libresprite[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

libresprite.exe
Size

3.7MB
MD5

645857102557d3c32fa27cbd19cfcb23
SHA1

915f09a9629d8f816dc5c5e441e9aa5c8123e026
SHA256

a35666e32d8ccca29322b1097e13aa24179faff9f580a471c49c1b79347765e3
SHA512

11cd3099ed5a05f1b1e6d7cf87cfaab2ed60e4b4f27bc13cfe13fc3236a157d94fdee477cbf10a09ccb9c87661ceb39e9e08847e48be54641f18c45999700bf8
SSDEEP

49152:Hr00diU/fTzw3/V+XvX4szUGXq3txRoByG8Xwm4X1OMIyph8MhXi75rA:L00Nir7Xs7rh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libresprite.exe

Files

libresprite.exe
.exe windows:6 windows x64 arch:x64

e4a272d88b1f606578338ec4975bbe37

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ole32

CoCreateInstance
CoUninitialize
GetHGlobalFromStream
CreateStreamOnHGlobal
CoInitialize

shlwapi

ord12
StrRetToBufW

sdl2

SDL_UpperBlit
SDL_FillRect
SDL_GetClipRect
SDL_SetClipRect
SDL_UnlockSurface
SDL_LockSurface
SDL_FreeSurface
SDL_CreateRGBSurfaceWithFormat
SDL_CreateRGBSurface
SDL_MapRGBA
SDL_GetWindowWMInfo
SDL_ShowCursor
SDL_CaptureMouse
SDL_WarpMouseInWindow
SDL_DestroyWindow
SDL_UpdateWindowSurface
SDL_GetWindowSurface
SDL_MaximizeWindow
SDL_GetWindowPosition
SDL_SetWindowPosition
SDL_SetWindowIcon
SDL_SetWindowTitle
SDL_GetWindowID
SDL_CreateWindow
SDL_UpperBlitScaled
SDL_GetError
SDL_Quit
SDL_Init
SDL_ShowSimpleMessageBox
SDL_SetHint
SDL_PollEvent
SDL_SetTextInputRect
SDL_StopTextInput
SDL_IsTextInputActive
SDL_StartTextInput
SDL_GetMouseState
SDL_free
SDL_wcslen
SDL_strlen
SDL_iconv_string
SDL_SetMainReady

sdl2_image

IMG_Init
IMG_Quit
IMG_Load

jpeg62

ord77
ord87
ord89
ord30
ord31
ord50
ord81
ord43
ord44
ord90
ord91
ord49
ord84
ord86
ord98
ord75

gif

ord29
ord30
ord5
ord51
ord42
ord31
ord33
ord9
ord7
ord49
ord11
ord6
ord32
ord28
ord23
ord1
ord14
ord35
ord18

libpng16

png_read_rows
png_set_sig_bytes
png_read_update_info
png_create_read_struct
png_set_strip_16
png_create_info_struct
png_write_rows
png_create_write_struct
png_set_longjmp_fn
png_set_interlace_handling
png_write_info
png_read_info
png_set_expand_gray_1_2_4_to_8
png_set_packing
png_write_end
png_set_tRNS
png_get_tRNS
png_set_PLTE
png_get_PLTE
png_set_IHDR
png_get_IHDR
png_get_color_type
png_get_image_height
png_get_image_width
png_get_rowbytes
png_free
png_malloc
png_get_error_ptr
png_init_io
png_destroy_write_struct
png_destroy_read_struct

zlib1

deflateEnd
inflateInit_
deflateInit_
inflateEnd
inflate
deflate

v8

?New@ArrayBuffer@v8@@SA?AV?$Local@VArrayBuffer@v8@@@2@PEAVIsolate@2@V?$shared_ptr@VBackingStore@v8@@@std@@@Z
?Value@Number@v8@@QEBANXZ
??1Utf8Value@String@v8@@QEAA@XZ
??0Utf8Value@String@v8@@QEAA@PEAVIsolate@2@V?$Local@VValue@v8@@@2@@Z
?NewFromUtf8@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PEAVIsolate@2@PEBDW4NewStringType@2@H@Z
?Value@Boolean@v8@@QEBA_NXZ
?Enter@Context@v8@@QEAAXXZ
?New@Context@v8@@SA?AV?$Local@VContext@v8@@@2@PEAVIsolate@2@PEAVExtensionConfiguration@2@V?$MaybeLocal@VObjectTemplate@v8@@@2@V?$MaybeLocal@VValue@v8@@@2@UDeserializeInternalFieldsCallback@2@PEAVMicrotaskQueue@2@@Z
?Global@Context@v8@@QEAA?AV?$Local@VObject@v8@@@2@XZ
?StackTrace@TryCatch@v8@@QEBA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?Exception@TryCatch@v8@@QEBA?AV?$Local@VValue@v8@@@2@XZ
?HasCaught@TryCatch@v8@@QEBA_NXZ
??1TryCatch@v8@@QEAA@XZ
??0TryCatch@v8@@QEAA@PEAVIsolate@1@@Z
?ToLocalEmpty@V8@v8@@CAXXZ
?DisposeGlobal@V8@v8@@CAXPEA_K@Z
?MoveGlobalReference@V8@v8@@CAXPEAPEA_K0@Z
?GlobalizeReference@V8@v8@@CAPEA_KPEAVIsolate@internal@2@PEA_K@Z
?Initialize@V8@v8@@CA_NH@Z
?InitializePlatform@V8@v8@@SAXPEAVPlatform@2@@Z
?InitializeExternalStartupData@V8@v8@@SAXPEBD@Z
?InitializeICUDefaultLocation@V8@v8@@SA_NPEBD0@Z
?Exit@Isolate@v8@@QEAAXXZ
?Enter@Isolate@v8@@QEAAXXZ
?New@Isolate@v8@@SAPEAV12@AEBUCreateParams@12@@Z
??1CreateParams@Isolate@v8@@QEAA@XZ
??0CreateParams@Isolate@v8@@QEAA@XZ
?GetFunction@FunctionTemplate@v8@@QEAA?AV?$MaybeLocal@VFunction@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?New@FunctionTemplate@v8@@SA?AV?$Local@VFunctionTemplate@v8@@@2@PEAVIsolate@2@P6AXAEBV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@V?$Local@VSignature@v8@@@2@HW4ConstructorBehavior@2@W4SideEffectType@2@PEBVCFunction@2@@Z
?Value@External@v8@@QEBAPEAXXZ
?New@External@v8@@SA?AV?$Local@VExternal@v8@@@2@PEAVIsolate@2@PEAX@Z
?New@Uint8Array@v8@@SA?AV?$Local@VUint8Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@_K1@Z
?Buffer@ArrayBufferView@v8@@QEAA?AV?$Local@VArrayBuffer@v8@@@2@XZ
?GetBackingStore@ArrayBuffer@v8@@QEAA?AV?$shared_ptr@VBackingStore@v8@@@std@@XZ
?NewBackingStore@ArrayBuffer@v8@@SA?AV?$unique_ptr@VBackingStore@v8@@U?$default_delete@VBackingStore@v8@@@std@@@std@@PEAX_KP6AX010@Z0@Z
?New@Number@v8@@SA?AV?$Local@VNumber@v8@@@2@PEAVIsolate@2@N@Z
?New@ArrayBuffer@v8@@SA?AV?$Local@VArrayBuffer@v8@@@2@PEAVIsolate@2@_K@Z
?NewDefaultAllocator@Allocator@ArrayBuffer@v8@@SAPEAV123@XZ
?ByteLength@BackingStore@v8@@QEBA_KXZ
?Data@BackingStore@v8@@QEBAPEAXXZ
??1BackingStore@v8@@QEAA@XZ
??1PropertyDescriptor@v8@@QEAA@XZ
?Exit@Context@v8@@QEAAXXZ
?TypeOf@Value@v8@@QEAA?AV?$Local@VString@v8@@@2@PEAVIsolate@2@@Z
?IsUint8Array@Value@v8@@QEBA_NXZ
?IsUint32@Value@v8@@QEBA_NXZ
??0PropertyDescriptor@v8@@QEAA@V?$Local@VValue@v8@@@1@0@Z
?New@Object@v8@@SA?AV?$Local@VObject@v8@@@2@PEAVIsolate@2@@Z
?DefineProperty@Object@v8@@QEAA?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@AEAVPropertyDescriptor@2@@Z
?Set@Object@v8@@QEAA?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@1@Z
?Value@Uint32@v8@@QEBAIXZ
?Value@Int32@v8@@QEBAHXZ
?New@Integer@v8@@SA?AV?$Local@VInteger@v8@@@2@PEAVIsolate@2@H@Z
??0HandleScope@v8@@QEAA@PEAVIsolate@1@@Z
??1HandleScope@v8@@QEAA@XZ
?CreateHandle@HandleScope@v8@@KAPEA_KPEAVIsolate@internal@2@_K@Z
?Compile@Script@v8@@SA?AV?$MaybeLocal@VScript@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VString@v8@@@2@PEAVScriptOrigin@2@@Z
?Run@Script@v8@@QEAA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?IsBoolean@Value@v8@@QEBA_NXZ
?IsNumber@Value@v8@@QEBA_NXZ
?IsInt32@Value@v8@@QEBA_NXZ

v8_libplatform

?NewDefaultPlatform@platform@v8@@YA?AV?$unique_ptr@VPlatform@v8@@U?$default_delete@VPlatform@v8@@@std@@@std@@HW4IdleTaskSupport@12@W4InProcessStackDumping@12@V?$unique_ptr@VTracingController@v8@@U?$default_delete@VTracingController@v8@@@std@@@4@@Z

freetype

FT_Glyph_To_Bitmap
FT_Done_FreeType
FT_Done_Face
FT_Glyph_Copy
FT_Init_FreeType
FT_Get_Glyph
FT_Load_Glyph
FT_Select_Charmap
FT_Open_Face
FT_Done_Glyph
FT_Set_Pixel_Sizes
FT_Get_Kerning
FT_Get_Char_Index

shell32

SHGetMalloc
CommandLineToArgvW
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteExW
SHGetFolderPathW

msvcp140

?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xlength_error@std@@YAXPEBD@Z
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
_Thrd_sleep
_Thrd_id
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sync_with_stdio@ios_base@std@@SA_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Xbad_alloc@std@@YAXXZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?__ExceptionPtrCreate@@YAXPEAX@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_join
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Xbad_function_call@std@@YAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??Bid@locale@std@@QEAA_KXZ

vcruntime140

_purecall
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
__RTDynamicCast
memset
__std_terminate
memchr
__RTtypeid
__std_type_info_name
longjmp
__std_type_info_compare
strchr
__C_specific_handler
__current_exception
__current_exception_context
__intrinsic_setjmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_cexit
abort
_seh_filter_exe
_initialize_narrow_environment
_register_onexit_function
_set_app_type
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_beginthreadex
terminate
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_errno
exit

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
setlocale

api-ms-win-crt-stdio-l1-1-0

setvbuf
ungetc
_set_fmode
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
_wsopen_dispatch
_wfopen
freopen
getc
feof
fgets
_fseeki64
fsetpos
__p__commode
fread
fputc
fgetpos
fgetc
fflush
fclose
fwrite
_get_stream_buffer_pointers
__stdio_common_vsprintf_s
__stdio_common_vsscanf
fopen
fputs
__acrt_iob_func
ftell
ferror
__stdio_common_vfprintf
_lseek
fseek

api-ms-win-crt-filesystem-l1-1-0

_wstat64i32
_unlock_file
_lock_file

api-ms-win-crt-string-l1-1-0

isdigit
strcmp
toupper
isspace
strpbrk
strncmp
tolower
strtok
_strdup
isalpha
isalnum

api-ms-win-crt-convert-l1-1-0

strtoul
strtod
strtol
atoi

api-ms-win-crt-math-l1-1-0

atan2
sqrt
cos
sin
ceilf
fmod
atan
floor
__setusermatherr
ceil
_dsign
cbrt
log2
trunc
_dclass
acos
asin
exp
sqrtf
tan
log10
log
pow

api-ms-win-crt-environment-l1-1-0

_wgetenv
getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
realloc
_callnewh
free
malloc

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

kernel32

Sleep
GlobalAlloc
GlobalSize
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
CreateFileW
CloseHandle
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetStdHandle
GetFileType
AllocConsole
FreeConsole
AttachConsole
FileTimeToSystemTime
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFullPathNameW
RemoveDirectoryW
GetModuleFileNameW
GetExitCodeProcess
OpenProcess
WaitForSingleObject
CreateThread
GetProcessHeap
HeapFree
HeapAlloc
GetCommandLineW
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
CreateDirectoryW
GlobalUnlock
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetProcAddress
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
FormatMessageW
LocalFree
GetLastError
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetTickCount
GetLocalTime
ResumeThread
GetSystemTime

user32

CloseClipboard
IsClipboardFormatAvailable
EmptyClipboard
RegisterClipboardFormatW
RegisterClipboardFormatA
GetClipboardData
SetClipboardData
OpenClipboard

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

dbghelp

MiniDumpWriteDump

Exports

Exports

_pixman_internal_only_get_implementation
pixman_blt
pixman_compute_composite_region
pixman_disable_out_of_bounds_workaround
pixman_f_transform_bounds
pixman_f_transform_from_pixman_transform
pixman_f_transform_init_identity
pixman_f_transform_init_rotate
pixman_f_transform_init_scale
pixman_f_transform_init_translate
pixman_f_transform_invert
pixman_f_transform_multiply
pixman_f_transform_point
pixman_f_transform_point_3d
pixman_f_transform_rotate
pixman_f_transform_scale
pixman_f_transform_translate
pixman_fill
pixman_format_supported_destination
pixman_format_supported_source
pixman_image_composite
pixman_image_composite32
pixman_image_create_bits
pixman_image_create_bits_no_clear
pixman_image_create_conical_gradient
pixman_image_create_linear_gradient
pixman_image_create_radial_gradient
pixman_image_create_solid_fill
pixman_image_fill_boxes
pixman_image_fill_rectangles
pixman_image_get_component_alpha
pixman_image_get_data
pixman_image_get_depth
pixman_image_get_destroy_data
pixman_image_get_format
pixman_image_get_height
pixman_image_get_stride
pixman_image_get_width
pixman_image_ref
pixman_image_set_accessors
pixman_image_set_alpha_map
pixman_image_set_clip_region
pixman_image_set_clip_region32
pixman_image_set_component_alpha
pixman_image_set_destroy_function
pixman_image_set_dither
pixman_image_set_dither_offset
pixman_image_set_filter
pixman_image_set_has_client_clip
pixman_image_set_indexed
pixman_image_set_repeat
pixman_image_set_source_clipping
pixman_image_set_transform
pixman_image_unref
pixman_region32_clear
pixman_region32_contains_point
pixman_region32_contains_rectangle
pixman_region32_copy
pixman_region32_equal
pixman_region32_extents
pixman_region32_fini
pixman_region32_init
pixman_region32_init_from_image
pixman_region32_init_rect
pixman_region32_init_rects
pixman_region32_init_with_extents
pixman_region32_intersect
pixman_region32_intersect_rect
pixman_region32_inverse
pixman_region32_n_rects
pixman_region32_not_empty
pixman_region32_rectangles
pixman_region32_reset
pixman_region32_selfcheck
pixman_region32_subtract
pixman_region32_translate
pixman_region32_union
pixman_region32_union_rect
pixman_region_clear
pixman_region_contains_point
pixman_region_contains_rectangle
pixman_region_copy
pixman_region_equal
pixman_region_extents
pixman_region_fini
pixman_region_init
pixman_region_init_from_image
pixman_region_init_rect
pixman_region_init_rects
pixman_region_init_with_extents
pixman_region_intersect
pixman_region_intersect_rect
pixman_region_inverse
pixman_region_n_rects
pixman_region_not_empty
pixman_region_rectangles
pixman_region_reset
pixman_region_selfcheck
pixman_region_set_static_pointers
pixman_region_subtract
pixman_region_translate
pixman_region_union
pixman_region_union_rect
pixman_transform_bounds
pixman_transform_from_pixman_f_transform
pixman_transform_init_identity
pixman_transform_init_rotate
pixman_transform_init_scale
pixman_transform_init_translate
pixman_transform_invert
pixman_transform_is_identity
pixman_transform_is_int_translate
pixman_transform_is_inverse
pixman_transform_is_scale
pixman_transform_multiply
pixman_transform_point
pixman_transform_point_31_16
pixman_transform_point_31_16_3d
pixman_transform_point_31_16_affine
pixman_transform_point_3d
pixman_transform_rotate
pixman_transform_scale
pixman_transform_translate
pixman_version
pixman_version_string

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 630KB - Virtual size: 630KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 107KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4a272d88b1f606578338ec4975bbe37

Headers

DLL Characteristics

File Characteristics

Imports

ole32

shlwapi

sdl2

sdl2_image

jpeg62

gif

libpng16

zlib1

v8

v8_libplatform

freetype

shell32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

kernel32

user32

comdlg32

dbghelp

Exports

Exports

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 630KB - Virtual size: 630KB

.data Size: 107KB - Virtual size: 112KB

.pdata Size: 128KB - Virtual size: 127KB

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 630KB - Virtual size: 630KB

.data
Size: 107KB - Virtual size: 112KB

.pdata
Size: 128KB - Virtual size: 127KB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 28KB - Virtual size: 27KB