mini_electron[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

mini_electron.exe
Size

704KB
MD5

4eb43fbf4b99acfa419c1a4cfb9c8bb9
SHA1

2cc11c5be440d4f958de66e2b1cb1785466e79f8
SHA256

d3e713102b2ff9a61987af635930d44e27fe742f17c8dbe565f0fa825c0479b9
SHA512

4b922c24698ce0b8919b26ff26b25cd6094581491b526b4b526b141d3b60af09cf3c679385325a3bb671f0c8f05ce6693ee5c1cb6ccfdaeef1af6769c8f8a7ad
SSDEEP

12288:IeCZsr4jTIYohYI4X8scZM8C/1q6v/PbpBryXh8JQAwXUE0t7fTLIoi3mkxM8LE6:DAaiUopexykn009

Score

1^/10

Malware Config

Signatures

Files

mini_electron.exe
.exe windows:5 windows x86 arch:x86

6ae527738bb8c25367eaa9412e8f35ab

Code Sign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a6:02:b1:29:d0:4f:62:4e:59:28:95:91:74:86:02:95
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05/11/2020, 00:00

Not After

05/11/2023, 23:59

Subject

SERIALNUMBER=91310120MA1HYANY1L,CN=卡饭（上海）信息安全有限公司,O=卡饭（上海）信息安全有限公司,POSTALCODE=201400,STREET=奉贤区金海公路6055号28幢1层,L=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

53:c7:46:fa:c8:0e:79:a1:5f:d7:16:75:93:c8:5b:df:55:da:0b:6f:93:1d:37:8d:95:da:15:43:b6:c4:63:9f
Signer

Actual PE Digest

53:c7:46:fa:c8:0e:79:a1:5f:d7:16:75:93:c8:5b:df:55:da:0b:6f:93:1d:37:8d:95:da:15:43:b6:c4:63:9f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\mycode\mb\out\Release_vc6\electron.pdb

Imports

imm32

ImmAssociateContext
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

node

??0HandleScope@v8@@QAE@PAVIsolate@1@@Z
??1HandleScope@v8@@QAE@XZ
?CreateHandle@HandleScope@v8@@KAPAPAVObject@internal@2@PAVIsolate@42@PAV342@@Z
?GetFrame@StackTrace@v8@@QBE?AV?$Local@VStackFrame@v8@@@2@I@Z
?InternalFieldCount@ObjectTemplate@v8@@QAEHXZ
?NewInstance@ObjectTemplate@v8@@QAE?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?SetAlignedPointerInInternalField@Object@v8@@QAEXHPAX@Z
?InternalFieldCount@Object@v8@@QAEHXZ
?GetEternal@V8@v8@@CA?AV?$Local@VValue@v8@@@2@PAVIsolate@2@H@Z
?Eternalize@V8@v8@@CAXPAVIsolate@2@PAVValue@2@PAH@Z
?SetInternalFieldCount@ObjectTemplate@v8@@QAEXH@Z
?New@ObjectTemplate@v8@@SA?AV?$Local@VObjectTemplate@v8@@@2@PAVIsolate@2@V?$Local@VFunctionTemplate@v8@@@2@@Z
?SetAccessorProperty@Template@v8@@QAEXV?$Local@VName@v8@@@2@V?$Local@VFunctionTemplate@v8@@@2@1W4PropertyAttribute@2@W4AccessControl@2@@Z
?Set@Template@v8@@QAEXV?$Local@VName@v8@@@2@V?$Local@VData@v8@@@2@W4PropertyAttribute@2@@Z
?GetFrameCount@StackTrace@v8@@QBEHXZ
?CurrentStackTrace@StackTrace@v8@@SA?AV?$Local@VStackTrace@v8@@@2@PAVIsolate@2@HW4StackTraceOptions@12@@Z
?GetLineNumber@StackFrame@v8@@QBEHXZ
?GetScriptNameOrSourceURL@StackFrame@v8@@QBE?AV?$Local@VString@v8@@@2@XZ
?GetFunctionName@StackFrame@v8@@QBE?AV?$Local@VString@v8@@@2@XZ
?IsFunction@Value@v8@@QBE_NXZ
?BooleanValue@Value@v8@@QBE_NXZ
?NewFromUtf8@String@v8@@SA?AV?$Local@VString@v8@@@2@PAVIsolate@2@PBDW4NewStringType@12@H@Z
?NewFromUtf8@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PAVIsolate@2@PBDW4NewStringType@2@H@Z
??0Utf8Value@String@v8@@QAE@V?$Local@VValue@v8@@@2@@Z
??1Utf8Value@String@v8@@QAE@XZ
?Set@Object@v8@@QAE_NV?$Local@VValue@v8@@@2@0@Z
?Get@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@V32@@Z
?Call@Function@v8@@QAE?AV?$Local@VValue@v8@@@2@V32@HQAV32@@Z
?Value@External@v8@@QBEPAXXZ
?New@FunctionTemplate@v8@@SA?AV?$Local@VFunctionTemplate@v8@@@2@PAVIsolate@2@P6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@V?$Local@VSignature@v8@@@2@HW4ConstructorBehavior@2@@Z
?GetFunction@FunctionTemplate@v8@@QAE?AV?$Local@VFunction@v8@@@2@XZ
?InstanceTemplate@FunctionTemplate@v8@@QAE?AV?$Local@VObjectTemplate@v8@@@2@XZ
?SetClassName@FunctionTemplate@v8@@QAEXV?$Local@VString@v8@@@2@@Z
?GlobalizeReference@V8@v8@@CAPAPAVObject@internal@2@PAVIsolate@42@PAPAV342@@Z
?DisposeGlobal@V8@v8@@CAXPAPAVObject@internal@2@@Z
?ToLocalEmpty@V8@v8@@CAXXZ
?IsLiveObj@node@@YA_NH@Z
node_module_register
?IsObject@Value@v8@@QBE_NXZ
?IsInt32@Value@v8@@QBE_NXZ
?ToObject@Value@v8@@QBE?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?ToInt32@Value@v8@@QBE?AV?$MaybeLocal@VInt32@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?New@Integer@v8@@SA?AV?$Local@VInteger@v8@@@2@PAVIsolate@2@H@Z
?Value@Int32@v8@@QBEHXZ
?GetCurrent@Isolate@v8@@SAPAV12@XZ
?GetCurrentContext@Isolate@v8@@QAE?AV?$Local@VContext@v8@@@2@XZ
?Global@Context@v8@@QAE?AV?$Local@VObject@v8@@@2@XZ
?IsBoolean@Value@v8@@QBE_NXZ
?IsUint32@Value@v8@@QBE_NXZ
?ToBoolean@Value@v8@@QBE?AV?$MaybeLocal@VBoolean@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?ToUint32@Value@v8@@QBE?AV?$MaybeLocal@VUint32@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?ToString@Value@v8@@QBE?AV?$Local@VString@v8@@@2@PAVIsolate@2@@Z
?Value@Boolean@v8@@QBE_NXZ
?Value@Uint32@v8@@QBEIXZ
?Get@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@I@Z
?GetOwnPropertyNames@Object@v8@@QAE?AV?$Local@VArray@v8@@@2@XZ
?Length@Array@v8@@QBEIXZ
?IsArray@Value@v8@@QBE_NXZ
?Set@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@1@Z
?Get@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@I@Z
?New@Object@v8@@SA?AV?$Local@VObject@v8@@@2@PAVIsolate@2@@Z
?FromJustIsNothing@V8@v8@@CAXXZ
nodeBlinkMicrotaskSuppressionEnter
nodeBlinkMicrotaskSuppressionLeave
?Int32Value@Value@v8@@QBEHXZ
?ForApi@Private@v8@@SA?AV?$Local@VPrivate@v8@@@2@PAVIsolate@2@V?$Local@VString@v8@@@2@@Z
?Set@Object@v8@@QAE_NIV?$Local@VValue@v8@@@2@@Z
?GetPrivate@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VPrivate@v8@@@2@@Z
?New@Array@v8@@SA?AV?$Local@VArray@v8@@@2@PAVIsolate@2@H@Z
?NewInstance@Function@v8@@QBE?AV?$Local@VObject@v8@@@2@HQAV?$Local@VValue@v8@@@2@@Z
?SetName@Function@v8@@QAEXV?$Local@VString@v8@@@2@@Z
?Enter@Context@v8@@QAEXXZ
?Exit@Context@v8@@QAEXXZ
?GetIsolate@Context@v8@@QAEPAVIsolate@2@XZ
?NumberValue@Value@v8@@QBENXZ
?Set@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@IV?$Local@VValue@v8@@@2@@Z
?Get@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z
?Compile@Script@v8@@SA?AV?$Local@VScript@v8@@@2@V?$Local@VString@v8@@@2@PAVScriptOrigin@2@@Z
?Run@Script@v8@@QAE?AV?$Local@VValue@v8@@@2@XZ
?Call@Function@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@HQAV52@@Z
?ToString@Value@v8@@QBE?AV?$MaybeLocal@VString@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?IsUint8Array@Value@v8@@QBE_NXZ
?NewInstance@Function@v8@@QBE?AV?$Local@VObject@v8@@@2@XZ
?New@External@v8@@SA?AV?$Local@VExternal@v8@@@2@PAVIsolate@2@PAX@Z
?Copy@Buffer@node@@YA?AV?$MaybeLocal@VObject@v8@@@v8@@PAVIsolate@4@PBDI@Z
?HasPrivate@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VPrivate@v8@@@2@@Z
?SetPrivate@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VPrivate@v8@@@2@V?$Local@VValue@v8@@@2@@Z
?GetIdentityHash@Object@v8@@QAEHXZ
?MakeWeak@V8@v8@@CAXPAPAVObject@internal@2@PAXP6AXABV?$WeakCallbackInfo@X@2@@ZW4WeakCallbackType@2@@Z
?ClearWeak@V8@v8@@CAPAXPAPAVObject@internal@2@@Z
?NewInstance@ObjectTemplate@v8@@QAE?AV?$Local@VObject@v8@@@2@XZ
?New@Number@v8@@SA?AV?$Local@VNumber@v8@@@2@PAVIsolate@2@N@Z
??0MicrotasksScope@v8@@QAE@PAVIsolate@1@W4Type@01@@Z
??1MicrotasksScope@v8@@QAE@XZ
?MakeCallback@node@@YA?AV?$Local@VValue@v8@@@v8@@PAVIsolate@3@V?$Local@VObject@v8@@@3@PBDHPAV23@@Z
?SetCallHandler@FunctionTemplate@v8@@QAEXP6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@PAVFastAccessorBuilder@experimental@2@@Z
?InContext@Isolate@v8@@QAE_NXZ
?RunMicrotasks@Isolate@v8@@QAEXXZ
nodeDeleteNodeEnvironment
?Init@node@@YAXPAHPAPBD0PAPAPBD@Z
?CreateEnvironment@node@@YAPAVEnvironment@1@PAVIsolate@v8@@PAUuv_loop_s@@V?$Local@VContext@v8@@@4@HPBQBDH3@Z
?LoadEnvironment@node@@YAXPAVEnvironment@1@@Z
??0ResourceConstraints@v8@@QAE@XZ
?New@Isolate@v8@@SAPAV12@ABUCreateParams@12@@Z
?Enter@Isolate@v8@@QAEXXZ
?Exit@Isolate@v8@@QAEXXZ
?Dispose@Isolate@v8@@QAEXXZ
?LowMemoryNotification@Isolate@v8@@QAEXXZ
?New@Context@v8@@SA?AV?$Local@VContext@v8@@@2@PAVIsolate@2@PAVExtensionConfiguration@2@V?$MaybeLocal@VObjectTemplate@v8@@@2@V?$MaybeLocal@VValue@v8@@@2@@Z
?SetAlignedPointerInEmbedderData@Context@v8@@QAEXHPAX@Z
?RemoveLiveSet@node@@YAXH@Z
?CleanNodeEnv@node@@YAXPAX@Z
nodeCreateDefaultPlatform
nodeBlinkAllocateUninitialized
nodeBlinkFree
?PumpMessageLoop@platform@v8@@YA_NPAVPlatform@2@PAVIsolate@2@@Z
nodeModuleInitRegister
?TypeError@Exception@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z
?ThrowException@Isolate@v8@@QAE?AV?$Local@VValue@v8@@@2@V32@@Z
?IsTrue@Value@v8@@QBE_NXZ
?IsFalse@Value@v8@@QBE_NXZ
?IsName@Value@v8@@QBE_NXZ
?IsSymbol@Value@v8@@QBE_NXZ
?IsNumber@Value@v8@@QBE_NXZ
?IsExternal@Value@v8@@QBE_NXZ
?IsDate@Value@v8@@QBE_NXZ
?IsArgumentsObject@Value@v8@@QBE_NXZ
?IsBooleanObject@Value@v8@@QBE_NXZ
?IsNumberObject@Value@v8@@QBE_NXZ
?IsStringObject@Value@v8@@QBE_NXZ
?IsSymbolObject@Value@v8@@QBE_NXZ
?IsNativeError@Value@v8@@QBE_NXZ
?IsRegExp@Value@v8@@QBE_NXZ
?IsGeneratorFunction@Value@v8@@QBE_NXZ
?IsGeneratorObject@Value@v8@@QBE_NXZ
?IsPromise@Value@v8@@QBE_NXZ
?IsMap@Value@v8@@QBE_NXZ
?IsSet@Value@v8@@QBE_NXZ
?IsMapIterator@Value@v8@@QBE_NXZ
?IsSetIterator@Value@v8@@QBE_NXZ
?IsWeakMap@Value@v8@@QBE_NXZ
?IsWeakSet@Value@v8@@QBE_NXZ
?IsArrayBuffer@Value@v8@@QBE_NXZ
?IsArrayBufferView@Value@v8@@QBE_NXZ
?IsTypedArray@Value@v8@@QBE_NXZ
?IsUint8ClampedArray@Value@v8@@QBE_NXZ
?IsInt8Array@Value@v8@@QBE_NXZ
?IsUint16Array@Value@v8@@QBE_NXZ
?IsInt16Array@Value@v8@@QBE_NXZ
?IsUint32Array@Value@v8@@QBE_NXZ
?IsInt32Array@Value@v8@@QBE_NXZ
?IsFloat32Array@Value@v8@@QBE_NXZ
?IsFloat64Array@Value@v8@@QBE_NXZ
?IsDataView@Value@v8@@QBE_NXZ
?IsSharedArrayBuffer@Value@v8@@QBE_NXZ
?ToBoolean@Value@v8@@QBE?AV?$Local@VBoolean@v8@@@2@PAVIsolate@2@@Z
?ToNumber@Value@v8@@QBE?AV?$Local@VNumber@v8@@@2@PAVIsolate@2@@Z
?ToUint32@Value@v8@@QBE?AV?$Local@VUint32@v8@@@2@PAVIsolate@2@@Z
?ToInt32@Value@v8@@QBE?AV?$Local@VInt32@v8@@@2@PAVIsolate@2@@Z
?BooleanValue@Value@v8@@QBE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@@Z
?Utf8Length@String@v8@@QBEHXZ
?WriteUtf8@String@v8@@QBEHPADHPAHH@Z
?Value@Number@v8@@QBENXZ
?NewFromUnsigned@Integer@v8@@SA?AV?$Local@VInteger@v8@@@2@PAVIsolate@2@I@Z
?Length@String@v8@@QBEHXZ
?SlowGetAlignedPointerFromInternalField@Object@v8@@AAEPAXH@Z

kernel32

WideCharToMultiByte
CreateFileW
RaiseException
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SystemTimeToFileTime
MultiByteToWideChar
ReadFile
WriteFile
GetLastError
GetModuleHandleW
GetProcAddress
CloseHandle
DebugBreak
GetSystemTime
LoadLibraryW
OutputDebugStringA
InterlockedCompareExchange
GetCurrentProcess
GetVersionExW
GetNativeSystemInfo
GlobalAlloc
GlobalLock
GlobalUnlock
InterlockedIncrement
InterlockedDecrement
GlobalFree
TerminateProcess
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateEventW
GetModuleFileNameW
CreateProcessW
OutputDebugStringW
GetTempPathW
GetFullPathNameW
GetCurrentProcessId
FreeLibrary
InitializeCriticalSection
Sleep
InterlockedExchangeAdd
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
GetFileSize
GetLongPathNameW
GetTempFileNameW
MoveFileExW
GetCommandLineW
SetEvent
LocalFree
CreateThread
FormatMessageW
GetVersion
InitializeCriticalSectionAndSpinCount

user32

CreateMenu
SetMenu
MessageBoxW
LoadCursorW
FindWindowExW
GetPropW
SetPropW
ShowWindow
CreateWindowExW
GetClassInfoW
RegisterClassW
DefWindowProcW
SendMessageW
RegisterClipboardFormatW
GetFocus
SetCapture
ReleaseCapture
SetTimer
KillTimer
IsWindowEnabled
GetSystemMetrics
GetSystemMenu
EnableMenuItem
GetDC
GetWindowDC
ReleaseDC
BeginPaint
EndPaint
SetWindowRgn
InvalidateRect
RemovePropW
SetWindowTextW
GetWindowTextW
GetClientRect
GetWindowRect
SetCursor
CreatePopupMenu
IntersectRect
PtInRect
GetWindowLongW
SetWindowLongW
GetDesktopWindow
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
EnumDisplaySettingsW
MonitorFromWindow
GetMonitorInfoW
EnumDisplayMonitors
MessageBeep
RegisterWindowMessageW
LoadMenuW
GetSubMenu
GetMenuItemID
SetMenuDefaultItem
DestroyIcon
TranslateMessage
DispatchMessageW
PeekMessageW
PostThreadMessageW
MessageBoxA
DestroyMenu
GetMenuItemCount
TrackPopupMenu
InsertMenuItemW
GetMenuItemInfoW
SetMenuItemInfoW
SetForegroundWindow
GetCursorPos
LoadIconW
PostMessageW
SetFocus
IsWindow
DestroyWindow
MoveWindow
SetWindowPos
IsWindowVisible
IsIconic
ScreenToClient
IsZoomed
RegisterClassExW

gdi32

BitBlt
SetRectRgn
SelectObject
PtInRegion
GetDeviceCaps
CombineRgn
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgn
CreateRoundRectRgn
DeleteDC
DeleteObject

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

shell32

DragAcceptFiles
ShellExecuteW
SHChangeNotify
Shell_NotifyIconW
SHParseDisplayName
SHGetDesktopFolder
CommandLineToArgvW
ShellExecuteExW
DragFinish
DragQueryFileW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathW

ole32

ReleaseStgMedium
OleDuplicateData
RegisterDragDrop
RevokeDragDrop
DoDragDrop
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

winmm

timeGetTime

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathIsDirectoryW

gdiplus

GdipCreateBitmapFromGdiDib
GdipCreateHBITMAPFromBitmap
GdipCreateHICONFromBitmap
GdipFree
GdipCloneImage
GdipDisposeImage
GdipSaveImageToStream
GdiplusStartup
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipAlloc
GdipCreateBitmapFromStreamICM

msvcp60

?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHABV12@@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHPBG@Z
?infinity@?$numeric_limits@N@std@@SANXZ
?length@?$char_traits@D@std@@SAIPBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGIABV?$allocator@G@1@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXPADID@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IABV12@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0ABV?$allocator@D@1@@Z
?at@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBG@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIABV12@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?compare@?$char_traits@D@std@@SAHPBD0I@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IID@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?max@?$numeric_limits@H@std@@SAHXZ
?min@?$numeric_limits@H@std@@SAHXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?find_first_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ
?reserve@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?data@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ

msvcrt

memset
_vsnprintf
free
_purecall
malloc
memcmp
ceil
floor
??2@YAPAXI@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
sprintf
abort
strncmp
_vscprintf
strtod
isspace
_except_handler3
_snwprintf
swprintf
wcsstr
strstr
isxdigit
strncat
strncpy
sscanf
??0exception@@QAE@ABV0@@Z
_CxxThrowException
_strtoui64
_close
_open_osfhandle
__iob_func
fprintf
wcsncpy
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
memcpy

Exports

Exports

napi_add_env_cleanup_hook
napi_adjust_external_memory
napi_async_destroy
napi_async_init
napi_call_function
napi_cancel_async_work
napi_close_callback_scope
napi_close_escapable_handle_scope
napi_close_handle_scope
napi_coerce_to_bool
napi_coerce_to_number
napi_coerce_to_object
napi_coerce_to_string
napi_create_array
napi_create_array_with_length
napi_create_arraybuffer
napi_create_async_work
napi_create_buffer
napi_create_buffer_copy
napi_create_dataview
napi_create_double
napi_create_error
napi_create_external
napi_create_external_arraybuffer
napi_create_external_buffer
napi_create_function
napi_create_int32
napi_create_int64
napi_create_object
napi_create_promise
napi_create_range_error
napi_create_reference
napi_create_string_latin1
napi_create_string_utf16
napi_create_string_utf8
napi_create_symbol
napi_create_type_error
napi_create_typedarray
napi_create_uint32
napi_define_class
napi_define_properties
napi_delete_async_work
napi_delete_element
napi_delete_property
napi_delete_reference
napi_escape_handle
napi_fatal_error
napi_fatal_exception
napi_get_and_clear_last_exception
napi_get_array_length
napi_get_arraybuffer_info
napi_get_boolean
napi_get_buffer_info
napi_get_cb_info
napi_get_dataview_info
napi_get_element
napi_get_global
napi_get_instance_data
napi_get_last_error_info
napi_get_named_property
napi_get_new_target
napi_get_node_version
napi_get_null
napi_get_property
napi_get_property_names
napi_get_prototype
napi_get_reference_value
napi_get_typedarray_info
napi_get_undefined
napi_get_uv_event_loop
napi_get_value_bool
napi_get_value_double
napi_get_value_external
napi_get_value_int32
napi_get_value_int64
napi_get_value_string_latin1
napi_get_value_string_utf16
napi_get_value_string_utf8
napi_get_value_uint32
napi_get_version
napi_has_element
napi_has_named_property
napi_has_own_property
napi_has_property
napi_instanceof
napi_is_array
napi_is_arraybuffer
napi_is_buffer
napi_is_dataview
napi_is_error
napi_is_exception_pending
napi_is_promise
napi_is_typedarray
napi_make_callback
napi_module_register
napi_new_instance
napi_open_callback_scope
napi_open_escapable_handle_scope
napi_open_handle_scope
napi_queue_async_work
napi_reference_ref
napi_reference_unref
napi_reject_deferred
napi_remove_env_cleanup_hook
napi_remove_wrap
napi_resolve_deferred
napi_run_script
napi_set_element
napi_set_instance_data
napi_set_named_property
napi_set_property
napi_strict_equals
napi_throw
napi_throw_error
napi_throw_range_error
napi_throw_type_error
napi_typeof
napi_unwrap
napi_wrap
uv_accept
uv_async_init
uv_async_send
uv_backend_fd
uv_backend_timeout
uv_barrier_destroy
uv_barrier_init
uv_barrier_wait
uv_buf_init
uv_cancel
uv_chdir
uv_check_init
uv_check_start
uv_check_stop
uv_close
uv_cond_broadcast
uv_cond_destroy
uv_cond_init
uv_cond_signal
uv_cond_timedwait
uv_cond_wait
uv_cpu_info
uv_cwd
uv_default_loop
uv_disable_stdio_inheritance
uv_dlclose
uv_dlerror
uv_dlopen
uv_dlsym
uv_err_name
uv_exepath
uv_fileno
uv_free_cpu_info
uv_free_interface_addresses
uv_freeaddrinfo
uv_fs_access
uv_fs_chmod
uv_fs_chown
uv_fs_close
uv_fs_event_getpath
uv_fs_event_init
uv_fs_event_start
uv_fs_event_stop
uv_fs_fchmod
uv_fs_fchown
uv_fs_fdatasync
uv_fs_fstat
uv_fs_fsync
uv_fs_ftruncate
uv_fs_futime
uv_fs_link
uv_fs_lstat
uv_fs_mkdir
uv_fs_mkdtemp
uv_fs_open
uv_fs_poll_getpath
uv_fs_poll_init
uv_fs_poll_start
uv_fs_poll_stop
uv_fs_read
uv_fs_readlink
uv_fs_realpath
uv_fs_rename
uv_fs_req_cleanup
uv_fs_rmdir
uv_fs_scandir
uv_fs_scandir_next
uv_fs_sendfile
uv_fs_stat
uv_fs_symlink
uv_fs_unlink
uv_fs_utime
uv_fs_write
uv_get_free_memory
uv_get_process_title
uv_get_total_memory
uv_getaddrinfo
uv_getnameinfo
uv_getrusage
uv_guess_handle
uv_handle_size
uv_has_ref
uv_hrtime
uv_idle_init
uv_idle_start
uv_idle_stop
uv_inet_ntop
uv_inet_pton
uv_interface_addresses
uv_ip4_addr
uv_ip4_name
uv_ip6_addr
uv_ip6_name
uv_is_active
uv_is_closing
uv_is_readable
uv_is_writable
uv_key_create
uv_key_delete
uv_key_get
uv_key_set
uv_kill
uv_listen
uv_loadavg
uv_loop_alive
uv_loop_close
uv_loop_delete
uv_loop_init
uv_loop_new
uv_loop_size
uv_mutex_destroy
uv_mutex_init
uv_mutex_lock
uv_mutex_trylock
uv_mutex_unlock
uv_now
uv_once
uv_os_free_passwd
uv_os_get_passwd
uv_os_homedir
uv_os_tmpdir
uv_pipe_bind
uv_pipe_connect
uv_pipe_getpeername
uv_pipe_getsockname
uv_pipe_init
uv_pipe_open
uv_pipe_pending_count
uv_pipe_pending_instances
uv_pipe_pending_type
uv_poll_init
uv_poll_init_socket
uv_poll_start
uv_poll_stop
uv_prepare_init
uv_prepare_start
uv_prepare_stop
uv_print_active_handles
uv_print_all_handles
uv_process_kill
uv_queue_work
uv_read_start
uv_read_stop
uv_recv_buffer_size
uv_ref
uv_replace_allocator
uv_req_size
uv_resident_set_memory
uv_run
uv_rwlock_destroy
uv_rwlock_init
uv_rwlock_rdlock
uv_rwlock_rdunlock
uv_rwlock_tryrdlock
uv_rwlock_trywrlock
uv_rwlock_wrlock
uv_rwlock_wrunlock
uv_sem_destroy
uv_sem_init
uv_sem_post
uv_sem_trywait
uv_sem_wait
uv_send_buffer_size
uv_set_process_title
uv_setup_args
uv_shutdown
uv_signal_init
uv_signal_start
uv_signal_stop
uv_spawn
uv_stop
uv_stream_set_blocking
uv_strerror
uv_tcp_bind
uv_tcp_connect
uv_tcp_getpeername
uv_tcp_getsockname
uv_tcp_init
uv_tcp_init_ex
uv_tcp_keepalive
uv_tcp_nodelay
uv_tcp_open
uv_tcp_simultaneous_accepts
uv_thread_create
uv_thread_equal
uv_thread_join
uv_thread_self
uv_timer_again
uv_timer_get_repeat
uv_timer_init
uv_timer_set_repeat
uv_timer_start
uv_timer_stop
uv_try_write
uv_tty_get_winsize
uv_tty_init
uv_tty_reset_mode
uv_tty_set_mode
uv_udp_bind
uv_udp_getsockname
uv_udp_init
uv_udp_init_ex
uv_udp_open
uv_udp_recv_start
uv_udp_recv_stop
uv_udp_send
uv_udp_set_broadcast
uv_udp_set_membership
uv_udp_set_multicast_interface
uv_udp_set_multicast_loop
uv_udp_set_multicast_ttl
uv_udp_set_ttl
uv_udp_try_send
uv_unref
uv_update_time
uv_uptime
uv_version
uv_version_string
uv_walk
uv_write
uv_write2

Sections

.text
Size: 513KB - Virtual size: 513KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ae527738bb8c25367eaa9412e8f35ab

Code Sign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

a6:02:b1:29:d0:4f:62:4e:59:28:95:91:74:86:02:95Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

53:c7:46:fa:c8:0e:79:a1:5f:d7:16:75:93:c8:5b:df:55:da:0b:6f:93:1d:37:8d:95:da:15:43:b6:c4:63:9fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

imm32

node

kernel32

user32

gdi32

comdlg32

shell32

ole32

winmm

shlwapi

gdiplus

msvcp60

msvcrt

Exports

Exports

Sections

.text Size: 513KB - Virtual size: 513KB

.rdata Size: 88KB - Virtual size: 87KB

.data Size: 48KB - Virtual size: 52KB

.CRT Size: 512B - Virtual size: 156B

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 29KB - Virtual size: 28KB

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

a6:02:b1:29:d0:4f:62:4e:59:28:95:91:74:86:02:95
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

53:c7:46:fa:c8:0e:79:a1:5f:d7:16:75:93:c8:5b:df:55:da:0b:6f:93:1d:37:8d:95:da:15:43:b6:c4:63:9f
Signer

.text
Size: 513KB - Virtual size: 513KB

.rdata
Size: 88KB - Virtual size: 87KB

.data
Size: 48KB - Virtual size: 52KB

.CRT
Size: 512B - Virtual size: 156B

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 29KB - Virtual size: 28KB