2024-07-26_3e3c50336f06cab900227a06fd30d541_hijackloader_polyvice

Sharing

Copy URL

Twitter E-mail

General

Target

2024-07-26_3e3c50336f06cab900227a06fd30d541_hijackloader_polyvice
Size

10.2MB
MD5

3e3c50336f06cab900227a06fd30d541
SHA1

dad934e9d851440a7fc60e38afdf806916180f9c
SHA256

b65a93136cf97f364de1a6d1e8730ff72e569742b8d5557ae04a8317d3b85b07
SHA512

b722bc97ab9c67ed6178e7181b3a9aaa5e51a33ef3439d2b124534fd6a14d57b8a5c22fd609901012de8698abfdb0179a1e7a02d6a0900feb4c96f93e92ee1ef
SSDEEP

196608:S6ILH+e6sHY6hjmaQ6gwDmKqo+wCZCw49zkekwwAoWYQqyqyA6y5/rPQyQwSO01h:S6oH+e6sHY6hjmaQ6gwDmKqo+wCZCw45

Score

1^/10

Malware Config

Signatures

Files

2024-07-26_3e3c50336f06cab900227a06fd30d541_hijackloader_polyvice
.exe windows:4 windows x64 arch:x64

17a5dc27529f1a075ef9690412603175

Code Sign

02:f8:ce
Certificate

Issuer

CN=CAcert Class 3 Root,OU=http://www.CAcert.org,O=CAcert Inc.

Not Before

28-04-2022 11:20

Not After

27-04-2024 11:20

Subject

CN=Stefan Weil,1.2.840.113549.1.9.1=#0c0e7377407765696c6e65747a2e6465

Extended Key Usages

ExtKeyUsageEmailProtection
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageMicrosoftServerGatedCrypto
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement

0e
Certificate

Issuer

CN=CA Cert Signing Authority,OU=http://www.cacert.org,O=Root CA,1.2.840.113549.1.9.1=#0c12737570706f7274406361636572742e6f7267

Not Before

23-05-2011 17:48

Not After

20-05-2021 17:48

Subject

CN=CAcert Class 3 Root,OU=http://www.CAcert.org,O=CAcert Inc.

0f
Certificate

Issuer

CN=CA Cert Signing Authority,OU=http://www.cacert.org,O=Root CA,1.2.840.113549.1.9.1=#0c12737570706f7274406361636572742e6f7267

Not Before

30-03-2003 12:29

Not After

29-03-2033 12:29

Subject

CN=CA Cert Signing Authority,OU=http://www.cacert.org,O=Root CA,1.2.840.113549.1.9.1=#0c12737570706f7274406361636572742e6f7267

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:06:16:b5:e9:3e:36:3d:cb:dc:20:f9:92:1d:b1:08:5a:a3:70:62:0f:92:be:a0:14:a2:26:ae:2b:39:5a:13
Signer

Actual PE Digest

20:06:16:b5:e9:3e:36:3d:cb:dc:20:f9:92:1d:b1:08:5a:a3:70:62:0f:92:be:a0:14:a2:26:ae:2b:39:5a:13

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

sdl2

SDL_CloseAudioDevice
SDL_CreateColorCursor
SDL_CreateCursor
SDL_CreateRGBSurfaceFrom
SDL_CreateRenderer
SDL_CreateTexture
SDL_CreateWindow
SDL_DestroyRenderer
SDL_DestroyTexture
SDL_DestroyWindow
SDL_FreeCursor
SDL_FreeSurface
SDL_GL_CreateContext
SDL_GL_DeleteContext
SDL_GL_GetCurrentContext
SDL_GL_MakeCurrent
SDL_GL_SetAttribute
SDL_GL_SwapWindow
SDL_GetCursor
SDL_GetError
SDL_GetModState
SDL_GetMouseState
SDL_GetWindowFlags
SDL_GetWindowFromID
SDL_GetWindowSize
SDL_GetWindowWMInfo
SDL_HideWindow
SDL_Init
SDL_InitSubSystem
SDL_LockAudioDevice
SDL_OpenAudioDevice
SDL_PauseAudioDevice
SDL_PollEvent
SDL_QuitSubSystem
SDL_RenderClear
SDL_RenderCopy
SDL_RenderPresent
SDL_RenderSetLogicalSize
SDL_SetCursor
SDL_SetHint
SDL_SetMainReady
SDL_SetRelativeMouseMode
SDL_SetWindowFullscreen
SDL_SetWindowGrab
SDL_SetWindowIcon
SDL_SetWindowSize
SDL_SetWindowTitle
SDL_ShowCursor
SDL_ShowSimpleMessageBox
SDL_ShowWindow
SDL_UnlockAudioDevice
SDL_UpdateTexture
SDL_WarpMouseInWindow
SDL_free
SDL_iconv_string
SDL_memcpy
SDL_strlen
SDL_wcslen

sdl2_image

IMG_Load

brlapi-0.8

brlapi__closeConnection
brlapi__enterTtyMode
brlapi__getDisplaySize
brlapi__openConnection
brlapi__readKey
brlapi__writeWin
brlapi_error_location
brlapi_getHandleSize
brlapi_perror
brlapi_strerror

libbz2-1

BZ2_bzDecompress
BZ2_bzDecompressEnd
BZ2_bzDecompressInit

libcairo-2

cairo_fill
cairo_image_surface_create_for_data
cairo_paint
cairo_rectangle
cairo_scale
cairo_set_source_surface
cairo_surface_destroy

libcapstone

cs_close
cs_disasm_iter
cs_malloc
cs_open
cs_option

libcurl-4

curl_easy_cleanup
curl_easy_getinfo
curl_easy_init
curl_easy_perform
curl_easy_setopt
curl_global_init
curl_multi_add_handle
curl_multi_cleanup
curl_multi_info_read
curl_multi_init
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket_action

libepoxy-0

epoxy_eglCreateContext
epoxy_eglCreateWindowSurface
epoxy_eglDestroyContext
epoxy_eglDestroySurface
epoxy_eglGetCurrentContext
epoxy_eglGetCurrentDisplay
epoxy_eglMakeCurrent
epoxy_glAttachShader
epoxy_glBindBuffer
epoxy_glBindFramebuffer
epoxy_glBindTexture
epoxy_glBindVertexArray
epoxy_glBlendFunc
epoxy_glBlitFramebuffer
epoxy_glBufferData
epoxy_glClear
epoxy_glClearColor
epoxy_glCompileShader
epoxy_glCreateProgram
epoxy_glCreateShader
epoxy_glDeleteFramebuffers
epoxy_glDeleteProgram
epoxy_glDeleteShader
epoxy_glDeleteTextures
epoxy_glDisable
epoxy_glDrawArrays
epoxy_glEnable
epoxy_glEnableVertexAttribArray
epoxy_glFlush
epoxy_glFramebufferTexture2DEXT
epoxy_glGenBuffers
epoxy_glGenFramebuffers
epoxy_glGenTextures
epoxy_glGenVertexArrays
epoxy_glGetAttribLocation
epoxy_glGetProgramInfoLog
epoxy_glGetProgramiv
epoxy_glGetShaderInfoLog
epoxy_glGetShaderiv
epoxy_glLinkProgram
epoxy_glPixelStorei
epoxy_glReadBuffer
epoxy_glReadPixels
epoxy_glShaderSource
epoxy_glTexImage2D
epoxy_glTexParameteri
epoxy_glTexSubImage2D
epoxy_glUseProgram
epoxy_glVertexAttribPointer
epoxy_glViewport
epoxy_has_egl_extension
epoxy_is_desktop_gl

libgdk-3-0

gdk_cursor_new_for_display
gdk_cursor_new_from_pixbuf
gdk_device_get_position
gdk_device_warp
gdk_display_get_default
gdk_display_get_default_seat
gdk_display_get_monitor_at_window
gdk_event_get_device
gdk_event_get_scancode
gdk_event_get_scroll_deltas
gdk_gl_context_clear_current
gdk_gl_context_get_current
gdk_gl_context_get_version
gdk_gl_context_make_current
gdk_gl_context_realize
gdk_gl_context_set_required_version
gdk_monitor_get_geometry
gdk_monitor_get_refresh_rate
gdk_seat_get_pointer
gdk_seat_grab
gdk_seat_ungrab
gdk_win32_display_get_type
gdk_win32_window_get_impl_hwnd
gdk_window_create_gl_context
gdk_window_get_height
gdk_window_get_root_coords
gdk_window_get_scale_factor
gdk_window_get_width
gdk_window_set_cursor

libgdk_pixbuf-2.0-0

gdk_pixbuf_new_from_data

libgio-2.0-0

g_app_info_launch_default_for_uri
g_buffered_input_stream_fill
g_buffered_input_stream_get_available
g_buffered_input_stream_get_type
g_buffered_input_stream_peek_buffer
g_buffered_input_stream_set_buffer_size
g_data_input_stream_new
g_data_input_stream_read_uint32
g_data_input_stream_set_byte_order
g_data_output_stream_new
g_data_output_stream_put_string
g_data_output_stream_put_uint32
g_data_output_stream_set_byte_order
g_dbus_connection_new_for_address_sync
g_dbus_error_quark
g_dbus_proxy_call_sync
g_dbus_proxy_get_cached_property
g_dbus_proxy_new_sync
g_input_stream_get_type
g_input_stream_read_all
g_io_error_quark
g_memory_input_stream_new_from_data
g_memory_output_stream_get_size
g_memory_output_stream_get_type
g_memory_output_stream_new_resizable
g_memory_output_stream_steal_data
g_output_stream_close
g_output_stream_get_type
g_output_stream_write_all
g_seekable_get_type
g_seekable_seek

libglib-2.0-0

g_array_append_vals
g_array_free
g_array_new
g_array_remove_index
g_array_set_size
g_array_sized_new
g_array_sort
g_array_unref
g_ascii_strdown
g_ascii_strncasecmp
g_ascii_table
g_ascii_tolower
g_ascii_xdigit_value
g_assertion_message_expr
g_base64_decode
g_base64_decode_inplace
g_base64_encode
g_build_filename
g_byte_array_append
g_byte_array_free
g_byte_array_new
g_byte_array_set_size
g_byte_array_sized_new
g_clear_error
g_datalist_get_data
g_datalist_id_set_data_full
g_date_time_format
g_date_time_format_iso8601
g_date_time_get_microsecond
g_date_time_new_from_unix_local
g_date_time_new_now_local
g_date_time_new_now_utc
g_date_time_to_unix
g_date_time_unref
g_dir_make_tmp
g_direct_equal
g_direct_hash
g_error_free
g_error_matches
g_file_get_contents
g_file_set_contents
g_free
g_get_codeset
g_get_prgname
g_get_real_time
g_get_tmp_dir
g_get_user_name
g_get_user_runtime_dir
g_getenv
g_hash_table_add
g_hash_table_contains
g_hash_table_destroy
g_hash_table_find
g_hash_table_foreach
g_hash_table_foreach_remove
g_hash_table_get_keys_as_array
g_hash_table_insert
g_hash_table_iter_init
g_hash_table_iter_next
g_hash_table_iter_remove
g_hash_table_lookup
g_hash_table_new
g_hash_table_new_full
g_hash_table_remove
g_hash_table_remove_all
g_hash_table_replace
g_hash_table_size
g_hash_table_unref
g_idle_source_new
g_int64_equal
g_int64_hash
g_int_equal
g_int_hash
g_list_append
g_list_delete_link
g_list_first
g_list_foreach
g_list_free
g_list_free_full
g_list_insert_before
g_list_last
g_list_prepend
g_list_sort
g_log
g_log_set_default_handler
g_main_context_acquire
g_main_context_check
g_main_context_default
g_main_context_dispatch
g_main_context_find_source_by_id
g_main_context_get_thread_default
g_main_context_new
g_main_context_pop_thread_default
g_main_context_prepare
g_main_context_push_thread_default
g_main_context_query
g_main_context_ref
g_main_context_release
g_main_context_unref
g_main_loop_new
g_main_loop_quit
g_main_loop_run
g_main_loop_unref
g_malloc
g_malloc0
g_malloc0_n
g_malloc_n
g_mapped_file_get_contents
g_mapped_file_get_length
g_mapped_file_new_from_fd
g_mapped_file_ref
g_mapped_file_unref
g_memdup
g_memdup2
g_mkdir
g_mkdir_with_parents
g_mkstemp
g_once_impl
g_once_init_enter
g_once_init_leave
g_path_get_basename
g_path_get_dirname
g_pattern_match_simple
g_poll
g_printerr
g_ptr_array_add
g_ptr_array_free
g_ptr_array_new
g_ptr_array_set_free_func
g_ptr_array_sort
g_quark_from_string
g_quark_try_string
g_queue_clear
g_queue_delete_link
g_queue_find_custom
g_queue_foreach
g_queue_free
g_queue_get_length
g_queue_init
g_queue_insert_sorted
g_queue_is_empty
g_queue_new
g_queue_peek_head
g_queue_peek_tail
g_queue_pop_head
g_queue_pop_tail
g_queue_push_tail
g_rand_free
g_rand_int
g_rand_int_range
g_rand_new
g_rand_new_with_seed_array
g_random_int
g_random_int_range
g_realloc
g_realloc_n
g_set_error
g_set_prgname
g_slice_alloc
g_slice_free1
g_slist_append
g_slist_find
g_slist_foreach
g_slist_free
g_slist_free_1
g_slist_free_full
g_slist_insert_sorted
g_slist_prepend
g_slist_remove
g_slist_sort
g_source_add_child_source
g_source_add_poll
g_source_attach
g_source_destroy
g_source_is_destroyed
g_source_new
g_source_ref
g_source_remove
g_source_remove_child_source
g_source_remove_poll
g_source_set_callback
g_source_set_can_recurse
g_source_set_name
g_source_unref
g_spawn_async_with_pipes
g_spawn_close_pid
g_str_equal
g_str_has_prefix
g_str_has_suffix
g_str_hash
g_strchomp
g_strchug
g_strcmp0
g_strconcat
g_strdup
g_strdup_printf
g_strdup_vprintf
g_strfreev
g_string_append
g_string_append_len
g_string_append_printf
g_string_append_unichar
g_string_append_vprintf
g_string_assign
g_string_erase
g_string_free
g_string_insert_c
g_string_new
g_string_new_len
g_string_prepend
g_string_prepend_c
g_string_printf
g_string_set_size
g_string_sized_new
g_string_truncate
g_string_vprintf
g_strjoin
g_strjoinv
g_strlcat
g_strlcpy
g_strndup
g_strrstr
g_strsplit
g_strstr_len
g_strv_length
g_timeout_source_new
g_timer_destroy
g_timer_elapsed
g_timer_new
g_tree_destroy
g_tree_foreach
g_tree_insert
g_tree_lookup
g_tree_lookup_extended
g_tree_new
g_tree_new_full
g_tree_nnodes
g_tree_ref
g_tree_remove
g_try_malloc
g_try_malloc0
g_try_malloc0_n
g_try_malloc_n
g_try_realloc
g_unichar_toupper
g_usleep
g_utf16_to_utf8
g_utf8_get_char
g_utf8_skip
g_utf8_to_utf16
g_utf8_validate
g_variant_dup_string
g_variant_dup_strv
g_variant_get_child_value
g_variant_get_fixed_array
g_variant_new
g_variant_new_fixed_array
g_variant_unref
g_warn_message
g_win32_error_message
g_win32_get_system_data_dirs_for_module

libgnutls-30

gnutls_anon_allocate_client_credentials
gnutls_anon_allocate_server_credentials
gnutls_anon_free_client_credentials
gnutls_anon_free_server_credentials
gnutls_anon_set_server_dh_params
gnutls_certificate_allocate_credentials
gnutls_certificate_free_credentials
gnutls_certificate_get_peers
gnutls_certificate_server_set_request
gnutls_certificate_set_dh_params
gnutls_certificate_set_x509_crl_file
gnutls_certificate_set_x509_key_file2
gnutls_certificate_set_x509_trust_file
gnutls_certificate_verify_peers2
gnutls_cipher_decrypt2
gnutls_cipher_deinit
gnutls_cipher_encrypt2
gnutls_cipher_get
gnutls_cipher_get_key_size
gnutls_cipher_init
gnutls_cipher_set_iv
gnutls_cipher_suite_info
gnutls_credentials_set
gnutls_deinit
gnutls_dh_params_deinit
gnutls_dh_params_generate2
gnutls_dh_params_import_pkcs3
gnutls_dh_params_init
gnutls_digest_list
gnutls_global_init
gnutls_handshake
gnutls_hash
gnutls_hash_deinit
gnutls_hash_get_len
gnutls_hash_init
gnutls_hmac
gnutls_hmac_deinit
gnutls_hmac_get_len
gnutls_hmac_init
gnutls_hmac_output
gnutls_init
gnutls_pbkdf2
gnutls_priority_deinit
gnutls_priority_get_cipher_suite_index
gnutls_priority_init
gnutls_priority_set_direct
gnutls_protocol_get_name
gnutls_psk_allocate_client_credentials
gnutls_psk_allocate_server_credentials
gnutls_psk_free_client_credentials
gnutls_psk_free_server_credentials
gnutls_psk_set_client_credentials
gnutls_psk_set_server_credentials_file
gnutls_psk_set_server_dh_params
gnutls_record_get_direction
gnutls_record_recv
gnutls_record_send
gnutls_rnd
gnutls_strerror
gnutls_transport_set_ptr
gnutls_transport_set_pull_function
gnutls_transport_set_push_function
gnutls_x509_crt_check_hostname
gnutls_x509_crt_deinit
gnutls_x509_crt_get_activation_time
gnutls_x509_crt_get_basic_constraints
gnutls_x509_crt_get_dn
gnutls_x509_crt_get_expiration_time
gnutls_x509_crt_get_key_purpose_oid
gnutls_x509_crt_get_key_usage
gnutls_x509_crt_import
gnutls_x509_crt_init
gnutls_x509_crt_list_import
gnutls_x509_crt_list_verify

libgobject-2.0-0

g_cclosure_new_swap
g_object_ref
g_object_set
g_object_set_data
g_object_unref
g_signal_connect_data
g_type_check_instance_cast
g_type_check_instance_is_a

libgtk-3-0

gtk_accel_group_connect
gtk_accel_group_new
gtk_accel_label_get_type
gtk_accel_label_set_accel
gtk_accel_map_add_entry
gtk_bin_get_child
gtk_bin_get_type
gtk_box_get_type
gtk_box_new
gtk_box_pack_start
gtk_check_menu_item_get_active
gtk_check_menu_item_get_type
gtk_check_menu_item_new_with_mnemonic
gtk_check_menu_item_set_active
gtk_container_add
gtk_container_get_type
gtk_container_remove
gtk_disable_setlocale
gtk_drawing_area_new
gtk_gl_area_get_type
gtk_gl_area_make_current
gtk_gl_area_new
gtk_gl_area_queue_render
gtk_icon_theme_get_default
gtk_icon_theme_prepend_search_path
gtk_init_check_abi_check
gtk_label_new
gtk_menu_bar_new
gtk_menu_get_type
gtk_menu_item_activate
gtk_menu_item_get_type
gtk_menu_item_new_with_mnemonic
gtk_menu_item_set_accel_path
gtk_menu_item_set_submenu
gtk_menu_new
gtk_menu_set_accel_group
gtk_menu_shell_append
gtk_menu_shell_get_type
gtk_notebook_append_page
gtk_notebook_get_current_page
gtk_notebook_get_type
gtk_notebook_new
gtk_notebook_page_num
gtk_notebook_set_current_page
gtk_notebook_set_show_border
gtk_notebook_set_show_tabs
gtk_notebook_set_tab_label_text
gtk_radio_menu_item_get_group
gtk_radio_menu_item_get_type
gtk_radio_menu_item_new_with_mnemonic
gtk_separator_menu_item_new
gtk_widget_add_events
gtk_widget_destroy
gtk_widget_get_allocated_height
gtk_widget_get_allocated_width
gtk_widget_get_display
gtk_widget_get_realized
gtk_widget_get_screen
gtk_widget_get_settings
gtk_widget_get_type
gtk_widget_get_window
gtk_widget_grab_focus
gtk_widget_hide
gtk_widget_queue_draw_area
gtk_widget_set_can_focus
gtk_widget_set_sensitive
gtk_widget_set_size_request
gtk_widget_show
gtk_widget_show_all
gtk_window_add_accel_group
gtk_window_fullscreen
gtk_window_get_type
gtk_window_new
gtk_window_resize
gtk_window_set_geometry_hints
gtk_window_set_icon_name
gtk_window_set_title
gtk_window_unfullscreen

libiconv-2

libiconv
libiconv_close
libiconv_open

libintl-8

libintl_bind_textdomain_codeset
libintl_bindtextdomain
libintl_fprintf
libintl_gettext
libintl_setlocale
libintl_textdomain

libjack64

jack_activate
jack_client_close
jack_client_name_size
jack_client_open
jack_connect
jack_deactivate
jack_get_buffer_size
jack_get_client_name
jack_get_ports
jack_get_sample_rate
jack_on_shutdown
jack_port_connected_to
jack_port_get_buffer
jack_port_name
jack_port_register
jack_set_error_function
jack_set_info_function
jack_set_port_registration_callback
jack_set_process_callback
jack_set_xrun_callback

libjpeg-8

jpeg_CreateCompress
jpeg_destroy_compress
jpeg_finish_compress
jpeg_set_defaults
jpeg_set_quality
jpeg_start_compress
jpeg_std_error
jpeg_write_scanlines

liblzo2-2

__lzo_init_v2
lzo1x_1_compress

libncursesw6

COLOR_PAIRS
COLS
LINES
_nc_wacs
curs_set
delwin
endwin
getcchar
init_pair
initscr
intrflush
keypad
newpad
nodelay
noecho
nonl
pnoutrefresh
raw
scrollok
set_escdelay
setcchar
start_color
stdscr
wadd_wchnstr
wclear
werase
wget_wch
wmove
wnoutrefresh
wrefresh

libnfs-14

nfs_close
nfs_creat
nfs_destroy_context
nfs_fstat
nfs_fsync_async
nfs_ftruncate
nfs_get_error
nfs_get_fd
nfs_init_context
nfs_mount
nfs_open
nfs_pagecache_invalidate
nfs_pread_async
nfs_pwrite_async
nfs_service
nfs_set_debug
nfs_set_gid
nfs_set_pagecache
nfs_set_pagecache_ttl
nfs_set_readahead
nfs_set_tcp_syncnt
nfs_set_uid
nfs_umount
nfs_which_events

libpixman-1-0

pixman_blt
pixman_fill
pixman_format_supported_source
pixman_image_composite
pixman_image_create_bits
pixman_image_create_solid_fill
pixman_image_fill_rectangles
pixman_image_get_data
pixman_image_get_format
pixman_image_get_height
pixman_image_get_stride
pixman_image_get_width
pixman_image_ref
pixman_image_set_destroy_function
pixman_image_unref
pixman_region_extents
pixman_region_fini
pixman_region_init
pixman_region_init_rect
pixman_region_intersect
pixman_region_translate

libpng16-16

png_create_info_struct
png_create_write_struct
png_create_write_struct_2
png_destroy_write_struct
png_free
png_get_io_ptr
png_init_io
png_malloc
png_set_IHDR
png_set_PLTE
png_set_compression_level
png_set_filter
png_set_write_fn
png_write_end
png_write_info
png_write_row

libsasl2-3

sasl_decode
sasl_dispose
sasl_encode
sasl_errdetail
sasl_errstring
sasl_getprop
sasl_listmech
sasl_server_init
sasl_server_new
sasl_server_start
sasl_server_step
sasl_setprop

libslirp-0

slirp_add_exec
slirp_add_guestfwd
slirp_add_hostfwd
slirp_cleanup
slirp_connection_info
slirp_handle_timer
slirp_input
slirp_new
slirp_pollfds_fill
slirp_pollfds_poll
slirp_remove_hostfwd
slirp_socket_can_recv
slirp_socket_recv
slirp_state_load
slirp_state_save
slirp_state_version

libsnappy

snappy_compress
snappy_max_compressed_length

libspice-server-1

spice_qxl_add_memslot
spice_qxl_add_memslot_async
spice_qxl_create_primary_surface
spice_qxl_create_primary_surface_async
spice_qxl_del_memslot
spice_qxl_destroy_primary_surface
spice_qxl_destroy_primary_surface_async
spice_qxl_set_device_info
spice_qxl_wakeup
spice_server_add_client
spice_server_add_interface
spice_server_add_ssl_client
spice_server_char_device_recognized_subtypes
spice_server_char_device_wakeup
spice_server_get_best_playback_rate
spice_server_get_best_record_rate
spice_server_init
spice_server_is_server_mouse
spice_server_kbd_leds
spice_server_migrate_connect
spice_server_migrate_end
spice_server_migrate_start
spice_server_new
spice_server_playback_get_buffer
spice_server_playback_put_samples
spice_server_playback_set_mute
spice_server_playback_set_volume
spice_server_playback_start
spice_server_playback_stop
spice_server_port_event
spice_server_record_get_samples
spice_server_record_set_mute
spice_server_record_set_volume
spice_server_record_start
spice_server_record_stop
spice_server_remove_interface
spice_server_set_addr
spice_server_set_agent_copypaste
spice_server_set_agent_file_xfer
spice_server_set_agent_mouse
spice_server_set_channel_security
spice_server_set_image_compression
spice_server_set_jpeg_compression
spice_server_set_name
spice_server_set_noauth
spice_server_set_playback_compression
spice_server_set_playback_rate
spice_server_set_port
spice_server_set_record_rate
spice_server_set_sasl
spice_server_set_sasl_appname
spice_server_set_seamless_migration
spice_server_set_streaming_video
spice_server_set_ticket
spice_server_set_tls
spice_server_set_uuid
spice_server_set_zlib_glz_compression
spice_server_vm_start
spice_server_vm_stop

libssh

sftp_attributes_free
sftp_close
sftp_extension_supported
sftp_file_set_blocking
sftp_free
sftp_fstat
sftp_fsync
sftp_get_error
sftp_init
sftp_new
sftp_open
sftp_read
sftp_seek64
sftp_write
ssh_clean_pubkey_hash
ssh_connect
ssh_disconnect
ssh_free
ssh_get_error
ssh_get_error_code
ssh_get_fingerprint_hash
ssh_get_poll_flags
ssh_get_publickey_hash
ssh_get_server_publickey
ssh_init
ssh_is_blocking
ssh_key_free
ssh_key_type
ssh_key_type_to_char
ssh_new
ssh_options_parse_config
ssh_options_set
ssh_session_is_known_server
ssh_set_blocking
ssh_string_free_char
ssh_userauth_list
ssh_userauth_none
ssh_userauth_publickey_auto

libusb-1.0

libusb_alloc_streams
libusb_alloc_transfer
libusb_attach_kernel_driver
libusb_cancel_transfer
libusb_claim_interface
libusb_clear_halt
libusb_close
libusb_detach_kernel_driver
libusb_free_config_descriptor
libusb_free_device_list
libusb_free_ss_endpoint_companion_descriptor
libusb_free_streams
libusb_free_transfer
libusb_get_active_config_descriptor
libusb_get_bus_number
libusb_get_config_descriptor
libusb_get_device_address
libusb_get_device_descriptor
libusb_get_device_list
libusb_get_device_speed
libusb_get_port_numbers
libusb_get_ss_endpoint_companion_descriptor
libusb_get_string_descriptor_ascii
libusb_handle_events_timeout
libusb_init
libusb_kernel_driver_active
libusb_open
libusb_ref_device
libusb_release_interface
libusb_reset_device
libusb_set_configuration
libusb_set_interface_alt_setting
libusb_set_option
libusb_submit_transfer
libusb_transfer_set_stream_id
libusb_unref_device

libusbredirparser-1

usbredirfilter_check
usbredirfilter_string_to_rules
usbredirparser_caps_set_cap
usbredirparser_create
usbredirparser_destroy
usbredirparser_do_read
usbredirparser_do_write
usbredirparser_init
usbredirparser_peer_has_cap
usbredirparser_send_alloc_bulk_streams
usbredirparser_send_bulk_packet
usbredirparser_send_cancel_data_packet
usbredirparser_send_control_packet
usbredirparser_send_filter_filter
usbredirparser_send_filter_reject
usbredirparser_send_free_bulk_streams
usbredirparser_send_get_alt_setting
usbredirparser_send_get_configuration
usbredirparser_send_interrupt_packet
usbredirparser_send_iso_packet
usbredirparser_send_reset
usbredirparser_send_set_alt_setting
usbredirparser_send_set_configuration
usbredirparser_send_start_bulk_receiving
usbredirparser_send_start_interrupt_receiving
usbredirparser_send_start_iso_stream
usbredirparser_send_stop_bulk_receiving
usbredirparser_send_stop_interrupt_receiving
usbredirparser_send_stop_iso_stream
usbredirparser_serialize
usbredirparser_unserialize

libvirglrenderer-1

virgl_renderer_context_create
virgl_renderer_context_destroy
virgl_renderer_create_fence
virgl_renderer_ctx_attach_resource
virgl_renderer_ctx_detach_resource
virgl_renderer_fill_caps
virgl_renderer_force_ctx_0
virgl_renderer_get_cap_set
virgl_renderer_get_cursor_data
virgl_renderer_init
virgl_renderer_poll
virgl_renderer_reset
virgl_renderer_resource_attach_iov
virgl_renderer_resource_create
virgl_renderer_resource_detach_iov
virgl_renderer_resource_get_info
virgl_renderer_resource_unref
virgl_renderer_submit_cmd
virgl_renderer_transfer_read_iov
virgl_renderer_transfer_write_iov

zlib1

compress
compress2
compressBound
crc32
deflate
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflateReset
inflate
inflateEnd
inflateInit2_
inflateInit_
inflateReset
uncompress

libzstd

ZSTD_compressBound
ZSTD_compressStream2
ZSTD_createCCtx
ZSTD_createCStream
ZSTD_createDCtx
ZSTD_createDStream
ZSTD_decompressStream
ZSTD_freeCCtx
ZSTD_freeCStream
ZSTD_freeDCtx
ZSTD_freeDStream
ZSTD_getErrorName
ZSTD_initCStream
ZSTD_initDStream
ZSTD_isError

advapi32

RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA

kernel32

AcquireSRWLockExclusive
ClearCommError
CloseHandle
CommConfigDialogA
ConnectNamedPipe
ConvertThreadToFiber
CreateEventA
CreateFiber
CreateFileA
CreateIoCompletionPort
CreateNamedPipeA
CreateSemaphoreA
CreateThread
DeleteCriticalSection
DeleteFiber
DeviceIoControl
EnterCriticalSection
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetCurrentDirectoryA
GetCurrentThread
GetCurrentThreadId
GetDefaultCommConfigA
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDriveTypeA
GetEnvironmentVariableW
GetFileAttributesA
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileType
GetLastError
GetLogicalDriveStringsA
GetLogicalProcessorInformation
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessId
GetQueuedCompletionStatus
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadTimes
GetTimeZoneInformation
GetVersion
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeConditionVariable
InitializeCriticalSection
InitializeSRWLock
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
OpenThread
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleInputA
ReadFile
ReleaseSRWLockExclusive
ReleaseSemaphore
ResetEvent
SetCommMask
SetCommState
SetCommTimeouts
SetConsoleCtrlHandler
SetConsoleMode
SetEndOfFile
SetEvent
SetFilePointer
SetUnhandledExceptionFilter
SetupComm
Sleep
SleepConditionVariableSRW
SleepEx
SwitchToFiber
TerminateProcess
TerminateThread
TlsGetValue
TryAcquireSRWLockExclusive
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteFile
__C_specific_handler
lstrlenA

msvcrt

___lc_codepage_func
___mb_cur_max_func
__argv
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_aligned_free
_aligned_malloc
_amsg_exit
_beginthreadex
_cexit
_commit
_commode
_endthreadex
_errno
_findclose
_findfirst64
_findnext64
_fmode
_fstat64
_fullpath
_get_osfhandle
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_mktime64
_onexit
_open
_read
_setjmp
_sopen
_stat64
_stricmp
_strnicmp
_telli64
_time64
_unlock
abort
atoi
bsearch
calloc
clock
exit
fclose
feof
ferror
fflush
fgets
fopen
fprintf
fputc
fread
free
fseek
ftell
fwrite
getc
getenv
isalnum
isalpha
isgraph
islower
isspace
isupper
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
perror
putc
putchar
puts
qsort
raise
rand
realloc
remove
rename
setbuf
setlocale
signal
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtok
strtol
strtoul
system
tolower
toupper
ungetc
vfprintf
wcslen
wcstombs
longjmp
_write
_unlink
_strdup
_rmdir
_isatty
_getpid
_fdopen
_dup2
_close
_access

ole32

CoCreateInstance
CoInitialize

api-ms-win-core-path-l1-1-0

PathCchSkipRoot

libwinpthread-1

clock_gettime

shell32

CommandLineToArgvW

user32

CallNextHookEx
GetDesktopWindow
GetFocus
SendMessageA
SetWindowsHookExA
UnhookWindowsHookEx

winmm

timeBeginPeriod
timeEndPeriod
timeGetDevCaps

ws2_32

WSACleanup
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

libgcc_s_seh-1

__divti3
__emutls_get_address
__modti3
__popcountdi2
__udivti3
__umodti3

libssp-0

__chk_fail
__memcpy_chk
__memmove_chk
__memset_chk
__stack_chk_fail
__stack_chk_guard
__strcat_chk
__strcpy_chk
__strncat_chk

Sections

.text
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 190KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17a5dc27529f1a075ef9690412603175

Code Sign

02:f8:ceCertificate

Extended Key Usages

Key Usages

0eCertificate

0fCertificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

20:06:16:b5:e9:3e:36:3d:cb:dc:20:f9:92:1d:b1:08:5a:a3:70:62:0f:92:be:a0:14:a2:26:ae:2b:39:5a:13Signer

Headers

DLL Characteristics

File Characteristics

Imports

sdl2

sdl2_image

brlapi-0.8

libbz2-1

libcairo-2

libcapstone

libcurl-4

libepoxy-0

libgdk-3-0

libgdk_pixbuf-2.0-0

libgio-2.0-0

libglib-2.0-0

libgnutls-30

libgobject-2.0-0

libgtk-3-0

libiconv-2

libintl-8

libjack64

libjpeg-8

liblzo2-2

libncursesw6

libnfs-14

libpixman-1-0

libpng16-16

libsasl2-3

libslirp-0

libsnappy

libspice-server-1

libssh

libusb-1.0

libusbredirparser-1

libvirglrenderer-1

zlib1

libzstd

advapi32

kernel32

msvcrt

ole32

api-ms-win-core-path-l1-1-0

libwinpthread-1

shell32

user32

winmm

ws2_32

libgcc_s_seh-1

libssp-0

Sections

.text Size: 5.1MB - Virtual size: 5.1MB

.data Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 3.0MB - Virtual size: 3.0MB

.pdata Size: 243KB - Virtual size: 243KB

.xdata Size: 256KB - Virtual size: 255KB

.bss Size: - Virtual size: 190KB

.idata Size: 56KB - Virtual size: 56KB

.CRT Size: 512B - Virtual size: 96B

02:f8:ce
Certificate

0e
Certificate

0f
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

20:06:16:b5:e9:3e:36:3d:cb:dc:20:f9:92:1d:b1:08:5a:a3:70:62:0f:92:be:a0:14:a2:26:ae:2b:39:5a:13
Signer

.text
Size: 5.1MB - Virtual size: 5.1MB

.data
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 3.0MB - Virtual size: 3.0MB

.pdata
Size: 243KB - Virtual size: 243KB

.xdata
Size: 256KB - Virtual size: 255KB

.bss
Size: - Virtual size: 190KB

.idata
Size: 56KB - Virtual size: 56KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 246KB - Virtual size: 245KB