OptiCraft[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

OptiCraft.exe
Size

85.3MB
MD5

a98740375ae832edca8a590a3dec6acc
SHA1

d8ffbf2e42503178e365a4eea99209fb97b142e7
SHA256

c54be6e7db8f173e7e7a54bdffd507e4fd4adb9949e28366aae17a948459b78f
SHA512

75fe59ee873ac50fc520f1c9ac142cc43212616a3f3b1550bea921c9a3572f04762e7e52eb3f170d4e54d4dcd17386d284cf704d86891f08d330912728dd28b1
SSDEEP

786432:957aNogGIT/xl81YGbJOuOobX+FlZ/9gjPg+X9M7KJBMa6JKv/tI:957pIT0OVoYP/9gj48MKBMa6A/a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OptiCraft.exe

Files

OptiCraft.exe
.exe windows:6 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Exports

Exports

??0_http_request@details@http@web@@QAE@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0_http_request@details@http@web@@QAE@V?$unique_ptr@V_http_server_context@details@http@web@@U?$default_delete@V_http_server_context@details@http@web@@@std@@@std@@@Z
??0http_client@client@http@web@@QAE@ABVuri@3@@Z
??0http_client@client@http@web@@QAE@ABVuri@3@ABVhttp_client_config@123@@Z
??0http_msg_base@details@http@web@@QAE@XZ
??0scoped_c_thread_locale@details@utility@@QAE@XZ
??0stream_compressor@compression@details@http@web@@QAE@W4compression_algorithm@1234@@Z
??0stream_decompressor@compression@details@http@web@@QAE@W4compression_algorithm@1234@@Z
??0uri@web@@AAE@ABUuri_components@details@1@@Z
??0uri@web@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0uri@web@@QAE@PB_W@Z
??0value@json@web@@QAE@$$QAV012@@Z
??0value@json@web@@QAE@ABV012@@Z
??0value@json@web@@QAE@H@Z
??0value@json@web@@QAE@I@Z
??0value@json@web@@QAE@N@Z
??0value@json@web@@QAE@PB_W@Z
??0value@json@web@@QAE@PB_W_N@Z
??0value@json@web@@QAE@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0value@json@web@@QAE@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
??0value@json@web@@QAE@XZ
??0value@json@web@@QAE@_J@Z
??0value@json@web@@QAE@_K@Z
??0value@json@web@@QAE@_N@Z
??0win32_encryption@details@web@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??1http_client@client@http@web@@QAE@XZ
??1scoped_c_thread_locale@details@utility@@QAE@XZ
??1win32_encryption@details@web@@QAE@XZ
??4value@json@web@@QAEAAV012@$$QAV012@@Z
??4value@json@web@@QAEAAV012@ABV012@@Z
??5json@web@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AAV23@AAVvalue@01@@Z
??6json@web@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@AAV23@ABVvalue@01@@Z
??8uri@web@@QBE_NABV01@@Z
??8value@json@web@@QBE_NABV012@@Z
??Avalue@json@web@@AAEAAV012@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??Avalue@json@web@@QAEAAV012@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??Avalue@json@web@@QAEAAV012@I@Z
??Rzero_memory_deleter@details@web@@QBEXPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?CONNECT@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?DEL@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?GET@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?HEAD@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?HTTP_0_9@http_versions@http@web@@2Uhttp_version@23@B
?HTTP_1_0@http_versions@http@web@@2Uhttp_version@23@B
?HTTP_1_1@http_versions@http@web@@2Uhttp_version@23@B
?MERGE@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?OPTIONS@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?PATCH@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?POST@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?PUT@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?TRCE@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?_authenticate_request@oauth1_config@experimental@oauth1@http@web@@AAEXAAVhttp_request@45@Voauth1_state@details@345@@Z
?_build_signature_base_string@oauth1_config@experimental@oauth1@http@web@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vhttp_request@45@Voauth1_state@details@345@@Z
?_complete@http_msg_base@details@http@web@@UAEX_KABVexception_ptr@std@@@Z
?_extract_json@http_msg_base@details@http@web@@QAE?AVvalue@json@4@_N@Z
?_extract_vector@http_msg_base@details@http@web@@QAE?AV?$vector@EV?$allocator@E@std@@@std@@XZ
?_get_content_length@http_msg_base@details@http@web@@QAEIXZ
?_hmac_sha1@oauth1_config@experimental@oauth1@http@web@@CA?AV?$vector@EV?$allocator@E@std@@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@7@0@Z
?_prepare_to_receive_data@http_msg_base@details@http@web@@QAEXXZ
?_request_token@oauth1_config@experimental@oauth1@http@web@@AAE?AV?$task@X@Concurrency@@Voauth1_state@details@345@_N@Z
?absolute_uri@_http_request@details@http@web@@QBE?AVuri@4@XZ
?accept@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?accept_charset@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?accept_encoding@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?accept_language@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?accept_ranges@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?access_control_allow_origin@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?add_chunked_delimiters@chunked_encoding@details@http@web@@YAIPAEII@Z
?add_handler@http_client@client@http@web@@QAEXABV?$function@$$A6A?AV?$task@Vhttp_response@http@web@@@Concurrency@@Vhttp_request@http@web@@V?$shared_ptr@Vhttp_pipeline_stage@http@web@@@std@@@Z@std@@@Z
?add_handler@http_client@client@http@web@@QAEXABV?$shared_ptr@Vhttp_pipeline_stage@http@web@@@std@@@Z
?age@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?allow@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?append@uri_builder@web@@QAEAAV12@ABVuri@2@@Z
?append_path@uri_builder@web@@QAEAAV12@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?append_query@uri_builder@web@@QAEAAV12@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?append_query_encode_impl@uri_builder@web@@AAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?append_query_no_encode_impl@uri_builder@web@@AAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?application_atom_xml@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?application_http@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?application_javascript@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?application_json@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?application_octetstream@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?application_x_www_form_urlencoded@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?application_xjavascript@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?application_xjson@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?application_xml@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?array@value@json@web@@SA?AV123@I@Z
?array@value@json@web@@SA?AV123@V?$vector@Vvalue@json@web@@V?$allocator@Vvalue@json@web@@@std@@@std@@@Z
?array@value@json@web@@SA?AV123@XZ
?as_array@value@json@web@@QAEAAVarray@23@XZ
?as_array@value@json@web@@QBEABVarray@23@XZ
?as_bool@value@json@web@@QBE_NXZ
?as_double@value@json@web@@QBENXZ
?as_integer@value@json@web@@QBEHXZ
?as_number@value@json@web@@QBEABVnumber@23@XZ
?as_object@value@json@web@@QAEAAVobject@23@XZ
?as_object@value@json@web@@QBEABVobject@23@XZ
?as_string@value@json@web@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?ascii@charset_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?at@value@json@web@@QAEAAV123@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QAEAAV123@I@Z
?at@value@json@web@@QBEABV123@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QBEABV123@I@Z
?authority@uri@web@@QBE?AV12@XZ
?authorization@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?base_uri@http_client@client@http@web@@QBEABVuri@4@XZ
?boolean@value@json@web@@SA?AV123@_N@Z
?boundary@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?build_authorization_uri@oauth1_config@experimental@oauth1@http@web@@QAE?AV?$task@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Concurrency@@XZ
?c_locale@scoped_c_thread_locale@details@utility@@SAPAU__crt_locale_pointers@@XZ
?cache_control@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?cache_control@http_headers@http@web@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?callback@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?callback_confirmed@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?client_config@http_client@client@http@web@@QBEABVhttp_client_config@234@XZ
?compress@stream_compressor@compression@details@http@web@@QAE?AV?$vector@EV?$allocator@E@std@@@std@@ABV67@_N@Z
?compress@stream_compressor@compression@details@http@web@@QAE?AV?$vector@EV?$allocator@E@std@@@std@@PBEI_N@Z
?connection@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?consumer_key@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?content_disposition@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?content_encoding@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?content_language@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?content_length@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?content_length@http_headers@http@web@@QBE_KXZ
?content_location@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?content_md5@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?content_range@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?content_type@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?content_type@http_headers@http@web@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?date@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?date@http_headers@http@web@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?decode@uri@web@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z
?decompress@stream_decompressor@compression@details@http@web@@QAE?AV?$vector@EV?$allocator@E@std@@@std@@ABV67@@Z
?decompress@stream_decompressor@compression@details@http@web@@QAE?AV?$vector@EV?$allocator@E@std@@@std@@PBEI@Z
?decrypt@win32_encryption@details@web@@QBE?AV?$unique_ptr@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vzero_memory_deleter@details@web@@@std@@XZ
?encode_data_string@uri@web@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z
?encode_uri@uri@web@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@W4component@components@12@@Z
?erase@value@json@web@@QAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?erase@value@json@web@@QAEXI@Z
?etag@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?expect@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?expires@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?extract_string@http_msg_base@details@http@web@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?extract_utf16string@http_msg_base@details@http@web@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?extract_utf8string@http_msg_base@details@http@web@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?form_data@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?format@value@json@web@@ABEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?format@value@json@web@@ABEXAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?from@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?from_base64@conversions@utility@@YA?AV?$vector@EV?$allocator@E@std@@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?from_string@datetime@utility@@SA?AV12@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?from_string@http_version@http@web@@SA?AU123@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?generate@nonce_generator@utility@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?has_array_field@value@json@web@@QBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_boolean_field@value@json@web@@QBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_double_field@value@json@web@@QBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_error@stream_compressor@compression@details@http@web@@QBE_NXZ
?has_error@stream_decompressor@compression@details@http@web@@QBE_NXZ
?has_integer_field@value@json@web@@QBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_number_field@value@json@web@@QBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_object_field@value@json@web@@QBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?has_string_field@value@json@web@@QBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?hmac_sha1@oauth1_methods@experimental@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?host@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?if_match@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?if_modified_since@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?if_none_match@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?if_range@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?if_unmodified_since@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?is_double@value@json@web@@QBE_NXZ
?is_int32@number@json@web@@QBE_NXZ
?is_int64@number@json@web@@QBE_NXZ
?is_integer@value@json@web@@QBE_NXZ
?is_supported@stream_compressor@compression@details@http@web@@SA_NXZ
?is_supported@stream_decompressor@compression@details@http@web@@SA_NXZ
?is_uint32@number@json@web@@QBE_NXZ
?is_valid@uri_builder@web@@QAE_NXZ
?join@uri_components@details@web@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?keep_object_element_order@json@web@@YAX_N@Z
?last_modified@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?latin1@charset_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?latin1_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?latin1_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?location@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?max_forwards@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?message_http@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?multipart_form_data@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?nonce@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?null@value@json@web@@SA?AV123@XZ
?number@value@json@web@@SA?AV123@H@Z
?number@value@json@web@@SA?AV123@I@Z
?number@value@json@web@@SA?AV123@N@Z
?number@value@json@web@@SA?AV123@_J@Z
?number@value@json@web@@SA?AV123@_K@Z
?object@value@json@web@@SA?AV123@V?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@Vvalue@json@web@@@std@@@2@@std@@_N@Z
?object@value@json@web@@SA?AV123@_N@Z
?parse@value@json@web@@SA?AV123@AAV?$basic_istream@DU?$char_traits@D@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AAV?$basic_istream@DU?$char_traits@D@std@@@std@@AAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@AAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@@Z
?parse@value@json@web@@SA?AV123@AAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@AAVerror_code@5@@Z
?parse@value@json@web@@SA?AV123@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?parse@value@json@web@@SA?AV123@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAVerror_code@5@@Z
?plaintext@oauth1_methods@experimental@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?platform_category@details@utility@@YAABVerror_category@std@@XZ
?pragma@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?proxy_authenticate@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?proxy_authorization@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?range@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?realm@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?referer@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?relative_uri@_http_request@details@http@web@@QBE?AVuri@4@XZ
?request@http_client@client@http@web@@QAE?AV?$task@Vhttp_response@http@web@@@Concurrency@@Vhttp_request@34@ABVcancellation_token@6@@Z
?resource@uri@web@@QBE?AV12@XZ
?retry_after@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?seconds_to_xml_duration@timespan@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$duration@_JU?$ratio@$00$00@std@@@chrono@4@@Z
?serialize@value@json@web@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?serialize@value@json@web@@QBEXAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?serialize@value@json@web@@QBEXAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@@Z
?server@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?set_body@http_msg_base@details@http@web@@QAEXABV?$basic_istream@E@streams@Concurrency@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_body@http_msg_base@details@http@web@@QAEXABV?$basic_istream@E@streams@Concurrency@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?set_body@http_msg_base@details@http@web@@QAEXABV?$basic_istream@E@streams@Concurrency@@_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_body@http_msg_base@details@http@web@@QAEXABV?$basic_istream@E@streams@Concurrency@@_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?set_cache_control@http_headers@http@web@@QAEXV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?set_content_length@http_headers@http@web@@QAEX_K@Z
?set_content_type@http_headers@http@web@@QAEXV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?set_date@http_headers@http@web@@QAEXABVdatetime@utility@@@Z
?set_port@uri_builder@web@@QAEAAV12@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?set_request_uri@_http_request@details@http@web@@QAEXABVuri@4@@Z
?signature@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?signature_method@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?split_path@uri@web@@SA?AV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?split_query@uri@web@@SA?AV?$map@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?string@value@json@web@@CA?AV123@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?system_type_to_datetime@datetime@utility@@CA_NPAX_KPAV12@@Z
?te@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?text@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?text_javascript@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?text_json@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?text_plain@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?text_plain_utf16@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?text_plain_utf16le@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?text_plain_utf8@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?text_xjavascript@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?text_xjson@mime_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?timestamp@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?to_base64@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$vector@EV?$allocator@E@std@@@4@@Z
?to_base64@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_K@Z
?to_string@_http_request@details@http@web@@UBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?to_string@_http_response@details@http@web@@UBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?to_string@datetime@utility@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4date_format@12@@Z
?to_string@http_msg_base@details@http@web@@UBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?to_string@uri_builder@web@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?to_string@value@json@web@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@$$QAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_string_t@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_uri@uri_builder@web@@QBE?AVuri@2@XZ
?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?to_utf8string@http_version@http@web@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?token@oauth1_config@experimental@oauth1@http@web@@QBEABVoauth1_token@2345@XZ
?token@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?token_from_redirected_uri@oauth1_config@experimental@oauth1@http@web@@QAE?AV?$task@X@Concurrency@@ABVuri@5@@Z
?token_secret@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?trailer@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?transfer_encoding@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?type@value@json@web@@QBE?AW4value_type@123@XZ
?upgrade@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?usascii@charset_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?usascii_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?user_agent@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?utc_now@datetime@utility@@SA?AV12@XZ
?utf16@charset_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?utf16be@charset_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?utf16le@charset_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?utf8@charset_types@details@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?utf8_to_utf16@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?validate@uri@web@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?vary@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?verifier@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?version@oauth1_strings@details@oauth1@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?via@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?warning@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?windows_category@details@utility@@YAABVerror_category@std@@XZ
?www_authenticate@header_names@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?xml_duration_to_seconds@timespan@utility@@YA?AV?$duration@_JU?$ratio@$00$00@std@@@chrono@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@@Z

Sections

Size: 62.7MB - Virtual size: 62.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

npnfwhld
Size: 22.5MB - Virtual size: 22.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ltmsvekk
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

baa93d47220682c04d92f7797d9224ce

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

comctl32

Exports

Exports

Sections

Size: 62.7MB - Virtual size: 62.7MB

.rsrc Size: 125KB - Virtual size: 125KB

.idata Size: 512B - Virtual size: 4KB

npnfwhld Size: 22.5MB - Virtual size: 22.5MB

ltmsvekk Size: 512B - Virtual size: 4KB

.rsrc
Size: 125KB - Virtual size: 125KB

.idata
Size: 512B - Virtual size: 4KB

npnfwhld
Size: 22.5MB - Virtual size: 22.5MB

ltmsvekk
Size: 512B - Virtual size: 4KB