2024-06-05_e292b70f888a5a93be0af7a49a27a6b5_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-05_e292b70f888a5a93be0af7a49a27a6b5_mafia
Size

4.7MB
MD5

e292b70f888a5a93be0af7a49a27a6b5
SHA1

cdab20483b30292dc9b01691864fcd427c609d89
SHA256

237e53b244db622614e50bf1dc206baf386970ffd7818c65915edc128af6c5a4
SHA512

2f0b0ec6052d485feb263a8bec8b8f6c7ecfd449ddf092a9d1c69b700edcb1c01c12f0eba94d6feafffbad61c122ad124d0f9450704881ad4fcc9672d6fdc506
SSDEEP

98304:5psNz99np+PNy5EsbgHpQWWydrAiAI2c4MMShsN8ogE0VoGP5j5lD:5pUZ9AA1blWPYJjcoGP5jD

Score

1^/10

Malware Config

Signatures

Files

2024-06-05_e292b70f888a5a93be0af7a49a27a6b5_mafia
.exe windows:5 windows x86 arch:x86

b4ba118ac439dfb6845e83f791dc1dc8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:41:e8:17:66:82:66:2d:6f:24:46:6b:42:16:bc:54:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

11/12/2014, 20:19

Not After

27/12/2015, 22:38

Subject

CN=TeneBril,O=TeneBril,L=Victoria,ST=BC,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4a:ea:60:90:f3:6b:2f:9a:5a:fb:f1:d0:2d:03:38:55:a9:e4:b8:7f
Signer

Actual PE Digest

4a:ea:60:90:f3:6b:2f:9a:5a:fb:f1:d0:2d:03:38:55:a9:e4:b8:7f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Working\Clients\SpeedyPC Pro\3.2.14\bin\Release\SpeedyPC.pdb

Imports

winmm

PlaySoundW
timeGetTime

rpcrt4

UuidCreateSequential

wininet

InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetQueryDataAvailable
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
HttpAddRequestHeadersW
InternetReadFile
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetCloseHandle
InternetConnectW
InternetOpenW
InternetOpenUrlW

shfolder

SHGetFolderPathW

shell32

SHGetDiskFreeSpaceExW
ord165
SHFileOperationW
SHCreateDirectoryExW
SHGetFileInfoW
SHGetMalloc
SHQueryRecycleBinW
Shell_NotifyIconW
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
SHEmptyRecycleBinW
DragFinish
DragQueryFileW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHAppBarMessage

ole32

CoSetProxyBlanket
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
OleDraw
CreateStreamOnHGlobal
CoCreateGuid
CoFreeUnusedLibraries
CLSIDFromProgID
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CLSIDFromString
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
DoDragDrop
OleLockRunning
OleGetClipboard
RegisterDragDrop
RevokeDragDrop
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleInitialize
CoLockObjectExternal
StringFromGUID2
CoInitializeSecurity
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
OleUninitialize
CoTaskMemFree

shlwapi

PathRemoveFileSpecW
ord215
ord217
PathFileExistsW
PathIsDirectoryW
PathGetCharTypeW
StrFormatByteSizeW
PathStripPathW
PathAppendW
PathFindFileNameW
PathUnquoteSpacesW
PathAddExtensionW
PathIsNetworkPathW
PathFindExtensionW
PathFindOnPathW
SHDeleteKeyW
UrlUnescapeW
PathStripToRootW
PathIsUNCW

gdi32

CreateRectRgn
SelectClipRgn
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CopyMetaFileW
GetStockObject
CreatePatternBrush
CreateDIBSection
GetDIBits
RealizePalette
StretchBlt
SetPixel
CreateRoundRectRgn
OffsetRgn
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExW
ExtFloodFill
SetPaletteEntries
GetWindowOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
GetViewportOrgEx
GetTextFaceW
SetPixelV
CreatePen
SetTextColor
SetBkColor
DeleteDC
GetTextExtentPoint32W
CreateDCW
GetDeviceCaps
SelectObject
CreateFontIndirectW
GetPixel
GetObjectW
GetCurrentObject
DeleteObject
CreateSolidBrush
BitBlt
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
CreateCompatibleDC
LPtoDP
CreateCompatibleBitmap
GetMapMode
SetDIBColorTable
GetWindowExtEx
GetViewportExtEx
DPtoLP
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreateBitmap
SelectPalette
GetObjectType
CreateHatchBrush
CreateRectRgnIndirect
SetRectRgn
CombineRgn
PatBlt
CreateEllipticRgn
Ellipse
CreatePolygonRgn
GetBkColor
GetTextColor
Polyline
Polygon
GetTextMetricsW
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetBitmapBits
GetObjectA
CreateDCA
GetRgnBox
Rectangle

comctl32

ImageList_GetIconSize
InitCommonControlsEx
ImageList_Draw

user32

SetRectEmpty
SetWindowRgn
MapVirtualKeyW
GetKeyNameTextW
IntersectRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
CheckMenuItem
GetMessageW
ClientToScreen
SendDlgItemMessageA
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetIconInfo
LoadImageW
TranslateMessage
IsDialogMessageW
WindowFromPoint
DrawStateW
GetMenuItemInfoW
RegisterClipboardFormatW
GetCursorPos
TrackPopupMenu
MapDialogRect
SetWindowContextHelpId
ShowOwnedPopups
TranslateAcceleratorW
BringWindowToTop
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
MapWindowPoints
ScrollWindow
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
ValidateRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetMenu
GetDlgCtrlID
IsDlgButtonChecked
SendDlgItemMessageW
SetActiveWindow
GetNextDlgTabItem
EndDialog
GetWindowTextLengthW
GetNextDlgGroupItem
SetScrollPos
GetWindowThreadProcessId
IsWindowEnabled
UnhookWindowsHookEx
CreatePopupMenu
InsertMenuItemW
LoadAcceleratorsW
ReuseDDElParam
UnpackDDElParam
DrawEdge
DrawFrameControl
GetSysColorBrush
UnregisterClassW
RealChildWindowFromPoint
EnumDisplayMonitors
SetLayeredWindowAttributes
CopyAcceleratorTableW
InvalidateRgn
CharNextW
UnionRect
EnableScrollBar
UpdateLayeredWindow
MonitorFromPoint
IsMenu
DeleteMenu
NotifyWinEvent
GetMenuDefaultItem
PostThreadMessageW
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
DestroyAcceleratorTable
CreateAcceleratorTableW
SetClassLongW
LockWindowUpdate
SetCursorPos
CopyIcon
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
GetDoubleClickTime
InvertRect
HideCaret
FrameRect
CharUpperBuffW
IsCharLowerW
SetMenuDefaultItem
GetClientRect
InvalidateRect
GetWindowDC
GetWindowRect
SendMessageW
ReleaseDC
GetFocus
EnableWindow
GrayStringW
DrawTextExW
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
GetUpdateRect
SubtractRect
CreateMenu
DestroyCursor
GetWindowRgn
GetScrollPos
CopyImage
RegisterWindowMessageW
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
RemoveMenu
IsZoomed
GetMonitorInfoW
MonitorFromWindow
IsRectEmpty
GetScrollInfo
GetDesktopWindow
GetForegroundWindow
CharUpperW
wsprintfW
PeekMessageW
CreateDialogIndirectParamW
GetWindow
GetAsyncKeyState
SetClipboardData
EmptyClipboard
GetWindowTextW
WinHelpW
SetWindowTextW
CallWindowProcW
EnumChildWindows
IsIconic
MoveWindow
SetWindowPos
SetFocus
CheckDlgButton
GetSystemMenu
GetClassNameW
SetWindowLongW
GetDlgItem
GetSystemMetrics
GetDialogBaseUnits
EndPaint
GetWindowLongW
DrawIcon
BeginPaint
MessageBeep
GetLastActivePopup
GetActiveWindow
MessageBoxW
UpdateWindow
SetForegroundWindow
ShowWindow
LoadIconW
DefWindowProcW
FindWindowExW
SetParent
PostQuitMessage
ExitWindowsEx
FillRect
EnableMenuItem
GetSubMenu
LoadMenuW
DrawIconEx
DestroyIcon
ShowScrollBar
OffsetRect
SystemParametersInfoW
ReleaseCapture
LoadCursorW
SetCursor
SetCapture
DestroyMenu
DispatchMessageW
WaitMessage
DestroyWindow
DrawFocusRect
SetRect
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
ScreenToClient
GetMessagePos
IsWindow
TrackMouseEvent
InflateRect
GetDC
LoadStringW
PostMessageW
RedrawWindow
PtInRect
CopyRect
GetParent
GetSysColor
SetTimer
KillTimer
IsWindowVisible
TabbedTextOutW
DrawTextW
MapVirtualKeyExW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

7zipdll

CreateObject
GetNumberOfMethodsDLL
GetHandlerProperty2
GetNumberOfFormats
SetLargePageMode
GetMethodProperty

kernel32

FileTimeToLocalFileTime
SetLastError
DeactivateActCtx
GetLastError
ActivateActCtx
TryEnterCriticalSection
GetCurrentProcessId
OpenProcess
TerminateProcess
GetVersionExW
CompareFileTime
GetLocaleInfoW
ReadFile
CreateFileW
FindFirstFileW
FindClose
GetCurrentThread
lstrlenW
HeapAlloc
GetProcessHeap
HeapFree
SetCurrentDirectoryW
CreateMutexW
GetLocalTime
MulDiv
GlobalAlloc
LocalAlloc
LocalLock
LocalFree
LocalUnlock
GetSystemTime
lstrcmpiW
SuspendThread
ResumeThread
SetEvent
ResetEvent
InitializeCriticalSectionAndSpinCount
lstrlenA
CreateToolhelp32Snapshot
Process32FirstW
WaitForMultipleObjects
Process32NextW
GetProcessId
GetShortPathNameW
HeapReAlloc
WriteFile
DeviceIoControl
GetEnvironmentVariableW
GetSystemDirectoryW
GetWindowsDirectoryW
FormatMessageW
InterlockedDecrement
VirtualFree
VirtualAlloc
FindNextFileW
SetFileTime
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetFullPathNameW
GetCurrentDirectoryW
SearchPathW
GetFileSize
SetFilePointer
GetFileInformationByHandle
SetEndOfFile
GetStdHandle
DuplicateHandle
ReleaseMutex
CreateEventW
SleepEx
PeekNamedPipe
GetFileType
ExpandEnvironmentStringsW
CreateTimerQueue
DeleteTimerQueueTimer
DeleteTimerQueue
ChangeTimerQueueTimer
CreateTimerQueueTimer
FindResourceExW
GetSystemPowerStatus
GetComputerNameW
GetSystemInfo
MoveFileExW
GlobalFree
SetFilePointerEx
GetACP
GetVersionExA
AreFileApisANSI
GetFileAttributesA
DeleteFileA
GetTempPathA
FlushFileBuffers
LockFile
LockFileEx
UnlockFile
GetFullPathNameA
LoadLibraryA
TlsSetValue
TlsGetValue
TlsAlloc
CreateFileA
GetFileSizeEx
GetTimeZoneInformation
GetSystemTimes
GetLongPathNameW
GlobalSize
CopyFileW
CreateActCtxW
ReleaseActCtx
FreeResource
lstrcmpW
CompareStringW
FileTimeToSystemTime
GlobalFindAtomW
GlobalAddAtomW
GetCurrentThreadId
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
SetThreadPriority
lstrcmpA
GetThreadLocale
InterlockedExchange
LoadLibraryExW
CompareStringA
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GlobalGetAtomNameW
RaiseException
InterlockedIncrement
GlobalReAlloc
GlobalHandle
LocalReAlloc
TlsFree
GlobalFlags
lstrcpyW
GetUserDefaultLCID
GetFileTime
GetFileAttributesExW
SetErrorMode
GetNumberFormatW
GetProfileIntW
VirtualProtect
GetCommandLineW
HeapSetInformation
GetStartupInfoW
ExitProcess
DecodePointer
EncodePointer
ExitThread
CreateThread
GetTimeFormatW
GetDateFormatW
HeapSize
GetDriveTypeA
FindFirstFileExA
RtlUnwind
GetCPInfo
SetStdHandle
VirtualQuery
HeapQueryInformation
SetUnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
HeapDestroy
QueryPerformanceCounter
UnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
GetOEMCP
IsValidCodePage
LCMapStringW
GetStringTypeW
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetEnvironmentVariableA
MultiByteToWideChar
GlobalLock
GetModuleFileNameW
WideCharToMultiByte
CreateDirectoryW
SetConsoleMode
GetFileAttributesW
GlobalMemoryStatusEx
GetModuleHandleW
GetDiskFreeSpaceW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetCurrentProcess
GetProcessTimes
GetSystemTimeAsFileTime
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
Sleep
TerminateThread
GetExitCodeThread
FindResourceW
LoadResource
LockResource
SizeofResource
ReadConsoleInputA
FlushConsoleInputBuffer
WaitForSingleObject
GetTempFileNameW
DeleteFileW
GetTempPathW
OutputDebugStringW
GlobalDeleteAtom
GlobalUnlock
InterlockedCompareExchange
GetVersion
GlobalMemoryStatus
SetEnvironmentVariableW

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

OpenThreadToken
GetTokenInformation
LookupAccountSidW
LookupAccountNameW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
OpenProcessToken
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityW
GetUserNameW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateWellKnownSid
SetEntriesInAclW
RegEnumKeyExW
RegDeleteValueW
RegSetValueExW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
DeregisterEventSource
AddAccessAllowedAce
RegDeleteKeyW
RegEnumValueW
FreeSid
AllocateAndInitializeSid
ConvertSidToStringSidW
RegOpenKeyW
RegQueryInfoKeyW
RegEnumKeyW
RegQueryValueW
RegisterEventSourceA
ReportEventA

oleaut32

VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayCreate
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
VariantChangeType
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SysFreeString
SysStringLen
OleCreateFontIndirect
VarBstrFromDate
SysAllocStringByteLen
SysStringByteLen
SysAllocString
VariantInit
VariantClear
SafeArrayRedim
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayGetDim

gdiplus

GdipTransformPath
GdipGetPathWorldBounds
GdipTranslateMatrix
GdipAddPathPolygonI
GdipAddPathLineI
GdipAddPathPath
GdipDrawPath
GdipFillPath
GdipDrawRectangle
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipGetFontHeight
GdipScaleMatrix
GdipDeleteMatrix
GdipCreateMatrix2
GdipAddPathLine2I
GdipDeletePath
GdipCreatePath
GdipCreateFromHWND
GdipSetStringFormatFlags
GdipSetStringFormatTabStops
GdipDrawLineI
GdipDeletePen
GdipCreatePen1
GdipMeasureString
GdipDrawImageRectI
GdipDrawString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipCreateStringFormat
GdipSetTextRenderingHint
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipFillRectangle
GdipCloneBrush
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRect
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateMatrix
GdipLoadImageFromFile
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdiplusShutdown
GdiplusStartup
GdipSetInterpolationMode
GdipDrawImageRectRectI
GdipResetClip
GdipAddPathEllipse
GdipCreatePen2
GdipSetLineWrapMode
GdipSetClipRect
GdipAddPathRectangle
GdipImageSelectActiveFrame
GdipDrawEllipse
GdipFillEllipse
GdipCreateFontFromLogfontW
GdipSetStringFormatHotkeyPrefix
GdipSetPathGradientFocusScales
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterPoint
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipClosePathFigure
GdipAddPathLine
ord1
GdipCreateLineBrushFromRect
GdipCombineRegionRect
GdipDeleteRegion
GdipCreateRegionPath
GdipClonePath
GdipAddPathArcI
GdipCreateBitmapFromHBITMAP
GdipGetLogFontW
GdipImageGetFrameCount
GdipDrawLine
GdipCreateLineBrushFromRectI
GdipReleaseDC
GdipGetDC
GdipCreateHICONFromBitmap
GdipCreateBitmapFromFile
GdipDrawRectangleI
GdipFillRectangleI
GdipGetFontSize
GdipGetFontStyle
GdipGetFontUnit
GdipCreateFont
GdipGetFamily
GdipDeleteFontFamily
GdipDrawImage
GdipGraphicsClear
GdipDeleteFont

oledlg

OleUIBusyW

psapi

GetProcessMemoryInfo

crypt32

CertGetNameStringW

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

ws2_32

WSAEnumNetworkEvents
WSAResetEvent
WSASend
WSAGetOverlappedResult
WSARecv
WSACreateEvent
WSASetEvent
WSAEventSelect
recv
inet_ntoa
htons
WSAConnect
socket
inet_addr
__WSAFDIsSet
select
ntohs
send
ioctlsocket
getsockname
bind
getsockopt
setsockopt
getprotobyname
connect
gethostname
accept
listen
WSAGetLastError
WSASocketW
WSACloseEvent
closesocket
WSACleanup
WSAStartup
GetAddrInfoW
shutdown
gethostbyname
WSASetLastError
sendto
recvfrom
FreeAddrInfoW

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDescriptionW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupOpenInfFileW
SetupCloseInfFile
SetupFindFirstLineW
SetupFindNextMatchLineW
SetupGetLineTextW
SetupEnumInfSectionsW
SetupFindNextLine

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

msimg32

TransparentBlt
AlphaBlend

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperGetProvCertFromChain
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
WTHelperProvDataFromStateData

litezip

ZipAddBufferW
ZipAddFileW
ZipClose
ZipCreateFileW

sbte

SBCSGetScannerResultsSizeW
SBCSRunScanner
SBCSSetScanOption
SBCSSetScanProgressDetailCallbackW
SBCSSetScanProgressStateCallback
SBCSResetScanOptions
SBCSGetDefReleaseDateW
SBCSGetScannerResultsW
SBCSCloseThreatEngine
SBCSOpenThreatEngineW
SBCSRunCleanerW
SBCSGetCleanerResultsSizeW
SBCSGetCleanerResultsW
SBCSGetDefVersionW

spursdownload

ThreatUpdate

msi

ord173
ord217

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 805KB - Virtual size: 805KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 98KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 329KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4ba118ac439dfb6845e83f791dc1dc8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

11:21:41:e8:17:66:82:66:2d:6f:24:46:6b:42:16:bc:54:0aCertificate

Extended Key Usages

Key Usages

4a:ea:60:90:f3:6b:2f:9a:5a:fb:f1:d0:2d:03:38:55:a9:e4:b8:7fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winmm

rpcrt4

wininet

shfolder

shell32

ole32

shlwapi

gdi32

comctl32

user32

version

7zipdll

kernel32

comdlg32

winspool.drv

advapi32

oleaut32

gdiplus

oledlg

psapi

crypt32

oleacc

imm32

ws2_32

setupapi

iphlpapi

msimg32

wintrust

litezip

sbte

spursdownload

msi

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 805KB - Virtual size: 805KB

.data Size: 98KB - Virtual size: 147KB

.rsrc Size: 109KB - Virtual size: 108KB

.reloc Size: 329KB - Virtual size: 328KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

11:21:41:e8:17:66:82:66:2d:6f:24:46:6b:42:16:bc:54:0a
Certificate

4a:ea:60:90:f3:6b:2f:9a:5a:fb:f1:d0:2d:03:38:55:a9:e4:b8:7f
Signer

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 805KB - Virtual size: 805KB

.data
Size: 98KB - Virtual size: 147KB

.rsrc
Size: 109KB - Virtual size: 108KB

.reloc
Size: 329KB - Virtual size: 328KB