cc7ecba6a1277019ad30e6e37620128e141c966097ade011e52e85e677b24970

Sharing

Copy URL Twitter E-mail

General

Target

cc7ecba6a1277019ad30e6e37620128e141c966097ade011e52e85e677b24970
Size

451KB
MD5

06c831b74dc10ccd115d2c1330b5a1a4
SHA1

5cb7a505a8d5fd3869f9c35f9f32e5dec2ecc43c
SHA256

cc7ecba6a1277019ad30e6e37620128e141c966097ade011e52e85e677b24970
SHA512

36d3c8908221047df34c2cfbc5b001f8c57b0aba5ca037ad168017c4c9f19911d33d2d374c29f0b445b7588771ee6288e0ac1d2105365fe32438ad97fc53aee9
SSDEEP

12288:Ipot0tr6sa7U2ZcBODfb09pi4hGDwhoQuAWaMVjH8WwZ:I+4L+92RkVjcWi

Score

1^/10

Malware Config

Signatures

Files

cc7ecba6a1277019ad30e6e37620128e141c966097ade011e52e85e677b24970
.dll windows:5 windows x86 arch:x86

bce4317f1e5b12d6d057375fa56dbfaf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/01/2013, 00:00

Not After

16/02/2016, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

40:21:70:e6:6c:3d:06:91:62:14:dd:e6:6b:e3:48:75:6b:56:b2:09
Signer

Actual PE Digest

40:21:70:e6:6c:3d:06:91:62:14:dd:e6:6b:e3:48:75:6b:56:b2:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\slave_depot\beyond_slave\branch_union_ds_rep\beyond\bin\pdb\Release\Downloader.pdb

Imports

wininet

InternetCrackUrlW

qbutils

?OnHandleDownloadEvent@HttpDownloader@Util@@AAEJIIJAAH@Z
?Map@SharedMemory@Util@@QAE_NI@Z
?Close@SharedMemory@Util@@QAEXXZ
?Load@CMarkupSTL@@QAE_NPBD@Z
?Finalize@HttpDownloader@Util@@QAE_NH@Z
?GetConfigUtilImpl@@YAPAUIConfigUtil@@XZ
?QueryString@RegEdit@@YAHPAUHKEY__@@PB_W1AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?MultiByteToWide@Util@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
?WideToMultiByte@Util@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@HAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z
?SetDoc@CMarkupSTL@@QAE_NPBD@Z
?CreateDirectoryW@Util@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?PathRemoveFileSpecW@Util@@YA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?Request@HttpDownloader@Util@@QAEHABUDownloadReqInfo@2@@Z
?PathCombineEx@Util@@YA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV23@@Z
?Cancel@HttpDownloader@Util@@QAE_NH_N@Z
?Create@VectorPostData@Util@@SAPAV12@XZ
?Save@CMarkupSTL@@QAE_NPBD@Z
?FilePathValid@Util@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_N@Z
?PathEqual@Util@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?GetSpecialDirectory@Util@@YA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H_N@Z
?AddChildElem@CMarkupSTL@@QAE_NPBD0H@Z
?AddElem@CMarkupSTL@@QAE_NPBD0H@Z
?GetChildData@CMarkupSTL@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1CMarkupSTL@@QAE@XZ
??0CMarkupSTL@@QAE@XZ
?StartsWith@Util@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_N@Z
?FindWithoutCase@Util@@YAIABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?PathRemoveFileExt@Util@@YA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?OpenApp@Util@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?PathRenameFileExt@Util@@YA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV23@@Z
?IncrementSEventStat@Util@@YAHKK@Z
?GetCurrentMainFrame@CommonFunc@Util@@YAPAUHWND__@@K@Z
?GetIPC@CommonFunc@Util@@YAPAVIIPC@@XZ
?CancelAll@HttpDownloader@Util@@QAE_N_N@Z
?Create@FileReceiver@Util@@SAPAVIDataReceiver@2@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@P6A_NPB_W@Z@Z
?UrlDecode@Util@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV23@@Z
?AddChildAttrib@CMarkupSTL@@QAE_NPBD0@Z
?GetChildAttrib@CMarkupSTL@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z
?Equal@Util@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_N@Z
??0RegKey@Util@@QAE@PAUHKEY__@@PB_WK@Z
?Close@RegKey@Util@@QAEXXZ
?GetDPIAwareFont@QBFont@Util@@YAPAUHFONT__@@W4SkinFontList@@@Z
?GetString@MUILang@Util@@YAPB_WH@Z
?ReadValueDW@RegKey@Util@@QAE_NPB_WPAK@Z
?WriteValue@RegKey@Util@@QAE_NPB_WK@Z
?GetOSVersion@Util@@YAHXZ
?GetAllDownloadTools@Util@@YAXAAV?$vector@UDownloadTool@Util@@V?$allocator@UDownloadTool@Util@@@std@@@std@@@Z
?InvokeDownloadTool@Util@@YA_NHABUTaskInfo@1@PAUHWND__@@@Z
?FileNameValid@Util@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?PathStandardize@Util@@YA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?PathCanAccess@Util@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV23@@Z
?CopyWString@Util@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAUHWND__@@@Z
?GetExeFileName@CommonFunc@Util@@YAPB_WXZ
?GetExeFolderNotWithSlash@CommonFunc@Util@@YAPB_WXZ
?OpenAppFolder@Util@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?RemoveDirectoryW@Util@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?Create@SharedMemory@Util@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@I_NAA_N@Z
?ReadValue@RegKey@Util@@QAE_NPB_WPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?SplitString@Util@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_WPAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@3@@Z
?FileNameRemoveInvalidChars@Util@@YA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?GetSuggestedFilename@Util@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAV23@0@Z
?DownloadToolExists@Util@@YA_NH@Z
?EndsWith@Util@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_N@Z
?GetQBWinInetInterface@@YAPAUIQBWinInet@@XZ
?InitFontResource@QBFont@Util@@YAXXZ
?DeleteString@RegEdit@@YAHPAUHKEY__@@PB_W1@Z
?FindChildElem@CMarkupSTL@@QAE_NPBD@Z

kernel32

GlobalFree
QueryPerformanceCounter
GlobalLock
GlobalAlloc
GetSystemTimeAsFileTime
InterlockedExchange
SuspendThread
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapDestroy
HeapReAlloc
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
IsDebuggerPresent
InterlockedDecrement
CloseHandle
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
QueueUserWorkItem
GetTickCount
OpenProcess
CopyFileW
DeleteFileW
Sleep
GetLastError
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
SetLastError
GetModuleHandleA
GetVersion
GetFileAttributesW
LoadLibraryW
OutputDebugStringA
CreateFileW
GetVersionExW
GetFileSizeEx
InterlockedCompareExchange
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
ResumeThread
InterlockedIncrement
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
RaiseException
GetCurrentThreadId
MulDiv
FlushInstructionCache
GetCurrentProcess
LoadLibraryA
GetFileSize
GetTempPathW
GetDiskFreeSpaceExW
LoadResource
LockResource
FindResourceW
SetEvent
lstrcmpiW
LoadLibraryExW
FreeLibrary
GlobalUnlock
CreateEventW
FreeResource
EnumResourceNamesW
SizeofResource
FindResourceExW
CreateProcessW
lstrlenW
LocalFree
GetPrivateProfileStringW
GetPrivateProfileIntW
WaitForMultipleObjects
WritePrivateProfileStringW
DuplicateHandle
TerminateProcess
GetTempFileNameW
InitializeCriticalSection
GetCommandLineW
TlsAlloc
TlsGetValue
TlsSetValue

user32

SystemParametersInfoW
LoadCursorW
GetClassInfoExW
ReleaseCapture
GetFocus
GetSysColor
GetMonitorInfoW
MonitorFromWindow
AdjustWindowRectEx
IsDialogMessageW
GetDlgItem
GetDlgCtrlID
GetParent
GetWindow
InsertMenuW
SetCapture
EnableWindow
IsWindowEnabled
RedrawWindow
IsWindowVisible
ShowWindow
InvalidateRect
UpdateWindow
ReleaseDC
GetDC
EndPaint
BeginPaint
MapWindowPoints
ScreenToClient
ClientToScreen
GetClientRect
GetWindowRect
SetWindowPos
MoveWindow
IsIconic
GetMenu
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SendMessageW
OffsetRect
EqualRect
PtInRect
RegisterClassExW
IsWindow
KillTimer
SetTimer
DestroyWindow
CreateWindowExW
PostMessageW
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetWindowLongW
MonitorFromPoint
LoadImageW
UnregisterClassA
FillRect
GetSubMenu
LoadMenuW
EnableMenuItem
CopyRect
MessageBoxW
GetClassNameW
EnumWindows
CreateDialogParamW
SendMessageTimeoutW
GetWindowThreadProcessId
AllowSetForegroundWindow
CharNextW
GetMessageW
DispatchMessageW
PeekMessageW
TranslateMessage
UnionRect
IntersectRect
IsRectEmpty
EnumChildWindows
GetIconInfo
SetRectEmpty
RegisterWindowMessageW
CreateCaret
ShowCaret
HideCaret
SetCaretPos
SetCursor
SendNotifyMessageW
SetRect
GetKeyState
AppendMenuW
RemovePropW
SetPropW
GetAncestor
InflateRect
DrawFocusRect
GetWindowDC
GetDesktopWindow
GetMenuItemInfoW
SetMenuDefaultItem
IsZoomed
GetPropW
SetParent
GetSystemMenu
TrackMouseEvent
DialogBoxParamW
EndDialog
UpdateLayeredWindow
SetWindowRgn
SendInput
FindWindowW
GetSystemMetrics
FindWindowExW
GetForegroundWindow
SetForegroundWindow
PostQuitMessage
GetCapture
SetActiveWindow
DrawTextW
GetActiveWindow
GetCursorPos
CreatePopupMenu
DestroyMenu
DestroyIcon
TrackPopupMenu
SetFocus

gdi32

RectVisible
GetClipBox
CreateRectRgnIndirect
LineTo
BitBlt
GetTextExtentPoint32W
SelectClipRgn
GetViewportOrgEx
GetObjectW
GetStockObject
GetCurrentObject
Rectangle
CreateCompatibleDC
SetViewportOrgEx
MoveToEx
CreateFontIndirectW
SetTextColor
RestoreDC
SaveDC
SetBkMode
SelectObject
GetDeviceCaps
ExtTextOutW
SetBkColor
DeleteDC
CreateSolidBrush
DeleteObject
CreatePen
GetPixel
CombineRgn
GetTextExtentExPointW
SetBitmapBits
GetBitmapBits
CreateFontW
SetDIBColorTable
CreateCompatibleBitmap
CreateDIBSection

advapi32

GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
GetTraceLoggerHandle

shell32

SHGetPathFromIDListW
ShellExecuteExW
SHBrowseForFolderW
SHGetFileInfoW
SHGetSpecialFolderLocation
CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
CLSIDFromProgID

oleaut32

SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VarUI4FromStr

shlwapi

PathAppendW
PathRemoveFileSpecW
AssocCreate
PathFileExistsW
PathFindExtensionW

msvcp90

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W0@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?_Xfunc@tr1@std@@YAXXZ
??0locale@std@@QAE@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?transform@?$collate@_W@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@PB_W0@Z
?_Getcat@?$collate@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Xmem@tr1@std@@YAXXZ
?id@?$collate@_W@std@@2V0locale@2@A
?_Xbad@tr1@std@@YAXW4error_type@regex_constants@12@@Z
?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@QAEXXZ
??1locale@std@@QAE@XZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z

msvcr90

??3@YAXPAX@Z
memmove_s
??_V@YAXPAX@Z
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
_purecall
?what@exception@std@@UBEPBDXZ
printf
_wremove
_wcsicmp
wcsncpy_s
_vsnwprintf_s
_wrename
_beginthreadex
_time64
_i64toa_s
_itoa_s
atoi
_atoi64
free
_stricmp
memcpy_s
wcsnlen
_recalloc
swprintf_s
_wtoi
_wcsdup
_wfopen_s
fwrite
fclose
tolower
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
feof
fread
ferror
_wtoi64
wcscpy_s
realloc
malloc
wcsstr
_set_invalid_parameter_handler
_set_purecall_handler
strchr
exit
_resetstkoflw
memset
abort
?terminate@@YAXXZ
memcpy
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
__CxxFrameHandler3
_CxxThrowException
__RTDynamicCast
??1exception@std@@UAE@XZ

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

imm32

ImmGetContext
ImmReleaseContext

riched20

ord4

gdiplus

GdipDeleteGraphics
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipDrawImageRectRectI
GdipCloneImage
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromResource
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteBrush
GdipCloneBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenWidth
GdipSetPenColor
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCreatePath
GdipDeletePath
GdipAddPathStringI
GdipGetImageGraphicsContext
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDrawPath
GdipDrawString
GdipDrawImageI
GdipDrawImageRectI
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipDeleteFont
GdipGetFamily
GdipGetFontSize
GdipGetImagePixelFormat
GdipCreateBitmapFromHICON
GdipBitmapGetPixel
GdiplusStartup
GdiplusShutdown
GdipGetImagePaletteSize
GdipGetImagePalette
GdipDrawEllipseI
GdipFillEllipseI
GdipCreateFromHDC
GdipDisposeImage
GdipSetImageAttributesWrapMode
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipAlloc
GdipFree
GdipGetImageWidth

Exports

Exports

CommitDownloadRequest
DialogStartDownloadManager
DialogStartDownloadTask
QQBrowserModuleEntry

Sections

.text
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nocrit
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bce4317f1e5b12d6d057375fa56dbfaf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

40:21:70:e6:6c:3d:06:91:62:14:dd:e6:6b:e3:48:75:6b:56:b2:09Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

qbutils

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcp90

msvcr90

comctl32

msimg32

imm32

riched20

gdiplus

Exports

Exports

Sections

.text Size: 237KB - Virtual size: 237KB

.nocrit Size: 8KB - Virtual size: 7KB

.rdata Size: 66KB - Virtual size: 66KB

.data Size: 9KB - Virtual size: 79KB

.shared Size: 512B - Virtual size: 4B

.rsrc Size: 94KB - Virtual size: 94KB

.reloc Size: 28KB - Virtual size: 27KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

40:21:70:e6:6c:3d:06:91:62:14:dd:e6:6b:e3:48:75:6b:56:b2:09
Signer

.text
Size: 237KB - Virtual size: 237KB

.nocrit
Size: 8KB - Virtual size: 7KB

.rdata
Size: 66KB - Virtual size: 66KB

.data
Size: 9KB - Virtual size: 79KB

.shared
Size: 512B - Virtual size: 4B

.rsrc
Size: 94KB - Virtual size: 94KB

.reloc
Size: 28KB - Virtual size: 27KB