c01b3525fc8957a1c8ffd5c73924fdafaf4b9a7ec4e2d7e82bc021b688aaeec8

Sharing

Copy URL Twitter E-mail

General

Target

c01b3525fc8957a1c8ffd5c73924fdafaf4b9a7ec4e2d7e82bc021b688aaeec8
Size

1.9MB
MD5

319106e633d97e2bcbbfa3d0eb93944c
SHA1

da8a2861008235870f340db46a64f15b626fab50
SHA256

c01b3525fc8957a1c8ffd5c73924fdafaf4b9a7ec4e2d7e82bc021b688aaeec8
SHA512

e8c798ba5b0bba65286519ff09590097abe07c15e44c2e1d66ba8377ba9999f3ce0800668b5069ef303756cbd27dc540fc4c94c1ab6237bfbebae2151e4c2bdf
SSDEEP

49152:373K+UfuII1cpSkPHtyVqcy69ALYs56KG6hhbsIycj:GlfuIfVSy6iLZ5Ljdj

Score

9^/10

Malware Config

Signatures

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
static1/unpack001/W10_Digital_Activation_Program_1.5.5.3/W10DigitalActivation.exe	Nirsoft
static1/unpack001/W10_Digital_Activation_Program_1.5.5.3/W10DigitalActivation_x64.exe	Nirsoft

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/W10_Digital_Activation_Program_1.5.5.3/W10DigitalActivation.exe
unpack001/W10_Digital_Activation_Program_1.5.5.3/W10DigitalActivation_x64.exe

Files

c01b3525fc8957a1c8ffd5c73924fdafaf4b9a7ec4e2d7e82bc021b688aaeec8
.zip
W10_Digital_Activation_Program_1.5.5.3/W10DigitalActivation.exe
.exe windows:4 windows x86 arch:x86

a8be0e8f11419d3a7188a2c487d6a286

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
HeapCreate
GetEnvironmentVariableW
GetUserDefaultLangID
HeapDestroy
ExitProcess
SystemTimeToFileTime
LocalFileTimeToFileTime
FindResourceW
LoadResource
LockResource
SizeofResource
CreateToolhelp32Snapshot
CloseHandle
GetLogicalDriveStringsW
QueryDosDeviceW
FileTimeToLocalFileTime
FileTimeToSystemTime
ExpandEnvironmentStringsW
GetCurrentProcess
GetSystemDefaultLangID
MultiByteToWideChar
GetProcAddress
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
GetCurrentProcessId
OpenProcess
GetLastError
FormatMessageW
GetVolumeInformationW
FindFirstFileW
FindNextFileW
FindClose
WideCharToMultiByte
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
CreateProcessW
Process32FirstW
Process32NextW
Beep
CreateFileW
CreateSemaphoreW
DeviceIoControl
GetCommandLineW
GetComputerNameW
GetDateFormatW
GetDiskFreeSpaceExW
GetExitCodeProcess
GetFileTime
GetPrivateProfileStringW
GetShortPathNameW
GetSystemDirectoryW
GetSystemPowerStatus
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetWindowsDirectoryW
GlobalMemoryStatus
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
SetComputerNameW
SetFileTime
SetLastError
SetSystemTime
SetVolumeLabelW
Sleep
TerminateProcess
WritePrivateProfileStringW
InitializeSListHead
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStdHandle
WriteFile
GetModuleFileNameW
FreeLibrary
GetModuleHandleExW
EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
HeapFree
GetCurrentThread
HeapAlloc
EnumSystemLocalesW
LoadLibraryExW
CompareStringW
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
GetLocaleInfoW
GetTempPathW
GetTimeFormatW
InitializeCriticalSectionAndSpinCount
IsValidLocale
LCMapStringW
OutputDebugStringW
GetFileType
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
IsValidCodePage
GetCommandLineA
FindFirstFileExW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableW
SetConsoleCtrlHandler
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
ReadFile
ReadConsoleW
SetFilePointerEx
WriteConsoleW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
EncodePointer
RaiseException
InitializeCriticalSection
CreateThread
GetTickCount
DuplicateHandle
CreatePipe
PeekNamedPipe
GetFileSize
SetFilePointer
SetEndOfFile
LoadLibraryW
DeleteFileW
GetVersionExW
GetDriveTypeW
GetFileAttributesW
SetCurrentDirectoryW
CreateDirectoryW
SetFileAttributesW
RemoveDirectoryW
CopyFileW
MoveFileW
MulDiv
GetLocalTime
GlobalFree
GlobalAlloc
SetEvent
CreateEventA
LoadLibraryA
ReleaseSemaphore
GetFileInformationByHandle
CreateFileA
ResetEvent
SetThreadPriority
UnregisterWait
RegisterWaitForSingleObject
DecodePointer
GetFileSizeEx

user32

OemToCharW
GetSysColor
GetDlgCtrlID
CallWindowProcW
SetWindowLongW
GetWindowLongW
GetClientRect
FillRect
GetClassNameW
GetWindow
SetWindowPos
InvalidateRect
SendMessageW
EnableWindow
IsWindowEnabled
RedrawWindow
SetClassLongW
GetClassLongW
GetWindowRect
OffsetRect
IsRectEmpty
MapWindowPoints
SubtractRect
IsWindow
GetParent
GetDC
ReleaseDC
BeginPaint
EndPaint
DefWindowProcW
GetAsyncKeyState
KillTimer
GetCursorPos
ScreenToClient
SetTimer
DrawTextW
FrameRect
InflateRect
FindWindowW
FindWindowExW
DrawFrameControl
EnumWindows
GetWindowThreadProcessId
GetForegroundWindow
SetCursorPos
AnimateWindow
AttachThreadInput
BlockInput
ChangeDisplaySettingsW
CharToOemW
CreateWindowExW
DrawMenuBar
EnableMenuItem
EnumDisplaySettingsW
ExitWindowsEx
FlashWindow
GetDesktopWindow
GetFocus
GetKeyState
GetLastInputInfo
GetSystemMenu
GetSystemMetrics
GetWindowTextW
LoadCursorW
LockWorkStation
MessageBeep
PostMessageW
RegisterHotKey
RemoveMenu
SetFocus
SetForegroundWindow
ShowWindow
UnregisterHotKey
UpdateWindow
WaitForInputIdle
keybd_event
mouse_event
MessageBoxW
IsWindowVisible
DestroyWindow
SystemParametersInfoW
SetWindowTextW
GetWindowTextLengthW
MoveWindow
GetIconInfo
ReleaseCapture
DrawStateW
SetCapture
SetRect
SetCursor
GetMessagePos
RemovePropW
GetPropW
SetPropW
SetScrollPos
GetWindowDC
ClientToScreen
GetSysColorBrush
EnumPropsExW
SetActiveWindow
DestroyIcon
LoadIconW
IsZoomed
IsIconic
RegisterClassW
AdjustWindowRectEx
UnregisterClassW
CreateAcceleratorTableW
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DefFrameProcW
EnumChildWindows
DestroyAcceleratorTable
TrackPopupMenu
IsChild
SetMenu
DestroyMenu
RegisterWindowMessageW
DrawIconEx
CopyImage
CreateIconFromResourceEx
CreateIconFromResource
CharUpperW
CharLowerW

gdi32

CreatePen
CreateSolidBrush
SelectObject
DeleteDC
DeleteObject
CreatePatternBrush
CreateRoundRectRgn
GetPixel
CreateCompatibleDC
SetBkMode
SetTextColor
SelectClipRgn
BitBlt
GetStockObject
RoundRect
SetDCBrushColor
SetBrushOrgEx
CreateDCW
CreateCompatibleBitmap
CreateFontIndirectW
GetObjectType
GetObjectW
GetTextExtentPoint32W
CreateRectRgnIndirect
TextOutW
MoveToEx
LineTo
ExcludeClipRect
SetBkColor
GetClipRgn
ExtSelectClipRgn
GetDeviceCaps
SelectPalette
RealizePalette
GetDIBits
SetPixelV
Rectangle
Ellipse
SetStretchBltMode
StretchDIBits
StretchBlt
SetROP2
ExtFloodFill
SetTextAlign
GetTextMetricsW
GdiGetBatchLimit
GdiSetBatchLimit
CreateDIBSection
CreateBitmap
SetPixel
CreateFontW
CreateRectRgn

advapi32

RegOpenKeyExW
RegOpenKeyW
RegConnectRegistryW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
LookupAccountNameW
IsValidSid
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
LookupAccountSidW
GetSidSubAuthorityCount
GetSidSubAuthority
ChangeServiceConfigW
CloseServiceHandle
ControlService
CreateProcessAsUserW
CryptAcquireContextW
CryptCreateHash
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptHashData
CryptReleaseContext
DuplicateTokenEx
GetLengthSid
GetSecurityInfo
GetUserNameW
ImpersonateLoggedOnUser
LogonUserW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
RegEnumValueW
RevertToSelf
SetSecurityInfo
SetTokenInformation
StartServiceW

oleaut32

SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetElement

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateGuid
StringFromGUID2
RevokeDragDrop
OleUninitialize
OleInitialize

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
ExtractIconExW
ExtractIconW
ord66
ord524
SHAddToRecentDocs
SHFileOperationW
SHFormatDrive
SHGetFileInfoW
ShellAboutW
Shell_NotifyIconW
ShellExecuteExW

ws2_32

WSAStartup
gethostbyname
WSACleanup
gethostbyaddr
inet_addr
closesocket
gethostname
htons
select
__WSAFDIsSet
ioctlsocket
recvfrom
socket
connect
recv
bind

winmm

timeBeginPeriod

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree

icmp

IcmpCloseHandle
IcmpCreateFile
IcmpSendEcho

imagehlp

MapFileAndCheckSumW
MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo
GetNetworkParams

msi

ord45
ord70

netapi32

NetApiBufferFree
NetLocalGroupAdd
NetLocalGroupDel
NetLocalGroupEnum
NetUserDel
NetUserGetInfo
NetUserSetInfo

setupapi

SetupIterateCabinetW

urlmon

URLDownloadToFileW
UrlMkSetSessionOption

userenv

GetDefaultUserProfileDirectoryW

uxtheme

SetWindowTheme

wininet

DeleteUrlCacheEntryW
InternetCloseHandle
InternetGetConnectedState
InternetOpenUrlW
InternetOpenW
InternetReadFile
UnlockUrlCacheEntryFileW

winspool.drv

ClosePrinter
DeletePrinter
OpenPrinterW
SetPrinterW

wintrust

WinVerifyTrust

comctl32

InitCommonControlsEx
ImageList_Replace
ImageList_Add
ImageList_ReplaceIcon
ImageList_Remove
ImageList_AddMasked
ImageList_Destroy
ImageList_Create

Sections

.code
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 947KB - Virtual size: 947KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

'.text'
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1008KB - Virtual size: 1020KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
W10_Digital_Activation_Program_1.5.5.3/W10DigitalActivation_x64.exe
.exe windows:5 windows x64 arch:x64

250e2205effe1708f8778d3c50f7b9fe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memset
setlocale
memcpy
log10
_wfopen
fseek
fclose
wcscmp
memmove
wcslen
wcscpy
wcscat
memcmp
strlen
strcpy
strcat
_stricmp
strncpy
fmod
fread
longjmp
setjmp
malloc
free
_wcsicmp
wcsncmp
wcsncpy
_snwprintf
tolower
floor
_gmtime64
_localtime64
_mktime64
_wcsnicmp
_itow
sqrtf
abs
fmodf
ftell
pow
??3@YAXPEAX@Z
wcsstr
_wcsdup
frexp
modf
fopen
_errno
strerror
abort
atof
fflush
fwrite
exit
sprintf
__iob_func
fprintf
ferror
getenv
sscanf
_vsnwprintf
sinf
cosf
ceil

kernel32

GetModuleHandleW
HeapCreate
GetEnvironmentVariableW
GetUserDefaultLangID
HeapDestroy
ExitProcess
SystemTimeToFileTime
LocalFileTimeToFileTime
FindResourceW
LoadResource
LockResource
SizeofResource
CreateToolhelp32Snapshot
CloseHandle
GetLogicalDriveStringsW
QueryDosDeviceW
FileTimeToLocalFileTime
FileTimeToSystemTime
ExpandEnvironmentStringsW
GetCurrentProcess
GetSystemDefaultLangID
MultiByteToWideChar
GetProcAddress
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
GetCurrentProcessId
OpenProcess
GetLastError
FormatMessageW
GetVolumeInformationW
FindFirstFileW
FindNextFileW
FindClose
WideCharToMultiByte
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
CreateProcessW
Process32FirstW
Process32NextW
Beep
CreateFileW
CreateSemaphoreW
DeviceIoControl
GetCommandLineW
GetComputerNameW
GetDateFormatW
GetDiskFreeSpaceExW
GetExitCodeProcess
GetFileTime
GetPrivateProfileStringW
GetShortPathNameW
GetSystemDirectoryW
GetSystemPowerStatus
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetWindowsDirectoryW
GlobalMemoryStatus
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
RtlZeroMemory
SetComputerNameW
SetFileTime
SetLastError
SetSystemTime
SetVolumeLabelW
Sleep
TerminateProcess
WritePrivateProfileStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateThread
HeapAlloc
HeapFree
FreeLibrary
LoadLibraryExW
GetCurrentThreadId
GetModuleFileNameW
DuplicateHandle
CreatePipe
GetStdHandle
PeekNamedPipe
ReadFile
SetEnvironmentVariableW
HeapReAlloc
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
TlsAlloc
TlsSetValue
GetTickCount
TlsGetValue
LoadLibraryW
DeleteFileW
GetVersionExW
GetDriveTypeW
GetFileAttributesW
SetCurrentDirectoryW
CreateDirectoryW
SetFileAttributesW
RemoveDirectoryW
GetTempPathW
GetLongPathNameW
CopyFileW
MoveFileW
MulDiv
GetLocalTime
GlobalFree
GlobalAlloc
HeapSize
TlsFree
DeleteCriticalSection
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject

user32

OemToCharW
GetSysColor
GetDlgCtrlID
CallWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
FillRect
GetClassNameW
GetWindow
SetWindowPos
InvalidateRect
SendMessageW
EnableWindow
IsWindowEnabled
RedrawWindow
SetClassLongPtrW
GetClassLongPtrW
GetWindowRect
OffsetRect
IsRectEmpty
MapWindowPoints
SubtractRect
IsWindow
GetParent
GetDC
ReleaseDC
BeginPaint
EndPaint
DefWindowProcW
GetAsyncKeyState
KillTimer
GetCursorPos
ScreenToClient
SetTimer
DrawTextW
FrameRect
InflateRect
FindWindowW
FindWindowExW
DrawFrameControl
EnumWindows
GetWindowThreadProcessId
GetForegroundWindow
SetCursorPos
AnimateWindow
AttachThreadInput
BlockInput
ChangeDisplaySettingsW
CharToOemW
CreateWindowExW
DrawMenuBar
EnableMenuItem
EnumDisplaySettingsW
ExitWindowsEx
FlashWindow
GetDesktopWindow
GetFocus
GetKeyState
GetLastInputInfo
GetSystemMenu
GetSystemMetrics
GetWindowTextW
LoadCursorW
LockWorkStation
MessageBeep
PostMessageW
RegisterHotKey
RemoveMenu
SetFocus
SetForegroundWindow
ShowWindow
UnregisterHotKey
UpdateWindow
WaitForInputIdle
keybd_event
mouse_event
LoadIconW
RegisterClassExW
MessageBoxW
IsWindowVisible
DestroyWindow
SystemParametersInfoW
SetWindowTextW
GetWindowTextLengthW
MoveWindow
GetIconInfo
ReleaseCapture
DrawStateW
SetCapture
SetRect
SetCursor
GetMessagePos
RemovePropW
GetPropW
SetPropW
SetScrollPos
GetWindowDC
ClientToScreen
GetSysColorBrush
EnumPropsExW
SetActiveWindow
DestroyIcon
IsZoomed
IsIconic
RegisterClassW
AdjustWindowRectEx
UnregisterClassW
CreateAcceleratorTableW
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DefFrameProcW
DestroyAcceleratorTable
EnumChildWindows
IsChild
RegisterWindowMessageW
DrawIconEx
CopyImage
CreateIconFromResourceEx
CreateIconFromResource
CharUpperW
CharLowerW

gdi32

CreatePen
CreateSolidBrush
SelectObject
DeleteDC
DeleteObject
CreatePatternBrush
CreateRoundRectRgn
GetPixel
CreateCompatibleDC
SetBkMode
SetTextColor
SelectClipRgn
BitBlt
GetStockObject
RoundRect
SetDCBrushColor
SetBrushOrgEx
CreateDCW
CreateCompatibleBitmap
CreateFontIndirectW
GetObjectType
GetObjectW
GetTextExtentPoint32W
CreateRectRgnIndirect
TextOutW
MoveToEx
LineTo
ExcludeClipRect
SetBkColor
GetClipRgn
ExtSelectClipRgn
GetDeviceCaps
SelectPalette
RealizePalette
GetDIBits
SetPixelV
Rectangle
Ellipse
SetStretchBltMode
StretchDIBits
StretchBlt
SetROP2
ExtFloodFill
SetTextAlign
GetTextMetricsW
GdiGetBatchLimit
GdiSetBatchLimit
CreateDIBSection
CreateBitmap
SetPixel
CreateFontW

advapi32

RegOpenKeyExW
RegOpenKeyW
RegConnectRegistryW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
LookupAccountNameW
IsValidSid
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
LookupAccountSidW
GetSidSubAuthorityCount
GetSidSubAuthority
ChangeServiceConfigW
CloseServiceHandle
ControlService
CreateProcessAsUserW
CryptAcquireContextW
CryptCreateHash
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptHashData
CryptReleaseContext
DuplicateTokenEx
GetLengthSid
GetSecurityInfo
GetUserNameW
ImpersonateLoggedOnUser
LogonUserW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
RegEnumValueW
RevertToSelf
SetSecurityInfo
SetTokenInformation
StartServiceW

oleaut32

SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetElement

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateGuid
StringFromGUID2
RevokeDragDrop

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
ExtractIconExW
ExtractIconW
ord66
ord524
SHAddToRecentDocs
SHFileOperationW
SHFormatDrive
SHGetFileInfoW
ShellAboutW
Shell_NotifyIconW
ShellExecuteExW

ws2_32

WSAStartup
gethostbyname
WSACleanup
gethostbyaddr
inet_addr
closesocket
gethostname
htons
select
__WSAFDIsSet
ioctlsocket
recvfrom
socket
connect
recv
bind

winmm

timeBeginPeriod

msimg32

AlphaBlend

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY

icmp

IcmpCloseHandle
IcmpCreateFile
IcmpSendEcho

imagehlp

MapFileAndCheckSumW
MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo
GetNetworkParams

msi

ord45
ord70

netapi32

NetApiBufferFree
NetLocalGroupAdd
NetLocalGroupDel
NetLocalGroupEnum
NetUserDel
NetUserGetInfo
NetUserSetInfo

setupapi

SetupIterateCabinetW

urlmon

URLDownloadToFileW
UrlMkSetSessionOption

userenv

GetDefaultUserProfileDirectoryW

uxtheme

SetWindowTheme

wininet

DeleteUrlCacheEntryW
InternetCloseHandle
InternetGetConnectedState
InternetOpenUrlW
InternetOpenW
InternetReadFile
UnlockUrlCacheEntryFileW

winspool.drv

ClosePrinter
DeletePrinter
OpenPrinterW
SetPrinterW

wintrust

WinVerifyTrust

comctl32

InitCommonControlsEx
ImageList_Replace
ImageList_Add
ImageList_ReplaceIcon
ImageList_Remove
ImageList_AddMasked
ImageList_Destroy
ImageList_Create

Sections

.code
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 422KB - Virtual size: 422KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 905KB - Virtual size: 916KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
W10_Digital_Activation_Program_1.5.5.3/readme_en.txt
W10_Digital_Activation_Program_1.5.5.3/readme_ru.txt

Sharing

General

Malware Config

Signatures

Files

a8be0e8f11419d3a7188a2c487d6a286

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

oleaut32

ole32

shell32

ws2_32

winmm

gdiplus

icmp

imagehlp

iphlpapi

msi

netapi32

setupapi

urlmon

userenv

uxtheme

wininet

winspool.drv

wintrust

comctl32

Sections

.code Size: 86KB - Virtual size: 85KB

.text Size: 947KB - Virtual size: 947KB

'.text' Size: 512B - Virtual size: 21B

.rdata Size: 118KB - Virtual size: 118KB

.gfids Size: 512B - Virtual size: 448B

.00cfg Size: 512B - Virtual size: 8B

.data Size: 1008KB - Virtual size: 1020KB

.rsrc Size: 71KB - Virtual size: 70KB

250e2205effe1708f8778d3c50f7b9fe

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

advapi32

oleaut32

ole32

shell32

ws2_32

winmm

msimg32

gdiplus

icmp

imagehlp

iphlpapi

msi

netapi32

setupapi

urlmon

userenv

uxtheme

wininet

winspool.drv

wintrust

comctl32

Sections

.code Size: 140KB - Virtual size: 139KB

.text Size: 422KB - Virtual size: 422KB

.rdata Size: 73KB - Virtual size: 72KB

.pdata Size: 23KB - Virtual size: 22KB

.data Size: 905KB - Virtual size: 916KB

.rsrc Size: 71KB - Virtual size: 70KB

.code
Size: 86KB - Virtual size: 85KB

.text
Size: 947KB - Virtual size: 947KB

'.text'
Size: 512B - Virtual size: 21B

.rdata
Size: 118KB - Virtual size: 118KB

.gfids
Size: 512B - Virtual size: 448B

.00cfg
Size: 512B - Virtual size: 8B

.data
Size: 1008KB - Virtual size: 1020KB

.rsrc
Size: 71KB - Virtual size: 70KB

.code
Size: 140KB - Virtual size: 139KB

.text
Size: 422KB - Virtual size: 422KB

.rdata
Size: 73KB - Virtual size: 72KB

.pdata
Size: 23KB - Virtual size: 22KB

.data
Size: 905KB - Virtual size: 916KB

.rsrc
Size: 71KB - Virtual size: 70KB