4b51bb1708809fc435c164323ef29342f2500ac135c69e2f312b0f5475a9fa02[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

4b51bb1708809fc435c164323ef29342f2500ac135c69e2f312b0f5475a9fa02.exe
Size

3.9MB
MD5

3ea726927781374110a7176dc0640838
SHA1

3f41264178761709cc6ebca7c466489603015f39
SHA256

4b51bb1708809fc435c164323ef29342f2500ac135c69e2f312b0f5475a9fa02
SHA512

c78e1892624ce6457c4e3ce36bd92ab9eb77c9f5e0ea7cf9e38c4edd846f1ad6701955d40c87f59e3945d30aa6eacfc8c863cf9a4e3d755bfef4b390adf968f5
SSDEEP

98304:723D++KKtbo8QBrPgkPRcTe17cdh0p1AhxYg:729xQBrPgkPRcTjig

Score

1^/10

Malware Config

Signatures

Files

4b51bb1708809fc435c164323ef29342f2500ac135c69e2f312b0f5475a9fa02.exe
.exe windows:6 windows x86 arch:x86

d197ea2196a92290b5d63b83e97e09c4

Code Sign

0a:de:81:14:d7:67:9b:06:6f:2d:b2:df:d2:f6:7a:c2
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05/04/2021, 00:00

Not After

05/04/2023, 23:59

Subject

CN=Intel Corporation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:15

Not After

02/12/2021, 22:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:f7:c5:35:6f:c1:b2:9f:9b:64:5d:1d:4d:96:a2:9b:fc:28:60:a7:2b:1c:b2:53:91:a4:47:56:25:78:8f:7e
Signer

Actual PE Digest

30:f7:c5:35:6f:c1:b2:9f:9b:64:5d:1d:4d:96:a2:9b:fc:28:60:a7:2b:1c:b2:53:91:a4:47:56:25:78:8f:7e

Digest Algorithm

sha256

PE Digest Matches

true

30:f7:c5:35:6f:c1:b2:9f:9b:64:5d:1d:4d:96:a2:9b:fc:28:60:a7:2b:1c:b2:53:91:a4:47:56:25:78:8f:7e
Signer

Actual PE Digest

30:f7:c5:35:6f:c1:b2:9f:9b:64:5d:1d:4d:96:a2:9b:fc:28:60:a7:2b:1c:b2:53:91:a4:47:56:25:78:8f:7e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\buildagent-cd_8811\p4\993441124\services\AMTSW\UNS\ReleaseUniversal\LMS.pdb

Imports

iphlpapi

GetInterfaceInfo
NotifyIpInterfaceChange
GetAdaptersAddresses
IpRenewAddress
GetExtendedTcpTable
GetAdaptersInfo
CancelIPChangeNotify
CancelMibChangeNotify2
SetTcpEntry
GetPerAdapterInfo
NotifyRouteChange
GetIpAddrTable

cfgmgr32

CM_Get_Device_Interface_ListA
CM_Get_Device_Interface_List_SizeA

winhttp

WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpSetOption
WinHttpCloseHandle
WinHttpQueryAuthSchemes
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpSetCredentials
WinHttpConnect
WinHttpOpenRequest

api-ms-win-core-synch-l1-2-0

SignalObjectAndWait
Sleep

api-ms-win-core-kernel32-legacy-l1-1-1

SetDllDirectoryW
VerifyVersionInfoW

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle
GetCommandLineA
GetCommandLineW
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetCurrentDirectoryW
ExpandEnvironmentStringsW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegSetValueExW
RegSetKeySecurity
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyExW

ws2_32

closesocket
WSASend
select
WSAEnumNetworkEvents
WSAEventSelect
inet_ntoa
htonl
shutdown
listen
htons
WSAStartup
getpeername
getsockname
send
socket
ntohs
ntohl
bind
recv
getsockopt
ioctlsocket
getnameinfo
freeaddrinfo
accept
getservbyname
gethostbyaddr
getaddrinfo
setsockopt
__WSAFDIsSet
inet_addr
gethostname
getservbyport
WSASetLastError
connect
WSACleanup
WSAGetLastError
WSAAddressToStringA
WSACloseEvent
WSACreateEvent
WSAAccept
gethostbyname

api-ms-win-core-com-l1-1-0

CoImpersonateClient
PropVariantClear
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoRevertToSelf
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoInitializeSecurity
CoRevokeClassObject
CoReleaseServerProcess
CoAddRefServerProcess
CoRegisterClassObject
CoResumeClassObjects

oleaut32

VarBstrCat
SysAllocString
SysFreeString
VariantInit
VariantClear
SysStringLen
UnRegisterTypeLi
LoadRegTypeLi
SafeArrayCreate
SafeArrayGetUBound
VarUI4FromStr
RegisterTypeLi
VariantChangeType
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayPutElement
SafeArrayCreateVector
SysStringByteLen
SysAllocStringByteLen
LoadTypeLi
SysAllocStringLen

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-synch-l1-1-0

TryEnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
CreateMutexW
CreateMutexA
ReleaseMutex
ReleaseSemaphore
SetEvent
ResetEvent
CreateEventW
EnterCriticalSection
CreateEventA
WaitForMultipleObjectsEx
WaitForSingleObjectEx

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
OpenProcessToken
GetCurrentThreadId
GetCurrentThread
CreateThread
GetCurrentProcess
SwitchToThread
TerminateProcess
SetThreadPriority
GetThreadId
GetCurrentProcessId
ExitProcess
ExitThread
TlsGetValue
TlsFree
SuspendThread
GetThreadPriority
TlsAlloc
TlsSetValue
GetExitCodeThread
ResumeThread
GetStartupInfoW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
LoadStringW
SizeofResource
LoadLibraryExA
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExW
FreeLibraryAndExitThread

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW
LoadLibraryA

api-ms-win-security-base-l1-1-0

CopySid
InitializeSecurityDescriptor
IsValidSid
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
AdjustTokenPrivileges
GetTokenInformation
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
GetLengthSid
EqualSid
CreateWellKnownSid

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW
CharUpperW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW
GetStringTypeW
MultiByteToWideChar

api-ms-win-core-registry-l2-1-0

RegCreateKeyW
RegDeleteKeyW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

DeleteService
OpenServiceW
OpenSCManagerW
CloseServiceHandle
CreateServiceW

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree
LocalFree
LocalAlloc

api-ms-win-core-localization-l1-2-0

IsValidCodePage
GetACP
GetOEMCP
EnumSystemLocalesW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetSystemDefaultLCID
GetUserDefaultLCID
IsValidLocale
FormatMessageW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupPrivilegeValueW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExA
GetTickCount
GetLogicalProcessorInformation
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemTime
GetVersionExW
GetSystemDirectoryA

crypt32

CertFindCertificateInStore
CryptQueryObject
CertFreeCertificateContext
CryptMsgClose
CertGetNameStringW
CertCloseStore
CryptMsgGetParam
CertOpenStore

api-ms-win-core-file-l1-1-0

FindFirstFileW
GetFileAttributesW
CreateFileA
GetFileType
GetFullPathNameW
UnlockFileEx
SetFilePointerEx
FindClose
LockFileEx
ReadFile
WriteFile
SetFilePointer
SetEndOfFile
CreateFileW
GetDriveTypeW
FindFirstFileExW
FindNextFileW
GetFinalPathNameByHandleW
FlushFileBuffers
GetFileInformationByHandle

wintrust

WinVerifyTrust

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
GetThreadTimes

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus
GetComputerNameA
UnregisterWait
RegisterWaitForSingleObject

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-heap-l1-1-0

HeapSize
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapFree

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

api-ms-win-power-setting-l1-1-0

PowerReadDCValue
PowerReadACValue

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetSpecialFolderPathW

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

powrprof

SetSuspendState

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect

advapi32

ReportEventW
DeregisterEventSource
RegisterEventSourceW

user32

MessageBoxW
PostThreadMessageW
UnregisterDeviceNotification
DispatchMessageW
RegisterDeviceNotificationW
GetMessageW
TranslateMessage

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
QueryDepthSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
UnregisterWaitEx
ChangeTimerQueueTimer
CreateTimerQueueTimer
CreateTimerQueue

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask
GetProcessAffinityMask

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-console-l1-1-0

ReadConsoleW
GetConsoleCP
SetConsoleCtrlHandler
GetConsoleMode
WriteConsoleW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

Exports

Exports

UTF8ToHtml
UTF8Toisolat1
_GetDriverVersion@8
_TeeConnect@4
_TeeDisconnect@4
_TeeFWStatus@12
_TeeGetDeviceHandle@4
_TeeInit@12
_TeeInitGUID@12
_TeeInitHandle@12
_TeeRead@20
_TeeWrite@20
__docbDefaultSAXHandler
__htmlDefaultSAXHandler
__oldXMLWDcompatibility
__xmlBufferAllocScheme
__xmlDefaultBufferSize
__xmlDefaultSAXHandler
__xmlDefaultSAXLocator
__xmlDeregisterNodeDefaultValue
__xmlDoValidityCheckingDefaultValue
__xmlErrEncoding
__xmlGenericError
__xmlGenericErrorContext
__xmlGetWarningsDefaultValue
__xmlIndentTreeOutput
__xmlKeepBlanksDefaultValue
__xmlLastError
__xmlLineNumbersDefaultValue
__xmlLoadExtDtdDefaultValue
__xmlOutputBufferCreateFilenameValue
__xmlParserDebugEntities
__xmlParserInputBufferCreateFilenameValue
__xmlParserVersion
__xmlPedanticParserDefaultValue
__xmlRaiseError
__xmlRegisterNodeDefaultValue
__xmlSaveNoEmptyTags
__xmlSimpleError
__xmlStructuredError
__xmlStructuredErrorContext
__xmlSubstituteEntitiesDefaultValue
__xmlTreeIndentString
docbDefaultSAXHandlerInit
htmlAttrAllowed
htmlAutoCloseTag
htmlCreateFileParserCtxt
htmlCreateMemoryParserCtxt
htmlCreatePushParserCtxt
htmlCtxtReadDoc
htmlCtxtReadFd
htmlCtxtReadFile
htmlCtxtReadIO
htmlCtxtReadMemory
htmlCtxtReset
htmlCtxtUseOptions
htmlDefaultSAXHandlerInit
htmlDocContentDumpFormatOutput
htmlDocContentDumpOutput
htmlDocDump
htmlDocDumpMemory
htmlDocDumpMemoryFormat
htmlElementAllowedHere
htmlElementStatusHere
htmlEncodeEntities
htmlEntityLookup
htmlEntityValueLookup
htmlFreeParserCtxt
htmlGetMetaEncoding
htmlHandleOmittedElem
htmlInitAutoClose
htmlIsAutoClosed
htmlIsBooleanAttr
htmlIsScriptAttribute
htmlNewDoc
htmlNewDocNoDtD
htmlNewParserCtxt
htmlNodeDump
htmlNodeDumpFile
htmlNodeDumpFileFormat
htmlNodeDumpFormatOutput
htmlNodeDumpOutput
htmlNodeStatus
htmlParseCharRef
htmlParseChunk
htmlParseDoc
htmlParseDocument
htmlParseElement
htmlParseEntityRef
htmlParseFile
htmlReadDoc
htmlReadFd
htmlReadFile
htmlReadIO
htmlReadMemory
htmlSAXParseDoc
htmlSAXParseFile
htmlSaveFile
htmlSaveFileEnc
htmlSaveFileFormat
htmlSetMetaEncoding
htmlTagLookup
initGenericErrorDefaultFunc
initdocbDefaultSAXHandler
inithtmlDefaultSAXHandler
initxmlDefaultSAXHandler
inputPop
inputPush
isolat1ToUTF8
namePop
namePush
nodePop
nodePush
valuePop
valuePush
xmlACatalogAdd
xmlACatalogDump
xmlACatalogRemove
xmlACatalogResolve
xmlACatalogResolvePublic
xmlACatalogResolveSystem
xmlACatalogResolveURI
xmlAddAttributeDecl
xmlAddChild
xmlAddChildList
xmlAddDocEntity
xmlAddDtdEntity
xmlAddElementDecl
xmlAddEncodingAlias
xmlAddID
xmlAddNextSibling
xmlAddNotationDecl
xmlAddPrevSibling
xmlAddRef
xmlAddSibling
xmlAllocOutputBuffer
xmlAllocParserInputBuffer
xmlAttrSerializeTxtContent
xmlAutomataCompile
xmlAutomataGetInitState
xmlAutomataIsDeterminist
xmlAutomataNewAllTrans
xmlAutomataNewCountTrans
xmlAutomataNewCountTrans2
xmlAutomataNewCountedTrans
xmlAutomataNewCounter
xmlAutomataNewCounterTrans
xmlAutomataNewEpsilon
xmlAutomataNewNegTrans
xmlAutomataNewOnceTrans
xmlAutomataNewOnceTrans2
xmlAutomataNewState
xmlAutomataNewTransition
xmlAutomataNewTransition2
xmlAutomataSetFinalState
xmlBoolToText
xmlBufContent
xmlBufEnd
xmlBufGetNodeContent
xmlBufNodeDump
xmlBufShrink
xmlBufUse
xmlBufferAdd
xmlBufferAddHead
xmlBufferCCat
xmlBufferCat
xmlBufferContent
xmlBufferCreate
xmlBufferCreateSize
xmlBufferCreateStatic
xmlBufferDetach
xmlBufferDump
xmlBufferEmpty
xmlBufferFree
xmlBufferGrow
xmlBufferLength
xmlBufferResize
xmlBufferSetAllocationScheme
xmlBufferShrink
xmlBufferWriteCHAR
xmlBufferWriteChar
xmlBufferWriteQuotedString
xmlBuildQName
xmlBuildRelativeURI
xmlBuildURI
xmlByteConsumed
xmlCanonicPath
xmlCatalogAdd
xmlCatalogAddLocal
xmlCatalogCleanup
xmlCatalogConvert
xmlCatalogDump
xmlCatalogFreeLocal
xmlCatalogGetDefaults
xmlCatalogGetPublic
xmlCatalogGetSystem
xmlCatalogIsEmpty
xmlCatalogLocalResolve
xmlCatalogLocalResolveURI
xmlCatalogRemove
xmlCatalogResolve
xmlCatalogResolvePublic
xmlCatalogResolveSystem
xmlCatalogResolveURI
xmlCatalogSetDebug
xmlCatalogSetDefaultPrefer
xmlCatalogSetDefaults
xmlCharEncCloseFunc
xmlCharEncFirstLine
xmlCharEncInFunc
xmlCharEncOutFunc
xmlCharInRange
xmlCharStrdup
xmlCharStrndup
xmlCheckFilename
xmlCheckHTTPInput
xmlCheckLanguageID
xmlCheckUTF8
xmlCheckVersion
xmlChildElementCount
xmlCleanupCharEncodingHandlers
xmlCleanupEncodingAliases
xmlCleanupGlobals
xmlCleanupInputCallbacks
xmlCleanupMemory
xmlCleanupOutputCallbacks
xmlCleanupParser
xmlCleanupThreads
xmlClearNodeInfoSeq
xmlClearParserCtxt
xmlConvertSGMLCatalog
xmlCopyAttributeTable
xmlCopyChar
xmlCopyCharMultiByte
xmlCopyDoc
xmlCopyDocElementContent
xmlCopyDtd
xmlCopyElementContent
xmlCopyElementTable
xmlCopyEntitiesTable
xmlCopyEnumeration
xmlCopyError
xmlCopyNamespace
xmlCopyNamespaceList
xmlCopyNode
xmlCopyNodeList
xmlCopyNotationTable
xmlCopyProp
xmlCopyPropList
xmlCreateDocParserCtxt
xmlCreateEntitiesTable
xmlCreateEntityParserCtxt
xmlCreateEnumeration
xmlCreateFileParserCtxt
xmlCreateIOParserCtxt
xmlCreateIntSubset
xmlCreateMemoryParserCtxt
xmlCreatePushParserCtxt
xmlCreateURI
xmlCreateURLParserCtxt
xmlCtxtGetLastError
xmlCtxtReadDoc
xmlCtxtReadFd
xmlCtxtReadFile
xmlCtxtReadIO
xmlCtxtReadMemory
xmlCtxtReset
xmlCtxtResetLastError
xmlCtxtResetPush
xmlCtxtUseOptions
xmlCurrentChar
xmlDOMWrapAdoptNode
xmlDOMWrapCloneNode
xmlDOMWrapFreeCtxt
xmlDOMWrapNewCtxt
xmlDOMWrapReconcileNamespaces
xmlDOMWrapRemoveNode
xmlDebugCheckDocument
xmlDebugDumpAttr
xmlDebugDumpAttrList
xmlDebugDumpDTD
xmlDebugDumpDocument
xmlDebugDumpDocumentHead
xmlDebugDumpEntities
xmlDebugDumpNode
xmlDebugDumpNodeList
xmlDebugDumpOneNode
xmlDebugDumpString
xmlDefaultSAXHandlerInit
xmlDelEncodingAlias
xmlDeregisterNodeDefault
xmlDetectCharEncoding
xmlDictCleanup
xmlDictCreate
xmlDictCreateSub
xmlDictExists
xmlDictFree
xmlDictGetUsage
xmlDictLookup
xmlDictOwns
xmlDictQLookup
xmlDictReference
xmlDictSetLimit
xmlDictSize
xmlDocCopyNode
xmlDocCopyNodeList
xmlDocDump
xmlDocDumpFormatMemory
xmlDocDumpFormatMemoryEnc
xmlDocDumpMemory
xmlDocDumpMemoryEnc
xmlDocFormatDump
xmlDocGetRootElement
xmlDocSetRootElement
xmlDumpAttributeDecl
xmlDumpAttributeTable
xmlDumpElementDecl
xmlDumpElementTable
xmlDumpEntitiesTable
xmlDumpEntityDecl
xmlDumpNotationDecl
xmlDumpNotationTable
xmlElemDump
xmlEncodeEntitiesReentrant
xmlEncodeSpecialChars
xmlErrMemory
xmlEscapeFormatString
xmlFileClose
xmlFileMatch
xmlFileOpen
xmlFileRead
xmlFindCharEncodingHandler
xmlFirstElementChild
xmlFree
xmlFreeAttributeTable
xmlFreeAutomata
xmlFreeCatalog
xmlFreeDoc
xmlFreeDocElementContent
xmlFreeDtd
xmlFreeElementContent
xmlFreeElementTable
xmlFreeEntitiesTable
xmlFreeEnumeration
xmlFreeIDTable
xmlFreeInputStream
xmlFreeMutex
xmlFreeNode
xmlFreeNodeList
xmlFreeNotationTable
xmlFreeNs
xmlFreeNsList
xmlFreeParserCtxt
xmlFreeParserInputBuffer
xmlFreePattern
xmlFreePatternList
xmlFreeProp
xmlFreePropList
xmlFreeRMutex
xmlFreeRefTable
xmlFreeStreamCtxt
xmlFreeTextReader
xmlFreeURI
xmlFreeValidCtxt
xmlGcMemGet
xmlGcMemSetup
xmlGetBufferAllocationScheme
xmlGetCharEncodingHandler
xmlGetCharEncodingName
xmlGetCompressMode
xmlGetDocCompressMode
xmlGetDocEntity
xmlGetDtdAttrDesc
xmlGetDtdElementDesc
xmlGetDtdEntity
xmlGetDtdNotationDesc
xmlGetDtdQAttrDesc
xmlGetDtdQElementDesc
xmlGetEncodingAlias
xmlGetExternalEntityLoader
xmlGetGlobalState
xmlGetID
xmlGetIntSubset
xmlGetLastChild
xmlGetLastError
xmlGetLineNo
xmlGetNoNsProp
xmlGetNodePath
xmlGetNsList
xmlGetNsProp
xmlGetParameterEntity
xmlGetPredefinedEntity
xmlGetProp
xmlGetRefs
xmlGetThreadId
xmlGetUTF8Char
xmlHasFeature
xmlHasNsProp
xmlHasProp
xmlHashAddEntry
xmlHashAddEntry2
xmlHashAddEntry3
xmlHashCopy
xmlHashCreate
xmlHashCreateDict
xmlHashDefaultDeallocator
xmlHashFree
xmlHashLookup
xmlHashLookup2
xmlHashLookup3
xmlHashQLookup
xmlHashQLookup2
xmlHashQLookup3
xmlHashRemoveEntry
xmlHashRemoveEntry2
xmlHashRemoveEntry3
xmlHashScan
xmlHashScan3
xmlHashScanFull
xmlHashScanFull3
xmlHashSize
xmlHashUpdateEntry
xmlHashUpdateEntry2
xmlHashUpdateEntry3
xmlIOFTPClose
xmlIOFTPMatch
xmlIOFTPOpen
xmlIOFTPRead
xmlIOHTTPClose
xmlIOHTTPMatch
xmlIOHTTPOpen
xmlIOHTTPOpenW
xmlIOHTTPRead
xmlIOParseDTD
xmlInitCharEncodingHandlers
xmlInitGlobals
xmlInitMemory
xmlInitNodeInfoSeq
xmlInitParser
xmlInitParserCtxt
xmlInitThreads
xmlInitializeCatalog
xmlInitializeDict
xmlInitializeGlobalState
xmlIsBaseChar
xmlIsBaseCharGroup
xmlIsBlank
xmlIsBlankNode
xmlIsChar
xmlIsCharGroup
xmlIsCombining
xmlIsCombiningGroup
xmlIsDigit
xmlIsDigitGroup
xmlIsExtender
xmlIsExtenderGroup
xmlIsID
xmlIsIdeographic
xmlIsIdeographicGroup
xmlIsLetter
xmlIsMainThread
xmlIsMixedElement
xmlIsPubidChar
xmlIsPubidChar_tab
xmlIsRef
xmlIsXHTML
xmlKeepBlanksDefault
xmlLastElementChild
xmlLineNumbersDefault
xmlLinkGetData
xmlListAppend
xmlListClear
xmlListCopy
xmlListCreate
xmlListDelete
xmlListDup
xmlListEmpty
xmlListEnd
xmlListFront
xmlListInsert
xmlListMerge
xmlListPopBack
xmlListPopFront
xmlListPushBack
xmlListPushFront
xmlListRemoveAll
xmlListRemoveFirst
xmlListRemoveLast
xmlListReverse
xmlListReverseSearch
xmlListReverseWalk
xmlListSearch
xmlListSize
xmlListSort
xmlListWalk
xmlLoadACatalog
xmlLoadCatalog
xmlLoadCatalogs
xmlLoadExternalEntity
xmlLoadSGMLSuperCatalog

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 892KB - Virtual size: 892KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 189KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d197ea2196a92290b5d63b83e97e09c4

Code Sign

0a:de:81:14:d7:67:9b:06:6f:2d:b2:df:d2:f6:7a:c2Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

30:f7:c5:35:6f:c1:b2:9f:9b:64:5d:1d:4d:96:a2:9b:fc:28:60:a7:2b:1c:b2:53:91:a4:47:56:25:78:8f:7eSigner

30:f7:c5:35:6f:c1:b2:9f:9b:64:5d:1d:4d:96:a2:9b:fc:28:60:a7:2b:1c:b2:53:91:a4:47:56:25:78:8f:7eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

iphlpapi

cfgmgr32

winhttp

api-ms-win-core-synch-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-registry-l1-1-0

ws2_32

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-util-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

crypt32

api-ms-win-core-file-l1-1-0

wintrust

api-ms-win-security-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-io-l1-1-1

0a:de:81:14:d7:67:9b:06:6f:2d:b2:df:d2:f6:7a:c2
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

30:f7:c5:35:6f:c1:b2:9f:9b:64:5d:1d:4d:96:a2:9b:fc:28:60:a7:2b:1c:b2:53:91:a4:47:56:25:78:8f:7e
Signer

30:f7:c5:35:6f:c1:b2:9f:9b:64:5d:1d:4d:96:a2:9b:fc:28:60:a7:2b:1c:b2:53:91:a4:47:56:25:78:8f:7e
Signer

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 892KB - Virtual size: 892KB

.data
Size: 189KB - Virtual size: 216KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 35KB - Virtual size: 35KB

.reloc
Size: 232KB - Virtual size: 232KB