McuServer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

McuServer.exe
Size

2.0MB
MD5

1cb21bbdd496d164ff846165577ac75c
SHA1

80781cfb8a61f80dca3aa6275bb3f2c9fde0d773
SHA256

518e58229241bd3b7201f37d103c5a3296db308deccb0b4bf1a82446f44c9bd3
SHA512

8bcc4ea03ae9085181648b8e286b2ad70ec575b67e296a334ec794e547b9180926220fddfb43046a2bf132392e567576d9554bf40a6d8ddb3dca0baa0b519123
SSDEEP

24576:Ts8/ptUtAjHD6WOPr/EeU4dCrcDGQ0GRiE2e1YEwewEGMA5of:TsJcUY4/j/i1efwewEzA5of

Score

1^/10

Malware Config

Signatures

Files

McuServer.exe
.exe windows:6 windows x86 arch:x86

9e757533222067b49ad00c46acf4cf9e

Code Sign

45:fc:63:dd:77:9a:22:91:40:2f:20:60:3c:eb:40:cd
Certificate

Issuer

CN=soyal.com

Not Before

13/05/2023, 08:33

Not After

13/05/2024, 08:53

Subject

CN=soyal.com

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

95:24:f1:df:39:f9:28:66:d4:42:82:b9:23:86:7a:72:48:c4:cc:00:54:62:a3:dc:54:d3:8a:45:cf:d7:5e:0a
Signer

Actual PE Digest

95:24:f1:df:39:f9:28:66:d4:42:82:b9:23:86:7a:72:48:c4:cc:00:54:62:a3:dc:54:d3:8a:45:cf:d7:5e:0a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\VCPP\701Server\Release\McuServer.pdb

Imports

msvfw32

DrawDibDraw
DrawDibClose
DrawDibRealize
DrawDibOpen

mfc140u

ord568
ord3960
ord1194
ord2890
ord5890
ord346
ord1060
ord2874
ord13960
ord13966
ord484
ord13961
ord1131
ord13125
ord974
ord13964
ord13257
ord1450
ord12612
ord358
ord13086
ord7379
ord4171
ord3869
ord12141
ord14131
ord2865
ord13544
ord11633
ord7066
ord2215
ord3905
ord6470
ord3142
ord3337
ord1055
ord2178
ord7327
ord2384
ord1705
ord12419
ord8100
ord7410
ord7672
ord14547
ord1533
ord1700
ord13028
ord8817
ord7626
ord12216
ord11000
ord1408
ord6309
ord11934
ord11933
ord11935
ord11932
ord11169
ord10570
ord11333
ord9042
ord11021
ord11235
ord8977
ord914
ord7378
ord10428
ord11080
ord1474
ord997
ord1068
ord362
ord13089
ord6788
ord3957
ord9377
ord5419
ord6122
ord1464
ord6851
ord1171
ord4884
ord3182
ord540
ord2006
ord14421
ord7649
ord10150
ord10149
ord12088
ord12123
ord9226
ord6876
ord2681
ord1468
ord10048
ord11146
ord11746
ord8913
ord8923
ord10509
ord11118
ord9526
ord9991
ord9986
ord9514
ord9524
ord9509
ord11279
ord11276
ord8304
ord4130
ord991
ord7432
ord4881
ord5765
ord7501
ord9212
ord9979
ord11743
ord9363
ord11139
ord11138
ord10721
ord10251
ord10431
ord5368
ord5377
ord14511
ord4088
ord4138
ord1128
ord12093
ord12964
ord2718
ord9484
ord4703
ord12660
ord12418
ord2558
ord13352
ord2843
ord7655
ord8395
ord11252
ord12575
ord5577
ord12786
ord9197
ord11267
ord10976
ord3857
ord9081
ord6199
ord5609
ord2858
ord13832
ord14065
ord481
ord7121
ord3849
ord2307
ord953
ord8470
ord7653
ord1472
ord8386
ord12247
ord10433
ord12928
ord12865
ord4589
ord7997
ord8324
ord5357
ord10151
ord10147
ord10144
ord2486
ord12542
ord12541
ord14589
ord7922
ord14595
ord9398
ord4152
ord4090
ord12947
ord7941
ord12246
ord12027
ord2034
ord11983
ord11982
ord1866
ord14466
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord13911
ord8462
ord995
ord6860
ord1072
ord366
ord2172
ord3852
ord5918
ord12239
ord8217
ord1526
ord12219
ord8360
ord12763
ord2029
ord985
ord3363
ord3254
ord6830
ord6549
ord3677
ord13471
ord1442
ord1460
ord984
ord1447
ord13628
ord968
ord4108
ord5582
ord7505
ord8894
ord11540
ord9423
ord9302
ord10402
ord11495
ord12081
ord9237
ord12102
ord4587
ord3843
ord5369
ord11795
ord9213
ord8209
ord9352
ord8831
ord5955
ord4495
ord2557
ord5938
ord13707
ord5939
ord13709
ord13700
ord5934
ord1788
ord12460
ord6130
ord5034
ord5033
ord3174
ord7138
ord1133
ord7810
ord6865
ord7441
ord5763
ord5961
ord10250
ord4885
ord4856
ord3236
ord14657
ord12405
ord14604
ord12348
ord4814
ord1687
ord5074
ord2378
ord4485
ord9225
ord4817
ord1046
ord316
ord1105
ord3162
ord6526
ord9126
ord1066
ord4219
ord3145
ord6490
ord3816
ord1176
ord3344
ord3186
ord6585
ord4499
ord2562
ord3689
ord3803
ord5425
ord7656
ord14055
ord9135
ord4236
ord3257
ord6834
ord7107
ord9468
ord5428
ord8345
ord1462
ord6316
ord4093
ord1143
ord501
ord6225
ord1446
ord8754
ord14137
ord3682
ord3691
ord3684
ord3807
ord3805
ord8464
ord4664
ord1690
ord7495
ord9235
ord12173
ord462
ord7109
ord1113
ord14234
ord3678
ord3804
ord3802
ord6489
ord6751
ord1433
ord13901
ord3362
ord3246
ord6825
ord3833
ord14507
ord13473
ord5427
ord4477
ord5422
ord3797
ord3696
ord9128
ord1070
ord3872
ord2993
ord8744
ord4222
ord3147
ord6497
ord7493
ord12131
ord6218
ord13752
ord2760
ord9210
ord12172
ord1111
ord9040
ord11015
ord11396
ord10472
ord4092
ord458
ord3403
ord3404
ord3164
ord6531
ord14327
ord3697
ord1405
ord3359
ord3237
ord6801
ord6129
ord7654
ord6220
ord13756
ord3305
ord3302
ord10255
ord8210
ord2761
ord14785
ord10285
ord10287
ord10286
ord10284
ord10288
ord5652
ord11725
ord11726
ord9139
ord12089
ord3838
ord11936
ord14588
ord8965
ord12220
ord6978
ord11002
ord9256
ord3266
ord13878
ord12262
ord12258
ord1722
ord1744
ord1770
ord1756
ord1777
ord4936
ord5003
ord12251
ord7627
ord4948
ord4966
ord4960
ord4954
ord5013
ord4997
ord4942
ord5019
ord4974
ord4912
ord4927
ord4988
ord4502
ord5790
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord6877
ord11717
ord13703
ord5935
ord7820
ord2682
ord12124
ord3941
ord3371
ord3372
ord3265
ord12168
ord4886
ord1002
ord8773
ord6973
ord5249
ord5549
ord5760
ord9350
ord5525
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord9209
ord1391
ord890
ord13070
ord1108
ord4649
ord13062
ord5210
ord13022
ord14123
ord14127
ord13019
ord14112
ord8881
ord14115

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
WaitForSingleObjectEx
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
GlobalHandle
GlobalSize
GlobalReAlloc
FreeResource
FindResourceW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
HeapDestroy
RaiseException
DecodePointer
SetCommTimeouts
SetLastError
GetTickCount64
GetSystemDirectoryW
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetLocaleInfoW
CreateFileW
CloseHandle
Sleep
GetCurrentThreadId
SetThreadPriority
TerminateThread
ResumeThread
LoadLibraryExW
OutputDebugStringW
GetLastError
DeleteFileW
CreateProcessW
GetStartupInfoW
ReleaseSemaphore
WaitForSingleObject
SetCurrentDirectoryW
GetCurrentDirectoryW
HeapAlloc
HeapFree
GetProcessHeap
SetEvent
CreateEventW
OpenSemaphoreW
SuspendThread
FreeLibrary
LocalFree
FormatMessageW
CreateSemaphoreW
Beep
LoadLibraryW
SetThreadLocale
GetSystemDefaultLangID
ReadFile
WriteFile
GetOverlappedResult
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetCommState
PurgeComm
GetCommTimeouts
GetCommState
GetCommProperties
EscapeCommFunction
SetupComm
ClearCommError
GetLocalTime
OpenEventW
ResetEvent

user32

DrawEdge
MessageBoxW
CreateIconFromResource
SendMessageW
SetTimer
KillTimer
EnableWindow
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
WindowFromDC
RedrawWindow
GetClientRect
GetSysColor
FillRect
GetClassLongW
GetParent
PostMessageW
MessageBeep
FindWindowW
SetWindowLongW
GetIconInfo
CreateIconIndirect
GetClassNameW
DestroyIcon
LoadCursorW
PtInRect
EqualRect
OffsetRect
UnionRect
CopyRect
SetRectEmpty
FrameRect
DrawFocusRect
ClientToScreen
GetCursorPos
SetCursor
DrawStateW
GetSystemMetrics
ReleaseCapture
SetCapture
GetCapture
GetFocus
IsWindow
DrawFrameControl
UnregisterClassW
RegisterWindowMessageW
GetWindowLongW
GetWindowRect
IsRectEmpty
InflateRect
EndPaint
BeginPaint
LoadIconW
InvalidateRect
ReleaseDC
GetDC
GetLastActivePopup
GetDesktopWindow
BringWindowToTop
IsIconic
IsChild
MapDialogRect
UpdateWindow
SetRect
LoadImageW
IntersectRect
GetMenuItemID
EnableMenuItem
GetSystemMenu
wsprintfW
SystemParametersInfoW
GetWindow

gdi32

PatBlt
GetPixel
SetStretchBltMode
StretchDIBits
SetDIBitsToDevice
SelectPalette
GetSystemPaletteEntries
GetPaletteEntries
GetDIBits
CreateBitmap
SelectObject
GetStockObject
GetCurrentObject
GetCharWidthW
Ellipse
DeleteObject
CreateFontW
CreateDIBitmap
DeleteDC
CreateHalftonePalette
GetDIBColorTable
RealizePalette
GetDeviceCaps
CreatePalette
LPtoDP
DPtoLP
ExtTextOutW
TextOutW
GetObjectW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetTextExtentPoint32W
GetMapMode
GetBkColor
Escape
CreateRectRgn
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

advapi32

RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW

shell32

ShellExecuteW

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_GetImageCount
ImageList_Draw
ImageList_Replace
ImageList_AddMasked
ImageList_GetIcon
ImageList_GetImageInfo

ole32

CreateStreamOnHGlobal

oleaut32

SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString
VariantTimeToSystemTime
SystemTimeToVariantTime
CreateErrorInfo
SetErrorInfo
VariantChangeType
VariantInit
VariantClear
GetErrorInfo

cshtsv11

ord142
ord2
ord94
ord143
ord3

cswskv11

ord31
ord39
ord55
ord78
ord86
ord92
ord2
ord121
ord133
ord3
ord171
ord101
ord149
ord150
ord53
ord118
ord167

odbc32

ord75
ord119
ord139
ord154
ord157
ord176
ord111
ord110
ord108
ord107
ord72
ord63
ord20
ord24
ord4
ord26
ord9
ord12
ord13
ord30
ord31
ord43
ord18
ord48
ord49
ord136

toolkitpro1700vc140u

??1CXTButton@@UAE@XZ
??0CXTPBrowseDialog@@QAE@PAVCWnd@@@Z
??1CXTPBrowseDialog@@UAE@XZ
?DoModal@CXTPBrowseDialog@@UAEHXZ
?SetTextAlignment@CXTPPopupItem@@QAEXH@Z
?SetTitle@CXTPBrowseDialog@@QAEXPB_W@Z
?SetSelPath@CXTPBrowseDialog@@QAEXPB_W@Z
?GetSelPath@CXTPBrowseDialog@@QAEPB_WXZ
??0CXTPPopupControl@@QAE@H@Z
??1CXTPPopupControl@@UAE@XZ
?SetPopupPos@CXTPPopupControl@@QAEXVCPoint@@@Z
?GetPopupPos@CXTPPopupControl@@QBE?AVCPoint@@XZ
?SetPopupSize@CXTPPopupControl@@QAEXVCSize@@@Z
?GetPopupSize@CXTPPopupControl@@QBE?AVCSize@@XZ
?Show@CXTPPopupControl@@QAEHPAVCWnd@@H@Z
?Close@CXTPPopupControl@@QAEHXZ
?SetTransparency@CXTPPopupControl@@QAEXE@Z
?SetShowDelay@CXTPPopupControl@@QAEXK@Z
?SetHyperLink@CXTPPopupItem@@QAEXH@Z
?SetBold@CXTPPopupItem@@QAEXH@Z
?SetIcon@CXTPPopupItem@@QAEHPAUHICON__@@W4XTPPopupItemIcon@@@Z
?GetPopupControl@CXTPPopupItem@@QBEPAVCXTPPopupControl@@XZ
??0CXTPTrayIcon@@QAE@XZ
??1CXTPTrayIcon@@UAE@XZ
?RemoveIcon@CXTPTrayIcon@@QAE_NXZ
?MinimizeToTray@CXTPTrayIcon@@QAEXPAVCWnd@@@Z
?SetAnimateDelay@CXTPPopupControl@@QAEXK@Z
?GetThisMessageMap@CXTPTrayIcon@@KGPBUAFX_MSGMAP@@XZ
?SetTheme@CXTPPaintManager@@SAXW4XTPPaintTheme@@@Z
??0CXTButton@@QAE@PAUCRuntimeClass@@@Z
?Add@CXTPCommandBars@@QAEPAVCXTPToolBar@@PB_WW4XTPBarPosition@@PAUCRuntimeClass@@@Z
?GetThisClass@CXTPCommandBars@@SGPAUCRuntimeClass@@XZ
?GetCommandBars@?$CXTPCommandBarsSiteBase@VCFrameWnd@@@@QBEPAVCXTPCommandBars@@XZ
??0CXTPFrameWnd@@QAE@XZ
??1CXTPFrameWnd@@UAE@XZ
?Create@CXTPPopupControl@@EAEHPB_W0KABUtagRECT@@PAVCWnd@@IPAUCCreateContext@@@Z
?Create@CXTPPopupControl@@MAEHPAVCWnd@@@Z
?Create@CXTPTrayIcon@@EAEHPB_W0KABUtagRECT@@PAVCWnd@@IPAUCCreateContext@@@Z
?Create@CXTPTrayIcon@@UAE_NPB_WKPAVCWnd@@I@Z
?Create@CXTPTrayIcon@@UAE_NPB_WPAVCWnd@@III_N@Z
?Draw@CXTPPopupItem@@UAEXPAVCDC@@@Z
?GetMessageMap@CXTPPopupControl@@MBEPBUAFX_MSGMAP@@XZ
?SetPopupAnimation@CXTPPopupControl@@QAEXW4XTPPopupAnimation@@@Z
?GetPopupState@CXTPPopupControl@@QBE?AW4XTPPopupState@@XZ
?SetTheme@CXTPPopupControl@@QAEXW4XTPPopupPaintTheme@@@Z
?RedrawControl@CXTPPopupControl@@QAEXXZ
?AddItem@CXTPPopupControl@@QAEPAVCXTPPopupItem@@PAV2@@Z
?RemoveAllItems@CXTPPopupControl@@QAEXXZ
?AllowMove@CXTPPopupControl@@QAEXH@Z
??0CXTPPopupItem@@QAE@PAUtagRECT@@PB_WKK@Z
??1CXTPPopupItem@@UAE@XZ
?GetRuntimeClass@CXTPPopupItem@@UBEPAUCRuntimeClass@@XZ
?GetTextFont@CXTPPopupItem@@UAEPAVCFont@@XZ
?InitCommandBars@?$CXTPCommandBarsSiteBase@VCFrameWnd@@@@UAEHPAUCRuntimeClass@@@Z
?InstallIconPending@CXTPTrayIcon@@UAEXXZ
?KillTimer@CXTPTrayIcon@@UAEXXZ
?LoadCommandBars@?$CXTPCommandBarsSiteBase@VCFrameWnd@@@@UAEXPB_WH@Z
?LoadFrame@?$CXTPFrameWndBase@VCFrameWnd@@@@UAEHIKPAVCWnd@@PAUCCreateContext@@@Z
?Notify@CXTPPopupControl@@MAEXIJ@Z
?OnClick@CXTPPopupControl@@MAEXPAVCXTPPopupItem@@@Z
?SetMenu@CXTPCommandBars@@QAEPAVCXTPMenuBar@@PB_WI@Z
?SetTheme@CXTThemeManagerStyleHost@@QAEXW4XTThemeStyle@@@Z
?OnCollapsing@CXTPPopupControl@@MAEXXZ
?OnExpanding@CXTPPopupControl@@MAEXH@Z
?OnItemInserted@CXTPPopupItem@@MAEXXZ
?OnSetPreviewMode@?$CXTPFrameWndBase@VCFrameWnd@@@@UAEXHPAUCPrintPreviewState@@@Z
?OnShow@CXTPPopupControl@@MAEXXZ
?OnTrayNotification@CXTPTrayIcon@@MAEJIJ@Z
?OnWndMsg@?$CXTPCommandBarsSiteBase@VCFrameWnd@@@@MAEHIIJPAJ@Z
?OnWndMsg@CXTPPopupControl@@MAEHIIJPAJ@Z
?PostNcDestroy@CXTPPopupControl@@MAEXXZ
?PreTranslateMessage@?$CXTPCommandBarsSiteBase@VCFrameWnd@@@@MAEHPAUtagMSG@@@Z
?RemoveAnimationIcons@CXTPTrayIcon@@UAEXXZ
?SaveCommandBars@?$CXTPCommandBarsSiteBase@VCFrameWnd@@@@UAEXPB_W@Z
?SetAnimationIcons@CXTPTrayIcon@@UAEXPBIPBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
?SetAnimationIcons@CXTPTrayIcon@@UAE_NPBIHPBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetTimer@CXTPTrayIcon@@UAEXII@Z
?SetTooltip@CXTPTrayIcon@@UAEXPB_W@Z
?SetTrayIcon@CXTPTrayIcon@@UAEXIK@Z
?StartAnimation@CXTPTrayIcon@@UAEXI@Z
?StopAnimation@CXTPTrayIcon@@UAEXXZ
?WindowProc@CXTPTrayIcon@@MAEJIIJ@Z
?XTPSystemVersion@@YGPAVCXTPSystemVersion@@XZ
?IsWinXPOrGreater@CXTPSystemVersion@@QBE_NXZ
?XTThemeManager@@YAPAVCXTThemeManager@@XZ
?SetTheme@CXTThemeManager@@QAEXW4XTThemeStyle@@@Z
?GetDefaultTheme@CXTButton@@SAPAVCXTButtonTheme@@XZ
?SetTooltipText@CXTPTrayIcon@@QAE_NPB_W@Z
?SetIcon@CXTPTrayIcon@@QAE_NI@Z
?SetButton@CXTPPopupItem@@QAEXH@Z
?SetID@CXTPPopupItem@@QAEXH@Z
?GetID@CXTPPopupItem@@QBEHXZ
?MaximizeFromTray@CXTPTrayIcon@@QAEXPAVCWnd@@@Z
?SetTextColor@CXTPPopupItem@@QAEXKK@Z

gdiplus

GdiplusShutdown

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ

soyalcomm

ord4
ord5

ws2_32

inet_ntoa
gethostname
gethostbyname

vcruntime140

__std_exception_destroy
memcpy
__std_type_info_destroy_list
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
wcsstr
wcschr
strstr
memchr
__CxxFrameHandler3
__std_exception_copy
strchr
_CxxThrowException
memmove
__std_terminate
_purecall
memset

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_execute_onexit_table
_initialize_onexit_table
_crt_atexit
_crt_at_quick_exit
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_controlfp_s
_seh_filter_exe
_set_app_type
_endthreadex
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_initialize_narrow_environment
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_beginthreadex
_configure_narrow_argv
terminate
_seh_filter_dll
_errno

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vsprintf
__stdio_common_vswscanf
__stdio_common_vswprintf_s
__stdio_common_vsscanf
fgets
fgetws
__stdio_common_vsnprintf_s
fwrite
_ftelli64
_fseeki64
fread
fflush
ferror
fclose
fopen_s
_wfopen_s
__stdio_common_vfprintf_s
__stdio_common_vfprintf_p
__stdio_common_vfscanf
__stdio_common_vsprintf_p
__stdio_common_vsprintf_s
__acrt_iob_func
__stdio_common_vfwprintf
__stdio_common_vfwprintf_s
__stdio_common_vfwprintf_p
__stdio_common_vfwscanf
__stdio_common_vswprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_p
__p__commode
__stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free
_set_new_mode
_recalloc

api-ms-win-crt-math-l1-1-0

_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
ceil
floor
_except1
_CIfmod
_libm_sse2_cos_precise
_dtest
modf
_isnan
_finite
__setusermatherr

api-ms-win-crt-convert-l1-1-0

_wtof
_ecvt_s
_wtoi
strtod
atoi

api-ms-win-crt-string-l1-1-0

wcsncmp
isdigit
wcscpy_s
_wcsicmp
wcscat_s

api-ms-win-crt-time-l1-1-0

_localtime64_s
clock
_time64

api-ms-win-crt-multibyte-l1-1-0

_mbschr

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-utility-l1-1-0

ldiv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 664KB - Virtual size: 664KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e757533222067b49ad00c46acf4cf9e

Code Sign

45:fc:63:dd:77:9a:22:91:40:2f:20:60:3c:eb:40:cdCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

95:24:f1:df:39:f9:28:66:d4:42:82:b9:23:86:7a:72:48:c4:cc:00:54:62:a3:dc:54:d3:8a:45:cf:d7:5e:0aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvfw32

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

cshtsv11

cswskv11

odbc32

toolkitpro1700vc140u

gdiplus

msvcp140

soyalcomm

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 664KB - Virtual size: 664KB

.rdata Size: 175KB - Virtual size: 174KB

.data Size: 11KB - Virtual size: 45KB

.gfids Size: 1024B - Virtual size: 824B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 52KB - Virtual size: 51KB

45:fc:63:dd:77:9a:22:91:40:2f:20:60:3c:eb:40:cd
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

95:24:f1:df:39:f9:28:66:d4:42:82:b9:23:86:7a:72:48:c4:cc:00:54:62:a3:dc:54:d3:8a:45:cf:d7:5e:0a
Signer

.text
Size: 664KB - Virtual size: 664KB

.rdata
Size: 175KB - Virtual size: 174KB

.data
Size: 11KB - Virtual size: 45KB

.gfids
Size: 1024B - Virtual size: 824B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 52KB - Virtual size: 51KB