193525d3de3244d3f88c094a02f7be4c2cf54652a61b82f03e97ecce40db3a87

Sharing

Copy URL Twitter E-mail

General

Target

193525d3de3244d3f88c094a02f7be4c2cf54652a61b82f03e97ecce40db3a87
Size

475KB
MD5

13de32016225096b2e24b07f244e34c9
SHA1

2f07c1d6ba52f4b4c6630e2729c119183561d7ed
SHA256

193525d3de3244d3f88c094a02f7be4c2cf54652a61b82f03e97ecce40db3a87
SHA512

d9efdc7adec46b8020d82121bf9f7eae307ec85e542c65bd29aa64fb03bb9a7dc0cd1360e78014f2ef412d019f33d9baa19204f379c882c155ab2cd195b05003
SSDEEP

6144:RkA9YuwySRzQJ81B3SzbTBSK90wCtYCDFqqD/tQ+1LCOTNOvPME47h:f9YuwzC81BCrBbza6qrtQ+tCQ

Score

1^/10

Malware Config

Signatures

Files

193525d3de3244d3f88c094a02f7be4c2cf54652a61b82f03e97ecce40db3a87
.exe windows:5 windows x86 arch:x86

ef50078cfbb2751a421d28890a6f2a7c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0c:ff:7b:32:9c:ff:7f:3b:8d:2d:54:2a:b2:58:26:ba
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/09/2013, 00:00

Not After

23/06/2015, 23:59

Subject

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Operate,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:aa:8f:79:0b:42:71:04:a2:44:01:16:5c:82:a0:b9:c6:4b:e5:33
Signer

Actual PE Digest

75:aa:8f:79:0b:42:71:04:a2:44:01:16:5c:82:a0:b9:c6:4b:e5:33

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\xl_framework\win32_component\LiveUpdate\XLLiveUD\release\XLLiveUD.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

ws2_32

htons
inet_addr
getpeername
ntohs
closesocket
WSACancelAsyncRequest
WSAAsyncSelect
htonl
ntohl
recv
WSAGetLastError
gethostbyname
send
connect
socket
WSACleanup
WSAStartup
getsockname
WSAAsyncGetHostByName

libexpat

ord50
ord35
ord20
ord25
ord21
ord16
ord52
ord48

xlluaruntime

XLLRT_CreateChunkFromFile
XLLRT_DestroyEnv
XLLRT_DestroyRunTime
XLLRT_ReleaseChunk
XLLRT_RunChunk
lua_pushboolean
XLLRT_CreateChunk
XLLRT_GetLuaState
XLLRT_CreateRunTime
XLLRT_CreateEnv
XLLRT_ErrorHandle
lua_pushstring
lua_tolstring
luaL_checklstring
lua_tonumber
lua_tointeger
luaL_checkinteger
lua_toboolean
lua_pushvalue
lua_type
XLLRT_RegisterGlobalObj
lua_gettop
luaL_ref
XLLRT_LuaCall
luaL_unref
lua_rawgeti
lua_touserdata
lua_error
XLLRT_GetEnv
luaL_checkudata
lua_isstring
lua_isnumber
XLLRT_RegisterClass
XLLRT_PushXLObject
lua_pushlstring
lua_pushnumber
lua_next
lua_settable
lua_pushnil
lua_pushinteger
lua_createtable
lua_settop
lua_setfield
XLLRT_PrepareChunk
lua_pushlightuserdata

xlgraphic

XL_SetFreeTypeEnabled
XL_InitGraphicLib
XL_PrepareGraphicParam
XL_UnInitGraphicLib

xlue

XLUE_InitLoader
XLUE_LoadXAR
XLUE_AddXARSearchPath
XLUE_UninitLuaHost
XLUE_Uninit
XLUE_UninitHandleMap

xlbughandler

_XL_InitBugHandler@20
_XL_SetPeerID@4
_XL_SetBugReportRootDir@4
_XL_SetReportShowMode@4

imm32

ImmDisableIME

xlstat

XLSTAT_Uninit
XLSTAT_Init
XLSTAT_SyncSendAllStat
XLSTAT_RegisterClass
XLSTAT_AddStat

kernel32

HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapDestroy
HeapReAlloc
HeapSize
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetVersionExA
SetPriorityClass
GetDiskFreeSpaceExW
DeviceIoControl
lstrcpyA
GetFileAttributesA
CreateDirectoryA
lstrcatA
GetModuleFileNameA
GetSystemDirectoryA
GetVolumeInformationA
GetPrivateProfileStringA
VerifyVersionInfoW
VerSetConditionMask
GetExitCodeProcess
LocalFree
GetVersion
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetLocalTime
GetVersionExW
GetCurrentThread
GetFileAttributesExW
GetFileSizeEx
LoadLibraryW
MoveFileA
SetFileAttributesW
RemoveDirectoryW
SetCurrentDirectoryW
GetCurrentDirectoryW
FindFirstFileW
FindNextFileW
FindClose
MoveFileW
GetModuleHandleW
SystemTimeToFileTime
SetFileTime
CreateFileW
lstrcatW
GetFileAttributesW
CreateDirectoryW
IsBadCodePtr
VirtualQuery
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
WriteFile
ReadFile
GetSystemInfo
GetExitCodeThread
GetQueuedCompletionStatus
GetVolumeInformationW
CreateFileA
PostQueuedCompletionStatus
SetThreadPriority
CreateIoCompletionPort
lstrcpynW
lstrlenW
MapViewOfFile
GetCurrentThreadId
InterlockedCompareExchange
InterlockedExchange
LoadLibraryA
GetProcAddress
FreeLibrary
InterlockedIncrement
InterlockedDecrement
CreateEventW
CloseHandle
WaitForSingleObject
CreateMutexW
GetLastError
SetEvent
ResetEvent
DeleteFileW
OpenProcess
TerminateProcess
Sleep
MoveFileExW
CopyFileW
GetCurrentProcess
GetTempPathW
RaiseException
OpenFileMappingW
CreateFileMappingW
OpenEventW
EnterCriticalSection
LeaveCriticalSection
GetTickCount
FlushInstructionCache
SetLastError
ResumeThread
WaitForMultipleObjects
GetCurrentProcessId
InitializeCriticalSection
DeleteCriticalSection
WritePrivateProfileStringA

user32

GetWindowThreadProcessId
GetParent
GetAncestor
WindowFromPoint
GetSystemMetrics
GetWindowTextW
GetForegroundWindow
wsprintfW
KillTimer
SetTimer
PostMessageW
DestroyIcon
LoadImageW
IsWindow
DestroyWindow
CallWindowProcW
CreateWindowExW
DefWindowProcW
GetWindowLongW
SetWindowLongW
LoadCursorW
GetClassInfoExW
RegisterClassExW
SendMessageW
GetDesktopWindow
PeekMessageW
RegisterWindowMessageW
DispatchMessageW
TranslateMessage
GetMessageW
PostThreadMessageW
MessageBoxW
PostQuitMessage
UnregisterClassA

advapi32

SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetAce
GetAclInformation
AddAce
InitializeAcl
EqualSid
IsValidSid
GetLengthSid
CopySid
GetSidSubAuthority
GetSidLengthRequired
InitializeSid
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetTokenInformation
CheckTokenMembership
DuplicateToken
OpenProcessToken
OpenThreadToken
AllocateAndInitializeSid
FreeSid

shell32

ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHGetSpecialFolderPathA

msvcp90

?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0strstreambuf@std@@QAE@PBDH@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??1strstreambuf@std@@UAE@XZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?length@?$char_traits@D@std@@SAIPBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IID@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@D@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??$?5DU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAD@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z

shlwapi

PathFileExistsW
PathAppendW
PathCombineW

msvcr90

??3@YAXPAX@Z
getc
fwprintf
toupper
strstr
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__set_app_type
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??_V@YAXPAX@Z
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
memmove_s
_vswprintf
_stricmp
_invalid_parameter_noinfo
_snprintf
malloc
free
atoi
_wtoi
_beginthreadex
__wargv
sprintf
swprintf_s
fwrite
_wfopen
fclose
feof
fread
_purecall
__argc
atol
memcpy_s
_itoa
_time64
srand
rand
_recalloc
vswprintf_s
ldiv
memset
_swprintf
swscanf
memcpy
ferror
wcsrchr
__CxxFrameHandler3
wcschr
memcmp
_CxxThrowException
sprintf_s
_gmtime64
strftime
_wstat64i32
strcmp
sscanf
_atoi64
_wcsicmp
fseek
strncpy
_strnicmp
strlen
strncmp
_ultow
_ui64toa
_ui64tow
_wtoi64
tolower
wcsncat
calloc
isprint
isspace
isalnum
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
fgetwc

userenv

UnloadUserProfile

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 183KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ef50078cfbb2751a421d28890a6f2a7c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

0c:ff:7b:32:9c:ff:7f:3b:8d:2d:54:2a:b2:58:26:baCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

75:aa:8f:79:0b:42:71:04:a2:44:01:16:5c:82:a0:b9:c6:4b:e5:33Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

ws2_32

libexpat

xlluaruntime

xlgraphic

xlue

xlbughandler

imm32

xlstat

kernel32

user32

advapi32

shell32

msvcp90

shlwapi

msvcr90

userenv

iphlpapi

Sections

.text Size: 203KB - Virtual size: 202KB

.rdata Size: 67KB - Virtual size: 66KB

.data Size: 6KB - Virtual size: 8KB

.rsrc Size: 14KB - Virtual size: 14KB

.reloc Size: 183KB - Virtual size: 198KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0c:ff:7b:32:9c:ff:7f:3b:8d:2d:54:2a:b2:58:26:ba
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

75:aa:8f:79:0b:42:71:04:a2:44:01:16:5c:82:a0:b9:c6:4b:e5:33
Signer

.text
Size: 203KB - Virtual size: 202KB

.rdata
Size: 67KB - Virtual size: 66KB

.data
Size: 6KB - Virtual size: 8KB

.rsrc
Size: 14KB - Virtual size: 14KB

.reloc
Size: 183KB - Virtual size: 198KB