b381c566fed045017b7fe1bb7028d22401ba61fd63e7df8e75d436067ae32918

Sharing

Copy URL Twitter E-mail

General

Target

b381c566fed045017b7fe1bb7028d22401ba61fd63e7df8e75d436067ae32918
Size

10.8MB
MD5

6bedb7ca5dae21adc370c7997e1c4dfc
SHA1

04a0d841d46394f842b828ea4a91c4649044e146
SHA256

b381c566fed045017b7fe1bb7028d22401ba61fd63e7df8e75d436067ae32918
SHA512

08a1406094ada5d0baaee135491a116965cbd5e517cac2876f43f03507c75c62aef198c77d797a988d494010981c4158c4ee8a5d507c03844ebcfa6c155a6d17
SSDEEP

196608:sLiAUaZgjR4d0drJx7lQFMvhPbknbu0Ywi8llmYRYvhHm:sLiAUQgNqsJkFihEu0q8lleG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b381c566fed045017b7fe1bb7028d22401ba61fd63e7df8e75d436067ae32918

Files

b381c566fed045017b7fe1bb7028d22401ba61fd63e7df8e75d436067ae32918
.dll windows:6 windows x86 arch:x86

4fed403364652c6bfbf874f7570b9754

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

RemoveDirectoryW
SetFilePointerEx
IsDebuggerPresent
DebugBreak
OutputDebugStringW
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
TerminateThread
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryExA
SetThreadAffinityMask
FormatMessageA
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
WakeConditionVariable
QueryPerformanceCounter
QueryPerformanceFrequency
DeleteFileA
GetTempPathA
GetTempFileNameA
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
GetFinalPathNameByHandleW
CreateFileA
GetFileAttributesExA
LockFileEx
UnlockFileEx
FindFirstFileExA
FindNextFileA
LoadLibraryA
InitializeConditionVariable
SleepConditionVariableCS
WaitForSingleObjectEx
SetThreadPriority
ExitProcess
GetFileSize
SetFilePointer
WriteFile
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReleaseSemaphore
LocalFree
CreateSemaphoreA
SwitchToThread
lstrcmpA
GetSystemTimeAsFileTime
InitializeSListHead
CreateEventW
GetFileSizeEx
GetFileAttributesA
FindNextFileW
FindFirstFileW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitOnceComplete
InitOnceBeginInitialize
ReadFile
FindClose
DeleteFileW
CreateFileW
CreateDirectoryW
CreateDirectoryA
GetEnvironmentVariableA
WakeAllConditionVariable
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetModuleFileNameW
GetLogicalProcessorInformation
GetSystemInfo
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
GetFileAttributesW
GetEnvironmentVariableW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW
wsprintfW

advapi32

EventRegister
EventWriteTransfer
EventUnregister

msvcp140

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?uncaught_exception@std@@YA_NXZ
?_Xbad_function_call@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xinvalid_argument@std@@YAXPBD@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
_Thrd_hardware_concurrency
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
_Thrd_id
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??1ios_base@std@@UAE@XZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PAD_J@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBE_JXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
_Thrd_yield
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?uncaught_exceptions@std@@YAHXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ

vcomp140

omp_get_thread_num
omp_get_num_threads
_vcomp_for_static_simple_init_i8
omp_set_num_threads
_vcomp_set_num_threads
_vcomp_fork
_vcomp_for_static_simple_init
_vcomp_for_static_end
omp_get_max_threads
_vcomp_for_dynamic_next
_vcomp_for_dynamic_init

shlwapi

PathRemoveBackslashW
PathFindNextComponentW
PathSkipRootW

concrt140

?_UnderlyingYield@details@Concurrency@@YAXXZ
?Id@CurrentScheduler@Concurrency@@SAIXZ
?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ
?Detach@CurrentScheduler@Concurrency@@SAXXZ
?_IsSynchronouslyBlocked@_Context@details@Concurrency@@QBE_NXZ
??1_StructuredTaskCollection@details@Concurrency@@QAE@XZ
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
??0_Cancellation_beacon@details@Concurrency@@QAE@XZ
??1_Cancellation_beacon@details@Concurrency@@QAE@XZ
?_Confirm_cancel@_Cancellation_beacon@details@Concurrency@@QAE_NXZ
?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z
?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ
?PPLParallelForEventGuid@Concurrency@@3U_GUID@@B
?_GetNumberOfVirtualProcessors@_CurrentScheduler@details@Concurrency@@SAIXZ
?_Yield@_Context@details@Concurrency@@SAXXZ
?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ
?Free@Concurrency@@YAXPAX@Z
?_CurrentContext@_Context@details@Concurrency@@SA?AV123@XZ

vcruntime140

memchr
__RTtypeid
wcsrchr
strrchr
strstr
longjmp
__CxxLongjmpUnwind
strchr
__RTDynamicCast
__current_exception
__current_exception_context
__std_type_info_destroy_list
_except_handler4_common
memset
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_terminate
_purecall
__std_type_info_compare
__std_type_info_name
_setjmp3

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_onexit_table
_beginthreadex
_seh_filter_dll
_register_onexit_function
strerror
_invalid_parameter_noinfo
_execute_onexit_table
_crt_atexit
_cexit
exit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
terminate
abort
_initialize_narrow_environment
set_terminate
_errno

api-ms-win-crt-heap-l1-1-0

_aligned_free
_aligned_malloc
malloc
_callnewh
realloc
free
calloc

api-ms-win-crt-stdio-l1-1-0

_open
fopen
fseek
__stdio_common_vsprintf
_lseek
_read
_get_stream_buffer_pointers
__stdio_common_vfwprintf
_write
fputs
fclose
fgets
__stdio_common_vsscanf
__stdio_common_vswprintf
_tempnam
fflush
fgetc
ferror
__stdio_common_vfprintf
__stdio_common_vsprintf_s
ungetc
setvbuf
fwrite
fputc
fgetpos
_fseeki64
__stdio_common_vsnprintf_s
fsetpos
_wsopen_s
_close
__acrt_iob_func
_sopen_s
fread

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32
_stat64i32
_unlock_file
_lock_file
_unlink
remove
_rmdir
_mkdir

api-ms-win-crt-locale-l1-1-0

_free_locale
_create_locale
setlocale
localeconv

api-ms-win-crt-string-l1-1-0

strncpy
isprint
_strdup
strncmp
isxdigit
strtok
isdigit
isalpha
isspace
wcsncpy_s
_wcsicmp
_wcsdup
strncpy_s
tolower
_towupper_l
_towlower_l

api-ms-win-crt-math-l1-1-0

_libm_sse2_log_precise
acoshf
asinhf
atanhf
_libm_sse2_exp_precise
_CIfmod
_CIsinh
_libm_sse2_asin_precise
_libm_sse2_atan_precise
ilogb
log2
scalbn
ilogbf
log2f
_CItanh
_libm_sse2_pow_precise
roundf
_libm_sse2_sqrt_precise
ceil
_fdsign
rint
rintf
remainderf
frexp
floor
_dclass
_CIatan2
_libm_sse2_log10_precise
_libm_sse2_acos_precise
fmax
_libm_sse2_tan_precise
_libm_sse2_sin_precise
scalbnf
_CIcosh
ldexp
_libm_sse2_cos_precise
_fdclass

api-ms-win-crt-time-l1-1-0

_difftime64
_time64
wcsftime
_gmtime64_s
_localtime64_s
_mktime64

api-ms-win-crt-convert-l1-1-0

strtof
strtoull
strtoll
_strtoi64
atof
strtod
atoi
strtol

api-ms-win-crt-utility-l1-1-0

qsort
rand
bsearch

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

_GetOCRVersion@4
_Init@8
_OCR@32
��- J�W��~)xL��5�' ��S��DG d�2� A��\��0법�Q��e��[q�. ��ut�}��&�c�=Q��(�:�Gye��Le��y�}�$�}�Q��d-�� 'C�y�KP��cN2mu�g��D�B@H��x^��"Z�� i1�MN�_�`��T��e��1��gX�{�g��*��3oD�k��TU�ʹ]ri�׺��o�~�*mk�ME)��]] K�E�XXAelE�c(^��/�\��ZLHl��w$\w1��)�T�FO��-S��"4 .� E�ɳ��ν��.��@��哀YO'��--#�)�)J��f0 wE�m��i��d�/i��¾��,I��z»�(��ۃp��!7y��L�(��-wn��c�2Y�z6m�$��=-ty�r��]�K2�k�Om�rVQRy�0�^��H��f�h��c�N<�@_O�^��l�l��T��W,Rnl�g}{o��#�;��`uG��GX��>��w)GY:�?j�[�T��GT��s:�K�طR_�g��2� _q?��m��\��2,O��P�SrEb�P�MfŒ��k��̨��'P�Q:Sv��]��X$�?��M�LR4��NI&�ux�e�ã%�+%��PQb��bCh��1t�E2�e�A:u95,x�L�B��*�Fط1[YT�U`S�JN��`S�ER�i~�Pڐ��\��h�eˌ\j� ��&�TD��C(�,d&+��C��(o��4�h��weo�n��2뽚�<�4hC��X>��k D7�#�tCٖP!%��W�� 0D�7��$�R�j\Z�*�� N�+�Y�$-Q��i�)�q$=)�ݛ��jl�$��gv��Ѣ��,ѐ >�@�<o^�6[g`�o��aR_)�ӝ�J��F�ө��G"�*K�s�ȄG��XuG1 ��Gb�2F OM*1��>��(��e�br�z��i]z�wxjM�vJ�-�2 ��9z("�;o^��=�m�=F7E�~��#�t��^��H��[ �{�6x�[�N�LJJg�QRy޴y��C��K(�r:&��/�8Pb�[ân��Ӏ,�&�#�V�WH�Q��K9��]A� ��3��"WVO��TiB��!��6a!�¶��h�� {�s�a>{�D�e�wR<8�1v Q��4٪;6��_��<>9�l��aF�ŏ�R�𭨔 :襘�2�Q��b�\~Z��3��X�:�_�oK��_BΓ��=��ʅ�v-7�N�j5.�$&��K`4��q2�Rne#7v(;P�V��o�ʾ#|��9�nrw}`�Y�edT q��luʣT綊��0�r��ԏ�ZZ�h��n�UH��aiI��З��PH' ��Ӱ�Z+��ʪ��첬5��cJ٪ŗa3&��Z�~�;%��9P|`�J W\Ma��aJ��0�SC�RI�p�'l�YS�ݯK@��5�D��9�2�F��7+��m 5'��?7�%�MX�m&#n��Ѝ��gW��V�� Ѿ�x9$��m�α�wZ��j�ī��k&Y�Խ�n ]��w�Ì*��{�Rʧ��TU��~�n� �j��C:�z��B�-x�8ʤC�+5��U��>Sǯ�F��C��lhMҧf�� >��Ԁ��I��lt��gz�OX] mI�\r��a��Z��1�5��_�L��t�c��~Zh{K3�Q��0��~�~�T��wY�lm��#��+��~!��̟FC�}4�[ש!��]��J�Q��tu�p��'�ӫt�,_�J%"i'��;�b�DBY�y�P=XuhG��*��ms/E�F%jB��B��[�K,��d�6׻��<Otw*�CH� �[Կ��ң}L�ˍݦ��&�`��r�S�G^��6�T��-��T�һڻ�,9Y+a�V[)�o�y��r|� ]|�B�W�l�L�9$n�z��L�~Nxi��81ù��ЊaS��A=W��,+�{��>�^�{�p�_��ѭ�\5�]��?ŗ"M~�y�9��c�4��F-G.P��ڍ�TF�w*�čk�0{��Z}?m��D�=4axat�?��_*,�w�"��.Uљ}�x�t��P�Z�i� ͐_��l�x:{�[P(є\ť�c_�R�kSJ��{� ��08�\dC�X|�ԺG4ݝ�i��Uzc�ɀ��G��S�E)��텫a�{078�Qꫬ�x+@q6 RwyhL�a2R�r�Q�\��h�@x1�m�hqW��D��}��Nldޠs��y��Nr�x�/4��X� �g�i!�YO��%�b�&�^ߵ�Ka��n�]�Xh|*!R� �'��]8��YtD8Q�D[�.PY4}�)��sZ]�mص�9�O��) E룐vJ(��:�L��A��s��2�0��>A��W��#&0Y��.��a��F��hI��G��6��&��uL!َ��}�_o1�c�j$�'��b#��W� ��}��4��3�l(��h��RK,!��A��\�w��O>�-Nf К��f�<�nu-��4Nc؈�6��>��(v�P��6�ڠWfM�@��N'�?�?�C ��w6�F��q�i�#��M��ָM 8�L��y�6r\d�\��?1W��\��zt2��h�H� ��F�G��%][9��0I'k��!�Tb��6߸u��W��b�3��K��ݔ�]�ɻS��+��lϻ;'h'�HF8$�jV��߲[�"4m��q�Ɋ��ݐ��}*N�7ǶQ��z6�ٲ��`D��V�[Ǫ׵�SD�8��}i�Wf��_�~$aPp|�G�\��x��}"��z�� vN5�j��/ !qy

Sections

.text
Size: - Virtual size: 16.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

IPPCODE
Size: - Virtual size: 572KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zd0
Size: - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zd1
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4fed403364652c6bfbf874f7570b9754

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcp140

vcomp140

shlwapi

concrt140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 16.5MB

IPPCODE Size: - Virtual size: 572KB

.rdata Size: 3.8MB - Virtual size: 3.8MB

.data Size: - Virtual size: 1.3MB

_RDATA Size: - Virtual size: 54KB

.zd0 Size: - Virtual size: 112KB

.zd1 Size: 6.9MB - Virtual size: 6.9MB

.reloc Size: 134KB - Virtual size: 133KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 16.5MB

IPPCODE
Size: - Virtual size: 572KB

.rdata
Size: 3.8MB - Virtual size: 3.8MB

.data
Size: - Virtual size: 1.3MB

_RDATA
Size: - Virtual size: 54KB

.zd0
Size: - Virtual size: 112KB

.zd1
Size: 6.9MB - Virtual size: 6.9MB

.reloc
Size: 134KB - Virtual size: 133KB

.rsrc
Size: 1KB - Virtual size: 1KB