52e0aeeb9092679be795bc8e178d68383aa694b3b3d4f4b11cf7b14f6367d1b0

Sharing

Copy URL Twitter E-mail

General

Target
52e0aeeb9092679be795bc8e178d68383aa694b3b3d4f4b11cf7b14f6367d1b0
Size 1.6MB
Sample240907-tzjpssshjm
SHA256 52e0aeeb9092679be795bc8e178d68383aa694b3b3d4f4b11cf7b14f6367d1b0
MD5 83876b972ecd173f034f0af5a50777df
SHA1 d8394dac4d2042a7e5eeb2090785456ea7dd563b
SHA512 6bbf3671f074ba17a2d109f2b1f446c17362325c1091af821d8c31c8770ca739ec6f5dbfe79a735c117114d3b8db519ba1d4171c945938203e96ee9e2fbc22de
SSDEEP 24576:Vbp2PEtmwb6kMjihOgysnGc7EiHhP2C1oPObTSFXhPq2QWv/Ec+M6eirEH7j:Vbprtmwe7dSvAObTAXhPq2QW3Ec+M6ed
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

52e0aeeb9092679be795bc8e178d68383aa694b3b3d4f4b11cf7b14f6367d1b0

.dll 1.6MB

52e0aeeb9092679be795bc8e178d68383aa694b3b3d4f4b11cf7b14f6367d1b0

IMPHASH 44c09d1f1fd06fe50ed84f2b1acf5a30
SHA256 52e0aeeb9092679be795bc8e178d68383aa694b3b3d4f4b11cf7b14f6367d1b0
MD5 83876b972ecd173f034f0af5a50777df
SHA1 d8394dac4d2042a7e5eeb2090785456ea7dd563b
SHA512 6bbf3671f074ba17a2d109f2b1f446c17362325c1091af821d8c31c8770ca739ec6f5dbfe79a735c117114d3b8db519ba1d4171c945938203e96ee9e2fbc22de
SSDEEP 24576:Vbp2PEtmwb6kMjihOgysnGc7EiHhP2C1oPObTSFXhPq2QWv/Ec+M6eirEH7j:Vbprtmwe7dSvAObTAXhPq2QW3Ec+M6ed
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

PE Signature issue

Digest

78:6b:0d:d4:80:a0:cf:f2:a4:cd:29:8f:e9:29:b6:52:f4:c2:1d:c3:be:b4:ac:30:d7:ad:ea:8e:4a:34:e9:8b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 8, 2024

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

cb:0f:48:5e:9e:73:d0:5c:41:51:aa:3d:27:aa:dc:c1:5f:40:f2:32

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 7, 2024

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Serial Number

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 2, 2023 - Oct 30, 2034

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

12:de:18:8b:44:59:31:20:43:25:45:07

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 20, 2022 - Mar 18, 2025

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

12:de:18:8b:44:59:31:20:43:25:45:07

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 20, 2022 - Mar 18, 2025

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

279183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

H:\baidu\netdisk\pc-international\output\pdb\AppUtil.pdb

bull140u

?CreateGuid@BULL@@YA?AU_GUID@@XZ ?KillTimer@BULL@@YAJK@Z ?SetTimer@BULL@@YAJK_NPAUICallbackTimer@1@KPAK@Z ?_wtoui64@@YA_KPB_W@Z ?RC4Decrypt@BULL@@YAJPA_W0PAPA_W@Z ?RC4Encrypt@BULL@@YAJPA_W0PAPA_W@Z ?Base64Decode@BULL@@YAJPA_WPAPAUIGeneralBuffer@1@@Z ?GetNamedObject@BULL@@YAJPA_WABU_GUID@@1PAPAX@Z ?MultiByteToWideChar@BULL@@YAJIPBDPAPA_W@Z ?WideCharToMultiByte@BULL@@YAJIPB_WPAPAUIGeneralBuffer@1@@Z ?VersionDecode@BULL@@YAJPAUIGeneralBuffer@1@0PAPAU21@@Z ?Base64Encode@BULL@@YAJPAUIGeneralBuffer@1@PAPA_WK@Z ?MD5@BULL@@YAJPAUIGeneralBuffer@1@PAPAU21@@Z ?CreateObjectNative@BULL@@YAJABU_GUID@@0PAPAX@Z ?AssertOut@BULL@@YAJPB_WH_N0@Z ?RegisterObject@BULL@@YAJABU_GUID@@0P6GJPAX0PAPAX@ZPB_W@Z ?XLogV@BULL@@YAXIPB_W0PAD@Z

kernel32

MoveFileExW GetTempPathW GetSystemTimeAsFileTime LoadLibraryW SetLastError GetCurrentThreadId QueueUserWorkItem GetGeoInfoW GetUserGeoID GetUserDefaultLCID GetFileTime CopyFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GlobalAlloc GlobalFree GetVolumeInformationA DeviceIoControl GetCurrentProcess GetCurrentProcessId CreateProcessW GetVersionExW LocalFree FormatMessageW ReadFile GetFileSize DeleteFileW CreateFileW CreateDirectoryW SetThreadLocale GetThreadLocale MultiByteToWideChar lstrcmpiW LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteCriticalSection FindNextFileW LoadLibraryA ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableW ConvertFiberToThread DeleteFiber GetFileType InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetLastError RaiseException DecodePointer EncodePointer FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy FindFirstFileW FindClose GetPrivateProfileIntW GetStdHandle GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc QueryPerformanceCounter TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WritePrivateProfileSectionW WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte WaitForSingleObject CloseHandle WriteFile IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA SetEvent ResetEvent WaitForSingleObjectEx CreateEventW

user32

WindowFromPoint GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW GetProcessWindowStation GetUserObjectInformationW MessageBoxW PostMessageW CharLowerBuffW PeekMessageW DispatchMessageW KillTimer SetTimer LoadCursorW SetWindowLongW GetWindowLongW DestroyWindow IsWindow TranslateMessage IsRectEmpty SetRect GetWindowRect GetSystemMetrics UnregisterClassW SystemParametersInfoW GetWindowThreadProcessId FindWindowW CharNextW CreateWindowExW

advapi32

CloseServiceHandle CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW StartServiceW OpenServiceW OpenSCManagerW RegEnumKeyExW GetTokenInformation OpenProcessToken RegQueryValueExW RegQueryValueExA RegOpenKeyExA RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW CryptEnumProvidersW

shell32

SHGetSpecialFolderPathW SHAppBarMessage SHCreateDirectoryExW

ole32

CoCreateGuid CoTaskMemAlloc CoTaskMemFree CLSIDFromString StringFromGUID2 CoInitializeEx StringFromCLSID CoTaskMemRealloc CoUninitialize CoCreateInstance

oleaut32

VariantCopy SysAllocString SafeArrayGetVartype SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SafeArrayDestroy LoadRegTypeLi VarBstrCmp VariantClear VariantInit SysAllocStringByteLen SysStringByteLen UnRegisterTypeLi RegisterTypeLi LoadTypeLi VarUI4FromStr SysStringLen SysFreeString SysAllocStringLen

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ?_Xout_of_range@std@@YAXPBD@Z ??Bid@locale@std@@QAEIXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?_BADOFF@std@@3_JB ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?uncaught_exception@std@@YA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ

wininet

InternetOpenA InternetCloseHandle InternetReadFile InternetWriteFile InternetQueryDataAvailable InternetSetOptionA HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestExA HttpEndRequestA HttpQueryInfoA InternetConnectA

ws2_32

WSACleanup WSAGetLastError recv send closesocket WSASetLastError

crypt32

CertOpenStore CertEnumCertificatesInStore CertFindCertificateInStore CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertCloseStore

iphlpapi

GetAdaptersAddresses GetAdaptersInfo

vcruntime140

strchr __std_exception_destroy _purecall memchr __vcrt_InitializeCriticalSectionEx _except_handler4_common __std_type_info_destroy_list strrchr wcsrchr memmove wcschr strstr wcsstr __std_terminate memset memcpy __CxxFrameHandler3 _CxxThrowException __std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _crt_atexit strerror_s _execute_onexit_table _exit raise _initialize_onexit_table _initialize_narrow_environment _errno _configure_narrow_argv _cexit terminate _seh_filter_dll _beginthreadex _invalid_parameter_noinfo _initterm_e _register_onexit_function signal _initterm

api-ms-win-crt-string-l1-1-0

wmemcpy_s strcmp strcspn wcscat_s wcscpy_s wcsncpy_s strncpy strspn _strnicmp _wcslwr_s wcsnlen _wcsicmp _stricmp isdigit strncmp _strlwr_s wcsspn wcscspn isxdigit strpbrk isspace strnlen

api-ms-win-crt-heap-l1-1-0

free malloc _recalloc realloc _callnewh

api-ms-win-crt-convert-l1-1-0

_wtoi64 _wtoi strtol atoi _wtof _itow_s _ultoa_s strtoul

api-ms-win-crt-filesystem-l1-1-0

_waccess _unlock_file _lock_file _wstat64i32 _waccess_s _stat64i32

api-ms-win-crt-stdio-l1-1-0

_wfopen fopen __stdio_common_vswprintf fputs __stdio_common_vswprintf_s __stdio_common_vfprintf __stdio_common_vsprintf_s __acrt_iob_func __stdio_common_vsscanf _setmode _get_stream_buffer_pointers __stdio_common_vsnwprintf_s ftell fseek fread _fileno fclose fgets __stdio_common_vsprintf ferror feof ungetc setvbuf fwrite _fseeki64 fsetpos fputc fgetpos fgetc fflush

api-ms-win-crt-time-l1-1-0

_mktime64 _gmtime64_s _time64

api-ms-win-crt-utility-l1-1-0

ldiv qsort

api-ms-win-crt-multibyte-l1-1-0

_mbsinc _mbschr _mbsicmp

api-ms-win-crt-math-l1-1-0

_except1

api-ms-win-crt-environment-l1-1-0

getenv

bcrypt

BCryptGenRandom

?AddAppToCurrentProfile@Firewall@UtilElevate@@YAJXZ ?Base64_MD5_VecString@Misc@AppUtil@@YAJABV?$vector@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@std@@@std@@PAPA_W@Z ?CompareVersion@Misc@AppUtil@@YAHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z ?ConstructFilePath@MFS@AppUtil@@YAJPB_W00PAPA_W@Z ?CurURLDecode@Misc@AppUtil@@YAJPBDAAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z ?CurURLDecode@Misc@AppUtil@@YAJPB_WAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?CurURLEncode@Misc@AppUtil@@YAJPBDAAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z ?CurURLEncode@Misc@AppUtil@@YAJPB_WAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?CurlInetPton4@Misc@AppUtil@@YAHPBDPAE@Z ?CurlInetPton6@Misc@AppUtil@@YAHPBDPAE@Z ?CurlIsIP@Misc@AppUtil@@YAHABV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z ?CurlIsIP@Misc@AppUtil@@YAHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?CurlIsIPV6@Misc@AppUtil@@YAHABV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z ?CurlIsIPV6@Misc@AppUtil@@YAHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?GetChannelInfo@Misc@AppUtil@@YAJPAPA_W@Z ?GetCurrentLangId@Misc@AppUtil@@YAJAAK@Z ?GetDomain@HelpAppSetting@@YAJAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?GetDomain@HelpAppSetting@@YAJW4EDomainType@1@AAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?GetDoubleFromJsonDataShim@Misc@AppUtil@@YAJPA_WPAUIGeneralData@BULL@@PAN@Z ?GetForceUpdateContent@Misc@AppUtil@@YAJPAPA_W00@Z ?GetLangDuiStringTableId@Misc@AppUtil@@YAJAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?GetProxyInfo@HelpProxySetting@@YAJPAKPAPA_WPAG@Z ?GetTeraBoxTempPath@Misc@AppUtil@@YAJPAPA_W@Z ?GetTime@Misc@AppUtil@@YA_JXZ ?GetUpdateLevel@Misc@AppUtil@@YAJPAH@Z ?GetUrl@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@HW4EDomainType@1@0AAV23@@Z ?GetUrl@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@HW4EDomainType@1@AAV23@@Z ?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAH@Z ?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAI@Z ?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAV23@H@Z ?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AA_J@Z ?GetVersionValue@Misc@AppUtil@@YA_KABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?IsAllAUPackageReady@Misc@AppUtil@@YAHAAH@Z ?IsAutoRun@Misc@AppUtil@@YAHXZ ?IsAutoUpdate@Misc@AppUtil@@YAHXZ ?IsElevated@UtilElevate@@YAJPAH@Z ?IsNeedAutoUpdate@Misc@AppUtil@@YAHXZ ?IsTeraBoxDomain@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAH@Z ?JsonEncode@JsonLib@@YAJPAUIGeneralArray@BULL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z ?JsonEncode@JsonLib@@YAJPAUIGeneralData@BULL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z ?Parse@JsonLib@@YAJPA_WPAPAUIGeneralArray@BULL@@@Z ?Parse@JsonLib@@YAJPA_WPAPAUIGeneralData@BULL@@@Z ?RSA_Public_Encrypt@Misc@AppUtil@@YAJV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@0PAPAUIGeneralBuffer@BULL@@@Z ?RawURLEncode@Misc@AppUtil@@YAJPBDAAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z ?RegisterSettingUpdateNotify@HelpAppSetting@@YAJPAUIAppSettingUpdateNotify@@@Z ?RunElevatedCmd@UtilElevate@@YAJPB_WPA_WPAK@Z ?SaveData@HelpAppSetting@@YAJXZ ?SetAutoRun@Misc@AppUtil@@YAJH@Z ?SetAutoUpdate@Misc@AppUtil@@YAJH@Z ?SetProxyInfo@HelpProxySetting@@YAJKPA_WG@Z ?SetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@00H@Z ?SetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0H@Z ?SetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0I@Z ?SetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0_J@Z ?TransUidToString@Misc@AppUtil@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAV34@@Z ?TransformUtf8BufferToBSTR@Misc@AppUtil@@YAJPAUIGeneralBuffer@BULL@@PAPA_W@Z ?TransformUtf8HttpMemoryBlockToBSTR@Misc@AppUtil@@YAJPAUIHttpMemoryBlock@BULL@@PAPA_W@Z ?TransformUtf8StringToWString@Misc@AppUtil@@YAJV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@AAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@4@@Z ?TransformWStringToUtf8String@Misc@AppUtil@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@4@@Z ?UnRegisterSettingUpdateNotify@HelpAppSetting@@YAJPAUIAppSettingUpdateNotify@@@Z ?VersionInfoDecode@Misc@AppUtil@@YAJPAPA_WH@Z ?WinMsgPeek@Misc@AppUtil@@YAJXZ AppCheck DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer GetInt64FromJsonDataShim Test

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

422KB

Virtual Size

421KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

832B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

52e0aeeb9092679be795bc8e178d68383aa694b3b3d4f4b11cf7b14f6367d1b0

PE Signature issue

PE Signature issue

bull140u

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

wininet

ws2_32

crypt32

iphlpapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

bcrypt

generic