FL_2024[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

FL_2024.exe
Size

437.7MB
MD5

d6a44a58da4b2dac62cc2e7d2e138e49
SHA1

106acb53a6263ddae5f644901ac178d408ad222e
SHA256

d120d1caa40dcc6f47a5a11cdaf2a724afecfe2c3bd7e0cb9763c5afaea8effa
SHA512

282e4d68517285ec806c1507a494f7d815523846c9d954a1ac7be0af92f25eb66d6871f2741ca60679e05781e29c14f19b9cf01dba4cc5a58f94127fe4c5b841
SSDEEP

6291456:HRvnOrFPdXkm8Ew1F3wFBNkfZcMl+vu3cMOwJIj:FcFFTw1FAFBN2c4+W3XOCIj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FL_2024.exe

Files

FL_2024.exe
.exe windows:6 windows x64 arch:x64

189d682cb97be38725da5f3a9ba31ae2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

PES2021.pdb

Imports

advapi32

ConvertSidToStringSidW
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptReleaseContext
DeregisterEventSource
LookupAccountNameW
RegCloseKey
RegOpenKeyExA
RegQueryValueExW
RegisterEventSourceW
ReportEventW

anselsdk64

?quaternionToRotationMatrixVectors@ansel@@YAXAEBUQuat@nv@@AEAUVec3@3@11@Z
?rotationMatrixVectorsToQuaternion@ansel@@YAXAEBUVec3@nv@@00AEAUQuat@3@@Z
?setConfiguration@ansel@@YA?AW4SetConfigurationStatus@1@AEBUConfiguration@1@@Z
?updateCamera@ansel@@YAXAEAUCamera@1@@Z
?isAnselAvailable@ansel@@YA_NXZ

api-ms-win-crt-convert-l1-1-0

_strtoi64
_strtoui64
_ui64tow_s
_wtoi64
atof
atoi
atol
mbstowcs
mbstowcs_s
strtod
strtof
strtol
strtoul
wcstombs
wcstombs_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_stat64i32
_unlock_file
remove
rename

api-ms-win-crt-heap-l1-1-0

_aligned_free
_aligned_malloc
_free_base
_malloc_base
_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-locale-l1-1-0

_create_locale
_free_locale
localeconv
setlocale
_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdtest
_finite
_get_FMA3_enable
_isnan
_set_FMA3_enable
acos
acosf
asin
asinf
atan
atan2
atan2f
atanf
cbrtf
ceil
ceilf
cos
cosf
cosh
exp
expf
fabs
floor
floorf
fmod
fmodf
frexp
ldexp
log
log10
log10f
logf
modf
pow
powf
roundf
sin
sinf
sinh
sqrt
sqrtf
tan
tanf
tanh

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_beginthreadex
_c_exit
_cexit
_configure_narrow_argv
_controlfp
_crt_atexit
_endthreadex
_errno
_exit
_get_errno
_get_narrow_winmain_command_line
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
abort
exit
raise
signal
strerror
strerror_s
system
terminate

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__stdio_common_vfprintf
__stdio_common_vfprintf_s
__stdio_common_vfscanf
__stdio_common_vfwprintf
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_s
__stdio_common_vswscanf
_fileno
_fseeki64
_ftelli64
_get_stream_buffer_pointers
_pclose
_popen
_set_fmode
_setmode
_wfopen
_wfopen_s
_write
clearerr
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fopen_s
fputc
fputs
fread
fseek
fsetpos
ftell
fwrite
getc
setvbuf
tmpfile
tmpnam
ungetc

api-ms-win-crt-string-l1-1-0

_stricmp
_strnicmp
_wcsicmp
_wcsnicmp
_wcsupr
isalnum
isalpha
iscntrl
isdigit
islower
ispunct
isspace
isupper
isxdigit
strcat_s
strcmp
strcoll
strcpy_s
strcspn
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strspn
strtok_s
tolower
toupper
wcscmp
wcslen
wcsncat_s
wcsncmp
wcsnlen

api-ms-win-crt-time-l1-1-0

_difftime64
_gmtime64
_gmtime64_s
_localtime64
_localtime64_s
_mktime64
_time64
clock
strftime

api-ms-win-crt-utility-l1-1-0

_byteswap_ulong
_byteswap_ushort
qsort
rand
srand
_byteswap_uint64

bcrypt

BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptDestroyKey
BCryptEncrypt
BCryptGenRandom
BCryptGenerateSymmetricKey
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptSetProperty

crypt32

CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptMsgClose
CryptMsgGetParam
CryptQueryObject

d3d11

D3D11CreateDevice

dinput8

DirectInput8Create

dsound

ord12
ord3
ord11

dxgi

CreateDXGIFactory1

gdi32

CreateDCW
CreateFontIndirectA
DeleteDC
DeleteObject
ExtEscape
GetDeviceCaps
GetObjectA
GetStockObject
GetTextExtentPoint32W
SelectObject
SetTextColor

iphlpapi

AddIPAddress
ConvertInterfaceLuidToGuid
CreateSortedAddressPairs
DeleteIPAddress
FreeMibTable
GetAdaptersAddresses
GetAdaptersInfo
GetBestInterface
GetIfEntry
GetIpAddrTable
GetIpForwardTable
GetNetworkParams

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
ConvertFiberToThread
ConvertThreadToFiber
CreateDirectoryA
CreateDirectoryW
CreateEventA
CreateEventW
CreateFiber
CreateFileA
CreateFileMappingW
CreateFileW
CreateHardLinkA
CreateMutexA
CreateMutexW
CreatePipe
CreateProcessA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFiber
DeleteFileA
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindResourceW
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileType
GetFullPathNameA
GetFullPathNameW
GetHandleInformation
GetLastError
GetLocalTime
GetLocaleInfoA
GetLogicalProcessorInformation
GetLongPathNameA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessTimes
GetStartupInfoW
GetStdHandle
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathW
GetThreadPriority
GetTickCount
GetTimeZoneInformation
GetVersionExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatus
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InitializeSRWLock
IsDebuggerPresent
IsProcessorFeaturePresent
K32GetProcessMemoryInfo
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
MapViewOfFile
MoveFileA
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleW
ReadFile
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryA
RemoveDirectoryW
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleMode
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFilePointer
SetHandleInformation
SetLastError
SetPriorityClass
SetProcessPriorityBoost
SetThreadAffinityMask
SetThreadExecutionState
SetThreadIdealProcessor
SetThreadPriority
SetThreadPriorityBoost
SetUnhandledExceptionFilter
SignalObjectAndWait
SizeofResource
Sleep
SleepConditionVariableCS
SuspendThread
SwitchToFiber
SwitchToThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteFile
__chkstk
lstrcatW
lstrcmpA
lstrcmpW
lstrcmpiA
lstrcpyW
lstrlenA
lstrlenW

mfplat

MFCreateMediaType
MFCreateSample
MFShutdown
MFStartup
MFCreateAlignedMemoryBuffer

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??0facet@locale@std@@IEAA@_K@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1facet@locale@std@@MEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??Bid@locale@std@@QEAA_KXZ
??Bios_base@std@@QEBA_NXZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_BADOFF@std@@3_JB
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Random_device@std@@YAIXZ
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
?swap@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uncaught_exception@std@@YA_NXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
_Cnd_broadcast
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Cnd_register_at_thread_exit
_Cnd_signal
_Cnd_timedwait
_Cnd_unregister_at_thread_exit
_Cnd_wait
_FDtest
_Getcoll
_Lock_shared_ptr_spin_lock
_Mtx_current_owns
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
_Mtx_trylock
_Mtx_unlock
_Strcoll
_Strxfrm
_Unlock_shared_ptr_spin_lock
_Xtime_get_ticks

msvcrt

memcpy

ntdll

NtClose
NtCreateNamedPipeFile
NtCreateThreadEx
NtGetContextThread
NtOpenFile
NtReadFile
NtSuspendThread
NtTerminateThread
NtWriteFile

ole32

CoCreateGuid
CoCreateInstance
CoInitialize
CoInitializeEx
CoTaskMemFree
CoUninitialize
OleInitialize

oleaut32

VariantClear

secur32

GetUserNameExW

shell32

CommandLineToArgvW
SHGetFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathW
ShellExecuteW

shlwapi

PathFileExistsW

steam_api64

SteamAPI_GetHSteamUser
SteamAPI_Init
SteamAPI_RegisterCallback
SteamAPI_RestartAppIfNecessary
SteamAPI_RunCallbacks
SteamAPI_SetMiniDumpComment
SteamAPI_Shutdown
SteamAPI_UnregisterCallResult
SteamAPI_UnregisterCallback
SteamAPI_WriteMiniDump
SteamInternal_ContextInit
SteamInternal_CreateInterface
SteamInternal_FindOrCreateUserInterface

user32

AdjustWindowRectEx
BeginPaint
CallNextHookEx
CallWindowProcA
ClientToScreen
CloseClipboard
CloseWindow
CreateWindowExA
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageA
DispatchMessageW
DrawTextW
EmptyClipboard
EnableWindow
EndPaint
EnumChildWindows
EnumDisplayDevicesA
EnumDisplaySettingsW
GetAncestor
GetCapture
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetForegroundWindow
GetKeyboardState
GetMenu
GetMessageA
GetMessageW
GetMonitorInfoW
GetProcessWindowStation
GetRawInputData
GetSystemMetrics
GetUserObjectInformationW
GetWindowDC
GetWindowLongA
GetWindowLongPtrA
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
InvalidateRect
IsIconic
IsWindow
LoadCursorA
LoadCursorW
LoadIconA
LoadIconW
MapVirtualKeyW
MessageBoxA
MessageBoxW
MonitorFromPoint
MonitorFromWindow
OpenClipboard
PostQuitMessage
PostThreadMessageW
PtInRect
RegisterClassExW
RegisterDeviceNotificationW
RegisterHotKey
RegisterRawInputDevices
ReleaseCapture
ReleaseDC
ScreenToClient
SendDlgItemMessageA
SendMessageA
SendMessageCallbackW
SendMessageW
SendNotifyMessageW
SetActiveWindow
SetCapture
SetClipboardData
SetCursor
SetFocus
SetMenu
SetParent
SetWindowLongA
SetWindowLongPtrA
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextA
SetWindowTextW
SetWindowsHookExW
ShowCursor
ShowWindow
ToAscii
TranslateMessage
UnregisterHotKey
UpdateWindow
wsprintfW

vcruntime140

_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__intrinsic_setjmp
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__vcrt_InitializeCriticalSectionEx
_purecall
longjmp
memchr
memcmp
memmove
memset
strchr
strrchr
strstr
wcsrchr
wcsstr

winhttp

WinHttpAddRequestHeaders
WinHttpCheckPlatform
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpSetTimeouts

wininet

HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetQueryOptionA
InternetReadFile
InternetSetOptionA

winmm

timeEndPeriod
timeGetSystemTime
timeGetTime
timeBeginPeriod

wlanapi

WlanCloseHandle
WlanFreeMemory
WlanOpenHandle
WlanQueryInterface

ws2_32

InetNtopW
InetPtonW
accept
ioctlsocket
inet_addr
WSAGetLastError
WSASetLastError
WSAStartup
WSACleanup
inet_ntoa
listen
ntohl
ntohs
__WSAFDIsSet
recv
recvfrom
select
send
bind
sendto
setsockopt
shutdown
socket
closesocket
connect
getpeername
gethostbyaddr
gethostbyname
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
WSAAddressToStringW
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAIoctl
WSARecvFrom
WSAResetEvent
WSASendTo
WSAWaitForMultipleEvents
freeaddrinfo
getaddrinfo
getnameinfo
inet_ntop

xinput1_3

ord3
ord4
ord2

Exports

Exports

??0TiXmlOutStream@@QEAA@$$QEAV0@@Z
??0TiXmlOutStream@@QEAA@AEBV0@@Z
??0TiXmlOutStream@@QEAA@XZ
??0TiXmlString@@QEAA@AEBV0@@Z
??0TiXmlString@@QEAA@PEBD@Z
??0TiXmlString@@QEAA@PEBD_K@Z
??0TiXmlString@@QEAA@XZ
??1TiXmlOutStream@@QEAA@XZ
??1TiXmlString@@QEAA@XZ
??4TiXmlOutStream@@QEAAAEAV0@$$QEAV0@@Z
??4TiXmlOutStream@@QEAAAEAV0@AEBV0@@Z
??4TiXmlString@@QEAAAEAV0@AEBV0@@Z
??4TiXmlString@@QEAAAEAV0@PEBD@Z
??6TiXmlOutStream@@QEAAAEAV0@AEBVTiXmlString@@@Z
??6TiXmlOutStream@@QEAAAEAV0@PEBD@Z
??ATiXmlString@@QEBAAEAD_K@Z
??YTiXmlString@@QEAAAEAV0@AEBV0@@Z
??YTiXmlString@@QEAAAEAV0@D@Z
??YTiXmlString@@QEAAAEAV0@PEBD@Z
?append@TiXmlString@@QEAAAEAV1@PEBD_K@Z
?assign@TiXmlString@@QEAAAEAV1@PEBD_K@Z
?at@TiXmlString@@QEBAAEBD_K@Z
?c_str@TiXmlString@@QEBAPEBDXZ
?capacity@TiXmlString@@QEBA_KXZ
?clear@TiXmlString@@QEAAXXZ
?data@TiXmlString@@QEBAPEBDXZ
?empty@TiXmlString@@QEBA_NXZ
?find@TiXmlString@@QEBA_KD@Z
?find@TiXmlString@@QEBA_KD_K@Z
?finish@TiXmlString@@AEBAPEADXZ
?init@TiXmlString@@AEAAX_K0@Z
?init@TiXmlString@@AEAAX_K@Z
?length@TiXmlString@@QEBA_KXZ
?npos@TiXmlString@@2_KB
?nullrep_@TiXmlString@@0URep@1@A
?quit@TiXmlString@@AEAAXXZ
?reserve@TiXmlString@@QEAAX_K@Z
?set_size@TiXmlString@@AEAAX_K@Z
?size@TiXmlString@@QEBA_KXZ
?start@TiXmlString@@AEBAPEADXZ
?swap@TiXmlString@@QEAAXAEAV1@@Z
agsDeInit
agsGetCrossfireGPUCount
agsInit
agsSetDisplayMode

Sections

.trace
Size: 37.2MB - Virtual size: 37.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14.4MB - Virtual size: 14.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xtext
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.bss
Size: 35KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data1
Size: 458KB - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.impdata
Size: 380.2MB - Virtual size: 380.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.xcode
Size: 512B - Virtual size: 501B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xtls
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sxdata
Size: 512B - Virtual size: 5B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sbss
Size: 512B - Virtual size: 97B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls$
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

189d682cb97be38725da5f3a9ba31ae2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

anselsdk64

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

bcrypt

crypt32

d3d11

dinput8

dsound

dxgi

gdi32

iphlpapi

kernel32

mfplat

msvcp140

msvcrt

ntdll

ole32

oleaut32

secur32

shell32

shlwapi

steam_api64

user32

vcruntime140

winhttp

wininet

winmm

wlanapi

ws2_32

xinput1_3

Exports

Exports

Sections

.trace Size: 37.2MB - Virtual size: 37.2MB

.rdata Size: 14.4MB - Virtual size: 14.4MB

.data Size: 3.2MB - Virtual size: 7.2MB

.pdata Size: 1.8MB - Virtual size: 1.8MB

.xtext Size: 512B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.bss Size: 35KB - Virtual size: 36KB

.data1 Size: 458KB - Virtual size: 460KB

.impdata Size: 380.2MB - Virtual size: 380.2MB

.reloc Size: 15KB - Virtual size: 14KB

.xcode Size: 512B - Virtual size: 501B

.rsrc Size: 512B - Virtual size: 20B

.text1 Size: 5KB - Virtual size: 5KB

.xtls Size: 10KB - Virtual size: 10KB

.idata Size: 1KB - Virtual size: 1KB

.sxdata Size: 512B - Virtual size: 5B

.sbss Size: 512B - Virtual size: 97B

.tls$ Size: 35KB - Virtual size: 35KB

.edata Size: 243KB - Virtual size: 243KB

.trace
Size: 37.2MB - Virtual size: 37.2MB

.rdata
Size: 14.4MB - Virtual size: 14.4MB

.data
Size: 3.2MB - Virtual size: 7.2MB

.pdata
Size: 1.8MB - Virtual size: 1.8MB

.xtext
Size: 512B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.bss
Size: 35KB - Virtual size: 36KB

.data1
Size: 458KB - Virtual size: 460KB

.impdata
Size: 380.2MB - Virtual size: 380.2MB

.reloc
Size: 15KB - Virtual size: 14KB

.xcode
Size: 512B - Virtual size: 501B

.rsrc
Size: 512B - Virtual size: 20B

.text1
Size: 5KB - Virtual size: 5KB

.xtls
Size: 10KB - Virtual size: 10KB

.idata
Size: 1KB - Virtual size: 1KB

.sxdata
Size: 512B - Virtual size: 5B

.sbss
Size: 512B - Virtual size: 97B

.tls$
Size: 35KB - Virtual size: 35KB

.edata
Size: 243KB - Virtual size: 243KB