FREAKY STOP[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

FREAKY STOP.zip
Size

1.0MB
MD5

97cc7043d4f1ee54c809091b5717b046
SHA1

ed10677f86b97d8437c33440fd778cc2b6d22884
SHA256

99996f2e22c28142ce7a9d9a2d33584178677d99afe5d34e04c5a3c4c127136a
SHA512

c429c204f9a2786eb645961cf83554733a4b28939c974990957186fd0a2cd499f9b705e4a6e37d53d81ebd13f78cbe9e60d423ef9d4828439ff082cecade4480
SSDEEP

24576:ySxiAT+IXBbaR/7jVWRDZPbqGGNrJyK4BdqmWSsGM5G5BsT6VnN:dNTT6/7jkRoG0thYFWSsGM4BhnN

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/FREAKY STOP/FREAKY STOP/FREAKY STOP.exe
unpack001/FREAKY STOP/FREAKY STOP/WinDivert.dll
unpack001/FREAKY STOP/FREAKY STOP/iup.dll

Files

FREAKY STOP.zip
.zip

Password: infected
FREAKY STOP/FREAKY STOP/FREAKY STOP.exe
.exe windows:6 windows x64 arch:x64

Password: infected

488fa4c9c47d4386469ccb56e744c865

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\cgod\Desktop\freakstop\bin\vs\Release\x64\clumsy.pdb

Imports

windivert

WinDivertClose
WinDivertHelperCalcChecksums
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertSend
WinDivertSetParam

iup

IupDestroy
IupAppend
IupGetChild
IupShowXY
IupGetAttribute
IupGetInt
IupGetGlobal
IupSetHandle
IupFill
IupVbox
IupFrame
IupImage
IupMainLoop
IupDialog
IupList
IupTimer
IupTabs
IupToggle
IupText
IupLabel
IupHbox
IupSetCallback
IupSetAttribute
IupFlush
IupStoreAttribute
IupGetFloat
IupClose
IupButton
IupStoreGlobal
IupOpen
IupGetCallback

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime

kernel32

GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ReleaseMutex
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
UnhandledExceptionFilter
WaitForSingleObject
GetModuleHandleA
IsWow64Process
VerifyVersionInfoW
GetModuleFileNameA
GetCurrentProcess
VerSetConditionMask
GetTickCount
CreateThread
WaitForMultipleObjects
Sleep
CreateMutexA
GetLastError

user32

LoadIconA
SendMessageA
MessageBoxA

advapi32

CheckTokenMembership
AllocateAndInitializeSid
FreeSid

shell32

ShellExecuteExA

vcruntime140

strrchr
__C_specific_handler
memset
memcpy
__current_exception_context
__current_exception
strchr

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
free

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vsprintf
__acrt_iob_func
fopen
fread
__stdio_common_vfprintf
__p__commode

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
terminate
_crt_atexit
_exit
_c_exit
_cexit
__p___argv
_set_app_type
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initterm
_initterm_e
__p___argc
exit

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

isspace

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FREAKY STOP/FREAKY STOP/WinDivert.dll
.dll windows:4 windows x64 arch:x64

Password: infected

0b649f8e17494bb31b47f6e959a1769c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

CloseServiceHandle
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegSetValueExW
StartServiceW

kernel32

CloseHandle
CreateEventW
CreateFileW
CreateMutexW
DeviceIoControl
GetLastError
GetModuleFileNameW
GetOverlappedResult
HeapAlloc
HeapCreate
HeapDestroy
ReleaseMutex
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject

Exports

Exports

WinDivertClose
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperCompileFilter
WinDivertHelperDecrementTTL
WinDivertHelperEvalFilter
WinDivertHelperFormatFilter
WinDivertHelperFormatIPv4Address
WinDivertHelperFormatIPv6Address
WinDivertHelperHashPacket
WinDivertHelperHtonIPv6Address
WinDivertHelperHtonIpv6Address
WinDivertHelperHtonl
WinDivertHelperHtonll
WinDivertHelperHtons
WinDivertHelperNtohIPv6Address
WinDivertHelperNtohIpv6Address
WinDivertHelperNtohl
WinDivertHelperNtohll
WinDivertHelperNtohs
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam
WinDivertShutdown

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FREAKY STOP/FREAKY STOP/WinDivert64.sys
.sys windows:10 windows x64 arch:x64

505c54af7fa8f0482014ca4fe5cdd53d

Code Sign

f4:8b:a9:cb:78:dd:96:f2:dc:60:2f:ef:35:68:c9:2a
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/10/2017, 00:00

Not After

12/10/2020, 23:59

Subject

SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

01/08/2030, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:31:94:79:a3:18:f5:52:2d:06:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2019, 18:34

Not After

03/06/2020, 18:34

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e
Signer

Actual PE Digest

22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e

Digest Algorithm

sha256

PE Digest Matches

true

22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e
Signer

Actual PE Digest

22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\WinDivert\install\MSVC\amd64\WinDivert64.pdb

Imports

ntoskrnl.exe

ExFreePoolWithTag
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAllocateErrorLogEntry
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
IoWriteErrorLogEntry
RtlCopyUnicodeString
ObfReferenceObject
ObfDereferenceObject
KeBugCheckEx
IoGetRequestorProcess
PsGetProcessId
ExUuidCreate
ExAllocatePoolWithTag
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
RtlGetVersion
RtlIntegerToUnicodeString

hal

KeQueryPerformanceCounter

ndis.sys

NdisAllocateNetBufferPool
NdisFreeNetBufferPool
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart

fwpkclnt.sys

FwpsAllocateNetBufferAndNetBufferList0
FwpmFilterDeleteByKey0
FwpmFilterAdd0
FwpmCalloutDeleteByKey0
FwpmCalloutAdd0
FwpmSubLayerDeleteByKey0
FwpmSubLayerAdd0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmEngineOpen0
FwpsQueryPacketInjectionState0
FwpsInjectNetworkReceiveAsync0
FwpsInjectForwardAsync0
FwpsInjectNetworkSendAsync0
FwpsCalloutRegister0
FwpsCalloutUnregisterByKey0
FwpsFlowAssociateContext0
FwpsFlowRemoveContext0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsFreeNetBufferList0

wdfldr.sys

WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionUnbind

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FREAKY STOP/FREAKY STOP/config.txt
FREAKY STOP/FREAKY STOP/freakyhotkey.ahk
.js
FREAKY STOP/FREAKY STOP/iup.dll
.dll windows:6 windows x64 arch:x64

Password: infected

ec0e84b9057fcbcd6a8bb53072d22e2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetSystemInfo
GetCPInfoExA
GetVersionExA
LoadLibraryExW
GetSystemDirectoryW
SetLastError
FindResourceW
LoadResource
LockResource
RtlLookupFunctionEntry
SizeofResource
GetLocalTime
ReadFile
CreateFileW
WriteFile
lstrcpyW
GlobalSize
GetFileAttributesW
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GetTickCount
GetComputerNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
OutputDebugStringW
GetVersionExW
GetSystemDefaultUILanguage
GetModuleHandleW
WideCharToMultiByte
lstrcpynW
LocalFree
GetProcAddress
GetLastError
FormatMessageW
GetCurrentThreadId
CreateMutexW
GetModuleFileNameW
lstrlenW
GetCommandLineW
CompareStringW
GetCPInfoExW
MulDiv
MultiByteToWideChar
FreeLibrary
LoadLibraryW
Sleep
SwitchToThread
CreateThread
CloseHandle
GetCurrentThread
ExitThread
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetTempFileNameA
GetTempPathA
RtlCaptureContext

user32

ShowScrollBar
SetScrollInfo
DrawEdge
InflateRect
GetActiveWindow
MapWindowPoints
DragDetect
GetClipboardFormatNameW
RegisterClipboardFormatW
SetRect
DrawFrameControl
DrawTextW
FrameRect
IsClipboardFormatAvailable
SetClipboardData
GetClipboardData
GetForegroundWindow
EmptyClipboard
CloseClipboard
OpenClipboard
GetCaretPos
GetFocus
CreateMenu
EnableMenuItem
GetMenuInfo
CheckMenuItem
RemoveMenu
DrawMenuBar
DestroyMenu
SetMenu
SetMenuInfo
SetMenuItemInfoW
IsMenu
GetSubMenu
TrackPopupMenu
SetMenuItemBitmaps
CreatePopupMenu
InsertMenuItemW
CheckMenuRadioItem
GetMenuState
GetMenuItemInfoW
PtInRect
GetComboBoxInfo
ShowCursor
MonitorFromWindow
SetWindowRgn
FillRect
EndDialog
UnregisterClassW
DefFrameProcW
GetWindowInfo
GetScrollInfo
RegisterClassW
DefMDIChildProcW
LockWindowUpdate
SetLayeredWindowAttributes
SetCapture
IsZoomed
GetDlgItem
UpdateLayeredWindow
ReleaseCapture
LoadImageW
InvalidateRect
IsIconic
BeginPaint
EndPaint
GetWindowRect
GetAsyncKeyState
GetDesktopWindow
GetCursorPos
GetClientRect
MessageBoxW
GetSysColor
GetMessageW
PostMessageW
DispatchMessageW
PeekMessageW
TranslateMessage
PostThreadMessageW
PostQuitMessage
GetKeyState
VkKeyScanA
GetKeyboardLayout
MapVirtualKeyA
GetClassNameA
EnumDisplayMonitors
CallNextHookEx
UnhookWindowsHookEx
EnumWindows
DisableProcessWindowsGhosting
SetWindowsHookExW
SystemParametersInfoA
SetForegroundWindow
SetFocus
SystemParametersInfoW
GetWindowLongW
GetWindowTextLengthW
DefWindowProcW
GetMessageExtraInfo
CallWindowProcW
MapVirtualKeyW
DestroyWindow
GetDC
GetScrollBarInfo
EnableScrollBar
SetScrollPos
GetCapture
DestroyCursor
GetMenuItemID
CreateIconIndirect
SetTimer
KillTimer
MessageBoxIndirectW
CreateMDIWindowW
GetMonitorInfoW
IsWindowVisible
SetWindowPos
SetWindowLongPtrW
CreateWindowExW
ScreenToClient
SendMessageW
GetSystemMetrics
SetWindowTextW
ChildWindowFromPointEx
GetWindowLongPtrW
ShowWindow
GetClassInfoW
RedrawWindow
ClientToScreen
TrackMouseEvent
DrawFocusRect
IsWindowEnabled
LoadCursorW
SetParent
SetCursor
SetWindowLongW
GetParent
RegisterWindowMessageW
SetCursorPos
ReleaseDC
SendInput
EnableWindow
GetWindowTextW
GetWindow
DestroyIcon

gdi32

BitBlt
GetMetaFileBitsEx
GetEnhMetaFileBits
SetBkColor
CreateFontIndirectW
CreateRectRgnIndirect
PatBlt
Polygon
ExtCreatePen
EndPath
CreateCompatibleBitmap
SelectClipRgn
BeginPath
SetGraphicsMode
FillPath
Arc
Pie
ModifyWorldTransform
SetViewportOrgEx
SetLayout
GetLayout
StretchBlt
TextOutW
SetTextColor
SetPixelV
ExcludeClipRect
SetTextAlign
CreateDIBSection
GetObjectW
CreateBitmap
GetObjectType
SetBkMode
CreateCompatibleDC
GetStockObject
CreatePatternBrush
CreateRectRgn
DeleteDC
SetDCBrushColor
CombineRgn
SelectObject
CreateFontW
GetTextMetricsW
GetTextExtentPoint32W
DeleteObject
CreateSolidBrush
GetDeviceCaps
Polyline

comdlg32

GetSaveFileNameW
ChooseFontW
GetOpenFileNameW

advapi32

ReportEventW
GetUserNameW
DeregisterEventSource
RegisterEventSourceW

shell32

ShellExecuteExW
ShellExecuteW
ord74
DragFinish
DragAcceptFiles
DragQueryPoint
DragQueryFileW
SHGetPathFromIDListW
SHBrowseForFolderW
Shell_NotifyIconW
SHGetFolderPathW

ole32

ReleaseStgMedium
CoCreateInstance
CoUninitialize
DoDragDrop
OleUninitialize
OleInitialize
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoInitializeEx

comctl32

ord13
ord14
ImageList_BeginDrag
ImageList_DragMove
ImageList_Create
ImageList_DragShowNolock
ImageList_DragLeave
ImageList_EndDrag
ImageList_GetIconSize
InitCommonControlsEx
ImageList_Destroy
ImageList_GetImageCount
ImageList_Draw
ImageList_DragEnter
ImageList_GetImageInfo
ImageList_Add

vcruntime140

__C_specific_handler
__std_type_info_destroy_list
memset
__intrinsic_setjmp
memmove
strstr
strchr
longjmp
memcpy

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc
realloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
fseek
fwrite
fread
feof
__stdio_common_vsscanf
fopen
fclose
getc
ungetc
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfscanf
ferror

api-ms-win-crt-string-l1-1-0

wcsncpy
strtok
strcspn
strncpy
strncmp
isalpha
isdigit
toupper
tolower
isalnum

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-locale-l1-1-0

localeconv
setlocale

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_cexit
_execute_onexit_table
_initterm
_initterm_e
_seh_filter_dll
_initialize_narrow_environment
_initialize_onexit_table

api-ms-win-crt-math-l1-1-0

fmod
acos
atan2
cosf
sqrt
sinf
sin
cos
ceil

Exports

Exports

IupAlarm
IupAnimatedLabel
IupAppend
IupBackgroundBox
IupButton
IupCalendar
IupCanvas
IupCbox
IupCboxV
IupCboxv
IupClassInfoDialog
IupClassMatch
IupClipboard
IupClose
IupColorBrowser
IupColorDlg
IupColorbar
IupConfig
IupConfigCopy
IupConfigDialogClosed
IupConfigDialogShow
IupConfigGetVariableDouble
IupConfigGetVariableDoubleDef
IupConfigGetVariableDoubleId
IupConfigGetVariableDoubleIdDef
IupConfigGetVariableInt
IupConfigGetVariableIntDef
IupConfigGetVariableIntId
IupConfigGetVariableIntIdDef
IupConfigGetVariableStr
IupConfigGetVariableStrDef
IupConfigGetVariableStrId
IupConfigGetVariableStrIdDef
IupConfigLoad
IupConfigRecentInit
IupConfigRecentUpdate
IupConfigSave
IupConfigSetListVariable
IupConfigSetVariableDouble
IupConfigSetVariableDoubleId
IupConfigSetVariableInt
IupConfigSetVariableIntId
IupConfigSetVariableStr
IupConfigSetVariableStrId
IupConvertXYToPos
IupCopyAttributes
IupCopyClassAttributes
IupCreate
IupCreateV
IupCreatep
IupCreatev
IupDatePick
IupDestroy
IupDetach
IupDetachBox
IupDial
IupDialog
IupDrawArc
IupDrawBegin
IupDrawEnd
IupDrawFocusRect
IupDrawGetClipRect
IupDrawGetImageInfo
IupDrawGetSize
IupDrawGetTextSize
IupDrawImage
IupDrawLine
IupDrawParentBackground
IupDrawPolygon
IupDrawRectangle
IupDrawResetClip
IupDrawSelectRect
IupDrawSetClipRect
IupDrawText
IupDropButton
IupElementPropertiesDialog
IupExecute
IupExecuteWait
IupExitLoop
IupExpander
IupFileDlg
IupFill
IupFlatButton
IupFlatFrame
IupFlatLabel
IupFlatList
IupFlatScrollBox
IupFlatSeparator
IupFlatTabs
IupFlatTabsV
IupFlatTabsv
IupFlatToggle
IupFlatTree
IupFlatVal
IupFlush
IupFontDlg
IupFrame
IupGauge
IupGetAllAttributes
IupGetAllClasses
IupGetAllDialogs
IupGetAllNames
IupGetAttribute
IupGetAttributeHandle
IupGetAttributeHandleId
IupGetAttributeHandleId2
IupGetAttributeId
IupGetAttributeId2
IupGetAttributes
IupGetBrother
IupGetCallback
IupGetChild
IupGetChildCount
IupGetChildPos
IupGetClassAttributes
IupGetClassCallbacks
IupGetClassName
IupGetClassType
IupGetColor
IupGetDialog
IupGetDialogChild
IupGetDouble
IupGetDoubleId
IupGetDoubleId2
IupGetFile
IupGetFloat
IupGetFloatId
IupGetFloatId2
IupGetFocus
IupGetFunction
IupGetGlobal
IupGetHandle
IupGetInt
IupGetInt2
IupGetIntId
IupGetIntId2
IupGetIntInt
IupGetLanguage
IupGetLanguageString
IupGetName
IupGetNextChild
IupGetParam
IupGetParamV
IupGetParamv
IupGetParent
IupGetRGB
IupGetRGBA
IupGetRGBId
IupGetRGBId2
IupGetText
IupGlobalsDialog
IupGridBox
IupGridBoxV
IupGridBoxv
IupHbox
IupHboxV
IupHboxv
IupHelp
IupHide
IupImage
IupImageGetHandle
IupImageRGB
IupImageRGBA
IupInsert
IupIsOpened
IupItem
IupLabel
IupLayoutDialog
IupLink
IupList
IupListDialog
IupLoad
IupLoadBuffer
IupLog
IupLogV
IupLoopStep
IupLoopStepWait
IupMainLoop
IupMainLoopLevel
IupMap
IupMenu
IupMenuV
IupMenuv
IupMessage
IupMessageAlarm
IupMessageDlg
IupMessageError
IupMessageV
IupMessagef
IupMultiBox
IupMultiBoxV
IupMultiBoxv
IupMultiLine
IupNextField
IupNormalizer
IupNormalizerV
IupNormalizerv
IupOpen
IupParam
IupParamBox
IupParamBoxV
IupParamBoxv
IupPlayInput
IupPopup
IupPostMessage
IupPreviousField
IupProgressBar
IupProgressDlg
IupRadio
IupRecordInput
IupRedraw
IupRefresh
IupRefreshChildren
IupReparent
IupResetAttribute
IupSaveClassAttributes
IupSaveImageAsText
IupSbox
IupScanf
IupScrollBox
IupSeparator
IupSetAtt
IupSetAttV
IupSetAttribute
IupSetAttributeHandle
IupSetAttributeHandleId
IupSetAttributeHandleId2
IupSetAttributeId
IupSetAttributeId2
IupSetAttributes
IupSetCallback
IupSetCallbacks
IupSetCallbacksV
IupSetClassDefaultAttribute
IupSetDouble
IupSetDoubleId
IupSetDoubleId2
IupSetFloat
IupSetFloatId
IupSetFloatId2
IupSetFocus
IupSetFunction
IupSetGlobal
IupSetHandle
IupSetInt
IupSetIntId
IupSetIntId2
IupSetLanguage
IupSetLanguagePack
IupSetLanguageString
IupSetRGB
IupSetRGBA
IupSetRGBId
IupSetRGBId2
IupSetStrAttribute
IupSetStrAttributeId
IupSetStrAttributeId2
IupSetStrGlobal
IupSetStrf
IupSetStrfId
IupSetStrfId2
IupSetStrfId2V
IupSetStrfIdV
IupSetStrfV
IupSetfAttribute
IupSetfAttributeId
IupSetfAttributeId2
IupShow
IupShowXY
IupSpace
IupSpin
IupSpinbox
IupSplit
IupStoreAttribute
IupStoreAttributeId
IupStoreAttributeId2
IupStoreGlobal
IupStoreLanguageString
IupStringCompare
IupSubmenu
IupTabs
IupTabsV
IupTabsv
IupText
IupTextConvertLinColToPos
IupTextConvertPosToLinCol
IupThread
IupTimer
IupToggle
IupTree
IupTreeGetId
IupTreeGetUserId
IupTreeSetAttributeHandle
IupTreeSetUserId
IupUnmap
IupUpdate
IupUpdateChildren
IupUser
IupVal
IupVbox
IupVboxV
IupVboxv
IupVersion
IupVersionDate
IupVersionNumber
IupVersionShow
IupZbox
IupZboxV
IupZboxv
iupArrayAdd
iupArrayCount
iupArrayCreate
iupArrayDestroy
iupArrayGetData
iupArrayInc
iupArrayInsert
iupArrayReleaseData
iupArrayRemove
iupAssert
iupAttribGet
iupAttribGetAllSaved
iupAttribGetBoolean
iupAttribGetBooleanId
iupAttribGetBooleanId2
iupAttribGetClassObject
iupAttribGetClassObjectId
iupAttribGetClassObjectId2
iupAttribGetDouble
iupAttribGetDoubleId
iupAttribGetDoubleId2
iupAttribGetFloat
iupAttribGetFloatId
iupAttribGetFloatId2
iupAttribGetHandleName
iupAttribGetId
iupAttribGetId2
iupAttribGetInherit
iupAttribGetInheritNativeParent
iupAttribGetInt
iupAttribGetIntId
iupAttribGetIntId2
iupAttribGetIntInt
iupAttribGetLocal
iupAttribGetStr
iupAttribIsIhandle
iupAttribIsNotString
iupAttribParse
iupAttribSet
iupAttribSetClassObject
iupAttribSetClassObjectId
iupAttribSetClassObjectId2
iupAttribSetDouble
iupAttribSetDoubleId
iupAttribSetDoubleId2
iupAttribSetFloat
iupAttribSetFloatId
iupAttribSetFloatId2
iupAttribSetHandleName
iupAttribSetId
iupAttribSetId2
iupAttribSetInt
iupAttribSetIntId
iupAttribSetIntId2
iupAttribSetStr
iupAttribSetStrId
iupAttribSetStrId2
iupAttribSetStrf
iupBackgroundBoxNewBaseClass
iupBaseCallValueChangedCb
iupBaseCanvasGetClientOffsetAttrib
iupBaseCanvasGetClientSizeAttrib
iupBaseComputeNaturalSize
iupBaseContainerGetExpandAttrib
iupBaseContainerUpdateExpand
iupBaseGetActiveAttrib
iupBaseGetCPaddingAttrib
iupBaseGetCSpacingAttrib
iupBaseGetClientOffsetAttrib
iupBaseGetClientSizeAttrib
iupBaseGetCurrentSizeAttrib
iupBaseGetExpandAttrib
iupBaseGetRasterSizeAttrib
iupBaseGetScrollbar
iupBaseGetSizeAttrib
iupBaseGetVisibleAttrib
iupBaseGetWidAttrib
iupBaseNativeParentGetBgColor
iupBaseNativeParentGetBgColorAttrib
iupBaseNoSaveCheck
iupBaseRegisterBaseCallbacks
iupBaseRegisterCommonAttrib
iupBaseRegisterCommonCallbacks
iupBaseRegisterVisualAttrib
iupBaseSetActiveAttrib
iupBaseSetCPaddingAttrib
iupBaseSetCSpacingAttrib
iupBaseSetCurrentSize
iupBaseSetExpandAttrib
iupBaseSetMaxSizeAttrib
iupBaseSetMinSizeAttrib
iupBaseSetNameAttrib
iupBaseSetPosition
iupBaseSetRasterSizeAttrib
iupBaseSetSizeAttrib
iupBaseSetVisibleAttrib
iupBaseTypeVoidMapMethod
iupBaseUpdateAttribFromFont
iupCallGetFocusCb
iupCallKillFocusCb
iupChildTreeAppend
iupChildTreeGetNativeParent
iupChildTreeGetNativeParentHandle
iupChildTreeGetPrevBrother
iupChildTreeIsParent
iupClassCallbackGetFormat
iupClassInfoGetDesc
iupClassInfoShowHelp
iupClassMatch
iupClassNew
iupClassObjectChildAdded
iupClassObjectChildRemoved
iupClassObjectComputeNaturalSize
iupClassObjectCreate
iupClassObjectDestroy
iupClassObjectDlgPopup
iupClassObjectGetInnerNativeContainerHandle
iupClassObjectHasDlgPopup
iupClassObjectLayoutUpdate
iupClassObjectMap
iupClassObjectSetChildrenCurrentSize
iupClassObjectSetChildrenPosition
iupClassObjectUnMap
iupClassRegisterAttribute
iupClassRegisterAttributeId
iupClassRegisterAttributeId2
iupClassRegisterCallback
iupClassRegisterGetAttribute
iupClassRegisterReplaceAttribDef
iupClassRegisterReplaceAttribFlags
iupClassRegisterReplaceAttribFunc
iupClassRelease
iupDataEntry
iupDialogGetNativeParent
iupDlgListAdd
iupDlgListCount
iupDlgListFirst
iupDlgListNext
iupDlgListRemove
iupDlgListVisibleCount
iupDlgListVisibleDec
iupDlgListVisibleInc
iupDrawCalcShadows
iupDrawColor
iupDrawColorMakeInactive
iupDrawGetTextFlags
iupDrawGetTextSize
iupDrawHorizSunkenMark
iupDrawParentBackground
iupDrawRaiseRect
iupDrawSetColor
iupDrawStrToColor
iupDrawSunkenRect
iupDrawVertSunkenMark
iupError
iupFlatDrawArrow
iupFlatDrawBorder
iupFlatDrawBox
iupFlatDrawCheckMark
iupFlatDrawDrawCircle
iupFlatDrawGetIconSize
iupFlatDrawIcon
iupFlatGetDarkerBgColor
iupFlatGetHorizontalAlignment
iupFlatGetImageName
iupFlatGetImageNameId
iupFlatGetImagePosition
iupFlatGetVerticalAlignment
iupFlatItemResetTip
iupFlatItemSetTip
iupFlatItemSetTipAttrib
iupFlatScrollBarCreate
iupFlatScrollBarGet
iupFlatScrollBarMotionUpdate
iupFlatScrollBarRegister
iupFlatScrollBarRelease
iupFlatScrollBarSetChildrenCurrentSize
iupFlatScrollBarSetChildrenPosition
iupFlatScrollBarSetPos
iupFlatScrollBarWheelUpdate
iupFlatSetActiveAttrib
iupFocusCanAccept
iupFocusNextInteractive
iupFontParsePango
iupFontParseWin
iupFontParseX
iupGetFontFaceAttrib
iupGetFontInfo
iupGetFontSizeAttrib
iupGetFontStyleAttrib
iupGetFontValue

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 401KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

488fa4c9c47d4386469ccb56e744c865

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

windivert

iup

winmm

kernel32

user32

advapi32

shell32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 1KB - Virtual size: 9KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 512B - Virtual size: 228B

Password: infected

0b649f8e17494bb31b47f6e959a1769c

Headers

File Characteristics

Imports

advapi32

kernel32

Exports

Exports

Sections

.text Size: 30KB - Virtual size: 29KB

.data Size: 512B - Virtual size: 32B

.rdata Size: 9KB - Virtual size: 8KB

.pdata Size: 1024B - Virtual size: 840B

.xdata Size: 1024B - Virtual size: 800B

.bss Size: - Virtual size: 16B

.edata Size: 1KB - Virtual size: 1KB

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 240B

505c54af7fa8f0482014ca4fe5cdd53d

Code Sign

f4:8b:a9:cb:78:dd:96:f2:dc:60:2f:ef:35:68:c9:2aCertificate

Extended Key Usages

Key Usages

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

33:00:00:00:31:94:79:a3:18:f5:52:2d:06:00:00:00:00:00:31Certificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2eSigner

22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 1KB - Virtual size: 9KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 512B - Virtual size: 228B

.text
Size: 30KB - Virtual size: 29KB

.data
Size: 512B - Virtual size: 32B

.rdata
Size: 9KB - Virtual size: 8KB

.pdata
Size: 1024B - Virtual size: 840B

.xdata
Size: 1024B - Virtual size: 800B

.bss
Size: - Virtual size: 16B

.edata
Size: 1KB - Virtual size: 1KB

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 240B

f4:8b:a9:cb:78:dd:96:f2:dc:60:2f:ef:35:68:c9:2a
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

33:00:00:00:31:94:79:a3:18:f5:52:2d:06:00:00:00:00:00:31
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e
Signer

22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e
Signer

.text
Size: 44KB - Virtual size: 44KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 16KB

.pdata
Size: 2KB - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 4B

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 420B

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 201KB - Virtual size: 201KB

.data
Size: 5KB - Virtual size: 401KB

.pdata
Size: 74KB - Virtual size: 74KB

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 1024B - Virtual size: 812B