2024-06-01_46aa91e55a1ed4e806e94a1c93bd51ab_bkransomware

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-01_46aa91e55a1ed4e806e94a1c93bd51ab_bkransomware
Size

10.1MB
MD5

46aa91e55a1ed4e806e94a1c93bd51ab
SHA1

25fc845ebbefe86344b8fe5b6f778f21f9c2d624
SHA256

220a333331c21fd570c8368bf9796f9b5f5dccd97a1ff66dc3812b4ba43a4d21
SHA512

808e0faeda8e791da1cccc4a78d27c60490e6d77a21b114b61b3cbea00afa92e726ee6f1bdf27b63e9962d438d1dbd9529b350a32bd94a6bbe707201199b00c8
SSDEEP

98304:i4RwwrVRsGl0SRbKB75mWcKMzH9Yx0K0IffiZi8ROiK5j6HD6OR0rRfuVa3keSgU:isPtuB9eq2Qj6KrRfuvgU

Score

1^/10

Malware Config

Signatures

Files

2024-06-01_46aa91e55a1ed4e806e94a1c93bd51ab_bkransomware
.exe windows:5 windows x86 arch:x86

3d655168a049d323d138e5d81c393481

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

59:b4:f8:8a:ac:be:29:b5:c1:ae:33:40:c2:c0:f2:44
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21/12/2015, 00:00

Not After

16/06/2017, 23:59

Subject

CN=GRETECH,O=GRETECH,L=Gangnam-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b2:f1:e7:43:e1:ee:4d:34:d0:fe:ca:7d:85:e0:6c:36:39:fc:08:d9
Signer

Actual PE Digest

b2:f1:e7:43:e1:ee:4d:34:d0:fe:ca:7d:85:e0:6c:36:39:fc:08:d9

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\work\gomplayer\project\bin\map_pdb\Gomplayer_vc120_ReleaseKor.pdb

Imports

winmm

mixerGetNumDevs
waveOutGetNumDevs
mixerClose
mixerGetID
PlaySoundW
mixerGetControlDetailsW
mixerSetControlDetails
mixerGetLineInfoW
mixerGetDevCapsW
mixerGetLineControlsW
mixerOpen
timeGetTime

kernel32

FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateSemaphoreW
IsValidCodePage
GetOEMCP
GetStringTypeW
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
GetEnvironmentStringsW
GetFileInformationByHandle
PeekNamedPipe
SetStdHandle
MoveFileExW
WriteConsoleW
SetEnvironmentVariableA
VirtualFree
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
GlobalMemoryStatus
GetEnvironmentStrings
EnumSystemLocalesW
GetStartupInfoW
IsDebuggerPresent
ExitThread
HeapQueryInformation
VirtualAlloc
RtlUnwind
SearchPathW
GetModuleHandleExW
ExitProcess
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
SetFilePointerEx
FreeEnvironmentStringsA
InterlockedCompareExchange
SwitchToThread
lstrlenA
SizeofResource
LockResource
LoadResource
FindResourceW
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RaiseException
LoadLibraryW
FreeLibrary
GetProcAddress
GetUserDefaultUILanguage
GetVersionExW
OutputDebugStringW
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameW
CloseHandle
Sleep
GetLocalTime
CompareStringW
GlobalAlloc
GlobalLock
GlobalFree
VerSetConditionMask
VerifyVersionInfoW
CreateProcessW
CreateFileW
DeleteFileW
GetFileSize
ReadFile
lstrcpynW
GetTickCount
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapDestroy
HeapSize
DecodePointer
WriteFile
lstrlenW
lstrcpyW
GetSystemDefaultUILanguage
GlobalFlags
LocalReAlloc
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetProfileIntW
GlobalGetAtomNameW
GetFileSizeEx
ReplaceFileW
MoveFileW
DuplicateHandle
GetThreadLocale
ResumeThread
SuspendThread
lstrcmpA
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
EncodePointer
OutputDebugStringA
GlobalSize
VirtualQuery
VirtualProtect
SetErrorMode
GetVersionExA
MoveFileA
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
SetFileAttributesW
GetModuleHandleA
SetFileAttributesA
CreateDirectoryA
GetDriveTypeA
FindNextFileA
FindFirstFileA
CreateTimerQueueTimer
DeleteTimerQueueEx
CreateTimerQueue
GetFileType
GetStdHandle
SetFileTime
IsDBCSLeadByte
GetCPInfo
InterlockedExchangeAdd
CreateEventW
lstrcmpW
GetPrivateProfileIntW
EnterCriticalSection
InterlockedExchange
WritePrivateProfileStringW
GetCurrentDirectoryW
GetCommandLineW
GetFileTime
GetSystemDirectoryW
GetCurrentThread
GetVersion
IsDBCSLeadByteEx
GetPrivateProfileStringW
GetVolumeInformationW
GetSystemWindowsDirectoryW
SetThreadPriority
InterlockedDecrement
InterlockedIncrement
MulDiv
GetLogicalDrives
SetLastError
FlushInstructionCache
GetSystemDirectoryA
GetACP
LoadLibraryExW
lstrcmpiW
SetPriorityClass
GetUserDefaultLangID
Process32NextW
TerminateProcess
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
FreeResource
GetExitCodeProcess
FindNextFileW
FindClose
FindFirstFileW
GetNativeSystemInfo
GetCurrentProcess
CopyFileW
GetWindowsDirectoryW
GetLocaleInfoW
GetDriveTypeW
GetTempFileNameW
GetLongPathNameW
TerminateThread
GetCurrentThreadId
WinExec
SetCurrentDirectoryW
AreFileApisANSI
GetSystemTime
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingW
LoadLibraryA
GetDiskFreeSpaceW
LockFileEx
FlushFileBuffers
GetFileAttributesW
GetFileAttributesA
FormatMessageA
GetSystemTimeAsFileTime
UnlockFileEx
LockFile
UnlockFile
SetEndOfFile
UnmapViewOfFile
LeaveCriticalSection
MapViewOfFile
CreateFileA
GetUserDefaultLCID
FormatMessageW
RemoveDirectoryW
GetDiskFreeSpaceExW
CreateDirectoryW
GlobalHandle
GlobalUnlock
LocalAlloc
LocalFree
WaitForMultipleObjects
CreateThread
ResetEvent
SetEvent
WaitForSingleObject
DeviceIoControl
SetFilePointer
lstrcatW
GetCurrentProcessId
FindResourceExW
QueryPerformanceCounter
GetFullPathNameW
GetModuleHandleW
GetTempPathW
InitializeCriticalSection
IsProcessorFeaturePresent

user32

GetMessageTime
GetMessagePos
GetMenuState
CharToOemBuffA
OemToCharBuffA
CharUpperA
OemToCharA
CharLowerA
CharToOemA
GetTopWindow
IsIconic
LoadCursorFromFileW
GetClassLongW
SetClassLongW
DestroyCursor
CreateAcceleratorTableW
InvalidateRgn
DestroyAcceleratorTable
GetCursor
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
TabbedTextOutW
DrawTextExW
GrayStringW
MonitorFromPoint
GetMenuItemID
GetMenuStringW
GetMenuItemInfoW
LoadMenuW
GetDlgCtrlID
GetWindowPlacement
GetWindowTextLengthW
EndPaint
DialogBoxIndirectParamW
BeginPaint
SetPropW
EndDialog
SetDlgItemTextW
GetPropW
FindWindowA
SetLastErrorEx
AnimateWindow
GetMonitorInfoW
MonitorFromRect
DrawIcon
RemovePropW
UnregisterHotKey
RegisterHotKey
EnumChildWindows
ShowScrollBar
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
EnumWindows
GetWindowTextW
GetClassInfoW
SetWindowTextW
GetKeyNameTextW
UnregisterClassW
RegisterWindowMessageW
EnableWindow
SendMessageW
MapDialogRect
RegisterClipboardFormatW
GetDesktopWindow
mouse_event
SubtractRect
SetParent
IntersectRect
TrackPopupMenu
DestroyMenu
DestroyIcon
DestroyWindow
ExitWindowsEx
ChangeDisplaySettingsW
ShowCursor
SendMessageTimeoutW
SetActiveWindow
EqualRect
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
GetActiveWindow
GetClassNameW
IsChild
CreatePopupMenu
SetMenuItemInfoW
InsertMenuW
RemoveMenu
DeleteMenu
CheckMenuItem
GetMenuItemCount
AppendMenuW
CheckMenuRadioItem
EnableMenuItem
GetDoubleClickTime
LoadAcceleratorsW
SetForegroundWindow
PostThreadMessageW
PostQuitMessage
ModifyMenuW
GetWindow
GetCapture
UpdateWindow
GetNextDlgTabItem
SetRectEmpty
DrawEdge
DrawFrameControl
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
SetMenu
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
MapWindowPoints
GetLastActivePopup
SetScrollInfo
GetScrollInfo
WinHelpW
MonitorFromWindow
GetDlgItemTextW
CheckDlgButton
GetWindowDC
DrawFocusRect
RedrawWindow
SetFocus
IsWindowEnabled
MessageBeep
IsDlgButtonChecked
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
CreateDialogIndirectParamW
SendDlgItemMessageA
GetMessageW
CharNextW
GetAsyncKeyState
GetSysColor
FillRect
CopyRect
GetSystemMetrics
PostMessageW
GetParent
InvalidateRect
RegisterWindowMessageA
GetClientRect
GetDC
GetWindowRect
UpdateLayeredWindow
ReleaseDC
ShowWindow
TranslateMessage
DispatchMessageW
SetRect
WindowFromPoint
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
IsZoomed
IsClipboardFormatAvailable
SetWindowContextHelpId
MapVirtualKeyW
ShowOwnedPopups
DefWindowProcW
FindWindowW
NotifyWinEvent
GetSysColorBrush
RealChildWindowFromPoint
CopyImage
CopyAcceleratorTableW
GetSystemMenu
WaitMessage
GetNextDlgGroupItem
GetMenuDefaultItem
DrawIconEx
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
LockWindowUpdate
SetLayeredWindowAttributes
EnumDisplayMonitors
DrawStateW
IsMenu
TrackMouseEvent
GetComboBoxInfo
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
SetCursorPos
CopyIcon
SetMenuDefaultItem
CharUpperBuffW
FrameRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
GetUpdateRect
CreateMenu
GetWindowRgn
InsertMenuA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SystemParametersInfoW
LoadCursorW
RegisterClassW
ValidateRect
PtInRect
GetDlgItem
LoadBitmapW
MoveWindow
IsWindowVisible
LoadImageW
SetTimer
GetCursorPos
KillTimer
ScreenToClient
GetKeyState
GetFocus
SetCursor
SetCapture
ReleaseCapture
DrawTextW
GetSubMenu
wsprintfA
IsWindow
LoadIconW
MessageBoxW
IsRectEmpty
UnionRect
InflateRect
OffsetRect
CharUpperW
ClientToScreen
GetMenu
GetWindowLongW
SetWindowLongW
SetWindowPos
AdjustWindowRectEx
TranslateAcceleratorW
PeekMessageW
SetWindowRgn
FindWindowExW
wsprintfW
EnumDisplaySettingsW
EnumDisplayDevicesW

gdi32

SetDIBColorTable
SetDIBits
RectVisible
Escape
PtVisible
GetTextMetricsW
OffsetRgn
CreateEllipticRgn
CreateRoundRectRgn
CreatePatternBrush
StretchDIBits
SelectClipRgn
GetObjectA
CopyMetaFileW
CreateDCW
PatBlt
CreateBitmap
CreateHatchBrush
ExcludeClipRect
GetObjectType
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
ExtSelectClipRgn
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
GetDIBColorTable
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetTextColor
GetMapMode
SetRectRgn
DPtoLP
GetCharWidthW
GetRgnBox
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
Polyline
RoundRect
SetPixelV
ExtFloodFill
SetPaletteEntries
GetBoundsRect
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
GetTextFaceW
GetDIBits
RealizePalette
SelectPalette
AbortPath
GetPath
EndPath
CloseFigure
BeginPath
TextOutA
GetTextExtentPoint32A
CreateFontA
SetMapMode
GetTextExtentPointW
SaveDC
RestoreDC
ExtTextOutW
GetClipBox
GetCurrentObject
CreateCompatibleBitmap
PtInRegion
FrameRgn
CreatePolygonRgn
Polygon
EnumFontFamiliesExW
GetBkColor
CreateFontIndirectW
Rectangle
Ellipse
BitBlt
FillRgn
CombineRgn
CreateRectRgnIndirect
SetBkMode
SetTextCharacterExtra
CreateFontW
GetTextExtentPoint32W
SetTextColor
StretchBlt
SetBkColor
SetPixel
GetPixel
TextOutW
GetDeviceCaps
CreateRectRgn
CreateDIBSection
GetObjectW
CreateSolidBrush
GetStockObject
DeleteObject
SelectObject
CreateCompatibleDC
DeleteDC
SwapBuffers
ChoosePixelFormat
SetPixelFormat
LineTo
CreatePen
MoveToEx

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetSaveFileNameW
GetOpenFileNameW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegSetValueExW
RegCloseKey
RegSetValueExA
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegFlushKey
RegCreateKeyA
RegCreateKeyW
GetFileSecurityW
AdjustTokenPrivileges
SetFileSecurityA
SetFileSecurityW
LookupPrivilegeValueA
FreeSid
AllocateAndInitializeSid
EqualSid
OpenThreadToken
RegEnumKeyW
RegDeleteValueW
GetTokenInformation
OpenProcessToken
RegCreateKeyExA
RegSetValueW
RegSetValueA
RegQueryValueExA
RegQueryValueW
RegQueryValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyW
RegOpenKeyA
RegEnumValueW
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegOpenKeyExW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
DragQueryFileW
DragFinish
DragQueryPoint
SHAppBarMessage
SHChangeNotify
SHGetFileInfoW
SHGetDesktopFolder
SHGetSpecialFolderLocation
ShellExecuteW
Shell_NotifyIconW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
DragAcceptFiles
SHFileOperationW
SHGetFolderPathW

comctl32

ImageList_Draw
ImageList_Create
ImageList_Add
ImageList_AddMasked
_TrackMouseEvent

shlwapi

PathAddBackslashW
PathFindExtensionW
PathFindFileNameW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW

uxtheme

DrawThemeBackground
GetThemePartSize
IsAppThemed
DrawThemeText
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
CloseThemeData
GetWindowTheme
GetThemeSysColor
GetCurrentThemeName
GetThemeColor
OpenThemeData

ole32

StringFromCLSID
OleLoadFromStream
OleSaveToStream
StgCreateDocfile
StgOpenStorage
StringFromGUID2
CoFreeLibrary
CoLoadLibrary
CoGetObject
CLSIDFromString
MkParseDisplayName
CreateBindCtx
CoCreateGuid
CoUninitialize
CoTaskMemRealloc
CoRegisterClassObject
OleInitialize
CoRevokeClassObject
OleUninitialize
CreateStreamOnHGlobal
OleLockRunning
CoGetClassObject
CLSIDFromProgID
OleCreate
OleSetContainedObject
OleDuplicateData
ReleaseStgMedium
CoInitializeEx
CoInitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleGetClipboard
CoFreeUnusedLibraries
CoDisconnectObject
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
DoDragDrop
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator

oleaut32

SafeArrayDestroy
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnaccessData
SafeArrayCreateVector
SysAllocStringLen
SysStringLen
SysAllocStringByteLen
SysStringByteLen
VariantCopy
OleLoadPicturePath
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleLoadPicture
VariantClear
VariantChangeType
SystemTimeToVariantTime
VariantTimeToSystemTime
VarBstrFromDate
VariantInit
SysFreeString
SysAllocString
OleCreateFontIndirect

oledlg

OleUIBusyW

urlmon

UrlMkSetSessionOption
UrlMkGetSessionOption

gdiplus

GdipNewPrivateFontCollection
GdipGetFontCollectionFamilyCount
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipDeletePrivateFontCollection
GdipDrawImageRect
GdipLoadImageFromFile
GdipFillRectangleI
GdipDrawRectangleI
GdipRotateMatrix
GdipSetPenDashStyle
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipGetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipSetPathFillMode
GdipAddPathString
GdipGetPathWorldBounds
GdipCreateRegionRectI
GdipDeleteRegion
GdipTransformRegion
GdipIsVisibleRegionPointI
GdipSetStringFormatMeasurableCharacterRanges
GdipCreateFont
GdipDeleteFont
GdipCreateRegion
GdipMeasureCharacterRanges
GdipGetRegionBounds
GdipTransformPath
GdipAddPathPath
GdipSetMatrixElements
GdipSetPenLineJoin
GdipWidenPath
GdipAddPathRectangle
GdipWarpPath
GdipCreateBitmapFromHICON
GdipLoadImageFromStream
GdipCreateHBITMAPFromBitmap
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipDrawString
GdipFillRectangle
GdipGetFontHeight
GdipSetStringFormatHotkeyPrefix
GdipDrawEllipseI
GdipCombineRegionRectI
GdipGetRegionHRgn
GdipSetImageAttributesColorMatrix
GdipCreateBitmapFromStream
GdipCreateBitmapFromResource
GdipGetImageRawFormat
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipGetLogFontW
GdipDrawImageRectI
GdipGetTextRenderingHint
GdipTranslateWorldTransform
GdipMultiplyMatrix
GdipSetClipRegion
GdipGetClip
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromHBITMAP
GdipFillEllipseI
GdipResetPath
GdipAddPathArcI
GdipClosePathFigure
GdipSetPageUnit
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipFillPath
GdipCreateFontFamilyFromName
GdipSaveImageToFile
GdipSetPropertyItem
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateSolidFill
GdipDeleteBrush
GdipFree
GdipGetImageHeight
GdipRotateWorldTransform
GdipGetImageWidth
GdipCreateBitmapFromGdiDib
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipDrawImageRectRectI
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdiplusShutdown
GdiplusStartup
GdipDrawImage
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipGraphicsClear
GdipCreateFromHDC
GdipDeleteGraphics
GdipMeasureString
GdipImageRotateFlip
GdipAlloc
GdipCloneBrush
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipScaleMatrix
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipResetWorldTransform
GdipDrawImageI
GdipSetWorldTransform
GdipTranslateMatrix
GdipDrawLine
GdipDrawLineI
GdipSetEmpty
GdipFillPolygonI
GdipDeleteMatrix
GdipCreateMatrix

opengl32

glGetString
glGetIntegerv
glGetError
glViewport
glMatrixMode
glLoadIdentity
glEnable
glShadeModel
glClearColor
glClearDepth
glDepthFunc
glFrontFace
glCullFace
glBlendFunc
glLineWidth
glHint
wglMakeCurrent
glDeleteTextures
glReadPixels
glClear
glBindTexture
glTexSubImage2D
glFlush
wglDeleteContext
glDisable
glTranslated
glTranslatef
glColor4ub
glBegin
glVertex3f
glEnd
glTexCoord2d
glNormal3d
wglCreateContext
glTexCoord2f
glNormal3f
glPushMatrix
glOrtho
glPopMatrix
glColor4f
glRotatef
glGenTextures
glTexParameteri
glTexImage2D
wglGetProcAddress

glu32

gluPerspective

tbb

?internal_push_back@concurrent_vector_base_v3@internal@tbb@@IAEPAXIAAI@Z
?internal_clear@concurrent_vector_base_v3@internal@tbb@@IAEIP6AXPAXI@Z@Z
?NFS_Free@internal@tbb@@YAXPAX@Z
?NFS_Allocate@internal@tbb@@YAPAXIIPAX@Z
?note_affinity@task@tbb@@UAEXG@Z
?internal_capacity@concurrent_vector_base_v3@internal@tbb@@IBEIXZ
?destroy@task_base@internal@interface5@tbb@@SAXAAVtask@4@@Z
?free@allocate_child_proxy@internal@tbb@@QBEXAAVtask@3@@Z
?allocate@allocate_child_proxy@internal@tbb@@QBEAAVtask@3@I@Z
?free@allocate_root_with_context_proxy@internal@tbb@@QBEXAAVtask@3@@Z
?allocate@allocate_root_with_context_proxy@internal@tbb@@QBEAAVtask@3@I@Z
?init@task_group_context@tbb@@IAEXXZ
??1concurrent_vector_base_v3@internal@tbb@@IAE@XZ
??1task_group_context@tbb@@QAE@XZ

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

rpcrt4

UuidFromStringA
RpcStringFreeW
UuidToStringW
UuidCreate

ws2_32

WSAGetLastError
htons
getservbyname
htonl
inet_ntoa
ntohs
getservbyport
inet_addr
closesocket
recv
send
socket
WSAAsyncSelect
connect
WSASetLastError
WSACleanup
gethostname
gethostbyaddr
gethostbyname
WSAStartup

imm32

ImmGetDefaultIMEWnd
ImmGetContext
ImmGetConversionStatus
ImmReleaseContext
ImmGetOpenStatus
ImmSetConversionStatus

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvCertFromChain

crypt32

CertGetNameStringW

wininet

HttpSendRequestExA
InternetCloseHandle
HttpOpenRequestW
HttpQueryInfoW
HttpAddRequestHeadersW
HttpSendRequestW
HttpAddRequestHeadersA
InternetConnectW
InternetConnectA
InternetWriteFile
HttpOpenRequestA
InternetOpenUrlW
InternetQueryDataAvailable
InternetOpenW
InternetGetCookieW
InternetCrackUrlA
InternetSetOptionW
InternetCrackUrlW
InternetSetCookieW
HttpSendRequestA
InternetOpenA
HttpEndRequestW
InternetCanonicalizeUrlW
InternetCreateUrlW
InternetReadFile
InternetAttemptConnect

iphlpapi

GetAdaptersInfo

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

Sections

.text
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 114KB - Virtual size: 72.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.GOMSH
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 398KB - Virtual size: 398KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d655168a049d323d138e5d81c393481

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

59:b4:f8:8a:ac:be:29:b5:c1:ae:33:40:c2:c0:f2:44Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

b2:f1:e7:43:e1:ee:4d:34:d0:fe:ca:7d:85:e0:6c:36:39:fc:08:d9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winmm

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

urlmon

gdiplus

opengl32

glu32

tbb

setupapi

version

rpcrt4

ws2_32

imm32

wintrust

crypt32

wininet

iphlpapi

oleacc

Sections

.text Size: 5.1MB - Virtual size: 5.1MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 114KB - Virtual size: 72.8MB

.GOMSH Size: 512B - Virtual size: 12B

.rsrc Size: 3.2MB - Virtual size: 3.2MB

.reloc Size: 398KB - Virtual size: 398KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

59:b4:f8:8a:ac:be:29:b5:c1:ae:33:40:c2:c0:f2:44
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

b2:f1:e7:43:e1:ee:4d:34:d0:fe:ca:7d:85:e0:6c:36:39:fc:08:d9
Signer

.text
Size: 5.1MB - Virtual size: 5.1MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 114KB - Virtual size: 72.8MB

.GOMSH
Size: 512B - Virtual size: 12B

.rsrc
Size: 3.2MB - Virtual size: 3.2MB

.reloc
Size: 398KB - Virtual size: 398KB