2024-06-19_2338917bf70092c32892a8724942a159_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-19_2338917bf70092c32892a8724942a159_ryuk
Size

7.7MB
MD5

2338917bf70092c32892a8724942a159
SHA1

4f923b846c1a32c06778903bffdbb480c31acee8
SHA256

6119848bc2c55b58d71933846078f83adc2856f891543882a7676f34f6630212
SHA512

0890bda63be5e9eb3bed8c8a8067a224de42b4c2affd50d32bc0e19eb339aa22e0b90867a9dce1bb31073fcc96b68651985f2ccedcdbb48965d1df3221921383
SSDEEP

98304:ZH6D/qC3+Fu4+6bO6ldJnnn5TnGwiKyleHB1Omm6lw9w:zt8qn5tiQIj6lw

Score

1^/10

Malware Config

Signatures

Files

2024-06-19_2338917bf70092c32892a8724942a159_ryuk
.exe windows:5 windows x64 arch:x64

17994539918c3da53b8afd6c364b659d

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:1d:88:21:60:0f:31:47:00:cf:fa:1e:62:59:a1:44
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22/12/2021, 00:00

Not After

20/12/2024, 23:59

Subject

SERIALNUMBER=91110101MA0045N17U,CN=Beijing Microlive Vision Technology Co.\, Ltd.,O=Beijing Microlive Vision Technology Co.\, Ltd.,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

72:44:1e:91:ba:9a:7d:79:24:b3:9a:d5:bd:55:89:f7:4f:8d:be:15:35:50:aa:71:07:d2:0e:45:c4:95:5d:f4
Signer

Actual PE Digest

72:44:1e:91:ba:9a:7d:79:24:b3:9a:d5:bd:55:89:f7:4f:8d:be:15:35:50:aa:71:07:d2:0e:45:c4:95:5d:f4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

douyin_tray.exe.pdb

Imports

imm32

ImmDisableIME

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

lynx_shared

??0BridgeNativeModule@lynx@@QEAA@AEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@Z
??0CommonNativeModule@lynx@@QEAA@AEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@Z
??0LynxViewBaseBuilder@lynx@@QEAA@XZ
??1BridgeNativeModule@lynx@@QEAA@XZ
??1CommonNativeModule@lynx@@UEAA@XZ
??1LynxConfig@lynx@@QEAA@XZ
??1LynxGroup@lynx@@QEAA@XZ
??1LynxTemplateData@lynx@@QEAA@XZ
??1LynxViewBaseBuilder@lynx@@QEAA@XZ
?Create@LynxGroup@lynx@@SA?AV?$unique_ptr@VLynxGroup@lynx@@U?$default_delete@VLynxGroup@lynx@@@Cr@std@@@Cr@std@@AEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@45@V645@AEBV?$vector@V?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@23@@45@_N3@Z
?CreateLynxView@lynx@@YAPEAVLynxView@1@XZ
?DestroyLynxView@lynx@@YAXPEAVLynxView@1@@Z
?GenerateID@LynxGroup@lynx@@SA?AV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@XZ
?GetInstance@LynxEnv@lynx@@SAAEAV12@XZ
?GetNativeWindow@LynxView@lynx@@QEAAPEAUHWND__@@XZ
?LoadTemplate@LynxViewBase@lynx@@QEAAXAEBV?$vector@EV?$allocator@E@Cr@std@@@Cr@std@@AEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@45@PEAVLynxTemplateData@2@@Z
?RegisterMethod@BridgeNativeModule@lynx@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@AEBV?$function@$$A6AXPEAXAEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@AEBUBridgeMethodArguments@lynx@@AEBV?$function@$$A6AXW4BridgeStatusCode@lynx@@AEBVEncodableValue@2@@Z@23@@Z@45@@Z
?RegisterMethod@CommonNativeModule@lynx@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@AEBV?$function@$$A6A?AV?$unique_ptr@VEncodableValue@lynx@@U?$default_delete@VEncodableValue@lynx@@@Cr@std@@@Cr@std@@PEAXAEBV?$vector@VEncodableValue@lynx@@V?$allocator@VEncodableValue@lynx@@@Cr@std@@@23@@Z@45@@Z
?RegisterModule@LynxConfig@lynx@@QEAA_NAEBV?$shared_ptr@VBridgeNativeModule@lynx@@@Cr@std@@@Z
?RegisterModule@LynxConfig@lynx@@QEAA_NAEBV?$shared_ptr@VCommonNativeModule@lynx@@@Cr@std@@@Z
?SendGlobalEvent@LynxViewBase@lynx@@QEAAXAEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@0@Z
?SetCronetEngine@LynxEnv@lynx@@QEAAXPEAX@Z
?SetGlobalPropsData@LynxViewBase@lynx@@QEAAXAEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@Z
?SetPreferredLayoutHeight@LynxViewBase@lynx@@QEAAXM@Z
?SetPreferredLayoutWidth@LynxViewBase@lynx@@QEAAXM@Z
?TriggerLayout@LynxViewBase@lynx@@QEAAXXZ
?UpdateDataWithString@LynxViewBase@lynx@@QEAAXAEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@Z
?UpdateScreenMetrics@LynxViewBase@lynx@@QEAAXMMM@Z
?UpdateViewportWithPreferredSize@LynxViewBase@lynx@@QEAAXMM_N@Z

advapi32

CreateProcessAsUserW
CryptAcquireContextA
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptSetKeyParam
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SystemFunction036

dbghelp

MiniDumpWriteDump
SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreatePalette
CreateRectRgn
DeleteDC
DeleteEnhMetaFile
DeleteObject
ExtTextOutW
GetDIBits
GetDeviceCaps
GetEnhMetaFileHeader
GetEnhMetaFilePaletteEntries
PlayEnhMetaFile
RealizePalette
SelectObject
SelectPalette
SetBkColor
SetEnhMetaFileBits
SetWinMetaFileBits

shell32

CommandLineToArgvW
SHAppBarMessage
SHGetFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathW
SHQueryUserNotificationState
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconGetRect
Shell_NotifyIconW

shlwapi

PathFileExistsW
ord219
StrStrW

user32

AllowSetForegroundWindow
CallNextHookEx
ChangeWindowMessageFilterEx
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EnumChildWindows
EnumDisplayMonitors
FindWindowExW
FindWindowW
GetActiveWindow
GetClassNameA
GetClientRect
GetCursorPos
GetDC
GetDesktopWindow
GetDoubleClickTime
GetMessageW
GetQueueStatus
GetShellWindow
GetSysColor
GetSystemMetrics
GetWindow
GetWindowLongPtrW
GetWindowLongW
GetWindowRect
IsWindow
IsWindowVisible
KillTimer
LoadCursorW
LoadIconW
MessageBoxW
MonitorFromPoint
MonitorFromWindow
MoveWindow
MsgWaitForMultipleObjectsEx
PeekMessageW
PostMessageW
PostQuitMessage
RedrawWindow
RegisterClassExW
RegisterClassW
RegisterWindowMessageW
ReleaseDC
SendMessageTimeoutW
SetFocus
SetForegroundWindow
SetLayeredWindowAttributes
SetParent
SetTimer
SetWindowLongPtrW
SetWindowLongW
SetWindowPos
SetWindowsHookExW
ShowWindow
SystemParametersInfoW
TranslateMessage
UnhookWindowsHookEx
UnregisterClassW

winmm

PlaySoundW
timeBeginPeriod
timeEndPeriod
timeGetTime

kernel32

AcquireSRWLockExclusive
AddVectoredExceptionHandler
AreFileApisANSI
AssignProcessToJobObject
CallbackMayRunLong
CloseHandle
CloseThreadpool
CloseThreadpoolWork
CompareStringW
CreateDirectoryA
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateProcessW
CreateThread
CreateThreadpool
CreateThreadpoolWork
CreateToolhelp32Snapshot
DecodePointer
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FindResourceExW
FindResourceW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSize
GetFileSizeEx
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoEx
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetProcessTimes
GetProductInfo
GetQueuedCompletionStatus
GetShortPathNameW
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemPowerStatus
GetSystemTime
GetSystemTimeAsFileTime
GetSystemTimes
GetTempPathA
GetTempPathW
GetThreadId
GetThreadPriority
GetTickCount
GetTickCount64
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalMemoryStatusEx
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSListHead
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetModuleFileNameExW
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalFree
LockFile
LockFileEx
LockResource
MapViewOfFile
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
PostQueuedCompletionStatus
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
ResetEvent
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetHandleInformation
SetLastError
SetStdHandle
SetThreadPriority
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepConditionVariableSRW
SubmitThreadpoolWork
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
UnmapViewOfFile
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WTSGetActiveConsoleSessionId
WaitForSingleObject
WaitForSingleObjectEx
WaitForThreadpoolWorkCallbacks
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
WriteProcessMemory
lstrcpyA

ole32

CoCreateGuid
CoCreateInstance
CoInitialize
CoInitializeEx
CoRegisterInitializeSpy
CoRevokeInitializeSpy
CoSetProxyBlanket
CoTaskMemFree
CoUninitialize
PropVariantClear

parfait

?CreateLogRecorder@ParfaitWrapperBase@parfait@@QEAAPEAVParfaitLogRecorderBase@2@W4RECORD_INTERVAL@2@W4LOG_RECORD_LEVEL@2@@Z
?CreateRecorder@ParfaitWrapperBase@parfait@@QEAAPEAVParfaitRecorderBase@2@W4RECORD_INTERVAL@2@PEBD@Z
?DestroyLogRecorder@ParfaitWrapperBase@parfait@@QEAAXPEAVParfaitLogRecorderBase@2@@Z
?DestroyRecorder@ParfaitWrapperBase@parfait@@QEAAXPEAVParfaitRecorderBase@2@@Z
?DoRecord@ParfaitLogRecorderBase@parfait@@QEAAXXZ
?DoRecord@ParfaitRecorderBase@parfait@@QEAAXXZ
?InitGlobalEnv@ParfaitWrapperBase@parfait@@QEAAXAEAVParfaitGlobalEnvBuilderBase@2@@Z
?InitInstanceEnv@ParfaitWrapperBase@parfait@@QEAAXAEAVParfaitEnvBuilderBase@2@@Z
?SetAppVersion@ParfaitGlobalEnvBuilderBase@parfait@@QEAAAEAV12@PEBD@Z
?SetDid@ParfaitGlobalEnvBuilderBase@parfait@@QEAAAEAV12@PEBD@Z
?SetHost@ParfaitGlobalEnvBuilderBase@parfait@@QEAAAEAV12@PEBD@Z
?SetIsDebug@ParfaitGlobalEnvBuilderBase@parfait@@SAX_N@Z
?SetProcessName@ParfaitEnvBuilderBase@parfait@@QEAAAEAV12@PEBD@Z
?SetUid@ParfaitGlobalEnvBuilderBase@parfait@@QEAAAEAV12@PEBD@Z
?UploadFile@ParfaitWrapperBase@parfait@@QEAAXPEBDPEBUUploadFileCallback@12@@Z
?UploadWithFlushImmediately@ParfaitWrapperBase@parfait@@QEAAXXZ
?WriteCategory@ParfaitRecorderBase@parfait@@QEAAAEAV12@PEBD@Z
?WriteLog@ParfaitLogRecorderBase@parfait@@QEAAAEAV12@PEBD@Z
CreateParfaitEnvBuilder
CreateParfaitGlobalEnvBuilder
CreateParfaitWrapper
DestroyParfaitEnvBuilder
DestroyParfaitGlobalEnvBuilder
DestroyParfaitWrapper

sscronet

Cronet_Buffer_Create
Cronet_Buffer_GetData
Cronet_Buffer_GetSize
Cronet_Buffer_InitWithAlloc
Cronet_EngineParams_Create
Cronet_EngineParams_Destroy
Cronet_EngineParams_enable_check_result_set
Cronet_EngineParams_enable_quic_set
Cronet_EngineParams_http_cache_mode_set
Cronet_EngineParams_storage_path_set
Cronet_EngineParams_ttnet_params_set
Cronet_EngineParams_user_agent_set
Cronet_Engine_Create
Cronet_Engine_SetMD5Header
Cronet_Engine_StartWithParams
Cronet_Error_message_get
Cronet_Executor_CreateWith
Cronet_Executor_GetClientContext
Cronet_Executor_SetClientContext
Cronet_FrontierMessageHandler_Create
Cronet_FrontierMessageHandler_Decode
Cronet_FrontierMessageHandler_Destroy
Cronet_FrontierMessage_Destroy
Cronet_FrontierMessage_payload_get
Cronet_FrontierMessage_payload_size_get
Cronet_HttpHeader_Create
Cronet_HttpHeader_Destroy
Cronet_HttpHeader_name_get
Cronet_HttpHeader_name_set
Cronet_HttpHeader_value_get
Cronet_HttpHeader_value_set
Cronet_Runnable_Destroy
Cronet_Runnable_Run
Cronet_TTNetParams_Create
Cronet_TTNetParams_Destroy
Cronet_TTNetParams_app_id_set
Cronet_TTNetParams_app_name_set
Cronet_TTNetParams_device_id_set
Cronet_TTNetParams_device_platform_set
Cronet_TTNetParams_domain_boe_set
Cronet_TTNetParams_domain_httpdns_set
Cronet_TTNetParams_domain_netlog_set
Cronet_TTNetParams_get_domain_default_json_set
Cronet_TTNetParams_is_main_process_set
Cronet_TTNetParams_tnc_host_first_set
Cronet_TTNetParams_tnc_host_second_set
Cronet_TTNetParams_tnc_host_third_set
Cronet_TTNetParams_uuid_set
Cronet_TTNetParams_version_code_set
Cronet_UploadDataProvider_CreateWith
Cronet_UploadDataProvider_GetClientContext
Cronet_UploadDataProvider_SetClientContext
Cronet_UploadDataSink_OnReadSucceeded
Cronet_UploadDataSink_OnRewindSucceeded
Cronet_UrlRequestCallback_CreateWith
Cronet_UrlRequestCallback_Destroy
Cronet_UrlRequestCallback_GetClientContext
Cronet_UrlRequestCallback_SetClientContext
Cronet_UrlRequestParams_Create
Cronet_UrlRequestParams_Destroy
Cronet_UrlRequestParams_http_method_set
Cronet_UrlRequestParams_request_headers_add
Cronet_UrlRequestParams_upload_data_provider_executor_set
Cronet_UrlRequestParams_upload_data_provider_set
Cronet_UrlRequest_Cancel
Cronet_UrlRequest_Create
Cronet_UrlRequest_Destroy
Cronet_UrlRequest_FollowRedirect
Cronet_UrlRequest_InitWithParams
Cronet_UrlRequest_Read
Cronet_UrlRequest_Start
Cronet_UrlResponseInfo_all_headers_list_at
Cronet_UrlResponseInfo_all_headers_list_size
Cronet_UrlResponseInfo_http_status_code_get
Cronet_UrlResponseInfo_http_status_text_get
Cronet_WSClientConnectionParams_Create
Cronet_WSClientConnectionParams_Destroy
Cronet_WSClientConnectionParams_appId_set
Cronet_WSClientConnectionParams_appKey_set
Cronet_WSClientConnectionParams_appStateReportEnabled_set
Cronet_WSClientConnectionParams_appToken_set
Cronet_WSClientConnectionParams_appVersion_set
Cronet_WSClientConnectionParams_customHeaders_add
Cronet_WSClientConnectionParams_customParams_add
Cronet_WSClientConnectionParams_deviceId_set
Cronet_WSClientConnectionParams_fpid_set
Cronet_WSClientConnectionParams_ignoreOfflineState_set
Cronet_WSClientConnectionParams_installId_set
Cronet_WSClientConnectionParams_load_flags_set
Cronet_WSClientConnectionParams_mode_set
Cronet_WSClientConnectionParams_network_set
Cronet_WSClientConnectionParams_platform_set
Cronet_WSClientConnectionParams_sdkVersion_set
Cronet_WSClientConnectionParams_sessionId_set
Cronet_WSClientConnectionParams_sharedConnection_set
Cronet_WSClientConnectionParams_timeout_set
Cronet_WSClientConnectionParams_urls_add
Cronet_WSClientConnectionParams_webId_set
Cronet_WSClientDelegate_CreateWith
Cronet_WSClientDelegate_Destroy
Cronet_WSClientDelegate_GetClientContext
Cronet_WSClientDelegate_SetClientContext
Cronet_WSClient_AddDelegate
Cronet_WSClient_ConfigConnection
Cronet_WSClient_Create
Cronet_WSClient_Destroy
Cronet_WSClient_IsConnected
Cronet_WSClient_RemoveDelegate
Cronet_WSClient_SetupMode
Cronet_WSClient_StartConnection
Cronet_WSClient_StopConnection

gdiplus

GdipAlloc
GdipCloneImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipCreateFont
GdipCreateFontFamilyFromName
GdipCreateFromHDC
GdipCreateSolidFill
GdipCreateStringFormat
GdipDeleteBrush
GdipDeleteFont
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDisposeImage
GdipDrawImageRectI
GdipDrawImageRectRect
GdipDrawString
GdipFillRectangleI
GdipFree
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageGraphicsContext
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImageWidth
GdipLoadImageFromFile
GdipSaveImageToFile
GdipSetInterpolationMode
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetTextRenderingHint
GdiplusShutdown
GdiplusStartup

dwmapi

DwmEnableBlurBehindWindow
DwmExtendFrameIntoClientArea
DwmIsCompositionEnabled

winhttp

WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption

evr

MFCreateVideoSampleFromSurface

mf

MFCreateMediaSession
MFCreateTopoLoader
MFCreateTopology
MFCreateTopologyNode
MFCreateVideoRendererActivate
MFGetService

mfplat

MFCreateAttributes
MFCreateMediaType
MFCreateSourceResolver
MFShutdown
MFStartup
MFTEnum

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

ws2_32

htonl
htons
ntohl
ntohs

oleaut32

SysAllocString
SysFreeString
VariantClear
VariantInit

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

Exports

Exports

??0LynxGroup@lynx@@QEAA@AEBV01@@Z
??0LynxResourceProvider@lynx@@QEAA@AEBV01@@Z
??0LynxResourceProvider@lynx@@QEAA@AEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@Z
??0LynxResourceResponse@lynx@@QEAA@AEBV01@@Z
??0LynxResourceResponse@lynx@@QEAA@XZ
??0LynxTemplateData@lynx@@QEAA@AEBV01@@Z
??0LynxViewBuilder@lynx@@QEAA@XZ
??0LynxViewClient@lynx@@QEAA@AEBV01@@Z
??0LynxViewClient@lynx@@QEAA@XZ
??0MethodResult@lynx@@QEAA@XZ
??1LynxResourceProvider@lynx@@UEAA@XZ
??1LynxResourceResponse@lynx@@QEAA@XZ
??1LynxViewBuilder@lynx@@QEAA@XZ
??1LynxViewClient@lynx@@UEAA@XZ
??1MethodResult@lynx@@UEAA@XZ
??4LynxGroup@lynx@@QEAAAEAV01@AEBV01@@Z
??4LynxRect@lynx@@QEAAAEAU01@$$QEAU01@@Z
??4LynxRect@lynx@@QEAAAEAU01@AEBU01@@Z
??4LynxResourceProvider@lynx@@QEAAAEAV01@AEBV01@@Z
??4LynxResourceResponse@lynx@@QEAAAEAV01@AEBV01@@Z
??4LynxScreen@lynx@@QEAAAEAU01@$$QEAU01@@Z
??4LynxScreen@lynx@@QEAAAEAU01@AEBU01@@Z
??4LynxSize@lynx@@QEAAAEAU01@$$QEAU01@@Z
??4LynxSize@lynx@@QEAAAEAU01@AEBU01@@Z
??4LynxTemplateData@lynx@@QEAAAEAV01@AEBV01@@Z
??4LynxViewBaseBuilder@lynx@@QEAAAEAU01@$$QEAU01@@Z
??4LynxViewBaseBuilder@lynx@@QEAAAEAU01@AEBU01@@Z
??4LynxViewBuilder@lynx@@QEAAAEAU01@$$QEAU01@@Z
??4LynxViewBuilder@lynx@@QEAAAEAU01@AEBU01@@Z
??4LynxViewClient@lynx@@QEAAAEAV01@AEBV01@@Z
??_7LynxResourceProvider@lynx@@6B@
??_7LynxViewClient@lynx@@6B@
??_7MethodResult@lynx@@6B@
?Config@LynxEnv@lynx@@QEAAAEAVLynxConfig@2@XZ
?Create@LynxGroup@lynx@@SA?AV?$unique_ptr@VLynxGroup@lynx@@U?$default_delete@VLynxGroup@lynx@@@Cr@std@@@Cr@std@@AEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@45@@Z
?Create@LynxGroup@lynx@@SA?AV?$unique_ptr@VLynxGroup@lynx@@U?$default_delete@VLynxGroup@lynx@@@Cr@std@@@Cr@std@@AEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@45@AEBV?$vector@V?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@23@@45@@Z
?Create@LynxGroup@lynx@@SA?AV?$unique_ptr@VLynxGroup@lynx@@U?$default_delete@VLynxGroup@lynx@@@Cr@std@@@Cr@std@@AEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@45@AEBV?$vector@V?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@23@@45@_N2@Z
?EnableCanvas@LynxGroup@lynx@@QEAA_NXZ
?GetGroupId@LynxViewBase@lynx@@QEAAHXZ
?GetGroupName@LynxGroup@lynx@@QEAA?AV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@XZ
?GetID@LynxGroup@lynx@@QEAA?AV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@XZ
?GetPreloadJSPaths@LynxGroup@lynx@@QEAAAEBV?$vector@V?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@23@@Cr@std@@XZ
?GetType@LynxResourceProvider@lynx@@QEBA?AV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@XZ
?IsReadOnly@LynxTemplateData@lynx@@QEBA_NXZ
?MarkReadOnly@LynxTemplateData@lynx@@QEAAXXZ
?OnDestroy@LynxViewClient@lynx@@UEAAXPEAVLynxViewBase@2@@Z
?OnFirstLoadPerfReady@LynxViewClient@lynx@@UEAAXAEBV?$unordered_map@HNU?$hash@H@Cr@std@@U?$equal_to@H@23@V?$allocator@U?$pair@$$CBHN@Cr@std@@@23@@Cr@std@@AEBV?$unordered_map@HV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@U?$hash@H@23@U?$equal_to@H@23@V?$allocator@U?$pair@$$CBHV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@Cr@std@@@23@@45@@Z
?OnRuntimeReady@LynxViewClient@lynx@@UEAAXPEAVLynxViewBase@2@@Z
?OnUpdatePerfReady@LynxViewClient@lynx@@UEAAXAEBV?$unordered_map@HNU?$hash@H@Cr@std@@U?$equal_to@H@23@V?$allocator@U?$pair@$$CBHN@Cr@std@@@23@@Cr@std@@AEBV?$unordered_map@HV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@U?$hash@H@23@U?$equal_to@H@23@V?$allocator@U?$pair@$$CBHV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@Cr@std@@@23@@45@@Z
?SetFrame@LynxViewBase@lynx@@QEAAXMM@Z
?SetGlobalProps@LynxViewBase@lynx@@QEAAXV?$unique_ptr@VEncodableValue@lynx@@U?$default_delete@VEncodableValue@lynx@@@Cr@std@@@Cr@std@@@Z
?SetGlobalPropsData@LynxViewBase@lynx@@QEAAXAEBVLynxTemplateData@2@@Z
?SetGroupId@LynxViewBase@lynx@@QEAAXH@Z
?UseProviderJsEnv@LynxGroup@lynx@@QEAA_NXZ
?kMaxPath@LynxViewBaseBuilder@lynx@@2_KB
?kSingnleGroup@LynxGroup@lynx@@2QEBDEB
?module_name@CommonNativeModule@lynx@@QEAA?AV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@XZ
?onDataUpdated@LynxViewClient@lynx@@UEAAXXZ
?onErrorOccurred@LynxViewClient@lynx@@UEAAXHAEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@Z
?onPageUpdate@LynxViewClient@lynx@@UEAAXXZ
?onReceivedError@LynxViewClient@lynx@@UEAAXHAEBV?$basic_string@DU?$char_traits@D@Cr@std@@V?$allocator@D@23@@Cr@std@@@Z
Cr_z_adler32
Cr_z_adler32_combine
Cr_z_adler32_z
Cr_z_crc32
Cr_z_crc32_combine
Cr_z_crc32_combine_gen
Cr_z_crc32_combine_op
Cr_z_crc32_z
Cr_z_get_crc_table
Cr_z_zError
Cr_z_zlibCompileFlags
Cr_z_zlibVersion
GetHandleVerifier

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 191KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 124B

.tls
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 108B

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17994539918c3da53b8afd6c364b659d

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0a:1d:88:21:60:0f:31:47:00:cf:fa:1e:62:59:a1:44Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

72:44:1e:91:ba:9a:7d:79:24:b3:9a:d5:bd:55:89:f7:4f:8d:be:15:35:50:aa:71:07:d2:0e:45:c4:95:5d:f4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

imm32

wtsapi32

lynx_shared

advapi32

dbghelp

gdi32

shell32

shlwapi

user32

winmm

kernel32

ole32

parfait

sscronet

gdiplus

dwmapi

winhttp

evr

mf

mfplat

userenv

ws2_32

oleaut32

netapi32

iphlpapi

Exports

Exports

Sections

.text Size: 6.0MB - Virtual size: 6.0MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 191KB - Virtual size: 320KB

.pdata Size: 203KB - Virtual size: 203KB

.00cfg Size: 512B - Virtual size: 40B

.gxfg Size: 14KB - Virtual size: 13KB

.retplne Size: 512B - Virtual size: 124B

.tls Size: 512B - Virtual size: 337B

.voltbl Size: 512B - Virtual size: 108B

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 66KB - Virtual size: 66KB

.reloc Size: 28KB - Virtual size: 27KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0a:1d:88:21:60:0f:31:47:00:cf:fa:1e:62:59:a1:44
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

72:44:1e:91:ba:9a:7d:79:24:b3:9a:d5:bd:55:89:f7:4f:8d:be:15:35:50:aa:71:07:d2:0e:45:c4:95:5d:f4
Signer

.text
Size: 6.0MB - Virtual size: 6.0MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 191KB - Virtual size: 320KB

.pdata
Size: 203KB - Virtual size: 203KB

.00cfg
Size: 512B - Virtual size: 40B

.gxfg
Size: 14KB - Virtual size: 13KB

.retplne
Size: 512B - Virtual size: 124B

.tls
Size: 512B - Virtual size: 337B

.voltbl
Size: 512B - Virtual size: 108B

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 66KB - Virtual size: 66KB

.reloc
Size: 28KB - Virtual size: 27KB