Wima[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Wima.exe
Size

26.1MB
MD5

48d732a19514bef06acc712f43fa7d65
SHA1

f06845844e06879d355824ce1fcfa90244d526ed
SHA256

ba4612db8ce37b8e64d163a4c8e236b0ad2ddc223b91383f270924846394bf95
SHA512

041aaa1c64da4d81a6867a56ebd9d8bfd092bd584c09de05349bce42e3b718a36b45970240f0ec25bf962e59730276e51f116d2f7b609beda6993edfa9248135
SSDEEP

393216:+wlf3f5+Z5Q8eFapl37A0Rqo/y1Ma9wiU72rjqiUZqDIzyzTZ+2lSPQl8T5RM0qE:+w2lRyKDnPI6RMZ2rV

Score

1^/10

Malware Config

Signatures

Files

Wima.exe
.exe windows:5 windows x86 arch:x86

79056a8ee27da483e5fb00ff29982a49

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

bf:e7:a6:9f:40:b4:5d:48:64:56:dc:59:bb:91:86:cd
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

06/04/2018, 00:00

Not After

05/04/2020, 23:59

Subject

CN=VSO SOFTWARE,OU=IT,O=VSO SOFTWARE,POSTALCODE=31400,STREET=1ER ETAGE BATIMENT A,L=TOULOUSE,ST=Occitanie,C=FR,2.5.4.18=#13053331343030

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:8c:f2:bf:f8:8d:b4:cf:0b:bb:c8:85:21:42:9e:ac:79:af:b9:54
Signer

Actual PE Digest

52:8c:f2:bf:f8:8d:b4:cf:0b:bb:c8:85:21:42:9e:ac:79:af:b9:54

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

d3d9

Direct3DCreate9

shlwapi

PathCanonicalizeW
PathRelativePathToW
PathFindOnPathW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

user32

CopyImage
MoveWindow
SetMenuItemInfoW
GetMenuItemInfoW
DefFrameProcW
SetCaretPos
GetCaretPos
DrawTextA
ScrollWindowEx
GetDlgCtrlID
FrameRect
RegisterWindowMessageW
GetMenuStringW
FillRect
ClipCursor
SendMessageA
IsClipboardFormatAvailable
EnumWindows
ShowOwnedPopups
GetClassInfoExW
GetClassInfoW
GetScrollRange
SetActiveWindow
GetActiveWindow
DrawEdge
GetKeyboardLayoutList
LoadBitmapW
EnumChildWindows
SendNotifyMessageW
GetScrollBarInfo
UnhookWindowsHookEx
SetCapture
GetCapture
CreatePopupMenu
ShowCaret
GetMenuItemID
DestroyCaret
CharLowerBuffW
PostMessageW
SetWindowLongW
DrawMenuBar
IsZoomed
SetParent
InvalidateRgn
GetClientRect
IsChild
IntersectRect
IsIconic
CallNextHookEx
ShowWindow
SetForegroundWindow
GetWindowTextW
GetAsyncKeyState
GetWindowTextLengthW
DestroyWindow
IsDialogMessageW
RegisterClassW
EndMenu
CharNextW
GetFocus
GetDC
SetFocus
ReleaseDC
ExitWindowsEx
GetClassLongW
DrawTextW
SetScrollRange
PeekMessageA
MessageBeep
SetClassLongW
SetRectEmpty
LockWindowUpdate
RemovePropW
AttachThreadInput
GetSubMenu
EqualRect
DestroyIcon
IsWindowVisible
DispatchMessageA
PtInRect
UnregisterClassW
GetTopWindow
SendMessageW
GetMessageTime
NotifyWinEvent
GetComboBoxInfo
CreateMenu
LoadStringW
CharLowerW
SetWindowRgn
SetWindowPos
GetWindowRgn
ShowWindowAsync
GetMenuItemCount
GetSysColorBrush
GetWindowDC
DrawTextExW
CharLowerBuffA
EnumClipboardFormats
ScrollDC
GetScrollInfo
SetWindowTextW
GetMessageExtraInfo
GetSysColor
EnableScrollBar
TrackPopupMenu
DrawIconEx
GetClassNameW
GetMessagePos
GetIconInfo
SetScrollInfo
GetKeyNameTextW
GetDesktopWindow
SetCursorPos
GetCursorPos
SetMenu
GetMenuState
GetMenu
SetRect
GetKeyState
IsRectEmpty
ValidateRect
IsCharAlphaW
GetCursor
CopyRect
KillTimer
BeginDeferWindowPos
WaitMessage
TranslateMDISysAccel
GetWindowPlacement
GetClipboardFormatNameW
CreateIconIndirect
GetMenuItemRect
CreateWindowExW
ChildWindowFromPoint
GetMessageW
GetDCEx
PeekMessageW
MonitorFromWindow
RegisterDeviceNotificationW
GetUpdateRect
MessageBoxA
SetTimer
WindowFromPoint
BeginPaint
DrawStateW
RegisterClipboardFormatW
DrawAnimatedRects
MapVirtualKeyW
OffsetRect
IsWindowUnicode
DispatchMessageW
CreateAcceleratorTableW
DefMDIChildProcW
WaitForInputIdle
GetSystemMenu
SetScrollPos
GetScrollPos
InflateRect
DrawFocusRect
ReleaseCapture
LoadCursorW
ScrollWindow
GetLastActivePopup
MessageBoxIndirectW
GetSystemMetrics
CharUpperBuffW
ClientToScreen
SetClipboardData
GetClipboardData
SetWindowPlacement
InvertRect
GetMonitorInfoW
CheckMenuItem
CharUpperW
UnregisterDeviceNotification
DefWindowProcW
GetForegroundWindow
ToAscii
EnableWindow
GetShellWindow
GetWindowThreadProcessId
RedrawWindow
EndPaint
MsgWaitForMultipleObjectsEx
LoadKeyboardLayoutW
ActivateKeyboardLayout
GetParent
CreateCaret
MonitorFromRect
InsertMenuItemW
GetPropW
MessageBoxW
SetPropW
UpdateWindow
MsgWaitForMultipleObjects
DestroyMenu
SetWindowsHookExW
GetDoubleClickTime
EmptyClipboard
GetDlgItem
AdjustWindowRectEx
DrawIcon
IsWindow
EnumThreadWindows
InvalidateRect
SetKeyboardState
GetKeyboardState
DrawFrameControl
ScreenToClient
IsCharAlphaNumericW
WindowFromDC
SetCursor
CreateIcon
RemoveMenu
SubtractRect
GetKeyboardLayoutNameW
OpenClipboard
TranslateMessage
MapWindowPoints
EnumDisplayMonitors
CallWindowProcW
CountClipboardFormats
CloseClipboard
DestroyCursor
CharUpperBuffA
CopyIcon
PostQuitMessage
ShowScrollBar
LoadImageW
EnableMenuItem
DeferWindowPos
HideCaret
EndDeferWindowPos
FindWindowExW
MonitorFromPoint
LoadIconW
SystemParametersInfoW
GetWindow
GetWindowLongW
GetWindowRect
InsertMenuW
PostThreadMessageW
IsWindowEnabled
IsDialogMessageA
FindWindowW
DeleteMenu
GetKeyboardLayout

olepro32

OleLoadPicture

oleaut32

SafeArrayPutElement
SetErrorInfo
GetErrorInfo
VariantInit
VariantClear
SysFreeString
SafeArrayAccessData
LoadTypeLibEx
SysReAllocStringLen
SafeArrayCreate
CreateErrorInfo
SafeArrayGetElement
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetUBound
SafeArrayGetLBound
RegisterTypeLib
VariantCopyInd
VariantChangeType

netapi32

NetWkstaGetInfo
NetApiBufferFree

advapi32

RegSetValueExW
RegSetValueExA
RegConnectRegistryW
RegEnumKeyW
RegCreateKeyW
OpenThreadToken
SetSecurityDescriptorSacl
RegQueryInfoKeyW
CryptGenRandom
RegUnLoadKeyW
CryptReleaseContext
IsValidSid
RegSaveKeyW
PrivilegeCheck
GetLengthSid
RegOpenKeyW
RegReplaceKeyW
GetSidSubAuthority
GetTokenInformation
AddAccessAllowedAce
LookupAccountSidW
RegCreateKeyExW
CryptAcquireContextW
SetSecurityDescriptorDacl
GetSidSubAuthorityCount
InitializeAcl
RegLoadKeyW
RegEnumKeyExW
SetSecurityDescriptorGroup
GetSidIdentifierAuthority
RegDeleteKeyW
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegOpenKeyExA
AllocateAndInitializeSid
FreeSid
RegDeleteValueW
RegFlushKey
RegQueryValueExW
RegQueryValueExA
RegEnumValueW
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
RegCloseKey
RegRestoreKeyW

msvcrt

sscanf
qsort
isupper
isalpha
isalnum
toupper
memchr
memcmp
memcpy
memset
isprint
_setjmp
isspace
iscntrl
longjmp
isxdigit
ispunct
isgraph
islower
tolower

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpWriteData
WinHttpSetCredentials
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSendRequest
WinHttpQueryOption

kernel32

SetFileTime
GetFileType
FlushViewOfFile
GetACP
GetStringTypeExW
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
GetCurrentProcessId
Beep
TerminateThread
IsDebuggerPresent
GetFullPathNameW
FindNextFileW
GlobalSize
GetCPInfoExW
GetSystemTime
WriteProcessMemory
SetFilePointerEx
EnumSystemLocalesW
CreateWaitableTimerW
GetTimeZoneInformation
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
FreeLibrary
HeapDestroy
DosDateTimeToFileTime
GetUserDefaultLCID
MapViewOfFileEx
SetLastError
WaitNamedPipeW
GetModuleFileNameW
GetLastError
GlobalAlloc
GlobalUnlock
OpenMutexW
CompareStringW
CreateThread
CreateMutexW
LoadLibraryA
ResetEvent
GetVolumeInformationW
OpenEventW
RaiseException
FindFirstChangeNotificationW
FormatMessageW
GetCurrentThread
GetLogicalDrives
IsBadReadPtr
BackupSeek
ExpandEnvironmentStringsW
LoadLibraryExW
MoveFileWithProgressW
FileTimeToSystemTime
GetShortPathNameW
EnumSystemCodePagesW
VirtualQuery
GlobalFindAtomW
VirtualQueryEx
Sleep
SetFilePointer
FlushFileBuffers
LoadResource
RemoveVectoredExceptionHandler
SuspendThread
GetTickCount
WaitForMultipleObjects
GetFileSize
GetStartupInfoW
GetFileAttributesW
VerLanguageNameW
GetThreadPriority
SetThreadPriority
VirtualAlloc
GetSystemInfo
GetTempPathW
LeaveCriticalSection
SetWaitableTimer
GetLogicalDriveStringsW
HeapCreate
VerSetConditionMask
GetDiskFreeSpaceW
GetUserDefaultUILanguage
GetConsoleOutputCP
GetModuleFileNameA
CompareStringA
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
HeapFree
WideCharToMultiByte
MultiByteToWideChar
FindClose
LoadLibraryW
SetEvent
FreeEnvironmentStringsW
GetLocaleInfoW
BackupWrite
GetLocalTime
WaitForSingleObject
DeleteCriticalSection
SetErrorMode
GetComputerNameW
SleepEx
IsValidLocale
VirtualFreeEx
LocalAlloc
WaitForMultipleObjectsEx
SetFileAttributesW
QueryDosDeviceW
VirtualProtect
CreateSemaphoreW
ReadProcessMemory
OpenFileMappingW
QueryPerformanceFrequency
VirtualFree
FlushInstructionCache
ExitProcess
HeapAlloc
FindNextChangeNotification
GetLongPathNameW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
TryEnterCriticalSection
CompareFileTime
FileTimeToDosDateTime
ReadFile
CreateProcessW
TransactNamedPipe
HeapSize
FindResourceW
lstrlenA
CopyFileW
AddVectoredExceptionHandler
lstrcmpA
MapViewOfFile
MulDiv
GetVersion
GetDriveTypeW
GetComputerNameExW
FreeResource
SetThreadExecutionState
MoveFileW
GlobalAddAtomW
GetSystemTimeAsFileTime
OpenProcess
SwitchToThread
GetExitCodeThread
BackupRead
OutputDebugStringW
LocalFileTimeToFileTime
GetFileAttributesExW
SetNamedPipeHandleState
GlobalMemoryStatusEx
SetPriorityClass
TerminateProcess
LockResource
GetPriorityClass
GetCurrentThreadId
UnhandledExceptionFilter
MoveFileExW
PeekNamedPipe
GlobalFree
EnterCriticalSection
ReleaseMutex
GetStringTypeExA
GlobalDeleteAtom
SetCurrentDirectoryW
GetCurrentDirectoryW
InitializeCriticalSection
GlobalLock
GetCurrentProcess
GetCommandLineW
GetProcAddress
ResumeThread
VirtualAllocEx
GetVersionExW
VerifyVersionInfoW
GetWindowsDirectoryW
GetEnvironmentStringsW
GetProcessAffinityMask
DeviceIoControl
SignalObjectAndWait
LCMapStringW
FindFirstFileW
UnmapViewOfFile
GetConsoleCP
GlobalHandle
CallNamedPipeW
FindResourceA
lstrlenW
QueryPerformanceCounter
SetEndOfFile
CopyFileExW
lstrcmpW
ReleaseSemaphore
SystemTimeToFileTime
CreateFileW
EnumResourceNamesW
GetDriveTypeA
DeleteFileW
SetThreadAffinityMask
FindCloseChangeNotification
GetEnvironmentVariableW
WriteFile
GetFileInformationByHandle
FindFirstFileExW
CreateFileMappingW
ExitThread
TlsGetValue
GetDateFormatW
PulseEvent
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
GetOverlappedResult
EnumCalendarInfoW
RemoveDirectoryW
OpenSemaphoreW
GlobalMemoryStatus
CreateEventW
SetThreadLocale
GetThreadLocale

shfolder

SHGetFolderPathW

wsock32

accept
htons
ntohs
getsockopt
setsockopt
select
WSAStartup
__WSAFDIsSet
WSACleanup
getsockname
listen
gethostbyname
bind
closesocket
inet_ntoa
socket
recv
ioctlsocket
WSAGetLastError
connect
shutdown
inet_addr
send

crypt32

CertGetNameStringA
CryptVerifyMessageSignature
CryptDecodeObject
CryptQueryObject
CertFreeCertificateContext
CryptMsgGetParam
CryptMsgClose

gdiplus

GdipFillEllipseI
GdipCloneImage
GdipDrawBezier
GdipDrawImagePointsRectI
GdipSetPenDashOffset
GdipGetPenDashOffset
GdipCreateFontFromDC
GdipClonePath
GdipIsVisibleRegionRect
GdipSetClipHrgn
GdipSetPixelOffsetMode
GdipGetLineColors
GdipSetClipPath
GdipGetEmHeight
GdipGetRegionBoundsI
GdipDrawPie
GdipFillRectangle
GdipGetPageUnit
GdipSetPageUnit
GdipGetLineGammaCorrection
GdipGetRegionDataSize
GdipFillClosedCurveI
GdipAddPathPolygon
GdipCombineRegionPath
GdipCreateMetafileFromFile
GdipRestoreGraphics
GdipResetPath
GdipGetFontSize
GdipResetImageAttributes
GdipGetCustomLineCapBaseCap
GdipAddPathEllipse
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesRemapTable
GdipFillPie
GdipDrawCurve2
GdipCreateHatchBrush
GdipSetPenDashStyle
GdipGetPenDashStyle
GdipSetLineGammaCorrection
GdipGetLineBlendCount
GdipGetSolidFillColor
GdipGetImageBounds
GdipSetSolidFillColor
GdipSetLineLinearBlend
GdipLoadImageFromFile
GdipGetPenCompoundCount
GdipAddPathEllipseI
GdipScaleMatrix
GdipGetLineWrapMode
GdipSetLineWrapMode
GdipSetLineColors
GdipCloneBrush
GdipGetMetafileHeaderFromFile
GdipSaveAdd
GdipGetGenericFontFamilyMonospace
GdipRecordMetafileI
GdipCreateFromHDC
GdipGetClipBounds
GdipSetImageAttributesOutputChannelColorProfile
GdipDeletePath
GdipIsVisibleClipEmpty
GdipIsVisibleRegionRectI
GdipIsVisiblePoint
GdipGetPenWidth
GdipSetPenWidth
GdipShearMatrix
GdipSetClipGraphics
GdipGetStringFormatDigitSubstitution
GdipDisposeImageAttributes
GdipCreateMatrix3
GdipRecordMetafileFileName
GdipGetFontUnit
GdipGetImageRawFormat
GdiplusShutdown
GdipRecordMetafileStream
GdipSetLinePresetBlend
GdipDrawImagePointsI
GdipCreateBitmapFromStream
GdipTranslateRegion
GdipEnumerateMetafileDestPoint
GdipGetVisibleClipBoundsI
GdipGetLineRect
GdipDeleteCachedBitmap
GdipSetImageAttributesColorMatrix
GdipGetHatchStyle
GdipDrawClosedCurve2
GdipDrawArc
GdipAlloc
GdipClosePathFigure
GdipDrawImageI
GdipAddPathCurve
GdipGetPenMiterLimit
GdipSetPenMiterLimit
GdipAddPathLineI
GdipGetStringFormatTrimming
GdipSetPropertyItem
GdipGetPropertyItem
GdipAddPathCurveI
GdipCreatePath
GdipCreatePen1
GdipFlattenPath
GdipVectorTransformMatrixPoints
GdipClonePen
GdipDrawCurveI
GdipGetFontStyle
GdipGetImageAttributesAdjustedPalette
GdipDeletePen
GdipCreateBitmapFromStreamICM
GdipSetPenDashCap197819
GdipEnumerateMetafileDestPointsI
GdipGetPageScale
GdipSetPageScale
GdipCreateFromHDC2
GdipTransformPath
GdipMultiplyLineTransform
GdipCreateLineBrushFromRectWithAngleI
GdipFree
GdipCreateTexture2
GdipBeginContainer
GdipResetTextureTransform
GdipAddPathPolygonI
GdipReversePath
GdipGetFontHeight
GdipGetPenCompoundArray
GdipGetLineSpacing
GdipTranslateWorldTransform
GdipGetPenMode
GdipDrawLinesI
GdipAddPathClosedCurve2I
GdipCreateRegionHrgn
GdipEnumerateMetafileSrcRectDestRectI
GdipCreateRegionPath
GdipSetPenCustomEndCap
GdiplusStartup
GdipGetImageEncoders
GdipImageRotateFlip
GdipVectorTransformMatrixPointsI
GdipGetTextureTransform
GdipMultiplyMatrix
GdipDrawCurve
GdipAddPathBeziersI
GdipGetMetafileHeaderFromEmf
GdipGetMetafileHeaderFromWmf
GdipDisposeImage
GdipSetClipRect
GdipCreatePath2I
GdipGetHatchForegroundColor
GdipGetCustomLineCapStrokeCaps
GdipGetClipBoundsI
GdipSetCustomLineCapStrokeCaps
GdipClosePathFigures
GdipMultiplyPenTransform
GdipGetClip
GdipCreateBitmapFromHBITMAP
GdipCreateRegion
GdipScaleLineTransform
GdipAddPathClosedCurve2
GdipGetPenDashArray
GdipSetPenDashArray
GdipResetClip
GdipAddPathStringI
GdipDrawCachedBitmap
GdipGetRegionScansCount
GdipGetTextureImage
GdipEnumerateMetafileSrcRectDestRect
GdipGetImageType
GdipDrawBezierI
GdipSetImageAttributesThreshold
GdipGetMetafileDownLevelRasterizationLimit
GdipSetMetafileDownLevelRasterizationLimit
GdipGetWorldTransform
GdipIsVisiblePathPoint
GdipGetPathWorldBoundsI
GdipAddPathLine2
GdipCombineRegionRectI
GdipSetWorldTransform
GdipGetAllPropertyItems
GdipAddPathCurve2I
GdipAddPathCurve3I
GdipDrawPolygonI
GdipRecordMetafileFileNameI
GdipGetGenericFontFamilySerif
GdipDrawLine
GdipEnumerateMetafileDestPoints
GdipDrawCurve3
GdipGetPathWorldBounds
GdipGetHemfFromMetafile
GdipDrawPath
GdipGetPenFillType
GdipDrawRectangle
GdipCreateBitmapFromHICON
GdipTranslateTextureTransform
GdipSetImageAttributesNoOp
GdipTranslateMatrix
GdipFillRectangles
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipSetCompositingMode
GdipGetPropertyIdList
GdipDeleteStringFormat
GdipGetCompositingQuality
GdipSetCompositingQuality
GdipTranslateClipI
GdipGetDpiX
GdipSetLineSigmaBlend
GdipTransformMatrixPoints
GdipIsVisiblePathPointI
GdipCreateSolidFill
GdipBitmapSetResolution
GdipDrawRectangles
GdipGetGenericFontFamilySansSerif
GdipCreateBitmapFromGraphics
GdipGetMetafileHeaderFromStream
GdipSetImageAttributesGamma
GdipScaleWorldTransform
GdipIsMatrixInvertible
GdipDrawDriverString
GdipCreateFontFamilyFromName
GdipCreateMatrix2
GdipCreateBitmapFromResource
GdipIsVisibleRegionPoint
GdipCreateMetafileFromEmf
GdipCreateMetafileFromWmf
GdipCreateRegionRect
GdipCreateMatrix
GdipEndContainer
GdipComment
GdipGetImageVerticalResolution
GdipLoadImageFromStreamICM
GdipGetStringFormatTabStopCount
GdipCreateMetafileFromWmfFile
GdipGetCustomLineCapBaseInset
GdipSetCustomLineCapBaseInset
GdipIsInfiniteRegion
GdipResetWorldTransform
GdipImageGetFrameCount
GdipEnumerateMetafileSrcRectDestPointsI
GdipDrawImagePointsRect
GdipDrawPolygon
GdipDrawEllipse
GdipGetPathPoints
GdipAddPathArc
GdipIsClipEmpty
GdipGetCellDescent
GdipCreatePen2
GdipDrawClosedCurve
GdipGetMetafileHeaderFromMetafile
GdipDrawArcI
GdipRotateMatrix
GdipIsEqualRegion
GdipDrawPieI
GdipGetRenderingOrigin
GdipDeleteFont
GdipDeleteCustomLineCap
GdipGetStringFormatFlags
GdipSetStringFormatFlags
GdipCreateCachedBitmap
GdipMeasureDriverString
GdipRemovePropertyItem
GdipGetRegionHRgn
GdipIsStyleAvailable
GdipSetPenCompoundArray
GdipResetLineTransform
GdipGetImagePixelFormat
GdipGetImageHeight
GdipSaveGraphics
GdipCreateImageAttributes
GdipCombineRegionRegion
GdipCreateLineBrush
GdipFillPolygon
GdipDrawImageRect
GdipAddPathBezier
GdipFillEllipse
GdipDrawImageRectI
GdipRotatePenTransform
GdipSetTextureTransform
GdipGetFontHeightGivenDPI
GdipMeasureString
GdipAddPathBeziers
GdipEmfToWmfBits
GdipFillClosedCurve
GdipSetCustomLineCapBaseCap
GdipFillPolygonI
GdipBitmapLockBits
GdipLoadImageFromStream
GdipGetStringFormatTabStops
GdipCreateFont
GdipDrawImage
GdipAddPathRectangles
GdipDrawClosedCurveI
GdipCreateLineBrushFromRectI
GdipIsMatrixIdentity
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipFillPath
GdipFillClosedCurve2I
GdipCreateTexture2I
GdipCloneImageAttributes
GdipEnumerateMetafileDestRect
GdipBeginContainerI
GdipGetTextureWrapMode
GdipDeleteFontFamily
GdipGetLogFontA
GdipGraphicsClear
GdipAddPathPie
GdipDeleteRegion
GdipGetPropertySize
GdipAddPathCurve3
GdipCreateHalftonePalette
GdipLoadImageFromFileICM
GdipBitmapGetPixel
GdipCreateTexture
GdipBitmapSetPixel
GdipGetPenColor
GdipSetPenColor
GdipGetPenTransform
GdipSetPenTransform
GdipDrawLines
GdipCreateMetafileFromStream
GdipCreateFromHWND
GdipGetCellAscent
GdipCreateRegionRgnData
GdipCreateBitmapFromFile
GdipAddPathLine
GdipWindingModeOutline
GdipGetRegionBounds
GdipCreateHICONFromBitmap
GdipGetPixelOffsetMode
GdipGetImageThumbnail
GdipGetImagePaletteSize
GdipAddPathString
GdipGetImageWidth
GdipSaveAddImage
GdipTranslateLineTransform
GdipGetBrushType
GdipGetEncoderParameterListSize
GdipIsOutlineVisiblePathPointI
GdipGetHatchBackgroundColor
GdipTransformRegion
GdipSetPathMarker
GdipGetLinePresetBlendCount
GdipGetFontCollectionFamilyList
GdipAddPathPath
GdipSetStringFormatTrimming
GdipRotateLineTransform
GdipStringFormatGetGenericDefault
GdipGetPathLastPoint
GdipAddPathClosedCurveI
GdipGetFamilyName
GdipRecordMetafile
GdipCreateStringFormat
GdipFillPieI
GdipIsVisibleRect
GdipBeginContainer2
GdipDeleteMatrix
GdipFillClosedCurve2
GdipDrawBeziers
GdipMultiplyWorldTransform
GdipPlayMetafileRecord
GdipGetLogFontW
GdipIsOutlineVisiblePathPoint
GdipCreateLineBrushFromRectWithAngle
GdipGetPathTypes
GdipAddPathLine2I
GdipGetImageDimension
GdipSetPenLineCap197819
GdipEnumerateMetafileSrcRectDestPointI
GdipCreateFontFromLogfontW
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipCloneStringFormat
GdipCreateFromHWNDICM
GdipDeleteGraphics
GdipCreateBitmapFromFileICM
GdipGetLinePresetBlend
GdipCloneBitmapArea
GdipSetLineTransform
GdipGetLineTransform
GdipFillRectangleI
GdipGetStringFormatHotkeyPrefix
GdipCloneFontFamily
GdipSetPenMode
GdipGetPenCustomStartCap
GdipSetPenCustomStartCap
GdipScalePenTransform
GdipAddPathArcI
GdipMultiplyTextureTransform
GdipDrawRectangleI
GdipCreateRegionRectI
GdipCreateLineBrushI
GdipGetImageFlags
GdipGetLineRectI
GdipTransformMatrixPointsI
GdipDrawImageRectRect
GdipSaveImageToStream
GdipResetPenTransform
GdipAddPathPieI
GdipEnumerateMetafileSrcRectDestPoint
GdipFlush
GdipTranslateRegionI
GdipGetPointCount
GdipTranslateClip
GdipCreateMatrix3I
GdipDrawImagePointRectI
GdipTransformPoints
GdipGetLineBlend
GdipBitmapUnlockBits
GdipSetLineBlend
GdipCloneBitmapAreaI
GdipDrawRectanglesI
GdipImageSelectActiveFrame
GdipCreateBitmapFromGdiDib
GdipIsEmptyRegion
GdipCreateBitmapFromScan0
GdipCreateLineBrushFromRect
GdipAddPathClosedCurve
GdipAddPathRectangle
GdipTransformPointsI
GdipDrawImagePointRect
GdipDrawString
GdipGetImageGraphicsContext
GdipGetMatrixElements
GdipCreateTextureIA
GdipSetImagePalette
GdipGetImagePalette
GdipGetStringFormatMeasurableCharacterRangeCount
GdipStartPathFigure
GdipSetMatrixElements
GdipIsMatrixEqual
GdipIsVisibleRectI
GdipGetPenCustomEndCap
GdipStringFormatGetGenericTypographic
GdipGetStringFormatLineAlign
GdipSetStringFormatLineAlign
GdipGetTextContrast
GdipSetTextContrast
GdipDrawEllipseI
GdipGetImageHorizontalResolution
GdipAddPathCurve2
GdipImageGetFrameDimensionsCount
GdipEnumerateMetafileSrcRectDestPoints
GdipCreatePath2
GdipCreateFontFromLogfontA
GdipSetClipRectI
GdipGetFamily
GdipDrawCurve2I
GdipDrawCurve3I
GdipGetRegionScansI
GdipSaveImageToFile
GdipCloneRegion
GdipIsVisiblePointI
GdipSetStringFormatMeasurableCharacterRanges
GdipSetImageAttributesToIdentity
GdipFillRectanglesI
GdipGetCustomLineCapStrokeJoin
GdipGetPenEndCap
GdipSetPenEndCap
GdipSetCustomLineCapStrokeJoin
GdipSetPenStartCap
GdipGetNearestColor
GdipSetStringFormatDigitSubstitution
GdipGetDpiY
GdipSetEmpty
GdipSetImageAttributesColorKeys
GdipGetPathPointsI
GdipGetPropertyCount
GdipGetRegionData
GdipInvertMatrix
GdipGetStringFormatAlign
GdipSetStringFormatAlign
GdipGetPathData
GdipCloneFont
GdipAddPathBezierI
GdipRotateWorldTransform
GdipGetVisibleClipBounds
GdipSetRenderingOrigin
GdipImageGetFrameDimensionsList
GdipSetInfinite
GdipScaleTextureTransform
GdipFillRegion
GdipSetPenLineJoin
GdipAddPathRectangleI
GdipTranslatePenTransform
GdipDrawBeziersI
GdipGetCompositingMode
GdipCloneMatrix
GdipRecordMetafileStreamI
GdipGetCustomLineCapWidthScale
GdipSetCustomLineCapWidthScale
GdipDrawImagePoints
GdipRotateTextureTransform
GdipSetClipRegion
GdipMeasureCharacterRanges
GdipGetPenDashCount
GdipDrawClosedCurve2I
GdipGetPropertyItemSize
GdipEnumerateMetafileDestRectI
GdipGetPathFillMode
GdipSetPathFillMode
GdipSetStringFormatHotkeyPrefix

gdi32

AddFontMemResourceEx
SetPaletteEntries
Pie
SetBkMode
GetRandomRgn
CreateCompatibleBitmap
CreatePolygonRgn
BeginPath
GetEnhMetaFileHeader
CloseEnhMetaFile
RectVisible
AngleArc
CloseFigure
StrokeAndFillPath
ResizePalette
SetAbortProc
SetTextColor
GetTextColor
StretchBlt
PathToRegion
SetArcDirection
ExtSelectClipRgn
RoundRect
SelectClipRgn
RestoreDC
FillPath
SetRectRgn
GetTextMetricsW
RemoveFontResourceW
GetWindowOrgEx
SetPixelV
CreatePalette
CreateDCW
CreateICW
CreatePen
FillRgn
PolyBezierTo
GetStockObject
CreateSolidBrush
GetBkMode
Polygon
MoveToEx
PlayEnhMetaFile
Ellipse
StartPage
GetBitmapBits
SetTextCharacterExtra
GetTextCharacterExtra
StartDocW
AbortDoc
GetSystemPaletteEntries
GetEnhMetaFileBits
CreatePenIndirect
SetBitmapBits
GetEnhMetaFilePaletteEntries
SetMapMode
GetMapMode
CreateFontIndirectW
PolyBezier
ExtCreatePen
GetBitmapDimensionEx
LPtoDP
GetNearestColor
EndDoc
GetObjectW
GetCurrentObject
GetWinMetaFileBits
SetROP2
GetTextExtentExPointW
PtVisible
GetEnhMetaFileDescriptionW
CreateEllipticRgnIndirect
ArcTo
CreateEnhMetaFileW
Arc
CreateRectRgnIndirect
PolylineTo
TextOutW
SelectPalette
SetGraphicsMode
ExcludeClipRect
SetWindowOrgEx
MaskBlt
CreatePatternBrush
EndPage
EndPath
DeleteEnhMetaFile
Chord
SetDIBits
SetViewportOrgEx
GetViewportOrgEx
CreateRectRgn
RealizePalette
SetDIBColorTable
GetDIBColorTable
GetGlyphOutlineW
CreateBrushIndirect
StrokePath
PatBlt
SelectClipPath
SetEnhMetaFileBits
PlgBlt
Rectangle
DeleteDC
SaveDC
BitBlt
FrameRgn
SetWorldTransform
GetDeviceCaps
GetTextExtentPoint32W
GetClipBox
GetClipRgn
Polyline
IntersectClipRect
CreateBitmap
CombineRgn
SetWinMetaFileBits
CreateDIBitmap
GetStretchBltMode
CreateDIBSection
SetStretchBltMode
GetDIBits
ExtCreateRegion
LineTo
GetRgnBox
EnumFontFamiliesW
EnumFontsW
SetWindowExtEx
CreateHalftonePalette
DeleteObject
SelectObject
ExtFloodFill
UnrealizeObject
CopyEnhMetaFileW
OffsetRgn
GetBkColor
SetBkColor
CreateCompatibleDC
GetObjectA
GetBrushOrgEx
GetCurrentPositionEx
SetDCPenColor
GetNearestPaletteIndex
SetTextAlign
GetTextAlign
RemoveFontMemResourceEx
CreateRoundRectRgn
GetTextExtentPointW
ExtTextOutW
SetBrushOrgEx
GetPixel
GdiFlush
SetViewportExtEx
SetPixel
PolyPolyline
EnumFontFamiliesExW
StretchDIBits
WidenPath
GetPaletteEntries

mpr

WNetGetUniversalNameW
WNetGetConnectionW

winmm

waveOutOpen
sndPlaySoundW
waveOutUnprepareHeader
waveOutGetDevCapsW
waveOutReset
timeGetTime
waveOutPause
waveOutGetPosition
mciSendStringW
waveOutSetVolume
waveOutGetVolume
waveOutPrepareHeader
waveOutRestart
waveOutWrite
waveOutClose

oleacc

LresultFromObject

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW
GetDefaultPrinterW
EnumPrintersW

comdlg32

ChooseColorW
GetSaveFileNameW
GetOpenFileNameW

comctl32

ImageList_GetImageInfo
FlatSB_SetScrollInfo
InitCommonControls
ImageList_DragMove
ImageList_Destroy
_TrackMouseEvent
ImageList_DragShowNolock
ImageList_Add
FlatSB_SetScrollProp
ImageList_GetDragImage
ImageList_Create
ImageList_EndDrag
ImageList_DrawEx
ImageList_SetImageCount
FlatSB_GetScrollPos
FlatSB_SetScrollPos
InitializeFlatSB
ImageList_Copy
FlatSB_GetScrollInfo
ImageList_Write
ImageList_DrawIndirect
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_BeginDrag
ImageList_GetIcon
ImageList_Replace
ImageList_GetImageCount
ImageList_DragEnter
ImageList_GetIconSize
ImageList_SetIconSize
ImageList_Read
ImageList_DragLeave
ImageList_LoadImageW
ImageList_Draw
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetOverlayImage

shell32

SHBrowseForFolderW
DragQueryFileW
SHGetSpecialFolderLocation
Shell_NotifyIconW
ShellExecuteExW
SHGetPathFromIDListW
ExtractIconW
SHGetFileInfoW
SHGetFolderPathW
SHGetMalloc
SHGetDesktopFolder
SHChangeNotify
SHFileOperationW
ShellExecuteW

imagehlp

ImageEnumerateCertificates
ImageGetCertificateData
ImageGetCertificateHeader

ole32

CreateDataAdviseHolder
CoCreateGuid
CoCreateInstance
OleGetClipboard
OleSetClipboard
IsEqualGUID
OleFlushClipboard
CreateStreamOnHGlobal
CLSIDFromProgID
CoInitialize
CoTaskMemAlloc
DoDragDrop
StringFromCLSID
RevokeDragDrop
CoRevokeClassObject
CoRegisterClassObject
CoUninitialize
ReleaseStgMedium
RegisterDragDrop
CoLockObjectExternal
OleInitialize
OleUninitialize
CoInitializeEx
CoDisconnectObject
CoTaskMemFree

msdmo

MoFreeMediaType

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 17.8MB - Virtual size: 17.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 870KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 159B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 132B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79056a8ee27da483e5fb00ff29982a49

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

bf:e7:a6:9f:40:b4:5d:48:64:56:dc:59:bb:91:86:cdCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

52:8c:f2:bf:f8:8d:b4:cf:0b:bb:c8:85:21:42:9e:ac:79:af:b9:54Signer

Headers

File Characteristics

Imports

d3d9

shlwapi

version

user32

olepro32

oleaut32

netapi32

advapi32

msvcrt

winhttp

kernel32

shfolder

wsock32

crypt32

gdiplus

gdi32

mpr

winmm

oleacc

winspool.drv

comdlg32

comctl32

shell32

imagehlp

ole32

msdmo

Exports

Exports

Sections

.text Size: 17.8MB - Virtual size: 17.8MB

.itext Size: 63KB - Virtual size: 62KB

.data Size: 1.3MB - Virtual size: 1.3MB

.bss Size: - Virtual size: 870KB

.idata Size: 40KB - Virtual size: 40KB

.didata Size: 30KB - Virtual size: 29KB

.edata Size: 512B - Virtual size: 159B

.tls Size: - Virtual size: 132B

.rdata Size: 512B - Virtual size: 93B

.reloc Size: 1.3MB - Virtual size: 1.3MB

.rsrc Size: 5.5MB - Virtual size: 5.5MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

bf:e7:a6:9f:40:b4:5d:48:64:56:dc:59:bb:91:86:cd
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

52:8c:f2:bf:f8:8d:b4:cf:0b:bb:c8:85:21:42:9e:ac:79:af:b9:54
Signer

.text
Size: 17.8MB - Virtual size: 17.8MB

.itext
Size: 63KB - Virtual size: 62KB

.data
Size: 1.3MB - Virtual size: 1.3MB

.bss
Size: - Virtual size: 870KB

.idata
Size: 40KB - Virtual size: 40KB

.didata
Size: 30KB - Virtual size: 29KB

.edata
Size: 512B - Virtual size: 159B

.tls
Size: - Virtual size: 132B

.rdata
Size: 512B - Virtual size: 93B

.reloc
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 5.5MB - Virtual size: 5.5MB