2024-08-22_046f937bef060ffa12df3de15867eaf9_bkransomware_hijackloader

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-22_046f937bef060ffa12df3de15867eaf9_bkransomware_hijackloader
Size

14.4MB
MD5

046f937bef060ffa12df3de15867eaf9
SHA1

50caf2348311a9a2b84f93bb8d3e5f07649cea77
SHA256

5b36ec21f8dfe1c7ad811385491639be52f7789d96c1a28d1c8e27c15a121adf
SHA512

6fcdd634ec1c61f80a1b62dc593ef068e4f14b32e092d0792e83f234289dfc754c9ac1008d6616a4596e76647df60c27a7b3db5db182e0b92e878998229f0f32
SSDEEP

196608:m1dqWwihfMPK0F/m0Vctx0Hk9aL9OQ9fgeXSPn:t5a0Y5vrKee4

Score

1^/10

Malware Config

Signatures

Files

2024-08-22_046f937bef060ffa12df3de15867eaf9_bkransomware_hijackloader
.exe windows:5 windows x86 arch:x86

f83789194cc1bbd6d02f2316edd6cf62

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0b:08:b5:d8:e4:66:de:21:ea:e1:d2:a2:76:31:29:16
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

06/09/2023, 00:00

Not After

13/10/2025, 23:59

Subject

CN=GRETECH CORPORATION,O=GRETECH CORPORATION,L=Shinjuku,ST=Tokyo,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b8:6b:57:a4:e9:c8:03:b1:09:54:8e:bd:33:04:1e:da:51:84:ef:3d:0c:e6:d6:6f:e7:f1:de:57:56:19:41:e2
Signer

Actual PE Digest

b8:6b:57:a4:e9:c8:03:b1:09:54:8e:bd:33:04:1e:da:51:84:ef:3d:0c:e6:d6:6f:e7:f1:de:57:56:19:41:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Work\PLAY\GOMPlayer\2408\Player\project\GOMPlayer\map_pdb\GOM32R_vc120_ReleaseU.pdb

Imports

kernel32

GetTimeZoneInformation
ReadConsoleW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
MoveFileA
SetFileAttributesA
CreateDirectoryA
GetDriveTypeA
FindNextFileA
FindFirstFileA
IsDBCSLeadByte
DeleteFileA
GetSystemTime
GetTempPathA
CreateFileMappingA
SetFilePointerEx
HeapValidate
SetEnvironmentVariableA
GetFileAttributesA
FormatMessageA
UnlockFileEx
FlushViewOfFile
TryEnterCriticalSection
HeapCompact
CreateMutexW
GetThreadPriority
ReleaseSemaphore
SetThreadContext
GetThreadContext
GlobalMemoryStatus
GetDiskFreeSpaceA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetVersionExA
InterlockedCompareExchange
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
WaitForSingleObjectEx
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
SwitchToThread
lstrlenA
GetExitCodeThread
VirtualFree
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetConsoleMode
GetConsoleCP
GetFullPathNameA
WriteConsoleW
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetTimeFormatW
HeapCreate
GetDateFormatW
GetOEMCP
IsValidCodePage
GetStringTypeW
CreateSemaphoreW
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStartupInfoW
GetStdHandle
GetFileType
SetStdHandle
HeapQueryInformation
VirtualAlloc
RtlUnwind
GetCPInfo
AreFileApisANSI
GetModuleHandleExW
ExitProcess
MoveFileExW
IsProcessorFeaturePresent
IsDebuggerPresent
ExitThread
SearchPathW
SetErrorMode
GetSystemDefaultUILanguage
GlobalFlags
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetProfileIntW
GlobalGetAtomNameW
LocalFileTimeToFileTime
GetFileSizeEx
GetFileAttributesExW
SystemTimeToFileTime
ReplaceFileW
SetFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetThreadLocale
MoveFileW
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
SuspendThread
lstrcmpA
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
InitializeCriticalSectionAndSpinCount
EncodePointer
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetFileAttributesW
GetProcessId
SetThreadExecutionState
GetSystemDirectoryA
LoadLibraryExW
SetPriorityClass
RemoveDirectoryW
LocalAlloc
GetLocaleInfoW
GetLongPathNameW
TerminateThread
GetUserDefaultLCID
CreateThread
GetCurrentProcessId
CompareStringW
FindResourceExW
WideCharToMultiByte
QueryPerformanceCounter
GetFullPathNameW
GlobalSize
GetACP
GetLogicalDrives
SetCurrentDirectoryW
SetDllDirectoryW
GetDllDirectoryW
DeleteTimerQueueEx
CreateTimerQueue
GetDiskFreeSpaceW
GetCommandLineW
GetCurrentDirectoryW
GetSystemDirectoryW
GetFileTime
SetThreadPriority
GetTempFileNameW
GetVersion
IsDBCSLeadByteEx
FreeResource
FindClose
FindNextFileW
FindFirstFileW
SetLastError
FlushInstructionCache
CreateTimerQueueTimer
DeleteTimerQueueTimer
ResetEvent
SetEvent
CreateEventW
GetExitCodeProcess
WaitForSingleObject
lstrcpynW
GetUserDefaultLangID
GetCurrentThread
IsBadWritePtr
VirtualQuery
FormatMessageW
SetUnhandledExceptionFilter
FlushFileBuffers
WriteFile
CreateFileA
WaitForMultipleObjects
ResumeThread
GetDriveTypeW
OutputDebugStringA
DecodePointer
HeapSize
HeapDestroy
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
TerminateProcess
OpenProcess
GetWindowsDirectoryW
GetVolumeInformationW
GetSystemWindowsDirectoryW
GetQueuedCompletionStatus
ReadDirectoryChangesW
PostQueuedCompletionStatus
CreateIoCompletionPort
GetTempPathW
GetModuleHandleW
CreateNamedPipeW
WritePrivateProfileStringW
GetPrivateProfileStringW
GlobalFree
lstrcpyW
GetCurrentThreadId
WinExec
MulDiv
GetFileSize
ReadFile
SetFilePointer
CreateProcessW
WritePrivateProfileStringA
lstrcmpiW
GetTickCount
GetPrivateProfileIntW
DeviceIoControl
CreateFileW
GlobalMemoryStatusEx
GetProcessTimes
GetSystemTimeAsFileTime
GetSystemInfo
GetNativeSystemInfo
CopyFileW
LocalFree
VerifyVersionInfoW
VerSetConditionMask
OutputDebugStringW
GetVersionExW
GetUserDefaultUILanguage
LoadLibraryW
GetDiskFreeSpaceExW
GetLocalTime
GetFileAttributesW
CreateDirectoryW
GlobalUnlock
GlobalLock
GlobalAlloc
DeleteFileW
lstrcmpW
MultiByteToWideChar
lstrlenW
CloseHandle
VirtualProtect
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetModuleFileNameW
Sleep
GetCurrentProcess
FreeLibrary
RaiseException
InitializeCriticalSectionEx
GetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FindResourceW
LoadResource
LockResource
SizeofResource
LockFileEx

user32

CheckMenuItem
CheckMenuRadioItem
EnableMenuItem
GetDoubleClickTime
PostThreadMessageW
PostQuitMessage
GetCapture
DrawEdge
DrawFocusRect
IsWindowEnabled
MessageBeep
wsprintfA
CharUpperW
GetMenu
AdjustWindowRectEx
SetLayeredWindowAttributes
GetClassInfoW
SubtractRect
AppendMenuW
GetNextDlgTabItem
SetMenuInfo
SetMenuItemInfoW
GetWindowDC
GetMenuItemRect
GetMenuInfo
DrawFrameControl
SetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
GetMenuCheckMarkDimensions
DestroyIcon
LoadMenuW
CheckDlgButton
SetRectEmpty
UnionRect
ModifyMenuW
GetMenuItemInfoW
GetMenuItemID
GetMenuStringW
EnumChildWindows
GetDlgCtrlID
GrayStringW
DrawTextExW
TabbedTextOutW
MonitorFromPoint
MonitorFromRect
IsChild
CharNextW
RedrawWindow
CreateAcceleratorTableW
InvalidateRgn
GetDesktopWindow
DestroyAcceleratorTable
RemoveMenu
SetParent
GetClassLongW
SetClassLongW
DestroyCursor
MessageBoxW
UpdateWindow
GetClassInfoExW
RegisterClassExW
DestroyMenu
TrackPopupMenu
GetMenuItemCount
GetSubMenu
GetKeyState
GetWindow
GetTopWindow
GetClassNameW
GetWindowPlacement
EndDialog
EndPaint
BeginPaint
GetForegroundWindow
DialogBoxIndirectParamW
RemovePropW
SetPropW
GetPropW
SetDlgItemTextW
DispatchMessageW
TranslateMessage
PeekMessageW
FindWindowA
ShowScrollBar
IsProcessDPIAware
AnimateWindow
SetLastErrorEx
GetMenuState
GetAsyncKeyState
MapDialogRect
GetLastActivePopup
CreateDialogIndirectParamW
GetMessagePos
GetMessageTime
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
SetMenu
ValidateRect
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetCursor
EnumWindows
ChangeDisplaySettingsExW
EnumDisplaySettingsW
DeleteMenu
CreateMenu
GetActiveWindow
SetActiveWindow
ShowCursor
ExitWindowsEx
mouse_event
InsertMenuA
MapVirtualKeyW
GetKeyNameTextW
RegisterHotKey
LoadCursorFromFileW
UnregisterHotKey
IntersectRect
CharToOemBuffA
CharUpperA
OemToCharA
CharLowerA
CharToOemA
OemToCharBuffA
RegisterWindowMessageW
EnableWindow
PtInRect
IsRectEmpty
PostMessageW
DefWindowProcW
UnregisterClassW
GetClientRect
RegisterWindowMessageA
LoadCursorW
LoadIconW
RegisterClassW
GetWindowRect
GetWindowRgn
SetWindowRgn
GetDC
ReleaseDC
CopyRect
GetCursorPos
OffsetRect
SetCursor
IsWindow
IsWindowVisible
ClientToScreen
SetTimer
FindWindowW
SendMessageTimeoutW
ScreenToClient
SystemParametersInfoW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SendMessageW
GetSysColor
FillRect
GetSystemMetrics
GetParent
InvalidateRect
KillTimer
MoveWindow
SetRect
SetCapture
ReleaseCapture
MonitorFromWindow
wsprintfW
FindWindowExW
BringWindowToTop
UpdateLayeredWindow
GetWindowLongW
SetWindowLongW
TrackMouseEvent
CallWindowProcW
SetFocus
LoadImageW
CreateWindowExW
DestroyWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowPos
SetWindowTextW
ShowWindow
GetFocus
DrawIconEx
DrawTextW
InflateRect
LoadBitmapW
LoadAcceleratorsW
IsIconic
DrawIcon
IsDialogMessageW
GetMessageW
SendDlgItemMessageA
WindowFromPoint
TranslateAcceleratorW
CallNextHookEx
GetScrollRange
MapWindowPoints
SetScrollInfo
GetScrollInfo
SetWindowsHookExW
UnhookWindowsHookEx
CopyImage
EqualRect
GetCursorInfo
CreatePopupMenu
InsertMenuW
GetDlgItem
keybd_event
WinHelpW
SetMenuItemBitmaps
GetMonitorInfoW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
IsZoomed
IsClipboardFormatAvailable
SetWindowContextHelpId
ShowOwnedPopups
RegisterClipboardFormatW
NotifyWinEvent
GetSysColorBrush
RealChildWindowFromPoint
CopyAcceleratorTableW
GetSystemMenu
GetNextDlgGroupItem
GetMenuDefaultItem
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
LockWindowUpdate
DrawStateW
IsMenu
GetComboBoxInfo
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
SetCursorPos
CopyIcon
SetMenuDefaultItem
CharUpperBuffW
FrameRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
GetUpdateRect
wvsprintfW
EnumDisplayMonitors
EnumDisplayDevicesW

gdi32

PtInRegion
GetCurrentObject
GetClipBox
RestoreDC
SaveDC
SetMapMode
SelectPalette
RealizePalette
CopyMetaFileW
CreateDCW
CreateHatchBrush
GetObjectType
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
ExtSelectClipRgn
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
CreateBitmap
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
PatBlt
GetMapMode
SetRectRgn
DPtoLP
LPtoDP
GetTextColor
GetCharWidthW
CreatePalette
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesW
GetTextCharsetInfo
Polyline
SetPixelV
SetPaletteEntries
GetBoundsRect
CreatePolygonRgn
GetViewportOrgEx
GetTextFaceW
Polygon
GetBkColor
Ellipse
Escape
RectVisible
PtVisible
OffsetRgn
CombineRgn
Rectangle
CreatePen
StretchDIBits
CreateFontIndirectW
GetObjectA
CreateRectRgnIndirect
CreateRoundRectRgn
CreateEllipticRgn
CreatePatternBrush
GetDIBits
GetDIBColorTable
SetDIBColorTable
ExtTextOutW
SelectClipRgn
CreateDIBSection
SetBkMode
GetRgnBox
CreateDiscardableBitmap
StretchBlt
DeleteDC
GetTextMetricsW
SetBkColor
DeleteObject
CreateFontA
CreateFontW
SelectObject
SetTextCharacterExtra
GetTextExtentPoint32A
GetTextExtentPoint32W
TextOutA
TextOutW
BeginPath
CloseFigure
EndPath
GetPath
AbortPath
CreateRectRgn
GetDeviceCaps
GetObjectW
CreateDIBitmap
CreateSolidBrush
GetStockObject
BitBlt
GetPixel
RoundRect
CreateCompatibleDC
FillRgn
LineTo
MoveToEx
CreateHalftonePalette
GetPaletteEntries
GetTextExtentPointW
EnumFontFamiliesExW
ExcludeClipRect
FrameRgn
GetWindowOrgEx
SetPixel
SetTextColor
CreateCompatibleBitmap
ExtFloodFill

msimg32

TransparentBlt
GradientFill
AlphaBlend

comdlg32

GetSaveFileNameW
GetOpenFileNameW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
SetFileSecurityW
GetFileSecurityW
CryptHashData
CryptDestroyHash
CheckTokenMembership
CryptCreateHash
CryptReleaseContext
RegEnumKeyW
CryptAcquireContextW
CryptGetHashParam
RegSetValueExA
RegSetValueW
RegSetValueA
RegQueryValueExA
RegQueryValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCreateKeyA
RegFlushKey
RegQueryValueW
RegOpenKeyW
RegEnumValueW
RegQueryInfoKeyW
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegDeleteValueW
RegQueryValueExW
RegCreateKeyW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
SetFileSecurityA

shell32

SHGetDesktopFolder
SHGetSpecialFolderLocation
SHFileOperationW
SHGetFileInfoW
SHAppBarMessage
DragQueryPoint
SHChangeNotify
DragFinish
DragQueryFileW
DragAcceptFiles
Shell_NotifyIconW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHCreateDirectoryExW
ShellExecuteExW
ShellExecuteW
SHGetFolderPathW

comctl32

ImageList_Create
ImageList_Draw
ImageList_Add
_TrackMouseEvent
ImageList_AddMasked

shlwapi

UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathAddBackslashW
StrCmpLogicalW
PathFindFileNameW
PathFindExtensionW
PathRemoveFileSpecW
PathFileExistsW
StrFormatKBSizeW

uxtheme

GetThemeColor
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemePartSize
IsAppThemed
DrawThemeText
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
GetWindowTheme
GetCurrentThemeName
GetThemeSysColor

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
DoDragDrop
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoDisconnectObject
CoFreeUnusedLibraries
OleGetClipboard
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
CoInitializeEx
ReleaseStgMedium
OleDuplicateData
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemRealloc
CoGetObject
CoInitialize
OleLoadFromStream
OleSaveToStream
StgCreateDocfile
StgOpenStorage
MkParseDisplayName
CreateBindCtx
CoCreateGuid
StringFromCLSID
OleSetContainedObject
OleCreate
CoFreeLibrary
CoLoadLibrary
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleUninitialize
CoUninitialize
CreateStreamOnHGlobal
CoSetProxyBlanket
CoInitializeSecurity
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VarUI4FromStr
VariantCopy
LoadTypeLi
OleCreateFontIndirect
VarBstrFromDate
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SafeArrayCreateVector
SafeArrayUnaccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayDestroy
VariantInit
VariantClear
OleLoadPicturePath
SysFreeString
SysAllocString
LoadRegTypeLi
SysStringLen

oledlg

OleUIBusyW

urlmon

UrlMkSetSessionOption
UrlMkGetSessionOption

gdiplus

GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipGetLogFontW
GdipCreateFontFromLogfontW
GdipSetEmpty
GdipCombineRegionRectI
GdipGetRegionHRgn
GdipStringFormatGetGenericDefault
GdipAddPathLine
GdipAddPathArc
GdipCreateLineBrushFromRectI
GdipResetPath
GdipNewPrivateFontCollection
GdipGetFontCollectionFamilyCount
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipDeletePrivateFontCollection
GdipDrawImageRect
GdipLoadImageFromFile
GdipSetPenMode
GdipSetImageAttributesColorKeys
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipSetWorldTransform
GdipSetPenDashStyle
GdipSetPathFillMode
GdipTransformRegion
GdipIsVisibleRegionPointI
GdipSetStringFormatMeasurableCharacterRanges
GdipMeasureCharacterRanges
GdipGetRegionBounds
GdipScaleMatrix
GdipTransformPath
GdipAddPathPath
GdipSetMatrixElements
GdipWidenPath
GdipAddPathRectangle
GdipWarpPath
GdipLoadImageFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipRotateWorldTransform
GdipGetTextRenderingHint
GdipSetClipRegion
GdipGetClip
GdipCreateRegion
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageHeight
GdipDeleteRegion
GdipCreateBitmapFromGdiDib
GdipFree
GdipAlloc
GdipSetPathGradientSurroundColorsWithCount
GdipCreateBitmapFromStream
GdipFillPolygonI
GdipSetImageAttributesColorMatrix
GdipGetCompositingMode
GdipCreateBitmapFromFileICM
GdipGetImageHorizontalResolution
GdipCreateBitmapFromStreamICM
GdipDrawImageRectI
GdipGetInterpolationMode
GdipClosePathFigure
GdipAddPathLineI
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdipCreatePen2
GdipSetSolidFillColor
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateStringFormat
GdipFillPath
GdipDrawPath
GdipSetPenLineJoin
GdipGetPathWorldBounds
GdipAddPathString
GdipDeletePath
GdipCreatePath
GdipGraphicsClear
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipDrawLineI
GdipSetPenColor
GdipGetSmoothingMode
GdipGetGenericFontFamilySansSerif
GdipDrawImage
GdipDrawString
GdipDrawRectangleI
GdipFillRectangleI
GdipDeletePen
GdipCreatePen1
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipSetTextRenderingHint
GdipCreateFont
GdipCreateRegionRectI
GdipFillRectangle
GdipGetFontHeight
GdipGetStringFormatFlags
GdipSetStringFormatTrimming
GdipBitmapSetResolution
GdipSetStringFormatHotkeyPrefix
GdipSetStringFormatFlags
GdipGetImageRawFormat
GdipSetPathGradientCenterPointI
GdipFillEllipseI
GdipImageRotateFlip
GdipGetPixelOffsetMode
GdipSetCompositingMode
GdipGetPropertyItemSize
GdipGetImageEncoders
GdipBitmapGetPixel
GdipCreateImageAttributes
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromFile
GdipGetImageEncodersSize
GdipDisposeImageAttributes
GdipAddPathArcI
GdipDrawEllipseI
GdipCloneImage
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipResetWorldTransform
GdipSetPathGradientCenterColor
GdipTranslateWorldTransform
GdipSetSmoothingMode
GdipDrawImageRectRectI
GdipSaveImageToFile
GdipGetImageVerticalResolution
GdipGetPathGradientPointCount
GdipGetPropertyItem
GdipCreatePathGradientFromPath
GdipGetImageWidth
GdipCreateFontFamilyFromName
GdipMeasureString
GdipDeleteFont
GdipDeleteFontFamily
GdipDrawImageI
GdipDrawImagePointRectI
GdipCreateFromHDC
GdipCreateBitmapFromResource
GdiplusShutdown
GdiplusStartup

pdh

PdhCloseQuery
PdhAddCounterW
PdhCollectQueryData
PdhOpenQueryW
PdhRemoveCounter
PdhGetFormattedCounterValue

crypt32

CertGetNameStringW
CryptUnprotectData

psapi

GetProcessMemoryInfo

wininet

HttpOpenRequestW
InternetOpenW
InternetQueryOptionW
HttpSendRequestExW
InternetCrackUrlW
InternetReadFile
InternetConnectW
InternetWriteFile
HttpSendRequestW
InternetSetOptionW
HttpAddRequestHeadersW
HttpQueryInfoW
InternetGetConnectedState
InternetCanonicalizeUrlW
InternetGetCookieW
InternetCrackUrlA
InternetCreateUrlW
InternetSetCookieW
InternetCloseHandle
HttpEndRequestW
InternetSetCookieExW

ws2_32

getservbyport
ntohs
inet_ntoa
htonl
getservbyname
WSAGetLastError
WSASetLastError
gethostbyaddr
gethostname
WSAStartup
gethostbyname
connect
inet_addr
htons
socket
closesocket
ntohl
recv
send
WSAAsyncSelect
WSACleanup

iphlpapi

GetAdaptersInfo

imm32

ImmGetContext
ImmSetConversionStatus
ImmReleaseContext
ImmGetDefaultIMEWnd
ImmGetConversionStatus
ImmGetOpenStatus

wintrust

WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust
WTHelperProvDataFromStateData

winmm

mixerClose
mixerGetNumDevs
mixerGetID
mixerOpen
mixerGetLineControlsW
mixerGetDevCapsW
mixerGetLineInfoW
mixerSetControlDetails
mixerGetControlDetailsW
PlaySoundW
waveOutGetNumDevs

d3d9

Direct3DCreate9

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

Sections

.text
Size: 7.5MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 131KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.GOMSH
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 571KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f83789194cc1bbd6d02f2316edd6cf62

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

0b:08:b5:d8:e4:66:de:21:ea:e1:d2:a2:76:31:29:16Certificate

Extended Key Usages

Key Usages

b8:6b:57:a4:e9:c8:03:b1:09:54:8e:bd:33:04:1e:da:51:84:ef:3d:0c:e6:d6:6f:e7:f1:de:57:56:19:41:e2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

urlmon

gdiplus

pdh

crypt32

psapi

wininet

ws2_32

iphlpapi

imm32

wintrust

winmm

d3d9

version

oleacc

Sections

.text Size: 7.5MB - Virtual size: 7.5MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 131KB - Virtual size: 259KB

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.GOMSH Size: 512B - Virtual size: 12B

.rsrc Size: 4.4MB - Virtual size: 4.4MB

.reloc Size: 572KB - Virtual size: 571KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0b:08:b5:d8:e4:66:de:21:ea:e1:d2:a2:76:31:29:16
Certificate

b8:6b:57:a4:e9:c8:03:b1:09:54:8e:bd:33:04:1e:da:51:84:ef:3d:0c:e6:d6:6f:e7:f1:de:57:56:19:41:e2
Signer

.text
Size: 7.5MB - Virtual size: 7.5MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 131KB - Virtual size: 259KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.GOMSH
Size: 512B - Virtual size: 12B

.rsrc
Size: 4.4MB - Virtual size: 4.4MB

.reloc
Size: 572KB - Virtual size: 571KB