HoYoPlay_install_ua_4f2236b375eb[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

HoYoPlay_install_ua_4f2236b375eb.exe
Size

166.0MB
MD5

4c85ad9fe691a1b6588d0e5964b36560
SHA1

83770e321ab78d16bece96caeaf08796582c0b9c
SHA256

74ac5fbffae620b5ae62671f42c0c28651ca82f0097d0df882c0a29c2e15c655
SHA512

1e9d207272cf1b9c86944ff8106a945d0275724a1729d2d0f34ece9b8d5fabfb03371d60e8fe2aac754e68da12360a611c6da5aff07c7f8b29c633378c243812
SSDEEP

3145728:bpb3V8070yNZoPXncQVo/CpN+h/y16cm2u9bB3/HWwcbKX8irUGc5nf8v:V7pWPXnc0o/99PB/2s8irURnEv

Score

1^/10

Malware Config

Signatures

Files

HoYoPlay_install_ua_4f2236b375eb.exe
.exe windows:6 windows x64 arch:x64

625b352e52cd581c860ec4f3d877014f

Code Sign

07:d2:59:92:dc:d9:c2:ef:20:2a:92:33:47:d3:42:a7
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

05/07/2024, 00:00

Not After

04/07/2027, 23:59

Subject

CN=COGNOSPHERE PTE. LTD.,O=COGNOSPHERE PTE. LTD.,L=Singapore,C=SG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:d2:59:92:dc:d9:c2:ef:20:2a:92:33:47:d3:42:a7
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

05/07/2024, 00:00

Not After

04/07/2027, 23:59

Subject

CN=COGNOSPHERE PTE. LTD.,O=COGNOSPHERE PTE. LTD.,L=Singapore,C=SG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:cb:19:8a:dd:95:cf:31:bc:4d:56:b5:af:80:bf:a5:06:cf:4b:22:4c:61:31:a1:66:4b:24:06:26:49:59:42
Signer

Actual PE Digest

bc:cb:19:8a:dd:95:cf:31:bc:4d:56:b5:af:80:bf:a5:06:cf:4b:22:4c:61:31:a1:66:4b:24:06:26:49:59:42

Digest Algorithm

sha256

PE Digest Matches

true

4a:59:25:62:91:80:20:40:b7:cf:3e:e1:14:63:f6:5d:19:66:b1:68
Signer

Actual PE Digest

4a:59:25:62:91:80:20:40:b7:cf:3e:e1:14:63:f6:5d:19:66:b1:68

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ole32

StringFromGUID2
CoCreateGuid
CoGetMalloc
ReleaseStgMedium
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleGetClipboard
OleSetClipboard
CoInitializeEx
OleUninitialize
OleInitialize
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

uxtheme

GetThemeTransitionDuration
IsAppThemed
IsThemeActive
SetWindowTheme
GetThemeBool
GetCurrentThemeName
CloseThemeData
GetThemePropertyOrigin
GetThemeMargins
GetThemeEnumValue
GetThemeInt
GetThemePartSize
ord47
IsThemeBackgroundPartiallyTransparent
GetThemeBackgroundRegion
OpenThemeData
GetThemeColor

dwmapi

DwmGetWindowAttribute
DwmIsCompositionEnabled
DwmSetWindowAttribute
DwmEnableBlurBehindWindow

dxgi

CreateDXGIFactory

iphlpapi

ConvertInterfaceLuidToNameW
GetAdaptersAddresses
ConvertInterfaceLuidToGuid
ConvertInterfaceNameToLuidW
ConvertInterfaceLuidToIndex
ConvertInterfaceIndexToLuid

secur32

InitializeSecurityContextW
FreeCredentialsHandle
DeleteSecurityContext
ApplyControlToken
QueryContextAttributesW
FreeContextBuffer
EncryptMessage
DecryptMessage
AcquireCredentialsHandleW
AcceptSecurityContext

bcrypt

BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptOpenAlgorithmProvider

mpr

WNetGetUniversalNameW

userenv

GetUserProfileDirectoryW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

netapi32

NetShareEnum
NetApiBufferFree

kernel32

GetModuleFileNameA
VerifyVersionInfoW
VerSetConditionMask
GetFullPathNameW
CreateProcessW
GetUserDefaultUILanguage
OpenProcess
K32EnumProcessModules
K32GetModuleFileNameExW
lstrcmpW
GetCurrentThreadId
FormatMessageW
WTSGetActiveConsoleSessionId
CheckRemoteDebuggerPresent
GlobalAlloc
GlobalUnlock
GlobalLock
GetLocaleInfoW
GlobalSize
GetUserDefaultLangID
GetFileSizeEx
WriteFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
GetVolumeInformationW
GetLongPathNameW
GetDriveTypeW
GetConsoleWindow
DisconnectNamedPipe
WaitNamedPipeW
ConnectNamedPipe
CreateNamedPipeW
GetOverlappedResult
SetEvent
ResetEvent
CreateEventW
GetCurrentProcess
GlobalFree
SetHandleInformation
TerminateProcess
IsProcessorFeaturePresent
CompareStringEx
GetNativeSystemInfo
GetSystemTime
GetLocalTime
WaitForSingleObjectEx
GetCommandLineW
LoadLibraryW
DuplicateHandle
SwitchToThread
CreateThread
GetCurrentThread
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
ReleaseMutex
GetTimeFormatW
GetCurrencyFormatW
GetUserDefaultLCID
GetUserPreferredUILanguages
GetFileAttributesExW
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount64
UnregisterWaitEx
RegisterWaitForSingleObject
ReadFileEx
PeekNamedPipe
CancelIoEx
SleepEx
WriteFileEx
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
GetFileInformationByHandle
GetLogicalDrives
RemoveDirectoryW
SetFileTime
GetTempPathW
GetVolumePathNamesForVolumeNameW
SetErrorMode
DeviceIoControl
SetLastError
MoveFileW
MoveFileExW
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
GetFileInformationByHandleEx
FlushFileBuffers
GetFileType
SetEndOfFile
SetFilePointerEx
GetStartupInfoW
GetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetExitCodeProcess
GetProcessId
GetModuleHandleExW
GetDiskFreeSpaceExW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
CompareStringW
LCMapStringW
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
FindFirstFileExW
FindNextFileW
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
VirtualAlloc
VirtualFree
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
RaiseException
RtlPcToFileHeader
GetStringTypeW
lstrcatW
lstrcpyW
GetTempFileNameA
GetTempPathA
MultiByteToWideChar
LocalFree
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
DecodePointer
ExpandEnvironmentStringsW
GlobalMemoryStatusEx
GetModuleHandleW
FileTimeToSystemTime
GetFileAttributesW
GetSystemDirectoryW
LocalAlloc
FreeLibrary
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
OutputDebugStringA
GetDiskFreeSpaceExA
GetModuleFileNameW
GetLastError
CloseHandle
SetFilePointer
ReadFile
CreateFileW
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetCPInfo
RtlCaptureContext
LoadLibraryExW
GetCurrentProcessId
WaitForMultipleObjects
Sleep
OpenMutexW
CreateMutexW
CopyFileW
WriteConsoleW
WaitForSingleObject
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
RtlUnwindEx
RtlUnwind
InitializeCriticalSectionAndSpinCount
ExitProcess
GetCommandLineA
ExitThread
FreeLibraryAndExitThread
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SetFileAttributesW
SetStdHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
SetEnvironmentVariableW
GetDateFormatW

shell32

SHCreateItemFromIDList
SHGetMalloc
SHGetPathFromIDListW
SHGetKnownFolderIDList
SHBrowseForFolderW
Shell_NotifyIconW
Shell_NotifyIconGetRect
SHGetFolderPathW
SHGetFolderLocation
SHChangeNotify
SHGetFileInfoW
SHGetStockIconInfo
ord727
ShellExecuteW
SHCreateItemFromParsingName
CommandLineToArgvW
SHGetKnownFolderPath

oleaut32

SafeArrayPutElement
SafeArrayCreateVector
SysFreeString
SysAllocString

ws2_32

htons
WSASocketW
gethostname
WSAHtonl
listen
select
setsockopt
WSAGetLastError
WSAAccept
WSAConnect
getsockname
WSAIoctl
WSANtohl
WSANtohs
WSARecv
WSARecvFrom
getpeername
closesocket
bind
__WSAFDIsSet
getsockopt
getnameinfo
WSASend
WSASendTo
WSACleanup
htonl
ntohl
getaddrinfo
freeaddrinfo
WSAAsyncSelect
WSAStartup

advapi32

BuildTrusteeWithSidW
SetEntriesInAclA
GetNamedSecurityInfoW
SetNamedSecurityInfoW
BuildExplicitAccessWithNameA
OpenProcessToken
AddAccessAllowedAce
AllocateAndInitializeSid
FreeSid
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
RegCloseKey
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
GetSidSubAuthority
GetSidSubAuthorityCount
AccessCheck
CopySid
DuplicateToken
RegSetValueExW
RegQueryInfoKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
GetEffectiveRightsFromAclW
LookupAccountSidW
MapGenericMask

d3d9

D3DPERF_EndEvent
D3DPERF_BeginEvent
Direct3DCreate9
D3DPERF_GetStatus
D3DPERF_SetMarker

gdi32

SelectObject
CreateDIBSection
GdiFlush
BitBlt
OffsetRgn
SetLayout
GetDeviceCaps
CreateCompatibleBitmap
CreateDCW
CreateBitmap
ChoosePixelFormat
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
SelectClipRgn
GetTextMetricsW
GetTextFaceW
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW
GetDIBits
GetRegionData
DeleteObject
DeleteDC
CreateRectRgn
CreateCompatibleDC
CombineRgn
GetBitmapBits
GetObjectW
CreateFontIndirectW
EnumFontFamiliesExW
GetFontData
GetStockObject
RemoveFontMemResourceEx
SetPixelFormat

user32

PostMessageW
AttachThreadInput
CreateWindowExW
IsChild
ShowWindow
UpdateLayeredWindow
SetLayeredWindowAttributes
FlashWindowEx
MoveWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
IsWindowVisible
IsIconic
SetFocus
RegisterTouchWindow
UnregisterTouchWindow
IsTouchWindow
GetCapture
SetCapture
ReleaseCapture
GetMenu
GetSystemMenu
EnableMenuItem
GetForegroundWindow
SetForegroundWindow
BeginPaint
EndPaint
GetUpdateRect
SetWindowRgn
InvalidateRect
SetWindowTextW
GetClientRect
GetWindowRect
AdjustWindowRectEx
SetCursor
ClientToScreen
ScreenToClient
GetWindowLongW
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
GetParent
SetParent
GetWindowThreadProcessId
GetWindow
DestroyCursor
DestroyIcon
MonitorFromPoint
GetAncestor
GetKeyboardLayoutList
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
SendMessageW
RegisterClassExW
GetFocus
GetCursorPos
WindowFromPoint
UpdateLayeredWindowIndirect
GetSysColorBrush
LoadImageW
SetMenu
DrawMenuBar
CreateMenu
CreatePopupMenu
DestroyMenu
InsertMenuW
AppendMenuW
ModifyMenuW
RemoveMenu
TrackPopupMenu
GetMenuItemInfoW
SetMenuItemInfoW
MonitorFromWindow
GetMonitorInfoW
EnumDisplayMonitors
LoadIconW
IsHungAppWindow
SetClipboardViewer
ChangeClipboardChain
RegisterClipboardFormatW
GetKeyboardLayout
RegisterWindowMessageW
IsWindowEnabled
CreateCaret
DestroyCaret
HideCaret
ShowCaret
SetCaretPos
FindWindowA
PeekMessageW
IsZoomed
GetKeyState
GetKeyboardState
ToAscii
ToUnicode
MapVirtualKeyW
TrackPopupMenuEx
RegisterClassW
EnumDisplayDevicesW
SetCursorPos
GetCursor
LoadCursorW
CreateCursor
CreateIconIndirect
GetIconInfo
GetCaretBlinkTime
GetClipboardFormatNameW
TrackMouseEvent
GetMessageExtraInfo
GetAsyncKeyState
GetTouchInputInfo
CloseTouchInputHandle
GetWindowTextW
EnumWindows
RealGetWindowClassW
ChangeWindowMessageFilterEx
MessageBoxW
DrawIconEx
TranslateMessage
DispatchMessageW
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
PostThreadMessageW
CharNextExA
RegisterDeviceNotificationW
UnregisterDeviceNotification
WindowFromDC
CallWindowProcW
SetPropW
GetPropW
RemovePropW
MessageBeep
IsWindow
GetDoubleClickTime
GetDesktopWindow
GetSysColor
ReleaseDC
GetDC
DestroyWindow
DefWindowProcW
SystemParametersInfoW
GetSystemMetrics
UnregisterClassW
ChildWindowFromPointEx
GetClassInfoW
GetCursorInfo

imm32

ImmGetVirtualKey
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmNotifyIME
ImmGetOpenStatus
ImmReleaseContext
ImmGetDefaultIMEWnd
ImmGetContext
ImmAssociateContextEx
ImmAssociateContext
ImmGetCompositionStringW

winmm

timeSetEvent
timeKillEvent
PlaySoundW

crypt32

PFXImportCertStore
CertFindChainInStore
CertFreeCertificateChain
CertGetCertificateChain
CertOpenSystemStoreW
CertVerifyTimeValidity
CertAddStoreToCollection
CertFindCertificateInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CertDuplicateCertificateContext

Exports

Exports

??0PlatformMethods@angle@@QEAA@XZ
??4PlatformMethods@angle@@QEAAAEAU01@$$QEAU01@@Z
??4PlatformMethods@angle@@QEAAAEAU01@AEBU01@@Z
ANGLEGetDisplayPlatform
ANGLEResetDisplayPlatform

Sections

.text
Size: 12.9MB - Virtual size: 12.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 477KB - Virtual size: 568KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 611KB - Virtual size: 611KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmimed
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 434KB - Virtual size: 434KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

625b352e52cd581c860ec4f3d877014f

Code Sign

07:d2:59:92:dc:d9:c2:ef:20:2a:92:33:47:d3:42:a7Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:d2:59:92:dc:d9:c2:ef:20:2a:92:33:47:d3:42:a7Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

bc:cb:19:8a:dd:95:cf:31:bc:4d:56:b5:af:80:bf:a5:06:cf:4b:22:4c:61:31:a1:66:4b:24:06:26:49:59:42Signer

4a:59:25:62:91:80:20:40:b7:cf:3e:e1:14:63:f6:5d:19:66:b1:68Signer

Headers

DLL Characteristics

File Characteristics

Imports

ole32

wtsapi32

uxtheme

dwmapi

dxgi

iphlpapi

secur32

bcrypt

mpr

userenv

version

netapi32

kernel32

shell32

oleaut32

ws2_32

advapi32

d3d9

gdi32

user32

imm32

winmm

crypt32

Exports

Exports

Sections

.text Size: 12.9MB - Virtual size: 12.9MB

.rdata Size: 8.4MB - Virtual size: 8.4MB

.data Size: 477KB - Virtual size: 568KB

.pdata Size: 611KB - Virtual size: 611KB

.qtmetad Size: 1KB - Virtual size: 1KB

.qtmimed Size: 315KB - Virtual size: 315KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 434KB - Virtual size: 434KB

.reloc Size: 72KB - Virtual size: 71KB

07:d2:59:92:dc:d9:c2:ef:20:2a:92:33:47:d3:42:a7
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:d2:59:92:dc:d9:c2:ef:20:2a:92:33:47:d3:42:a7
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

bc:cb:19:8a:dd:95:cf:31:bc:4d:56:b5:af:80:bf:a5:06:cf:4b:22:4c:61:31:a1:66:4b:24:06:26:49:59:42
Signer

4a:59:25:62:91:80:20:40:b7:cf:3e:e1:14:63:f6:5d:19:66:b1:68
Signer

.text
Size: 12.9MB - Virtual size: 12.9MB

.rdata
Size: 8.4MB - Virtual size: 8.4MB

.data
Size: 477KB - Virtual size: 568KB

.pdata
Size: 611KB - Virtual size: 611KB

.qtmetad
Size: 1KB - Virtual size: 1KB

.qtmimed
Size: 315KB - Virtual size: 315KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 434KB - Virtual size: 434KB

.reloc
Size: 72KB - Virtual size: 71KB