TdmService[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

TdmService.exe
Size

4.9MB
MD5

0c979cd330a5d024f9994b2437bd1f56
SHA1

63a28f402b473b22e16f903097661b821f7bcaee
SHA256

96212a94b534aec00ade327531a5983abd0a6647cb5f907227980a04d2627505
SHA512

5754f27f850d9875040bb25485a8d3883700218fd8153cfefbd348b2281e9ccf02fd555d451318702b46b20b57e9193df544dfca9df116a5d5bb5da909cfa720
SSDEEP

49152:1cgkA4ABmKr5J1VrdQCb5rMo2Z8NL0aIw8SaB0Zs6MnvPds7o92mNfbkhHHJxU8k:1eMhb5wljHoHRb66pT6dx

Score

1^/10

Malware Config

Signatures

Files

TdmService.exe
.exe windows:5 windows x64 arch:x64

faee63a50c046eb8396fdfa63542f5f5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4a:9b:9c:b7:1d:02:27:44:e7:5a:07:1b:cf:69:cc:c6
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/11/2010, 00:00

Not After

04/11/2013, 23:59

Subject

CN=Wave Systems Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Wave Systems Corp.,L=Lee,ST=Massachusetts,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f9:4e:54:11:6a:49:af:71:50:03:09:51:14:87:d1:3e:f0:88:ae:02
Signer

Actual PE Digest

f9:4e:54:11:6a:49:af:71:50:03:09:51:14:87:d1:3e:f0:88:ae:02

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\Program Files (x86)\Draco.NET Service\Source\TDM_50_PRO\source\TdmService\bin\VS2008\x64\Release_pro\TdmService.pdb

Imports

wtsapi32

WTSQueryUserToken
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

wcr10

WCR_Uninitialize
WCR_Initialize
WCR_Crc32Compute
WCR_AesDecrypt
WCR_SuperUpdateParameters
WCR_StreamCreateOnBuffer
WCR_StreamPosition
WCR_Sha256Compute
WCR_Sha1Compute
WCR_StreamDestroy
WCR_RsaCreateFromX509
WCR_AesCreate
WCR_RsaDestroy
WCR_AesEncrypt
WCR_RandomBytes
WCR_Pbkdf2Compute
WCR_RsaPublicEncrypt
WCR_StringToByteArray
WCR_SuperComputeChallengeSSO
WCR_AesDestroy
WCR_StreamRead
WCR_StreamSeek
WCR_RsaCreateFromPKCS8
WCR_RsaPrivateEncrypt
WCR_RsaPrivateDecrypt
WCR_SuperComputeChallenge
WCR_GetLastError
WCR_StreamLength

super

SuperComputeRecoveryPassword
SuperInitializeParameters
SuperInitializeBlob
SuperComputeChallenge
SuperUninitialize
SuperInitialize

kernel32

WritePrivateProfileStringW
GetTickCount
RemoveDirectoryW
GetFileSize
GetSystemDefaultLCID
GetProcessHeap
HeapAlloc
SetPriorityClass
SetProcessAffinityMask
GetProcessAffinityMask
FlushFileBuffers
GetDriveTypeW
GetLogicalDrives
GetExitCodeThread
SetEndOfFile
UnmapViewOfFile
GetThreadPriority
GetCurrentThread
MapViewOfFile
CreateFileMappingW
WaitForMultipleObjects
CreateMutexW
LocalAlloc
SetEvent
CreateEventW
GetCommandLineW
GetStdHandle
FreeConsole
SetConsoleCtrlHandler
AllocConsole
WTSGetActiveConsoleSessionId
FlushInstructionCache
GetCurrentProcess
OpenEventW
HeapFree
LoadLibraryW
FreeLibrary
GetComputerNameW
GetVersionExW
TerminateThread
CreateThread
ReleaseMutex
CreateMutexA
DeleteFileW
GetModuleFileNameA
GetTimeZoneInformation
GetLocalTime
GetCurrentProcessId
GetCurrentThreadId
OutputDebugStringW
CreateDirectoryW
GetSystemTime
SystemTimeToFileTime
GetFileInformationByHandle
CopyFileW
GetUserDefaultLangID
SetLastError
lstrcmpiW
QueueUserWorkItem
DeviceIoControl
LocalFree
GetModuleHandleW
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetTempFileNameW
GetTempPathW
ReadFile
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
WriteFile
SetFilePointer
GetLastError
CreateFileW
HeapDestroy
HeapReAlloc
HeapSize
InterlockedPushEntrySList
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
GetSystemTimeAsFileTime
lstrlenA
CloseHandle
FindClose
FindNextFileW
FindFirstFileW
Sleep
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
RaiseException
InitializeCriticalSection
lstrlenW
GetModuleFileNameW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetThreadPriority
SetThreadAffinityMask
GetProcAddress
GetSystemInfo
GetLocaleInfoW
GetFileAttributesW
CreateDirectoryA
ExpandEnvironmentStringsW
GetFirmwareEnvironmentVariableW
SetFirmwareEnvironmentVariableW
LoadLibraryA
FileTimeToDosDateTime

user32

MsgWaitForMultipleObjects
RegisterDeviceNotificationW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CharNextW
PostMessageW
DefWindowProcW
SetWindowLongPtrW
UnregisterClassA
GetKeyboardLayoutNameW
CharLowerBuffW
GetWindowLongPtrW
CreateWindowExW
CallWindowProcW
RegisterWindowMessageW
IsWindow
PeekMessageW
TranslateMessage
wsprintfW
DispatchMessageW
PostQuitMessage
SendMessageW
UnregisterDeviceNotification

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
IsTextUnicode
RegisterEventSourceW
DeregisterEventSource
ReportEventW
LookupAccountNameW
ConvertSidToStringSidW
LookupAccountSidW
DuplicateTokenEx
OpenProcessToken
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
GetSidSubAuthority
AllocateAndInitializeSid
FreeSid
LsaOpenPolicy
LsaNtStatusToWinError
LsaQueryInformationPolicy
ConvertStringSidToSidW
LsaFreeMemory
LogonUserW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExW
CreateProcessAsUserW
GetTokenInformation
InitializeSid
GetSidIdentifierAuthority
GetSidLengthRequired
GetSidSubAuthorityCount
QueryServiceStatus
CryptSetKeyParam
CryptDecrypt
CryptEncrypt
CryptGetKeyParam
CryptDestroyKey
CryptAcquireContextW
CryptGenKey
CryptGetUserKey
CryptImportKey
CryptReleaseContext
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptCreateHash
SetServiceStatus
RegDeleteValueW
DeleteService
ControlService
OpenServiceW
ChangeServiceConfig2W
CreateServiceW
CloseServiceHandle
OpenSCManagerW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey

shell32

SHGetFolderPathA
SHGetFolderPathW
SHCreateDirectoryExW
CommandLineToArgvW
SHFileOperationW

ole32

CoCreateInstance
CoImpersonateClient
CoRevertToSelf
CoQueryClientBlanket
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoResumeClassObjects
CoSetProxyBlanket
CoInitialize
CLSIDFromProgID
CLSIDFromString
OleRun
CoTaskMemFree
StringFromCLSID
CoCreateGuid

oleaut32

SafeArrayUnlock
SafeArrayLock
VariantClear
VariantInit
VariantTimeToSystemTime
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
VarBstrCmp
SysStringLen
SysFreeString
LoadRegTypeLi
LoadTypeLi
SysAllocString
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringLen
SystemTimeToVariantTime
VariantCopy
SafeArrayCreate
RegisterTypeLi
SafeArrayCopy
GetErrorInfo
SysAllocStringByteLen
SysStringByteLen
VarBstrCat
SafeArrayRedim
UnRegisterTypeLi
VarCmp
SafeArrayGetVartype

activeds

ord3

msvcp90

??0?$allocator@D@std@@QEAA@XZ
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IEAAPEA_WXZ
?deallocate@?$allocator@D@std@@QEAAXPEAD_K@Z
??0?$allocator@D@std@@QEAA@AEBV01@@Z
?allocate@?$allocator@D@std@@QEAAPEAD_K@Z
?max_size@?$allocator@D@std@@QEBA_KXZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_KPEB_W_K@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAX_K@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@_K0AEBV12@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@AEBV10@PEBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA?AV12@_K0@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2_KB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KPEBD_K@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAD_K@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAX_KD@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV12@AEBV12@@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??7ios_base@std@@QEBA_NXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QEAA@PEB_WHH@Z
??_D?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?close@?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAX_K_W@Z
??Bios_base@std@@QEBAPEAXXZ
??$getline@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@YAAEAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AEAV10@AEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@_W@Z
??0?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QEAA@PEB_WHH@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@PEB_W@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_K_W_K@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV12@_K0AEBV12@@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0AEBV12@@Z
?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IEAAX_N_K@Z
??0?$_String_val@_WV?$allocator@_W@std@@@std@@IEAA@V?$allocator@_W@1@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV12@_K_W@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAX_K@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_KPEB_W_K@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV12@_K0PEB_W@Z
?_Xweak@tr1@std@@YAXXZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAXAEAV12@@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KPEBD_K1@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KD_K@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KD_K@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KPEBD_K@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KD_K@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KPEBD_K@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@AEBV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@PEBD@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_KPEB_W_K@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PEB_W@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAX_K@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@PEB_W_K@Z
?max_size@?$allocator@_W@std@@QEBA_KXZ
??0?$allocator@_W@std@@QEAA@AEBV01@@Z
?deallocate@?$allocator@_W@std@@QEAAXPEA_W_K@Z
?allocate@?$allocator@_W@std@@QEAAPEA_W_K@Z
??0?$allocator@_W@std@@QEAA@XZ
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBAHAEBV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_K_W_K@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA?AV12@_K0@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_KAEBV12@_K@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2_KB
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBAAEB_W_K@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEA_W_K@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PEB_WAEBV10@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?good@ios_base@std@@QEBA_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?length@?$char_traits@D@std@@SA_KPEBD@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?eof@?$char_traits@D@std@@SAHXZ
?eq_int_type@?$char_traits@D@std@@SA_NAEBH0@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?width@ios_base@std@@QEAA_J_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?endl@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@1@AEAV21@@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?flush@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@1@AEAV21@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@_K_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBAH_K0PEB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@_W@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_K_W_K@Z
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_KPEB_W_K@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_KPEB_W_K@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV12@_K0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD_K@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PEBD@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAXXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@PEB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBAPEB_WXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBAPEBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@AEBV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAXAEAV12@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@AEBV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@PEB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@AEBV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@PEB_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBAHPEB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV12@PEB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@AEBV01@@Z
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_KXZ
??$getline@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@YAAEAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AEAV10@AEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEA_W_K@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@_KD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@AEBV01@@Z
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAXD@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@0@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_KXZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_NXZ

atl90

ord17
ord64
ord43
ord32
ord44
ord56
ord68
ord49
ord30
ord31
ord58
ord61
ord23

shlwapi

PathFileExistsA
PathAppendA
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryA
PathAppendW

msvcr90

tolower
__RTDynamicCast
isupper
printf
wcstol
wprintf_s
rand
srand
_vsnwprintf
_wtoi
strcat_s
iswalpha
strcpy_s
wcstombs_s
mbstowcs_s
_strupr_s
strcspn
isalnum
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_stricmp
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
strlen
wcsrchr
_wcsnicmp
__C_specific_handler
isdigit
_vsnwprintf_s
realloc
memmove
clock
_CxxThrowException
_wtol
_wstat64i32
_wfopen_s
fprintf_s
fclose
__CxxFrameHandler3
wcscspn
wcsspn
_beginthreadex
_wfdopen
_open_osfhandle
__iob_func
wcsncpy_s
swprintf_s
vsprintf_s
wcscat_s
wcstoul
toupper
wcscmp
wcsstr
memcpy
_wcsicmp
_localtime64_s
_difftime64
_mktime64
_gmtime64_s
_time64
calloc
_vscwprintf
vswprintf_s
_waccess
wcsnlen
??0exception@std@@QEAA@XZ
_invalid_parameter_noinfo
sprintf_s
??0exception@std@@QEAA@AEBQEBD@Z
??1exception@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
??0exception@std@@QEAA@AEBV01@@Z
memcpy_s
wcslen
wcscpy_s
_recalloc
malloc
_resetstkoflw
free
_purecall
memcmp
??_V@YAXPEAX@Z
memset
memmove_s
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
_wcslwr_s
fwrite
fopen_s
_close
_read
_filelength
_sopen_s
_vscprintf
sscanf_s
wcschr
swscanf_s
printf_s
wprintf
strrchr

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

netapi32

NetUserModalsGet
NetApiBufferFree
DsGetDcNameW

setupapi

SetupDiGetDriverInfoDetailW
SetupDiCallClassInstaller
SetupDiGetDeviceInterfaceDetailW
CM_Get_Device_IDW
SetupDiSetClassInstallParamsW
CM_Reenumerate_DevNode
CM_Get_DevNode_Registry_PropertyW
CM_Get_Parent
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupIterateCabinetW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
CM_Get_Sibling
SetupDiGetSelectedDriverW
SetupDiOpenDeviceInfoW
SetupDiEnumDeviceInterfaces
CM_Get_Child

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wintrust

WinVerifyTrust

crypt32

CertCreateSelfSignCertificate
CertFreeCertificateContext
CertStrToNameW

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 259KB - Virtual size: 258KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

faee63a50c046eb8396fdfa63542f5f5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

4a:9b:9c:b7:1d:02:27:44:e7:5a:07:1b:cf:69:cc:c6Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

f9:4e:54:11:6a:49:af:71:50:03:09:51:14:87:d1:3e:f0:88:ae:02Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wtsapi32

wcr10

super

kernel32

user32

advapi32

shell32

ole32

oleaut32

activeds

msvcp90

atl90

shlwapi

msvcr90

userenv

netapi32

setupapi

version

wintrust

crypt32

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 62KB - Virtual size: 136KB

.pdata Size: 259KB - Virtual size: 258KB

.rsrc Size: 237KB - Virtual size: 237KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

4a:9b:9c:b7:1d:02:27:44:e7:5a:07:1b:cf:69:cc:c6
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

f9:4e:54:11:6a:49:af:71:50:03:09:51:14:87:d1:3e:f0:88:ae:02
Signer

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 62KB - Virtual size: 136KB

.pdata
Size: 259KB - Virtual size: 258KB

.rsrc
Size: 237KB - Virtual size: 237KB