d6e868dba593df4b2a395a26663041d1af70daf16cd7d57d73b626683d837368

Sharing

Copy URL Twitter E-mail

General

Target

d6e868dba593df4b2a395a26663041d1af70daf16cd7d57d73b626683d837368
Size

6.4MB
MD5

b1b96ed70051cf590e33f45222aa34e0
SHA1

14d32ebcbad8094fb9dce87a6fa1a75ab18b0157
SHA256

d6e868dba593df4b2a395a26663041d1af70daf16cd7d57d73b626683d837368
SHA512

9e668ee485c13fdf9b336d66b00b3b8c5a17c13fefec82cd1e4ce86f96669adf11eecd68385db6b01b2cbcb35978ec0aa833095a5a6cd29ac74900fb42beca99
SSDEEP

98304:EsRdabAuq2pP01uIbQpPCv9HfNRZ4XaTnGgWi/0TMZQ7OWOW:xdab4n1uIbwcTZ9G3TMPW

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
d6e868dba593df4b2a395a26663041d1af70daf16cd7d57d73b626683d837368
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/out.upx

Files

d6e868dba593df4b2a395a26663041d1af70daf16cd7d57d73b626683d837368
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 133KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupLib.dll
.dll windows:6 windows x86 arch:x86

8a121a6ec43d6fb524ea2ae276bf16bd

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

21/08/2024, 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:b6:e2:d6:ac:ac:13:af:df:5e:f3:0b:e6:e9:7e:c9:23:32:5a:2e:99:44:94:47:7b:3b:87:31:34:92:01:b3
Signer

Actual PE Digest

01:b6:e2:d6:ac:ac:13:af:df:5e:f3:0b:e6:e9:7e:c9:23:32:5a:2e:99:44:94:47:7b:3b:87:31:34:92:01:b3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-8e18b00276fd470e835a1e79d9eeecd4\src\bin\Release_Win32\SetupLib.pdb

Imports

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

wininet

InternetSetOptionW
HttpAddRequestHeadersA
InternetErrorDlg
InternetQueryOptionW
HttpOpenRequestA
InternetWriteFile
HttpAddRequestHeadersW
InternetReadFile
InternetConnectA
InternetCloseHandle
HttpSendRequestExW
HttpEndRequestW
InternetOpenW
InternetCrackUrlA

shlwapi

StrRetToBufW
SHDeleteKeyW
PathFileExistsW
StrToIntW
PathMatchSpecW

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetFileInfoW
SHGetDesktopFolder
CommandLineToArgvW
SHGetKnownFolderPath
ShellExecuteW
SHFileOperationW
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

advapi32

CryptEncrypt
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptSetKeyParam
GetTokenInformation
CryptImportKey
SystemFunction036
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
RegDeleteValueW
LookupAccountSidW
LookupPrivilegeValueW
LookupAccountNameW
AddAccessAllowedAce
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
GetFileSecurityW
AddAce
SetSecurityDescriptorSacl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
EqualSid
GetAce
GetAclInformation
SetFileSecurityW
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW
RegEnumValueW
RegOpenKeyW
ConvertSidToStringSidW
RegCreateKeyW
RegLoadKeyW
RegUnLoadKeyW
OpenProcessToken
RegEnumKeyExW
RegSaveKeyW
RegFlushKey
RegQueryInfoKeyW
RegEnumKeyW
AdjustTokenPrivileges
CryptReleaseContext

kernel32

CreateProcessW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
GetTickCount
GetExitCodeProcess
Sleep
DeleteFileW
GlobalAlloc
LockResource
Process32NextW
MultiByteToWideChar
CreateToolhelp32Snapshot
OpenProcess
UnmapViewOfFile
GetSystemDirectoryW
GetCurrentThreadId
CreateFileW
VirtualProtect
VirtualQuery
OutputDebugStringA
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetLongPathNameW
GetNativeSystemInfo
RtlCaptureStackBackTrace
WaitForSingleObject
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
EnterCriticalSection
SizeofResource
MoveFileExW
HeapDestroy
HeapReAlloc
FindResourceW
HeapSize
InitializeCriticalSectionEx
GetModuleFileNameW
GetTempPathW
LoadLibraryExW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
LoadResource
FindResourceExW
RaiseException
SuspendThread
GetCurrentProcessId
GetEnvironmentVariableW
DebugBreak
FreeLibrary
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
LocalFree
GetProcAddress
DecodePointer
HeapAlloc
GetThreadContext
SetThreadContext
LoadLibraryW
CreateFileA
CreateFileMappingA
OutputDebugStringW
GetLastError
LocalAlloc
FindClose
lstrlenA
InitializeCriticalSectionAndSpinCount
lstrlenW
FindNextFileW
GetFullPathNameW
SetLastError
HeapFree
FindFirstFileW
TransactNamedPipe
SetNamedPipeHandleState
WaitNamedPipeW
InitOnceBeginInitialize
InitOnceComplete
GetDriveTypeW
GlobalHandle
CloseHandle
GlobalFree
ReadFile
lstrcatW
lstrcpyW
GetCommandLineW
TerminateThread
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
QueryDosDeviceW
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
GetLogicalDriveStringsW
FileTimeToSystemTime
GlobalLock
GetTempFileNameW
GlobalUnlock
CreateDirectoryW
GetProcessId
GetFileAttributesExW
SystemTimeToFileTime
CopyFileW
GetFileTime
WriteFile
SetFilePointer
DuplicateHandle
ExitThread
CreateEventW
FormatMessageW
CreateThread
GetFileSize
OpenMutexW
CreateMutexW
ReleaseMutex
GetVersionExW
OpenFileMappingW
GetWindowsDirectoryW
FlushFileBuffers
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
VirtualFree
VirtualAlloc
GetCurrentThread
GetExitCodeThread
SetThreadPriority
lstrcmpiW
GetDiskFreeSpaceExW
OpenEventW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
FormatMessageA
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
LoadLibraryExA
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
ResumeThread
Process32FirstW
GetModuleHandleExW
GetTimeZoneInformation
ExitProcess
GetStdHandle
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetFileSizeEx
GetConsoleOutputCP
SetConsoleCtrlHandler
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
SetEndOfFile
WriteConsoleW
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
MoveFileExA
CompareFileTime
GetEnvironmentVariableA
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
SetConsoleMode
ReadConsoleA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTime
GetLocalTime
GetSystemInfo
GetCurrentDirectoryW
FreeLibraryAndExitThread

user32

ClientToScreen
PtInRect
OffsetRect
ExitWindowsEx
SetCursor
GetProcessWindowStation
GetUserObjectInformationW
wvsprintfW
InsertMenuItemW
GetKeyState
ScreenToClient
GetWindowThreadProcessId
DrawTextW
UpdateLayeredWindow
GetFocus
MonitorFromPoint
GetDC
IsWindowVisible
CreatePopupMenu
GetWindowPlacement
IsWindowEnabled
GetMessageW
SetWindowPos
TrackPopupMenu
SetMenuItemInfoW
TrackMouseEvent
DestroyMenu
SetPropW
SetCapture
AppendMenuW
ReleaseCapture
GetCursorPos
WaitMessage
CallMsgFilterW
GetQueueStatus
GetMessagePos
SubtractRect
RegisterWindowMessageW
SetFocus
FindWindowW
MessageBoxIndirectW
LoadIconW
SetParent
SetActiveWindow
MonitorFromWindow
DispatchMessageW
ShowWindow
SetRect
GetMonitorInfoW
AttachThreadInput
GetForegroundWindow
GetMenuItemInfoW
GetSystemMenu
PostMessageW
SendMessageTimeoutW
GetMenuItemCount
DeleteMenu
wsprintfW
GetDlgItem
GetWindowTextLengthW
SetWindowTextW
KillTimer
EnableWindow
GetWindowTextW
FindWindowExW
MessageBoxW
CreateWindowExW
SendMessageW
RegisterClassExW
IsWindow
GetKeyboardLayoutList
LoadKeyboardLayoutW
LoadCursorW
GetClientRect
PeekMessageW
UnloadKeyboardLayout
GetClassInfoExW
GetWindowLongW
DefWindowProcW
CallWindowProcW
GetWindowRect
FillRect
SetTimer
CopyRect
SetWindowLongW
LoadImageW
InvalidateRect
BeginPaint
EndPaint
DestroyIcon
UnregisterClassW
LoadStringW
CharNextW
DestroyWindow
MsgWaitForMultipleObjectsEx
TranslateMessage
WindowFromPoint
SetRectEmpty
PostQuitMessage
GetPropW
NotifyWinEvent
MoveWindow
GetDesktopWindow
SystemParametersInfoW
GetParent
SetForegroundWindow
IsIconic
GetSystemMetrics
IntersectRect
ReleaseDC

gdi32

CreateFontIndirectW
GetFontData
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
DeleteDC
SetViewportOrgEx
DeleteObject
GetStockObject
GetObjectW
SetTextColor
SetBkMode
SetTextCharacterExtra
GetTextExtentExPointW
CreateDIBSection

ole32

OleCreate
OleSetContainedObject
CoTaskMemFree
CoUninitialize
CoCreateGuid
CoInitialize
CoCreateInstance

oleaut32

SysAllocStringByteLen
SysStringLen
SysAllocString
VariantInit
SysFreeString
SysStringByteLen
VariantClear

imm32

ImmDisableIME
ImmGetIMEFileNameW
ImmInstallIMEW
ImmGetContext
ImmSetOpenStatus
ImmNotifyIME

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

msimg32

AlphaBlend

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

wldap32

ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord217

bcrypt

BCryptGenRandom

winhttp

WinHttpOpenRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpOpen
WinHttpQueryOption
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpSetOption
WinHttpGetProxyForUrl
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpWriteData
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpCrackUrl

ws2_32

WSAIoctl
__WSAFDIsSet
select
gethostname
socket
htons
setsockopt
WSACleanup
WSAStartup
WSASetLastError
ntohs
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
accept
bind
connect
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
getpeername

oleacc

AccessibleObjectFromWindow
LresultFromObject

winmm

timeGetTime

Exports

Exports

AddAccess
AddAccessExec
AddAccessOnReg
AddAccess_RX
AddIE7ElevationPolicy
AddSogouImeMgrSchTasks
AttachProgressBar
BackupExe
BackupOtherFile
BackupSysDict
CancelDelayDelDir
CancleDelayDelDirWrap
CheckAccess
CheckInDelayDir
CheckRegKeyIsVolatile
CmpFile
CopyRegToArm32
CorrectSmartInfoUsed
CreateSmartInfoUid
CreateSogouInputUid
DefaultBrowserIsIE
DelBackupExe
DelayDelFile
DelayDelReg
DelayDeleteSogouImeFile
DeleteShortcut
DeleteShortcutWithPath
DeleteVolatileRegKey
DownloadQuiet
ExecWait
FilterSid
GetAppDataPath
GetArm32SysPath
GetBDInfo
GetCheckBoxState
GetFeedBackContact
GetFeedBackReason
GetFinishIds
GetFinishStats
GetHWID
GetHandleVerifier
GetHwndImage
GetHwndMain
GetImeInstallMutex
GetInstallPath
GetOSVersionTime
GetPPName
GetQQStatistics
GetRealOsVersion
GetSmartInfoOption
GetVerifyText
GuiInitAndAttach
HideChildWindows
ImageInstallingStart
InitResource
InstSuccessUserNetSchedule
InstallIME
InstalledIMEIsPre30b1
IsArmArch
IsFinishCheckBoxShow
IsFinishCloseBtnClicked
IsFullScreenActivated
IsInWin8
IsInX64
IsInXP
IsReadScreenEnable
IsRecommendTimeout
IsShowOpenMedal
IsSmartInfoEnable
IsSogouExplorerInstalled
IsSogouMobileInstalled
KillProcess
MonitorUninstallCompleted
MonitorVerifyUninstallSelect
MoveImeDir
MoveUrlGuideIcon
OnAbort
OnPageLeave
OnPagePre
OnPageShow
OpenPage
Ping
PluginToComp
QQMgrSetIESP
ReadIniStr
ReadSmartInfoOption
RemoveAppDataDir
RemoveCommonDir
RemoveDir
RemoveFireWall
RemoveIE7ElevationPolicy
RemoveSogouImeMgrSchTasks
SECheckOSInstalled
SaveInstallTime
SetAccessRights
SetCheckBoxState
SetGuideQQUrl
SetLowLabel
SetMutex
SetPathAccessRightsRecursive
SetQQShowType
SetReboot
SetRecommendTime
SetShowQQ
SetSmartInfoOption
SetUrlInvite
SetWithType
ShowQQOrNot
SwitchIme
UnGuiInitAndAttach
UninstallInstPath
UninstallReg
UninstallUsrReg
UpdateFireWall
WaitAccountThread

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 124KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.8MB

UPX1 Size: 24KB - Virtual size: 24KB

.rsrc Size: 133KB - Virtual size: 136KB

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

8a121a6ec43d6fb524ea2ae276bf16bd

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

01:b6:e2:d6:ac:ac:13:af:df:5e:f3:0b:e6:e9:7e:c9:23:32:5a:2e:99:44:94:47:7b:3b:87:31:34:92:01:b3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wtsapi32

wininet

shlwapi

shell32

version

advapi32

kernel32

user32

gdi32

ole32

oleaut32

imm32

psapi

msimg32

crypt32

wldap32

bcrypt

winhttp

ws2_32

oleacc

winmm

Exports

Exports

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 124KB - Virtual size: 297KB

UPX0
Size: - Virtual size: 2.8MB

UPX1
Size: 24KB - Virtual size: 24KB

.rsrc
Size: 133KB - Virtual size: 136KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

01:b6:e2:d6:ac:ac:13:af:df:5e:f3:0b:e6:e9:7e:c9:23:32:5a:2e:99:44:94:47:7b:3b:87:31:34:92:01:b3
Signer

.text
Size: 4.5MB - Virtual size: 4.5MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 124KB - Virtual size: 297KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.rsrc
Size: 1024B - Virtual size: 736B

.reloc
Size: 232KB - Virtual size: 232KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 590B

.text
Size: 29KB - Virtual size: 28KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 458KB

.ndata
Size: - Virtual size: 2.1MB

.rsrc
Size: 134KB - Virtual size: 133KB