f5e8af0f25ae8499fe6fb3082961d588698a5f21921f0c3a7309cd6d8560481a

Sharing

Copy URL Twitter E-mail

General

Target

f5e8af0f25ae8499fe6fb3082961d588698a5f21921f0c3a7309cd6d8560481a
Size

3.9MB
MD5

695c995123724b5c86ce8f9c0a63e8a9
SHA1

9c536b29da26d1947c2ddcf03f8371114e0bd4c8
SHA256

f5e8af0f25ae8499fe6fb3082961d588698a5f21921f0c3a7309cd6d8560481a
SHA512

41f8233ab3a1dcb1b8b7c8582d3f1e86166d04f2aa4275ebb9f876cb8fd07a4b6b9d27fd8d32bed28f170cab0b31bc66b14edf47f55636efd6b862e3935172b0
SSDEEP

49152:Yx3GL9R/5q/lBB/RkPZfh/Yh78+JCLw2+Oi7mioj+Xs/VL7CogKT+pLTosfMyWV:YhGL9R/5q/lBB/RkPlh/uH2+OiZZwV

Score

1^/10

Malware Config

Signatures

Files

f5e8af0f25ae8499fe6fb3082961d588698a5f21921f0c3a7309cd6d8560481a
.exe windows:6 windows x86 arch:x86

4f826c976807813cf49957d10cdb4aa6

Code Sign

0a:de:81:14:d7:67:9b:06:6f:2d:b2:df:d2:f6:7a:c2
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05/04/2021, 00:00

Not After

05/04/2023, 23:59

Subject

CN=Intel Corporation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

74:e6:b8:93:40:97:f8:e6:ce:44:5f:60:6d:d0:2a:98:16:bd:23:62:bb:33:48:f2:12:3c:dd:d5:45:f3:ad:ba
Signer

Actual PE Digest

74:e6:b8:93:40:97:f8:e6:ce:44:5f:60:6d:d0:2a:98:16:bd:23:62:bb:33:48:f2:12:3c:dd:d5:45:f3:ad:ba

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\buildagent-cd_8811\p4\993441124\services\AMTSW\UNS\Release\LMS.pdb

Imports

wsock32

inet_addr
htonl

advapi32

RegisterServiceCtrlHandlerExW
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
OpenThreadToken
CopySid
GetLengthSid
GetTokenInformation
InitializeSecurityDescriptor
IsValidSid
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
ChangeServiceConfigW
ChangeServiceConfig2W
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
SetServiceStatus
StartServiceCtrlDispatcherW
CreateWellKnownSid
EqualSid
LookupAccountSidW
ConvertSidToStringSidW
FreeSid
RegSetKeySecurity
SetEntriesInAclW
AllocateAndInitializeSid
RegDeleteKeyExW
SetSecurityDescriptorDacl
AdjustTokenPrivileges
InitiateSystemShutdownExW
RegCreateKeyW

user32

CharUpperW
CharNextW
MessageBoxW
UnregisterDeviceNotification
PostThreadMessageW
RegisterDeviceNotificationW
LoadStringW
GetMessageW
TranslateMessage
DispatchMessageW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

cfgmgr32

CM_Get_Device_Interface_ListA
CM_Get_Device_Interface_List_SizeA

iphlpapi

GetPerAdapterInfo
GetIpAddrTable
GetAdaptersInfo
CancelIPChangeNotify
NotifyRouteChange
CancelMibChangeNotify2
GetAdaptersAddresses
NotifyIpInterfaceChange
GetExtendedTcpTable
SetTcpEntry
GetInterfaceInfo
IpRenewAddress

winhttp

WinHttpAddRequestHeaders
WinHttpOpen
WinHttpOpenRequest
WinHttpSendRequest
WinHttpSetCredentials
WinHttpQueryHeaders
WinHttpReadData
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpConnect
WinHttpQueryAuthSchemes

wintrust

WinVerifyTrust

powrprof

PowerReadACValue
SetSuspendState
PowerReadDCValue
GetPwrCapabilities

ws2_32

WSAEventSelect
WSAEnumNetworkEvents
WSACloseEvent
WSACleanup
accept
bind
closesocket
WSASend
shutdown
listen
WSAAccept
WSAStartup
getpeername
getsockname
send
ntohs
connect
recv
getsockopt
setsockopt
__WSAFDIsSet
gethostname
WSAGetLastError
ioctlsocket
getnameinfo
freeaddrinfo
getservbyname
htons
socket
ntohl
gethostbyaddr
getaddrinfo
gethostbyname
inet_addr
getservbyport
WSASetLastError
WSAAddressToStringA
WSACreateEvent
select

kernel32

EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapReAlloc
HeapSize
ReadConsoleW
GetConsoleMode
GetConsoleCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
GetDriveTypeW
GetCurrentDirectoryW
SetEnvironmentVariableW
GetFileType
SetStdHandle
FreeLibraryAndExitThread
ExitThread
GetFullPathNameW
VirtualAlloc
OutputDebugStringW
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTickCount
GetStringTypeW
SwitchToThread
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EncodePointer
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
VirtualFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
FreeEnvironmentStringsW
WriteConsoleW
GetModuleHandleExW
CreateTimerQueue
Sleep
SetDllDirectoryW
ExpandEnvironmentStringsW
GetLastError
GetCommandLineW
DecodePointer
CloseHandle
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
GetCurrentProcess
CreateThread
GetCurrentThread
GetCurrentThreadId
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
MultiByteToWideChar
LocalAlloc
LocalFree
FormatMessageW
IsWow64Process
GetComputerNameExA
GetFinalPathNameByHandleW
CreateFileW
LoadLibraryW
lstrlenW
GetACP
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
TerminateProcess
GetStdHandle
ExitProcess
GetEnvironmentStringsW
DuplicateHandle
GetVersionExW
GlobalAlloc
GlobalFree
TryEnterCriticalSection
TlsSetValue
ReleaseSemaphore
SignalObjectAndWait
SetThreadPriority
InitializeCriticalSection
CreateMutexA
ReleaseMutex
SuspendThread
ResumeThread
GetExitCodeThread
TlsAlloc
GetThreadPriority
ResetEvent
GetThreadId
GetCurrentProcessId
CreateSemaphoreW
TlsGetValue
TlsFree
CreateEventA
SetLastError
UnlockFileEx
SetFilePointerEx
LockFileEx
ReadFile
WriteFile
SetFilePointer
SetEndOfFile
GetSystemInfo
GetOverlappedResult
GetComputerNameA
FlushFileBuffers
GetSystemTimeAsFileTime
GetTimeZoneInformation
QueryPerformanceCounter
WaitForMultipleObjects
WaitForMultipleObjectsEx
CreateFileA
GetFileInformationByHandle
OutputDebugStringA
CancelIo
HeapAlloc
HeapFree
GetProcessHeap
DeviceIoControl
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
LoadLibraryA
GetSystemPowerStatus
VerSetConditionMask
VerifyVersionInfoW
GetSystemDefaultLCID
GetSystemTime
VirtualProtect
VirtualQuery
LoadLibraryExA
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
FindFirstFileW
GetFileAttributesW
CreateMutexW

shell32

SHGetSpecialFolderPathW

ole32

CoInitializeEx
CoSetProxyBlanket
CoRegisterClassObject
PropVariantClear
CoRevertToSelf
CoImpersonateClient
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoInitializeSecurity
CoReleaseServerProcess
CoAddRefServerProcess
CoResumeClassObjects
CoRevokeClassObject
CoUninitialize
CoCreateInstance

oleaut32

SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreateVector
SafeArrayCreate
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
VarBstrCat
LoadRegTypeLi
SafeArrayPutElement
SafeArrayUnlock
SysAllocString
SysFreeString
VariantInit
VariantClear
SysStringLen
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi
SysAllocStringLen
SafeArrayLock

crypt32

CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptQueryObject
CertGetNameStringW
CryptMsgClose
CertFreeCertificateContext
CertOpenStore

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

Exports

Exports

UTF8ToHtml
UTF8Toisolat1
_GetDriverVersion@8
_TeeConnect@4
_TeeDisconnect@4
_TeeFWStatus@12
_TeeGetDeviceHandle@4
_TeeInit@12
_TeeInitGUID@12
_TeeInitHandle@12
_TeeRead@20
_TeeWrite@20
__docbDefaultSAXHandler
__htmlDefaultSAXHandler
__oldXMLWDcompatibility
__xmlBufferAllocScheme
__xmlDefaultBufferSize
__xmlDefaultSAXHandler
__xmlDefaultSAXLocator
__xmlDeregisterNodeDefaultValue
__xmlDoValidityCheckingDefaultValue
__xmlErrEncoding
__xmlGenericError
__xmlGenericErrorContext
__xmlGetWarningsDefaultValue
__xmlIndentTreeOutput
__xmlKeepBlanksDefaultValue
__xmlLastError
__xmlLineNumbersDefaultValue
__xmlLoadExtDtdDefaultValue
__xmlOutputBufferCreateFilenameValue
__xmlParserDebugEntities
__xmlParserInputBufferCreateFilenameValue
__xmlParserVersion
__xmlPedanticParserDefaultValue
__xmlRaiseError
__xmlRegisterNodeDefaultValue
__xmlSaveNoEmptyTags
__xmlSimpleError
__xmlStructuredError
__xmlStructuredErrorContext
__xmlSubstituteEntitiesDefaultValue
__xmlTreeIndentString
docbDefaultSAXHandlerInit
htmlAttrAllowed
htmlAutoCloseTag
htmlCreateFileParserCtxt
htmlCreateMemoryParserCtxt
htmlCreatePushParserCtxt
htmlCtxtReadDoc
htmlCtxtReadFd
htmlCtxtReadFile
htmlCtxtReadIO
htmlCtxtReadMemory
htmlCtxtReset
htmlCtxtUseOptions
htmlDefaultSAXHandlerInit
htmlDocContentDumpFormatOutput
htmlDocContentDumpOutput
htmlDocDump
htmlDocDumpMemory
htmlDocDumpMemoryFormat
htmlElementAllowedHere
htmlElementStatusHere
htmlEncodeEntities
htmlEntityLookup
htmlEntityValueLookup
htmlFreeParserCtxt
htmlGetMetaEncoding
htmlHandleOmittedElem
htmlInitAutoClose
htmlIsAutoClosed
htmlIsBooleanAttr
htmlIsScriptAttribute
htmlNewDoc
htmlNewDocNoDtD
htmlNewParserCtxt
htmlNodeDump
htmlNodeDumpFile
htmlNodeDumpFileFormat
htmlNodeDumpFormatOutput
htmlNodeDumpOutput
htmlNodeStatus
htmlParseCharRef
htmlParseChunk
htmlParseDoc
htmlParseDocument
htmlParseElement
htmlParseEntityRef
htmlParseFile
htmlReadDoc
htmlReadFd
htmlReadFile
htmlReadIO
htmlReadMemory
htmlSAXParseDoc
htmlSAXParseFile
htmlSaveFile
htmlSaveFileEnc
htmlSaveFileFormat
htmlSetMetaEncoding
htmlTagLookup
initGenericErrorDefaultFunc
initdocbDefaultSAXHandler
inithtmlDefaultSAXHandler
initxmlDefaultSAXHandler
inputPop
inputPush
isolat1ToUTF8
namePop
namePush
nodePop
nodePush
valuePop
valuePush
xmlACatalogAdd
xmlACatalogDump
xmlACatalogRemove
xmlACatalogResolve
xmlACatalogResolvePublic
xmlACatalogResolveSystem
xmlACatalogResolveURI
xmlAddAttributeDecl
xmlAddChild
xmlAddChildList
xmlAddDocEntity
xmlAddDtdEntity
xmlAddElementDecl
xmlAddEncodingAlias
xmlAddID
xmlAddNextSibling
xmlAddNotationDecl
xmlAddPrevSibling
xmlAddRef
xmlAddSibling
xmlAllocOutputBuffer
xmlAllocParserInputBuffer
xmlAttrSerializeTxtContent
xmlAutomataCompile
xmlAutomataGetInitState
xmlAutomataIsDeterminist
xmlAutomataNewAllTrans
xmlAutomataNewCountTrans
xmlAutomataNewCountTrans2
xmlAutomataNewCountedTrans
xmlAutomataNewCounter
xmlAutomataNewCounterTrans
xmlAutomataNewEpsilon
xmlAutomataNewNegTrans
xmlAutomataNewOnceTrans
xmlAutomataNewOnceTrans2
xmlAutomataNewState
xmlAutomataNewTransition
xmlAutomataNewTransition2
xmlAutomataSetFinalState
xmlBoolToText
xmlBufContent
xmlBufEnd
xmlBufGetNodeContent
xmlBufNodeDump
xmlBufShrink
xmlBufUse
xmlBufferAdd
xmlBufferAddHead
xmlBufferCCat
xmlBufferCat
xmlBufferContent
xmlBufferCreate
xmlBufferCreateSize
xmlBufferCreateStatic
xmlBufferDetach
xmlBufferDump
xmlBufferEmpty
xmlBufferFree
xmlBufferGrow
xmlBufferLength
xmlBufferResize
xmlBufferSetAllocationScheme
xmlBufferShrink
xmlBufferWriteCHAR
xmlBufferWriteChar
xmlBufferWriteQuotedString
xmlBuildQName
xmlBuildRelativeURI
xmlBuildURI
xmlByteConsumed
xmlCanonicPath
xmlCatalogAdd
xmlCatalogAddLocal
xmlCatalogCleanup
xmlCatalogConvert
xmlCatalogDump
xmlCatalogFreeLocal
xmlCatalogGetDefaults
xmlCatalogGetPublic
xmlCatalogGetSystem
xmlCatalogIsEmpty
xmlCatalogLocalResolve
xmlCatalogLocalResolveURI
xmlCatalogRemove
xmlCatalogResolve
xmlCatalogResolvePublic
xmlCatalogResolveSystem
xmlCatalogResolveURI
xmlCatalogSetDebug
xmlCatalogSetDefaultPrefer
xmlCatalogSetDefaults
xmlCharEncCloseFunc
xmlCharEncFirstLine
xmlCharEncInFunc
xmlCharEncOutFunc
xmlCharInRange
xmlCharStrdup
xmlCharStrndup
xmlCheckFilename
xmlCheckHTTPInput
xmlCheckLanguageID
xmlCheckUTF8
xmlCheckVersion
xmlChildElementCount
xmlCleanupCharEncodingHandlers
xmlCleanupEncodingAliases
xmlCleanupGlobals
xmlCleanupInputCallbacks
xmlCleanupMemory
xmlCleanupOutputCallbacks
xmlCleanupParser
xmlCleanupThreads
xmlClearNodeInfoSeq
xmlClearParserCtxt
xmlConvertSGMLCatalog
xmlCopyAttributeTable
xmlCopyChar
xmlCopyCharMultiByte
xmlCopyDoc
xmlCopyDocElementContent
xmlCopyDtd
xmlCopyElementContent
xmlCopyElementTable
xmlCopyEntitiesTable
xmlCopyEnumeration
xmlCopyError
xmlCopyNamespace
xmlCopyNamespaceList
xmlCopyNode
xmlCopyNodeList
xmlCopyNotationTable
xmlCopyProp
xmlCopyPropList
xmlCreateDocParserCtxt
xmlCreateEntitiesTable
xmlCreateEntityParserCtxt
xmlCreateEnumeration
xmlCreateFileParserCtxt
xmlCreateIOParserCtxt
xmlCreateIntSubset
xmlCreateMemoryParserCtxt
xmlCreatePushParserCtxt
xmlCreateURI
xmlCreateURLParserCtxt
xmlCtxtGetLastError
xmlCtxtReadDoc
xmlCtxtReadFd
xmlCtxtReadFile
xmlCtxtReadIO
xmlCtxtReadMemory
xmlCtxtReset
xmlCtxtResetLastError
xmlCtxtResetPush
xmlCtxtUseOptions
xmlCurrentChar
xmlDOMWrapAdoptNode
xmlDOMWrapCloneNode
xmlDOMWrapFreeCtxt
xmlDOMWrapNewCtxt
xmlDOMWrapReconcileNamespaces
xmlDOMWrapRemoveNode
xmlDebugCheckDocument
xmlDebugDumpAttr
xmlDebugDumpAttrList
xmlDebugDumpDTD
xmlDebugDumpDocument
xmlDebugDumpDocumentHead
xmlDebugDumpEntities
xmlDebugDumpNode
xmlDebugDumpNodeList
xmlDebugDumpOneNode
xmlDebugDumpString
xmlDefaultSAXHandlerInit
xmlDelEncodingAlias
xmlDeregisterNodeDefault
xmlDetectCharEncoding
xmlDictCleanup
xmlDictCreate
xmlDictCreateSub
xmlDictExists
xmlDictFree
xmlDictGetUsage
xmlDictLookup
xmlDictOwns
xmlDictQLookup
xmlDictReference
xmlDictSetLimit
xmlDictSize
xmlDocCopyNode
xmlDocCopyNodeList
xmlDocDump
xmlDocDumpFormatMemory
xmlDocDumpFormatMemoryEnc
xmlDocDumpMemory
xmlDocDumpMemoryEnc
xmlDocFormatDump
xmlDocGetRootElement
xmlDocSetRootElement
xmlDumpAttributeDecl
xmlDumpAttributeTable
xmlDumpElementDecl
xmlDumpElementTable
xmlDumpEntitiesTable
xmlDumpEntityDecl
xmlDumpNotationDecl
xmlDumpNotationTable
xmlElemDump
xmlEncodeEntitiesReentrant
xmlEncodeSpecialChars
xmlErrMemory
xmlEscapeFormatString
xmlFileClose
xmlFileMatch
xmlFileOpen
xmlFileRead
xmlFindCharEncodingHandler
xmlFirstElementChild
xmlFree
xmlFreeAttributeTable
xmlFreeAutomata
xmlFreeCatalog
xmlFreeDoc
xmlFreeDocElementContent
xmlFreeDtd
xmlFreeElementContent
xmlFreeElementTable
xmlFreeEntitiesTable
xmlFreeEnumeration
xmlFreeIDTable
xmlFreeInputStream
xmlFreeMutex
xmlFreeNode
xmlFreeNodeList
xmlFreeNotationTable
xmlFreeNs
xmlFreeNsList
xmlFreeParserCtxt
xmlFreeParserInputBuffer
xmlFreePattern
xmlFreePatternList
xmlFreeProp
xmlFreePropList
xmlFreeRMutex
xmlFreeRefTable
xmlFreeStreamCtxt
xmlFreeTextReader
xmlFreeURI
xmlFreeValidCtxt
xmlGcMemGet
xmlGcMemSetup
xmlGetBufferAllocationScheme
xmlGetCharEncodingHandler
xmlGetCharEncodingName
xmlGetCompressMode
xmlGetDocCompressMode
xmlGetDocEntity
xmlGetDtdAttrDesc
xmlGetDtdElementDesc
xmlGetDtdEntity
xmlGetDtdNotationDesc
xmlGetDtdQAttrDesc
xmlGetDtdQElementDesc
xmlGetEncodingAlias
xmlGetExternalEntityLoader
xmlGetGlobalState
xmlGetID
xmlGetIntSubset
xmlGetLastChild
xmlGetLastError
xmlGetLineNo
xmlGetNoNsProp
xmlGetNodePath
xmlGetNsList
xmlGetNsProp
xmlGetParameterEntity
xmlGetPredefinedEntity
xmlGetProp
xmlGetRefs
xmlGetThreadId
xmlGetUTF8Char
xmlHasFeature
xmlHasNsProp
xmlHasProp
xmlHashAddEntry
xmlHashAddEntry2
xmlHashAddEntry3
xmlHashCopy
xmlHashCreate
xmlHashCreateDict
xmlHashDefaultDeallocator
xmlHashFree
xmlHashLookup
xmlHashLookup2
xmlHashLookup3
xmlHashQLookup
xmlHashQLookup2
xmlHashQLookup3
xmlHashRemoveEntry
xmlHashRemoveEntry2
xmlHashRemoveEntry3
xmlHashScan
xmlHashScan3
xmlHashScanFull
xmlHashScanFull3
xmlHashSize
xmlHashUpdateEntry
xmlHashUpdateEntry2
xmlHashUpdateEntry3
xmlIOFTPClose
xmlIOFTPMatch
xmlIOFTPOpen
xmlIOFTPRead
xmlIOHTTPClose
xmlIOHTTPMatch
xmlIOHTTPOpen
xmlIOHTTPOpenW
xmlIOHTTPRead
xmlIOParseDTD
xmlInitCharEncodingHandlers
xmlInitGlobals
xmlInitMemory
xmlInitNodeInfoSeq
xmlInitParser
xmlInitParserCtxt
xmlInitThreads
xmlInitializeCatalog
xmlInitializeDict
xmlInitializeGlobalState
xmlIsBaseChar
xmlIsBaseCharGroup
xmlIsBlank
xmlIsBlankNode
xmlIsChar
xmlIsCharGroup
xmlIsCombining
xmlIsCombiningGroup
xmlIsDigit
xmlIsDigitGroup
xmlIsExtender
xmlIsExtenderGroup
xmlIsID
xmlIsIdeographic
xmlIsIdeographicGroup
xmlIsLetter
xmlIsMainThread
xmlIsMixedElement
xmlIsPubidChar
xmlIsPubidChar_tab
xmlIsRef
xmlIsXHTML
xmlKeepBlanksDefault
xmlLastElementChild
xmlLineNumbersDefault
xmlLinkGetData
xmlListAppend
xmlListClear
xmlListCopy
xmlListCreate
xmlListDelete
xmlListDup
xmlListEmpty
xmlListEnd
xmlListFront
xmlListInsert
xmlListMerge
xmlListPopBack
xmlListPopFront
xmlListPushBack
xmlListPushFront
xmlListRemoveAll
xmlListRemoveFirst
xmlListRemoveLast
xmlListReverse
xmlListReverseSearch
xmlListReverseWalk
xmlListSearch
xmlListSize
xmlListSort
xmlListWalk
xmlLoadACatalog
xmlLoadCatalog
xmlLoadCatalogs
xmlLoadExternalEntity
xmlLoadSGMLSuperCatalog

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 889KB - Virtual size: 889KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 189KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f826c976807813cf49957d10cdb4aa6

Code Sign

0a:de:81:14:d7:67:9b:06:6f:2d:b2:df:d2:f6:7a:c2Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

74:e6:b8:93:40:97:f8:e6:ce:44:5f:60:6d:d0:2a:98:16:bd:23:62:bb:33:48:f2:12:3c:dd:d5:45:f3:ad:baSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wsock32

advapi32

user32

version

cfgmgr32

iphlpapi

winhttp

wintrust

powrprof

ws2_32

kernel32

shell32

ole32

oleaut32

crypt32

rpcrt4

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 889KB - Virtual size: 889KB

.data Size: 189KB - Virtual size: 216KB

.didat Size: 512B - Virtual size: 32B

.rsrc Size: 35KB - Virtual size: 35KB

.reloc Size: 232KB - Virtual size: 232KB

0a:de:81:14:d7:67:9b:06:6f:2d:b2:df:d2:f6:7a:c2
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

74:e6:b8:93:40:97:f8:e6:ce:44:5f:60:6d:d0:2a:98:16:bd:23:62:bb:33:48:f2:12:3c:dd:d5:45:f3:ad:ba
Signer

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 889KB - Virtual size: 889KB

.data
Size: 189KB - Virtual size: 216KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 35KB - Virtual size: 35KB

.reloc
Size: 232KB - Virtual size: 232KB