796824b4240d8ec77e739d4611a79ceda4a9b618143b2c6a3d0d12f20053e1f3

Sharing

Copy URL Twitter E-mail

General

Target

796824b4240d8ec77e739d4611a79ceda4a9b618143b2c6a3d0d12f20053e1f3
Size

4.5MB
MD5

f3e7e0f26f7b44239f025e014ff7f67f
SHA1

6ee448271f8716547147674ced00c9c89c8270dc
SHA256

796824b4240d8ec77e739d4611a79ceda4a9b618143b2c6a3d0d12f20053e1f3
SHA512

1a590c313b56bd04e8f945650a13600c9eddc4bc33f252fd7eb8a7cf42ae285de906c93265e962229326dd24279db658351e7fff6446536e374a74c12f33915d
SSDEEP

49152:uTs++X5VAMPLfOyim8XTyNow3xGzSzio9+aXtvIA2SuaAmNJgp33bk+fZJ8mj5n4:WuVAwiiQGiobtv2wNJgh3o+fZJ8mjc

Score

1^/10

Malware Config

Signatures

Files

796824b4240d8ec77e739d4611a79ceda4a9b618143b2c6a3d0d12f20053e1f3
.dll regsvr32 windows:10 windows x86 arch:x86

77014880f4fa768206ab911f825c6092

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ae:1b:a3:0f:d3:b7:8f:f5:9d:8b:e6:1a:a1:a1:22:6c:64:ad:d5:c6:2d:28:99:e4:7a:a8:27:7e:14:25:3e:88
Signer

Actual PE Digest

ae:1b:a3:0f:d3:b7:8f:f5:9d:8b:e6:1a:a1:a1:22:6c:64:ad:d5:c6:2d:28:99:e4:7a:a8:27:7e:14:25:3e:88

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

wininet.pdb

Imports

msvcrt

_amsg_exit
_initterm
_except_handler4_common
_lock
_unlock
__dllonexit
_onexit
strchr
memmove
_XcptFilter
wcsncmp
bsearch
memcpy_s
_itoa_s
wcsstr
_atoi64
malloc
iscntrl
_wcsnicmp
wcschr
tolower
_vscwprintf
_itow_s
wcstok_s
qsort
_wtoi
memmove_s
_itow
_strnicmp
_strlwr
memcpy
memcmp
memchr
_ftol2
ispunct
isalnum
isspace
isalpha
isxdigit
isdigit
__isascii
strncmp
_vsnwprintf
iswdigit
strcspn
wcscpy_s
?terminate@@YAXXZ
_wcslwr_s
__CxxFrameHandler3
strpbrk
wcsrchr
_vsnprintf
_stricmp
_wcsicmp
_purecall
free
wcsncpy_s
memset

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
VirtualFree
VirtualAlloc

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemDirectoryW
GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
CreateEventExA
ResetEvent
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
CreateMutexExW
CreateSemaphoreExW
ReleaseMutex
OpenSemaphoreW
WaitForSingleObjectEx
TryAcquireSRWLockExclusive
CreateEventW
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockExclusive
SetEvent
WaitForSingleObject
CreateEventA
InitializeCriticalSection
ReleaseSRWLockShared
WaitForMultipleObjectsEx
AcquireSRWLockExclusive
AcquireSRWLockShared
DeleteCriticalSection
InitializeCriticalSectionEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW
LoadStringW
LoadStringA
GetModuleHandleExA
FreeLibrary
LoadLibraryExA
GetProcAddress
FreeLibraryAndExitThread
GetModuleHandleExW
LoadLibraryExW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapDestroy
HeapSize

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
InitializeConditionVariable
Sleep

api-ms-win-core-file-l1-1-0

CreateFileA
SetFileAttributesW
GetDriveTypeW
GetFileSizeEx
FindFirstFileW
GetVolumeInformationW
WriteFile
SetFilePointer
CreateFileW
FindNextFileW
GetFileSize
GetVolumePathNameW
GetDiskFreeSpaceExW
RemoveDirectoryW
GetLongPathNameW
FindFirstFileExW
GetShortPathNameW
GetFileAttributesW
CompareFileTime
GetFileAttributesExW
GetDiskFreeSpaceExA
SetFileInformationByHandle
CreateDirectoryW
GetFileTime
SetEndOfFile
ReadFile
FindClose
DeleteFileW
SetFilePointerEx

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWrite
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessageVa

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegGetValueA
RegGetValueW
RegDeleteValueW
RegOpenCurrentUser
RegCloseKey
RegOpenKeyExW
RegNotifyChangeKeyValue
RegDeleteTreeW
RegCreateKeyExW
RegQueryValueExA
RegSetValueExA
RegDeleteTreeA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyExA
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalAlloc
LocalFree
GlobalAlloc

api-ms-win-core-localization-l1-2-0

IsDBCSLeadByte
FormatMessageA
IsValidCodePage
GetCPInfoExW
FormatMessageW
IdnToUnicode
IdnToAscii
GetLocaleInfoW
GetCPInfo
IsDBCSLeadByteEx

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
OpenThreadToken
OpenProcessToken
GetCurrentProcess
GetCurrentProcessId
CreateThread
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
SwitchToThread
ProcessIdToSessionId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-datetime-l1-1-0

GetTimeFormatA
GetDateFormatA

api-ms-win-core-string-l2-1-0

CharLowerW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
TrySubmitThreadpoolCallback
WaitForThreadpoolWaitCallbacks
CallbackMayRunLong
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWait
FreeLibraryWhenCallbackReturns
CreateThreadpoolWait
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
SetThreadpoolWait
CloseThreadpoolWork
CreateThreadpoolWork
StartThreadpoolIo
CloseThreadpoolIo
WaitForThreadpoolTimerCallbacks
CancelThreadpoolIo
CreateThreadpoolIo

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime
GetNativeSystemInfo
GetProductInfo

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-io-l1-1-0

GetOverlappedResult
GetQueuedCompletionStatus
PostQueuedCompletionStatus
DeviceIoControl
CreateIoCompletionPort

api-ms-win-core-file-l2-1-0

MoveFileExW
CreateHardLinkW

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-security-appcontainer-l1-1-0

GetAppContainerNamedObjectPath

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-0

SetFileCompletionNotificationModes
GetComputerNameW
MoveFileW
WTSGetActiveConsoleSessionId

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-shlwapi-legacy-l1-1-0

PathAddBackslashA

api-ms-win-core-stringansi-l1-1-0

CharUpperA
CharNextA
CharLowerA

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrA
StrToIntA
StrCmpNA
StrChrA
StrCmpICA
StrChrNW
StrCmpNICA
StrCmpNICW
StrChrW
StrStrIA
StrRChrW
StrCmpNIW
StrCmpNIA
StrStrIW
StrRChrA

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiA
lstrcmpW
lstrcmpA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock
GlobalReAlloc

api-ms-win-core-url-l1-1-0

PathCreateFromUrlW
UrlCanonicalizeA
UrlCombineA
UrlCombineW
UrlCanonicalizeW
UrlUnescapeA

api-ms-win-http-time-l1-1-0

InternetTimeFromSystemTimeW
InternetTimeToSystemTimeA
InternetTimeToSystemTimeW
InternetTimeFromSystemTimeA

ntdll

NtQueryInformationToken
RtlQueryPackageClaims
RtlGetDeviceFamilyInfoEnum
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlFreeSid
RtlGetAppContainerParent
RtlGetAppContainerSidType
NtQueryLicenseValue
RtlInitUnicodeString
RtlGetPersistedStateLocation
RtlGetLastNtStatus
RtlReportExceptionEx
NtSetInformationFile
NtSetInformationObject
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlIpv6AddressToStringExA
RtlIpv6AddressToStringA
RtlIpv4AddressToStringA
RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExA
RtlIpv4StringToAddressExA
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlNtStatusToDosError
NtQueryWnfStateData
NtClose
NtQueryVolumeInformationFile
NtCreateFile
RtlPublishWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlGetVersion

kernelbase

GetIsEdpEnabled
SubscribeEdpEnabledStateChange
UnsubscribeEdpEnabledStateChange
GetIsWdagEnabled
SubscribeWdagEnabledStateChange
UnsubscribeWdagEnabledStateChange
GetPackageSecurityContext
GetPackageSecurityProperty

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

AppCacheCheckManifest
AppCacheCloseHandle
AppCacheCreateAndCommitFile
AppCacheDeleteGroup
AppCacheDeleteIEGroup
AppCacheDuplicateHandle
AppCacheFinalize
AppCacheFreeDownloadList
AppCacheFreeGroupList
AppCacheFreeIESpace
AppCacheFreeSpace
AppCacheGetDownloadList
AppCacheGetFallbackUrl
AppCacheGetGroupList
AppCacheGetIEGroupList
AppCacheGetInfo
AppCacheGetManifestUrl
AppCacheLookup
CommitUrlCacheEntryA
CommitUrlCacheEntryBinaryBlob
CommitUrlCacheEntryW
CreateMD5SSOHash
CreateUrlCacheContainerA
CreateUrlCacheContainerW
CreateUrlCacheEntryA
CreateUrlCacheEntryExW
CreateUrlCacheEntryW
CreateUrlCacheGroup
DeleteIE3Cache
DeleteUrlCacheContainerA
DeleteUrlCacheContainerW
DeleteUrlCacheEntry
DeleteUrlCacheEntryA
DeleteUrlCacheEntryW
DeleteUrlCacheGroup
DeleteWpadCacheForNetworks
DetectAutoProxyUrl
DispatchAPICall
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
FindCloseUrlCache
FindFirstUrlCacheContainerA
FindFirstUrlCacheContainerW
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryExA
FindFirstUrlCacheEntryExW
FindFirstUrlCacheEntryW
FindFirstUrlCacheGroup
FindNextUrlCacheContainerA
FindNextUrlCacheContainerW
FindNextUrlCacheEntryA
FindNextUrlCacheEntryExA
FindNextUrlCacheEntryExW
FindNextUrlCacheEntryW
FindNextUrlCacheGroup
ForceNexusLookup
ForceNexusLookupExW
FreeUrlCacheSpaceA
FreeUrlCacheSpaceW
FtpCommandA
FtpCommandW
FtpCreateDirectoryA
FtpCreateDirectoryW
FtpDeleteFileA
FtpDeleteFileW
FtpFindFirstFileA
FtpFindFirstFileW
FtpGetCurrentDirectoryA
FtpGetCurrentDirectoryW
FtpGetFileA
FtpGetFileEx
FtpGetFileSize
FtpGetFileW
FtpOpenFileA
FtpOpenFileW
FtpPutFileA
FtpPutFileEx
FtpPutFileW
FtpRemoveDirectoryA
FtpRemoveDirectoryW
FtpRenameFileA
FtpRenameFileW
FtpSetCurrentDirectoryA
FtpSetCurrentDirectoryW
GetProxyDllInfo
GetUrlCacheConfigInfoA
GetUrlCacheConfigInfoW
GetUrlCacheEntryBinaryBlob
GetUrlCacheEntryInfoA
GetUrlCacheEntryInfoExA
GetUrlCacheEntryInfoExW
GetUrlCacheEntryInfoW
GetUrlCacheGroupAttributeA
GetUrlCacheGroupAttributeW
GetUrlCacheHeaderData
GopherCreateLocatorA
GopherCreateLocatorW
GopherFindFirstFileA
GopherFindFirstFileW
GopherGetAttributeA
GopherGetAttributeW
GopherGetLocatorTypeA
GopherGetLocatorTypeW
GopherOpenFileA
GopherOpenFileW
HttpAddRequestHeadersA
HttpAddRequestHeadersW
HttpCheckDavCompliance
HttpCloseDependencyHandle
HttpDuplicateDependencyHandle
HttpEndRequestA
HttpEndRequestW
HttpGetServerCredentials
HttpGetTunnelSocket
HttpIndicatePageLoadComplete
HttpIsHostHstsEnabled
HttpOpenDependencyHandle
HttpOpenRequestA
HttpOpenRequestW
HttpPushClose
HttpPushEnable
HttpPushWait
HttpQueryInfoA
HttpQueryInfoW
HttpSendRequestA
HttpSendRequestExA
HttpSendRequestExW
HttpSendRequestW
HttpWebSocketClose
HttpWebSocketCompleteUpgrade
HttpWebSocketQueryCloseStatus
HttpWebSocketReceive
HttpWebSocketSend
HttpWebSocketShutdown
IncrementUrlCacheHeaderData
InternetAlgIdToStringA
InternetAlgIdToStringW
InternetAttemptConnect
InternetAutodial
InternetAutodialCallback
InternetAutodialHangup
InternetCanonicalizeUrlA
InternetCanonicalizeUrlW
InternetCheckConnectionA
InternetCheckConnectionW
InternetClearAllPerSiteCookieDecisions
InternetCloseHandle
InternetCombineUrlA
InternetCombineUrlW
InternetConfirmZoneCrossing
InternetConfirmZoneCrossingA
InternetConfirmZoneCrossingW
InternetConnectA
InternetConnectW
InternetConvertUrlFromWireToWideChar
InternetCrackUrlA
InternetCrackUrlW
InternetCreateUrlA
InternetCreateUrlW
InternetDial
InternetDialA
InternetDialW
InternetEnumPerSiteCookieDecisionA
InternetEnumPerSiteCookieDecisionW
InternetErrorDlg
InternetFindNextFileA
InternetFindNextFileW
InternetFortezzaCommand
InternetFreeCookies
InternetFreeProxyInfoList
InternetGetCertByURL
InternetGetCertByURLA
InternetGetConnectedState
InternetGetConnectedStateEx
InternetGetConnectedStateExA
InternetGetConnectedStateExW
InternetGetCookieA
InternetGetCookieEx2
InternetGetCookieExA
InternetGetCookieExW
InternetGetCookieW
InternetGetLastResponseInfoA
InternetGetLastResponseInfoW
InternetGetPerSiteCookieDecisionA
InternetGetPerSiteCookieDecisionW
InternetGetProxyForUrl
InternetGetSecurityInfoByURL
InternetGetSecurityInfoByURLA
InternetGetSecurityInfoByURLW
InternetGoOnline
InternetGoOnlineA
InternetGoOnlineW
InternetHangUp
InternetInitializeAutoProxyDll
InternetLockRequestFile
InternetOpenA
InternetOpenUrlA
InternetOpenUrlW
InternetOpenW
InternetQueryDataAvailable
InternetQueryFortezzaStatus
InternetQueryOptionA
InternetQueryOptionW
InternetReadFile
InternetReadFileExA
InternetReadFileExW
InternetSecurityProtocolToStringA
InternetSecurityProtocolToStringW
InternetSetCookieA
InternetSetCookieEx2
InternetSetCookieExA
InternetSetCookieExW
InternetSetCookieW
InternetSetDialState
InternetSetDialStateA
InternetSetDialStateW
InternetSetFilePointer
InternetSetOptionA
InternetSetOptionExA
InternetSetOptionExW
InternetSetOptionW
InternetSetPerSiteCookieDecisionA
InternetSetPerSiteCookieDecisionW
InternetSetSecureLegacyServersAppCompat
InternetSetStatusCallback
InternetSetStatusCallbackA
InternetSetStatusCallbackW
InternetShowSecurityInfoByURL
InternetShowSecurityInfoByURLA
InternetShowSecurityInfoByURLW
InternetTimeFromSystemTime
InternetTimeFromSystemTimeA
InternetTimeFromSystemTimeW
InternetTimeToSystemTime
InternetTimeToSystemTimeA
InternetTimeToSystemTimeW
InternetUnlockRequestFile
InternetWriteFile
InternetWriteFileExA
InternetWriteFileExW
IsHostInProxyBypassList
IsUrlCacheEntryExpiredA
IsUrlCacheEntryExpiredW
LoadUrlCacheContent
ParseX509EncodedCertificateForListBoxEntry
PrivacyGetZonePreferenceW
PrivacySetZonePreferenceW
ReadUrlCacheEntryStream
ReadUrlCacheEntryStreamEx
RegisterUrlCacheNotification
ResumeSuspendedDownload
RetrieveUrlCacheEntryFileA
RetrieveUrlCacheEntryFileW
RetrieveUrlCacheEntryStreamA
RetrieveUrlCacheEntryStreamW
RunOnceUrlCache
SetUrlCacheConfigInfoA
SetUrlCacheConfigInfoW
SetUrlCacheEntryGroup
SetUrlCacheEntryGroupA
SetUrlCacheEntryGroupW
SetUrlCacheEntryInfoA
SetUrlCacheEntryInfoW
SetUrlCacheGroupAttributeA
SetUrlCacheGroupAttributeW
SetUrlCacheHeaderData
ShowCertificate
ShowClientAuthCerts
ShowSecurityInfo
ShowX509EncodedCertificate
UnlockUrlCacheEntryFile
UnlockUrlCacheEntryFileA
UnlockUrlCacheEntryFileW
UnlockUrlCacheEntryStream
UpdateUrlCacheContentPath
UrlCacheCheckEntriesExist
UrlCacheCloseEntryHandle
UrlCacheContainerSetEntryMaximumAge
UrlCacheCreateContainer
UrlCacheFindFirstEntry
UrlCacheFindNextEntry
UrlCacheFreeEntryInfo
UrlCacheFreeGlobalSpace
UrlCacheGetContentPaths
UrlCacheGetEntryInfo
UrlCacheGetGlobalCacheSize
UrlCacheGetGlobalLimit
UrlCacheReadEntryStream
UrlCacheReloadSettings
UrlCacheRetrieveEntryFile
UrlCacheRetrieveEntryStream
UrlCacheServer
UrlCacheSetGlobalLimit
UrlCacheUpdateEntryExtraData
UrlZonesDetach
_GetFileExtensionFromUrl

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wpp_sf
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

77014880f4fa768206ab911f825c6092

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

ae:1b:a3:0f:d3:b7:8f:f5:9d:8b:e6:1a:a1:a1:22:6c:64:ad:d5:c6:2d:28:99:e4:7a:a8:27:7e:14:25:3e:88Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-appcontainer-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-stringansi-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-http-time-l1-1-0

ntdll

kernelbase

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.wpp_sf Size: 79KB - Virtual size: 78KB

.data Size: 1KB - Virtual size: 14KB

.idata Size: 12KB - Virtual size: 12KB

.didat Size: 1KB - Virtual size: 1KB

.rsrc Size: 129KB - Virtual size: 129KB

.reloc Size: 82KB - Virtual size: 82KB

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

ae:1b:a3:0f:d3:b7:8f:f5:9d:8b:e6:1a:a1:a1:22:6c:64:ad:d5:c6:2d:28:99:e4:7a:a8:27:7e:14:25:3e:88
Signer

.text
Size: 4.2MB - Virtual size: 4.2MB

.wpp_sf
Size: 79KB - Virtual size: 78KB

.data
Size: 1KB - Virtual size: 14KB

.idata
Size: 12KB - Virtual size: 12KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 129KB - Virtual size: 129KB

.reloc
Size: 82KB - Virtual size: 82KB