HYU64[.]zip | Triage

Resubmissions

23/07/2024, 21:23

240723-z8s8gssdqb 7

13/10/2023, 17:26

13/10/2023, 17:21

13/10/2023, 17:14

02/08/2022, 09:53

03/02/2021, 19:17

Sharing

Copy URL Twitter E-mail

General

Target

HYU64.zip
Size

15.0MB
MD5

b93a47aeff524fa8c66e78c68425ca88
SHA1

fcaee95542f5c18824e5ba80d4af55e56565b148
SHA256

2d759c6de54e8b627c21dfe8c045028fbcebc721eb5853d1da3094bb0b66148b
SHA512

de7d8fccebaadd0a103c25379e259304a5f7996b20fc1bff7489af9332f303d9b30744cb8ba8272e55a916d47c1e796c504d16f4fb230ac732ed6bc42296eb57
SSDEEP

196608:Vz3giygJzxlQc0/g+cyIF9xJfh1YKkmyaXqqvr6x79SWFRj3BT8KqnMg19D+KVlE:VzpVJIg+85YKBXzj6bSqRLuHMgPX+TB

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/NDC2I0WN1Z9AQIP3JV6AX1O1IMXGGB9G.scr	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/VZFULXXOLK.dll
unpack001/svshshots.exe

Files

HYU64.zip
.zip
HV6Y40PG4QDWJ.vmp
.xml
NDC2I0WN1Z9AQIP3JV6AX1O1IMXGGB9G.scr
.exe windows:5 windows x64 arch:x64

cd157d70e2e1b59af033047c1545386e

Code Sign

3b:90:30:71:8e:4e:5f:91:06:e7:e7:d2:a8:5f:1b:48
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/06/2019, 00:00

Not After

31/05/2022, 23:59

Subject

CN=Ivan Yurievich Permyakov IP,O=Ivan Yurievich Permyakov IP,POSTALCODE=620144,STREET=8 Marta str.\, 194-236,L=Ekaterinburg,ST=-,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

01/08/2030, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1d:96:4b:be:98:f5:3e:21:e6:5a:d0:da:b6:90:20:57:cf:7f:3f:96
Signer

Actual PE Digest

1d:96:4b:be:98:f5:3e:21:e6:5a:d0:da:b6:90:20:57:cf:7f:3f:96

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

psapi

GetModuleInformation

kernel32

FreeEnvironmentStringsW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

shell32

CommandLineToArgvW

wtsapi32

WTSSendMessageW

user32

GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

Exports

Exports

�jMi��FL�?��Ӂ��ֈ��؆�>��yhuK��q=V��g�>�cZ�vz/|}_=��'�`ݧ��: ��l��ߣ�]o��\�HV��j�0)и�0{�zz�l�7�IQ�ٶ6�^��7��>X�<>gw�T��:�R�i%(�̵hC��E��,�e��#E�J&<}}�EH��T��pHH<<8]?��p��'�Ɨ�n�`��xJ��հ��l��C��^{}.w��^S�#c��b�5��Z��#��d�^��]�yXͱ��eI�즘�HS��~��`]�?Fn��,1��?iB }�ￛ;��*�V�]:v�U�=��ht�O4�GIJ�p_�e:꩚+YZpmU�� <Ɇ�hHΡ��4��6 ��Yy�=C!��Β>�7��k�f�xg��gf�1�3�[0fW�^pZ�0ؕ2J@K�ёb�Q�ᩣ�c:�[(��Մi�l�{�jL��9�ӧ��'�sjf�*�%��a]Fj��#�I��TKg5M!��1sm�Vï��-�zswG��H�P�e$�32�9lt)�dgWD��c�p/W��x��eCl3�M��|�iMn��:j�k��ـ�yy�=�H|�[ A�t�Qv��g6i�%��1�k4C�k8�U~:�2]��wx��N��J��~�D�� }�]�D�we��l*�I#t14��L ǣ�2D?��j��["�5 ��a(��8LQ�t��0{�ǿ�B��}�l�C��g�C#�N,��c*N9�g��'�XQ��Xܽ%��2'��dCi�� E��'��.��o�׵�M��{�{ā��$��:K<9b%�p��7e 3/էS�,�sQ7�O��\� ��J? v��K��ݨdqʮ��/��tV!5��C�k��m��Q��FZ%5a�� J��i�0�=�gq��x&��d>*i��"��U�T��X��5$��Fkֿ��Gj��Qyg��~.��A��|O�C�1��{!��Sq*م��L{�|��*�0��G]�� o�C�$��غɚ�l��R� �hyB-r��k7�i��7E�H�U�x j��>=|��b��gK5��Q"��?a�� Y��g��_�:@�R=�=:!�`��r�N�26�|�I�N��Si�S8�V��I`� ��.��Ē��E;5o3qYP��sVʓu5:� o~2�?t��j�x��`��w��lW��#��͔`��=��R�;�G� 4�Q��Poz�!~-��0�^ౖ��^�d޻ߦ�R�i��T��SLm��,s:}�VS@y�X~�Q��B��ݦ*��T0S�)!Wy�[�:��"�b꺻8�V��a��IE�A��.2�R��vX)W��Fc��e�{�@>\�� Q�d!8�Ȝ;��7��a5W1݄�|s�8��e#�ėf��-��J9E�i�s�]w��! �^�y)h+[9��{��pjﳗ��鉽j19�e��N�6e�u�S��a'"��8Z궂li �qip�2��bc�)��h�h��$��[�e��@ ��n��$��[��^�q|O�H�KцA%,�A:��O�?!�#�@&�-�A�w-��`y%r͢X�z��*�,��m�r�5��>I��.{�_��b{V��*�1=XFz��o#�h ��r�)�hY�Lp�qk��5�߽��ޔ]��R-IH�� eY��k� [�xj��(%��\��n��8l�5≔��?��Z��&��q_r�s�Ar�?�̕b��b1��C�q�PM(�5�,D"i�f��|5�]8�b�X�� 38S�y�y�Zp)薉��R�I ?�a��J߹H-eOcy�fְ��<��Z+�ވ��b�L� �e�U�峂M��Q��SJe�=:�gG�CQm��r�I��Ȯ��XT��܈�@��[ ��A�w9yW�M�9�̸xm�/�؞��Ūm�yX��˘�ˇ��V1�c�mD� �o��΃��7��&�H��0�K�/?GQ�=��Cӄ�]��#�̇��gt~�E3��JE1w�Si}}�d�%�{�~�a%��ž�+�e<`��8R��4a?�m�2�}�/w~��:f�!��N)��牼��k��Č�b��,aT��,�$��v��Bz��rt7��m��x�ycD��IMpl22�q��N�O�� K�#MW�X>э��UC�t2��U�Q�f򋮸]ț��P�q�)pN!}��:z��?��/��2|�� *%V�xT��B��3�h³3rI�:�o��g�C��lX½ X`��0I��wآ��=Y\W(O8�(��5HR��a��-�!l�i�˨��O�[W��;�W c�� s3]�J�x�H��L��F�J��^��ic��vGr��c�X�u~܀ ��,U�?e07� ��Yb:��93�# {x��U��`<W�]�s��˗14��CS�kq��w�O#�,��ke0��r��È�Q}�p��U!��MĊ�.�8��P��# Ho�/��Z��A��IZ�-�d�0j�fM��\!�AT��2 v�S��]�F��}PyH��n�Y�.F�E��[��avu\`�łis��ؼ��,N��x{M�� T��N~OD]vd�~��3ߑ�ن��b��u��t��T�pE� �Ն��IT�V��c��A�kpy݈0}��'�ji�$�!E�1;F�H�iK�� (u�i�3��/mS}��?�'�zՠ�4eΊ�pLw��p��I��]��͋��$}��vHmC��k9��{��;=

Sections

.text
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 7.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX0
Size: - Virtual size: 7.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UPX1
Size: 12.5MB - Virtual size: 12.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 339KB - Virtual size: 338KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
VZFULXXOLK.dll
.dll windows:5 windows x64 arch:x64

f774fcd4eaf335e662524aa024f5ac26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

winmm

PlaySoundW

wininet

InternetCloseHandle
InternetReadFile
InternetOpenW
InternetOpenUrlW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW
GetDefaultPrinterW
EnumPrintersW

comctl32

ImageList_GetImageInfo
FlatSB_SetScrollInfo
InitCommonControls
ImageList_DragMove
ImageList_Destroy
_TrackMouseEvent
ImageList_DragShowNolock
ImageList_Add
FlatSB_SetScrollProp
ImageList_GetDragImage
ImageList_Create
ImageList_EndDrag
ImageList_DrawEx
ImageList_SetImageCount
FlatSB_GetScrollPos
FlatSB_SetScrollPos
InitializeFlatSB
ImageList_Copy
FlatSB_GetScrollInfo
ImageList_Write
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_BeginDrag
ImageList_GetIcon
ImageList_Replace
ImageList_GetImageCount
ImageList_DragEnter
ImageList_GetIconSize
ImageList_SetIconSize
ImageList_Read
ImageList_DragLeave
ImageList_LoadImageW
ImageList_Draw
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetOverlayImage

shell32

SHGetSpecialFolderLocation
Shell_NotifyIconW
ShellExecuteW
SHGetPathFromIDListW

user32

DdeSetUserHandle
CopyImage
SetMenuItemInfoW
GetMenuItemInfoW
DefFrameProcW
GetDlgCtrlID
FrameRect
VkKeyScanA
RegisterWindowMessageW
GetMenuStringW
FillRect
DdeCmpStringHandles
SendMessageA
IsClipboardFormatAvailable
EnumWindows
ShowOwnedPopups
GetClassInfoW
GetScrollRange
SetActiveWindow
GetActiveWindow
DrawEdge
GetKeyboardLayoutList
LoadBitmapW
EnumChildWindows
GetScrollBarInfo
UnhookWindowsHookEx
SetCapture
GetCapture
ShowCaret
CreatePopupMenu
GetMenuItemID
CharLowerBuffW
PostMessageW
IsZoomed
SetParent
DrawMenuBar
SetSystemCursor
GetClientRect
IsChild
IsIconic
CallNextHookEx
DdeDisconnect
ShowWindow
GetWindowTextW
SetForegroundWindow
GetAsyncKeyState
IsDialogMessageW
DestroyWindow
RegisterClassW
EndMenu
CharNextW
GetFocus
GetDC
SetFocus
ReleaseDC
mouse_event
ExitWindowsEx
SetScrollRange
DrawTextW
PeekMessageA
MessageBeep
RemovePropW
GetSubMenu
DestroyIcon
IsWindowVisible
DispatchMessageA
UnregisterClassW
GetTopWindow
SendMessageW
GetMessageTime
GetWindowLongPtrW
SetWindowLongPtrW
DdeNameService
DdeAccessData
LoadStringW
CreateMenu
CharLowerW
SetWindowRgn
SetWindowPos
GetMenuItemCount
GetSysColorBrush
GetWindowDC
DdeQueryConvInfo
DrawTextExW
CharLowerBuffA
EnumClipboardFormats
GetScrollInfo
SetWindowTextW
GetMessageExtraInfo
GetSysColor
EnableScrollBar
TrackPopupMenu
keybd_event
DrawIconEx
DdePostAdvise
GetClassNameW
DdeCreateDataHandle
GetMessagePos
GetIconInfo
SetScrollInfo
GetKeyNameTextW
GetDesktopWindow
SetCursorPos
GetCursorPos
SetMenu
GetMenuState
GetMenu
SetRect
GetKeyState
GetCursor
KillTimer
WaitMessage
TranslateMDISysAccel
GetWindowPlacement
CreateWindowExW
GetMessageW
GetDCEx
PeekMessageW
MonitorFromWindow
SetTimer
WindowFromPoint
BeginPaint
RegisterClipboardFormatW
DdeUnaccessData
MapVirtualKeyW
IsWindowUnicode
DispatchMessageW
CreateAcceleratorTableW
DefMDIChildProcW
GetSystemMenu
SetScrollPos
GetScrollPos
DdeClientTransaction
DrawFocusRect
ReleaseCapture
LoadCursorW
DdeConnect
ScrollWindow
GetLastActivePopup
DdeUninitialize
GetSystemMetrics
CharUpperBuffW
SetClassLongPtrW
GetClassLongPtrW
SetClipboardData
GetClipboardData
ClientToScreen
SetWindowPlacement
DdeFreeStringHandle
GetMonitorInfoW
CheckMenuItem
CharUpperW
DefWindowProcW
GetForegroundWindow
EnableWindow
GetWindowThreadProcessId
RedrawWindow
EndPaint
MsgWaitForMultipleObjectsEx
LoadKeyboardLayoutW
ActivateKeyboardLayout
GetParent
MonitorFromRect
InsertMenuItemW
DdeQueryStringA
GetPropW
MessageBoxW
SetPropW
UpdateWindow
MsgWaitForMultipleObjects
VkKeyScanW
DestroyMenu
SetWindowsHookExW
EmptyClipboard
AdjustWindowRectEx
IsWindow
DrawIcon
EnumThreadWindows
InvalidateRect
SetKeyboardState
GetKeyboardState
ScreenToClient
DrawFrameControl
DdeFreeDataHandle
SetCursor
CreateIcon
DdeInitializeA
RemoveMenu
DdeCreateStringHandleA
GetKeyboardLayoutNameW
OpenClipboard
TranslateMessage
MapWindowPoints
EnumDisplayMonitors
CountClipboardFormats
CallWindowProcW
CloseClipboard
DestroyCursor
PostMessageA
CharUpperBuffA
CopyIcon
PostQuitMessage
DdeGetLastError
ShowScrollBar
EnableMenuItem
HideCaret
FindWindowExW
MonitorFromPoint
LoadIconW
SystemParametersInfoW
GetWindow
GetWindowRect
InsertMenuW
PostThreadMessageW
IsWindowEnabled
IsDialogMessageA
FindWindowW
GetKeyboardLayout
DeleteMenu

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

oleaut32

GetErrorInfo
SysFreeString
VariantClear
VariantInit
SysReAllocStringLen
SafeArrayCreate
SafeArrayGetElement
GetActiveObject
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
VariantChangeType

advapi32

RegSetValueExW
RegConnectRegistryW
GetUserNameW
RegQueryInfoKeyW
RegUnLoadKeyW
IsValidAcl
RegSaveKeyW
RegReplaceKeyW
RegCreateKeyExW
InitializeAcl
RegLoadKeyW
RegEnumKeyExW
AdjustTokenPrivileges
SetSecurityInfo
RegDeleteKeyW
LookupPrivilegeValueW
RegOpenKeyExA
RegOpenKeyExW
OpenProcessToken
RegDeleteValueW
RegFlushKey
RegQueryValueExA
RegQueryValueExW
RegEnumValueW
RegCloseKey
RegRestoreKeyW

netapi32

NetWkstaGetInfo
NetApiBufferFree

msvcrt

memcpy
memset

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpWriteData
WinHttpSetCredentials
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSendRequest
WinHttpQueryOption

kernel32

SetFileAttributesW
GetFileType
SetFileTime
RtlUnwindEx
QueryDosDeviceW
GetACP
GetStringTypeExW
CloseHandle
LocalFree
GetCurrentProcessId
SizeofResource
VirtualProtect
TlsAlloc
TerminateThread
QueryPerformanceFrequency
SetProcessWorkingSetSize
IsDebuggerPresent
FindNextFileW
GetFullPathNameW
VirtualFree
HeapAlloc
ExitProcess
GetCPInfoExW
GlobalSize
RtlUnwind
GetCPInfo
EnumSystemLocalesW
GetStdHandle
GetTimeZoneInformation
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
GetModuleHandleW
FreeLibrary
TryEnterCriticalSection
HeapDestroy
FileTimeToDosDateTime
ReadFile
GetUserDefaultLCID
HeapSize
GetLastError
GetModuleFileNameW
SetLastError
GlobalAlloc
GlobalUnlock
FindResourceW
CreateThread
CompareStringW
CopyFileW
MapViewOfFile
LoadLibraryA
GetVolumeInformationW
ResetEvent
MulDiv
FreeResource
GetDriveTypeW
GetVersion
RaiseException
GlobalAddAtomW
FormatMessageW
OpenProcess
SwitchToThread
GetExitCodeThread
OutputDebugStringW
GetCurrentThread
GetLogicalDrives
GetFileAttributesExW
LoadLibraryExW
TerminateProcess
LockResource
FileTimeToSystemTime
GetCurrentThreadId
UnhandledExceptionFilter
GlobalFindAtomW
VirtualQuery
GlobalFree
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
GetStringTypeExA
LoadResource
SuspendThread
GetTickCount
GetFileSize
GlobalDeleteAtom
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetThreadPriority
GetCurrentProcess
GlobalLock
SetThreadPriority
VirtualAlloc
GetTempPathW
GetCommandLineW
GetSystemInfo
LeaveCriticalSection
GetProcAddress
ResumeThread
GetLogicalDriveStringsW
WinExec
GetVersionExW
VerifyVersionInfoW
HeapCreate
LCMapStringW
GetDiskFreeSpaceW
VerSetConditionMask
FindFirstFileW
GetUserDefaultUILanguage
TlsFree
GetConsoleOutputCP
UnmapViewOfFile
GetConsoleCP
lstrlenW
CompareStringA
SetEndOfFile
QueryPerformanceCounter
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
GetLocaleInfoW
CreateFileW
SystemTimeToFileTime
EnumResourceNamesW
DeleteFileW
IsDBCSLeadByteEx
GetEnvironmentVariableW
GetLocalTime
WaitForSingleObject
WriteFile
CreateFileMappingW
ExitThread
DeleteCriticalSection
GetDateFormatW
TlsGetValue
SetErrorMode
GetComputerNameW
TzSpecificLocalTimeToSystemTime
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
RemoveDirectoryW
CreateEventW
WaitForMultipleObjectsEx
GetThreadLocale
SetThreadLocale

wsock32

gethostbyaddr
WSACleanup
gethostbyname
bind
gethostname
closesocket
WSAGetLastError
connect
inet_addr
getpeername
WSAAsyncSelect
WSAAsyncGetServByName
WSACancelAsyncRequest
send
ntohs
htons
WSAStartup
getservbyname
getsockname
listen
socket
recv
inet_ntoa
ioctlsocket
WSAAsyncGetHostByName

ole32

OleRegEnumVerbs
IsAccelerator
CreateBindCtx
MkParseDisplayName
CoCreateInstance
CoUninitialize
IsEqualGUID
ProgIDFromCLSID
CreateStreamOnHGlobal
OleInitialize
CLSIDFromProgID
OleUninitialize
CoGetClassObject
CoInitialize
CoTaskMemFree
OleDraw
CoTaskMemAlloc
StringFromCLSID
OleSetMenuDescriptor

gdi32

Pie
SetBkMode
CreateCompatibleBitmap
GetEnhMetaFileHeader
CloseEnhMetaFile
RectVisible
AngleArc
ResizePalette
SetAbortProc
SetTextColor
StretchBlt
RoundRect
RestoreDC
SetRectRgn
GetTextMetricsW
GetWindowOrgEx
CreatePalette
PolyBezierTo
CreateICW
CreateDCW
GetStockObject
CreateSolidBrush
Polygon
MoveToEx
PlayEnhMetaFile
Ellipse
StartPage
GetBitmapBits
StartDocW
AbortDoc
GetSystemPaletteEntries
GetEnhMetaFileBits
GetEnhMetaFilePaletteEntries
CreatePenIndirect
SetMapMode
CreateFontIndirectW
PolyBezier
LPtoDP
EndDoc
GetObjectW
GetWinMetaFileBits
SetROP2
GetEnhMetaFileDescriptionW
ArcTo
CreateEnhMetaFileW
Arc
SelectPalette
ExcludeClipRect
MaskBlt
SetWindowOrgEx
EndPage
DeleteEnhMetaFile
Chord
SetDIBits
SetViewportOrgEx
CreateRectRgn
RealizePalette
SetDIBColorTable
GetDIBColorTable
CreateBrushIndirect
PatBlt
SetEnhMetaFileBits
CreateEllipticRgn
Rectangle
SaveDC
DeleteDC
BitBlt
FrameRgn
GetDeviceCaps
GetTextExtentPoint32W
GetClipBox
IntersectClipRect
Polyline
CreateBitmap
CombineRgn
SetWinMetaFileBits
GetStretchBltMode
CreateDIBitmap
SetStretchBltMode
GetDIBits
CreateDIBSection
LineTo
GetRgnBox
EnumFontsW
CreateHalftonePalette
SelectObject
DeleteObject
ExtFloodFill
UnrealizeObject
CopyEnhMetaFileW
SetBkColor
CreateCompatibleDC
GetBrushOrgEx
GetCurrentPositionEx
GetNearestPaletteIndex
GetTextExtentPointW
ExtTextOutW
SetBrushOrgEx
GetPixel
GdiFlush
SetPixel
EnumFontFamiliesExW
StretchDIBits
GetPaletteEntries

Exports

Exports

FJFIRDVXLQY8XVMCEF0JTMQY66C51NO1YZU
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 567KB - Virtual size: 566KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 576KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 205B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.pdata
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 382KB - Virtual size: 382KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
svshshots.ahk
svshshots.exe
.exe windows:5 windows x64 arch:x64

7543123d253bcf0c3cbae87ee020cb99

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wsock32

getservbyport
ntohs
inet_addr
htonl
getservbyname
WSASetLastError
htons
WSAGetLastError
gethostbyname
ioctlsocket
gethostbyaddr
gethostname
shutdown
WSACleanup
closesocket
connect
socket
WSAStartup
send
recv
WSAAsyncSelect
inet_ntoa

winmm

waveOutGetVolume
mixerGetLineInfoW
mixerSetControlDetails
mixerGetControlDetailsW
mixerGetLineControlsW
mixerGetDevCapsW
waveOutSetVolume
mixerClose
mixerOpen
mciSendStringW
joyGetDevCapsW
joyGetPosEx

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

ImageList_GetIconSize
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
ImageList_ReplaceIcon
CreateStatusWindowW

psapi

GetProcessImageFileNameW
GetModuleFileNameExW
GetModuleBaseNameW

wininet

InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetReadFileExA
InternetOpenW

kernel32

GlobalFree
GlobalUnlock
WideCharToMultiByte
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetEnvironmentVariableW
lstrcmpiW
GetStringTypeExW
CreateThread
SetThreadPriority
GetExitCodeThread
CloseHandle
CreateMutexW
GetLastError
LoadLibraryW
GetModuleHandleW
GetVersionExW
DeleteCriticalSection
GetModuleFileNameW
GetFileAttributesW
GetFullPathNameW
GetSystemTimeAsFileTime
GetShortPathNameW
FindFirstFileW
FindNextFileW
FindClose
FileTimeToLocalFileTime
SetEnvironmentVariableW
Beep
MoveFileW
OutputDebugStringW
CreateProcessW
MultiByteToWideChar
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
GetCurrentProcessId
OpenProcess
TerminateProcess
SetPriorityClass
SetLastError
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetDiskFreeSpaceExW
SetVolumeLabelW
CreateFileW
GlobalAlloc
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceW
GetCurrentDirectoryW
CreateDirectoryW
ReadFile
WriteFile
DeleteFileW
CopyFileW
SetFileAttributesW
LocalFileTimeToFileTime
SetFileTime
GetFileSizeEx
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameW
GetSystemWindowsDirectoryW
GetTempPathW
EnterCriticalSection
LeaveCriticalSection
VirtualProtect
QueryDosDeviceW
CompareStringW
RemoveDirectoryW
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FormatMessageW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
WritePrivateProfileSectionW
SetEndOfFile
GetACP
GetFileType
GetStdHandle
SetFilePointerEx
SystemTimeToFileTime
FileTimeToSystemTime
GetFileSize
IsWow64Process
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesW
LoadLibraryExW
FindResourceW
LoadResource
LockResource
SizeofResource
GlobalSize
GlobalLock
SetErrorMode
InitializeCriticalSection
GetCPInfo
SetCurrentDirectoryW
Sleep
GetTickCount
MulDiv
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
TlsGetValue
TlsSetValue
TlsFree
GetCommandLineA
GetCommandLineW
HeapSize
ExitProcess
GetModuleHandleExW
HeapReAlloc
HeapQueryInformation
HeapFree
HeapAlloc
GetStringTypeW
LCMapStringW
GetProcessHeap
GetConsoleCP
GetConsoleMode
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW
DeviceIoControl
ReadConsoleW

user32

EnumDisplayMonitors
GetMonitorInfoW
RegisterWindowMessageW
GetSysColor
GetSysColorBrush
DrawIconEx
FillRect
DefWindowProcW
SetForegroundWindow
DialogBoxParamW
SendDlgItemMessageW
GetDlgItem
SetDlgItemTextW
MessageBeep
ClientToScreen
GetCursorInfo
GetLastInputInfo
GetSystemMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringW
ExitWindowsEx
SetMenu
FlashWindow
GetPropW
SetPropW
RemovePropW
MapWindowPoints
RedrawWindow
SetWindowLongPtrW
SetParent
GetClassInfoExW
GetAncestor
UpdateWindow
GetMessagePos
GetClassLongPtrW
DefDlgProcW
CallWindowProcW
CheckRadioButton
IntersectRect
GetUpdateRect
PtInRect
CreateDialogIndirectParamW
GetWindowLongPtrW
CreateAcceleratorTableW
DestroyAcceleratorTable
InsertMenuItemW
SetMenuDefaultItem
RemoveMenu
SetMenuItemInfoW
IsMenu
GetMenuItemInfoW
CreateMenu
CreatePopupMenu
SetMenuInfo
AppendMenuW
DestroyMenu
TrackPopupMenuEx
GetDesktopWindow
CopyImage
CreateIconIndirect
CreateIconFromResourceEx
IsIconic
GetWindow
BringWindowToTop
GetTopWindow
GetQueueStatus
SetRect
GetIconInfo
SetWindowTextW
IsWindowVisible
BlockInput
GetMenu
CheckMenuItem
GetClientRect
ChangeClipboardChain
SetClipboardViewer
LoadAcceleratorsW
CreateWindowExW
RegisterClassExW
LoadCursorW
DestroyIcon
DestroyWindow
IsCharAlphaW
MapVirtualKeyW
VkKeyScanExW
MapVirtualKeyExW
GetKeyboardLayoutNameW
ActivateKeyboardLayout
GetGUIThreadInfo
GetWindowTextW
mouse_event
WindowFromPoint
GetSystemMetrics
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
AttachThreadInput
SendInput
UnregisterHotKey
RegisterHotKey
PostQuitMessage
SendMessageTimeoutW
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
IsCharAlphaNumericW
IsCharUpperW
IsCharLowerW
ToUnicodeEx
GetKeyboardLayout
CallNextHookEx
CharLowerW
ReleaseDC
GetDC
MessageBoxW
OpenClipboard
GetClipboardData
GetClipboardFormatNameW
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageW
FindWindowW
IsZoomed
EnumWindows
GetWindowTextLengthW
EnableWindow
InvalidateRect
SetLayeredWindowAttributes
SetWindowPos
SetWindowRgn
SetFocus
SetActiveWindow
EnumChildWindows
MoveWindow
EnumClipboardFormats
GetWindowRect
EndDialog
IsWindow
DispatchMessageW
TranslateMessage
ShowWindow
CountClipboardFormats
SetWindowLongW
ScreenToClient
IsDialogMessageW
SendMessageW
IsWindowEnabled
GetWindowLongW
GetKeyState
TranslateAcceleratorW
KillTimer
PeekMessageW
GetFocus
GetClassNameW
GetWindowThreadProcessId
GetForegroundWindow
GetMessageW
SetTimer
GetParent
GetDlgCtrlID
CharUpperW
IsClipboardFormatAvailable
SystemParametersInfoW
AdjustWindowRectEx
LoadImageW
DrawTextW
GetAsyncKeyState

gdi32

GdiFlush
CreateDIBSection
SetBkColor
EnumFontFamiliesExW
SetBrushOrgEx
GetPixel
BitBlt
CreatePatternBrush
SetBkMode
GetCharABCWidthsW
GetClipBox
FillRgn
GetClipRgn
ExcludeClipRect
GetDeviceCaps
DeleteObject
CreateFontW
CreateSolidBrush
CreateDCW
CreateCompatibleBitmap
GetSystemPaletteEntries
GetDIBits
CreateCompatibleDC
CreatePolygonRgn
CreateRectRgn
CreateRoundRectRgn
CreateEllipticRgn
DeleteDC
GetObjectW
GetTextMetricsW
GetTextFaceW
SelectObject
GetStockObject
SetTextColor

comdlg32

CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW

advapi32

GetUserNameW
LockServiceDatabase
OpenSCManagerW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CloseServiceHandle
RegConnectRegistryW
UnlockServiceDatabase

shell32

DragQueryPoint
SHEmptyRecycleBinW
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetDesktopFolder
SHGetMalloc
SHGetFolderPathW
ShellExecuteExW
Shell_NotifyIconW
DragFinish
DragQueryFileW
ExtractIconW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
CoInitialize
CoUninitialize
CLSIDFromString
CLSIDFromProgID
CoGetObject
StringFromGUID2
CreateStreamOnHGlobal

oleaut32

SafeArrayDestroy
GetActiveObject
SysStringLen
SysFreeString
SafeArrayCreate
VariantClear
VariantChangeType
SysAllocString
SafeArrayCopy
VariantCopyInd
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayUnlock
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayUnaccessData
OleLoadPicture

Sections

.text
Size: 843KB - Virtual size: 843KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 241KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

cd157d70e2e1b59af033047c1545386e

Code Sign

3b:90:30:71:8e:4e:5f:91:06:e7:e7:d2:a8:5f:1b:48Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

1d:96:4b:be:98:f5:3e:21:e6:5a:d0:da:b6:90:20:57:cf:7f:3f:96Signer

Headers

DLL Characteristics

File Characteristics

Imports

psapi

kernel32

shell32

wtsapi32

user32

Exports

Exports

Sections

.text Size: - Virtual size: 2.3MB

.rdata Size: - Virtual size: 7.6MB

.data Size: - Virtual size: 56KB

.pdata Size: - Virtual size: 103KB

.gfids Size: - Virtual size: 564B

.tls Size: - Virtual size: 9B

.UPX0 Size: - Virtual size: 7.9MB

.UPX1 Size: 12.5MB - Virtual size: 12.5MB

.reloc Size: 512B - Virtual size: 216B

.rsrc Size: 339KB - Virtual size: 338KB

f774fcd4eaf335e662524aa024f5ac26

Headers

File Characteristics

Imports

winmm

wininet

winspool.drv

comctl32

shell32

user32

version

oleaut32

advapi32

netapi32

msvcrt

winhttp

kernel32

wsock32

ole32

gdi32

Exports

Exports

Sections

.text Size: 6.0MB - Virtual size: 6.0MB

.data Size: 567KB - Virtual size: 566KB

.bss Size: - Virtual size: 576KB

.idata Size: 22KB - Virtual size: 21KB

.didata Size: 5KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 205B

.rdata Size: 512B - Virtual size: 69B

.reloc Size: 291KB - Virtual size: 291KB

.pdata Size: 319KB - Virtual size: 319KB

.rsrc Size: 382KB - Virtual size: 382KB

7543123d253bcf0c3cbae87ee020cb99

Headers

DLL Characteristics

File Characteristics

3b:90:30:71:8e:4e:5f:91:06:e7:e7:d2:a8:5f:1b:48
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

1d:96:4b:be:98:f5:3e:21:e6:5a:d0:da:b6:90:20:57:cf:7f:3f:96
Signer

.text
Size: - Virtual size: 2.3MB

.rdata
Size: - Virtual size: 7.6MB

.data
Size: - Virtual size: 56KB

.pdata
Size: - Virtual size: 103KB

.gfids
Size: - Virtual size: 564B

.tls
Size: - Virtual size: 9B

.UPX0
Size: - Virtual size: 7.9MB

.UPX1
Size: 12.5MB - Virtual size: 12.5MB

.reloc
Size: 512B - Virtual size: 216B

.rsrc
Size: 339KB - Virtual size: 338KB

.text
Size: 6.0MB - Virtual size: 6.0MB

.data
Size: 567KB - Virtual size: 566KB

.bss
Size: - Virtual size: 576KB

.idata
Size: 22KB - Virtual size: 21KB

.didata
Size: 5KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 205B

.rdata
Size: 512B - Virtual size: 69B

.reloc
Size: 291KB - Virtual size: 291KB

.pdata
Size: 319KB - Virtual size: 319KB

.rsrc
Size: 382KB - Virtual size: 382KB

.text
Size: 843KB - Virtual size: 843KB

.rdata
Size: 241KB - Virtual size: 241KB

.data
Size: 15KB - Virtual size: 40KB

.pdata
Size: 31KB - Virtual size: 30KB

.gfids
Size: 512B - Virtual size: 228B

.rsrc
Size: 38KB - Virtual size: 37KB