2024-08-21_9dd3b60c2df9f75639ffe0a0c8c3b966_icedid

Sharing

Copy URL

Twitter E-mail

General

Target

2024-08-21_9dd3b60c2df9f75639ffe0a0c8c3b966_icedid
Size

13.9MB
MD5

9dd3b60c2df9f75639ffe0a0c8c3b966
SHA1

446311b289495b6e325707da98b01d1da71591fa
SHA256

bcedf563dc20637078f189a6b1da81d0397b38fb81d16bf740de337f4f1a6cc6
SHA512

b243e6c0790934ffdc2f31923d0e06180619d92970e4255d5b98b1ed7593a57bd18652ceef98581c19ad1b3fe6e8b4a3f0f6589116740dff0ad354f620fe23f2
SSDEEP

196608:8zGd6+Xwks/EzvotC+wcdOxi2NLHioUueX2s8hOLHEQTGEFVQ74f9KkF:EkWwvOUcdb2NLHiR32uTGEZf97

Score

1^/10

Malware Config

Signatures

Files

2024-08-21_9dd3b60c2df9f75639ffe0a0c8c3b966_icedid
.exe windows:6 windows x86 arch:x86

c812cf52a4fffae05b59c8e216ac79c8

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d2:2f:1c:fb:03:d6:75:ee:bf:34:eb:ef:56:a2:5c:05
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

07/03/2023, 00:00

Not After

06/03/2026, 23:59

Subject

CN=Northwest Performance Software\, Inc,O=Northwest Performance Software\, Inc,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d2:2f:1c:fb:03:d6:75:ee:bf:34:eb:ef:56:a2:5c:05
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

07/03/2023, 00:00

Not After

06/03/2026, 23:59

Subject

CN=Northwest Performance Software\, Inc,O=Northwest Performance Software\, Inc,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:68:3a:b1:b0:11:f0:b2:6e:78:4e:b4:c4:7d:71:31:da:78:24:22:f7:5a:eb:fb:62:cd:2a:31:aa:1f:d6:1d
Signer

Actual PE Digest

5b:68:3a:b1:b0:11:f0:b2:6e:78:4e:b4:c4:7d:71:31:da:78:24:22:f7:5a:eb:fb:62:cd:2a:31:aa:1f:d6:1d

Digest Algorithm

sha256

PE Digest Matches

true

b4:2c:87:95:f9:a9:aa:27:b3:87:c3:bf:6a:86:11:2b:eb:35:4c:b8
Signer

Actual PE Digest

b4:2c:87:95:f9:a9:aa:27:b3:87:c3:bf:6a:86:11:2b:eb:35:4c:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\development\nstpro11\BCGPDigitalDashboard\ReleaseStatic\BCGPDigitalDashboard.pdb

Imports

sqlite3

sqlite3_mprintf
sqlite3_prepare_v2
sqlite3_busy_timeout
sqlite3_last_insert_rowid
sqlite3_get_table
sqlite3_exec
sqlite3_close
sqlite3_open
sqlite3_bind_null
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_text
sqlite3_reset
sqlite3_changes
sqlite3_free_table
sqlite3_errmsg
sqlite3_finalize
sqlite3_step
sqlite3_column_type
sqlite3_column_decltype
sqlite3_column_name
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_int
sqlite3_column_text
sqlite3_column_count
sqlite3_vmprintf
sqlite3_free
sqlite3_snprintf

kernel32

GetOEMCP
GetCPInfo
GetCurrentDirectoryA
FileTimeToLocalFileTime
GetFileAttributesExA
GetFileSizeEx
LocalFileTimeToFileTime
WideCharToMultiByte
SizeofResource
WriteConsoleW
CreateFileW
DeleteFileW
CreateDirectoryW
GetFileAttributesExW
SetConsoleCtrlHandler
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetUserDefaultUILanguage
GetStdHandle
ExitProcess
GetFileType
SetStdHandle
QueryPerformanceFrequency
HeapQueryInformation
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
VirtualQuery
VirtualAlloc
GetSystemInfo
GetCommandLineW
GetCommandLineA
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetNumberFormatA
CreateDirectoryA
GetSystemDirectoryA
FindResourceExA
ExpandEnvironmentStringsA
GetTimeFormatA
GetDateFormatA
lstrcpynA
lstrlenA
EnumSystemLocalesA
GetSystemDefaultLCID
GetLocaleInfoA
VerifyVersionInfoW
RaiseException
OutputDebugStringW
VirtualProtect
GetSystemDefaultUILanguage
GetLocaleInfoW
GetStringTypeW
SetFileAttributesA
SetErrorMode
GetWindowsDirectoryA
VerSetConditionMask
LockResource
VerifyVersionInfoA
FindResourceExW
GetTempPathA
GetProfileIntA
SearchPathA
Sleep
GetTickCount
LocalLock
LocalUnlock
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetACP
GlobalFlags
GetAtomNameA
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetStringTypeExA
GetThreadLocale
MoveFileA
lstrcmpiA
GetShortPathNameA
LoadLibraryExA
GetCurrentProcess
DuplicateHandle
GetVolumeInformationA
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetFileSize
FlushFileBuffers
FindFirstFileA
FindClose
LoadResource
FindResourceW
MultiByteToWideChar
AreFileApisANSI
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcpyA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
GetModuleHandleA
GetProcAddress
HeapFree
InitializeCriticalSectionEx
HeapSize
DeleteFileA
CreateFileA
GetUserDefaultLCID
GlobalFree
GetLastError
HeapReAlloc
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
GlobalSize
LocalFree
MulDiv
FormatMessageA
CopyFileA
SetLastError
lstrcmpA
GetCurrentProcessId
GetModuleFileNameA
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleW
LoadLibraryW
FindResourceA
EncodePointer
GetCurrentThreadId
GetSystemDirectoryW
FreeLibrary
LoadLibraryExW
LoadLibraryA
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomA
GlobalFindAtomA
GlobalGetAtomNameA
CompareStringA
GetCurrentThread
GetVersionExA
GetTickCount64
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
CloseHandle
SetEvent
WaitForSingleObject
CreateEventA
SetThreadPriority
SuspendThread
ResumeThread
GetDiskFreeSpaceA
GetFileAttributesA
GetFileTime
GetFullPathNameA
SetFileTime
GetTempFileNameA
ReplaceFileA

user32

SendMessageA
GetClassInfoA
LoadIconA
SetRect
GetTabbedTextExtentW
GetTabbedTextExtentA
DestroyCursor
GetWindowRgn
WindowFromDC
CreateMenu
InSendMessage
MonitorFromRect
SendNotifyMessageA
SubtractRect
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
DrawMenuBar
EnumChildWindows
GetUpdateRect
IsClipboardFormatAvailable
CharUpperBuffA
ModifyMenuA
GetDoubleClickTime
SetMenuDefaultItem
DestroyAcceleratorTable
CreateAcceleratorTableA
ToAsciiEx
GetKeyboardState
MapVirtualKeyExA
IsCharLowerA
GetKeyboardLayout
LoadCursorA
WaitMessage
GetComboBoxInfo
MonitorFromPoint
UpdateLayeredWindow
LockWindowUpdate
GetDCEx
DrawIcon
FrameRect
CopyIcon
SetCursorPos
IsZoomed
DrawFrameControl
DrawEdge
SetClassLongA
DrawStateA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
SetLayeredWindowAttributes
NotifyWinEvent
LoadCursorW
InvertRect
HideCaret
EnableScrollBar
GetIconInfo
RedrawWindow
DrawFocusRect
WindowFromPoint
GetMenuDefaultItem
SetParent
GetSystemMenu
UnionRect
MapVirtualKeyA
GetKeyNameTextA
LoadMenuW
LoadAcceleratorsW
MessageBeep
GetNextDlgGroupItem
IsRectEmpty
InvalidateRgn
CopyAcceleratorTableA
SetCapture
CharNextA
PostThreadMessageA
DeleteMenu
GetAsyncKeyState
CopyImage
SystemParametersInfoA
GetMenuItemInfoA
LoadImageW
TrackMouseEvent
GetSysColorBrush
RegisterClassExA
LoadBitmapW
GetSystemMetrics
GetWindowRect
GetDialogBaseUnits
RealChildWindowFromPoint
InflateRect
CharUpperA
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
DestroyIcon
IntersectRect
InvalidateRect
InsertMenuItemA
DestroyMenu
CreatePopupMenu
LoadMenuA
TranslateAcceleratorA
LoadAcceleratorsA
ReleaseCapture
BringWindowToTop
SetCursor
ShowOwnedPopups
GetCursorPos
GetMessageA
MapDialogRect
SetWindowContextHelpId
RegisterClipboardFormatA
PostQuitMessage
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
SetTimer
GetParent
DispatchMessageA
TranslateMessage
PeekMessageA
UpdateWindow
EnableWindow
DrawIconEx
LoadImageA
SetWindowRgn
GetDC
KillTimer
UnregisterClassA
GetMenuStringA
GetMenuState
CountClipboardFormats
SetCaretPos
CreateCaret
GetClipboardData
IsCharAlphaNumericA
GetWindowContextHelpId
GetCaretPos
ShowCaret
DestroyCaret
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuA
AppendMenuA
RemoveMenu
IsWindowEnabled
MessageBoxA
GetWindowLongA
GetWindowThreadProcessId
GetLastActivePopup
DrawTextA
DrawTextExA
GrayStringA
TabbedTextOutA
GetWindowDC
ReleaseDC
BeginPaint
EndPaint
ClientToScreen
ScreenToClient
GetSysColor
FillRect
IsWindow
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetDlgItem
GetNextDlgTabItem
GetActiveWindow
SetActiveWindow
GetDesktopWindow
SetFocus
SetScrollPos
GetScrollPos
GetWindowTextA
GetWindowTextLengthA
GetWindow
SendDlgItemMessageA
GetClientRect
SetRectEmpty
OffsetRect
ShowWindow
MoveWindow
SetWindowPos
SetDlgItemInt
GetDlgItemInt
SetDlgItemTextA
GetDlgItemTextA
CheckDlgButton
CheckRadioButton
IsDlgButtonChecked
GetDlgCtrlID
GetFocus
ScrollWindowEx
SetWindowTextA
SetWindowLongA
IsDialogMessageA
RegisterWindowMessageA
GetMessagePos
GetMessageTime
PostMessageA
DefWindowProcA
CallWindowProcA
RegisterClassA
GetClassInfoExA
CreateWindowExA
IsMenu
IsChild
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsIconic
GetKeyState
CheckMenuItem
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetTopWindow
GetClassNameA
GetClassLongA
PtInRect
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
ScrollWindow
ValidateRect
SetForegroundWindow
GetForegroundWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
GetMenu
GetCapture
IsWindowVisible

gdi32

GetOutlineTextMetricsA
Arc
CreateEllipticRgnIndirect
CreatePolyPolygonRgn
PolyBezier
UnrealizeObject
GetRegionData
BeginPath
CloseFigure
EndPath
FillPath
ChoosePixelFormat
SetPixelFormat
GetCharABCWidthsA
SetBrushOrgEx
GetRgnBox
GetTextFaceA
GetTextExtentPoint32W
GetTextExtentPointA
GetTextAlign
GetStretchBltMode
GetPolyFillMode
GetNearestColor
GetBkMode
GetROP2
DeleteMetaFile
CreateMetaFileA
CloseMetaFile
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
RoundRect
GetCurrentObject
OffsetRgn
Rectangle
EnumFontFamiliesExA
LPtoDP
CreateRoundRectRgn
Polyline
Polygon
CreatePolygonRgn
Ellipse
CreateEllipticRgn
SetDIBColorTable
CreateDIBSection
StretchBlt
SetPixel
GetDIBits
GetTextCharsetInfo
EnumFontFamiliesA
CreateDIBitmap
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
StretchDIBits
GetCharWidthA
CreateFontA
GetTextColor
GetBkColor
GetTextMetricsA
GetTextExtentPoint32A
SetRectRgn
PatBlt
GetMapMode
CreateRectRgnIndirect
DPtoLP
SetAbortProc
AbortDoc
EndPage
StartPage
EndDoc
CreateCompatibleBitmap
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
PolylineTo
PolyBezierTo
ExtTextOutA
TextOutA
MoveToEx
ExtCreatePen
SetArcDirection
SelectClipPath
PolyDraw
ArcTo
StartDocA
SetColorAdjustment
ModifyWorldTransform
SetWorldTransform
EnumMetaFile
PlayMetaFileRecord
SetTextJustification
SetTextAlign
SetTextColor
SetTextCharacterExtra
SetStretchBltMode
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetGraphicsMode
SetMapperFlags
SetBkMode
SetBkColor
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
PlayMetaFile
OffsetClipRgn
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetObjectType
GetCurrentPositionEx
GetClipRgn
GetClipBox
ExcludeClipRect
Escape
DeleteDC
CreateSolidBrush
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateDIBPatternBrushPt
CreateBitmap
CreateDCA
CopyMetaFileA
BitBlt
DeleteObject
CombineRgn
CreateRectRgn
GetPixel
SelectObject
CreateCompatibleDC
GetStockObject
CreateFontIndirectA
GetObjectA
GetDeviceCaps

msimg32

TransparentBlt
AlphaBlend

winspool.drv

DocumentPropertiesA
ord201
EnumPrintersA
DeviceCapabilitiesA
ClosePrinter
GetJobA
OpenPrinterA

advapi32

IsTextUnicode
RegQueryInfoKeyA
RegCloseKey
RegSetValueA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegEnumKeyA
RegQueryValueA
SetFileSecurityA
GetFileSecurityA
RegOpenKeyExW
RegEnumValueA
RegEnumKeyExA

shell32

SHAppBarMessage
ShellExecuteExA
SHBrowseForFolderA
SHGetMalloc
ShellExecuteA
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListA
DragAcceptFiles
SHAddToRecentDocs
SHGetFileInfoA
DragFinish
DragQueryFileA
SHGetDataFromIDListA
SHGetFolderPathA
ExtractIconExA
SHFileOperationA
ExtractIconA

shlwapi

PathIsUNCA
PathRemoveFileSpecW
PathRemoveExtensionA
PathFindFileNameA
PathFindExtensionA
PathStripToRootA
StrFormatKBSizeA

uxtheme

GetThemeSysColor
GetWindowTheme
IsAppThemed
GetThemePartSize
GetCurrentThemeName
GetThemeColor
CloseThemeData
OpenThemeData
DrawThemeText
DrawThemeBackground
DrawThemeParentBackground
IsThemeBackgroundPartiallyTransparent

ole32

WriteClassStm
OleRegEnumVerbs
OleRegGetMiscStatus
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateFileMoniker
StgIsStorageFile
StgOpenStorage
StgCreateDocfile
OleLockRunning
OleSetMenuDescriptor
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleRun
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
StringFromGUID2
CoInitializeEx
CoDisconnectObject
PropVariantCopy
CoInitialize
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoCreateGuid
CoUninitialize
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CreateGenericComposite
CreateItemMoniker
OleCreate
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreateLinkToFile
OleCreateFromFile
OleLoad
OleDraw
GetClassFile
OleSave
GetHGlobalFromILockBytes
OleSaveToStream
OleQueryCreateFromData
OleSetContainedObject
OleGetIconOfClass
CreateDataAdviseHolder
OleQueryLinkFromData
CoGetMalloc
OleIsRunning
GetRunningObjectTable
CreateOleAdviseHolder

oleaut32

VarUdateFromDate
VarBstrCmp
VariantChangeTypeEx
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysAllocString
OleCreateFontIndirect
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayCreateVector
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VariantInit
VariantChangeType
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
SysStringLen
SysReAllocStringLen
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCreate
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayRedim
SysFreeString
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCopy
SafeArrayPtrOfIndex
VariantCopy
VarDateFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromDec
VarDecFromStr

oledlg

ord7
ord6
ord5
ord12
ord4
ord3
ord11
ord8
ord9

gdiplus

GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCreatePath
GdipDeletePath
GdipSetPathFillMode
GdipStartPathFigure
GdipClosePathFigure
GdipAddPathLine
GdipAddPathLine2
GdipAddPathArc
GdipAddPathBezier
GdipAddPathRectangle
GdipAddPathEllipse
GdipAddPathPath
GdipTransformPath
GdipGetPathWorldBounds
GdipCreateMatrix
GdipDeleteMatrix
GdipSetMatrixElements
GdipMultiplyMatrix
GdipTranslateMatrix
GdipScaleMatrix
GdipRotateMatrix
GdipTransformMatrixPoints
GdipGetMatrixElements
GdipIsMatrixIdentity
GdipCloneRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipGetRegionHRgn
GdipGetBrushType
GdipGetTextureTransform
GdipSetTextureTransform
GdipTranslateTextureTransform
GdipSetLinePresetBlend
GdipSetLineWrapMode
GdipGetLineTransform
GdipSetLineTransform
GdipMultiplyLineTransform
GdipTranslateLineTransform
GdipScaleLineTransform
GdipRotateLineTransform
GdipSetPathGradientCenterColor
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterPoint
GdipGetPathGradientPointCount
GdipSetPathGradientPresetBlend
GdipSetPathGradientWrapMode
GdipGetPathGradientTransform
GdipSetPathGradientTransform
GdipMultiplyPathGradientTransform
GdipTranslatePathGradientTransform
GdipScalePathGradientTransform
GdipFree
GdipSetPenEndCap
GdipSetPenDashCap197819
GdipSetPenLineJoin
GdipSetPenMiterLimit
GdipSetPenDashStyle
GdipGetImagePaletteSize
GdipSetPenDashArray
GdipCloneBitmapArea
GdipSetImageAttributesColorMatrix
GdipSetCompositingMode
GdipGetCompositingMode
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipGetInterpolationMode
GdipSetWorldTransform
GdipResetWorldTransform
GdipMultiplyWorldTransform
GdipGetWorldTransform
GdipSetPageUnit
GdipDrawLine
GdipDrawArc
GdipDrawRectangle
GdipDrawEllipse
GdipDrawPath
GdipGraphicsClear
GdipFillRectangle
GdipFillEllipse
GdipFillPath
GdipFillRegion
GdipDrawImageRectRect
GdipSetClipPath
GdipSetClipRegion
GdipResetClip
GdipDeleteFontFamily
GdipGetEmHeight
GdipGetCellDescent
GdipGetFamily
GdipGetFontStyle
GdipGetFontSize
GdipDrawString
GdipMeasureString
GdipSetStringFormatFlags
GdipGetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateRegion
GdipCreateRegionPath
GdipDeleteRegion
GdipCloneBrush
GdipDeleteBrush
GdipCreateTextureIAI
GdipSetTextureWrapMode
GdipCreateSolidFill
GdipCreateLineBrush
GdipCreatePathGradientFromPath
GdipCreatePen1
GdipCreatePen2
GdipDeletePen
GdipGetImageType
GdipCreateBitmapFromHICON
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipDrawImageRect
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipDeleteFont
GdipCreateStringFormat
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipAlloc
GdiplusShutdown
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipSetPenDashOffset
GdiplusStartup
GdipSetPenStartCap

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundA

comdlg32

GetFileTitleA

comctl32

ImageList_Remove
ImageList_DrawEx
ImageList_Destroy
ImageList_Create
ord14
ord13
ImageList_GetImageInfo
ImageList_AddMasked
ImageList_GetImageCount
ImageList_GetIcon
ImageList_Add
ImageList_SetImageCount
ImageList_ReplaceIcon
ImageList_GetIconSize
ImageList_Draw

Sections

.text
Size: 9.9MB - Virtual size: 9.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c812cf52a4fffae05b59c8e216ac79c8

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

d2:2f:1c:fb:03:d6:75:ee:bf:34:eb:ef:56:a2:5c:05Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

d2:2f:1c:fb:03:d6:75:ee:bf:34:eb:ef:56:a2:5c:05Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

5b:68:3a:b1:b0:11:f0:b2:6e:78:4e:b4:c4:7d:71:31:da:78:24:22:f7:5a:eb:fb:62:cd:2a:31:aa:1f:d6:1dSigner

b4:2c:87:95:f9:a9:aa:27:b3:87:c3:bf:6a:86:11:2b:eb:35:4c:b8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

sqlite3

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

oleacc

imm32

winmm

comdlg32

comctl32

Sections

.text Size: 9.9MB - Virtual size: 9.9MB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.data Size: 96KB - Virtual size: 128KB

.rsrc Size: 2.0MB - Virtual size: 2.0MB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

d2:2f:1c:fb:03:d6:75:ee:bf:34:eb:ef:56:a2:5c:05
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

d2:2f:1c:fb:03:d6:75:ee:bf:34:eb:ef:56:a2:5c:05
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

5b:68:3a:b1:b0:11:f0:b2:6e:78:4e:b4:c4:7d:71:31:da:78:24:22:f7:5a:eb:fb:62:cd:2a:31:aa:1f:d6:1d
Signer

b4:2c:87:95:f9:a9:aa:27:b3:87:c3:bf:6a:86:11:2b:eb:35:4c:b8
Signer

.text
Size: 9.9MB - Virtual size: 9.9MB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 96KB - Virtual size: 128KB

.rsrc
Size: 2.0MB - Virtual size: 2.0MB