wininet[.]dll | Triage

Resubmissions

29/08/2024, 11:48

240829-nyfc4a1hrp 5

29/08/2024, 11:34

240829-npys3syhlf 1

Sharing

Copy URL Twitter E-mail

General

Target

wininet.dll
Size

2.5MB
MD5

6f12d140fb307e9e560142cdbae4b7b6
SHA1

6b1edc38ff943cff3dde98d082502abf6418c0c7
SHA256

e4038f11f10f6149b2c12e4b11726fd8b329b73a605cf6cf734b16999819396f
SHA512

8cbd2366258099989f6afe5462f0682f000e59e5663b863aa8ad55f72ed3fc3282d16f564754f830c9a4ecf273d8873820178c82110a95bedbf7606abfd336d5
SSDEEP

49152:9diWPSqXss/rdGwl5etEvpYHStwcz7jHsQkO7Y5mnnD5A:9dr79x3l52Oa8HYm2

Score

1^/10

Malware Config

Signatures

Files

wininet.dll
.dll regsvr32 windows:10 windows x64 arch:x64

11f6d1c533d964b17659e0c39e80597d

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:77:3e:49:1c:95:b7:0d:80:bc:3f:0f:a0:37:74:f4:f5:48:dc:c9:40:de:99:00:b9:e4:29:7f:0b:54:71:43
Signer

Actual PE Digest

38:77:3e:49:1c:95:b7:0d:80:bc:3f:0f:a0:37:74:f4:f5:48:dc:c9:40:de:99:00:b9:e4:29:7f:0b:54:71:43

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wininet.pdb

Imports

msvcrt

_strnicmp
_itow
wcschr
qsort
_atoi64
wcstok_s
_itoa_s
bsearch
_vscwprintf
_onexit
isspace
isalpha
_vsnwprintf_s
isxdigit
_itow_s
isdigit
_strlwr
strcmp
__C_specific_handler
iscntrl
_vsnwprintf
strcspn
ispunct
iswdigit
strncmp
_wtoi
_wcsnicmp
wcsncmp
memset
memmove
memcpy
memcmp
memchr
isalnum
wcsstr
strpbrk
wcscpy_s
wcsncpy_s
strchr
__dllonexit
_XcptFilter
__isascii
_amsg_exit
_initterm
_lock
?terminate@@YAXXZ
__CxxFrameHandler3
_wcslwr_s
__CxxFrameHandler4
_wcsicmp
wcsrchr
_vsnprintf
_stricmp
_purecall
free
malloc
_unlock
wcscmp

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
WaitForMultipleObjectsEx
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
DeleteCriticalSection
AcquireSRWLockShared
ResetEvent
CreateEventExA
WaitForSingleObjectEx
SetEvent
WaitForSingleObject
CreateEventA
TryAcquireSRWLockExclusive
InitializeCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable
WakeAllConditionVariable
InitOnceExecuteOnce
SleepConditionVariableCS
Sleep
SleepConditionVariableSRW

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
HeapDestroy
HeapFree
HeapSize
GetProcessHeap

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemTime
GetTickCount64
GetTickCount
GetSystemDirectoryW

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadLibraryExW
LoadLibraryExA
SizeofResource
GetModuleFileNameW
LoadStringW
LoadStringA
GetProcAddress
GetModuleHandleExA
FreeLibrary
FreeLibraryAndExitThread
LoadResource
GetModuleHandleExW

api-ms-win-core-file-l1-1-0

GetVolumePathNameW
GetShortPathNameW
FindNextFileW
FindFirstFileW
CompareFileTime
GetDiskFreeSpaceExW
GetFileSizeEx
GetDriveTypeW
SetFileAttributesW
CreateDirectoryW
GetDiskFreeSpaceExA
GetLongPathNameW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
GetFileTime
GetVolumeInformationW
SetFileInformationByHandle
CreateFileA
DeleteFileW
WriteFile
SetFilePointer
CreateFileW
ReadFile
GetFileSize
GetFileAttributesW
FindFirstFileExW
FindClose
RemoveDirectoryW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessageVa

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-registry-l1-1-0

RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyExA
RegOpenCurrentUser
RegQueryValueExA
RegDeleteTreeA
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegNotifyChangeKeyValue
RegGetValueA
RegGetValueW
RegCreateKeyExW
RegSetValueExA
RegSetValueExW
RegDeleteValueW
RegDeleteTreeW
RegQueryValueExW
RegEnumKeyExW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventActivityIdControl
EventWriteTransfer
EventRegister
EventUnregister
EventWrite

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc
LocalFree
LocalAlloc

api-ms-win-core-localization-l1-2-0

GetCPInfoExW
IdnToAscii
GetCPInfo
IsDBCSLeadByte
FormatMessageA
GetLocaleInfoW
FormatMessageW
IsValidCodePage
IsDBCSLeadByteEx
IdnToUnicode

api-ms-win-core-processthreads-l1-1-0

TlsSetValue
OpenProcessToken
TlsAlloc
GetCurrentProcessId
GetCurrentThread
OpenThreadToken
ProcessIdToSessionId
SwitchToThread
GetCurrentProcess
CreateThread
TlsGetValue
TlsFree
TerminateProcess
GetCurrentThreadId

api-ms-win-core-datetime-l1-1-0

GetTimeFormatA
GetDateFormatA

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
SetThreadpoolTimer
StartThreadpoolIo
CloseThreadpoolIo
CreateThreadpoolIo
CreateThreadpoolWait
FreeLibraryWhenCallbackReturns
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CancelThreadpoolIo
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo
GetProductInfo
GetSystemTimePreciseAsFileTime

api-ms-win-core-io-l1-1-0

GetOverlappedResult
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
DeviceIoControl

api-ms-win-core-file-l2-1-0

CreateHardLinkW
MoveFileExW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-security-appcontainer-l1-1-0

GetAppContainerNamedObjectPath

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList
InterlockedFlushSList

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-0

FindResourceA
GetComputerNameW
SetFileCompletionNotificationModes
WTSGetActiveConsoleSessionId
MoveFileW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathAddBackslashA

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-stringansi-l1-1-0

CharLowerA
CharNextA
CharUpperA

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpICA
StrStrIW
StrCmpNIA
StrStrIA
StrRChrW
StrRChrA
StrChrNW
StrToIntA
StrCmpNA
StrCmpNIW
StrChrW
StrCmpNICW
StrCmpNICA
StrStrA
StrChrA

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiA
lstrcmpA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

api-ms-win-core-url-l1-1-0

UrlCanonicalizeW
UrlCombineA
UrlUnescapeA
UrlCombineW
UrlCanonicalizeA
PathCreateFromUrlW

api-ms-win-http-time-l1-1-0

InternetTimeFromSystemTimeW
InternetTimeToSystemTimeW
InternetTimeToSystemTimeA
InternetTimeFromSystemTimeA

ntdll

RtlGetPersistedStateLocation
RtlGetDeviceFamilyInfoEnum
RtlGetVersion
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlFreeSid
RtlGetAppContainerParent
RtlGetAppContainerSidType
RtlGetLastNtStatus
RtlNtStatusToDosError
RtlReportExceptionEx
NtSetInformationFile
NtSetInformationObject
RtlQueryPackageClaims
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlIpv6AddressToStringExA
RtlIpv6AddressToStringA
NtQueryInformationToken
RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExA
RtlIpv4StringToAddressExA
NtClose
NtQueryVolumeInformationFile
NtCreateFile
NtGetCachedSigningLevel
NtCompareSigningLevels
NtSetCachedSigningLevel
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlIpv4AddressToStringA

kernelbase

GetIsEdpEnabled
SubscribeEdpEnabledStateChange
UnsubscribeEdpEnabledStateChange
GetIsWdagEnabled
SubscribeWdagEnabledStateChange
UnsubscribeWdagEnabledStateChange
GetPackageSecurityContext
GetPackageSecurityProperty

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

AppCacheCheckManifest
AppCacheCloseHandle
AppCacheCreateAndCommitFile
AppCacheDeleteGroup
AppCacheDeleteIEGroup
AppCacheDuplicateHandle
AppCacheFinalize
AppCacheFreeDownloadList
AppCacheFreeGroupList
AppCacheFreeIESpace
AppCacheFreeSpace
AppCacheGetDownloadList
AppCacheGetFallbackUrl
AppCacheGetGroupList
AppCacheGetIEGroupList
AppCacheGetInfo
AppCacheGetManifestUrl
AppCacheLookup
CommitUrlCacheEntryA
CommitUrlCacheEntryBinaryBlob
CommitUrlCacheEntryW
CreateMD5SSOHash
CreateUrlCacheContainerA
CreateUrlCacheContainerW
CreateUrlCacheEntryA
CreateUrlCacheEntryExW
CreateUrlCacheEntryW
CreateUrlCacheGroup
DeleteIE3Cache
DeleteUrlCacheContainerA
DeleteUrlCacheContainerW
DeleteUrlCacheEntry
DeleteUrlCacheEntryA
DeleteUrlCacheEntryW
DeleteUrlCacheGroup
DeleteWpadCacheForNetworks
DetectAutoProxyUrl
DispatchAPICall
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
FindCloseUrlCache
FindFirstUrlCacheContainerA
FindFirstUrlCacheContainerW
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryExA
FindFirstUrlCacheEntryExW
FindFirstUrlCacheEntryW
FindFirstUrlCacheGroup
FindNextUrlCacheContainerA
FindNextUrlCacheContainerW
FindNextUrlCacheEntryA
FindNextUrlCacheEntryExA
FindNextUrlCacheEntryExW
FindNextUrlCacheEntryW
FindNextUrlCacheGroup
ForceNexusLookup
ForceNexusLookupExW
FreeUrlCacheSpaceA
FreeUrlCacheSpaceW
FtpCommandA
FtpCommandW
FtpCreateDirectoryA
FtpCreateDirectoryW
FtpDeleteFileA
FtpDeleteFileW
FtpFindFirstFileA
FtpFindFirstFileW
FtpGetCurrentDirectoryA
FtpGetCurrentDirectoryW
FtpGetFileA
FtpGetFileEx
FtpGetFileSize
FtpGetFileW
FtpOpenFileA
FtpOpenFileW
FtpPutFileA
FtpPutFileEx
FtpPutFileW
FtpRemoveDirectoryA
FtpRemoveDirectoryW
FtpRenameFileA
FtpRenameFileW
FtpSetCurrentDirectoryA
FtpSetCurrentDirectoryW
GetProxyDllInfo
GetUrlCacheConfigInfoA
GetUrlCacheConfigInfoW
GetUrlCacheEntryBinaryBlob
GetUrlCacheEntryInfoA
GetUrlCacheEntryInfoExA
GetUrlCacheEntryInfoExW
GetUrlCacheEntryInfoW
GetUrlCacheGroupAttributeA
GetUrlCacheGroupAttributeW
GetUrlCacheHeaderData
GopherCreateLocatorA
GopherCreateLocatorW
GopherFindFirstFileA
GopherFindFirstFileW
GopherGetAttributeA
GopherGetAttributeW
GopherGetLocatorTypeA
GopherGetLocatorTypeW
GopherOpenFileA
GopherOpenFileW
HttpAddRequestHeadersA
HttpAddRequestHeadersW
HttpCheckDavCompliance
HttpCloseDependencyHandle
HttpDuplicateDependencyHandle
HttpEndRequestA
HttpEndRequestW
HttpGetServerCredentials
HttpGetTunnelSocket
HttpIndicatePageLoadComplete
HttpIsHostHstsEnabled
HttpOpenDependencyHandle
HttpOpenRequestA
HttpOpenRequestW
HttpPushClose
HttpPushEnable
HttpPushWait
HttpQueryInfoA
HttpQueryInfoW
HttpSendRequestA
HttpSendRequestExA
HttpSendRequestExW
HttpSendRequestW
HttpWebSocketClose
HttpWebSocketCompleteUpgrade
HttpWebSocketQueryCloseStatus
HttpWebSocketReceive
HttpWebSocketSend
HttpWebSocketShutdown
IncrementUrlCacheHeaderData
InternetAlgIdToStringA
InternetAlgIdToStringW
InternetAttemptConnect
InternetAutodial
InternetAutodialCallback
InternetAutodialHangup
InternetCanonicalizeUrlA
InternetCanonicalizeUrlW
InternetCheckConnectionA
InternetCheckConnectionW
InternetClearAllPerSiteCookieDecisions
InternetCloseHandle
InternetCombineUrlA
InternetCombineUrlW
InternetConfirmZoneCrossing
InternetConfirmZoneCrossingA
InternetConfirmZoneCrossingW
InternetConnectA
InternetConnectW
InternetConvertUrlFromWireToWideChar
InternetCrackUrlA
InternetCrackUrlW
InternetCreateUrlA
InternetCreateUrlW
InternetDial
InternetDialA
InternetDialW
InternetEnumPerSiteCookieDecisionA
InternetEnumPerSiteCookieDecisionW
InternetErrorDlg
InternetFindNextFileA
InternetFindNextFileW
InternetFortezzaCommand
InternetFreeCookies
InternetFreeProxyInfoList
InternetGetCertByURL
InternetGetCertByURLA
InternetGetConnectedState
InternetGetConnectedStateEx
InternetGetConnectedStateExA
InternetGetConnectedStateExW
InternetGetCookieA
InternetGetCookieEx2
InternetGetCookieExA
InternetGetCookieExW
InternetGetCookieW
InternetGetLastResponseInfoA
InternetGetLastResponseInfoW
InternetGetPerSiteCookieDecisionA
InternetGetPerSiteCookieDecisionW
InternetGetProxyForUrl
InternetGetSecurityInfoByURL
InternetGetSecurityInfoByURLA
InternetGetSecurityInfoByURLW
InternetGoOnline
InternetGoOnlineA
InternetGoOnlineW
InternetHangUp
InternetInitializeAutoProxyDll
InternetLockRequestFile
InternetOpenA
InternetOpenUrlA
InternetOpenUrlW
InternetOpenW
InternetQueryDataAvailable
InternetQueryFortezzaStatus
InternetQueryOptionA
InternetQueryOptionW
InternetReadFile
InternetReadFileExA
InternetReadFileExW
InternetSecurityProtocolToStringA
InternetSecurityProtocolToStringW
InternetSetCookieA
InternetSetCookieEx2
InternetSetCookieExA
InternetSetCookieExW
InternetSetCookieW
InternetSetDialState
InternetSetDialStateA
InternetSetDialStateW
InternetSetFilePointer
InternetSetOptionA
InternetSetOptionExA
InternetSetOptionExW
InternetSetOptionW
InternetSetPerSiteCookieDecisionA
InternetSetPerSiteCookieDecisionW
InternetSetSecureLegacyServersAppCompat
InternetSetStatusCallback
InternetSetStatusCallbackA
InternetSetStatusCallbackW
InternetShowSecurityInfoByURL
InternetShowSecurityInfoByURLA
InternetShowSecurityInfoByURLW
InternetTimeFromSystemTime
InternetTimeFromSystemTimeA
InternetTimeFromSystemTimeW
InternetTimeToSystemTime
InternetTimeToSystemTimeA
InternetTimeToSystemTimeW
InternetUnlockRequestFile
InternetWriteFile
InternetWriteFileExA
InternetWriteFileExW
IsHostInProxyBypassList
IsUrlCacheEntryExpiredA
IsUrlCacheEntryExpiredW
LoadUrlCacheContent
ParseX509EncodedCertificateForListBoxEntry
PrivacyGetZonePreferenceW
PrivacySetZonePreferenceW
ReadUrlCacheEntryStream
ReadUrlCacheEntryStreamEx
RegisterUrlCacheNotification
ResumeSuspendedDownload
RetrieveUrlCacheEntryFileA
RetrieveUrlCacheEntryFileW
RetrieveUrlCacheEntryStreamA
RetrieveUrlCacheEntryStreamW
RunOnceUrlCache
SetUrlCacheConfigInfoA
SetUrlCacheConfigInfoW
SetUrlCacheEntryGroup
SetUrlCacheEntryGroupA
SetUrlCacheEntryGroupW
SetUrlCacheEntryInfoA
SetUrlCacheEntryInfoW
SetUrlCacheGroupAttributeA
SetUrlCacheGroupAttributeW
SetUrlCacheHeaderData
ShowCertificate
ShowClientAuthCerts
ShowSecurityInfo
ShowX509EncodedCertificate
UnlockUrlCacheEntryFile
UnlockUrlCacheEntryFileA
UnlockUrlCacheEntryFileW
UnlockUrlCacheEntryStream
UpdateUrlCacheContentPath
UrlCacheCheckEntriesExist
UrlCacheCloseEntryHandle
UrlCacheContainerSetEntryMaximumAge
UrlCacheCreateContainer
UrlCacheFindFirstEntry
UrlCacheFindNextEntry
UrlCacheFreeEntryInfo
UrlCacheFreeGlobalSpace
UrlCacheGetContentPaths
UrlCacheGetEntryInfo
UrlCacheGetGlobalCacheSize
UrlCacheGetGlobalLimit
UrlCacheReadEntryStream
UrlCacheReloadSettings
UrlCacheRetrieveEntryFile
UrlCacheRetrieveEntryStream
UrlCacheServer
UrlCacheSetGlobalLimit
UrlCacheUpdateEntryExtraData
UrlZonesDetach
_GetFileExtensionFromUrl

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_wpp_sf
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 464KB - Virtual size: 461KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

11f6d1c533d964b17659e0c39e80597d

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

38:77:3e:49:1c:95:b7:0d:80:bc:3f:0f:a0:37:74:f4:f5:48:dc:c9:40:de:99:00:b9:e4:29:7f:0b:54:71:43Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-security-appcontainer-l1-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-stringansi-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-http-time-l1-1-0

ntdll

kernelbase

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

_wpp_sf Size: 124KB - Virtual size: 123KB

fothk Size: 4KB - Virtual size: 4KB

.rdata Size: 464KB - Virtual size: 461KB

.data Size: 4KB - Virtual size: 17KB

.pdata Size: 68KB - Virtual size: 67KB

.didat Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

38:77:3e:49:1c:95:b7:0d:80:bc:3f:0f:a0:37:74:f4:f5:48:dc:c9:40:de:99:00:b9:e4:29:7f:0b:54:71:43
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

_wpp_sf
Size: 124KB - Virtual size: 123KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 464KB - Virtual size: 461KB

.data
Size: 4KB - Virtual size: 17KB

.pdata
Size: 68KB - Virtual size: 67KB

.didat
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB