EXM Premium Tweaking Utility[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

EXM Premium Tweaking Utility.zip
Size

12.1MB
MD5

6c1c8fcab0ba9e26633632a51e60c0e1
SHA1

c241cd70ec48a0b1c10995f9539d27da2fe95948
SHA256

81e07e5d2ba029b9af8faddebcff6a6e1c709603638e341c7e32a5e3f2604e04
SHA512

0e57b2132b403f5b25fa8b1b8e1f6143b5ac7a2e78cab39db13869e1b51acff08b1f073a18ba13ba9c185fb457c89643b30f3802725b28de36620da85085aab1
SSDEEP

196608:UuIM4NhLDOqRS4pM8HanwkpAiUMiX/hy3mVkFDV8KDz79CyQgk9y:XEh/xM861pWymVNXM

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/EXM Premium Tweaking Utility/EXMPremiumTweakingUtility.dll
unpack001/EXM Premium Tweaking Utility/EXMPremiumTweakingUtility.exe
unpack001/EXM Premium Tweaking Utility/mongocrypt.dll
unpack001/EXM Premium Tweaking Utility/updater.exe

Files

EXM Premium Tweaking Utility.zip
.zip
EXM Premium Tweaking Utility/EXMPremiumTweakingUtility.deps.json
EXM Premium Tweaking Utility/EXMPremiumTweakingUtility.dll
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

EXMPremiumTweakingUtility.pdb

Sections

.text
Size: 8.7MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 231KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
EXM Premium Tweaking Utility/EXMPremiumTweakingUtility.dll.config
EXM Premium Tweaking Utility/EXMPremiumTweakingUtility.exe
.exe windows:6 windows x64 arch:x64

6dbf27f4c70fe2c8ed3e0122ba75d641

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

Imports

kernel32

FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetLastError
GetFileAttributesExW
GetFullPathNameW
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
FindFirstFileExW
OutputDebugStringW
LoadLibraryA
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_exit
__p___argc
_initterm_e
_initterm
_get_initial_wide_environment
_invalid_parameter_noinfo_noreturn
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
_set_app_type
__p___wargv
_seh_filter_exe
_register_onexit_function
_cexit
terminate
_errno
exit
abort
_crt_atexit
_c_exit
_register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

setvbuf
fflush
_wfopen
__stdio_common_vswprintf
__stdio_common_vfwprintf
_set_fmode
__stdio_common_vsprintf_s
__acrt_iob_func
fputwc
fputws
__p__commode

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
free
malloc
calloc

api-ms-win-crt-string-l1-1-0

wcsnlen
strcpy_s
_wcsdup
strcspn
wcsncmp
toupper

api-ms-win-crt-convert-l1-1-0

_wtoi
wcstoul

api-ms-win-crt-locale-l1-1-0

setlocale
___lc_locale_name_func
localeconv
_unlock_locales
_lock_locales
___mb_cur_max_func
_configthreadlocale
__pctype_func
___lc_codepage_func

api-ms-win-crt-math-l1-1-0

frexp
__setusermatherr

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_time64
wcsftime

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 231KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EXM Premium Tweaking Utility/EXMPremiumTweakingUtility.runtimeconfig.json
EXM Premium Tweaking Utility/Images/AMDLogoFinal.png
.png
EXM Premium Tweaking Utility/Images/EULA_Revised.png
.png
EXM Premium Tweaking Utility/Images/End User License Agreement.png
.png
EXM Premium Tweaking Utility/Images/NVlogo.png
.png
EXM Premium Tweaking Utility/Images/image-removebg.png
.png
EXM Premium Tweaking Utility/Images/key.png
.png
EXM Premium Tweaking Utility/Images/password.png
.png
EXM Premium Tweaking Utility/Images/user1.png
.png
EXM Premium Tweaking Utility/System.Management.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:2e:9c:db:9d:9c:95:47:2e:be:9e:41:03:8d:b5:53:a6:3a:6b:eb:10:69:3e:9f:5f:8d:bf:ce:99:3b:c4:0c
Signer

Actual PE Digest

0c:2e:9c:db:9d:9c:95:47:2e:be:9e:41:03:8d:b5:53:a6:3a:6b:eb:10:69:3e:9f:5f:8d:bf:ce:99:3b:c4:0c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Management/Release/net6.0-windows/System.Management.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EXM Premium Tweaking Utility/mongocrypt.dll
.dll windows:6 windows x64 arch:x64

d372b9fc93c96a13c769b1ac6c49679a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\data\mci\d753f0d73e2c06da818e02251c850423\libmongocrypt\cmake-build\mongocrypt.pdb

Imports

bcrypt

BCryptGetProperty
BCryptSignHash
BCryptImportKeyPair
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptImportKey
BCryptDecrypt
BCryptEncrypt
BCryptSetProperty
BCryptOpenAlgorithmProvider

ws2_32

gethostname

crypt32

CryptDecodeObjectEx

kernel32

IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentProcessId
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcess
GetModuleHandleW
InitOnceExecuteOnce
GetLastError
SetLastError
GetModuleFileNameW
WideCharToMultiByte
GetCurrentDirectoryW
LocalFree
FormatMessageW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryW
MultiByteToWideChar

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
strchr
memcpy
memset
memcmp
memmove
strstr

api-ms-win-crt-runtime-l1-1-0

abort
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_errno
_initialize_onexit_table
_seh_filter_dll
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_initterm
_clearfp
_statusfp
strerror_s
terminate

api-ms-win-crt-math-l1-1-0

asinh
atan
atan2
log1p
cbrt
cos
sin
cosh
asin
erfc
exp
pow
exp2
expm1
hypot
lgamma
log
log10
sinh
tan
tanh
tgamma
acos
sqrt
log2f
acosh
_dclass
erf
ceil
trunc
log2

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
_close
_read
_sopen_s

api-ms-win-crt-string-l1-1-0

isalnum
isxdigit
strncpy_s
_strdup
strncpy
strncmp
strcmp
isspace
_stricmp
tolower
iswctype
isdigit
_strnicmp
isupper
isalpha
strspn

api-ms-win-crt-heap-l1-1-0

malloc
free
realloc
calloc

api-ms-win-crt-time-l1-1-0

_time64
strftime
_gmtime64_s

api-ms-win-crt-convert-l1-1-0

strtol
strtod
strtoul

api-ms-win-crt-utility-l1-1-0

rand
srand

Exports

Exports

mongocrypt_binary_data
mongocrypt_binary_destroy
mongocrypt_binary_len
mongocrypt_binary_new
mongocrypt_binary_new_from_data
mongocrypt_crypt_shared_lib_version
mongocrypt_crypt_shared_lib_version_string
mongocrypt_ctx_datakey_init
mongocrypt_ctx_decrypt_init
mongocrypt_ctx_destroy
mongocrypt_ctx_encrypt_init
mongocrypt_ctx_explicit_decrypt_init
mongocrypt_ctx_explicit_encrypt_expression_init
mongocrypt_ctx_explicit_encrypt_init
mongocrypt_ctx_finalize
mongocrypt_ctx_kms_done
mongocrypt_ctx_mongo_done
mongocrypt_ctx_mongo_feed
mongocrypt_ctx_mongo_op
mongocrypt_ctx_new
mongocrypt_ctx_next_kms_ctx
mongocrypt_ctx_provide_kms_providers
mongocrypt_ctx_rewrap_many_datakey_init
mongocrypt_ctx_setopt_algorithm
mongocrypt_ctx_setopt_algorithm_range
mongocrypt_ctx_setopt_contention_factor
mongocrypt_ctx_setopt_index_key_id
mongocrypt_ctx_setopt_key_alt_name
mongocrypt_ctx_setopt_key_encryption_key
mongocrypt_ctx_setopt_key_id
mongocrypt_ctx_setopt_key_material
mongocrypt_ctx_setopt_masterkey_aws
mongocrypt_ctx_setopt_masterkey_aws_endpoint
mongocrypt_ctx_setopt_masterkey_local
mongocrypt_ctx_setopt_query_type
mongocrypt_ctx_state
mongocrypt_ctx_status
mongocrypt_destroy
mongocrypt_init
mongocrypt_kms_ctx_bytes_needed
mongocrypt_kms_ctx_endpoint
mongocrypt_kms_ctx_feed
mongocrypt_kms_ctx_get_kms_provider
mongocrypt_kms_ctx_message
mongocrypt_kms_ctx_status
mongocrypt_new
mongocrypt_setopt_aes_256_ctr
mongocrypt_setopt_aes_256_ecb
mongocrypt_setopt_append_crypt_shared_lib_search_path
mongocrypt_setopt_bypass_query_analysis
mongocrypt_setopt_crypto_hook_sign_rsaes_pkcs1_v1_5
mongocrypt_setopt_crypto_hooks
mongocrypt_setopt_encrypted_field_config_map
mongocrypt_setopt_kms_provider_aws
mongocrypt_setopt_kms_provider_local
mongocrypt_setopt_kms_providers
mongocrypt_setopt_log_handler
mongocrypt_setopt_schema_map
mongocrypt_setopt_set_crypt_shared_lib_path_override
mongocrypt_setopt_use_need_kms_credentials_state
mongocrypt_status
mongocrypt_status_code
mongocrypt_status_destroy
mongocrypt_status_message
mongocrypt_status_new
mongocrypt_status_ok
mongocrypt_status_set
mongocrypt_status_type
mongocrypt_version

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EXM Premium Tweaking Utility/updater.exe
.exe windows:6 windows x86 arch:x86

1441b4945139452b4eb43729e9f94cbe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\ReleaseAI\win\Release\stubs\x86\Updater.pdb

Imports

kernel32

LoadResource
FindResourceW
FindResourceExW
ReadFile
WideCharToMultiByte
FindClose
GetSystemTime
FindFirstFileW
RemoveDirectoryW
FindNextFileW
GetFileSize
CreateDirectoryW
SetFileAttributesW
GetFileTime
WriteFile
SetFilePointer
SetFileTime
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetWindowsDirectoryW
GetTempPathW
GetTempFileNameW
GetCurrentProcess
GetSystemDirectoryW
LoadLibraryExW
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
GetCurrentProcessId
GetExitCodeProcess
WaitForSingleObject
TerminateProcess
FreeLibrary
Sleep
LocalFree
GetTickCount
LocalAlloc
GetUserDefaultUILanguage
FileTimeToLocalFileTime
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
CreateProcessW
MultiByteToWideChar
FormatMessageW
SetLastError
GetEnvironmentVariableW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionEx
lstrcmpiW
VerifyVersionInfoW
VerSetConditionMask
lstrlenW
CompareStringW
GetExitCodeThread
TerminateThread
CreateThread
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
OutputDebugStringW
GetCurrentThreadId
GetLocalTime
LockResource
GetStringTypeW
ResetEvent
CreateEventW
SetEvent
GlobalFree
MulDiv
QueryPerformanceFrequency
QueryPerformanceCounter
RaiseException
GetSystemDefaultLangID
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
UnmapViewOfFile
ReleaseMutex
CreateFileMappingW
MapViewOfFile
CreateMutexW
OpenFileMappingW
OpenEventW
lstrcpynW
DecodePointer
GetACP
QueryFullProcessImageNameW
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
SetEndOfFile
WriteConsoleW
ReadConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
GetFileSizeEx
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
GetCPInfo
CompareStringEx
LCMapStringEx
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
HeapReAlloc
InitializeSListHead
EncodePointer
IsDebuggerPresent
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
HeapSize
HeapDestroy
CloseHandle
CreateFileW
CopyFileW
MoveFileW
DeleteFileW
CompareFileTime
SystemTimeToFileTime
FileTimeToSystemTime
GetLastError
FlushFileBuffers
CopyFileExW

user32

LoadMenuW
GetSubMenu
TrackPopupMenu
EnableMenuItem
DestroyMenu
LockWindowUpdate
CreateDialogParamW
GetMessageW
GetMessagePos
SetCursorPos
RemovePropW
SetPropW
GetForegroundWindow
MonitorFromPoint
GetPropW
GetMenuItemID
SetMenuDefaultItem
PostQuitMessage
RegisterWindowMessageW
DrawMenuBar
GetSystemMenu
EnumWindows
GetWindowThreadProcessId
GetWindowLongW
GetDC
SendMessageW
GetParent
LoadStringW
SetWindowTextW
PeekMessageW
TranslateMessage
DispatchMessageW
LoadImageW
GetSystemMetrics
GetClassInfoExW
RegisterClassExW
PostMessageW
KillTimer
SetTimer
GetDesktopWindow
PostThreadMessageW
EndDialog
MonitorFromWindow
GetMonitorInfoW
MoveWindow
DialogBoxParamW
CreateIconFromResourceEx
LookupIconIdFromDirectoryEx
GetActiveWindow
GetWindowDC
ModifyMenuW
GetWindowRect
MapWindowPoints
EnableWindow
GetDlgItem
GetWindow
SetWindowLongW
DefWindowProcW
CallWindowProcW
DrawEdge
ShowWindow
IsWindowVisible
SetForegroundWindow
MessageBoxW
GetDlgCtrlID
FillRect
DestroyWindow
EndPaint
BeginPaint
SetCursor
SetCapture
SetFocus
ReleaseCapture
GetCapture
PtInRect
ScreenToClient
GetCursorPos
UpdateWindow
InvalidateRect
CharNextW
OffsetRect
ReleaseDC
IsWindow
SetRectEmpty
GetWindowTextW
GetWindowTextLengthW
CreateWindowExW
SystemParametersInfoW
LoadCursorW
GetClassNameW
GetClientRect
DrawFocusRect
GetFocus
DrawTextW
GetSysColor
IsWindowEnabled
RedrawWindow
SetWindowPos
UnregisterClassW
TrackMouseEvent

gdi32

GetObjectW
PatBlt
DeleteDC
CreateBitmap
CreatePatternBrush
DeleteObject
GetStockObject
CreateFontIndirectW
SelectObject
SetTextColor
SetBkMode
GetDeviceCaps

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
Shell_NotifyIconW
ShellExecuteW
SHBrowseForFolderW
SHGetFolderPathW

ole32

CoInitializeEx
CoTaskMemAlloc
CoTaskMemRealloc
CoResumeClassObjects
CLSIDFromString
CoCreateGuid
CoAddRefServerProcess
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoReleaseServerProcess

oleaut32

SysFreeString
RevokeActiveObject
DispGetIDsOfNames
LoadTypeLi
VarUI4FromStr
DispInvoke
SysAllocString

shlwapi

PathIsUNCW
PathAppendW
PathFileExistsW

comctl32

CreatePropertySheetPageW
InitCommonControlsEx
PropertySheetW
DestroyPropertySheetPage

uxtheme

IsAppThemed
EnableThemeDialogTexture

Sections

.text
Size: 720KB - Virtual size: 719KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EXM Premium Tweaking Utility/updater.ini

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

PDB Paths

Sections

.text Size: 8.7MB - Virtual size: 8.7MB

.rsrc Size: 231KB - Virtual size: 231KB

6dbf27f4c70fe2c8ed3e0122ba75d641

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

Sections

.text Size: 95KB - Virtual size: 95KB

.rdata Size: 37KB - Virtual size: 36KB

.data Size: 2KB - Virtual size: 5KB

.pdata Size: 5KB - Virtual size: 5KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 231KB - Virtual size: 231KB

.reloc Size: 1024B - Virtual size: 792B

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7cCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

0c:2e:9c:db:9d:9c:95:47:2e:be:9e:41:03:8d:b5:53:a6:3a:6b:eb:10:69:3e:9f:5f:8d:bf:ce:99:3b:c4:0cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 291KB - Virtual size: 291KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

d372b9fc93c96a13c769b1ac6c49679a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcrypt

ws2_32

crypt32

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 1.1MB - Virtual size: 1.2MB

.text
Size: 8.7MB - Virtual size: 8.7MB

.rsrc
Size: 231KB - Virtual size: 231KB

.text
Size: 95KB - Virtual size: 95KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 5KB - Virtual size: 5KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 231KB - Virtual size: 231KB

.reloc
Size: 1024B - Virtual size: 792B

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

0c:2e:9c:db:9d:9c:95:47:2e:be:9e:41:03:8d:b5:53:a6:3a:6b:eb:10:69:3e:9f:5f:8d:bf:ce:99:3b:c4:0c
Signer

.text
Size: 291KB - Virtual size: 291KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 1.1MB - Virtual size: 1.2MB

.pdata
Size: 54KB - Virtual size: 53KB

.idata
Size: 8KB - Virtual size: 8KB

.00cfg
Size: 512B - Virtual size: 283B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 14KB - Virtual size: 14KB

.text
Size: 720KB - Virtual size: 719KB

.rdata
Size: 183KB - Virtual size: 183KB

.data
Size: 5KB - Virtual size: 10KB

.rsrc
Size: 80KB - Virtual size: 80KB

.reloc
Size: 40KB - Virtual size: 40KB