8b2b5fc36a434ea705ee2a166a2b8580N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8b2b5fc36a434ea705ee2a166a2b8580N.exe
Size

3.9MB
MD5

8b2b5fc36a434ea705ee2a166a2b8580
SHA1

601da73983140e9015ca1f67980bee3c5333632f
SHA256

b4fd8a96326c13f93eed8f902384adf01d6d16649d8396c259bb458405037968
SHA512

6f8aa46b07bb9531af11a35fd11912c708141e89cf0d88bd2f5796e65e15fd45cb9972d5d113ae3aee339bf442901cd22574f10f11d4e1576a4622bfc4f0f3ef
SSDEEP

49152:7Fra97H51PYXqvCcwHL3bpBdvySdElXM/oFYL5/vrAJy2h4i+ImxLAn/qawaaub:E97H51+CMrXdvyZlX2Mbh4iELA/hd

Score

1^/10

Malware Config

Signatures

Files

8b2b5fc36a434ea705ee2a166a2b8580N.exe
.dll windows:6 windows x86 arch:x86

087eab34553b6fd77ee4fbd69e2ef2b1

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:6a:87:85:2e:3b:b8:8b:61:d9:d1:9f:36:95:53:a8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

11/04/2025, 23:59

Subject

SERIALNUMBER=91510100MA6CPTDM7Q,CN=成都俊云科技有限公司,O=成都俊云科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:1c:45:c5:aa:af:16:90:c0:ed:7d:d5:2c:78:82:64:86:69:58:22:a4:b0:5d:e9:0e:67:e8:fe:ff:99:ec:d5
Signer

Actual PE Digest

38:1c:45:c5:aa:af:16:90:c0:ed:7d:d5:2c:78:82:64:86:69:58:22:a4:b0:5d:e9:0e:67:e8:fe:ff:99:ec:d5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\work\work_pro\PARALLEL\QeeYouAcceler\Release\tools\tool_showimage_qiyou.pdb

Imports

kernel32

IsDebuggerPresent
EncodePointer
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleA
VirtualAlloc
VirtualFree
OutputDebugStringA
GetFileSizeEx
TlsAlloc
TlsGetValue
TlsSetValue
ReadFile
GetFileSize
CreateFileW
lstrlenW
CreateEventW
CloseHandle
FreeResource
LoadResource
LockResource
SizeofResource
GlobalAlloc
GlobalLock
GlobalUnlock
FindResourceW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
GetSystemInfo
GetCurrentDirectoryW
CreateDirectoryW
GetFileAttributesW
LocalFileTimeToFileTime
SetFilePointer
SetFileTime
WriteFile
SystemTimeToFileTime
GetFileInformationByHandle
GetLocalTime
GetTickCount
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
DecodePointer
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringW
DeleteFileW
GetModuleFileNameW
lstrcmpiW
ExitProcess
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetCurrentProcessId
GetVersionExW
MulDiv
LocalFree
FormatMessageW
lstrcpynW
lstrcpyW
QueryPerformanceCounter
QueryPerformanceFrequency

user32

MapVirtualKeyExW
GetKeyNameTextW
GetKeyboardLayout
SetForegroundWindow
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
DrawTextA
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
EqualRect
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
TrackPopupMenu
AppendMenuW
EnableMenuItem
DestroyMenu
CreatePopupMenu
GetWindowRgn
MoveWindow
UpdateLayeredWindow
IsWindowEnabled
SetRect
FillRect
DrawTextW
CharPrevW
UpdateWindow
GetPropW
SetPropW
EnableWindow
ShowWindow
GetClassInfoExW
RegisterClassExW
RegisterClassW
CallWindowProcW
PostQuitMessage
DefWindowProcW
LoadImageW
GetWindow
PtInRect
IsRectEmpty
GetSysColor
MapWindowPoints
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetKeyState
GetFocus
GetActiveWindow
SetFocus
CharNextW
DestroyWindow
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
LoadCursorW
UnionRect
InflateRect
SetCursor
SetWindowLongW
MessageBoxW
GetClientRect
SetWindowRgn
IsIconic
SystemParametersInfoW
OffsetRect
SendMessageW
IsWindow
PostMessageW
IsWindowVisible
GetWindowRect
GetClassNameW
SetWindowPos
GetCursorPos
ScreenToClient
IntersectRect
GetWindowLongW
GetParent
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
GetMonitorInfoW
wsprintfA
IsZoomed

gdi32

EnumFontFamiliesExW
GetFontData
GetGlyphOutlineW
GetObjectW
CreateRoundRectRgn
DeleteObject
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectW
CreatePen
DeleteDC
GetDeviceCaps
GetStockObject
AddFontMemResourceEx
RemoveFontMemResourceEx
Rectangle
RestoreDC
SaveDC
SelectObject
GetLayout
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
SetWindowOrgEx
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
GetViewportOrgEx
LineTo
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
CreateDIBSection
GetObjectA
MoveToEx
TextOutW
GdiFlush
CreateRectRgn
PtInRegion
CreatePatternBrush
GetTextExtentPointA
GetBitmapBits
SetBitmapBits
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
SetGraphicsMode
SetTextAlign
SetWorldTransform
ExtTextOutW
GetTextFaceW

shell32

DragQueryFileW

ole32

CreateStreamOnHGlobal
CoCreateInstance
DoDragDrop
OleDuplicateData
ReleaseStgMedium
CoCreateGuid
OleLockRunning
CLSIDFromProgID
CLSIDFromString

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

chromebase

?SysWideToUTF8@cr_base@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
?WaitForInstance@internal@cr_base@@YAHPAH@Z
?PostTask@TaskRunner@cr_base@@QAE_NABVLocation@tracked_objects@@ABV?$Callback@$$A6AXXZ@2@@Z
?AssertSingletonAllowed@ThreadRestrictions@cr_base@@SAXXZ
?GetFindInfo@FileEnumerator@file_util@@QAEXPAU_WIN32_FIND_DATAW@@@Z
??GTime@cr_base@@QBE?AVTimeDelta@1@V01@@Z
?FromFileTime@Time@cr_base@@SA?AV12@U_FILETIME@@@Z
?Now@Time@cr_base@@SA?AV12@XZ
?InDays@TimeDelta@cr_base@@QBEHXZ
?SysWideToNativeMB@cr_base@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
?value@FilePath@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?StringPrintf@cr_base@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_WZZ
?RunsTasksOnCurrentThread@SequencedWorkerPool@cr_base@@UBE_NXZ
?PostDelayedTask@SequencedWorkerPool@cr_base@@UAE_NABVLocation@tracked_objects@@ABV?$Callback@$$A6AXXZ@2@_J@Z
?PostDelayedTask@SequencedWorkerPool@cr_base@@UAE_NABVLocation@tracked_objects@@ABV?$Callback@$$A6AXXZ@2@VTimeDelta@2@@Z
?OnDestruct@SequencedWorkerPool@cr_base@@MBEXXZ
?CompleteLazyInstance@internal@cr_base@@YAXPAHHPAXP6AX1@Z@Z
?NeedsLazyInstance@internal@cr_base@@YA_NPAH@Z
??1ScopedAllowSingleton@ThreadRestrictions@cr_base@@QAE@XZ
??0ScopedAllowSingleton@ThreadRestrictions@cr_base@@QAE@XZ
?message_loop@Thread@cr_base@@QBEPAVMessageLoop@@XZ
?PostNonNestableDelayedTask@MessageLoop@@QAEXABVLocation@tracked_objects@@ABV?$Callback@$$A6AXXZ@cr_base@@VTimeDelta@5@@Z
??1SequencedWorkerPool@cr_base@@MAE@XZ
?Shutdown@SequencedWorkerPool@cr_base@@QAEXXZ
??0SequencedWorkerPool@cr_base@@QAE@IABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Release@?$RefCountedThreadSafe@VTaskRunner@cr_base@@UTaskRunnerTraits@2@@cr_base@@QBEXXZ
?AddRef@?$RefCountedThreadSafe@VTaskRunner@cr_base@@UTaskRunnerTraits@2@@cr_base@@QBEXXZ
?Release@Lock@cr_base@@QAEXXZ
?Acquire@Lock@cr_base@@QAEXXZ
??1Lock@cr_base@@QAE@XZ
??0Lock@cr_base@@QAE@XZ
??0TimeDelta@cr_base@@QAE@XZ
??0LogMessage@logging@@QAE@PBDHHPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Next@FileEnumerator@file_util@@QAE?AVFilePath@@XZ
??1FileEnumerator@file_util@@QAE@XZ
??0FileEnumerator@file_util@@QAE@ABVFilePath@@_NW4FileType@01@@Z
?CreateDirectoryW@file_util@@YA_NABVFilePath@@@Z
?empty@FilePath@@QBE_NXZ
??4FilePath@@QAEAAV0@ABV0@@Z
?g_dcheck_state@logging@@3W4DcheckState@1@A
??1FilePath@@QAE@XZ
??0FilePath@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?SplitString@cr_base@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_WPAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@3@@Z
?PostDelayedTask@MessageLoop@@QAEXABVLocation@tracked_objects@@ABV?$Callback@$$A6AXXZ@cr_base@@VTimeDelta@5@@Z
?current@MessageLoop@@SAPAV1@XZ
?GetProgramCounter@tracked_objects@@YAPBXXZ
??0Location@tracked_objects@@QAE@PBD0HPBX@Z
??1CallbackBase@internal@cr_base@@IAE@XZ
??0CallbackBase@internal@cr_base@@IAE@PAVBindStateBase@12@@Z
??1WeakReferenceOwner@internal@cr_base@@QAE@XZ
??0WeakReferenceOwner@internal@cr_base@@QAE@XZ
?Release@RefCountedThreadSafeBase@subtle@cr_base@@IBE_NXZ
?AddRef@RefCountedThreadSafeBase@subtle@cr_base@@IBEXXZ
??1RefCountedThreadSafeBase@subtle@cr_base@@IAE@XZ
??0RefCountedThreadSafeBase@subtle@cr_base@@IAE@XZ
??6@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AAV01@PB_W@Z
?stream@LogMessage@logging@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
??1LogMessage@logging@@QAE@XZ
??0LogMessage@logging@@QAE@PBDHH@Z
?GetMinLogLevel@logging@@YAHXZ
?RegisterCallback@AtExitManager@cr_base@@SAXP6AXPAX@Z0@Z

shlwapi

PathFileExistsW

msvcp120

??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
_Getcvt
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?widen@?$ctype@D@std@@QBEDD@Z
?widen@?$ctype@D@std@@QBEPBDPBD0PAD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??_7_Facet_base@std@@6B@
??_7facet@locale@std@@6B@
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
_Mtx_init
_Mtx_destroy
_Mtx_lock
_Mtx_unlock
_Cnd_init
_Cnd_destroy
_Cnd_wait
?_Throw_C_error@std@@YAXH@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xbad_function_call@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?_Winerror_map@std@@YAPBDH@Z
?_Future_error_map@std@@YAPBDH@Z
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
_Cnd_broadcast
_Cnd_register_at_thread_exit
_Cnd_unregister_at_thread_exit
?_Throw_future_error@std@@YAXABVerror_code@1@@Z

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

gdiplus

GdipCloneImage
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipDrawImageRectI
GdipCreatePath
GdipDeletePath
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetSmoothingMode
GdipDrawPath
GdipFillPath
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromStreamICM
GdipAddPathLine
GdipAddPathArc
GdipSetPenMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipFillRectangleI
GdipCreateFontFromDC
GdipLoadImageFromStream
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipFree
GdipCreateFontFromLogfontA
GdipAlloc
GdipImageGetFrameDimensionsCount

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

msvcr120

_libm_sse2_cos_precise
_CIatan2
ceil
??1bad_cast@std@@UAE@XZ
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
floor
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
fflush
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
_CIfmod
round
strcspn
localeconv
longjmp
_setjmp3
fabs
abort
copysignf
fmod
_vsnprintf_s
_snprintf
__iob_func
vprintf
cos
sin
acos
_wassert
exp
atan2
_except1
__clean_type_info_names_internal
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_except_handler4_common
fopen
rewind
_get_osfhandle
_fileno
_vsnprintf
??3@YAXPAX@Z
_purecall
??2@YAPAXI@Z
memmove
?terminate@@YAXXZ
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
sprintf_s
_finite
??8type_info@@QBE_NABV0@@Z
__RTDynamicCast
memcmp
_wcsicmp
_wtoi
_vsnwprintf
??_V@YAXPAX@Z
free
wcstol
toupper
memchr
sprintf
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
wcscpy_s
wcsncmp
malloc
strcpy_s
wcsncpy
wcsstr
calloc
??0exception@std@@QAE@ABQBD@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?what@exception@std@@UBEPBDXZ
roundf
strlen
wcscat
wcschr
wcscmp
wcscpy
wcslen
_wcslwr
realloc
isdigit
wcsncat
_itow
wcstoul
wcstod
abs
strcmp
strncmp
strtol
_lrotl
swscanf
fclose
feof
fread
fseek
ftell
pow
ldexp
labs
sqrt
iswalnum
_swprintf
wcstof
_wtof

ws2_32

gethostname
gethostbyname
WSAStartup

usp10

ScriptShape
ScriptItemize
ScriptFreeCache

rlottie

??0Surface@rlottie@@QAE@PAIIII@Z
??1Animation@rlottie@@QAE@XZ
?renderSync@Animation@rlottie@@QAEXIVSurface@2@_N@Z
?render@Animation@rlottie@@QAE?AV?$future@VSurface@rlottie@@@std@@IVSurface@2@_N@Z
?duration@Animation@rlottie@@QBENXZ
?totalFrame@Animation@rlottie@@QBEIXZ
?frameRate@Animation@rlottie@@QBENXZ
?loadFromData@Animation@rlottie@@SA?AV?$unique_ptr@VAnimation@rlottie@@U?$default_delete@VAnimation@rlottie@@@std@@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@00_N@Z

Exports

Exports

_GetToolHandel@0

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 352KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Keyboard
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

087eab34553b6fd77ee4fbd69e2ef2b1

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

02:6a:87:85:2e:3b:b8:8b:61:d9:d1:9f:36:95:53:a8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

38:1c:45:c5:aa:af:16:90:c0:ed:7d:d5:2c:78:82:64:86:69:58:22:a4:b0:5d:e9:0e:67:e8:fe:ff:99:ec:d5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

chromebase

shlwapi

msvcp120

comctl32

gdiplus

imm32

msvcr120

ws2_32

usp10

rlottie

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 352KB - Virtual size: 352KB

.data Size: 50KB - Virtual size: 80KB

Keyboard Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 17B

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 100KB - Virtual size: 99KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

02:6a:87:85:2e:3b:b8:8b:61:d9:d1:9f:36:95:53:a8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

38:1c:45:c5:aa:af:16:90:c0:ed:7d:d5:2c:78:82:64:86:69:58:22:a4:b0:5d:e9:0e:67:e8:fe:ff:99:ec:d5
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 352KB - Virtual size: 352KB

.data
Size: 50KB - Virtual size: 80KB

Keyboard
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 17B

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 100KB - Virtual size: 99KB