutexA
SetFileAttributesA
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
GetStdHandle
SleepEx
GetThreadTimes
QueryPerformanceFrequency
GetThreadLocale
VirtualFree
VirtualAlloc
DosDateTimeToFileTime
GetFileType
SystemTimeToFileTime
GetCurrentDirectoryW
DuplicateHandle
SetFileTime
OpenMutexW
OpenFileMappingW
ReleaseMutex
HeapSetInformation
ReadFile
GetSystemInfo
LocalAlloc
lstrcmpiA
FindNextFileA
DeleteFileA
RemoveDirectoryA
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
ReadProcessMemory
GetNumaHighestNodeNumber
GetLastError
RaiseException
GetPrivateProfileIntW
GetFileAttributesA
GetEnvironmentVariableW
lstrcmpiW
SetFileAttributesW
CreateThread
MoveFileW
InitializeCriticalSectionEx
OutputDebugStringW
InitializeSListHead
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
SetEvent
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
lstrlenA
lstrcpyA
GlobalLock
GlobalUnlock
GlobalAlloc
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
CreateEventW
EncodePointer
FormatMessageA
RtlCaptureStackBackTrace

user32

GetCursorPos
DestroyIcon
IsWindow
LoadCursorW
DestroyCursor
SetCursor
SetRect
CopyRect
InflateRect
IntersectRect
UnionRect
IsRectEmpty
EqualRect
PtInRect
GetKeyState
EnableMenuItem
GetDC
ReleaseDC
ClientToScreen
ScreenToClient
GetSysColor
PostQuitMessage
EnableWindow
IsWindowEnabled
SetActiveWindow
GetDesktopWindow
RegisterWindowMessageW
KillTimer
SetTimer
SetWindowTextW
OffsetRect
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
CharUpperW
SetWindowPos
GetSystemMetrics
DestroyWindow
ShowWindow
SendMessageW
wsprintfW
PostMessageW
UnregisterClassW
DefWindowProcW
CallWindowProcW
RegisterClassExW
CreateWindowExW
GetDlgItem
SetWindowLongW
TrackMouseEvent
AnimateWindow
SetLayeredWindowAttributes
IsZoomed
SetFocus
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
BeginPaint
EndPaint
InvalidateRect
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
GetClassNameW
GetFocus
CharNextW
GetIconInfo
IsMenu
CreatePopupMenu
DestroyMenu
GetMenuItemCount
InsertMenuW
AppendMenuW
DeleteMenu
TrackPopupMenu
GetMenuInfo
SetMenuInfo
CharPrevExA
GetKeyboardLayoutNameW
SetClassLongW
WindowFromPoint
RegisterTouchWindow
CloseTouchInputHandle
GetTouchInputInfo
VkKeyScanExW
GetDoubleClickTime
GetMessageTime
GetKeyboardLayout
LoadStringW
EnumChildWindows
AdjustWindowRectEx
RemovePropW
GetPropW
SetPropW
RemoveMenu
GetSubMenu
SetMenu
GetMenu
DialogBoxParamW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
MonitorFromRect
SetWindowPlacement
SetParent
SetWindowLongA
GetWindowLongA
BringWindowToTop
CallWindowProcA
GetCursorInfo
MessageBoxIndirectW
MessageBoxExW
GetAncestor
SystemParametersInfoW
MapDialogRect
GetWindowThreadProcessId
GetClassNameA
FillRect
SetWindowContextHelpId
GetWindowTextLengthW
GetWindowTextW
GetWindowTextA
RedrawWindow
InvalidateRgn
DestroyAcceleratorTable
CreateAcceleratorTableW
MapVirtualKeyW
SendInput
VkKeyScanW
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
EndDialog
CreateDialogIndirectParamW
MoveWindow
GetLayeredWindowAttributes
IsChild
CreateWindowExA
GetClassInfoExW
RegisterClassA
DefWindowProcA
PostThreadMessageW
SendMessageTimeoutW
GetMessageExtraInfo
wsprintfA
CreateIconIndirect
FindWindowW
GetMenuItemInfoW
SetMenuContextHelpId
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjects
GetForegroundWindow
MessageBoxW
LoadIconW
GetWindowPlacement
IsIconic
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
GetActiveWindow
SetForegroundWindow
IsWindowVisible
DrawTextW
SystemParametersInfoA
LoadBitmapW
CreateIconFromResource
LoadImageW
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
DestroyCaret
DrawIconEx

gdi32

BitBlt
SetGraphicsMode
GetDeviceCaps
EnumFontsW
GetRegionData
IntersectClipRect
SelectClipRgn
CreateDIBSection
CreateDIBitmap
CreateDCW
CreateRoundRectRgn
CombineRgn
CreateFontW
CreateRectRgn
PtInRegion
SetRectRgn
ChoosePixelFormat
SetPixelFormat
SwapBuffers
GetCurrentObject
GetViewportOrgEx
StretchDIBits
DeleteObject
CreateBitmap
CreateCompatibleDC
DeleteDC
SelectObject
CreateFontIndirectW
CreateSolidBrush
GetClipBox
GetStockObject
GdiFlush
GetTextFaceW
ExtTextOutW
SetWorldTransform
GetTextMetricsW
SetTextAlign
SetTextColor
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextExtentPointI
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsW
GetGlyphOutlineW
GetFontData
GetCharABCWidthsW
EnumFontFamiliesExW
Rectangle
SetBkMode
GetObjectW
GetDCOrgEx
StretchBlt
CreateCompatibleBitmap
SetViewportOrgEx
ExtCreateRegion

advapi32

RegSetValueExA
CheckTokenMembership
FreeSid
CloseServiceHandle
OpenServiceA
OpenSCManagerA
ConvertSidToStringSidA
LookupAccountSidW
LookupAccountSidA
GetTokenInformation
GetUserNameA
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextW
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
RegDeleteValueA
CryptGenRandom
CryptAcquireContextA
SetNamedSecurityInfoW
GetSecurityDescriptorSacl
SetEntriesInAclW
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
CreateProcessAsUserW
CreateProcessAsUserA
DuplicateTokenEx
AllocateAndInitializeSid

shell32

SHGetFolderPathA
Shell_NotifyIconW
SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
SHCreateDirectoryExW
ShellExecuteA

ole32

CoDisconnectObject
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoGetClassObject
CoUninitialize
CoTaskMemRealloc
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CreateBindCtx
CoCreateGuid
OleSetContainedObject

oleaut32

SysFreeString
SysAllocString
SysAllocStringByteLen
GetErrorInfo
VariantInit
VariantClear
VariantChangeType
SetErrorInfo
CreateErrorInfo
SysAllocStringLen
SysStringLen
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VariantCopy
VarUI4FromStr
DispCallFunc

shlwapi

ord12
StrToIntExW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathAddExtensionW
PathFileExistsA
StrCmpIW
SHCreateStreamOnFileEx
ChrCmpIA
ChrCmpIW
StrStrA
StrStrIA
PathAddBackslashA
PathIsDirectoryA
PathIsDirectoryW
PathRemoveBackslashA
PathRemoveFileSpecA
StrStrIW

userenv

CreateEnvironmentBlock
GetUserProfileDirectoryA
DestroyEnvironmentBlock

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
VerQueryValueW

wtsapi32

WTSEnumerateSessionsA
WTSFreeMemory
WTSQuerySessionInformationW

msvfw32

MCIWndCreateW

imm32

ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmSetCandidateWindow
ImmNotifyIME

gdiplus

GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipGraphicsClear
GdipDrawImageRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipAlloc

psapi

EnumProcessModules
GetModuleFileNameExW

iphlpapi

SendARP
GetIfTable
GetExtendedTcpTable
SetTcpEntry
GetAdaptersInfo

comctl32

InitCommonControlsEx

wininet

InternetGetCookieA
InternetSetCookieA

winmm

waveOutWrite
midiStreamOpen

libcef

cef_v8context_in_context
cef_dictionary_value_create
cef_string_utf16_set
cef_remove_cross_origin_whitelist_entry
cef_add_cross_origin_whitelist_entry
cef_load_crlsets_file
cef_zip_directory
cef_delete_file
cef_directory_exists
cef_clear_scheme_handler_factories
cef_create_temp_directory_in_directory
cef_create_new_temp_directory
cef_get_temp_directory
cef_create_directory
cef_v8context_get_entered_context
cef_crash_reporting_enabled
cef_v8value_create_object
cef_enable_highdpi_support
cef_set_osmodal_loop
cef_quit_message_loop
cef_run_message_loop
cef_do_message_loop_work
cef_shutdown
cef_initialize
cef_v8value_create_int
cef_v8value_create_bool
cef_v8value_create_null
cef_v8value_create_undefined
cef_request_create
cef_set_crash_key_value
cef_v8context_get_current_context
cef_register_scheme_handler_factory
cef_register_extension
cef_post_delayed_task
cef_post_task
cef_currently_on
cef_process_message_create
cef_string_multimap_free
cef_string_multimap_alloc
cef_browser_host_create_browser_sync
cef_browser_host_create_browser
cef_cookie_manager_get_global_manager
cef_string_multimap_append
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_map_append
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_list_append
cef_v8value_create_function
cef_v8value_create_array_buffer
cef_v8value_create_array
cef_v8value_create_uint
cef_v8value_create_double
cef_v8value_create_date
cef_v8value_create_string
cef_parse_url
cef_string_list_free
cef_string_list_alloc
cef_string_list_value
cef_string_list_size
cef_string_utf16_cmp
cef_value_create
cef_command_line_get_global
cef_command_line_create
cef_string_map_free
cef_string_map_alloc
cef_binary_value_create
cef_time_to_timet
cef_string_utf8_to_utf16
cef_api_hash
cef_execute_java_script_with_user_gesture_for_tests
cef_register_widevine_cdm
cef_is_web_plugin_unstable
cef_register_web_plugin_crash
cef_unregister_internal_web_plugin
cef_refresh_web_plugins
cef_visit_web_plugin_info
cef_now_from_system_trace_time
cef_end_tracing
cef_begin_tracing
cef_is_cert_status_error
cef_launch_process
cef_get_path
cef_write_json
cef_parse_jsonand_return_error
cef_parse_json
cef_uridecode
cef_uriencode
cef_base64decode
cef_base64encode
cef_get_extensions_for_mime_type
cef_get_mime_type
cef_format_url_for_security_display
cef_create_url
cef_execute_process
cef_string_userfree_utf16_free
cef_string_wide_to_utf8
cef_log
cef_string_ascii_to_utf16
cef_string_utf16_to_utf8
cef_string_utf16_clear
cef_urlrequest_create
cef_string_utf8_clear
cef_list_value_create
cef_display_get_alls
cef_display_get_count
cef_display_get_matching_bounds
cef_display_get_nearest_point
cef_display_get_primary
cef_string_utf16_to_lower
cef_menu_button_create
cef_label_button_create
cef_window_create_top_level
cef_textfield_create
cef_scroll_view_create
cef_panel_create
cef_browser_view_get_for_browser
cef_browser_view_create
cef_menu_model_create
cef_print_settings_create
cef_server_create
cef_zip_reader_create
cef_clear_cross_origin_whitelist
cef_stream_writer_create_for_handler
cef_stream_writer_create_for_file
cef_image_create
cef_task_runner_get_for_thread
cef_task_runner_get_for_current_thread
cef_response_create
cef_v8stack_trace_get_current
cef_get_min_log_level
cef_post_data_element_create
cef_post_data_create
cef_stream_reader_create_for_handler
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_create_context_shared
cef_request_context_create_context
cef_request_context_get_global_context
cef_drag_data_create
cef_media_router_get_global

dbghelp

SymGetModuleInfo64
SymCleanup
SymGetLineFromAddr64
SymGetSymFromAddr64
SymFunctionTableAccess64
SymGetModuleBase64
StackWalk64
SymInitialize

d3d11

D3D11CreateDevice

ws2_32

accept
recvfrom
sendto
ioctlsocket
gethostname
inet_ntoa
gethostbyname
freeaddrinfo
getaddrinfo
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
listen
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
inet_addr
socket

wldap32

ord200
ord33
ord30
ord301
ord79
ord35
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord46
ord211
ord143

comdlg32

FindTextW

opengl32

glGenTextures
glEnd
glEnable
glDrawArrays
glDisable
glDeleteTextures
glColor4f
glHint
glClearColor
glClear
glBlendFunc
glBindTexture
glBegin
wglMakeCurrent
wglDeleteContext
wglCreateContext
glInterleavedArrays
glLineWidth
glLoadIdentity
glMatrixMode
glOrtho
glPixelStorei
glPopAttrib
glPopMatrix
glPushAttrib
glPushMatrix
glRotatef
glTexEnvf
glTexImage2D
glTexParameteri
glTexSubImage2D
glVertex2f
glVertex2i
glViewport
wglGetCurrentContext
glColor3f
wglGetProcAddress

usp10

ScriptShape
ScriptFreeCache
ScriptItemize

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 137KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 342KB - Virtual size: 342KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

46a9eb36abd60bbefa988cdc9d09d9a3

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

02:d2:20:be:0b:f7:a3:b3:38:a3:8a:b6:f5:28:0b:b7Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

58:39:12:af:7a:5c:c9:61:c1:2a:43:b9:e5:8e:2e:6d:43:cc:2a:a8:fc:b2:c3:8d:ff:89:03:96:f5:02:74:15Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

userenv

version

wtsapi32

msvfw32

imm32

gdiplus

psapi

iphlpapi

comctl32

wininet

winmm

libcef

dbghelp

d3d11

ws2_32

wldap32

comdlg32

opengl32

usp10

Exports

Exports

Sections

.text Size: 5.5MB - Virtual size: 5.5MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 137KB - Virtual size: 402KB

.rsrc Size: 113KB - Virtual size: 113KB

.reloc Size: 342KB - Virtual size: 342KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

02:d2:20:be:0b:f7:a3:b3:38:a3:8a:b6:f5:28:0b:b7
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

58:39:12:af:7a:5c:c9:61:c1:2a:43:b9:e5:8e:2e:6d:43:cc:2a:a8:fc:b2:c3:8d:ff:89:03:96:f5:02:74:15
Signer

.text
Size: 5.5MB - Virtual size: 5.5MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 137KB - Virtual size: 402KB

.rsrc
Size: 113KB - Virtual size: 113KB

.reloc
Size: 342KB - Virtual size: 342KB