0[.]285[.]0[.]48900[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0.285.0.48900.exe
Size

16.1MB
MD5

26fd9102575b235eeb91798a9efdfffd
SHA1

3599f15470952681b4e6cc43f4e9c565262b1065
SHA256

bfbd6ddc03abbc2ac70abefe9a5a8a9552fa54b79263fcb8d1e852a3e27876e9
SHA512

52a613fc1f7771dba611e0d374e9c0cc3842a80cfaa6ab35a8f2c1ef8b01d83cdba122596f2d21bcd4454d167db96665133527f11b689bf1ea31912f5d4fd35b
SSDEEP

196608:gWHdE3nU1KfoQhJ4DnOmb+gW0EVtMIjugzQA/D1whRA6RM00QT9616QJp5cZcI:99E3UKheEPMIiiQA/DGT2QkYQJs

Score

1^/10

Malware Config

Signatures

Files

0.285.0.48900.exe
.exe windows:5 windows x86 arch:x86

db47f99f5718aef8f674f96a7377be87

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

69:4e:21:5b:8d:f6:f1:77:f5:00:12:fe:bd:09:bd:a6
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

11/10/2016, 00:00

Not After

11/10/2019, 23:59

Subject

CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e1:16:bf:16:50:8a:f3:74:e5:67:87:5c:78:78:ce:2f:2c:11:ac:8d
Signer

Actual PE Digest

e1:16:bf:16:50:8a:f3:74:e5:67:87:5c:78:78:ce:2f:2c:11:ac:8d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\BuildAgent\work\Trunk2012\build.msvc\Win32\RCCService-Release\RCCService\RCCService.pdb

Imports

kernel32

QueueUserWorkItem
GetGeoInfoA
GetUserGeoID
SetConsoleTextAttribute
SetConsoleCtrlHandler
InterlockedIncrement
GetShortPathNameW
GetModuleFileNameW
GetVersionExA
IsWow64Process
SetLastError
FormatMessageA
GetModuleFileNameA
GetStdHandle
WaitForSingleObject
DebugBreak
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
WriteProcessMemory
GetCurrentProcess
GetProcessHeap
MultiByteToWideChar
FindNextFileA
FindFirstFileA
CreateFileA
CompareFileTime
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
WriteFile
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WideCharToMultiByte
MoveFileA
DeleteFileA
FindResourceExW
FindResourceW
SizeofResource
LoadResource
LockResource
GetCurrentThreadId
VirtualProtect
GetProcAddress
HeapFree
ReplaceFileW
SetEnvironmentVariableA
GetEnvironmentVariableA
CreateMutexA
LoadLibraryExA
SearchPathW
LoadLibraryW
OpenEventW
GetTempPathA
SetThreadContext
GetTickCount
Sleep
CreateSemaphoreA
ReleaseSemaphore
DuplicateHandle
GlobalMemoryStatusEx
GetProcessHeaps
HeapSetInformation
VirtualQuery
GlobalLock
GlobalUnlock
ReleaseMutex
VerSetConditionMask
FreeLibrary
GetVersion
SleepEx
LoadLibraryA
ExpandEnvironmentStringsA
VerifyVersionInfoA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
GetSystemInfo
OpenProcess
LocalFree
WaitForMultipleObjectsEx
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateWaitableTimerA
SetWaitableTimer
DeviceIoControl
FindClose
GetFileTime
SetFileTime
GetTempPathW
GetComputerNameA
HeapAlloc
GetCurrentDirectoryW
GetDiskFreeSpaceExW
CreateDirectoryW
RemoveDirectoryW
GetFullPathNameW
CreateFileW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileExW
SetUnhandledExceptionFilter
CreateProcessA
GetProcessAffinityMask
GetCurrentThread
GetLocalTime
GetThreadContext
FreeConsole
SetThreadPriority
InterlockedDecrement
HeapDestroy
HeapReAlloc
HeapSize
EncodePointer
DecodePointer
IsProcessorFeaturePresent
IsDebuggerPresent
GetLastError
GetModuleHandleA
ResetEvent
GetCurrentProcessId
WaitForSingleObjectEx
OpenEventA
SetEvent
CloseHandle
CreateEventA
GetModuleHandleExA
InitializeCriticalSectionAndSpinCount
CreateThread
GetSystemTimeAsFileTime

user32

SendMessageA
CreateWindowExA
RegisterClassA
PostQuitMessage
DefWindowProcA
GetDC
GetWindowTextA
EnumWindows
GetClassNameA
GetWindowThreadProcessId
GetWindowInfo
MessageBoxA
DestroyWindow
GetClientRect
GetWindowLongA
EnumDisplayDevicesA
PostMessageA
GetAsyncKeyState
GetClipboardData
CloseClipboard
OpenClipboard

advapi32

CryptVerifySignatureA
CryptImportKey
CryptGenRandom
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
StartServiceA
StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
ChangeServiceConfig2A
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
ReportEventA
RegisterEventSourceA
DeregisterEventSource

ole32

StringFromGUID2
CoCreateGuid
CoInitialize
CoUninitialize
CoCreateInstance

shlwapi

PathAddBackslashA
PathStripPathA
PathRemoveFileSpecA
PathFileExistsA
PathAppendA
PathIsRelativeA

dbghelp

MiniDumpWriteDump

msvcp110

??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?is@?$ctype@D@std@@QBE_NFD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?id@?$ctype@D@std@@2V0locale@2@A
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?classic@locale@std@@SAABV12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?fail@ios_base@std@@QBE_NXZ
?exceptions@ios_base@std@@QAEXH@Z
?setf@ios_base@std@@QAEHHH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?toupper@?$ctype@D@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
_Inf
_Nan
_FInf
_FNan
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??Bios_base@std@@QBEPAXXZ
?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?setf@ios_base@std@@QAEHH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??7ios_base@std@@QBE_NXZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
_FDtest
?eof@ios_base@std@@QBE_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
_Xtime_get_ticks
_Mtx_init
_Mtx_destroy
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
??0?$codecvt@_WDH@std@@QAE@I@Z
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??_7_Facet_base@std@@6B@
??_7facet@locale@std@@6B@
??_7codecvt_base@std@@6B@
?id@?$codecvt@_WDH@std@@2V0locale@2@A
??_7?$codecvt@_WDH@std@@6B@
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0_Container_base12@std@@QAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UAEXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?_Add_vtordisp1@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?uncaught_exception@std@@YA_NXZ
?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UAEXXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?good@ios_base@std@@QBE_NXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?_Xbad_alloc@std@@YAXXZ

msvcr110

ldexp
modf
__iob_func
strcoll
strcspn
strerror
strpbrk
feof
ferror
fputs
fread
freopen
getc
isalpha
isupper
islower
isxdigit
isalnum
iscntrl
frexp
localeconv
_CIcosh
_CIfmod
_CIsinh
_CItanh
__libm_sse2_acos
__libm_sse2_asin
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_cos
__libm_sse2_exp
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_sin
__libm_sse2_tan
_HUGE
__RTtypeid
abort
?before@type_info@@QBE_NABV1@@Z
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
??0bad_typeid@std@@QAE@ABV01@@Z
??1bad_typeid@std@@UAE@XZ
atof
strtok
sprintf_s
_wcsnicmp
__libm_sse2_acosf
__libm_sse2_atanf
__libm_sse2_sinf
__libm_sse2_tanf
__libm_sse2_cosf
__libm_sse2_asinf
calloc
__libm_sse2_expf
__libm_sse2_powf
__libm_sse2_logf
_difftime64
_aligned_free
_aligned_malloc
_wfopen
fseek
ftell
_mbschr
_mbsnbcpy
fgets
_stat64
__sys_nerr
qsort
getenv
_strtoi64
_beginthreadex
_stricmp
vsprintf
?terminate@@YAXXZ
__libm_sse2_log10f
?_GetConcurrency@details@Concurrency@@YAIXZ
_wassert
_vsnprintf
_exit
_strtoui64
_strnicmp
iswspace
__CxxLongjmpUnwind
clock
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_vsnprintf_s
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
realloc
exit
_wstat64i32
_wchdir
_wgetcwd
_finite
_wfopen_s
_wfsopen
_vswprintf_c_l
_strdup
_write
_read
_errno
_setmode
_mktime64
_localtime64
_gmtime64
strftime
_ftime64
_isnan
strstr
strrchr
strncat
strchr
sprintf
_snprintf
sscanf
fprintf
fopen
wctomb
strtoul
strtol
strtod
rand
mbtowc
atol
___mb_cur_max_func
ispunct
ceil
_setjmp3
longjmp
tolower
isspace
isdigit
srand
_kbhit
_getch
??0exception@std@@QAE@XZ
_mbsnicmp
_mbsicmp
atoi
strncmp
_except_handler3
_vscprintf
vsprintf_s
strncpy
malloc
_set_purecall_handler
_mkdir
memmove_s
strnlen
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
_unlock_file
_lock_file
ungetc
setvbuf
printf
fwrite
_fseeki64
fsetpos
fputc
fgetpos
fgetc
fflush
fclose
memcpy_s
__RTDynamicCast
_time64
memchr
memset
memcpy
__libm_sse2_pow
__CxxFrameHandler3
??8type_info@@QBE_NABV0@@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABQBD@Z
memmove
??_V@YAXPAX@Z
free
??2@YAPAXI@Z
_purecall
??3@YAXPAX@Z
toupper
_CxxThrowException

version

VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoW

wsock32

WSASetLastError
inet_addr
gethostname
gethostbyname
socket
WSAStartup
setsockopt
sendto
send
select
recvfrom
recv
ntohs
ntohl
WSACleanup
WSAGetLastError
getpeername
shutdown
getsockname
__WSAFDIsSet
accept
listen
ioctlsocket
htons
htonl
getsockopt
inet_ntoa
connect
closesocket
bind

vmprotectsdk32

VMProtectIsDebuggerPresent
VMProtectBeginVirtualization
VMProtectEnd
VMProtectBeginMutation

psapi

GetProcessMemoryInfo
GetModuleBaseNameA
GetModuleInformation

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
timeSetEvent

ws2_32

getnameinfo
WSAIoctl
freeaddrinfo
getaddrinfo

fmod

?removeDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@@Z
?getNumDSPs@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
FMOD_Memory_GetStats
?getDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVDSP@2@@Z
?getMode@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?setParameterFloat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
FMOD_System_Create
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?getNumDrivers@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getDriverInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@HPADHPAUFMOD_GUID@@PAHPAW4FMOD_SPEAKERMODE@@2@Z
?setDriver@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?getDriver@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?setSoftwareFormat@System@FMOD@@QAG?AW4FMOD_RESULT@@HW4FMOD_SPEAKERMODE@@H@Z
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?set3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?set3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z
?getVersion@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getChannelsPlaying@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH0@Z
?getCPUUsage@System@FMOD@@QAG?AW4FMOD_RESULT@@PAM0000@Z
?createDSPByType@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PAPAVDSP@2@@Z
?createChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAPAVChannelGroup@2@@Z
?setReverbProperties@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_REVERB_PROPERTIES@@@Z
?getSystemObject@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSystem@2@@Z
?setVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?getVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?setMute@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?set3DAttributes@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@00@Z
?set3DMinMaxDistance@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?setFrequency@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?getMute@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?addDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HPAVDSP@2@@Z
?addGroup@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@_NPAPAVDSPConnection@2@@Z
?release@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setBypass@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setMode@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?getParameterFloat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAMPADH@Z
FMOD_Sound_Release
FMOD_Sound_GetUserData
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PAVSound@2@PAVChannelGroup@2@_NPAPAVChannel@2@@Z
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAMPAH@Z
?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?getOpenState@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_OPENSTATE@@PAIPA_N2@Z
?stop@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setPaused@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?getPaused@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?setUserData@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?unlock@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAX0II@Z
?lock@Sound@FMOD@@QAG?AW4FMOD_RESULT@@IIPAPAX0PAI1@Z
?isRecording@System@FMOD@@QAG?AW4FMOD_RESULT@@HPA_N@Z
?recordStart@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAVSound@2@_N@Z
?getRecordPosition@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAI@Z
?getRecordDriverInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@HPADHPAUFMOD_GUID@@PAHPAW4FMOD_SPEAKERMODE@@2PAI@Z
?getRecordNumDrivers@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH0@Z
?getMeteringInfo@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_DSP_METERING_INFO@@0@Z
?getMeteringEnabled@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PA_N0@Z
?setMeteringEnabled@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N0@Z
?setParameterData@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAXI@Z
?disconnectFrom@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@PAVDSPConnection@2@@Z
?addInput@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@PAPAVDSPConnection@2@W4FMOD_DSPCONNECTION_TYPE@@@Z
?release@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getCurrentSound@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSound@2@@Z
?setLoopCount@Channel@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setChannelGroup@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAVChannelGroup@2@@Z
?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?setPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@II@Z

shell32

SHGetFolderPathAndSubDirW
SHGetFolderPathW

gdi32

SwapBuffers
ChoosePixelFormat
SetPixelFormat

opengl32

wglDeleteContext
wglCreateContext
glReadPixels
glTexSubImage2D
glTexParameteri
glTexParameterf
glTexImage2D
glPixelStorei
glGetTexImage
glGenTextures
glDeleteTextures
glDrawElements
glDrawArrays
glViewport
glStencilOp
glStencilMask
glStencilFunc
wglGetCurrentContext
glPolygonOffset
glEnable
glDisable
glDepthMask
glDepthFunc
glCullFace
glCopyTexSubImage2D
glColorMask
glClearStencil
glClearDepth
glClearColor
glClear
glBlendFunc
glBindTexture
glGetString
glGetIntegerv
wglMakeCurrent
wglGetCurrentDC
wglGetProcAddress
glReadBuffer

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 10.9MB - Virtual size: 10.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lua
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db47f99f5718aef8f674f96a7377be87

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

69:4e:21:5b:8d:f6:f1:77:f5:00:12:fe:bd:09:bd:a6Certificate

Extended Key Usages

Key Usages

e1:16:bf:16:50:8a:f3:74:e5:67:87:5c:78:78:ce:2f:2c:11:ac:8dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

shlwapi

dbghelp

msvcp110

msvcr110

version

wsock32

vmprotectsdk32

psapi

winmm

ws2_32

fmod

shell32

gdi32

opengl32

Exports

Exports

Sections

.text Size: 10.9MB - Virtual size: 10.9MB

.rdata Size: 2.7MB - Virtual size: 2.7MB

.data Size: 1.1MB - Virtual size: 6.1MB

.lua Size: 158KB - Virtual size: 158KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 1.3MB - Virtual size: 1.3MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

69:4e:21:5b:8d:f6:f1:77:f5:00:12:fe:bd:09:bd:a6
Certificate

e1:16:bf:16:50:8a:f3:74:e5:67:87:5c:78:78:ce:2f:2c:11:ac:8d
Signer

.text
Size: 10.9MB - Virtual size: 10.9MB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 1.1MB - Virtual size: 6.1MB

.lua
Size: 158KB - Virtual size: 158KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1.3MB - Virtual size: 1.3MB