72664b08359e4f6bdb434aafb9ffbd042a0b8bea751f76b1119820cb4511c101

Sharing

Copy URL Twitter E-mail

General

Target

72664b08359e4f6bdb434aafb9ffbd042a0b8bea751f76b1119820cb4511c101
Size

6.6MB
MD5

2f739b80a69da3f5a4b20fd4a72e3969
SHA1

80e3dd048180fdbd4331a98b1c6de425e0e38f20
SHA256

72664b08359e4f6bdb434aafb9ffbd042a0b8bea751f76b1119820cb4511c101
SHA512

789db91ab8f0e4bfa666fd56fec5a60a395071d61693b769ce30deb079b0d521683272f4a59b920c31d69b4d88b54f59e1db88980bea52773c07cf95b3cc0c4d
SSDEEP

196608:YI2SMrH4W/T33eOOsOQpy77HYbFA/8jwjBoBlS3S7T4lWSdr7MNcf/QGYTMC:sU6OES3JlWhcfYGYTMC

Score

1^/10

Malware Config

Signatures

Files

72664b08359e4f6bdb434aafb9ffbd042a0b8bea751f76b1119820cb4511c101
.exe windows:5 windows x86 arch:x86

880d0b14ad8c32a99558b139441ca89b

Code Sign

8b:3c:04:96:18:b9:7a:47:b7:1c:d9:d4:3b:99:0d:df
Certificate

Issuer

CN=LandHonor,OU=LandHonor,O=LandHonor,L=China,ST=山东,C=??

Not Before

22/07/2024, 02:54

Not After

22/07/2025, 00:00

Subject

CN=LandHonor,OU=LandHonor,O=LandHonor,L=China,ST=山东,C=??

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

8b:3c:04:96:18:b9:7a:47:b7:1c:d9:d4:3b:99:0d:df
Certificate

Issuer

CN=LandHonor,OU=LandHonor,O=LandHonor,L=China,ST=山东,C=??

Not Before

22/07/2024, 02:54

Not After

22/07/2025, 00:00

Subject

CN=LandHonor,OU=LandHonor,O=LandHonor,L=China,ST=山东,C=??

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:b3:3b:e4:5d:8f:4c:a3:69:77:02:6c:d0:75:be:d0:6d:d2:55:9e:38:a1:94:b0:44:72:b9:51:d3:31:6a:3a
Signer

Actual PE Digest

70:b3:3b:e4:5d:8f:4c:a3:69:77:02:6c:d0:75:be:d0:6d:d2:55:9e:38:a1:94:b0:44:72:b9:51:d3:31:6a:3a

Digest Algorithm

sha256

PE Digest Matches

true

45:02:5d:2f:36:25:91:30:59:5e:70:92:be:15:fc:9a:bf:40:36:ef
Signer

Actual PE Digest

45:02:5d:2f:36:25:91:30:59:5e:70:92:be:15:fc:9a:bf:40:36:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\source\NetMon\NetMonitor\Bin\server\spromgr.pdb

Imports

nfapi

?nf_adjustProcessPriviledges@nfapi@@YAXXZ
?nf_addRule@nfapi@@YA?AW4_NF_STATUS@@PAU_NF_RULE@1@H@Z
?nf_udpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@1@@Z
?nf_udpPostSend@nfapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@1@@Z
?nf_udpSetConnectionState@nfapi@@YA?AW4_NF_STATUS@@_KH@Z
?nf_setTCPTimeout@nfapi@@YAKK@Z
?nf_tcpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_tcpPostSend@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_tcpSetConnectionState@nfapi@@YA?AW4_NF_STATUS@@_KH@Z
?nf_free@nfapi@@YAXXZ
?nf_init@nfapi@@YA?AW4_NF_STATUS@@PBDPAVNF_EventHandler@1@@Z

protocolfilters

?pf_addFilter@ProtocolFilters@@YAH_KW4_PF_FilterType@1@KW4_PF_OpTarget@1@1@Z
?pf_postObject@ProtocolFilters@@YAH_KPAVPFObject@1@@Z
?PFObject_create@ProtocolFilters@@YAPAVPFObject@1@HH@Z
?pf_init@ProtocolFilters@@YAHPAVPFEvents@1@PB_W@Z
?pf_free@ProtocolFilters@@YAXXZ
?pf_getNFEventHandler@ProtocolFilters@@YAPAVNF_EventHandler@nfapi@@XZ

shlwapi

PathRemoveFileSpecW
PathFindExtensionA
PathStripToRootA
PathIsUNCA
PathRemoveExtensionA
PathFindFileNameA
SHDeleteKeyA
PathIsDirectoryA
PathFileExistsA
StrFormatKBSizeA

kernel32

CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
QueryPerformanceFrequency
GetFileSizeEx
SetFilePointerEx
GetCPInfo
InterlockedIncrement
InterlockedDecrement
CompareFileTime
GlobalAddAtomA
FindFirstFileW
FindNextFileW
GetProcessTimes
LockResource
LoadResource
SizeofResource
FindResourceW
ExitThread
GetCommandLineW
LocalSize
lstrcmpiA
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetFileTime
Module32First
Module32Next
MulDiv
lstrcmpA
GetModuleHandleW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
CompareStringA
GlobalGetAtomNameA
GetAtomNameA
FileTimeToSystemTime
GetThreadLocale
SetThreadPriority
SuspendThread
LoadLibraryExA
GetShortPathNameA
GetStringTypeExA
GlobalFlags
EncodePointer
GetSystemDirectoryW
FreeResource
LoadLibraryExW
GlobalDeleteAtom
lstrcmpW
FindResourceA
GlobalFindAtomA
FileTimeToLocalFileTime
GetFileAttributesExA
LocalFileTimeToFileTime
DuplicateHandle
CompareStringW
ResetEvent
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetOEMCP
GetACP
GetWindowsDirectoryA
VerSetConditionMask
VerifyVersionInfoA
GetProfileIntA
SearchPathA
VirtualProtect
ReplaceFileA
GetUserDefaultLCID
FindResourceExW
LocalLock
LocalUnlock
GetStartupInfoW
GetFileInformationByHandle
SetStdHandle
HeapQueryInformation
VirtualQuery
GetCommandLineA
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
RtlCaptureStackBackTrace
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
CreateTimerQueue
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
SetCurrentDirectoryA
SetEnvironmentVariableA
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
RemoveDirectoryW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
RtlUnwind
ExpandEnvironmentStringsA
GetFileType
SleepEx
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
GetCurrentThread
WaitNamedPipeA
CreateNamedPipeA
SetHandleInformation
WinExec
GetSystemDirectoryA
GetLocaleInfoW
GetTempFileNameA
GetStartupInfoA
PeekNamedPipe
FindFirstFileA
lstrcpyA
FindClose
SetLastError
WaitForMultipleObjects
RemoveDirectoryA
GetDiskFreeSpaceExA
lstrcatA
LocalReAlloc
CancelIo
LocalAlloc
InterlockedExchange
VirtualFree
VirtualAlloc
GetDriveTypeW
OpenFileMappingA
GetLocalTime
IsDebuggerPresent
SetUnhandledExceptionFilter
WaitNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
ReleaseMutex
GlobalUnlock
GlobalLock
GlobalSize
GetComputerNameW
GetModuleFileNameW
SetErrorMode
TryEnterCriticalSection
GetCurrentThreadId
LoadLibraryW
FormatMessageW
GetVersionExW
HeapCreate
HeapValidate
CreateFileW
FlushFileBuffers
GetTempPathW
LockFileEx
GetDiskFreeSpaceW
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
GetFullPathNameW
GetFullPathNameA
GetFileSize
CreateMutexW
HeapCompact
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
SystemTimeToFileTime
QueryPerformanceCounter
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
UnlockFileEx
CreateFileA
GetDriveTypeA
lstrlenA
DeviceIoControl
CreatePipe
ReadFile
WriteFile
GetExitCodeProcess
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
CreateSemaphoreA
GetSystemTimeAsFileTime
GetStdHandle
Sleep
ReleaseSemaphore
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
Process32NextW
Process32FirstW
QueryDosDeviceW
CreateProcessW
GetLogicalDriveStringsW
Process32Next
Process32First
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetVolumeInformationA
QueryDosDeviceA
CreateDirectoryA
GetCurrentDirectoryA
OutputDebugStringA
CreateProcessA
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
GetLogicalDriveStringsA
OpenMutexA
CreateMutexA
FormatMessageA
GetTickCount
SetFilePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
OpenProcess
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GlobalFree
GlobalAlloc
GetProcAddress
FreeLibrary
DecodePointer
MoveFileW
MoveFileA
CopyFileW
CopyFileA
DeleteFileW
DeleteFileA
GetFileAttributesW
GetFileAttributesA
SetFileAttributesW
SetFileAttributesA
CreateEventA
CloseHandle
WaitForSingleObject
SetEvent
ResumeThread
TerminateThread
CreateThread
GetConsoleCP
GetConsoleMode
FatalAppExitA
MoveFileExW
ReadConsoleW
IsValidCodePage
GetStringTypeW
UnhandledExceptionFilter
CreateEventW
CreateSemaphoreW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
SetConsoleCtrlHandler
GetThreadTimes
FreeLibraryAndExitThread
InitializeSListHead
UnregisterWaitEx
SetProcessAffinityMask
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
WaitForMultipleObjectsEx
GetExitCodeThread
GetDiskFreeSpaceExW
CreateHardLinkW
lstrlenW
SetFileTime

user32

EqualRect
CopyRect
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetClientRect
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
ScrollWindow
RedrawWindow
SetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
GetMenu
GetCapture
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
LoadBitmapW
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
IsDialogMessageA
SetWindowLongA
ScrollWindowEx
SendDlgItemMessageA
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
GetClassLongA
GetDlgItemInt
SetDlgItemInt
GetDlgItem
SetWindowPos
MoveWindow
GetScrollPos
SetScrollPos
SetFocus
RealChildWindowFromPoint
GetWindow
GetClassNameA
PtInRect
HideCaret
SetWindowTextA
GetFocus
GetDlgCtrlID
CharUpperA
DestroyIcon
TabbedTextOutA
SetWindowsHookExA
ValidateRect
GetKeyState
GetActiveWindow
InvertRect
LoadCursorW
NotifyWinEvent
GetTopWindow
LoadIconW
BeginPaint
EndPaint
FillRect
DestroyMenu
GetMenuItemInfoA
InflateRect
SystemParametersInfoA
CopyImage
ShowOwnedPopups
SetCursor
DeleteMenu
InvalidateRect
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
IntersectRect
GetDialogBaseUnits
GetNextDlgGroupItem
ReleaseCapture
EnableScrollBar
DrawFocusRect
SetRectEmpty
OffsetRect
SetScrollInfo
GetScrollInfo
WinHelpA
MonitorFromWindow
IsIconic
DrawTextA
DrawTextExA
SetDlgItemTextA
GrayStringA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfW
SendMessageA
SendMessageTimeoutA
UnregisterClassA
RegisterClassExA
CreateWindowExA
DestroyWindow
GetLastInputInfo
GetSystemMetrics
GetWindowTextA
GetWindowTextW
GetWindowThreadProcessId
LoadCursorA
LoadIconA
LoadImageA
RegisterClassExW
CreateWindowExW
GetForegroundWindow
PostMessageA
DefWindowProcA
PostQuitMessage
FindWindowW
OpenClipboard
CloseClipboard
SetClipboardViewer
ChangeClipboardChain
GetClipboardData
GetPriorityClipboardFormat
KillTimer
wsprintfA
CharNextA
MessageBoxA
SetClipboardData
EmptyClipboard
keybd_event
mouse_event
MapVirtualKeyA
DestroyCursor
BlockInput
PrintWindow
GetAsyncKeyState
CreatePopupMenu
GetMenuDefaultItem
SetLayeredWindowAttributes
DrawStateA
LoadImageW
SetCapture
DrawEdge
DrawFrameControl
SetWindowRgn
UnionRect
IsMenu
UpdateLayeredWindow
MonitorFromPoint
GetDC
BringWindowToTop
LoadAcceleratorsA
TranslateAcceleratorA
IsRectEmpty
DrawIconEx
GetIconInfo
MessageBeep
CallNextHookEx
ReleaseDC
GetWindowRect
SetCursorPos
GetCursorPos
WindowFromPoint
LoadMenuA
InsertMenuItemA
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
GetKeyNameTextA
TrackMouseEvent
LoadMenuW
GetComboBoxInfo
IsZoomed
GetSystemMenu
PostThreadMessageA
GetTabbedTextExtentW
GetTabbedTextExtentA
WindowFromDC
DrawIcon
GetWindowRgn
GetDCEx
MapDialogRect
CreateMenu
InSendMessage
SendNotifyMessageA
SubtractRect
GetUpdateRect
IsClipboardFormatAvailable
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
DrawMenuBar
WaitMessage
EnumChildWindows
FrameRect
CharUpperBuffA
RegisterClipboardFormatA
ModifyMenuA
SetMenuDefaultItem
CopyIcon
GetDoubleClickTime
SetClassLongA
LockWindowUpdate
SetParent
CopyAcceleratorTableA
DestroyAcceleratorTable
CreateAcceleratorTableA
LoadAcceleratorsW
ToAsciiEx
GetKeyboardState
MapVirtualKeyExA
IsCharLowerA
GetKeyboardLayout
ClientToScreen
SetRect
GetDesktopWindow
GetMonitorInfoA
EnumDisplayMonitors
GetCursorInfo
SetTimer
IsWindowEnabled
GetWindowDC
FindWindowExA
RegisterHotKey
ShowWindow
FindWindowA
ExitWindowsEx
IsWindowVisible
EnumWindows
OpenDesktopA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
GetThreadDesktop
GetUserObjectInformationA
IsWindow
CloseWindow
SendMessageTimeoutW
GetParent
GetMenuStringA
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuA
AppendMenuA
RemoveMenu
UnhookWindowsHookEx
EnableWindow
GetWindowLongA
GetLastActivePopup
GetSysColor
GetSysColorBrush
GetWindowTextLengthA
PeekMessageA

gdi32

SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
StartDocA
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
MoveToEx
TextOutA
ExtTextOutA
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectA
GetTextExtentPoint32A
CombineRgn
CreateRectRgnIndirect
GetMapMode
PatBlt
SetRectRgn
DPtoLP
GetTextMetricsA
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
SetBkMode
EnumFontFamiliesA
GetTextCharsetInfo
SetPixel
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
Rectangle
EnumFontFamiliesExA
GetRgnBox
OffsetRgn
CreateRoundRectRgn
GetCurrentObject
CreateFontA
GetCharWidthA
StretchDIBits
RoundRect
SetMapMode
PtInRegion
SetPixelV
ExtFloodFill
SetPaletteEntries
FillRgn
GetBoundsRect
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextExtentPointA
GetTextExtentPoint32W
GetTextFaceA
CloseMetaFile
CreateMetaFileA
DeleteMetaFile
SelectPalette
ExtSelectClipRgn
SelectClipRgn
RectVisible
PtVisible
PlayMetaFile
OffsetClipRgn
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetCurrentPositionEx
GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateDIBPatternBrushPt
GetObjectA
SetTextColor
SetBkColor
CreateBitmap
CreateDCA
CopyMetaFileA
StretchBlt
SaveDC
RestoreDC
GetDeviceCaps
CreateDIBSection
SelectObject
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SetGraphicsMode
FrameRgn
SetMapperFlags
CreateDIBitmap
GetClipRgn
BitBlt

winspool.drv

GetJobA
OpenPrinterA
ClosePrinter
DocumentPropertiesA

shell32

ShellExecuteExA
SHAppBarMessage
DragFinish
DragQueryFileA
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHAddToRecentDocs
ExtractIconA
CommandLineToArgvW
SHFileOperationA
ShellExecuteA
SHGetSpecialFolderPathA
SHGetFileInfoA
ShellExecuteW
SHGetFolderPathW
ShellExecuteExW
SHBrowseForFolderW
SHBrowseForFolderA
SHGetFolderPathA
SHGetPathFromIDListW
SHGetPathFromIDListA
SHGetMalloc

ole32

OleIsRunning
OleQueryCreateFromData
OleQueryLinkFromData
OleRegEnumVerbs
CLSIDFromProgID
CoRegisterMessageFilter
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
OleUninitialize
OleInitialize
OleSetContainedObject
OleGetIconOfClass
GetHGlobalFromILockBytes
OleSaveToStream
OleSave
OleLoad
OleCreateFromFile
OleCreateLinkToFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
CoFreeUnusedLibraries
CreateOleAdviseHolder
OleCreate
WriteClassStm
CreateItemMoniker
CreateGenericComposite
StgCreateDocfileOnILockBytes
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleRegGetMiscStatus
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateILockBytesOnHGlobal
CreateFileMoniker
StgIsStorageFile
StgOpenStorageOnILockBytes
StgOpenStorage
StgCreateDocfile
OleLockRunning
OleSetMenuDescriptor
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CreateStreamOnHGlobal
CoCreateGuid
CLSIDFromString
CoDisconnectObject
StringFromGUID2
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
WriteClassStg
ReadClassStg
CreateBindCtx
CoTreatAsClass
CoTaskMemAlloc
StringFromCLSID
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
OleGetClipboard
PropVariantCopy
CreateDataAdviseHolder
GetRunningObjectTable
CoGetMalloc
OleRun

oleaut32

VariantCopy
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
VariantChangeType
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayCreate
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen
SysAllocStringLen
SysStringLen
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
VariantClear
SysAllocString
SysFreeString
VarDateFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromDec
VarDecFromStr
VariantInit
GetErrorInfo
SetErrorInfo
SafeArrayRedim
SafeArrayCopy
CreateErrorInfo

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

ws2_32

inet_addr
freeaddrinfo
getaddrinfo
WSAGetLastError
socket
setsockopt
send
select
recv
__WSAFDIsSet
connect
closesocket
WSACleanup
WSAStartup
gethostname
gethostbyname
inet_ntoa
getsockname
htons
bind
WSASocketA
getpeername
ntohs
htonl
listen
shutdown
WSAIoctl
WSARecv
WSASend
recvfrom
sendto
WSASetLastError
getsockopt
accept
ioctlsocket

winmm

PlaySoundA
timeGetTime
timeKillEvent
timeSetEvent
waveInReset
waveInStop
waveInStart
waveInAddBuffer
waveInUnprepareHeader
waveOutGetNumDevs
waveOutOpen
waveOutClose
waveInPrepareHeader
waveInClose
waveInOpen
waveInGetNumDevs
waveOutReset
waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader

wldap32

ord27
ord22
ord211
ord143
ord41
ord50
ord26
ord30
ord32
ord35
ord301
ord33
ord200
ord46
ord60
ord79

ofetapi

SetManualEncryptFile
SetCustomDataResident
SetOneFileOneKeyMode
SetDriverCryptConfig
GetStartFiltering
SetStartFiltering
CancelPolicy
SendPolicy

dbghelp

MiniDumpWriteDump

advapi32

UnlockServiceDatabase
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptHashData
CryptAcquireContextA
CryptCreateHash
GetFileSecurityA
SetFileSecurityA
RegEnumValueA
RegOpenKeyExW
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegSetValueA
RegQueryInfoKeyA
RegEnumKeyExA
QueryServiceConfigW
QueryServiceConfigA
EnumServicesStatusExW
OpenProcessToken
OpenServiceW
OpenSCManagerA
LockServiceDatabase
CreateServiceW
CloseServiceHandle
ChangeServiceConfigA
RegGetValueA
RegSetKeyValueA
GetUserNameW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
LookupPrivilegeValueA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges

psapi

GetProcessImageFileNameW
GetProcessImageFileNameA
GetModuleFileNameExA
EnumProcesses
EnumProcessModules

iphlpapi

GetAdaptersInfo

cfgmgr32

CM_Get_Device_IDA
CM_Get_Parent

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

gdiplus

GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipGetImageGraphicsContext
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipGetImageThumbnail
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdipFree

msimg32

TransparentBlt
AlphaBlend

uxtheme

DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetWindowTheme
GetThemePartSize
DrawThemeText

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

avicap32

capGetDriverDescriptionA

msvfw32

ICSeqCompressFrame
ICCompressorFree
ICOpen
ICClose
ICSendMessage
ICSeqCompressFrameStart
ICSeqCompressFrameEnd

version

GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoA
VerQueryValueA

pgdlltunnel

ord3
ord12
ord13
ord2
ord6
ord1
ord19
ord16

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetContext
ImmReleaseContext
ImmGetOpenStatus

oledlg

ord8

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 935KB - Virtual size: 934KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 110KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 322KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

880d0b14ad8c32a99558b139441ca89b

Code Sign

8b:3c:04:96:18:b9:7a:47:b7:1c:d9:d4:3b:99:0d:dfCertificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

8b:3c:04:96:18:b9:7a:47:b7:1c:d9:d4:3b:99:0d:dfCertificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

70:b3:3b:e4:5d:8f:4c:a3:69:77:02:6c:d0:75:be:d0:6d:d2:55:9e:38:a1:94:b0:44:72:b9:51:d3:31:6a:3aSigner

45:02:5d:2f:36:25:91:30:59:5e:70:92:be:15:fc:9a:bf:40:36:efSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

nfapi

protocolfilters

shlwapi

kernel32

user32

gdi32

winspool.drv

shell32

ole32

oleaut32

netapi32

ws2_32

winmm

wldap32

ofetapi

dbghelp

advapi32

psapi

iphlpapi

cfgmgr32

setupapi

gdiplus

msimg32

uxtheme

wininet

avicap32

msvfw32

version

pgdlltunnel

wtsapi32

oleacc

imm32

oledlg

Exports

Exports

Sections

.text Size: 5.2MB - Virtual size: 5.2MB

.rdata Size: 935KB - Virtual size: 934KB

.data Size: 110KB - Virtual size: 188KB

.tls Size: 2KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 496B

.reloc Size: 322KB - Virtual size: 321KB

8b:3c:04:96:18:b9:7a:47:b7:1c:d9:d4:3b:99:0d:df
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

8b:3c:04:96:18:b9:7a:47:b7:1c:d9:d4:3b:99:0d:df
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

70:b3:3b:e4:5d:8f:4c:a3:69:77:02:6c:d0:75:be:d0:6d:d2:55:9e:38:a1:94:b0:44:72:b9:51:d3:31:6a:3a
Signer

45:02:5d:2f:36:25:91:30:59:5e:70:92:be:15:fc:9a:bf:40:36:ef
Signer

.text
Size: 5.2MB - Virtual size: 5.2MB

.rdata
Size: 935KB - Virtual size: 934KB

.data
Size: 110KB - Virtual size: 188KB

.tls
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 496B

.reloc
Size: 322KB - Virtual size: 321KB