2024-06-19_7c91376758f57d725a7ab76694640e3b_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-19_7c91376758f57d725a7ab76694640e3b_icedid
Size

9.2MB
MD5

7c91376758f57d725a7ab76694640e3b
SHA1

33d2d327813369f9ea3d125dad5bde05aa8e9f4a
SHA256

2a97c61dfcbb419c06eb121a7cad630dad803d71f891fd2620ed5a07c011eef5
SHA512

6e123b9bb8a139f8e82fd4d5513264c03146e438c754deb1e628e30ed151729408f8a6fb04fd4f7c5b232cc52b8e0598680b3a99cf0824837195a7a942f0d469
SSDEEP

98304:9ctS6Ed29heof4r9VaVW44m/jkcIDOnVXX4XnkoeyVo3c3phEEpsUl6mkFPjF63W:YpEof4r38B4IjHVXX4vuephECB6TFCRk

Score

1^/10

Malware Config

Signatures

Files

2024-06-19_7c91376758f57d725a7ab76694640e3b_icedid
.exe windows:6 windows x86 arch:x86

8bc1a0b44a5d231ddd2151a3b66bf3d3

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ec:8e:4d:a0:9c:b5:89:45:35:4f:74:64:bc:20:c2:29
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

09/09/2021, 00:00

Not After

08/09/2024, 23:59

Subject

CN=Florian Heidenreich,O=Florian Heidenreich,ST=Sachsen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

00:09:5b:30:df:41:42:92:20:ad:42:04:39:82:1e:de:38:e0:22:30:d7:fb:59:40:ba:72:5e:d3:ca:72:ae:47
Signer

Actual PE Digest

00:09:5b:30:df:41:42:92:20:ad:42:04:39:82:1e:de:38:e0:22:30:d7:fb:59:40:ba:72:5e:d3:ca:72:ae:47

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Y:\build\binaries\mp3tag\Mp3tag.pdb

Imports

shlwapi

PathRelativePathToW
PathSearchAndQualifyW
PathIsUNCW
PathQuoteSpacesW
ord12
PathFindFileNameW
PathRemoveExtensionW
PathFindExtensionW
PathRemoveFileSpecW
PathStripToRootW
ord219
PathCompactPathW
StrCmpLogicalW
PathIsRelativeW

uxtheme

DrawThemeBackground
DrawThemeParentBackground
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetThemeMargins
GetThemeInt
SetWindowTheme
OpenThemeData
GetThemeColor
CloseThemeData
GetThemeBackgroundContentRect
EndBufferedPaint
BufferedPaintSetAlpha
BeginBufferedPaint
DrawThemeText

kernel32

Beep
CompareStringOrdinal
LoadLibraryExW
VirtualProtect
GetACP
OutputDebugStringA
GetModuleHandleA
EncodePointer
lstrcmpW
GlobalFindAtomW
CompareStringW
GetVersionExW
lstrcmpA
CompareStringA
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
SuspendThread
ResumeThread
GetProfileIntW
GetDiskFreeSpaceW
ReplaceFileW
FlushFileBuffers
LockFile
UnlockFile
DuplicateHandle
GetThreadLocale
GetFileSizeEx
LocalFileTimeToFileTime
CreateSemaphoreW
GetAtomNameW
GlobalFlags
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
SetErrorMode
FindResourceExW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SwitchToThread
SignalObjectAndWait
GetSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileType
ExpandEnvironmentStringsW
GetVolumeInformationW
GetDiskFreeSpaceExW
HeapCreate
GetFullPathNameA
GetNativeSystemInfo
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
DeleteFileA
HeapCompact
LockFileEx
GetTickCount
AreFileApisANSI
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
SetConsoleCtrlHandler
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
IsValidLocale
ExitProcess
GetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
SetStdHandle
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
HeapQueryInformation
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetCPInfo
CompareStringEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateEventExW
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFileInformationByHandle
LCMapStringEx
GetLocaleInfoEx
RtlCaptureStackBackTrace
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
FormatMessageA
RaiseException
GetWindowsDirectoryW
GetSystemDirectoryW
VerifyVersionInfoW
VerSetConditionMask
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetThreadPriority
ReadDirectoryChangesW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
InitializeCriticalSectionAndSpinCount
WriteFile
ReadFile
SetEndOfFile
SetFilePointer
CreateProcessW
lstrcatW
GetCommandLineW
SetCurrentDirectoryW
GetCurrentDirectoryW
RemoveDirectoryW
CreateDirectoryW
OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFullPathNameW
SetFileTime
GetFileTime
GetLongPathNameW
GetShortPathNameW
GetFileAttributesExW
GetFileSize
MoveFileExW
GetTickCount64
MoveFileW
SetFileAttributesW
CopyFileW
DeleteFileW
SystemTimeToFileTime
CreateMutexW
GetCurrentThread
SleepEx
SetEvent
SetThreadPriority
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
HeapDestroy
DecodePointer
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
NormalizeString
IsNormalizedString
GetTempFileNameW
LCMapStringW
GetStringTypeExW
LCMapStringA
LoadLibraryA
GetStringTypeExA
GetUserDefaultLCID
CreateSemaphoreExW
CreateMutexExW
GlobalGetAtomNameW
GetVersion
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
OutputDebugStringW
IsDebuggerPresent
FindNextFileW
lstrcpynW
GetEnvironmentVariableW
WaitForMultipleObjects
MulDiv
Sleep
GetFileAttributesW
TerminateThread
CreateThread
QueryPerformanceFrequency
QueryPerformanceCounter
lstrcpyW
GlobalUnlock
LocalAlloc
GlobalLock
GlobalFree
GlobalAlloc
GlobalSize
WaitForSingleObject
ResetEvent
CreateEventW
FreeLibrary
GetDriveTypeW
SetLastError
LocalFree
WideCharToMultiByte
lstrcmpiW
lstrlenW
EnumSystemLocalesW
FindClose
FindFirstFileW
GetLocaleInfoW
GetModuleHandleW
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
TzSpecificLocalTimeToSystemTime
HeapFree
GetProcessHeap
HeapAlloc
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
GlobalDeleteAtom
GlobalAddAtomW
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
GetLastError
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
GetTempPathW
GetProcAddress
LoadLibraryW
GetModuleFileNameW
SetUnhandledExceptionFilter
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
VirtualFree
SetProcessAffinityMask
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
WaitForMultipleObjectsEx
GetFileInformationByHandle
PeekNamedPipe
UnlockFileEx

user32

InvalidateRgn
BeginPaint
EndPaint
SetPropW
SetWindowRgn
IsZoomed
GetScrollInfo
GetClassLongW
GetWindowRgn
MapWindowPoints
IsMenu
AdjustWindowRectEx
DeferWindowPos
TrackMouseEvent
FrameRect
FillRect
SetRect
CopyIcon
DrawEdge
UnionRect
DestroyCursor
GetComboBoxInfo
SetWindowPos
PostThreadMessageW
CreateWindowExW
RegisterClassW
DestroyWindow
DefWindowProcW
DrawTextW
GetIconInfo
CreateIconIndirect
DrawIconEx
CreateMenu
GetMenuItemInfoW
GetMenuState
DeleteMenu
ModifyMenuW
LoadMenuW
SetMenuDefaultItem
SendDlgItemMessageA
SetRectEmpty
UnregisterClassA
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
IsWindowEnabled
GetMessageTime
CallWindowProcW
GetClassInfoW
GetClassInfoExW
IsChild
GetWindowPlacement
SetWindowPlacement
SetFocus
MonitorFromRect
MsgWaitForMultipleObjects
CharUpperBuffW
SendMessageTimeoutW
GetLastActivePopup
MsgWaitForMultipleObjectsEx
PeekMessageW
IsWindowUnicode
GetMessageW
GetMessageA
DispatchMessageA
DestroyAcceleratorTable
LoadAcceleratorsW
DestroyMenu
SetActiveWindow
GetCapture
OpenClipboard
GetMenu
EnableWindow
SendMessageW
MessageBoxW
UpdateWindow
GetAsyncKeyState
KillTimer
SetTimer
PostMessageW
SendDlgItemMessageW
GetDlgItemTextW
MonitorFromWindow
GetMonitorInfoW
CopyRect
SystemParametersInfoW
GetWindowRect
CreatePopupMenu
AppendMenuW
SetDlgItemTextW
GetDlgItem
GetClientRect
InsertMenuW
GetWindow
LoadIconW
GetFocus
GetMessagePos
RegisterClipboardFormatW
IsClipboardFormatAvailable
GetClipboardData
EmptyClipboard
SetClipboardData
GetPriorityClipboardFormat
ReleaseDC
GetDC
DragDetect
GetParent
CheckMenuRadioItem
EnumClipboardFormats
CheckMenuItem
CloseClipboard
GetSubMenu
SetMenu
TrackPopupMenuEx
GetForegroundWindow
ValidateRect
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
GetPropW
RemovePropW
GetTopWindow
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetScrollInfo
WinHelpW
ShowWindow
MoveWindow
SetDlgItemInt
GetDlgItemInt
CheckDlgButton
CheckRadioButton
IsDlgButtonChecked
ScrollWindowEx
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
GetMenuStringW
RemoveMenu
GetKeyNameTextW
MapVirtualKeyW
PostQuitMessage
WaitMessage
ShowOwnedPopups
GetWindowThreadProcessId
DrawTextExW
GrayStringW
TabbedTextOutW
LockWindowUpdate
ScreenToClient
PtInRect
GetMenuItemCount
GetMenuItemID
ClientToScreen
GetSysColor
WindowFromPoint
SetCursor
LoadCursorW
TranslateMessage
DispatchMessageW
InvalidateRect
GetDlgCtrlID
IsWindow
DestroyIcon
RedrawWindow
GetWindowDC
GetSystemMetrics
MessageBeep
IntersectRect
EqualRect
RegisterWindowMessageW
EnableMenuItem
GetClassNameW
IsWindowVisible
IsIconic
SetForegroundWindow
GetCursorPos
TrackPopupMenu
GetMenuInfo
GetSysColorBrush
SetMenuInfo
DrawMenuBar
MonitorFromPoint
LoadStringA
LoadImageW
LoadStringW
BeginDeferWindowPos
EndDeferWindowPos
GetDesktopWindow
GetKeyState
InflateRect
OffsetRect
CharLowerBuffW
IsRectEmpty
GetWindowLongW
SetCapture
ReleaseCapture
GetDCEx
UnregisterClassW
CharLowerW
CharUpperW
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
SetWindowLongW
MapDialogRect
DrawIcon
BringWindowToTop
TranslateAcceleratorW
InsertMenuItemW
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
GetSystemMenu
SetParent
GetDialogBaseUnits
RealChildWindowFromPoint
CopyImage
GetActiveWindow

gdi32

IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
GetWindowExtEx
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
MoveToEx
TextOutW
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetMapMode
DPtoLP
CreateEllipticRgn
CreateDIBSection
LPtoDP
GetBkColor
CreateFontW
GetCharWidthW
StretchDIBits
EnumFontFamiliesExW
GetViewportExtEx
GetObjectType
GetCurrentPositionEx
GetClipRgn
GetClipBox
Escape
CreatePatternBrush
CreateHatchBrush
CreateDIBPatternBrushPt
CreateDCW
CopyMetaFileW
SetPixelV
SetDIBits
Ellipse
ExcludeClipRect
SetPixel
SetBkMode
ExtTextOutW
SetBkColor
CreateDIBitmap
CreatePolygonRgn
GetPixel
CreateBitmap
GetWindowOrgEx
FillRgn
CombineRgn
SetRectRgn
OffsetRgn
CreateRectRgn
DeleteObject
GetDeviceCaps
SelectObject
CreateCompatibleDC
GetObjectW
CreateCompatibleBitmap
BitBlt
DeleteDC
CreateSolidBrush
GetTextExtentPoint32W
CreateFontIndirectW
GetTextMetricsW
GetCurrentObject
GetTextColor
CreateRectRgnIndirect
PatBlt
GetStockObject
SetTextColor
CreatePen
ExtCreatePen
StartDocW
GetDIBits

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

SetFileSecurityW
CryptReleaseContext
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
RegEnumKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegEnumValueW
RegSetValueW
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
GetFileSecurityW
GetUserNameW

shell32

DragQueryFileW
ShellExecuteW
SHGetFileInfoW
SHCreateItemFromIDList
SHParseDisplayName
SHCreateShellItemArrayFromIDLists
ord155
ord190
SHOpenFolderAndSelectItems
FindExecutableW
SHBindToParent
SHGetDataFromIDListW
SHAddToRecentDocs
ExtractIconW
DragFinish
Shell_NotifyIconW
SHCreateShellItem
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteExW
SHGetMalloc
SHFileOperationW
SHGetIDListFromObject
SHGetSpecialFolderPathW

comctl32

ord410
ImageList_SetBkColor
ImageList_ReplaceIcon
ord345
ord413
ImageList_DragMove
ImageList_DragShowNolock
ImageList_BeginDrag
ImageList_DragEnter
ImageList_GetImageInfo
ImageList_AddMasked
ImageList_DragLeave
ImageList_EndDrag
ord412
ImageList_GetIcon
ImageList_Draw

ole32

WriteFmtUserTypeStg
ReadFmtUserTypeStg
OleDuplicateData
OleRegGetUserType
SetConvertStg
CoCreateGuid
CoGetObjectContext
CoGetApartmentType
CoInitializeEx
OleSetClipboard
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
PropVariantCopy
CreateBindCtx
OleRun
CLSIDFromProgID
CoRegisterMessageFilter
CoRevokeClassObject
CoRegisterClassObject
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CoDisconnectObject
StringFromGUID2
CLSIDFromString
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
RegisterDragDrop
ReleaseStgMedium
CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoGetClassObject

oleaut32

SysFreeString
SysAllocStringLen
VariantInit
VariantClear
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
SysAllocString
LoadTypeLi
LoadRegTypeLi
VarDecFromStr
VarBstrFromDec
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
VariantCopy
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayCreate
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysReAllocStringLen
RegisterTypeLi

oledlg

OleUIBusyW

ws2_32

socket
htons
inet_addr
gethostbyname
WSASetLastError
connect
send
recv
closesocket
select
gethostname
accept
bind
getpeername
getsockname
htonl
inet_ntoa
ntohs
WSAAsyncSelect
WSAGetLastError
WSACleanup
WSAStartup
sendto
recvfrom

gdiplus

GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipSaveImageToStream
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipLoadImageFromStream
GdipGetImageWidth
GdipDrawPath
GdipDrawRectangleI
GdipAddPathArcI
GdipClosePathFigure
GdipStartPathFigure
GdipResetPath
GdipDeletePath
GdipCreatePath
GdipGetImagePixelFormat
GdipGetImageHeight
GdipDrawImageRectI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromStreamICM
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageFlags
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipGraphicsClear
GdipSetInterpolationMode
GdipCreateBitmapFromScan0

winmm

mciSendCommandW
mciGetErrorStringW

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

tak_deco_lib

tak_SSD_Destroy
tak_SSD_GetEncoderInfo
tak_SSD_GetStreamInfo
tak_SSD_Valid
tak_SSD_Create_FromStream

crypt32

CryptUnprotectMemory
CertFreeCertificateContext
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CryptProtectMemory

winhttp

WinHttpQueryAuthSchemes
WinHttpSetCredentials
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryDataAvailable
WinHttpSetStatusCallback
WinHttpReceiveResponse
WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpGetDefaultProxyConfiguration
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpSetOption
WinHttpQueryOption

bcrypt

BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptOpenAlgorithmProvider

Sections

.text
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8bc1a0b44a5d231ddd2151a3b66bf3d3

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

ec:8e:4d:a0:9c:b5:89:45:35:4f:74:64:bc:20:c2:29Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

00:09:5b:30:df:41:42:92:20:ad:42:04:39:82:1e:de:38:e0:22:30:d7:fb:59:40:ba:72:5e:d3:ca:72:ae:47Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

uxtheme

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

oledlg

ws2_32

gdiplus

winmm

oleacc

tak_deco_lib

crypt32

winhttp

bcrypt

Sections

.text Size: 5.8MB - Virtual size: 5.8MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 116KB - Virtual size: 157KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

ec:8e:4d:a0:9c:b5:89:45:35:4f:74:64:bc:20:c2:29
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

00:09:5b:30:df:41:42:92:20:ad:42:04:39:82:1e:de:38:e0:22:30:d7:fb:59:40:ba:72:5e:d3:ca:72:ae:47
Signer

.text
Size: 5.8MB - Virtual size: 5.8MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 116KB - Virtual size: 157KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB