Lazarus's Clumsy[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Lazarus's Clumsy.zip
Size

795KB
MD5

1cdfaf973f5367907f2893743739a11c
SHA1

222f926f29db5c8b3316b6b46d2bf5c7508fc8eb
SHA256

d863becb148b98738df753a77031a85851a08c2674ad7d44897265b49f364f32
SHA512

33ba8a94c7161a5a712fb6e698fa34f2c4985833da63bc5dc5ebf4a697b37b8b06829904c03046ab96aa7bd37617111c8926f2651e8d1d92a2767a4937bec3c5
SSDEEP

12288:rHBvLaXPJPxwvoKu2BS+tCV4Do/JZK9pdrxksjBl3S9p+3wSXmK6FAxK4wrU:71KVxwXuS98VHBZCpdPC9SXbzwg

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Lazarus's Clumsy/WinDivert.dll
unpack001/Lazarus's Clumsy/clumsy.exe
unpack001/Lazarus's Clumsy/iup.dll

Files

Lazarus's Clumsy.zip
.zip
Lazarus's Clumsy/Lazarus_Hotkey.ahk
.js
Lazarus's Clumsy/WinDivert.dll
.dll windows:4 windows x64 arch:x64

4544b9434647b234f3a827bc356d7008

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

CloseServiceHandle
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
StartServiceW

kernel32

CloseHandle
CreateEventW
CreateFileW
CreateMutexW
DeviceIoControl
GetLastError
GetModuleFileNameW
GetOverlappedResult
HeapAlloc
HeapCreate
HeapDestroy
ReleaseMutex
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject

Exports

Exports

WinDivertClose
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperCompileFilter
WinDivertHelperDecrementTTL
WinDivertHelperEvalFilter
WinDivertHelperFormatFilter
WinDivertHelperFormatIPv4Address
WinDivertHelperFormatIPv6Address
WinDivertHelperHashPacket
WinDivertHelperHtonIPv6Address
WinDivertHelperHtonIpv6Address
WinDivertHelperHtonl
WinDivertHelperHtonll
WinDivertHelperHtons
WinDivertHelperNtohIPv6Address
WinDivertHelperNtohIpv6Address
WinDivertHelperNtohl
WinDivertHelperNtohll
WinDivertHelperNtohs
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam
WinDivertShutdown

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1024B - Virtual size: 772B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lazarus's Clumsy/WinDivert64.sys
.sys windows:10 windows x64 arch:x64

c84ecd8417f3069c9748e69aa26094d7

Code Sign

f4:8b:a9:cb:78:dd:96:f2:dc:60:2f:ef:35:68:c9:2a
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/10/2017, 00:00

Not After

12/10/2020, 23:59

Subject

SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

01/08/2030, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:31:94:79:a3:18:f5:52:2d:06:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:34

Not After

03/06/2020, 18:34

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:35:90:cf:1f:c5:15:64:ae:ba:1a:2e:f9:67:ee:21:5d:a6:13:a2:71:fa:10:11:5a:93:53:6b:ef:43:59:45
Signer

Actual PE Digest

39:35:90:cf:1f:c5:15:64:ae:ba:1a:2e:f9:67:ee:21:5d:a6:13:a2:71:fa:10:11:5a:93:53:6b:ef:43:59:45

Digest Algorithm

sha256

PE Digest Matches

true

39:35:90:cf:1f:c5:15:64:ae:ba:1a:2e:f9:67:ee:21:5d:a6:13:a2:71:fa:10:11:5a:93:53:6b:ef:43:59:45
Signer

Actual PE Digest

39:35:90:cf:1f:c5:15:64:ae:ba:1a:2e:f9:67:ee:21:5d:a6:13:a2:71:fa:10:11:5a:93:53:6b:ef:43:59:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\WinDivert-2.1.0\install\MSVC\amd64\WinDivert64.pdb

Imports

ntoskrnl.exe

RtlCopyUnicodeString
KeBugCheckEx
IoGetRequestorProcess
PsGetProcessId
ExUuidCreate
ObfDereferenceObject
ObfReferenceObject
IoFreeMdl
IoAllocateMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
ExFreePoolWithTag
ExAllocatePoolWithTag
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
RtlGetVersion

hal

KeQueryPerformanceCounter

ndis.sys

NdisAllocateNetBufferPool
NdisFreeNetBufferPool
NdisAllocateNetBufferListPool
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisFreeNetBufferListPool

fwpkclnt.sys

FwpmEngineClose0
FwpmTransactionBegin0
FwpmTransactionAbort0
FwpmEngineOpen0
FwpmSubLayerAdd0
FwpmSubLayerDeleteByKey0
FwpmCalloutAdd0
FwpmCalloutDeleteByKey0
FwpmFilterAdd0
FwpmFilterDeleteByKey0
FwpmTransactionCommit0
FwpsCalloutRegister0
FwpsCalloutUnregisterByKey0
FwpsFlowAssociateContext0
FwpsFlowRemoveContext0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpsInjectNetworkSendAsync0
FwpsInjectForwardAsync0
FwpsInjectNetworkReceiveAsync0
FwpsQueryPacketInjectionState0

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lazarus's Clumsy/clumsy.exe
.exe windows:6 windows x64 arch:x64

b2c861fc1b89b067f7cd850c0f1db909

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\cherzog\Documents\GitHub\clumsy\bin\vs\Release\x64\clumsy.pdb

Imports

windivert

WinDivertClose
WinDivertHelperCalcChecksums
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertSend
WinDivertSetParam

iup

IupStoreAttribute
IupTimer
IupList
IupDialog
IupButton
IupImage
IupFrame
IupVbox
IupOpen
IupClose
IupMainLoop
IupGetCallback
IupDestroy
IupAppend
IupShowXY
IupToggle
IupText
IupLabel
IupHbox
IupSetCallback
IupSetAttribute
IupGetFloat
IupGetAttribute
IupFill
IupSetHandle
IupFlush
IupGetGlobal
IupStoreGlobal
IupGetInt

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

kernel32

GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ReleaseMutex
WaitForSingleObject
GetCurrentThreadId
InitializeSListHead
GetModuleHandleW
IsDebuggerPresent
UnhandledExceptionFilter
CreateMutexA
GetModuleHandleA
IsWow64Process
VerifyVersionInfoW
GetModuleFileNameA
GetCurrentProcess
VerSetConditionMask
GetTickCount
CreateThread
WaitForMultipleObjects
Sleep
GetLastError

user32

SendMessageA
LoadIconA
MessageBoxA

advapi32

FreeSid
AllocateAndInitializeSid
CheckTokenMembership

shell32

ShellExecuteExA

vcruntime140

memset
strchr
strrchr
memcpy
__current_exception_context
__current_exception
__C_specific_handler

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
_set_fmode
fread
fopen
__acrt_iob_func
__p__commode
__stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_cexit
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_exit
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_set_app_type
_seh_filter_exe
exit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

isspace

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lazarus's Clumsy/clumsy.pdb
Lazarus's Clumsy/iup.dll
.dll windows:6 windows x64 arch:x64

90c5201807a627bc07a7216f7de91c00

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetSystemInfo
GetCPInfoExA
GetCurrentProcessId
GetVersionExA
SetCurrentDirectoryA
GetCurrentDirectoryA
OutputDebugStringA
WaitForSingleObject
LoadLibraryExW
GetSystemDirectoryW
SetLastError
FindResourceW
LoadResource
LockResource
SizeofResource
GetLocalTime
CreateFileW
WriteFile
lstrcpyW
GlobalSize
GetFileAttributesW
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GetTickCount
GetComputerNameA
GetVersionExW
GetSystemDefaultUILanguage
GetModuleHandleW
WideCharToMultiByte
lstrcpynW
LocalFree
GetProcAddress
CloseHandle
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
CreateMutexW
GetModuleFileNameW
lstrlenW
GetCommandLineW
CompareStringW
GetCPInfoExW
MulDiv
MultiByteToWideChar
FreeLibrary
LoadLibraryW
RtlVirtualUnwind
Sleep
RtlCaptureContext

user32

GetActiveWindow
MapWindowPoints
DragDetect
GetClipboardFormatNameW
RegisterClipboardFormatW
SetRect
DrawFrameControl
DrawTextW
FrameRect
IsClipboardFormatAvailable
SetClipboardData
GetClipboardData
GetForegroundWindow
EmptyClipboard
CloseClipboard
OpenClipboard
GetCaretPos
GetFocus
CreateMenu
EnableMenuItem
GetMenuInfo
CheckMenuItem
RemoveMenu
DrawMenuBar
DestroyMenu
SetMenu
SetMenuInfo
SetMenuItemInfoW
IsMenu
GetSubMenu
TrackPopupMenu
SetMenuItemBitmaps
CreatePopupMenu
InsertMenuItemW
CheckMenuRadioItem
GetMenuState
GetMenuItemInfoW
PtInRect
GetComboBoxInfo
ShowCursor
KillTimer
MessageBoxIndirectW
CreateMDIWindowW
PostMessageW
GetWindow
GetMenuItemID
SetWindowRgn
FillRect
EndDialog
InflateRect
DefFrameProcW
GetWindowInfo
RegisterClassW
DefMDIChildProcW
LockWindowUpdate
SetLayeredWindowAttributes
SetCapture
IsZoomed
GetDlgItem
UpdateLayeredWindow
ReleaseCapture
LoadImageW
InvalidateRect
IsIconic
BeginPaint
EndPaint
GetWindowRect
GetAsyncKeyState
GetDesktopWindow
GetCursorPos
GetClientRect
MessageBoxW
GetSysColor
GetMessageW
DispatchMessageW
PeekMessageW
TranslateMessage
PostQuitMessage
GetKeyState
VkKeyScanA
GetKeyboardLayout
MapVirtualKeyA
EnumDisplayMonitors
CallNextHookEx
UnhookWindowsHookEx
EnumWindows
SetWindowsHookExW
SetForegroundWindow
SystemParametersInfoA
SetFocus
SystemParametersInfoW
GetWindowLongW
GetWindowTextLengthW
DefWindowProcW
GetMessageExtraInfo
CallWindowProcW
MapVirtualKeyW
DestroyWindow
GetDC
DrawEdge
SetScrollInfo
ShowScrollBar
SetTimer
GetCapture
GetScrollBarInfo
EnableScrollBar
SetScrollPos
DestroyCursor
DestroyIcon
UnregisterClassW
IsWindowVisible
SetWindowPos
SetWindowLongPtrW
CreateWindowExW
ScreenToClient
SendMessageW
GetSystemMetrics
SetWindowTextW
ChildWindowFromPointEx
GetWindowLongPtrW
ShowWindow
GetClassInfoW
RedrawWindow
ClientToScreen
TrackMouseEvent
DrawFocusRect
IsWindowEnabled
LoadCursorW
SetParent
SetCursor
SetWindowLongW
GetParent
RegisterWindowMessageW
SetCursorPos
ReleaseDC
SendInput
EnableWindow
GetWindowTextW
CreateIconIndirect
GetScrollInfo

gdi32

GetMetaFileBitsEx
GetEnhMetaFileBits
SetBkColor
CreateFontIndirectW
CreateRectRgnIndirect
PatBlt
Polygon
ExtCreatePen
EndPath
SetPixelV
BitBlt
BeginPath
SetGraphicsMode
FillPath
Arc
Pie
ModifyWorldTransform
SetViewportOrgEx
SetLayout
GetLayout
CreateCompatibleBitmap
StretchBlt
TextOutW
SetTextColor
SetBkMode
SelectClipRgn
ExcludeClipRect
SetTextAlign
CreateDIBSection
GetObjectW
CreateBitmap
GetObjectType
CreateCompatibleDC
GetStockObject
CreatePatternBrush
CreateRectRgn
DeleteDC
SetDCBrushColor
CombineRgn
CreateFontW
CreateSolidBrush
SelectObject
GetTextMetricsW
GetTextExtentPoint32W
DeleteObject
Polyline
GetDeviceCaps

comdlg32

GetSaveFileNameW
ChooseFontW
GetOpenFileNameW

advapi32

ReportEventA
RegisterEventSourceA
GetUserNameA
DeregisterEventSource

shell32

ShellExecuteA
ShellExecuteExA
ord74
DragFinish
DragAcceptFiles
DragQueryPoint
DragQueryFileW
SHGetPathFromIDListW
SHBrowseForFolderW
Shell_NotifyIconW

ole32

CoCreateInstance
CoUninitialize
DoDragDrop
OleUninitialize
ReleaseStgMedium
OleInitialize
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoInitializeEx

comctl32

InitCommonControlsEx
ImageList_Add
ImageList_GetImageInfo
ImageList_Draw
ImageList_GetImageCount
ImageList_Create
ImageList_Destroy
ord13
ord14
ImageList_BeginDrag
ImageList_DragMove
ImageList_DragEnter
ImageList_DragShowNolock
ImageList_DragLeave
ImageList_EndDrag
ImageList_GetIconSize

vcruntime140

__C_specific_handler
__std_type_info_destroy_list
memset
__intrinsic_setjmp
memmove
strstr
strchr
longjmp
memcpy

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc
realloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
fwrite
fread
feof
__stdio_common_vsscanf
fopen
fclose
getc
fseek
ungetc
__acrt_iob_func
__stdio_common_vfprintf
ferror
__stdio_common_vfscanf

api-ms-win-crt-string-l1-1-0

strtok
strcspn
strncpy
strncmp
wcsncpy
isalpha
isdigit
tolower
isalnum

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-locale-l1-1-0

localeconv
setlocale

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_cexit
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_execute_onexit_table

api-ms-win-crt-math-l1-1-0

fmod
acos
cosf
ceil
sqrt
sinf
sin
cos
atan2

Exports

Exports

IupAlarm
IupAnimatedLabel
IupAppend
IupBackgroundBox
IupButton
IupCalendar
IupCanvas
IupCbox
IupCboxV
IupCboxv
IupClassMatch
IupClipboard
IupClose
IupColorBrowser
IupColorDlg
IupColorbar
IupConfig
IupConfigCopy
IupConfigDialogClosed
IupConfigDialogShow
IupConfigGetVariableDouble
IupConfigGetVariableDoubleDef
IupConfigGetVariableDoubleId
IupConfigGetVariableDoubleIdDef
IupConfigGetVariableInt
IupConfigGetVariableIntDef
IupConfigGetVariableIntId
IupConfigGetVariableIntIdDef
IupConfigGetVariableStr
IupConfigGetVariableStrDef
IupConfigGetVariableStrId
IupConfigGetVariableStrIdDef
IupConfigLoad
IupConfigRecentInit
IupConfigRecentUpdate
IupConfigSave
IupConfigSetListVariable
IupConfigSetVariableDouble
IupConfigSetVariableDoubleId
IupConfigSetVariableInt
IupConfigSetVariableIntId
IupConfigSetVariableStr
IupConfigSetVariableStrId
IupConvertXYToPos
IupCopyAttributes
IupCopyClassAttributes
IupCreate
IupCreateV
IupCreatep
IupCreatev
IupDatePick
IupDestroy
IupDetach
IupDetachBox
IupDial
IupDialog
IupDrawArc
IupDrawBegin
IupDrawEnd
IupDrawFocusRect
IupDrawGetClipRect
IupDrawGetImageInfo
IupDrawGetSize
IupDrawGetTextSize
IupDrawImage
IupDrawLine
IupDrawParentBackground
IupDrawPolygon
IupDrawRectangle
IupDrawResetClip
IupDrawSelectRect
IupDrawSetClipRect
IupDrawText
IupDropButton
IupElementPropertiesDialog
IupExecute
IupExecuteWait
IupExitLoop
IupExpander
IupFileDlg
IupFill
IupFlatButton
IupFlatFrame
IupFlatLabel
IupFlatList
IupFlatScrollBox
IupFlatSeparator
IupFlatTabs
IupFlatTabsV
IupFlatTabsv
IupFlatToggle
IupFlush
IupFontDlg
IupFrame
IupGauge
IupGetAllAttributes
IupGetAllClasses
IupGetAllDialogs
IupGetAllNames
IupGetAttribute
IupGetAttributeHandle
IupGetAttributeHandleId
IupGetAttributeHandleId2
IupGetAttributeId
IupGetAttributeId2
IupGetAttributes
IupGetBrother
IupGetCallback
IupGetChild
IupGetChildCount
IupGetChildPos
IupGetClassAttributes
IupGetClassCallbacks
IupGetClassName
IupGetClassType
IupGetColor
IupGetDialog
IupGetDialogChild
IupGetDouble
IupGetDoubleId
IupGetDoubleId2
IupGetFile
IupGetFloat
IupGetFloatId
IupGetFloatId2
IupGetFocus
IupGetFunction
IupGetGlobal
IupGetHandle
IupGetInt
IupGetInt2
IupGetIntId
IupGetIntId2
IupGetIntInt
IupGetLanguage
IupGetLanguageString
IupGetName
IupGetNextChild
IupGetParam
IupGetParamV
IupGetParamv
IupGetParent
IupGetRGB
IupGetRGBId
IupGetRGBId2
IupGetText
IupGlobalsDialog
IupGridBox
IupGridBoxV
IupGridBoxv
IupHbox
IupHboxV
IupHboxv
IupHelp
IupHide
IupImage
IupImageRGB
IupImageRGBA
IupInsert
IupItem
IupLabel
IupLayoutDialog
IupLink
IupList
IupListDialog
IupLoad
IupLoadBuffer
IupLog
IupLogV
IupLoopStep
IupLoopStepWait
IupMainLoop
IupMainLoopLevel
IupMap
IupMenu
IupMenuV
IupMenuv
IupMessage
IupMessageAlarm
IupMessageDlg
IupMessageError
IupMessageV
IupMessagef
IupMultiBox
IupMultiBoxV
IupMultiBoxv
IupMultiLine
IupNextField
IupNormalizer
IupNormalizerV
IupNormalizerv
IupOpen
IupParam
IupParamBox
IupParamBoxV
IupParamBoxv
IupPlayInput
IupPopup
IupPreviousField
IupProgressBar
IupProgressDlg
IupRadio
IupRecordInput
IupRedraw
IupRefresh
IupRefreshChildren
IupReparent
IupResetAttribute
IupSaveClassAttributes
IupSaveImageAsText
IupSbox
IupScanf
IupScrollBox
IupSeparator
IupSetAtt
IupSetAttV
IupSetAttribute
IupSetAttributeHandle
IupSetAttributeHandleId
IupSetAttributeHandleId2
IupSetAttributeId
IupSetAttributeId2
IupSetAttributes
IupSetCallback
IupSetCallbacks
IupSetCallbacksV
IupSetClassDefaultAttribute
IupSetDouble
IupSetDoubleId
IupSetDoubleId2
IupSetFloat
IupSetFloatId
IupSetFloatId2
IupSetFocus
IupSetFunction
IupSetGlobal
IupSetHandle
IupSetInt
IupSetIntId
IupSetIntId2
IupSetLanguage
IupSetLanguagePack
IupSetLanguageString
IupSetRGB
IupSetRGBId
IupSetRGBId2
IupSetStrAttribute
IupSetStrAttributeId
IupSetStrAttributeId2
IupSetStrGlobal
IupSetStrf
IupSetStrfId
IupSetStrfId2
IupSetStrfId2V
IupSetStrfIdV
IupSetStrfV
IupSetfAttribute
IupSetfAttributeId
IupSetfAttributeId2
IupShow
IupShowXY
IupSpace
IupSpin
IupSpinbox
IupSplit
IupStoreAttribute
IupStoreAttributeId
IupStoreAttributeId2
IupStoreGlobal
IupStoreLanguageString
IupStringCompare
IupSubmenu
IupTabs
IupTabsV
IupTabsv
IupText
IupTextConvertLinColToPos
IupTextConvertPosToLinCol
IupTimer
IupToggle
IupTree
IupTreeGetId
IupTreeGetUserId
IupTreeSetAttributeHandle
IupTreeSetUserId
IupUnmap
IupUpdate
IupUpdateChildren
IupUser
IupVal
IupVbox
IupVboxV
IupVboxv
IupVersion
IupVersionDate
IupVersionNumber
IupZbox
IupZboxV
IupZboxv
iupArrayAdd
iupArrayCount
iupArrayCreate
iupArrayDestroy
iupArrayGetData
iupArrayInc
iupArrayInsert
iupArrayRemove
iupAssert
iupAttribGet
iupAttribGetBoolean
iupAttribGetBooleanId
iupAttribGetBooleanId2
iupAttribGetClassObject
iupAttribGetClassObjectId
iupAttribGetClassObjectId2
iupAttribGetDouble
iupAttribGetDoubleId
iupAttribGetDoubleId2
iupAttribGetFloat
iupAttribGetFloatId
iupAttribGetFloatId2
iupAttribGetHandleName
iupAttribGetId
iupAttribGetId2
iupAttribGetInherit
iupAttribGetInheritNativeParent
iupAttribGetInt
iupAttribGetIntId
iupAttribGetIntId2
iupAttribGetIntInt
iupAttribGetLocal
iupAttribGetStr
iupAttribIsIhandle
iupAttribIsNotString
iupAttribSet
iupAttribSetClassObject
iupAttribSetClassObjectId
iupAttribSetClassObjectId2
iupAttribSetDouble
iupAttribSetDoubleId
iupAttribSetDoubleId2
iupAttribSetFloat
iupAttribSetFloatId
iupAttribSetFloatId2
iupAttribSetHandleName
iupAttribSetId
iupAttribSetId2
iupAttribSetInt
iupAttribSetIntId
iupAttribSetIntId2
iupAttribSetStr
iupAttribSetStrId
iupAttribSetStrId2
iupAttribSetStrf
iupBackgroundBoxNewBaseClass
iupBaseCallValueChangedCb
iupBaseComputeNaturalSize
iupBaseContainerGetExpandAttrib
iupBaseContainerUpdateExpand
iupBaseGetActiveAttrib
iupBaseGetClientOffsetAttrib
iupBaseGetRasterSizeAttrib
iupBaseGetScrollbar
iupBaseGetSizeAttrib
iupBaseGetVisibleAttrib
iupBaseGetWidAttrib
iupBaseRegisterCommonAttrib
iupBaseRegisterCommonCallbacks
iupBaseRegisterVisualAttrib
iupBaseSetActiveAttrib
iupBaseSetCurrentSize
iupBaseSetPosition
iupBaseSetRasterSizeAttrib
iupBaseSetSizeAttrib
iupBaseSetVisibleAttrib
iupBaseTypeVoidMapMethod
iupBaseUpdateAttribFromFont
iupCallGetFocusCb
iupCallKillFocusCb
iupChildTreeAppend
iupChildTreeGetNativeParent
iupChildTreeGetNativeParentHandle
iupClassCallbackGetFormat
iupClassMatch
iupClassNew
iupClassObjectAttribIsNotString
iupClassObjectChildAdded
iupClassObjectChildRemoved
iupClassObjectComputeNaturalSize
iupClassObjectCreate
iupClassObjectDestroy
iupClassObjectDlgPopup
iupClassObjectGetAttribute
iupClassObjectGetAttributeInfo
iupClassObjectLayoutUpdate
iupClassObjectMap
iupClassObjectSetAttribute
iupClassObjectSetChildrenCurrentSize
iupClassObjectSetChildrenPosition
iupClassObjectUnMap
iupClassRegisterAttribute
iupClassRegisterAttributeId
iupClassRegisterAttributeId2
iupClassRegisterCallback
iupClassRegisterGetAttribute
iupClassRegisterReplaceAttribDef
iupClassRegisterReplaceAttribFlags
iupClassRegisterReplaceAttribFunc
iupClassRelease
iupDataEntry
iupDialogGetNativeParent
iupDlgListAdd
iupDlgListCount
iupDlgListFirst
iupDlgListNext
iupDlgListRemove
iupDlgListVisibleCount
iupDlgListVisibleDec
iupDlgListVisibleInc
iupDrawCalcShadows
iupDrawColor
iupDrawColorMakeInactive
iupDrawGetTextSize
iupDrawHorizSunkenMark
iupDrawParentBackground
iupDrawRaiseRect
iupDrawSetColor
iupDrawStrToColor
iupDrawSunkenRect
iupDrawVertSunkenMark
iupError
iupFlatScrollBarCreate
iupFlatScrollBarGet
iupFlatScrollBarMotionUpdate
iupFlatScrollBarRegister
iupFlatScrollBarSetChildrenCurrentSize
iupFlatScrollBarSetChildrenPosition
iupFlatScrollBarSetPos
iupFlatScrollBarWheelUpdate
iupFocusCanAccept
iupFontParsePango
iupFontParseWin
iupFontParseX
iupGetFontFaceAttrib
iupGetFontInfo
iupGetFontSizeAttrib
iupGetFontStyleAttrib
iupGetFontValue
iupGetParamCount
iupGetParamType
iupGlobalIsPointer
iupImageColorMakeInactive
iupImageGetHandle
iupImageInitColorTable
iupImageStockLoadAll
iupImageStockSet
iupImageStockSetNoResize
iupKeyCallKeyCb
iupKeyCallKeyPressCb
iupKeyCodeToName
iupKeyForEach
iupKeyProcessMnemonic
iupKeyProcessNavigation
iupKeySetMnemonic
iupLayoutApplyMinMaxSize
iupLayoutUpdate
iupLineFileClose
iupLineFileEOF
iupLineFileGetBuffer
iupLineFileOpen
iupLineFileReadLine
iupMaskCheck
iupMaskCreate
iupMaskCreateFloat
iupMaskCreateInt
iupMaskCreateReal
iupMaskDestroy
iupMaskGetStr
iupObjectCheck
iupObjectGetParamList
iupRadioFindToggleParent
iupRegisterClass
iupRegisterFindClass
iupRound
iupSaveImageAsText
iupSetFontFaceAttrib
iupSetFontSizeAttrib
iupSetFontStyleAttrib
iupShowVersion
iupStrBoolean
iupStrCompare
iupStrCompareEqual
iupStrCompareFind
iupStrConvertToUTF8
iupStrCopyN
iupStrCountChar
iupStrDup
iupStrDupUntil
iupStrEqual
iupStrEqualNoCase

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4544b9434647b234f3a827bc356d7008

Headers

File Characteristics

Imports

advapi32

kernel32

Exports

Exports

Sections

.text Size: 30KB - Virtual size: 29KB

.data Size: 512B - Virtual size: 32B

.rdata Size: 9KB - Virtual size: 8KB

.pdata Size: 1024B - Virtual size: 840B

.xdata Size: 1024B - Virtual size: 772B

.bss Size: - Virtual size: 16B

.edata Size: 1KB - Virtual size: 1KB

.idata Size: 1024B - Virtual size: 992B

.reloc Size: 512B - Virtual size: 236B

c84ecd8417f3069c9748e69aa26094d7

Code Sign

f4:8b:a9:cb:78:dd:96:f2:dc:60:2f:ef:35:68:c9:2aCertificate

Extended Key Usages

Key Usages

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

33:00:00:00:31:94:79:a3:18:f5:52:2d:06:00:00:00:00:00:31Certificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

39:35:90:cf:1f:c5:15:64:ae:ba:1a:2e:f9:67:ee:21:5d:a6:13:a2:71:fa:10:11:5a:93:53:6b:ef:43:59:45Signer

39:35:90:cf:1f:c5:15:64:ae:ba:1a:2e:f9:67:ee:21:5d:a6:13:a2:71:fa:10:11:5a:93:53:6b:ef:43:59:45Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

ndis.sys

fwpkclnt.sys

wdfldr.sys

Sections

.text Size: 42KB - Virtual size: 41KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 512B - Virtual size: 16KB

.pdata Size: 2KB - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 4B

INIT Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 420B

b2c861fc1b89b067f7cd850c0f1db909

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

windivert

iup

winmm

kernel32

user32

advapi32

shell32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

.text
Size: 30KB - Virtual size: 29KB

.data
Size: 512B - Virtual size: 32B

.rdata
Size: 9KB - Virtual size: 8KB

.pdata
Size: 1024B - Virtual size: 840B

.xdata
Size: 1024B - Virtual size: 772B

.bss
Size: - Virtual size: 16B

.edata
Size: 1KB - Virtual size: 1KB

.idata
Size: 1024B - Virtual size: 992B

.reloc
Size: 512B - Virtual size: 236B

f4:8b:a9:cb:78:dd:96:f2:dc:60:2f:ef:35:68:c9:2a
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

33:00:00:00:31:94:79:a3:18:f5:52:2d:06:00:00:00:00:00:31
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

39:35:90:cf:1f:c5:15:64:ae:ba:1a:2e:f9:67:ee:21:5d:a6:13:a2:71:fa:10:11:5a:93:53:6b:ef:43:59:45
Signer

39:35:90:cf:1f:c5:15:64:ae:ba:1a:2e:f9:67:ee:21:5d:a6:13:a2:71:fa:10:11:5a:93:53:6b:ef:43:59:45
Signer

.text
Size: 42KB - Virtual size: 41KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 16KB

.pdata
Size: 2KB - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 4B

INIT
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 420B

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 20KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 364KB - Virtual size: 363KB

.reloc
Size: 512B - Virtual size: 200B

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 140KB - Virtual size: 139KB

.data
Size: 7KB - Virtual size: 402KB

.pdata
Size: 52KB - Virtual size: 51KB

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 1KB - Virtual size: 1KB