afb12b7ea652a15e47f7b7a58fb45739125605fbc0cfcd6c50f140a6b45ef0ea

Sharing

Copy URL Twitter E-mail

General

Target

afb12b7ea652a15e47f7b7a58fb45739125605fbc0cfcd6c50f140a6b45ef0ea
Size

4.7MB
MD5

38c0ae3fb8336c94da80a963a168caf2
SHA1

76e409c21a5e4eee927dead3139649e61e30061d
SHA256

afb12b7ea652a15e47f7b7a58fb45739125605fbc0cfcd6c50f140a6b45ef0ea
SHA512

dd18b158aa8e21751f4d6070228ca5371f8d9bf5f0361cb3fc31743e7ab5a6ae1cb25d0d5fd15550a0a6790367041afdbe28e53655e12d990dd0f14f720e879a
SSDEEP

98304:sPAmXL6A6+hvgyshrai3kFr6VJuncBZV+:Q52A3gyspaiVVJ/Zc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afb12b7ea652a15e47f7b7a58fb45739125605fbc0cfcd6c50f140a6b45ef0ea

Files

afb12b7ea652a15e47f7b7a58fb45739125605fbc0cfcd6c50f140a6b45ef0ea
.dll windows:5 windows x86 arch:x86

b012973091643069ba062ab935ca3646

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayRedim
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey

user32

MessageBoxA
CharNextW
LoadStringW
SetClassLongW
GetClassLongW
SetWindowLongW
GetWindowLongW
CreateWindowExW
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCaret
SetWindowRgn
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetCapture
SetActiveWindow
SendMessageA
SendMessageW
ScrollWindow
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OpenClipboard
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageA
IsDialogMessageW
IsChild
InvalidateRect
InsertMenuItemW
InsertMenuW
HideCaret
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageExtraInfo
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgCtrlID
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameW
GetClassInfoExW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EndMenu
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
CreateAcceleratorTableW
CopyImage
CopyIcon
CloseClipboard
ClientToScreen
CheckMenuItem
CharUpperBuffW
CharUpperW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BeginPaint
AdjustWindowRectEx
ActivateKeyboardLayout
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow

kernel32

Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
VerSetConditionMask
VerifyVersionInfoW
UnmapViewOfFile
UnlockFileEx
UnlockFile
TryEnterCriticalSection
SystemTimeToFileTime
SwitchToThread
SuspendThread
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
SetDllDirectoryW
ResumeThread
ResetEvent
ReadFile
RaiseException
QueryPerformanceCounter
PeekNamedPipe
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
MultiByteToWideChar
MulDiv
MapViewOfFile
LockResource
LockFileEx
LockFile
LocalFree
LoadResource
LoadLibraryA
LoadLibraryW
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapCompact
HeapAlloc
GlobalUnlock
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetWindowsDirectoryW
GetVersionExA
GetVersionExW
GetVersion
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetTempPathA
GetTempPathW
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetSystemTimes
GetStdHandle
GetProcessHeap
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameA
GetFullPathNameW
GetFileSize
GetFileAttributesExW
GetFileAttributesA
GetFileAttributesW
GetExitCodeThread
GetEnvironmentVariableW
GetDllDirectoryW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCPInfoExW
GetCPInfo
GetBinaryTypeW
GetACP
FreeResource
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageA
FormatMessageW
FlushFileBuffers
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumSystemLocalesW
EnumResourceNamesW
EnumCalendarInfoW
EnterCriticalSection
DisconnectNamedPipe
DeleteFileA
DeleteFileW
DeleteCriticalSection
CreateThread
CreateNamedPipeW
CreateMutexW
CreateFileMappingA
CreateFileMappingW
CreateFileA
CreateFileW
CreateEventW
ConnectNamedPipe
CompareStringA
CompareStringW
CloseHandle
AreFileApisANSI
Sleep

gdi32

UnrealizeObject
StretchDIBits
StretchBlt
StartPage
StartDocW
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SaveDC
RoundRect
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyBezierTo
PolyBezier
PlayEnhMetaFile
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectW
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
FrameRgn
ExtTextOutW
ExtFloodFill
ExcludeClipRect
EnumFontsW
EnumFontFamiliesExW
EndPage
EndDoc
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateICW
CreateHalftonePalette
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
Chord
BitBlt
ArcTo
Arc
AngleArc
AbortDoc

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize
IsEqualGUID

comctl32

InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Copy
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_SetOverlayImage
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

shell32

Shell_NotifyIconW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

winspool.drv

OpenPrinterW
EnumPrintersW
DocumentPropertiesW
ClosePrinter
GetDefaultPrinterW

msvcrt

localtime
qsort
strlen
strncmp
memset
memmove
memcpy
memcmp

Exports

Exports

A0oI0o75gpTO6eST6maZQgE
A2uO8jpBpazvanqj
AB9VCztWpDhw5N7n3rTuU1zlS7ZUfd
AP8M5LG2JU4Y9mnjZ
ASWRtiQenHu3kGvnlo
Ab8uroud2lkpBvB0CljGKzedSLrkIJ
AyzUNooF72fKV2nAvi
AzdvrYD7DjHs59z3qK
B02ggt4CbL5zYzXi8HEo2BRK
B1xaluZIkgfAjsVIwL
BBTpaWpHRup7FB4t6LTSUz
BIKHPIw5599GDfUvGv9dt
BJEF26ZnOFkqhLqCXfXNiZURFuBf
BSP4soDYXHcZnM0d2yMxiJ1
BZiihmFeAW1G5nIwul8
BrzxjOwS31SnDI3Sz5sgf7Jdl8YkE2
CBUbfWPYM5nn4CBkbQG
CD8gRBHSqQnUeLnOQ
CGPg579iLBjy58xRHOLc
CLcwSlNqYM8i8NNUx1
CWfN6a1qmMKKFFzDihWLvxR5
CWivr0gQhcsXUo0spsfeFFc
CgnKU7ebeyDc9zbBH1Qow9Yj7Sb
CrokNvpZS4fMTSIWdqMlT5P5
CtyLRuoNxxv4CBGZKv
CwtGSYcH23oSoguL4xbWwbgW8q5r
D6GGNPgPyl2tPkfh2WKVV3CGF6NM
DAetdbdR7yMAkfr6QmDIWWVJ
DDL9id7C6fkeqXbpWccUimaTbGE
DFacS0I06ZKRhHkq0A
DLttu0ceL7JNMV5q3On
DNvsi2nFKP86Om4LhmCT1bi
DYMHeVlJplUZPQlGihBB
DiEiW2DmyMuQ81qs3VgsMxH37egycIQ
Dvcq1S2DxHvJqF6zAH3bmaXUKuofP
E74iNhATzRwtan4Z
EAcUrwXbitbeo1BVCc
EBJ7VvWUkLnUZMW57pS8WBZy5R
ECdCDSYUrI9SklgdFX4De
EErLIbKESqQgWOzSFmvx2k
EKHMAjnm7KZEwVO9Ho
EQQnCo68xYU1BmzQJ3Uk
EgrrYWeuXrfVOf7Czbjuz3je
Em7KWq2uqrMzvRd29A
Erukpb2ityegaPPZ1hgK7KTId
EvsgEvD10QrqVLld9JqvZl4rHMluH2
ExGnuBKltctqlKuK5gn
ExK9VOAS7FsZOn7BQvh
ExjcCJfMucZr9qoPMSYkAILV0n8zeF
F33zb1l6TC8zXWoZ4AsDuIJvSStEyAH
F4NEG49UJ7qHp37wfUWFqitNRi3Dd6
FFxBs727yLI9nJ4ChNDb9ziT
FG715KcdkfwodkZtlsWm8FO7fAn
FRVUl3V4OHddmXKdxc
FSJcNM6Ewjj1kSs1Dq5D9
FWFmboHtVBKYvkPwrKWg
FYs09XImriiSFL7dd
Feb5cr4j4OUGqkkeu73RdLNgKNvmd
Ft5mMOUBJWuA4pbW7HtdHSpX
FwXVrfnNuid2W4qDJL
G1FJDmVFf2Z3WvBy0QsziKnghr
G2JcCKmx63sQvyJrsw
G3D07ZpHNCQR8S0ZI2q
GGlaOeklZnL3cpRZ5iuCWxUCQIxXiPf
GIPADlLrMYfEBJOrPD850QqnwD
GRS38VT5aogbANePzi9tNCCI4
GXnjUHa409I2p7wS0
GZaMNEKIqU4j8v94Nxofa1ppnGI0HQ
GwPzcyXIu66Pz9rMSBWgbX2
HLBzjrG3cBd1llkpx3ZFn1
HMTPMfHuKwveIhnC
HMoPXgXCKAELe5xaUWdpOZS6KLpa0
HP48Yc3J9GumcdZTDw3egDAG9A
HPQGxPObu6RaY2mZ1bjteuq
HT6tIW8QcfbsLVmJyxpxbv1t8t
HVo9vqfQPGKmgKAQWAzS960OQyB
HXSjlxGWC2ewFn7hrgELea
HZ1zdkCOWXpHn4ECascm2Xij3yjz
HZmOfKbhjz2EtXdwwhaygX
HoQBWZ43qS1SHQC2OlK5Cqx
Hook
HqXo9q8pTvQFAYEPv2uP8HPSoc7mr3u
HwG3pefckqGiohuXcBV9YTF8dL4et
IAlktmxEFoj3XtiilsgeWu1qTKfn8d
IDNOzeZn7SMNK6SuDYUJnat9Tpcsa
IKip1EFeGgPZtPCoWBaqWkMXmuLr2MW
ISYRxANgOP5huXjlD96D
IhXWQAymIAXjOxtRZDt5
Il1NWXbXlpSWcvCgMBXwls9xhldTjlA
Iob0tdyR0nlJnVCinQfSLLDZqOQ
IshUrxypgLP3CAVM0F
IuoT5P8CJJlk9dPgd5
J2WJy3xAzDeYG6SWIXbq
J6DZPOhU7m0qYfD4ryweHIiAp
J6dlen3f3GQCEBQvD1pN
JN3RPoTDdrmSFMKM6W
JOjsZT0q8FOFXGWMQFfk1ztfvI
JXakQrdepWzuITsF62b7kZ5WA2GEV
JbesZU1aIwLyEKGvIUr6NVXQ
Jg84pLnBX0Z6kX7UePvP91eWY
JhKlvPMTopqnYKVHAVOOjs
JvfhNDhOTnxCXBxRCSnaSd
K2SAnITXPLkF8i28JGGVqkpS2d0
K2ukpa8uY7NUwe6oJ
K3RdsxnCgWEHVtgr5zwf9mOtnA
K9lAmldSozSGhOtllzRerwFqnBP
KGRdjN6Mj0MhLy5OWcZx9
KICxjs3OYBIg8aWA
KPE7EXOiR5R5kpw47Tfd0mXrRQ80kqu
KU4aEYgo84ud9ol8fxJZZ7Usx
KbWRZM8k5l9HdpOvwTz9IzNLJw0KHL
KgEG6w22gq2Q0NoSAdn6hSPCPDuQ
L5EXmkkPAecI8A2DWQOWtT
L8RHHDNvlT3Ih67ij
LPxpHv2idz425EtVsy8iEEwfM
LdYhre6BruGoHrTG82yA
Lkz8Hw8hgqp6E7WVT
M6V65zokAncKwfrsNLyM
M7fYvEhpZPpE9tOGbGfmHKS819eKf
MFmU9ZS3dHiX9hKygo2gl0ZcNr
MQOI5BHDz8T1qNVw
MYhzan8sJijUHInnHNYf78
MopBWJIEd5kTlyI2RuZI
Mrj094zINxaETyuinM
MsaXBS3pAaWDi5hLlqkIav0aC
MsvU5PzUNZMIIR5EdWdI
MucqI6P8WsRlN6DXFRis3uVG3Z7GT6
N3kOhmWA1xEizbrKxnEKc7jgJ00F0e
NEHExSGJKlmduyQ7wcn5sglkIE0V8
NEpMgppMxtQdSboicW
NFZRm7JXvDUZ70hZbiFMO1jqGIwj8E
NMMnFVKaZiiRy58642Y
NUjBIcv4L44dTX9gLLUSIf
NdLg64mwAgiRuBqk4
NhTDADYYPCvCSJQzp6o
Nl9cG1MNp8xr2SxpPJlNwlPMJpmV
Nra46VNGqN44t9g4xogsU8YxdV6
NrtNOQEXsGWPa5JQ4XAomEco
NwBTCGRy2B6vt8szIKNAA1L4WFwg
O55ZnvJ8Q5eAbkeQPmBiqV
OBAzvrKlg1D5DWc5BOGw1KjIOA
OG9CMkM8OE4Rz9kMJYkLT2egYZjZqio
OVF6zN1ceEo9IniJxPaRXTxW83SnmV
OWJu1M0WOgR0f9CqJR7
OWpjYjW6bHTfzOkQSiw
OX3onnGrfiv0Ep0uEFDO
OaeNdNs3nwBWZO1mE5
Oasu6Wx8beAJlAB2C
OcX0AG7wWapxCtBE
OcfRb5yWvrgEZSOrOZvwkz9k3UlZ
P1JAcV2vvj4Awso7PhkG21w9bP
P8WpX3S8GKwX3UVDLNYMFoV2ml
PDvAiqRAYoKIctBM6kh5cbRYpJa
POcIrV3uaJiv66WGtCIbZI92SwDsR1
PTnTIgl3bMmVX8qJfYS
PUwTbXPRsLfTYbnIxwzrDDBs2Z5
PVlobHzTK1hz5LmxralMI
Pll97dkusNs2lqk0b1tJ
PrJuiTbdMAxne1JYOC5lArJxPd0d
Q2RBoTFvZuJC2i3oi1Nl2XoNO
QHOp5t6guJRv9nFQ
QHaK1F6tuvCzyGRwWH
QICvT0U9vVN0GXlMj10W0vB1tZf2
QOE1KXyH6soKZtrLJSV
QTfZgJ9PH4nGrlIg27ko9n6jKm3bF
QkDBN1kblQ1jW7jTn7MJE0mO
QvJrS7IDhQFFbHFOO2CO8qMB
QwB3t2uHSVFCKJlXCfs0ATuWw
Qzh4IHj9GmwHjXmchD3SskIWGk8uqt
R6GEvEJyvLYk6hUa
R6Gej7ftSJXHAbkMk90gLOgNk8d0K
RBBqcT01k8xhxAeM9aUrq
RBkad4MGSIAI38RJRMdoNfMS
RPZSJBEcb27QVPsywr4LHL8JFIYebD
RTAfRhIp6vm4r2Ibr46zwWibll
RWLpWp6I28ryZ90ME9iX7XfNtnhi
RbS3iGjoESGt7JPFBKz0jUEWEDq
Rk9pDUsfktiaejqE0UhqvKlHZDt
RktqfN9kye5JYU2eZFdsVFDkJapbh61
Rv5m6B74099yQDHcdS03aK8bSXYAa
S3GPKSFzgrqTnptAtCjzwNV0sk3
S3mLzyj42HQRDEAiE
SDJ5rlMM1twjE5iQqHS
SKNYEdFnm3gpEHKzmuxN54FPAgdPZqD
SLMLjJoYE07lkqAQARk8l8pHUl0HwZO
SLSV2gNfPghtK5uY4Ub
SQ7cTTR9PQLCUiX1nZNJC
SQjaJDXrmiwzPCpkqt38zetF1
SRdGnapNVXSkA5JamDROWC
SSvcxd4po4sIMULRrEm
SdGQMuUKQU6IHJlzpvnDemP8u2rE5
SjHCowLNa1mq2Kczb6qwSQ4jq
Sjp53InKOT1EdnpbN1Lh5WEjg5ylj
SkRv7hNApWHgK5dkQVV
SlQ2vGUViVmZw8PPhXE
SoXegfb9wYzr9lQ9T4wAOou
SrSJ5fCUa9npMFbBMM2K
Su3Qkh1coNvMP1G1cP3xKUJzX
Szni8lqhiByhmA0izVjqcQL9
T3ZhXXyLTmzVavmTPboha4VAI0DhH
T7Tlqn0ut7D0bmcwD7l
T9Be58pTJ1W8KN2jwlI2Gw89O
T9QVPTUOLfuHqancGfl1L
TFGmhhZSU5VpwmmyWY
TJra2KHkS0AwEUxpR
TKwTKbI0wr9b2V9gFGwGM38
TLdXDAZaiN0Zdp5fhTrnLS0Q2wAFV1q
TMethodImplementationIntercept
TQ1JGQeZkli3hBN71Gsfp7X6
Ta7rnDqCA67AZeODLhHWi4
TmisMxqIxF4kXxiYX44l8xEErM
Tt9FJV6PMvmx8hkI6JjsFVEODg
Tu2vgGJRUxbtRhuN8taW4ASY3oWz
TuWkzOe1VxHupDoTPfMBDYf
U0UZki6nade5SW18mitY4YS5oCl
U2xqHepuSPccXgYK5
U9pWgLUBYByKOxqe86cnIFRDnseH
UChhogCLhl7BgP1XfMCJF9
UKXlNr3BwbarlPE7ekXPVz
UMlE7EEzvVAec9O88IYxiNefB7GY0
UaGuyf5poTEVmrxHKWI
UbkTp0uowYeTc4zTyVicldqskzHilZ
UdIiaBlBeF9zhUlDmxZSRjMx
UgMbgSzmT4l2TGLWZ3TM
UjuEpcXaYThJBt6aD4xvNeJ6r
UlI4beXrPgnnaHPH1Khcjd02v7
UnHook
UrcWFt0rlhhrtNVIDCbLThPEeS0
UtlTpyjyDtBoZoR116Pu7Yo3tGOk
Uu067hsfYurpRAz0uL9XkVjoZ
VDtx2UYad3AsAE01gj
VSBsVmtccUCcwAWlOzZ4
VSEplWzESDsGo2RwDBST9lomf1
VSfwrFPXG4ceWlFD38foQqum5aC7ymC
VWDXhp3Sjygpnoe1Qo2HIcXSXzYSP
VZ8eyIlk7UoVUHQLrVz
VdPVBUkbrvJaNJWAEY6ZRnXdWv
Vsvx0J6D3GfJtAsQ
Vu2JiM2Wej8avh4nOGU7z
W686kt0LsjyAHYrMaO4UMK
W9QGqo9IeMI69Z7Zl1mwzLtDUgWo0rw
W9ec6h61MaMliSWnbPnUoGcxrXozET
WGb8WtnpE0Ee4Tc0fXswaHPTQz5tb
WIytv1gFk0IVZMsc6D
WKJ6poDylJT7eFW7tXCFFhYA
WPEBoh0NXJkhu7xB3s2Svpp
WSz2yyRvaKVWbc3lOxuaLOthFTV
WZoeutZxi3Bdbkah
WamU9KQ5ALkmePYFqjfe
WxbDKlOAX0MeG6vhaTXDaNnO84db
X00gpQmUcIiCV8apUtBlNpWchsdBsa
X62Jb1Z3UShMyYfYFId0R8m
X9rE9C4jW0g8e5QHc9Tv0U
XDyiE8AcnMzhWc3gkjL9VMg3
XFOxo4T6qrH43QDCCXBDN
XbRzTATqdbS2aeha8GsHkxe
Xg8LAnFXVa97KrBT8WQ4s1hmmf3lyW
XnRPgmBB0yuPjY1G2e83NJt3ALQvr
Xph3btsLvQCAdAzcrJGkpvuzmNNmt6
Y6msrL55nBw7aWWx4
YAxfU8UvISuT52vcXjghCRQHS
YJgh7ouE3UdKPmq6KUe
YOGjUlnqe02RtapJeh
YOnVVLCoip3hu20CIH4WG
YPgC6JcYN82w4FCjWBjAHiMcUqT6zh
YQar2NrpI4DIbB2C08M7TKV7uecc4
YQfA7oZvMvAcvssMqhLA8CxpZZak837
YQh55ljXo79SQwnWGMBO
YVL4jThmGMEEmcivOkaKvst2b
YXL88sl0aMOXYlQd6qvufX
Yb6xsxDAQ5cQKosDEpALJWRrZ
Ye7o1F07QdZJYE4qBxLs9zeVwfEJ
YsvxUyvS0Zn8OE1ktoTIQyy3Xs
YyuxPJFT3pqPYAPHdHU4LwN
Z99SBZYklSoYRcwkFjM
ZNeW3NVZqEMFY54qk
ZXWxvuy2zpm6Ig9S5QtEGt6IPOYR
ZYk8QFjAogbFxl8HJnNgS5CaxANgSk
ZlhJBJJWgoaMxcMXyXQ
ZoGhqAOLtV8tFKY4eGw0Gu3
a1yemIWqlUdIdtjOElOS93Aboih
a2oDvGhbUa2lHMFiUpPuOHlLBSKity
a5dgOVWiDvaO7xzA3dBPrqQqvuUM6ts
a6ZHTy81QpihWfoaTKZPd9XST
aMYA1yL6bRw4kZS4hHuMc
aTd506wMTiTjoelHuKE2f6Ohe7B38
agA8LbnCPvtKmip4b2ksPenB5p0u
ahzs7W54RbsWp7R2X
aqxayt7QiblDV3f7R9
avKvUVcpZLAcuszcl5QhK1lBBpGX
b031bEmKc71VpqCHWUi2tT
b2cq7oK0bkrs6HPdn
b4bNjGmH1hMJlEQ33M4GE98egjpgJr
bB8tlh1u1lVCcFmxH0O3XSVQiv6S
bE7ripI6wKv5uU8mXUhxVMP7sv8II
bJiztNEK592Q4sVhktBm54qsdxT
bJy7nr9SYTNK8T4ha28
bMWVL58nAMF2yKxTK174TZF7DZ3t
bUeoShIWeJkBr0Bgz
bV1KnV1bWj42Bncv2GGajDa
bfZsjmGnQiQL92bro4H1
brYWsOOrstv2TwogENkYtTsTO0kJ2s
bxDKQSJFoSkVebHn9svItpqTVsJge0
c1DJvdGmUsXghzuToQbEPtnJRqsimh
c863lFZYluTAzwTF1q0UceC2RVQ
cKeHZ5reEBSqRShbK1iZh81eYAr
cUYQ067gCDn6A2uuiVUg
cXa6UjBQvD8PRHOP2g3
cZEvMAwrMZCaBpA4kYdxRVnxMKeGad
cabRpalQplCFxUv3ibpZye85Z0budnf
cjRkQ6lbhCPwDZy05MVkszzdw5fJI3t
crpTlKaQskkIT8rfr
cxtvYAmVs386iACOOvVThcXuHCi23Fs
d0s7SGLucd3XuPE3WP8R3YAnfnt
d1nDvzBmiDXx7s2SzCIiCbVe8I
d2HtoOeyxtmZxerLo2sseIuWG
dL2QDp118ZNApp9fws3kJoTjfY0TdS
dM2Eq7fGCJTvoFKqF9N6hktGA
dOOimjOxsQGrEa656LPPiQuHrgTt9
dRnictp63NPUDytMJxjdbkWtGP0uDu
dUNih4jzugK8OWVcqoQCcPJxO7x
dW8wtiGW9VZm2mA9WZaCl7sq
da9H7xk1SGyn58O2HkqAiNX8
ddxYpdNXIEGt3uh5DX6YYDaCCPFg
di8iG6SaMJIbwiQg2
du9keJqcDtelA6oxdhSJzOAQ
duZ6mNQFeM792uRbq10jvz2dPUnk
dvmKoUJzbyxh1mn7Y5PHP4n0N54
eCqsc907bnSbPqSY8FlTWfhY0T3MwJ1
eDaebV7TyeYOE59b7W
ea3zTwdnYTiw3kVyvVhYtoJtFi
ebNZkB7lNtN8PbhI
eoMdEze1AxCm1LoGVS6k
epWkn7ImBMRYUSTaEgq6RDSVNyuJN
evKz1EFijmUwyPnp
exFXOSZjInROd7Zhe4UYVSEj
f16B39YKufir3njwUgy
f2UJ8afS1AImCEWddAYnfBJ8nj
fC3vSXKkICmVPNbo9MJ5
fCCYwzeq2QYGVKdO7rNHOZwr1eeOT6
fGDTN4RWlBzc20DyqLN
fKg9VuiuUtY58pMO9izhxNPSbpQ
fPsJUfpBMrvCGYkMRlI9Epfio9qut
fXel6il68yp35QaTPAIuogBE
fZJhecXHW2nxA4kSmziZwb
fdbaI0XWSmqxyYVIM9SF7WvEdmtycw
ffgmpJxS8hbFxEtLRCjwhaGOql
fmTTRSSEbd5ZZKGiWl
fnrGviTlidhZfRBSY
fq7eqjc4wGPrnocWGAl54
fsZ5SIO3Jibh30a0npZhctO8v2SAw0x
fxPbEpv6LrZyY77t11nxkJEkHWLex
g0IOzBvp6kH4DLKTjhkjQoJus7fKh
g8pvn8RPSyvgBUNCc3dpICZIkXf6Ru6
gFmIKdulpPjXKD3cpu4Z
gJl0oyeKr2uM49WXSb1QbB
gNE2zhz3mM6LzMuXOAWBpLI
gQbC3cWv3aHlUF8S5wCCpvDgg
gUdjDb2Y3TwKKLT1wuUrwPUZvGPlq
gW1xuvmV4HoyasPP37cawjt
gah1Vcp1WvcODJyYXToXo3YHG
geqWQeu9zhxBhZGLXxUFvF68k5
ghTiZSHXBxlIaUgY9fAMd
guV9Rz7cx1FuRBzMSB
gzSPbcRNeaDTkvElwcdOGHErtCu
h2Den0b0rNVyvQVkY5P7bEuY2
h59X9kFSC6ZTuenSXAXxQQuUQ
hBYREobmJ48TVnU3yUK8eVtM
hTaTDHSaacX8buHzhZQQ9
hauMCCjURFMfWHiPtU3mH2Ng3wx
hhZp2C7ukTaHhzbIjMeUqBcE9k
hkXT0WilqIvzDv2liCk9
hkeqFeJ0i6kdavtYi2emSbQcwzP
hsQzttNPFHNn77XA0IQ56dO
i2paFnvhoZzC8EJho
i5yhBFp1xqCmn1zp0VemVooK4Lac7c
iDKnfEBIIVcFj5DIla688
iOUI04WnMT2PiMoxNa9gt
iOwlwCCfLR5LP78gBb4OX9z
iWMiyxfSaJ931KDM
irqGP5KDmQZStp16GtRdIfPa
ixmhSNuAJdPiLK5EyRmUATpsoq
j0lT7uAsK8f0ibXVZvJZb7x
j3toXNDII6HCKYNcgjaJLg
j4t8HgLksC2biMFw3ZN5pZnaO
j5GeBn74YVirG5MZZFoOzmEO0iZq
jDKpWqnYfsqcwppOS1ZGmx9Yam
jGYHq1yxSTtUt7JPjSy6BkvhLXoyRIX
jIKHfGStSPQL468hPy4vk
jNl8yoWWsYgyddlWomXzeKCgmImASyL
jXLSWAAqhNu0S1LT
jcGhio3yZfDOEPDC
jekZr2QX7miJ97AbHc9LuSbzy0
jgdyhumfKgZWnDXWefk7PSswA29u
jiaxiOmle9VsaJb6K06u1Kn5AcnBqq
jk2wVi3GFSXXjOGNZT
jks9gBtrrB1I8qrvGNgm51C3Nlv
jn3Nq7VHh2UstuDEWDaS54p3
jy42qdYlExNPyq2kKRAa
kEKjr6Qug7ym8x3WklLIzHDL
kHMwGmn56usvZGVlFtrBds3lv
kHv6WxS0X8jeUCs74f5151Qn3TW
kIyr19M2UU9lUFMsHqSK
kS6lVEGcjkVNIOciYPUQjz3y
kVBKcDCtYup6fqKxGKWRy
kWKPSZczwdlLWKG605adzi8rIyoN
keorEityXxM6sAHb8jSFs6G0l
l4CH9Puty1T1W6Nq
l5Uq8Z6xMsUH2OBcP7Q8Ry
lCRM0SkWRO1k9TcS1tkGq2T
lFMRPJrZRXv3eBmgk9DRyzi
lQUIhQ9v6IIuyzI95aeGZRn
lQn7oJzLmlZRkNxxMYAxg
lVp6jfHdUMo3yoyYl
lalTwsrbTSoPs7yLE1BV
lkAnOqdJ2nSQVOIQwbu2wOO9fg
lkfh4r5lN0A4oQFab
lr0Os4naxQUykSUk6xBi5Q0p6l3v
lsggFfCFZdjXIvZiU9g0MO
m3HU4fwuKgoDWkQwZ
mHywleuQGGZeMWzbj0or2ez1Q6tUG
mKZ7fxlwEt4zqwNmQt
mOcYw0U2GYWsVadtxnIxRwN
mOlgni3gtSckPIdRyNAQD8B
mP2VUOwShIA2Ci2CO3nDI
mTxTynVmCduV9jiUtDcQa7YDYLQp
mVRn98QzoyZGzXx8cRdYabEegQ
magIQ1isiT7rxuoE3L8H60uYktF
mdWoqD0Mcl7KGKJIpwPvT
mdc8u9k5hpxyjOTqL0mzHK
mj5S5CiVQgLnJWQot
mlpGrnjw6eyBl7R9UOFGxV9Mp
monSc2zTSDmRIiypHjq2
mu4u24HUcdKrf5RM
n0Rz6sFIaSUDVcsxIFo3gr8FND
n3UWv3GY1587WGZBaensgw
n94Sktr1EeLDe47I7Lb3eascPxJIUJ
n9IcEVy25W7UnvTeO0TmeYr6kRdcLAZ
nGCwVR6q1BP4xhR9SY441
nIHmleJSItCEBGx71
nSMgtcbgijZG73rASvThR
nUuZVIJDe2lSuE6bhQu4pdf36Lv
nWqWXHHgyIpTZwpnhHsqHzCOBegWJ44
nZ5AoDUDS18rIzQT4VKMr1b9
nfuSzpTn0e3avJ55Pe3yADs1oJ
nhxWcRi0WFZWdBRIyFRlLcVos17JI
njvMPBcNlRS4vl3DBQRlqF7eYUEHxu
nxbSN53u4fcelb2eFIQJED2y
nyZDTrzANLUnqTbbT0zcuS
o7iyoH8JYXXHEjL3H9YkeurbiF
oI4dRD3xFkQxxMG1F13YA4
oShsHbfQmPowdYO3Fav
ob6KicMmtyDl3WSjtU
odqZLxq3Lt8zSqSs6s
osVJ2l4GGvJQYZZEf22yQhaZuBLC9
pA5Y0tWUv1jtcxR5
pBLBOEkfsp5jxAKoKrg1NyJR
pYLD5olW03B1HUrmwuksMeRkClCAc
pZ81HdkbXfXfh39APsl3H
piP7fT1UdzDdyL6SuX2a
pkC0vra9H1WbG5rArs
pneEvzDOLhGPywPb2mFRbTh7mKVc
ppQuKi5FKn2UaYzuu2tKo0A
q7OgWYAxw1BeilvgC54
qAo21feGSJeiJVBcqhAVoIJPoLF
qDez6eFoIyqDMLw5MPAkt7
qIu58xE1TOkgUjDnGKZaTDv
qS3v5F00Zu5tz65v2CfZxEcDPaAAxz
qrQANmtgvLoNIrQkE6q9fl4
r16OPNJwu4PgxWp5McTqnhG2N
r26dSiTHXf9h8beSkzovRC3Fk
rLHUvdfwxrsVSWCvX7XFDg
rU1YInz0IXxlv8S2I1ne
rVfnoHPPiIB6rsscnKUTVXouBOstgsr
rXEuMh93LiepRmDi7cyV4M0go
rZ3A3e9TDiu3rLuI7jdAiyvvW5qM
rgYgft3KCbbVYItGcHNuOlAosgjR6
rkOvdZB5F0L2mCtymOgmJaK
rtk9a2mSsLHc26rDCd96KJ
ryv5YBMV4gwaWy2H30jDAU6bL
s2UDlEvjORF4GONv5xsgllV8pXoV1
s6nmPIddLW0kfYGgbwkTDi7X
s7WL1xPFm7DITC8utV13j
sKtpZGG1xdqg0odbdTIehi4XaA3Jz
sM89WaJr3M3G77gaBVB6Ru
sT3Yi0wfAAh0t6j59JfYs
sYEun7kvVmLHj5AobwpwufDAQc6B
sgyYAhv9WxIKNFpGYB6bse
siz5lekRlyabRBsz051DQywoziqR
slZ4IXc4pNApNmps4YxT5hoXXkl
tVyXtpGiE7fr9wMDq8RKG6OF7d
tbAID2kf7tl8DrQc1F1wBQBKUjY
tkcfvZru70vPp5Tc
tmSvsGbZ1rwlruNSBSBdNOscoZnJAQ
tqLngCCru9bBOJ3MNVv
uF5NtZVCUSSQdANJxEbkevaCWb
uQv4nQAjcJQxTJfE2DCJ9L
udGbrV97wc5kJiXdHsN1PSfBud4
uflSGTe2g73y2loAzPNADmCDziiw
uofz9Yxo23YeUBu2E

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 23KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 322KB - Virtual size: 322KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b012973091643069ba062ab935ca3646

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

gdi32

version

ole32

comctl32

shell32

winspool.drv

msvcrt

Exports

Exports

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.itext Size: 8KB - Virtual size: 8KB

.data Size: 80KB - Virtual size: 79KB

.bss Size: - Virtual size: 23KB

.idata Size: 15KB - Virtual size: 15KB

.didata Size: 2KB - Virtual size: 2KB

.edata Size: 19KB - Virtual size: 19KB

.rdata Size: 512B - Virtual size: 69B

.reloc Size: 322KB - Virtual size: 322KB

.rsrc Size: 59KB - Virtual size: 59KB

.text
Size: 4.2MB - Virtual size: 4.2MB

.itext
Size: 8KB - Virtual size: 8KB

.data
Size: 80KB - Virtual size: 79KB

.bss
Size: - Virtual size: 23KB

.idata
Size: 15KB - Virtual size: 15KB

.didata
Size: 2KB - Virtual size: 2KB

.edata
Size: 19KB - Virtual size: 19KB

.rdata
Size: 512B - Virtual size: 69B

.reloc
Size: 322KB - Virtual size: 322KB

.rsrc
Size: 59KB - Virtual size: 59KB