2024-05-03_ab84c4f7fca069dd4ecf009a7a719684_bkransomware

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-03_ab84c4f7fca069dd4ecf009a7a719684_bkransomware
Size

5.4MB
MD5

ab84c4f7fca069dd4ecf009a7a719684
SHA1

7a9d4ae1238630db6ddeb0a344614d9320498da9
SHA256

1645245f66e9bb0af47a6b47d3dc1ace88da27afb43eddb8ff6a06cdc8ce2577
SHA512

0e6d98473ad16c3b1174886b500a323eefe5897ecc64195f31547a81b11c16f442f5c34e9b7ebe42be9f83b0a62f21e70644f83451a611dd3b3b5448efb91d72
SSDEEP

98304:6uWI07yAWCL+cF/21IqE0GcQInC+R/5/qxuKk5q0s55R3FqE9BeMCOmQFGGY4se:y77FFO975/quq0sB9BeMCOmQFGpk

Score

1^/10

Malware Config

Signatures

Files

2024-05-03_ab84c4f7fca069dd4ecf009a7a719684_bkransomware
.exe windows:5 windows x86 arch:x86

39fee7cf1f1909edc3b10eb5b10419fd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3b:52:29:cf:ac:60:e3:58:6a:71:d9:bb:74:40:0a:8a
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

30/11/2015, 00:00

Not After

28/01/2019, 23:59

Subject

CN=JUMO GmbH & Co. KG,O=JUMO GmbH & Co. KG,L=Fulda,ST=Hessen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3b:52:29:cf:ac:60:e3:58:6a:71:d9:bb:74:40:0a:8a
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

30/11/2015, 00:00

Not After

28/01/2019, 23:59

Subject

CN=JUMO GmbH & Co. KG,O=JUMO GmbH & Co. KG,L=Fulda,ST=Hessen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

91:ad:8f:22:b2:31:84:04:99:df:e6:a8:68:b5:1b:e8:fb:56:a5:0d:8f:c6:32:29:9a:b0:76:cb:eb:d1:2e:07
Signer

Actual PE Digest

91:ad:8f:22:b2:31:84:04:99:df:e6:a8:68:b5:1b:e8:fb:56:a5:0d:8f:c6:32:29:9a:b0:76:cb:eb:d1:2e:07

Digest Algorithm

sha256

PE Digest Matches

true

10:30:8f:e3:4f:ad:ef:99:05:a7:82:88:94:1c:cd:e0:fd:c7:a4:07
Signer

Actual PE Digest

10:30:8f:e3:4f:ad:ef:99:05:a7:82:88:94:1c:cd:e0:fd:c7:a4:07

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

prg175u.exe.pdb

Imports

kernel32

OutputDebugStringW
WriteConsoleW
SizeofResource
LockResource
SetEnvironmentVariableA
GetStringTypeW
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetTimeFormatW
GetDateFormatW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStartupInfoW
VirtualAlloc
GetSystemInfo
AreFileApisANSI
GetModuleHandleExW
RtlUnwind
CreateThread
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
CreateDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetFileType
SetStdHandle
HeapQueryInformation
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
LCMapStringA
HeapCreate
GlobalMemoryStatus
GetSystemTime
GetNumberFormatW
SetProcessWorkingSetSize
GetVersionExA
GetDriveTypeW
WritePrivateProfileSectionW
GetVersion
GetConsoleCP
ReadConsoleW
GetConsoleMode
ExitThread
LoadResource
FindResourceW
MultiByteToWideChar
lstrcmpW
HeapAlloc
GetProcessHeap
HeapFree
GetComputerNameW
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
MoveFileW
GetLastError
GetLocalTime
GetProcAddress
GlobalAlloc
GlobalLock
GlobalUnlock
GetTickCount
Sleep
lstrcpynW
GlobalGetAtomNameW
SetLastError
FormatMessageW
LocalFree
HeapReAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
HeapSize
DecodePointer
DeleteCriticalSection
LoadLibraryW
FreeLibrary
CreateFileW
UnmapViewOfFile
CloseHandle
GlobalFree
GetStdHandle
GetModuleFileNameW
GetCurrentThreadId
MulDiv
GetLocaleInfoW
GetTimeZoneInformation
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineW
SearchPathW
GetWindowsDirectoryW
GetProfileIntW
FindResourceExW
SetErrorMode
GetSystemDefaultUILanguage
CompareStringW
GlobalFlags
VirtualProtect
GetCurrentDirectoryW
VerifyVersionInfoW
lstrcpyW
VerSetConditionMask
LocalReAlloc
LocalAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalReAlloc
GetThreadLocale
SetFilePointerEx
ExitProcess
SetUnhandledExceptionFilter
GetStringTypeExW
lstrcmpiW
SetEndOfFile
ReadFile
GetVolumeInformationW
GetShortPathNameW
FlushFileBuffers
FindFirstFileW
FindClose
GetUserDefaultLCID
ReplaceFileW
GetTempFileNameW
GetFullPathNameW
SetFileTime
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
CompareStringA
SystemTimeToFileTime
FileTimeToSystemTime
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryExW
GetSystemDirectoryW
EncodePointer
LoadLibraryA
GetModuleHandleA
OutputDebugStringA
CopyFileW
GlobalSize
DuplicateHandle
SetThreadPriority
ResumeThread
SuspendThread
OpenMutexW
OpenEventW
CreateEventW
ReleaseMutex
WaitForMultipleObjects
lstrcatW
TryEnterCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
GetCurrentThread
GetCurrentProcess
TerminateProcess
UnlockFile
SetFilePointer
LockFile
DeleteFileW
GetFileSize
WaitForSingleObject
SetEvent
ResetEvent
GetModuleFileNameA
VirtualQueryEx
GetDiskFreeSpaceW
ExpandEnvironmentStringsW
GlobalHandle
GetFileAttributesW
GetTempPathW
VirtualQuery
GlobalAddAtomW
GetUserDefaultUILanguage
QueryPerformanceCounter
FreeResource
GetModuleHandleW
GetVersionExW
lstrlenW
CreateMutexW
SetThreadLocale
WriteFile

user32

GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
DrawStateW
DrawEdge
IsClipboardFormatAvailable
CopyImage
GetSystemMenu
UnionRect
RealChildWindowFromPoint
GetAsyncKeyState
WaitMessage
RegisterClipboardFormatW
GetSysColorBrush
SetLayeredWindowAttributes
NotifyWinEvent
MapVirtualKeyW
GetKeyNameTextW
GetMenuItemInfoW
CharUpperW
ShowOwnedPopups
SendDlgItemMessageA
GetNextDlgTabItem
CreateDialogIndirectParamW
SetCursorPos
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
GetTabbedTextExtentW
SystemParametersInfoW
DrawIcon
WindowFromDC
CreateMenu
CopyAcceleratorTableW
GetMessageW
DestroyCursor
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
IsDialogMessageW
ScrollWindowEx
IsDlgButtonChecked
CheckDlgButton
SetDlgItemTextW
MoveWindow
GetScrollInfo
SetScrollInfo
GetClassLongW
AdjustWindowRectEx
RemovePropW
CreateAcceleratorTableW
SetPropW
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
TrackPopupMenu
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
DestroyWindow
IsChild
CreateWindowExW
GetClassInfoExW
RegisterClassW
CallWindowProcW
GetMessageTime
RegisterWindowMessageW
EndPaint
GetActiveWindow
SetRectEmpty
FrameRect
DrawFrameControl
OffsetRect
DrawIconEx
BeginPaint
GetWindowDC
GrayStringW
DrawTextExW
DrawTextW
WinHelpW
GetClassNameW
SetWindowLongW
SetActiveWindow
InsertMenuItemW
SetMenu
GetMenu
GetComboBoxInfo
LoadAcceleratorsW
GetCapture
GetDlgCtrlID
GetDlgItem
SetWindowPos
ShowWindow
GetClassInfoW
RemoveMenu
GetMenuState
GetMenuStringW
wsprintfW
TrackMouseEvent
MessageBeep
LockWindowUpdate
SetClassLongW
GetDCEx
GetMenuDefaultItem
GetNextDlgGroupItem
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
GetDoubleClickTime
CopyIcon
SetMenuDefaultItem
IsWindowEnabled
SetFocus
SetParent
RedrawWindow
SetCursor
IsMenu
ModifyMenuW
IsCharLowerW
MapVirtualKeyExW
CharUpperBuffW
UpdateLayeredWindow
GetUpdateRect
GetPropW
SubtractRect
EqualRect
GetForegroundWindow
GetWindowThreadProcessId
PostThreadMessageW
PostQuitMessage
DefWindowProcW
LoadCursorW
ReleaseCapture
EndDialog
GetLastActivePopup
SetForegroundWindow
BringWindowToTop
IsIconic
FindWindowW
GetWindowRgn
GetDesktopWindow
SetTimer
GetWindowRect
KillTimer
ScreenToClient
SetWindowRgn
GetClientRect
IsWindow
SendMessageW
UpdateWindow
EnableWindow
CopyRect
EnumDisplayMonitors
MonitorFromPoint
GetSystemMetrics
SetRect
MonitorFromWindow
GetMonitorInfoW
PtInRect
IntersectRect
IsWindowVisible
InsertMenuW
GetMenuItemCount
GetMenuItemID
LoadIconW
PostMessageW
LoadStringW
GetParent
GetKeyState
OpenClipboard
GetClipboardData
CloseClipboard
AppendMenuW
ClientToScreen
LoadStringA
MessageBoxA
OemToCharA
CharLowerW
SetCaretPos
DestroyCaret
CreateCaret
ShowCaret
GetOpenClipboardWindow
SystemParametersInfoA
LoadMenuW
GetSubMenu
EmptyClipboard
SetClipboardData
InvalidateRect
ShowScrollBar
LoadBitmapW
GetMessagePos
MapWindowPoints
GetCursorPos
SetCapture
UnregisterClassW
LoadImageW
DestroyIcon
InflateRect
CreatePopupMenu
GetWindowTextLengthW
GetDialogBaseUnits
GetSysColor
FillRect
DrawFocusRect
GetWindowLongW
MapDialogRect
MessageBoxW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
TranslateAcceleratorW
GetWindowTextW
SetWindowTextW
WindowFromPoint
MsgWaitForMultipleObjects
ReleaseDC
GetFocus
IsRectEmpty
IsZoomed
DestroyAcceleratorTable
DrawMenuBar
DestroyMenu
ReuseDDElParam
UnpackDDElParam
GetDC
TabbedTextOutW
GetTopWindow
DispatchMessageW
TranslateMessage
PeekMessageW
DeleteMenu
GetWindow

gdi32

Escape
ExcludeClipRect
GetClipBox
GetCurrentPositionEx
GetObjectType
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextColor
SetTextAlign
ExtCreatePen
MoveToEx
TextOutW
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
CreatePatternBrush
ScaleWindowExtEx
GetViewportOrgEx
CreateEllipticRgn
Ellipse
LPtoDP
SetAbortProc
GetROP2
GetBkMode
GetCharWidthW
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetWindowOrgEx
GetTextFaceW
CreateRectRgnIndirect
GetTextCharsetInfo
GetMapMode
SetRectRgn
CreateFontW
Polygon
Polyline
GetCurrentObject
EnumFontFamiliesExW
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
SetPixel
SetDIBColorTable
GetRgnBox
OffsetRgn
RoundRect
ExtFloodFill
SetPaletteEntries
GetBoundsRect
CreateBitmap
CopyMetaFileW
CreatePen
ExtTextOutW
BitBlt
DPtoLP
EnumFontFamiliesW
Rectangle
GetTextColor
GetStockObject
PatBlt
SelectObject
GetPixel
SetPixelV
GetBkColor
CreateHatchBrush
AbortDoc
CreateFontIndirectW
CreateRectRgn
PtInRegion
CreateRoundRectRgn
CreatePolygonRgn
CombineRgn
CreateSolidBrush
FrameRgn
GetTextExtentPoint32W
PtVisible
RectVisible
CreateDCW
RectInRegion
GetGraphicsMode
CreateBitmapIndirect
CreateICW
CreateBrushIndirect
CreatePenIndirect
SetBrushOrgEx
GetTextExtentPointW
SetViewportOrgEx
SetViewportExtEx
GetDeviceCaps
DeleteDC
StretchBlt
CreateCompatibleDC
GetObjectW
GetTextMetricsW
CreateCompatibleBitmap
StretchDIBits
SelectPalette
RealizePalette
CreateDIBSection
DeleteObject
CreatePalette
CreateHalftonePalette
CreateDIBitmap
GetDIBits
StartDocW
StartPage
EndPage
ScaleViewportExtEx
FillRgn
EndDoc

msimg32

AlphaBlend
TransparentBlt

winspool.drv

GetJobW
ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

AllocateAndInitializeSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetAce
SetNamedSecurityInfoW
RegSetKeySecurity
RegUnLoadKeyW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryInfoKeyW
RegNotifyChangeKeyValue
RegLoadKeyW
RegGetKeySecurity
RegFlushKey
RegConnectRegistryW
RegCreateKeyExW
RegDeleteKeyW
RegSetValueExW
GetLengthSid
RegEnumValueW
RegEnumKeyExW
SetFileSecurityW
GetFileSecurityW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegSetValueW

shell32

DragAcceptFiles
DragQueryFileW
DragFinish
SHGetFileInfoW
ExtractIconW
SHAddToRecentDocs
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
SHAppBarMessage
SHGetDesktopFolder
SHGetSpecialFolderLocation

comctl32

ImageList_AddMasked
ImageList_Draw
ImageList_DrawEx
ImageList_GetImageCount
ImageList_SetBkColor
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_Merge
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_ReplaceIcon
ord17
ord8

shlwapi

PathFindExtensionW
PathFindFileNameW
PathRemoveExtensionW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
ord12
StrFormatKBSizeW

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
GetWindowTheme
GetThemeSysColor
GetCurrentThemeName
GetThemeColor
DrawThemeText
DrawThemeParentBackground
IsAppThemed

ole32

OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
DoDragDrop
RegisterDragDrop
RevokeDragDrop
CoDisconnectObject
OleGetClipboard
CoRevokeClassObject
CoLockObjectExternal
OleLockRunning
CreateStreamOnHGlobal
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
StringFromGUID2
CoRegisterClassObject
CoInitializeEx
CoInitialize
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
StringFromCLSID
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
StgOpenStorage
StgCreateDocfile
CoTaskMemFree
CoCreateGuid
CoUninitialize
ProgIDFromCLSID
CoCreateInstance

oleaut32

VariantClear
VariantCopy
SafeArrayGetVartype
SafeArrayCopy
VariantChangeType
SysAllocString
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetDim
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCreate
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
SysStringByteLen
VariantInit
VariantTimeToSystemTime
RegisterTypeLi
VarDateFromStr
SysFreeString
VarBstrFromDate
SysAllocStringLen
LoadRegTypeLi
VarUdateFromDate
LoadTypeLi
SystemTimeToVariantTime
VarR8FromStr
SysStringLen

oledlg

OleUIBusyW

wintrust

CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
WinVerifyTrust

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

EnumProcessModules
GetModuleFileNameExA

dbghelp

SymLoadModule
SymCleanup
StackWalk
SymSetOptions
SymGetOptions
SymInitialize
SymUnDName
SymFunctionTableAccess
SymGetModuleInfo
SymGetSymFromAddr
UnDecorateSymbolName

nameu_175

GetDllHandle

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

gdiplus

GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdiplusShutdown
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetInterpolationMode
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipGetImageWidth

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 95KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 362KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39fee7cf1f1909edc3b10eb5b10419fd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

3b:52:29:cf:ac:60:e3:58:6a:71:d9:bb:74:40:0a:8aCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

3b:52:29:cf:ac:60:e3:58:6a:71:d9:bb:74:40:0a:8aCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9Certificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

91:ad:8f:22:b2:31:84:04:99:df:e6:a8:68:b5:1b:e8:fb:56:a5:0d:8f:c6:32:29:9a:b0:76:cb:eb:d1:2e:07Signer

10:30:8f:e3:4f:ad:ef:99:05:a7:82:88:94:1c:cd:e0:fd:c7:a4:07Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

wintrust

version

psapi

dbghelp

nameu_175

oleacc

gdiplus

imm32

winmm

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 95KB - Virtual size: 148KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 362KB - Virtual size: 361KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

3b:52:29:cf:ac:60:e3:58:6a:71:d9:bb:74:40:0a:8a
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

3b:52:29:cf:ac:60:e3:58:6a:71:d9:bb:74:40:0a:8a
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

91:ad:8f:22:b2:31:84:04:99:df:e6:a8:68:b5:1b:e8:fb:56:a5:0d:8f:c6:32:29:9a:b0:76:cb:eb:d1:2e:07
Signer

10:30:8f:e3:4f:ad:ef:99:05:a7:82:88:94:1c:cd:e0:fd:c7:a4:07
Signer

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 95KB - Virtual size: 148KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 362KB - Virtual size: 361KB