2024-05-23_7a063a31edb90f782012dee4f2425678_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-23_7a063a31edb90f782012dee4f2425678_mafia
Size

3.2MB
MD5

7a063a31edb90f782012dee4f2425678
SHA1

cc822f98e61b8e1b79fafb722c31cffd786152ff
SHA256

0a67abab8b96fa81ebfd7fe6c179b7067dcd4a520c20221dfa9d70202cc27c56
SHA512

f20244c3320dc49c7b6232c030f3ee99ca2f1c1956c05b711458b514c9f8201bd66ff9cd8cbae50e78fd8774f5bb88ebb411abf6b21f1bd928846d3521967fd0
SSDEEP

98304:+D2CrC2cFGNKkq7iTcDEkelIFjxr/aS9SJrXe5/7HG8/FEVmBWrP:k2CrC2c7Es/oJ65lEVmBCP

Score

1^/10

Malware Config

Signatures

Files

2024-05-23_7a063a31edb90f782012dee4f2425678_mafia
.exe windows:5 windows x86 arch:x86

61bbce14ed6450157d97a4181b86eba5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

05:cb:98:64:e8:ab:65:ca:03:41:62:a3:02:2c:79:6b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

22-04-2016 00:00

Not After

30-12-2018 23:59

Subject

CN=SGA Co.\,LTD,OU=IT Team,O=SGA Co.\,LTD,L=Seocho-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d6:d1:f0:d3:bb:f5:14:02:92:e5:cb:79:dd:1e:31:66:52:f8:5d:c4
Signer

Actual PE Digest

d6:d1:f0:d3:bb:f5:14:02:92:e5:cb:79:dd:1e:31:66:52:f8:5d:c4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\_SVN\vc90\VCMS_WS\Build\mvcms.pdb

Imports

kernel32

GetFileType
SetStdHandle
HeapSize
HeapQueryInformation
HeapReAlloc
GetSystemInfo
VirtualAlloc
GetStartupInfoW
UnhandledExceptionFilter
GetStdHandle
FindFirstFileExA
GetDriveTypeA
ExitThread
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
HeapCreate
HeapSetInformation
HeapDestroy
SetHandleCount
GetConsoleCP
GetConsoleMode
GetDriveTypeW
LCMapStringW
FatalAppExitA
SetConsoleCtrlHandler
GetLocaleInfoW
PeekNamedPipe
GetCurrentDirectoryW
SetCurrentDirectoryW
GetTimeZoneInformation
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
CompareStringW
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
CreateFileW
SetEnvironmentVariableA
LocalLock
LocalUnlock
FindResourceExW
GetDiskFreeSpaceA
ReplaceFileA
GetUserDefaultLCID
VirtualProtect
SearchPathA
GetProfileIntA
GetNumberFormatA
GetSystemDirectoryW
GetOEMCP
GetCPInfo
GetACP
GetUserDefaultUILanguage
ConvertDefaultLocale
GetLocaleInfoA
LoadLibraryExA
FindResourceA
FreeResource
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryW
lstrcmpW
GlobalFlags
GlobalAddAtomA
SuspendThread
GetFileSizeEx
GetFileAttributesExA
SetErrorMode
lstrcmpA
GetAtomNameA
GlobalGetAtomNameA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetModuleHandleW
CompareStringA
GetShortPathNameA
GetFullPathNameA
DuplicateHandle
SetEndOfFile
lstrcmpiA
GetThreadLocale
GetStringTypeExA
GetModuleFileNameW
ActivateActCtx
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
GlobalFree
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
lstrlenW
MulDiv
GetFileInformationByHandle
SetFileTime
LocalFileTimeToFileTime
GetCurrentDirectoryA
InterlockedExchange
VirtualQuery
FormatMessageA
LocalAlloc
GetProcessHeap
HeapAlloc
HeapFree
DeviceIoControl
ReleaseMutex
UnlockFile
LockFile
ExitProcess
SetLastError
CreateProcessA
FlushFileBuffers
CreateSemaphoreA
SetNamedPipeHandleState
CreateNamedPipeA
GetModuleHandleA
FileTimeToLocalFileTime
GetCurrentThread
TerminateProcess
GetWindowsDirectoryA
GetLongPathNameA
ProcessIdToSessionId
GetFileTime
GetVolumeInformationA
GetVersionExA
GetSystemDefaultUILanguage
OutputDebugStringA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetTickCount
OpenProcess
SetProcessWorkingSetSize
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
CompareFileTime
ReleaseSemaphore
InterlockedDecrement
SetEvent
InterlockedIncrement
InitializeCriticalSectionAndSpinCount
CreateMutexA
SetUnhandledExceptionFilter
LoadResource
LockResource
SizeofResource
FindResourceW
CreateEventA
GetFileAttributesA
GetTempPathA
GetTempFileNameA
RemoveDirectoryA
SetFilePointer
SetFileAttributesA
MoveFileA
MoveFileExA
ResetEvent
GetDateFormatA
GetTimeFormatA
WriteFile
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetFileSize
SetThreadPriority
ResumeThread
WaitForMultipleObjects
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
lstrlenA
lstrcpyA
CreateThread
GetExitCodeThread
TerminateThread
WaitForSingleObject
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
DeleteFileA
FindFirstFileA
CreateDirectoryA
FindClose
CopyFileA
FindNextFileA
Sleep
ReadFile
GetLastError
LoadLibraryA
GetProcAddress
GetLocalTime
GetModuleFileNameA
CreateFileA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CloseHandle
GetCommandLineA

user32

InvalidateRect
DeleteMenu
ShowOwnedPopups
SetCursor
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
CopyImage
SystemParametersInfoA
DestroyMenu
GetMenuItemInfoA
IntersectRect
InflateRect
PostQuitMessage
IsIconic
RegisterWindowMessageA
LoadIconW
LoadIconA
WinHelpA
IsChild
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
SetScrollRange
GetKeyboardState
LoadAcceleratorsW
DispatchMessageA
TranslateMessage
PeekMessageA
GetScrollRange
SetForegroundWindow
ShowScrollBar
RedrawWindow
UpdateWindow
GetClientRect
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
DefWindowProcA
CallWindowProcA
GetMenu
CreateAcceleratorTableA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuA
GetMenuDefaultItem
CheckMenuItem
EndPaint
BeginPaint
SetTimer
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
SetWindowPos
ScrollWindowEx
ShowWindow
MoveWindow
SetWindowLongA
IsWindow
IsDialogMessageA
CreatePopupMenu
IsRectEmpty
MapVirtualKeyA
SetCapture
ReleaseCapture
GetKeyboardLayout
InvertRect
DrawFocusRect
HideCaret
EnableScrollBar
NotifyWinEvent
MessageBeep
OffsetRect
GetIconInfo
GetAsyncKeyState
wsprintfA
GetDesktopWindow
RemoveMenu
GetSubMenu
GetMenuItemCount
InsertMenuA
GetMenuItemID
AppendMenuA
GetMenuStringA
GetMenuState
UnhookWindowsHookEx
GetSystemMetrics
CharUpperA
MessageBoxA
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetParent
SendMessageA
GetWindowThreadProcessId
GetSysColorBrush
GetSysColor
ReleaseDC
GetDC
LoadCursorA
GetWindowTextA
GetWindowTextLengthA
UnregisterClassA
ValidateRect
GetCursorPos
GetKeyState
IsWindowVisible
GetActiveWindow
GetMessageA
CallNextHookEx
SetWindowsHookExA
DestroyIcon
SetWindowTextA
PtInRect
GetClassNameA
GetWindowRect
GetDlgCtrlID
GetWindow
ClientToScreen
RealChildWindowFromPoint
GetFocus
SetRect
SetCursorPos
BringWindowToTop
LockWindowUpdate
GetWindowDC
KillTimer
GetDialogBaseUnits
GetKeyNameTextA
OpenClipboard
LoadImageA
GetNextDlgGroupItem
DrawIconEx
IsZoomed
SetWindowRgn
SetFocus
SetScrollPos
SetParent
DestroyAcceleratorTable
WindowFromPoint
SetClassLongA
LoadMenuW
GetSystemMenu
DrawStateA
DrawEdge
DrawFrameControl
CopyAcceleratorTableA
ToAsciiEx
EnableMenuItem
GetScrollPos
SetClipboardData
CloseClipboard
EmptyClipboard
LoadImageW
IsCharLowerA
MapVirtualKeyExA
UnionRect
UpdateLayeredWindow
MonitorFromPoint
IsMenu
TranslateAcceleratorA
InsertMenuItemA
LoadAcceleratorsA
GetMenuBarInfo
LoadMenuA
ReuseDDElParam
UnpackDDElParam
PostThreadMessageA
WaitMessage
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
InSendMessage
CreateMenu
SetMenuDefaultItem
IsClipboardFormatAvailable
SendNotifyMessageA
FrameRect
GetUpdateRect
RegisterClipboardFormatA
CopyIcon
CharUpperBuffA
GetDoubleClickTime
SubtractRect
EnumChildWindows
MapDialogRect
DrawIcon
DestroyCursor
WindowFromDC
GetWindowRgn
GetDCEx
GetTabbedTextExtentW
GetTabbedTextExtentA
CopyRect
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
SendDlgItemMessageA
GetDlgItemTextA
GetDlgItemInt
GetDlgItem
CheckRadioButton
CheckDlgButton

gdi32

ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
CreateBitmap
CreateCompatibleDC
GetStockObject
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreateFontIndirectA
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
GetTextExtentPoint32A
CreateDIBitmap
CreateCompatibleBitmap
GetTextMetricsA
EnumFontFamiliesA
GetTextCharsetInfo
GetBkColor
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
GetCharWidthA
CreateFontA
StretchDIBits
GetCurrentObject
GetCurrentPositionEx
CreateRoundRectRgn
CreatePolygonRgn
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
SetDIBColorTable
GetDIBits
StretchBlt
SetPixel
Rectangle
OffsetRgn
GetRgnBox
EnumFontFamiliesExA
RoundRect
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceA
GetTextExtentPointA
GetTextExtentPoint32W
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
SetWindowExtEx
ScaleWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
StartDocA
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetLayout
GetLayout
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetTextColor
SetStretchBltMode
GetDeviceCaps
CopyMetaFileA
CreateDCA
DeleteObject
SaveDC
RestoreDC
SetBkColor
SetBkMode
SetPolyFillMode
CreateDIBSection
GetObjectA
SetROP2

winspool.drv

GetJobA
OpenPrinterA
DocumentPropertiesA
ClosePrinter

comdlg32

GetFileTitleA

advapi32

OpenSCManagerA
RegOpenKeyA
RegCloseKey
RegEnumValueA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA
GetFileSecurityA
SetFileSecurityA
RegEnumKeyA
RegQueryValueA
RegDeleteKeyA
RegOpenKeyExW
RegSetValueA
DeleteService
CreateServiceA
ChangeServiceConfig2A
ControlService
StartServiceA
LockServiceDatabase
UnlockServiceDatabase
SetServiceStatus
RegCreateKeyA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
RegisterServiceCtrlHandlerExA
StartServiceCtrlDispatcherA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenThreadToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
LookupAccountSidA
RegNotifyChangeKeyValue
RegDeleteValueA
RegCreateKeyExA

shell32

ShellExecuteA
SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA
DragQueryFileA
SHAppBarMessage
ShellExecuteExA
SHGetDesktopFolder
SHAddToRecentDocs
ExtractIconA
SHGetSpecialFolderLocation
DragFinish
SHGetFileInfoA

ole32

OleSetContainedObject
OleCreateFromFile
OleCreateLinkToFile
OleGetIconOfClass
CreateItemMoniker
CreateGenericComposite
OleRegEnumVerbs
OleRegGetMiscStatus
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleQueryCreateFromData
OleQueryLinkFromData
OleIsRunning
GetRunningObjectTable
CoGetMalloc
CreateOleAdviseHolder
CreateDataAdviseHolder
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoGetClassObject
CoRegisterClassObject
CoRevokeClassObject
OleLoad
OleCreate
OleCreateStaticFromData
OleCreateLinkFromData
CoRegisterMessageFilter
CLSIDFromProgID
OleCreateFromData
OleSaveToStream
WriteClassStm
OleSave
PropVariantCopy
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleSetMenuDescriptor
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
StgIsStorageFile
StgOpenStorage
CreateFileMoniker
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfile
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateGuid
CLSIDFromString
CoDisconnectObject
StringFromGUID2
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoCreateInstance
OleRun
CoInitializeEx
GetHGlobalFromILockBytes
StgCreateDocfileOnILockBytes

oleaut32

SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayRedim
VarDateFromStr
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantCopy
SysFreeString
VariantChangeType
VariantInit
SysAllocString
VariantClear
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromDate
SafeArrayCreate
CreateErrorInfo
GetErrorInfo
SetErrorInfo

msimg32

TransparentBlt
AlphaBlend

comctl32

ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Create
ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_Remove
ImageList_DrawEx

shlwapi

PathRemoveFileSpecW
PathRemoveExtensionA
PathFindExtensionA
PathFindFileNameA
PathIsUNCA
PathStripToRootA
SHDeleteKeyA
StrToIntA
StrTrimA
PathRemoveFileSpecA
PathFileExistsA

oledlg

ord8

urlmon

URLDownloadToFileA

wininet

DeleteUrlCacheEntry

ws2_32

WSAStartup
bind
listen
accept
WSASocketA
connect
htons
gethostbyname
closesocket
inet_addr
setsockopt
recv
__WSAFDIsSet
select
send
WSAGetLastError
socket
WSACleanup
ntohs
ntohl
htonl
inet_ntoa

iphlpapi

GetAdaptersInfo

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameA
GetProcessMemoryInfo

netapi32

NetWkstaGetInfo
NetApiBufferFree

sensapi

IsNetworkAlive

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

gdiplus

GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromFileICM
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageGraphicsContext
GdipDrawImageI
GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipCloneImage

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundA

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 570KB - Virtual size: 570KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61bbce14ed6450157d97a4181b86eba5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

05:cb:98:64:e8:ab:65:ca:03:41:62:a3:02:2c:79:6bCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

d6:d1:f0:d3:bb:f5:14:02:92:e5:cb:79:dd:1e:31:66:52:f8:5d:c4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

msimg32

comctl32

shlwapi

oledlg

urlmon

wininet

ws2_32

iphlpapi

version

psapi

netapi32

sensapi

oleacc

gdiplus

imm32

winmm

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 570KB - Virtual size: 570KB

.data Size: 36KB - Virtual size: 90KB

.rsrc Size: 15KB - Virtual size: 15KB

.reloc Size: 181KB - Virtual size: 180KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

05:cb:98:64:e8:ab:65:ca:03:41:62:a3:02:2c:79:6b
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

d6:d1:f0:d3:bb:f5:14:02:92:e5:cb:79:dd:1e:31:66:52:f8:5d:c4
Signer

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 570KB - Virtual size: 570KB

.data
Size: 36KB - Virtual size: 90KB

.rsrc
Size: 15KB - Virtual size: 15KB

.reloc
Size: 181KB - Virtual size: 180KB