346b2602aef791eac3b5324833b0b5818477536e5ebdf34833ddaebd7b41376b

Sharing

Copy URL Twitter E-mail

General

Target

346b2602aef791eac3b5324833b0b5818477536e5ebdf34833ddaebd7b41376b
Size

2.1MB
MD5

69cb46cfc01148457cdd3b0753e459d6
SHA1

5f63d134a58768739bbfed102efe8d9861791065
SHA256

346b2602aef791eac3b5324833b0b5818477536e5ebdf34833ddaebd7b41376b
SHA512

0738b3f011685ec78ed3f66648d06f88bda9e2912b09882a626d88d172ba868d2105ed98df0c7f8141a3377be1b5b3483060c021a3f1c5c88fbc5b45780527a8
SSDEEP

24576:67yrxWWu1XnVxawuAfCTwJpNAvklxMfW+J+FN6WyjrDt4XjkxC2DiF6pC:yyrmKfMJpNJ0R5Wq+TkCZ60

Score

1^/10

Malware Config

Signatures

Files

346b2602aef791eac3b5324833b0b5818477536e5ebdf34833ddaebd7b41376b
.dll windows:10 windows x64 arch:x64

db6b5f2defd1befa5999abd93fcdbd42

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f5:71:25:c1:3d:cc:ca:8e:6b:05:11:d9:b1:b8:06:db:20:90:3a:92:94:5c:5f:6c:91:5e:30:58:43:19:89:0f
Signer

Actual PE Digest

f5:71:25:c1:3d:cc:ca:8e:6b:05:11:d9:b1:b8:06:db:20:90:3a:92:94:5c:5f:6c:91:5e:30:58:43:19:89:0f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WindowsCodecs.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
__intrinsic_setjmp
_o__wcsicmp
_o__wcsnicmp
_o_atan2
_o_calloc
_o_ceilf
_o_exit
_o_exp
_o_floorf
_o_fread
_o_free
_o_getenv_s
_o_ldexp
_o_log
_o_malloc
_o_powf
_o_qsort
_o_rand
_o_realloc
_o_sqrt
_o_strcpy_s
__C_specific_handler
_o__execute_onexit_table
_o__errno
__std_type_info_compare
wcsstr
strstr
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__aligned_realloc
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___acrt_iob_func
memcmp
memmove
memcpy

api-ms-win-crt-string-l1-1-0

wcscmp
memset
strncmp
strcmp

api-ms-win-core-marshal-l1-1-0

HBITMAP_UserUnmarshal
HICON_UserUnmarshal
HICON_UserFree
HICON_UserSize
CLIPFORMAT_UserFree
CLIPFORMAT_UserUnmarshal
HBITMAP_UserFree
HPALETTE_UserUnmarshal
HPALETTE_UserFree
HBITMAP_UserSize
CLIPFORMAT_UserMarshal
HBITMAP_UserMarshal
HPALETTE_UserMarshal
CLIPFORMAT_UserSize
HPALETTE_UserSize
HICON_UserMarshal

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
ObjectStublessClient4

api-ms-win-core-synch-l1-1-0

CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockShared
ReleaseSemaphore
CreateEventW
WaitForSingleObjectEx
OpenSemaphoreW
SetEvent
DeleteCriticalSection
WaitForSingleObject
SleepEx
AcquireSRWLockShared
ReleaseSRWLockExclusive
ReleaseMutex
LeaveCriticalSection
AcquireSRWLockExclusive
EnterCriticalSection
ResetEvent
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleExA
LoadLibraryExW
GetModuleFileNameA
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
OpenThreadToken
GetCurrentThread
SetThreadToken
GetCurrentProcessId
OpenProcessToken

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetVersionExW
GetTickCount
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCaptureStackBackTrace

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-crt-math-l1-1-0

_isnan
_finite

api-ms-win-core-com-l1-1-0

CoCreateInstance
CreateStreamOnHGlobal
GetHGlobalFromStream
IIDFromString
PropVariantCopy
CoGetApartmentType
CoLockObjectExternal
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
PropVariantClear

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
FormatMessageW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-file-l1-1-0

SetFilePointerEx
WriteFile
ReadFile
SetEndOfFile
CreateFileW
GetFileInformationByHandle
SetFilePointer
GetFileSize
GetFileType

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-memory-l1-1-0

VirtualAlloc
UnmapViewOfFile
MapViewOfFileEx
VirtualFree

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

ntdll

RtlInitializeBitMap
RtlSetBits
RtlDllShutdownInProgress
DbgPrintEx

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock
GlobalSize

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-normalization-l1-1-0

GetStringScripts

api-ms-win-core-stringansi-l1-1-0

IsCharAlphaNumericA

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileMappingA

Exports

Exports

DllCanUnloadNow
DllFreeCodecResources
DllGetClassObject
IEnumString_Next_WIC_Proxy
IEnumString_Reset_WIC_Proxy
IPropertyBag2_Write_Proxy
IWICBitmapClipper_Initialize_Proxy
IWICBitmapCodecInfo_DoesSupportAnimation_Proxy
IWICBitmapCodecInfo_DoesSupportLossless_Proxy
IWICBitmapCodecInfo_DoesSupportMultiframe_Proxy
IWICBitmapCodecInfo_GetContainerFormat_Proxy
IWICBitmapCodecInfo_GetDeviceManufacturer_Proxy
IWICBitmapCodecInfo_GetDeviceModels_Proxy
IWICBitmapCodecInfo_GetFileExtensions_Proxy
IWICBitmapCodecInfo_GetMimeTypes_Proxy
IWICBitmapDecoder_CopyPalette_Proxy
IWICBitmapDecoder_GetColorContexts_Proxy
IWICBitmapDecoder_GetDecoderInfo_Proxy
IWICBitmapDecoder_GetFrameCount_Proxy
IWICBitmapDecoder_GetFrame_Proxy
IWICBitmapDecoder_GetMetadataQueryReader_Proxy
IWICBitmapDecoder_GetPreview_Proxy
IWICBitmapDecoder_GetThumbnail_Proxy
IWICBitmapEncoder_Commit_Proxy
IWICBitmapEncoder_CreateNewFrame_Proxy
IWICBitmapEncoder_GetEncoderInfo_Proxy
IWICBitmapEncoder_GetMetadataQueryWriter_Proxy
IWICBitmapEncoder_Initialize_Proxy
IWICBitmapEncoder_SetPalette_Proxy
IWICBitmapEncoder_SetThumbnail_Proxy
IWICBitmapFlipRotator_Initialize_Proxy
IWICBitmapFrameDecode_GetColorContexts_Proxy
IWICBitmapFrameDecode_GetMetadataQueryReader_Proxy
IWICBitmapFrameDecode_GetThumbnail_Proxy
IWICBitmapFrameEncode_Commit_Proxy
IWICBitmapFrameEncode_GetMetadataQueryWriter_Proxy
IWICBitmapFrameEncode_Initialize_Proxy
IWICBitmapFrameEncode_SetColorContexts_Proxy
IWICBitmapFrameEncode_SetResolution_Proxy
IWICBitmapFrameEncode_SetSize_Proxy
IWICBitmapFrameEncode_SetThumbnail_Proxy
IWICBitmapFrameEncode_WriteSource_Proxy
IWICBitmapLock_GetDataPointer_STA_Proxy
IWICBitmapLock_GetStride_Proxy
IWICBitmapScaler_Initialize_Proxy
IWICBitmapSource_CopyPalette_Proxy
IWICBitmapSource_CopyPixels_Proxy
IWICBitmapSource_GetPixelFormat_Proxy
IWICBitmapSource_GetResolution_Proxy
IWICBitmapSource_GetSize_Proxy
IWICBitmap_Lock_Proxy
IWICBitmap_SetPalette_Proxy
IWICBitmap_SetResolution_Proxy
IWICColorContext_InitializeFromMemory_Proxy
IWICComponentFactory_CreateMetadataWriterFromReader_Proxy
IWICComponentFactory_CreateQueryWriterFromBlockWriter_Proxy
IWICComponentInfo_GetAuthor_Proxy
IWICComponentInfo_GetCLSID_Proxy
IWICComponentInfo_GetFriendlyName_Proxy
IWICComponentInfo_GetSpecVersion_Proxy
IWICComponentInfo_GetVersion_Proxy
IWICFastMetadataEncoder_Commit_Proxy
IWICFastMetadataEncoder_GetMetadataQueryWriter_Proxy
IWICFormatConverter_Initialize_Proxy
IWICImagingFactory_CreateBitmapClipper_Proxy
IWICImagingFactory_CreateBitmapFlipRotator_Proxy
IWICImagingFactory_CreateBitmapFromHBITMAP_Proxy
IWICImagingFactory_CreateBitmapFromHICON_Proxy
IWICImagingFactory_CreateBitmapFromMemory_Proxy
IWICImagingFactory_CreateBitmapFromSource_Proxy
IWICImagingFactory_CreateBitmapScaler_Proxy
IWICImagingFactory_CreateBitmap_Proxy
IWICImagingFactory_CreateComponentInfo_Proxy
IWICImagingFactory_CreateDecoderFromFileHandle_Proxy
IWICImagingFactory_CreateDecoderFromFilename_Proxy
IWICImagingFactory_CreateDecoderFromStream_Proxy
IWICImagingFactory_CreateEncoder_Proxy
IWICImagingFactory_CreateFastMetadataEncoderFromDecoder_Proxy
IWICImagingFactory_CreateFastMetadataEncoderFromFrameDecode_Proxy
IWICImagingFactory_CreateFormatConverter_Proxy
IWICImagingFactory_CreatePalette_Proxy
IWICImagingFactory_CreateQueryWriterFromReader_Proxy
IWICImagingFactory_CreateQueryWriter_Proxy
IWICImagingFactory_CreateStream_Proxy
IWICMetadataBlockReader_GetCount_Proxy
IWICMetadataBlockReader_GetReaderByIndex_Proxy
IWICMetadataQueryReader_GetContainerFormat_Proxy
IWICMetadataQueryReader_GetEnumerator_Proxy
IWICMetadataQueryReader_GetLocation_Proxy
IWICMetadataQueryReader_GetMetadataByName_Proxy
IWICMetadataQueryWriter_RemoveMetadataByName_Proxy
IWICMetadataQueryWriter_SetMetadataByName_Proxy
IWICPalette_GetColorCount_Proxy
IWICPalette_GetColors_Proxy
IWICPalette_GetType_Proxy
IWICPalette_HasAlpha_Proxy
IWICPalette_InitializeCustom_Proxy
IWICPalette_InitializeFromBitmap_Proxy
IWICPalette_InitializeFromPalette_Proxy
IWICPalette_InitializePredefined_Proxy
IWICPixelFormatInfo_GetBitsPerPixel_Proxy
IWICPixelFormatInfo_GetChannelCount_Proxy
IWICPixelFormatInfo_GetChannelMask_Proxy
IWICStream_InitializeFromIStream_Proxy
IWICStream_InitializeFromMemory_Proxy
WICConvertBitmapSource
WICCreateBitmapFromSection
WICCreateBitmapFromSectionEx
WICCreateColorContext_Proxy
WICCreateImagingFactory_Proxy
WICGetMetadataContentSize
WICMapGuidToShortName
WICMapSchemaToName
WICMapShortNameToGuid
WICMatchMetadataContent
WICSerializeMetadataContent
WICSetEncoderFormat_Proxy

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 544KB - Virtual size: 543KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db6b5f2defd1befa5999abd93fcdbd42

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

f5:71:25:c1:3d:cc:ca:8e:6b:05:11:d9:b1:b8:06:db:20:90:3a:92:94:5c:5f:6c:91:5e:30:58:43:19:89:0fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-marshal-l1-1-0

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-crt-math-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

ntdll

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-normalization-l1-1-0

api-ms-win-core-stringansi-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

RT_CODE Size: 4KB - Virtual size: 2KB

fothk Size: 4KB - Virtual size: 4KB

.rdata Size: 544KB - Virtual size: 543KB

.data Size: 16KB - Virtual size: 16KB

.pdata Size: 60KB - Virtual size: 57KB

.didat Size: 4KB - Virtual size: 592B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 19KB

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

f5:71:25:c1:3d:cc:ca:8e:6b:05:11:d9:b1:b8:06:db:20:90:3a:92:94:5c:5f:6c:91:5e:30:58:43:19:89:0f
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

RT_CODE
Size: 4KB - Virtual size: 2KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 544KB - Virtual size: 543KB

.data
Size: 16KB - Virtual size: 16KB

.pdata
Size: 60KB - Virtual size: 57KB

.didat
Size: 4KB - Virtual size: 592B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 19KB