2024-05-30_d9ae87cbbc410e80f1575e18f6991d2c_avoslocker_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-30_d9ae87cbbc410e80f1575e18f6991d2c_avoslocker_revil
Size

9.7MB
MD5

d9ae87cbbc410e80f1575e18f6991d2c
SHA1

5293cc30a8b460659d791d58db04a3b1a9739445
SHA256

560b2f536e629cb0d9e2da33a5ab3603ab82d3c732348df9516744597e8099c0
SHA512

2719fef942f0fa55d2a235a4fc9dc9db087b835999404aa03214542cd91f489b16eee74b2559e6aae5d7d2c90a22d5731870a30c38b68fe92d89b545ca3a959c
SSDEEP

196608:u9nt/EtU7FiHJRx18U5KILq9XK5iEKsXwW/lsG4E7aDoXy:u9t/Et9HBvLSXK5iEpgDEu8C

Score

1^/10

Malware Config

Signatures

Files

2024-05-30_d9ae87cbbc410e80f1575e18f6991d2c_avoslocker_revil
.exe windows:6 windows x86 arch:x86

f99199dfae23c4e965bf70f1e0f26dc2

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

17:84:31:17:85:2d:87:39:43:3c:23:9b
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

17/01/2019, 07:04

Not After

16/02/2022, 07:04

Subject

CN=杭州跃兔网络科技有限公司,O=杭州跃兔网络科技有限公司,L=杭州,ST=浙江,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

45:3c:4e:a1:e2:52:21:c1:b3:c4:ac:83:33:1e:e0:40:de:02:70:17
Signer

Actual PE Digest

45:3c:4e:a1:e2:52:21:c1:b3:c4:ac:83:33:1e:e0:40:de:02:70:17

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\小目标登录器\代理测试\Release\GameUpdate_XMB.pdb

Imports

comctl32

_TrackMouseEvent
InitCommonControlsEx

shlwapi

UrlCanonicalizeA
PathCanonicalizeA
PathFindExtensionA
PathFindFileNameA
StrFormatKBSizeA
UrlUnescapeA
PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA
PathAppendA
PathCompactPathA
PathGetDriveNumberA
PathRemoveBackslashA
PathSetDlgItemPathA
PathRemoveFileSpecA
PathGetArgsA
PathFileExistsA

ws2_32

htons
getsockopt
recv
connect
socket
getnameinfo
shutdown
send
setsockopt
inet_addr
inet_ntoa
WSACleanup
closesocket
gethostbyname
select
ioctlsocket
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
inet_pton
WSAGetLastError
__WSAFDIsSet
WSASetLastError
bind
getpeername
getsockname
ntohs
WSAIoctl
accept
ntohl
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
WSAAddressToStringA
WSAStartup

winmm

PlaySoundA
timeGetTime

kernel32

GetEnvironmentVariableW
SizeofResource
HeapFree
InitializeCriticalSectionEx
FindResourceA
HeapSize
MultiByteToWideChar
GetLastError
LockResource
GlobalAlloc
GlobalFree
HeapReAlloc
RaiseException
LoadResource
FindResourceW
HeapAlloc
DecodePointer
LoadLibraryExA
GetModuleHandleW
VirtualQuery
VirtualProtect
GetSystemInfo
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
GetVersionExA
CreateMutexA
GetDriveTypeA
GetProcessAffinityMask
DeviceIoControl
SetProcessAffinityMask
GetCurrentProcess
SystemTimeToFileTime
GetLocalTime
CreateThread
MoveFileExA
GetExitCodeThread
FindNextFileA
FindFirstFileA
GetFileAttributesExA
GetTickCount
GetModuleHandleA
OutputDebugStringA
CreateEventA
SetEvent
WaitForMultipleObjects
GetCurrentDirectoryA
lstrcpynA
lstrcpynW
MulDiv
FreeLibrary
GetProcAddress
LoadLibraryA
ExpandEnvironmentStringsA
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
FindNextFileW
FindFirstFileExW
CreateDirectoryW
GetFileAttributesExW
GetTimeZoneInformation
SetConsoleCtrlHandler
DeleteFileW
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetStdHandle
HeapQueryInformation
VirtualAlloc
GetCurrentDirectoryW
GetSystemTime
FindFirstFileW
ConvertThreadToFiber
ConvertFiberToThread
SetConsoleMode
ReadConsoleA
SwitchToFiber
DeleteFiber
FindClose
CreateFiber
SetCurrentDirectoryW
SetEnvironmentVariableW
GetFullPathNameW
GetDriveTypeW
GetCommandLineW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwind
GetStringTypeW
CompareStringEx
LCMapStringEx
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
CreateEventW
GetUserDefaultLCID
GetTempFileNameA
SetCurrentDirectoryA
CreateProcessA
GetCurrentProcessId
SetEnvironmentVariableA
ExitProcess
RemoveDirectoryA
CloseHandle
DeleteFileA
CreateFileA
CopyFileA
GetTempPathA
Sleep
GetCommandLineA
OpenProcess
WaitForSingleObject
GetEnvironmentVariableA
MoveFileA
GetModuleFileNameA
TerminateThread
GlobalUnlock
SearchPathA
GetProfileIntA
SetErrorMode
GetWindowsDirectoryA
FindResourceExW
FileTimeToLocalFileTime
lstrcmpiA
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
lstrcpyA
GetThreadLocale
GetACP
GetCPInfo
GetOEMCP
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LocalAlloc
InitializeCriticalSectionAndSpinCount
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpA
WideCharToMultiByte
GetProcessHeap
DeleteCriticalSection
GlobalLock
GlobalSize
CompareStringA
GlobalGetAtomNameA
GlobalFindAtomA
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
WaitForSingleObjectEx
CompareFileTime
GetSystemTimeAsFileTime
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
SetLastError
FormatMessageW
VerSetConditionMask
VerifyVersionInfoA
GetFileSizeEx
WriteFile
CreateDirectoryA
SetFilePointer
CreateFileW
GetFileSize
SetThreadPriority
GetCurrentThreadId
ResumeThread
InitializeCriticalSection
ResetEvent
FormatMessageA
SetUnhandledExceptionFilter
GetCurrentThread
TerminateProcess
UnmapViewOfFile
GetFileAttributesA
SetFileAttributesA
LocalFree
CreateToolhelp32Snapshot
Process32First
Process32Next
Module32First
Module32Next
WTSGetActiveConsoleSessionId
OpenMutexA
ReleaseMutex
LockFile
UnlockFile
SetFilePointerEx
SetEndOfFile
GetFileInformationByHandle
FlushFileBuffers
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
EncodePointer
GetSystemDirectoryW
GetModuleFileNameW
LoadLibraryExW
LoadLibraryW
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomA

user32

FrameRect
EmptyClipboard
CloseClipboard
ClientToScreen
OpenClipboard
GetSubMenu
LoadMenuW
GetSystemMenu
DeleteMenu
AppendMenuA
PeekMessageA
TranslateMessage
IsIconic
FillRect
SetRect
UpdateLayeredWindow
SetClipboardData
MsgWaitForMultipleObjects
DispatchMessageA
UpdateWindow
MoveWindow
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetPropA
GetClassNameA
GetLastActivePopup
GetSystemMetrics
InflateRect
SystemParametersInfoA
LoadIconW
IsWindow
SetWindowLongW
GetWindowLongW
SetParent
ShowWindow
PostMessageW
PostThreadMessageA
GetWindowTextA
GetWindowDC
RegisterWindowMessageA
GetMessageTime
DefWindowProcA
CallWindowProcA
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
IsMenu
IsChild
DestroyWindow
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgCtrlID
SetFocus
GetCapture
GetMenu
SetMenu
GetMenuItemID
GetMenuItemCount
TrackPopupMenu
SetActiveWindow
GetForegroundWindow
BeginPaint
EndPaint
ValidateRect
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
RemovePropA
GetWindowTextLengthA
SetWindowTextA
MapWindowPoints
GetSysColor
CopyRect
GetClassLongA
GetTopWindow
GetWindow
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
LoadIconA
SetScrollInfo
GetScrollInfo
WinHelpA
MonitorFromWindow
GetMonitorInfoA
CheckDlgButton
SendDlgItemMessageA
IsWindowEnabled
GetDlgItem
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetActiveWindow
GetDesktopWindow
GetMenuStringA
GetMenuState
InsertMenuA
RemoveMenu
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoA
LoadBitmapW
GetMessageA
PostQuitMessage
ShowOwnedPopups
SetWindowContextHelpId
MapDialogRect
GetKeyNameTextA
MapVirtualKeyA
IntersectRect
DestroyMenu
GetMenuItemInfoA
CopyImage
GetSysColorBrush
RealChildWindowFromPoint
TrackMouseEvent
DestroyIcon
LoadImageW
WaitMessage
SetCapture
ReleaseCapture
LoadCursorW
CharUpperA
CharNextA
CopyAcceleratorTableA
InvalidateRgn
IsRectEmpty
GetNextDlgGroupItem
MessageBeep
IsClipboardFormatAvailable
CreatePopupMenu
GetMenuDefaultItem
DrawFocusRect
LoadImageA
DrawIconEx
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
SetLayeredWindowAttributes
EnumDisplayMonitors
DrawStateA
SetClassLongA
SetWindowRgn
DrawEdge
DrawFrameControl
IsZoomed
BringWindowToTop
SetCursorPos
CopyIcon
DrawIcon
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
InsertMenuItemA
UnpackDDElParam
ReuseDDElParam
RegisterClipboardFormatA
UnionRect
MonitorFromPoint
GetComboBoxInfo
IsCharLowerA
MapVirtualKeyExA
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
CreateAcceleratorTableA
DestroyAcceleratorTable
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuA
CharUpperBuffA
GetUpdateRect
DrawMenuBar
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
EqualRect
GrayStringA
TabbedTextOutA
DrawTextExA
GetAsyncKeyState
OffsetRect
SetWindowLongA
EnableWindow
ReleaseDC
GetParent
UnregisterClassA
GetClientRect
MessageBoxA
GetDC
EnumWindows
PostMessageA
GetWindowThreadProcessId
GetCursorPos
InvalidateRect
PtInRect
KillTimer
SetCursor
SendMessageA
RegisterHotKey
SetTimer
ScreenToClient
SetWindowPos
IsWindowVisible
LoadCursorA
GetFocus
GetWindowRect
GetMessagePos
DrawTextA
VkKeyScanExW
WindowFromPoint
GetKeyboardLayout
GetKeyState
RedrawWindow
GetWindowLongA
SetRectEmpty
SetForegroundWindow
UnregisterHotKey
SetPropA
IsDialogMessageA
AdjustWindowRectEx

gdi32

OffsetViewportOrgEx
CreateCompatibleBitmap
SelectObject
DeleteObject
CreateDCA
DeleteDC
GetObjectA
GetStockObject
SelectPalette
SetWindowOrgEx
SetBkColor
SetTextColor
CreateBitmap
CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgn
ExcludeClipRect
GetClipBox
GetObjectType
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SetBkMode
SetMapMode
SetLayout
SetWindowExtEx
RealizePalette
OffsetWindowOrgEx
SetPolyFillMode
SetROP2
SetTextAlign
GetLayout
ExtCreatePen
MoveToEx
SetViewportExtEx
GetTextFaceA
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FillRgn
RoundRect
OffsetRgn
LPtoDP
CreateRoundRectRgn
Polygon
CreatePolygonRgn
Ellipse
CreateEllipticRgn
SetDIBColorTable
StretchBlt
GetTextCharsetInfo
EnumFontFamiliesA
CreateDIBitmap
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
EnumFontFamiliesExA
GetRgnBox
GetTextColor
GetBkColor
DPtoLP
SetRectRgn
GetMapMode
CombineRgn
CreateCompatibleDC
CreateDIBSection
BitBlt
CreateSolidBrush
GetDeviceCaps
CreateFontA
GetBkMode
GetTextExtentPoint32A
PtVisible
Escape
TextOutA
RectVisible
ExtTextOutA
GetTextMetricsA
GetPixel
CreateFontIndirectA
Polyline
CreateRectRgnIndirect
FrameRgn
Rectangle
SetPixel
ScaleViewportExtEx
PatBlt
CopyMetaFileA
ScaleWindowExtEx
SetViewportOrgEx

shell32

SHGetSpecialFolderPathA
SHGetDataFromIDListW
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteW
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetDesktopFolder
Shell_NotifyIconA
SHGetFileInfoA
ShellExecuteA
ShellExecuteExA
SHGetSpecialFolderLocation
DragQueryFileA
SHChangeNotify
SHAppBarMessage
DragFinish

ole32

CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CreateStreamOnHGlobal
StringFromGUID2
CoInitialize
CoCreateGuid
CoUninitialize
OleDuplicateData
ReleaseStgMedium
CLSIDFromString
CLSIDFromProgID
CoDisconnectObject
CoGetClassObject
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
CoRegisterMessageFilter
CoRevokeClassObject
RevokeDragDrop
RegisterDragDrop
CoInitializeEx
CoLockObjectExternal

advapi32

RegCreateKeyExA
RegEnumKeyExA
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegQueryInfoKeyA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetTokenInformation
OpenSCManagerA
EnumServicesStatusA
CloseServiceHandle
RegOpenKeyExA
RegEnumKeyA
RegQueryValueA

msimg32

TransparentBlt
AlphaBlend

uxtheme

GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData
DrawThemeParentBackground
DrawThemeText
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
IsAppThemed
GetWindowTheme
GetThemeSysColor
GetCurrentThemeName

oledlg

ord8

gdiplus

GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipFillRectangle
GdipCreateTexture
GdipBitmapGetPixel
GdipDrawImageRectRectI
GdipSetImageAttributesColorMatrix
GdipDrawRectangleI
GdipCreateBitmapFromHBITMAP
GdipCreateImageAttributes
GdipFillRectangleI
GdipDeletePen
GdipDrawImageI
GdipCreatePen1
GdipImageGetFrameDimensionsCount
GdipGetPropertyItem
GdipImageSelectActiveFrame
GdipSetInterpolationMode
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipCreateStringFormat
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipGetPropertyItemSize
GdipDisposeImageAttributes
GdipDrawImageRectRect
GdipDeleteBrush
GdipDrawImageRectI
GdipSetStringFormatLineAlign
GdipCreateFont
GdipCreateSolidFill
GdipDrawString
GdipSetTextRenderingHint
GdipCloneBrush
GdipDeleteStringFormat
GdipDeleteFont
GdipSetStringFormatAlign
GdipSetSmoothingMode
GdiplusStartup
GdiplusShutdown
GdipGetImageHeight
GdipReleaseDC
GdipDrawImageRect
GdipCloneImage
GdipCreateBitmapFromStream
GdipAlloc
GdipDisposeImage
GdipFree
GdipCreateFromHDC
GdipDeleteGraphics
GdipGetImageWidth
GdipCreateBitmapFromFile

iphlpapi

IcmpCloseHandle
IcmpSendEcho
IcmpCreateFile
GetIpForwardTable
GetAdaptersInfo
GetAdaptersAddresses

imagehlp

MakeSureDirectoryPathExists

wininet

InternetSetStatusCallback
HttpQueryInfoA
HttpOpenRequestA
HttpAddRequestHeadersA
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetReadFile
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetOpenUrlA
InternetSetFilePointer
InternetWriteFile
InternetQueryDataAvailable
InternetQueryOptionA
InternetSetOptionA
InternetGetLastResponseInfoA

wldap32

ord200
ord301
ord32
ord30
ord79
ord35
ord33
ord27
ord26
ord22
ord41
ord143
ord50
ord45
ord60
ord211
ord46

crypt32

CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertOpenStore
CertCloseStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

oleaut32

VariantChangeType
SysAllocStringByteLen
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
SafeArrayDestroy
VariantClear
VariantInit
LoadTypeLi
OleCreateFontIndirect
SysAllocString
VariantCopy
VarBstrFromDate
SysFreeString

bcrypt

BCryptGenRandom

Sections

.text
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 430KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f99199dfae23c4e965bf70f1e0f26dc2

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

17:84:31:17:85:2d:87:39:43:3c:23:9bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

45:3c:4e:a1:e2:52:21:c1:b3:c4:ac:83:33:1e:e0:40:de:02:70:17Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

shlwapi

ws2_32

winmm

kernel32

user32

gdi32

shell32

ole32

advapi32

msimg32

uxtheme

oledlg

gdiplus

iphlpapi

imagehlp

wininet

wldap32

crypt32

imm32

oleacc

winspool.drv

oleaut32

bcrypt

Sections

.text Size: 4.9MB - Virtual size: 4.9MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 65KB - Virtual size: 430KB

.rsrc Size: 3.3MB - Virtual size: 3.3MB

.reloc Size: 316KB - Virtual size: 316KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

17:84:31:17:85:2d:87:39:43:3c:23:9b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

45:3c:4e:a1:e2:52:21:c1:b3:c4:ac:83:33:1e:e0:40:de:02:70:17
Signer

.text
Size: 4.9MB - Virtual size: 4.9MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 65KB - Virtual size: 430KB

.rsrc
Size: 3.3MB - Virtual size: 3.3MB

.reloc
Size: 316KB - Virtual size: 316KB