0c2953841583afb815a4d61cc69c9b70N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0c2953841583afb815a4d61cc69c9b70N.exe
Size

6.3MB
MD5

0c2953841583afb815a4d61cc69c9b70
SHA1

a36c608c211cf21dd760a8080363fae12c936b41
SHA256

92d42fd823b765e1bca76c4d97cdbeb5c089b0dfd285e5feae522e7abb43377a
SHA512

928dc7aeab6dca02d94e1b2e5514f6388050ddc5f8d6898c56f5d6caa357be082f991a30b30f8bbcca1a5eed8e073f6c4510e4a7a0751afb59395b38de995da1
SSDEEP

98304:u8Xp6xgux7iswym/MGsPdu+DZvNd9dq/En9lbTW8EIM7EPrnDrPEZfofBkAeQnS:0x/bm/g8+DZxmEDTW8EIfnDru8BG

Score

1^/10

Malware Config

Signatures

Files

0c2953841583afb815a4d61cc69c9b70N.exe
.exe windows:5 windows x86 arch:x86

5adc8ec28d161d43e38cd902b97e703e

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:58:65:49:c2:44:d5:21:ff:12:78:e8:9b:a2:3b:d3
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

13/09/2023, 00:00

Not After

11/09/2026, 23:59

Subject

SERIALNUMBER=3086133,CN=Tenorshare (Hongkong) Limited,O=Tenorshare (Hongkong) Limited,L=Sheung Wan,C=HK,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c9:55:e5:b0:c5:54:9d:a9:4c:fb:40:a6:5e:19:a8:9d:4b:2e:c8:aa:72:dd:b3:2a:0a:cf:66:b8:10:69:94:f4
Signer

Actual PE Digest

c9:55:e5:b0:c5:54:9d:a9:4c:fb:40:a6:5e:19:a8:9d:4b:2e:c8:aa:72:dd:b3:2a:0a:cf:66:b8:10:69:94:f4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Jenkins\WorkSpace\workspace\Common_Uninstaller\output\Release\Uninstall.pdb

Imports

agentsupport

?GetLinkManagerObj@TSCommon@@YAPAVILinkManager@1@XZ

kernel32

GlobalGetAtomNameW
SystemTimeToFileTime
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
GetCurrentProcessId
FreeLibrary
GlobalFlags
lstrcmpW
GetCurrentThreadId
SetThreadPriority
ResumeThread
GlobalAddAtomW
CreateFileW
FlushFileBuffers
GetFileSize
GetFullPathNameW
GetVolumeInformationW
LockFile
ReadFile
SetEndOfFile
SetFilePointer
UnlockFile
WriteFile
DuplicateHandle
LoadLibraryExW
LoadLibraryA
EncodePointer
GetSystemDirectoryW
CompareStringW
GetLocaleInfoW
GlobalDeleteAtom
GlobalFindAtomW
GetCurrentThread
GetFileAttributesExW
GetFileSizeEx
FormatMessageW
LocalFileTimeToFileTime
SetFileTime
VirtualProtect
GetCurrentDirectoryW
lstrcpyW
FindResourceExW
GetWindowsDirectoryW
VerSetConditionMask
VerifyVersionInfoW
GetTempFileNameW
GetProfileIntW
SearchPathW
GetUserDefaultLCID
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
TryEnterCriticalSection
GetExitCodeThread
QueryPerformanceFrequency
LCMapStringW
GetStringTypeW
GetCPInfo
lstrcmpA
GetACP
HeapSize
lstrcpynW
SleepEx
VerifyVersionInfoA
FormatMessageA
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
GlobalMemoryStatus
FlushConsoleInputBuffer
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrlenA
GetSystemDirectoryA
GetVolumeInformationA
GetModuleFileNameA
GetComputerNameW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetConsoleCtrlHandler
HeapQueryInformation
GetCommandLineA
GetCommandLineW
VirtualAlloc
VirtualQuery
SetStdHandle
GetDriveTypeW
SetFilePointerEx
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
ReadConsoleW
GetConsoleCP
GetTimeZoneInformation
IsValidLocale
EnumSystemLocalesW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
FileTimeToSystemTime
SetLastError
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
GetModuleHandleA
lstrlenW
GetProcessHeap
GetModuleFileNameW
GetUserDefaultUILanguage
InitializeCriticalSectionAndSpinCount
GetTempPathW
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
Sleep
GetLastError
GetFileAttributesA
RaiseException
DecodePointer
DeleteCriticalSection
GetSystemTimeAsFileTime
GetTickCount
WaitForSingleObject
CreateEventW
SetEvent
DeleteFileA
CloseHandle
CreateThread
ResetEvent
MulDiv
CreateMutexA
CreateProcessW
GetExitCodeProcess
CreateDirectoryW
SizeofResource
GetCurrentProcess
InitializeProcThreadAttributeList
GetFileAttributesW
GetVersionExW
OpenProcess
CreateToolhelp32Snapshot
MultiByteToWideChar
UpdateProcThreadAttribute
Process32NextW
OutputDebugStringW
LockResource
Process32FirstW
GetSystemInfo
LoadLibraryW
LoadResource
DeleteProcThreadAttributeList
FindResourceW
GetProcAddress
GetModuleHandleW
CopyFileW
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
GetSystemTime
lstrcmpiW
OutputDebugStringA
GetEnvironmentVariableA
FreeResource
CreateDirectoryA
WinExec
LocalFree
GetLocalTime
GetTempPathA
GetFileTime

user32

DrawIconEx
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
MapVirtualKeyW
GetKeyNameTextW
LoadMenuW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongW
SetWindowRgn
SetParent
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
DrawEdge
DrawFrameControl
IsZoomed
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
FrameRect
DrawIcon
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
RegisterClassExW
CharPrevW
CreateCaret
GetCaretBlinkTime
ShowCaret
SetCaretPos
GetCaretPos
wsprintfA
DrawTextA
InvalidateRgn
GetGUIThreadInfo
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
FindWindowA
SendMessageA
IntersectRect
InflateRect
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
GetTopWindow
GetClassLongW
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetClientRect
RemovePropW
GetPropW
KillTimer
ShowScrollBar
IsRectEmpty
SetScrollRange
ScrollWindow
RedrawWindow
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
DestroyWindow
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
FillRect
ScreenToClient
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
CharUpperW
DestroyIcon
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
RealChildWindowFromPoint
GetClassNameW
GetDesktopWindow
PtInRect
ClientToScreen
GetWindowRect
IsDialogMessageW
SetWindowLongW
SetWindowTextW
GetFocus
GetDlgCtrlID
CheckDlgButton
GetDlgItem
SetWindowPos
MoveWindow
ShowWindow
GetWindow
GetScrollPos
SetScrollPos
SetFocus
LoadCursorW
GetSysColorBrush
GetSysColor
ReleaseDC
GetDC
GetLastActivePopup
GetWindowThreadProcessId
GetParent
GetWindowLongW
MessageBoxW
IsWindowEnabled
EnableWindow
SendMessageW
UnhookWindowsHookEx
GetWindowTextLengthW
GetWindowTextW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
CharNextW
IsWindow
PostMessageW
PostQuitMessage
GetSystemMetrics
wsprintfW
SetTimer
DeleteMenu
SetCursor
ShowOwnedPopups
DrawFocusRect
WindowFromPoint
ReleaseCapture
GetAsyncKeyState
SetCapture
GetNextDlgGroupItem
LoadImageW
TrackMouseEvent
GetScrollRange
InvalidateRect
MapDialogRect
DestroyMenu
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
OffsetRect
SetRectEmpty
SendDlgItemMessageA
CopyImage
SystemParametersInfoW
SetPropW
GetMenuItemInfoW

advapi32

DuplicateTokenEx
CreateProcessAsUserW
RegOpenKeyExW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
DeregisterEventSource
RegisterEventSourceA
ReportEventA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
DragQueryFileW
DragFinish
SHBrowseForFolderW
SHAppBarMessage
ord165
CommandLineToArgvW
ShellExecuteW
SHGetFileInfoW

ole32

CoCreateGuid
CoInitialize
CoUninitialize
CLSIDFromProgID
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
CoInitializeEx
CoDisconnectObject
CLSIDFromString
CoCreateInstance
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VarBstrFromDate
SysFreeString
LoadTypeLi
VariantChangeType
VariantCopy
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocStringLen
VariantInit
SysAllocString

msimg32

TransparentBlt
AlphaBlend

shlwapi

PathRemoveFileSpecW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFileExistsA
PathFileExistsW
StrFormatKBSizeW

uxtheme

CloseThemeData
GetThemePartSize
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
GetCurrentThemeName
DrawThemeText
DrawThemeParentBackground
OpenThemeData
DrawThemeBackground
GetThemeColor

gdiplus

GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImageRectRect
GdipSetSmoothingMode
GdipSetPenDashStyle
GdipDrawLine
GdipSetPenLineJoin
GdipCreateFromHDC
GdipSetPenEndCap
GdipDeleteGraphics
GdipDeletePen
GdipCreatePen1
GdipGetPropertyItem
GdipTranslateWorldTransform
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipSetPenStartCap
GdipGetImageWidth
GdipGetImageHeight
GdiplusShutdown
GdipAlloc
GdipBitmapUnlockBits
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipSetInterpolationMode
GdipDrawImageRectI
GdipFree
GdiplusStartup
GdipCloneImage
GdipRotateWorldTransform
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipCreatePen2
GdipGetPropertyItemSize
GdipResetWorldTransform
GdipSetWorldTransform
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipCreatePath
GdipDeletePath
GdipClosePathFigure
ord1
GdipAddPathEllipse
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipReleaseDC
GdipSetTextRenderingHint
GdipGetImagePalette

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

bugsplat

?sendAdditionalFile@MiniDmpSender@@QAEXPB_W@Z
??1MiniDmpSender@@UAE@XZ
??0MiniDmpSender@@QAE@PB_W000K@Z
?setCallback@MiniDmpSender@@QAEXP6A_NIPAX0@Z@Z
?getMinidumpPath@MiniDmpSender@@QAEXPA_WI@Z

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

winmm

timeGetTime
PlaySoundW

iphlpapi

GetBestInterface
GetAdaptersInfo

wininet

InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetSetOptionW
InternetReadFile
HttpQueryInfoW
InternetGetConnectedState

gdi32

SetBkColor
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextColor
SetTextAlign
SelectPalette
GetObjectW
MoveToEx
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
TextOutW
ExtTextOutW
IntersectClipRect
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
CreateFontIndirectW
CreateRectRgnIndirect
PatBlt
SetRectRgn
DPtoLP
GetTextExtentPoint32W
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
SetBitmapBits
GetBitmapBits
GetTextExtentPointA
GdiFlush
GetObjectA
GetCharABCWidthsW
Rectangle
GetRgnBox
OffsetRgn
CreateBitmap
BitBlt
DeleteObject
GetDeviceCaps
CreateDCW
CreatePenIndirect
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
RoundRect
CloseEnhMetaFile
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextFaceW
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
CopyMetaFileW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

comctl32

ord17
InitCommonControlsEx
_TrackMouseEvent

ws2_32

recvfrom
sendto
accept
freeaddrinfo
connect
socket
listen
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
ioctlsocket
WSAStartup
gethostname
gethostbyname
shutdown
inet_ntoa
closesocket
getaddrinfo
WSACleanup

wldap32

ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46
ord22
ord211
ord143
ord60
ord50

Exports

Exports

CreateExportObj
DestroyExportObj
NSISLog
libssh2_agent_connect
libssh2_agent_disconnect
libssh2_agent_free
libssh2_agent_get_identity
libssh2_agent_init
libssh2_agent_list_identities
libssh2_agent_userauth
libssh2_banner_set
libssh2_base64_decode
libssh2_channel_close
libssh2_channel_direct_tcpip_ex
libssh2_channel_eof
libssh2_channel_flush_ex
libssh2_channel_forward_accept
libssh2_channel_forward_cancel
libssh2_channel_forward_listen_ex
libssh2_channel_free
libssh2_channel_get_exit_signal
libssh2_channel_get_exit_status
libssh2_channel_handle_extended_data
libssh2_channel_handle_extended_data2
libssh2_channel_open_ex
libssh2_channel_process_startup
libssh2_channel_read_ex
libssh2_channel_receive_window_adjust
libssh2_channel_receive_window_adjust2
libssh2_channel_request_pty_ex
libssh2_channel_request_pty_size_ex
libssh2_channel_send_eof
libssh2_channel_set_blocking
libssh2_channel_setenv_ex
libssh2_channel_wait_closed
libssh2_channel_wait_eof
libssh2_channel_window_read_ex
libssh2_channel_window_write_ex
libssh2_channel_write_ex
libssh2_channel_x11_req_ex
libssh2_exit
libssh2_free
libssh2_hostkey_hash
libssh2_init
libssh2_keepalive_config
libssh2_keepalive_send
libssh2_knownhost_add
libssh2_knownhost_addc
libssh2_knownhost_check
libssh2_knownhost_checkp
libssh2_knownhost_del
libssh2_knownhost_free
libssh2_knownhost_get
libssh2_knownhost_init
libssh2_knownhost_readfile
libssh2_knownhost_readline
libssh2_knownhost_writefile
libssh2_knownhost_writeline
libssh2_poll
libssh2_poll_channel_read
libssh2_scp_recv
libssh2_scp_send64
libssh2_scp_send_ex
libssh2_session_abstract
libssh2_session_banner_get
libssh2_session_banner_set
libssh2_session_block_directions
libssh2_session_callback_set
libssh2_session_disconnect_ex
libssh2_session_flag
libssh2_session_free
libssh2_session_get_blocking
libssh2_session_get_timeout
libssh2_session_handshake
libssh2_session_hostkey
libssh2_session_init_ex
libssh2_session_last_errno
libssh2_session_last_error
libssh2_session_method_pref
libssh2_session_methods
libssh2_session_set_blocking
libssh2_session_set_timeout
libssh2_session_startup
libssh2_session_supported_algs
libssh2_sftp_close_handle
libssh2_sftp_fstat_ex
libssh2_sftp_fstatvfs
libssh2_sftp_get_channel
libssh2_sftp_init
libssh2_sftp_last_error
libssh2_sftp_mkdir_ex
libssh2_sftp_open_ex
libssh2_sftp_read
libssh2_sftp_readdir_ex
libssh2_sftp_rename_ex
libssh2_sftp_rmdir_ex
libssh2_sftp_seek
libssh2_sftp_seek64
libssh2_sftp_shutdown
libssh2_sftp_stat_ex
libssh2_sftp_statvfs
libssh2_sftp_symlink_ex
libssh2_sftp_tell
libssh2_sftp_tell64
libssh2_sftp_unlink_ex
libssh2_sftp_write
libssh2_trace
libssh2_trace_sethandler
libssh2_userauth_authenticated
libssh2_userauth_hostbased_fromfile_ex
libssh2_userauth_keyboard_interactive_ex
libssh2_userauth_list
libssh2_userauth_password_ex
libssh2_userauth_publickey
libssh2_userauth_publickey_fromfile_ex

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 881KB - Virtual size: 881KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5adc8ec28d161d43e38cd902b97e703e

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

04:58:65:49:c2:44:d5:21:ff:12:78:e8:9b:a2:3b:d3Certificate

Extended Key Usages

Key Usages

c9:55:e5:b0:c5:54:9d:a9:4c:fb:40:a6:5e:19:a8:9d:4b:2e:c8:aa:72:dd:b3:2a:0a:cf:66:b8:10:69:94:f4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

agentsupport

kernel32

user32

advapi32

shell32

ole32

oleaut32

msimg32

shlwapi

uxtheme

gdiplus

imm32

bugsplat

version

oleacc

winmm

iphlpapi

wininet

gdi32

winspool.drv

comctl32

ws2_32

wldap32

Exports

Exports

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 881KB - Virtual size: 881KB

.data Size: 71KB - Virtual size: 128KB

.gfids Size: 107KB - Virtual size: 106KB

.giats Size: 512B - Virtual size: 16B

.tls Size: 512B - Virtual size: 21B

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 224KB - Virtual size: 223KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

04:58:65:49:c2:44:d5:21:ff:12:78:e8:9b:a2:3b:d3
Certificate

c9:55:e5:b0:c5:54:9d:a9:4c:fb:40:a6:5e:19:a8:9d:4b:2e:c8:aa:72:dd:b3:2a:0a:cf:66:b8:10:69:94:f4
Signer

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 881KB - Virtual size: 881KB

.data
Size: 71KB - Virtual size: 128KB

.gfids
Size: 107KB - Virtual size: 106KB

.giats
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 21B

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 224KB - Virtual size: 223KB