427a6ab581afbf3e72dff24cd280ee468d5610ac3e78be3d12b56260a53b4ef9

Sharing

Copy URL Twitter E-mail

General

Target

427a6ab581afbf3e72dff24cd280ee468d5610ac3e78be3d12b56260a53b4ef9
Size

2.1MB
MD5

f0e0e819938ed10d82f238545d407dba
SHA1

f30d09ee927f231e2733d0e25d19c59a345531a1
SHA256

427a6ab581afbf3e72dff24cd280ee468d5610ac3e78be3d12b56260a53b4ef9
SHA512

dc06f32d3060c70c9ec2bad6adc74efcfaae05e5eb4f33b39f1809c6bc56858be5b07599a12d046e719cced20f6b3bb3e032d6f6db800b2bcdb346aa95d4ebc4
SSDEEP

49152:A+RskJeDj8uyco57lQxxMw6HZ7ygCXI1V9pjXn7g:A+RrJeDt+lQEyuzT7g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
427a6ab581afbf3e72dff24cd280ee468d5610ac3e78be3d12b56260a53b4ef9

Files

427a6ab581afbf3e72dff24cd280ee468d5610ac3e78be3d12b56260a53b4ef9
.exe windows:4 windows x86 arch:x86

61259b55b8912888e90f516ca08dc514

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 180KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/03/2022, 00:00

Not After

07/03/2025, 23:59

Subject

CN=SweetLabs Inc,O=SweetLabs Inc,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2b:c6:51:36:86:23:02:c1:3a:97:86:7a:fb:16:ee:4c:9e:4a:a1:f4:d9:11:49:27:cc:e9:26:f1:14:65:36:79
Signer

Actual PE Digest

2b:c6:51:36:86:23:02:c1:3a:97:86:7a:fb:16:ee:4c:9e:4a:a1:f4:d9:11:49:27:cc:e9:26:f1:14:65:36:79

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

5e62e8e248e7364886b604bd1fcf4c13

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/03/2022, 00:00

Not After

07/03/2025, 23:59

Subject

CN=SweetLabs Inc,O=SweetLabs Inc,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

49:ea:7a:a0:68:e0:8a:fc:ab:62:45:2e:7a:d7:75:fe:96:be:3f:5d:1b:94:8a:3f:cb:6c:58:44:83:fb:2e:29
Signer

Actual PE Digest

49:ea:7a:a0:68:e0:8a:fc:ab:62:45:2e:7a:d7:75:fe:96:be:3f:5d:1b:94:8a:3f:cb:6c:58:44:83:fb:2e:29

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
GetUserNameW

kernel32

GlobalFree
GetVersion
GlobalAlloc
CloseHandle
GetModuleHandleA
GetLastError
GetCurrentProcess
GetCurrentThread
GetProcAddress
lstrcpynW

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 705B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/aetihlp.dll
.dll windows:6 windows x86 arch:x86

a6cec2d7fa105b6a937f5a89dfa2c253

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/03/2022, 00:00

Not After

07/03/2025, 23:59

Subject

CN=SweetLabs Inc,O=SweetLabs Inc,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:f6:37:83:be:25:1c:57:cf:60:da:ce:65:14:f8:5a:ef:6e:20:6e:7c:af:e4:64:85:23:4c:a8:fe:bd:89:8a
Signer

Actual PE Digest

6c:f6:37:83:be:25:1c:57:cf:60:da:ce:65:14:f8:5a:ef:6e:20:6e:7c:af:e4:64:85:23:4c:a8:fe:bd:89:8a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

aetihlp.pdb

Imports

comctl32

ord413
ord410
ord412

wldap32

ord79
ord35
ord33
ord32
ord27
ord30
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord143
ord200
ord301
ord26
ord217

normaliz

IdnToUnicode
IdnToAscii

ws2_32

htons
socket
getservbyport
select
WSACleanup
WSAStartup
ntohs
WSAGetLastError
recvfrom
WSASetLastError
closesocket
WSAWaitForMultipleEvents
WSAIoctl
WSAResetEvent
shutdown
getpeername
accept
bind
connect
getsockname
htonl
listen
recv
getaddrinfo
getservbyname
freeaddrinfo
sendto
gethostbyaddr
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
inet_ntoa
inet_addr
gethostbyname
setsockopt
gethostname
__WSAFDIsSet
ioctlsocket

netapi32

NetApiBufferFree
NetGetJoinInformation

kernel32

CreateFileW
GetFileSizeEx
ReadFile
SetFilePointer
SetEndOfFile
WriteFile
SetLastError
FindFirstFileW
GetFileAttributesW
DeleteFileW
FindNextFileW
FindClose
CreateProcessW
GetExitCodeProcess
Sleep
DecodePointer
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
MultiByteToWideChar
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
LoadLibraryA
MoveFileExA
WaitForSingleObjectEx
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
GetEnvironmentVariableW
GetConsoleMode
WaitForSingleObject
ReadConsoleA
ReadConsoleW
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
VirtualFree
GetACP
SwitchToFiber
DeleteFiber
CreateFiberEx
ConvertFiberToThread
ConvertThreadToFiberEx
LoadLibraryW
GetSystemTime
SystemTimeToFileTime
GetModuleHandleW
GetProcAddress
GetTickCount
Process32NextW
TerminateProcess
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
ProcessIdToSessionId
GetCurrentProcessId
SetEvent
CloseHandle
OpenEventW
CreateEventW
CreateEventA
LocalFree
FormatMessageA
LeaveCriticalSection
AreFileApisANSI
HeapCreate
GetDiskFreeSpaceW
LockFile
UnlockFileEx
CreateMutexW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
DeleteFileA
HeapCompact
UnlockFile
EnterCriticalSection
GetLastError
InitializeCriticalSectionEx
HeapDestroy
GetProcessHeap
SetConsoleMode
HeapFree
HeapReAlloc
HeapSize
FormatMessageW
WideCharToMultiByte
LockFileEx
CreateFileMappingW
MapViewOfFile
OutputDebugStringA
WriteConsoleW
GetCommandLineW
GetCommandLineA
FindNextFileA
FindFirstFileExA
GetOEMCP
IsValidCodePage
SetEnvironmentVariableA
GetTimeZoneInformation
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
GetModuleFileNameA
ExitProcess
SetConsoleCtrlHandler
SetFilePointerEx
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
GetDriveTypeW
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
OpenEventA
GetCPInfo
LCMapStringEx
EncodePointer
TryAcquireSRWLockExclusive
GetStringTypeW
RaiseException
IsDebuggerPresent
LoadLibraryExW
GetExitCodeThread
TerminateThread
CreateThread
TryEnterCriticalSection
InitializeCriticalSection
CreateMutexA
ReleaseMutex
QueryFullProcessImageNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileSize
LocalAlloc
CompareStringW
GlobalFree
ResetEvent
SetThreadLocale
GetThreadLocale
VirtualQuery
GetComputerNameW
GetSystemDirectoryW
GetVolumeInformationW
GetCurrentThread
OutputDebugStringW
SystemTimeToTzSpecificLocalTime
MoveFileExW
GetTempPathW
GetTempFileNameW
GetFileAttributesExW
FindFirstFileExW
CreateDirectoryW
ExpandEnvironmentStringsW
FindResourceW
SizeofResource
LockResource
LoadResource
FreeResource
GetModuleFileNameW
HeapAlloc
IsWow64Process
GetVersionExW
GetCurrentProcess
FileTimeToSystemTime
GetUserDefaultLCID
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
LCMapStringW
GetStringTypeExW
CreateHardLinkW
GetTickCount64
GetUserGeoID
GetGeoInfoW

user32

SetRect
SetWindowPos
GetDC
GetClientRect
SetWindowTextW
RedrawWindow
GetWindowTextW
SetTimer
SendMessageW
GetDlgItem
GetWindowRect
ScreenToClient
MoveWindow
SystemParametersInfoW
CopyRect
GetDesktopWindow
DestroyMenu
CreatePopupMenu
GetParent
wsprintfW
SetProcessDefaultLayout
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostMessageW
FindWindowW
GetWindowThreadProcessId
AllowSetForegroundWindow
LoadStringW
UpdateWindow
ShowWindow
GetDlgItemTextW
DrawTextExW
GetClassNameW
GetSysColor
SetParent
EnumChildWindows
LoadIconW
GetSystemMetrics
PeekMessageW
DispatchMessageW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
IsWindow

gdi32

SetBkMode
CreateSolidBrush
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateDIBSection
GetObjectW

advapi32

RegCloseKey
ReportEventW
CryptAcquireContextW
RegCreateKeyExW
GetUserNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCopyTreeW
RegFlushKey
ConvertSidToStringSidW
LookupAccountNameW
RegOpenKeyW
OpenThreadToken
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteTreeW
RegDeleteKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
CryptDestroyKey
RegDeleteValueW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
DeregisterEventSource
CryptSetHashParam
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
RegisterEventSourceW

ole32

PropVariantClear
CoTaskMemFree
CoInitializeEx
StringFromGUID2
CoUninitialize
CoInitializeSecurity
CoCreateInstance
CoCreateGuid

oleaut32

VariantCopy
SysAllocString
SysAllocStringLen
VariantClear
VariantInit
SysFreeString

gdiplus

GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipSetCompositingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipFlush
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdiplusStartup
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdiplusShutdown

bcrypt

BCryptGenRandom

msi

ord173
ord217

rpcrt4

RpcStringFreeW
UuidToStringW

wininet

DeleteUrlCacheEntryW
InternetQueryOptionW

winhttp

WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpOpen

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust

crypt32

CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertOpenStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertCloseStore
CertDuplicateCertificateContext

userenv

ExpandEnvironmentStringsForUserW

version

VerQueryValueW

shlwapi

SHRegDuplicateHKey
ord487
StrRetToBufW
ord176
PathFileExistsW

powrprof

GetPwrCapabilities

secur32

GetUserNameExW

shell32

SHBindToParent
SHGetDesktopFolder
SHGetKnownFolderPath
SHGetFolderPathW
SHFileOperationW
SHGetMalloc
ShellExecuteExW
SHCreateDirectoryExW

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 812KB - Virtual size: 812KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/unsettings.reg

Sharing

General

Malware Config

Signatures

Files

61259b55b8912888e90f516ca08dc514

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 180KB

.rsrc Size: 50KB - Virtual size: 50KB

fc0224e99e736751432961db63a41b76

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

2b:c6:51:36:86:23:02:c1:3a:97:86:7a:fb:16:ee:4c:9e:4a:a1:f4:d9:11:49:27:cc:e9:26:f1:14:65:36:79Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 120B

.reloc Size: 1024B - Virtual size: 662B

5e62e8e248e7364886b604bd1fcf4c13

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

49:ea:7a:a0:68:e0:8a:fc:ab:62:45:2e:7a:d7:75:fe:96:be:3f:5d:1b:94:8a:3f:cb:6c:58:44:83:fb:2e:29Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 714B

.rdata Size: 1024B - Virtual size: 705B

.data Size: 512B - Virtual size: 104B

.reloc Size: 512B - Virtual size: 240B

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 180KB

.rsrc
Size: 50KB - Virtual size: 50KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

2b:c6:51:36:86:23:02:c1:3a:97:86:7a:fb:16:ee:4c:9e:4a:a1:f4:d9:11:49:27:cc:e9:26:f1:14:65:36:79
Signer

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 662B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

49:ea:7a:a0:68:e0:8a:fc:ab:62:45:2e:7a:d7:75:fe:96:be:3f:5d:1b:94:8a:3f:cb:6c:58:44:83:fb:2e:29
Signer

.text
Size: 1024B - Virtual size: 714B

.rdata
Size: 1024B - Virtual size: 705B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 512B - Virtual size: 240B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:48:70:1f:4a:cd:4f:4b:5b:41:3c:bd:2a:73:fa:20
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

6c:f6:37:83:be:25:1c:57:cf:60:da:ce:65:14:f8:5a:ef:6e:20:6e:7c:af:e4:64:85:23:4c:a8:fe:bd:89:8a
Signer

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 812KB - Virtual size: 812KB

.data
Size: 35KB - Virtual size: 55KB

.rsrc
Size: 336KB - Virtual size: 335KB

.reloc
Size: 163KB - Virtual size: 163KB