2024-05-27_5fcce3fbdda8da53b206712056533e4c_avoslocker

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-27_5fcce3fbdda8da53b206712056533e4c_avoslocker
Size

10.5MB
MD5

5fcce3fbdda8da53b206712056533e4c
SHA1

ae97eefea7bbd9e401943e2c656dc4f4dd4edd9d
SHA256

3dcbd2846355caec1efa6008d5044615b8fbafb9a0c4e5d6f2c53fba299bed5a
SHA512

b9c4091dc5ba923d1f623e3baa46a8c5b954fd82586b7074ef8dcdf3186fff2ab35908bed04bef356f7430dc6fe15eb0cdad7949105df0ce3579db93d3f219eb
SSDEEP

196608:8ieSZqZEJ8jo5QrCBjwHuo32OC7fjdDUGfa9:Lex60eQrCHOOa9

Score

1^/10

Malware Config

Signatures

Files

2024-05-27_5fcce3fbdda8da53b206712056533e4c_avoslocker
.exe windows:6 windows x86 arch:x86

142b9820deeaada64d498ba95d8100fd

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:78:c8:e2:85:9c:24:18:0e:aa:16:a2:ef:5d:de:1c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/09/2020, 00:00

Not After

23/10/2023, 12:00

Subject

CN=NetEase Youdao Information Technology (Beijing) Co.\, Ltd.,O=NetEase Youdao Information Technology (Beijing) Co.\, Ltd.,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\TeamCity\workspace\YDProject\dict-pc\src\bin\Release\YoudaoDict.pdb

Imports

rpcrt4

RpcStringFreeW
UuidToStringW

kernel32

WritePrivateProfileStringW
Module32NextW
Module32FirstW
QueryDosDeviceW
GetLogicalDriveStringsW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
OutputDebugStringW
FreeLibraryWhenCallbackReturns
TerminateProcess
CreateThreadpoolWork
GetSystemDirectoryW
GetModuleFileNameW
DeviceIoControl
HeapFree
HeapSize
HeapReAlloc
HeapAlloc
DecodePointer
HeapDestroy
GetProcessHeap
GetPrivateProfileSectionW
FreeResource
GlobalReAlloc
InitializeConditionVariable
WakeConditionVariable
lstrcpyW
GetCurrentProcessId
WakeAllConditionVariable
GetModuleHandleW
SleepConditionVariableCS
SleepConditionVariableSRW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetFileSize
WriteFile
InitializeCriticalSectionAndSpinCount
ReadFile
CreateFileW
InitOnceBeginInitialize
InitOnceComplete
FreeLibrary
ReleaseSRWLockShared
AcquireSRWLockShared
LocalAlloc
K32GetModuleFileNameExW
K32EnumProcessModules
FlushViewOfFile
SwitchToThread
CreateFileMappingA
WideCharToMultiByte
MulDiv
GetVersionExW
SystemTimeToFileTime
SetProcessWorkingSetSize
GetPrivateProfileStringW
GetFileAttributesW
QueryPerformanceCounter
QueryPerformanceFrequency
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
RemoveDirectoryW
CreateThreadpoolTimer
GetTempPathW
SetThreadpoolTimer
CompareStringOrdinal
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
lstrcatW
lstrlenW
WinExec
SubmitThreadpoolWork
FindClose
FindNextFileW
GetSystemTime
FileTimeToSystemTime
FindFirstFileW
SetFilePointer
CreateProcessW
MoveFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateMutexW
OpenMutexW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
lstrcpynW
GetCommandLineW
LocalFree
LCMapStringEx
lstrcmpA
CompareStringEx
GetCPInfo
VirtualAlloc
GetLocaleInfoEx
GlobalFree
SetWaitableTimer
GetStringTypeW
CreateWaitableTimerW
GlobalUnlock
CancelWaitableTimer
FindResourceExW
GlobalLock
FreeLibraryAndExitThread
SetLastError
CreateEventExW
WaitForMultipleObjects
FormatMessageA
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
GlobalAlloc
QueryDepthSList
CreateDirectoryW
UnregisterWaitEx
RegisterWaitForSingleObject
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
UnregisterWait
VirtualFree
SetFileAttributesW
CopyFileW
CreateTimerQueue
ReleaseMutex
K32GetProcessImageFileNameW
OpenProcess
GetTickCount
FindFirstFileExW
DeleteFileA
TryEnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
GetTempPathA
GetTempFileNameA
GetSystemInfo
ExitProcess
lstrlenA
CreateFileA
ExitThread
ReleaseSemaphore
CreateSemaphoreA
GetDriveTypeW
GetFileInformationByHandle
GetLocalTime
GetFileType
PeekNamedPipe
CloseThreadpoolWork
GetTimeZoneInformation
SetFilePointerEx
GetCommandLineA
SetStdHandle
HeapQueryInformation
GetStdHandle
GetCurrentProcess
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
TerminateThread
VirtualProtect
VirtualQuery
LoadLibraryExA
GetCurrentThread
GetThreadTimes
GetComputerNameW
GlobalSize
FormatMessageW
FlushFileBuffers
GetFullPathNameW
GetVolumeInformationW
LockFile
SetEndOfFile
UnlockFile
OutputDebugStringA
DuplicateHandle
GetModuleHandleA
LoadLibraryExW
LoadLibraryA
lstrcmpiW
GetThreadLocale
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
EncodePointer
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomW
GlobalFindAtomW
CompareStringW
SetThreadPriority
SuspendThread
GetProfileIntW
GetPrivateProfileIntW
GetFileAttributesExW
GetFileSizeEx
GetFileTime
TlsFree
GlobalHandle
LocalReAlloc
GlobalGetAtomNameW
SetErrorMode
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
VerSetConditionMask
VerifyVersionInfoW
GetCurrentDirectoryW
GetWindowsDirectoryW
SearchPathW
GetDiskFreeSpaceW
GetTempFileNameW
GetUserDefaultLCID
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
GetStartupInfoW
Sleep
IsValidCodePage
GetACP
GetOEMCP
IsValidLocale
EnumSystemLocalesW
GetDateFormatW
ResumeThread
GetTimeFormatW
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionEx
RaiseException
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetLastError
DeleteCriticalSection
CloseHandle
CreateThread
WaitForSingleObject
CreateEventW
GetCurrentThreadId
SetEvent
SetCurrentDirectoryW
GetDiskFreeSpaceA
GetFileAttributesA
SetEnvironmentVariableW
DeleteFileW
GetPrivateProfileSectionNamesW
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
GetFullPathNameA
GetProcAddress
LoadLibraryW
LockFileEx
GetModuleHandleExW
AreFileApisANSI

advapi32

CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
InitializeSecurityDescriptor
InitializeAcl
LookupAccountNameW
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegQueryValueW
RegEnumKeyExW
RegEnumValueW
RegEnumKeyW
CryptEncrypt
RegDeleteValueW
RegDeleteKeyW

shlwapi

PathFindExtensionW
PathRemoveExtensionW
PathRemoveFileSpecW
StrFormatKBSizeW
PathFindFileNameW
PathStripToRootW
PathIsDirectoryW
PathIsUNCW
PathFileExistsW

user32

DestroyIcon
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
CharNextW
UnionRect
EnableScrollBar
SetMenuDefaultItem
GetMenuDefaultItem
NotifyWinEvent
DeleteMenu
EnumDisplayMonitors
RealChildWindowFromPoint
SendDlgItemMessageA
CopyImage
GetMenuItemInfoW
DestroyMenu
LoadMenuW
GetKeyNameTextW
ShowOwnedPopups
MapDialogRect
SetWindowContextHelpId
DrawStateW
SetRectEmpty
GetWindowDC
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
WaitMessage
IsDialogMessageW
SetWindowTextW
IsWindowEnabled
CheckDlgButton
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
WinHelpW
SetScrollInfo
GetLastActivePopup
GetClassLongW
AdjustWindowRectEx
RemovePropW
GetPropW
SetPropW
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
EndPaint
BeginPaint
TrackPopupMenu
SetMenu
GetMenu
GetDlgCtrlID
GetDlgItem
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
IsMenu
GetClassInfoExW
RegisterClassW
GetMessageTime
CharUpperW
RemoveMenu
AppendMenuW
GetSubMenu
GetMenuState
GetMenuStringW
EnumClipboardFormats
GetShellWindow
GetDesktopWindow
GetScrollBarInfo
WaitForInputIdle
LoadBitmapW
GetScrollInfo
DestroyWindow
CreateWindowExW
RegisterClassExW
TrackMouseEvent
InsertMenuW
CreatePopupMenu
ShowScrollBar
BringWindowToTop
InsertMenuItemW
GetComboBoxInfo
PeekMessageW
CreateMenu
GetMessageW
IsWindowVisible
MessageBoxA
SetParent
SetCursor
GetUpdateRect
PostQuitMessage
DispatchMessageW
TranslateMessage
SubtractRect
WindowFromDC
LoadCursorW
PostMessageW
EnableMenuItem
GetMenuItemID
PostThreadMessageW
EnableWindow
UnregisterClassW
DefWindowProcW
GetWindowLongW
GetMenuItemCount
CallWindowProcW
GetTopWindow
GetSystemMenu
GetParent
GetWindowThreadProcessId
GetCursorPos
WindowFromPoint
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
MapVirtualKeyExW
IsCharLowerW
GetDoubleClickTime
DrawIcon
InvertRect
IsWindow
HideCaret
GetIconInfo
FrameRect
CopyIcon
ModifyMenuW
CharUpperBuffW
GetWindowTextW
GetClientRect
InvalidateRect
MapWindowPoints
GetWindowRect
GetClassInfoW
ClientToScreen
SendMessageW
MonitorFromWindow
SetForegroundWindow
MonitorFromPoint
ReleaseDC
GetDC
GetMonitorInfoW
SetWindowLongW
PtInRect
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
IsZoomed
ScreenToClient
SetWindowRgn
LoadImageW
GetSystemMetrics
OffsetRect
IsIconic
MonitorFromRect
CopyRect
IntersectRect
IsRectEmpty
SetRect
RegisterClipboardFormatW
FindWindowW
MoveWindow
SetTimer
KillTimer
OpenClipboard
GetWindowRgn
GetFocus
CloseClipboard
EmptyClipboard
SetClipboardData
ShowWindow
SetClassLongW
LockWindowUpdate
MessageBoxW
DestroyAcceleratorTable
GetAsyncKeyState
SystemParametersInfoW
TranslateAcceleratorW
LoadAcceleratorsW
LoadIconW
GetForegroundWindow
GetActiveWindow
IsClipboardFormatAvailable
GetClipboardData
UnregisterHotKey
MessageBeep
CreateAcceleratorTableW
SetWindowPos
GetClassNameW
wsprintfW
GetKeyState
RegisterWindowMessageW
SendMessageTimeoutW
SetLayeredWindowAttributes
SetActiveWindow
SetCapture
ReleaseCapture
GetKeyboardLayout
VkKeyScanExW
keybd_event
MapVirtualKeyW
AttachThreadInput
EqualRect
ChangeClipboardChain
SetClipboardViewer
InflateRect
GetSysColor
GetMessagePos
UpdateWindow
DestroyCursor
GetKeyboardState
ToUnicodeEx
DrawIconEx
GetWindow
DrawFocusRect
RegisterHotKey
DrawFrameControl
DrawEdge
GetMenuBarInfo
GetAncestor
ReuseDDElParam
SendInput
GetCapture
SetFocus
GetWindowTextLengthW
SetCursorPos
GrayStringW
FillRect
UnpackDDElParam
UpdateLayeredWindow
TabbedTextOutW
DrawTextW
DrawTextExW
GetSysColorBrush

oleaut32

SysAllocStringLen
VarBstrCmp
GetActiveObject
LoadTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantCopy
VarBstrFromDate
SysAllocString
OleCreateFontIndirect
VariantInit
VariantChangeType
SysFreeString
SafeArrayDestroy
SysStringLen
VariantClear
GetErrorInfo

gdi32

LPtoDP
RoundRect
ExtFloodFill
GetSystemPaletteEntries
GetPaletteEntries
SetPaletteEntries
CreatePalette
FillRgn
GetBoundsRect
GetWindowOrgEx
GetViewportOrgEx
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CreateDCW
SelectObject
DeleteDC
Ellipse
SetPixelV
GetDeviceCaps
CreateSolidBrush
CreateRectRgn
EnumFontFamiliesExW
GetDIBits
GetTextFaceW
SetTextAlign
CreateEllipticRgn
GetTextColor
GetBkColor
GetTextCharsetInfo
EnumFontFamiliesW
DeleteObject
FrameRgn
CreateDIBitmap
DPtoLP
PtInRegion
SelectClipRgn
SetRectRgn
GetStockObject
OffsetRgn
SetDIBColorTable
SetPixel
SetStretchBltMode
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SelectPalette
ExtSelectClipRgn
SaveDC
RestoreDC
GetMapMode
IntersectClipRect
GetPixel
GetObjectType
RealizePalette
GetClipBox
ExcludeClipRect
GetTextExtentPoint32W
CreateFontIndirectW
GetTextMetricsW
CreateRectRgnIndirect
PatBlt
ScaleWindowExtEx
ScaleViewportExtEx
GetViewportExtEx
GetWindowExtEx
CreatePatternBrush
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
CreateHatchBrush
CreateBitmap
CopyMetaFileW
CreateBitmapIndirect
CreateFontW
GetFontUnicodeRanges
GetGlyphIndicesW
CopyEnhMetaFileW
DeleteEnhMetaFile
SetBkMode
LineTo
MoveToEx
CreatePen
SetBitmapBits
CreateRoundRectRgn
GetBitmapBits
StretchBlt
GetRgnBox
ExtTextOutW
TextOutW
Polyline
Polygon
GetNearestPaletteIndex
Escape
PtVisible
RectVisible
Rectangle
CreatePolygonRgn
SetBkColor
CombineRgn
SetTextColor
GetObjectW
CreateDIBSection

ws2_32

listen
WSAGetLastError
WSACancelAsyncRequest
gethostname
gethostbyname
WSAAsyncGetHostByName
setsockopt
WSAAsyncSelect
WSASetLastError
WSACleanup
WSAStartup
socket
sendto
send
select
recvfrom
recv
ntohs
inet_addr
htons
htonl
connect
closesocket
bind
accept
ntohl
inet_ntoa

ole32

CoRegisterMessageFilter
CoCreateInstance
CoRevokeClassObject
CoUninitialize
CoInitialize
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
DoDragDrop
OleIsCurrentClipboard
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
OleGetClipboard
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
CLSIDFromString
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
PropVariantClear
CoTaskMemFree
CoInitializeEx
CLSIDFromProgID
CreateStreamOnHGlobal
OleFlushClipboard
CoSetProxyBlanket
StringFromGUID2
CoCreateGuid

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
SHFileOperationW
SHAppBarMessage
DragQueryFileW
DragAcceptFiles
ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW
SHGetFileInfoW
DragFinish
Shell_NotifyIconW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetDesktopFolder
SHGetSpecialFolderLocation

comctl32

_TrackMouseEvent
ImageList_ReplaceIcon
ImageList_Create

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CryptStringToBinaryA
CryptQueryObject
CryptDecodeObjectEx
CertCloseStore
CryptMsgClose
CryptDecodeObject
CertFindCertificateInStore
CertFreeCertificateContext
CryptMsgGetParam
CertGetNameStringW
CryptImportPublicKeyInfo

iphlpapi

GetAdaptersInfo

setupapi

SetupIterateCabinetW

winhttp

WinHttpWriteData
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpOpen
WinHttpSetOption
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpQueryOption
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpConnect

psapi

GetProcessImageFileNameW

msimg32

TransparentBlt
AlphaBlend

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

oledlg

OleUIBusyW

gdiplus

GdipCreateFromHWND
GdipSetTextRenderingHint
GdipSetPixelOffsetMode
GdipGetLogFontW
GdipAddPathString
GdipDrawString
GdipReversePath
GdipAddPathEllipseI
GdipDrawEllipseI
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipPrivateAddFontFile
GdipGetFamilyName
GdipSetStringFormatLineAlign
GdipAddPathLineI
GdipAddPathArcI
GdipAddPathRectangleI
GdipSetClipPath
GdipMultiplyWorldTransform
GdipSetClipRectI
GdipStringFormatGetGenericTypographic
GdipDrawLine
GdipScaleMatrix
GdipRotateMatrix
GdipClonePath
GdipClosePathFigure
GdipAddPathPath
GdipTransformPath
GdipSetImageAttributesColorKeys
GdipSetPenLineCap197819
GdipDrawLineI
GdipCreateBitmapFromHBITMAP
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawPath
GdipGetDC
GdipResetPath
GdipSetPenDashArray
GdipSetPenDashStyle
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateBitmapFromScan0
GdipDrawImagePointRectI
GdipSetWorldTransform
GdipGetImageGraphicsContext
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDrawImageRectRect
GdiplusShutdown
GdipSaveGraphics
GdipDrawImageRectI
GdipSetSmoothingMode
GdipSetInterpolationMode
GdiplusStartup
GdipDeletePrivateFontCollection
GdipCreateFromHWNDICM
GdipNewPrivateFontCollection
GdipCloneImage
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipDrawImageRectRectI
GdipMeasureString
GdipFillPath
GdipFillRectangleI
GdipAddPathArc
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteBrush
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipAlloc
GdipFree
GdipSetPenColor
GdipRestoreGraphics

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

propsys

PropVariantToStringAlloc

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW
ImmGetOpenStatus

winmm

PlaySoundW

ntdll

RtlUnwind

Exports

Exports

?CheckData@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?Destroy@@YAXXZ
?Init@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0H@Z
?Init@@YA_NHQAPBD@Z
?TranslatorDebug@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@@Z
?TranslatorPara@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@0@Z
?TranslatorPara@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@@Z
?TranslatorParas@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@0@Z
?TranslatorParas@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@@Z
?TranslatorParas@@YA?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@ABV12@@Z
?updatePatch@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

Sections

.text
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 179KB - Virtual size: 852KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 659KB - Virtual size: 659KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 415KB - Virtual size: 414KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

142b9820deeaada64d498ba95d8100fd

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

07:78:c8:e2:85:9c:24:18:0e:aa:16:a2:ef:5d:de:1cCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

kernel32

advapi32

shlwapi

user32

oleaut32

gdi32

ws2_32

ole32

shell32

comctl32

version

crypt32

iphlpapi

setupapi

winhttp

psapi

msimg32

winspool.drv

oledlg

gdiplus

oleacc

propsys

imm32

winmm

ntdll

Exports

Exports

Sections

.text Size: 7.2MB - Virtual size: 7.2MB

.rdata Size: 2.0MB - Virtual size: 2.0MB

.data Size: 179KB - Virtual size: 852KB

_RDATA Size: 1KB - Virtual size: 1KB

.rsrc Size: 659KB - Virtual size: 659KB

.reloc Size: 415KB - Virtual size: 414KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

07:78:c8:e2:85:9c:24:18:0e:aa:16:a2:ef:5d:de:1c
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

.text
Size: 7.2MB - Virtual size: 7.2MB

.rdata
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 179KB - Virtual size: 852KB

_RDATA
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 659KB - Virtual size: 659KB

.reloc
Size: 415KB - Virtual size: 414KB