f177f76869c7f4ed344f1062067d3f01d05c356baa1678b8700276d5fe6d4cc6

Sharing

Copy URL Twitter E-mail

General

Target

f177f76869c7f4ed344f1062067d3f01d05c356baa1678b8700276d5fe6d4cc6
Size

2.3MB
MD5

c453cc596b329d58e7385914c48de471
SHA1

56e6eb952dcd02bd9aca019f78fd7bcb7d1efc21
SHA256

f177f76869c7f4ed344f1062067d3f01d05c356baa1678b8700276d5fe6d4cc6
SHA512

07c0fa2e1befb82cb936ea23e6d5ab6bd4a0c660813999003475e4d304e25abe199ca308008a77a02a27856f662a3756b763c09d426d2974ab2f108672e6e35f
SSDEEP

49152:gNyLs+jcXAmIx8g1jiLYv3fSQ3eEsKdRcjJcfBvMrNI:g8Lvj2AmIWg1jiLw3fJ3eEsKdRcjJc9B

Score

1^/10

Malware Config

Signatures

Files

f177f76869c7f4ed344f1062067d3f01d05c356baa1678b8700276d5fe6d4cc6
.dll windows:6 windows x86 arch:x86

bc5d54a1dc2f3f18a1ddaa21c24bc717

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:99:de:8f:ff:80:db:8c:e7:ee:24:d8:41:58:ee:97
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

02/10/2023, 00:00

Not After

01/10/2026, 23:59

Subject

CN=Guangxi Nanning Liangdu Technology Co.\, Ltd,O=Guangxi Nanning Liangdu Technology Co.\, Ltd,ST=Guangxi Zhuangzu Zizhiqu,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

00:41:c1:2c:69:f4:14:c6:7a:b5:59:17:e4:3d:24:4e:3f:ff:6a:c2:8c:d4:01:f0:24:5f:26:53:fd:0b:d8:0c
Signer

Actual PE Digest

00:41:c1:2c:69:f4:14:c6:7a:b5:59:17:e4:3d:24:4e:3f:ff:6a:c2:8c:d4:01:f0:24:5f:26:53:fd:0b:d8:0c

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\NVMe-Win10\Desktop\CodeProject\VC++\Total Uninstaller\svn_core\Release\core.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

ExitProcess
GetFileType
SetStdHandle
QueryPerformanceFrequency
VirtualQuery
VirtualAlloc
GetSystemInfo
HeapQueryInformation
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
InterlockedFlushSList
RtlUnwind
GetCPInfo
LCMapStringEx
GetConsoleMode
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
FindNextFileW
FindFirstFileExW
GetStringTypeW
GetLocaleInfoEx
FormatMessageA
RaiseException
OutputDebugStringW
GetConsoleOutputCP
SetFilePointerEx
GetStdHandle
CompareStringEx
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetUserDefaultLCID
GetTempFileNameW
Sleep
SearchPathW
GetProfileIntW
GetTickCount64
GetTempPathW
GetWindowsDirectoryW
FindResourceExW
lstrcpyW
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FileTimeToLocalFileTime
FileTimeToSystemTime
VirtualProtect
GlobalGetAtomNameW
lstrcmpiW
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
DeleteFileW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetCurrentDirectoryW
CompareStringW
GlobalFindAtomW
LoadLibraryA
EncodePointer
SetErrorMode
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CopyFileW
FormatMessageW
MulDiv
LocalFree
GlobalFree
GlobalUnlock
GlobalSize
GlobalAddAtomW
GetCurrentProcessId
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
WideCharToMultiByte
MultiByteToWideChar
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
FreeLibrary
GetVersionExW
GetCurrentThread
SetLastError
OutputDebugStringA
ResumeThread
SetThreadPriority
GetCurrentThreadId
GetSystemDirectoryW
GetLongPathNameW
VerifyVersionInfoW
VerSetConditionMask
WriteConsoleW
CloseHandle
WaitForSingleObject
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
FreeEnvironmentStringsW
SetEnvironmentVariableW

user32

MessageBeep
GetIconInfo
DrawIconEx
IsRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
LoadImageW
TrackMouseEvent
IntersectRect
MapDialogRect
GetAsyncKeyState
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
OffsetRect
SetRectEmpty
SendDlgItemMessageA
InflateRect
GetMenuItemInfoW
DestroyMenu
CharUpperW
DestroyIcon
LoadCursorW
GetSysColorBrush
GetSystemMetrics
FillRect
ReleaseDC
GetWindowDC
GetDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
InvalidateRect
KillTimer
SetTimer
RealChildWindowFromPoint
GetDesktopWindow
ClientToScreen
DeleteMenu
SystemParametersInfoW
CopyImage
IsDialogMessageW
SetWindowTextW
CheckDlgButton
EnableScrollBar
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
GetWindow
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
EqualRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetCursorPos
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
CopyIcon
FrameRect
DrawIcon
UnionRect
UnregisterClassW
GetMessageW
TranslateMessage
DispatchMessageW
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
GetDlgItem
IsIconic
EndDeferWindowPos
HideCaret
InvertRect
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
MapVirtualKeyW
GetKeyNameTextW
LoadMenuW
SetLayeredWindowAttributes
EnumDisplayMonitors
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
SetClassLongW
SetWindowRgn
SetParent
DrawEdge
DrawFrameControl
IsZoomed
GetSystemMenu
MoveWindow
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
WaitMessage
GetKeyboardLayout
PeekMessageW
SendMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
PostMessageW
PostQuitMessage
ShowOwnedPopups
SetCursor
EnableWindow
IsWindowEnabled
MessageBoxW
GetWindowLongW
GetParent
GetWindowThreadProcessId
GetLastActivePopup
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
UnhookWindowsHookEx
RegisterWindowMessageW
GetMessagePos
GetMessageTime
DefWindowProcW
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsWindow
IsMenu
IsChild
DestroyWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
BringWindowToTop
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
DestroyCursor
GetWindowRgn
CreateMenu
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
GetUpdateRect
IsClipboardFormatAvailable
CharUpperBuffW
RegisterClipboardFormatW
ModifyMenuW
GetDoubleClickTime
RemovePropW
SetMenuDefaultItem

gdi32

Escape
ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectW
GetTextExtentPoint32W
CombineRgn
CreateRectRgn
PatBlt
SetRectRgn
DPtoLP
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
DeleteObject
GetObjectW
SetTextColor
SetBkColor
DeleteDC
CreateBitmap
GetDeviceCaps
CreateDCW
CreateRectRgnIndirect
CreateSolidBrush
CopyMetaFileW

msimg32

AlphaBlend
TransparentBlt

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHGetDesktopFolder
DragQueryFileW
DragFinish
SHAppBarMessage
SHBrowseForFolderW
ShellExecuteExW

shlwapi

PathFindFileNameW
ord487
PathStripToRootW
PathRemoveFileSpecW
StrFormatKBSizeW
PathIsUNCW
PathFindExtensionW

uxtheme

IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
GetCurrentThemeName
GetThemeSysColor
DrawThemeBackground
CloseThemeData
OpenThemeData
DrawThemeParentBackground
DrawThemeText
GetThemeColor
GetThemePartSize

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
CoInitializeEx
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantCopy
VariantClear
VarBstrFromDate
SysAllocString
SysFreeString
SysAllocStringLen
LoadTypeLi
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantChangeType
VariantInit

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdiplusShutdown
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

Exports

Exports

exfun_AppX_Listed
exfun_AppX_Listed_Free
exfun_AppX_Remove
exfun_DelDirOrFiles
exfun_DeleteDesktopLinkFiles
exfun_GetAppDataFolder
exfun_GetDesktopFolder
exfun_GetDirAllSubDirName
exfun_GetDirAllSubDirName_Free
exfun_GetDirectorySize
exfun_GetFileVersion
exfun_GetLocalAppDataFolder
exfun_GetLongPathName
exfun_GetProgramFolder
exfun_GetProgramFolderEx
exfun_GetSystemDirectory
exfun_GetUserNameStartupFolder
exfun_GetWindowsFolder
exfun_IsDirectory
exfun_Other_IsWin10later
exfun_Reg_DeleteValue
exfun_Reg_FindSubKey
exfun_Reg_FindSubKey_Free
exfun_Reg_GetAllSIDByHKLM
exfun_Reg_GetAllSIDByHKLM_Free
exfun_Reg_GetAllSIDByHKU
exfun_Reg_GetAllSIDByHKU_Free
exfun_Reg_GetAllSubKeyPath
exfun_Reg_GetAllSubKeyPath_Free
exfun_Reg_GetRootAllKeyName
exfun_Reg_GetRootAllKeyName_Free
exfun_Reg_GetRootAllValueAndName
exfun_Reg_GetRootAllValueAndName_Free
exfun_Reg_GetRootAllValueName
exfun_Reg_GetRootAllValueName_Free
exfun_Reg_IsExistKey
exfun_Reg_IsExistValue
exfun_Reg_QueryValue_Str
exfun_Reg_QueryValue_Str_Free

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 453KB - Virtual size: 453KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc5d54a1dc2f3f18a1ddaa21c24bc717

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

52:99:de:8f:ff:80:db:8c:e7:ee:24:d8:41:58:ee:97Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

00:41:c1:2c:69:f4:14:c6:7a:b5:59:17:e4:3d:24:4e:3f:ff:6a:c2:8c:d4:01:f0:24:5f:26:53:fd:0b:d8:0cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

oleacc

imm32

winmm

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 453KB - Virtual size: 453KB

.data Size: 23KB - Virtual size: 40KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 138KB - Virtual size: 137KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

52:99:de:8f:ff:80:db:8c:e7:ee:24:d8:41:58:ee:97
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

00:41:c1:2c:69:f4:14:c6:7a:b5:59:17:e4:3d:24:4e:3f:ff:6a:c2:8c:d4:01:f0:24:5f:26:53:fd:0b:d8:0c
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 453KB - Virtual size: 453KB

.data
Size: 23KB - Virtual size: 40KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 138KB - Virtual size: 137KB