6692008a81ed291945bbc7c9565c6fd81eecf5f35787aa757dd83810d9a2bbe4

Sharing

Copy URL Twitter E-mail

General

Target

6692008a81ed291945bbc7c9565c6fd81eecf5f35787aa757dd83810d9a2bbe4
Size

3.5MB
MD5

f7e5528cf52458b0f6fa2da22d24f916
SHA1

dd8929244390cb64819c61495a818391db3409c1
SHA256

6692008a81ed291945bbc7c9565c6fd81eecf5f35787aa757dd83810d9a2bbe4
SHA512

0af555842e984e3d8a09c88988d03d4f5c90ac66782431f0b4597bcf2bcb304855ebf585110d25c036201fe4a41aa13d6196b5da0efbf0aaa9f770d41b6ddf00
SSDEEP

49152:pyqNIjKSMwk58P/3K+UHtRYcCqg+1tapM:p2fMYcCqgsh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6692008a81ed291945bbc7c9565c6fd81eecf5f35787aa757dd83810d9a2bbe4

Files

6692008a81ed291945bbc7c9565c6fd81eecf5f35787aa757dd83810d9a2bbe4
.dll windows:5 windows x86 arch:x86

09dfaac34bb5e5f7e32a9b05033e80f0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayRedim
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey

user32

MessageBoxA
CharNextW
LoadStringW
SetClassLongW
GetClassLongW
SetWindowLongW
GetWindowLongW
CreateWindowExW
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCaret
SetWindowRgn
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetCapture
SetActiveWindow
SendMessageA
SendMessageW
ScrollWindow
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OpenClipboard
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageA
IsDialogMessageW
IsChild
InvalidateRect
InsertMenuItemW
InsertMenuW
HideCaret
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageExtraInfo
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgCtrlID
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameW
GetClassInfoExW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EndMenu
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
CreateAcceleratorTableW
CopyImage
CopyIcon
CloseClipboard
ClientToScreen
CheckMenuItem
CharUpperBuffW
CharUpperW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BeginPaint
AdjustWindowRectEx
ActivateKeyboardLayout
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow

kernel32

Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
VerSetConditionMask
VerifyVersionInfoW
TryEnterCriticalSection
SwitchToThread
SuspendThread
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
RaiseException
IsDebuggerPresent
MultiByteToWideChar
MulDiv
LockResource
LocalFree
LoadResource
LoadLibraryA
LoadLibraryW
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
HeapSize
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GlobalUnlock
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetWindowsDirectoryW
GetVersionExW
GetVersion
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetSystemTimes
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeThread
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCPInfoExW
GetCPInfo
GetACP
FreeResource
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumSystemLocalesW
EnumResourceNamesW
EnumCalendarInfoW
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateFileW
CreateEventW
CompareStringA
CompareStringW
CloseHandle
Sleep

gdi32

UnrealizeObject
StretchDIBits
StretchBlt
StartPage
StartDocW
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SaveDC
RoundRect
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyBezierTo
PolyBezier
PlayEnhMetaFile
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectW
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
FrameRgn
ExtTextOutW
ExtFloodFill
ExcludeClipRect
EnumFontsW
EnumFontFamiliesExW
EndPage
EndDoc
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateICW
CreateHalftonePalette
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
Chord
BitBlt
ArcTo
Arc
AngleArc
AbortDoc

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CoCreateInstance
CoGetMalloc
CoUninitialize
CoInitialize
IsEqualGUID

comctl32

InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Copy
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_SetOverlayImage
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

shell32

Shell_NotifyIconW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

winspool.drv

OpenPrinterW
EnumPrintersW
DocumentPropertiesW
ClosePrinter
GetDefaultPrinterW

Exports

Exports

ACsxR5qSUiElGIcltRrAYw97
AK2g1VTqtLjgvf3rwt
ANorh8iREL6emAW06F
AOCvd931xIrrSnknkM
ARq0O2BLpJbntQx06tQzOZfxmyU2
AmmQRamQwZOq3j1US29S19
AvVQDNFaHCvBiyvLW3FbIFWPT4cN
B9UAzMPBCz0FpjGmKEpJTvFnvacCIK
BBiiz0bLwIxq7798Fc4qrd
BCQyGlhSpyremGgiKWDz
BEqtVZFyfDdi2nkmUQb8qCPQNuf1
BFNjaUy7Qms34wmR6oG3MBEOP
BGyNLmAmPUfIBVf74A4MIR
BLSJcprJ8eWsQFmLiObhwJOb
Biivvzg37Sc1UffWR
BlEQiUjUoQfDgdfazeERCow32xbd
BmBxDK6GdZTosjMGJJI63qLu4yOCvO
C2xmd7oP6bmwq2ughEyw
CdlWz1rQUgI8yjwYyjp1vVBwAx5
CrbwgJfvj7JK0ftvfyBkpxHxlrHC
CxI1v8v0hAmMCaUu1SN
D1kKSmKxsZZRkS2WdkJRgYpQZrG
DIFWEiM8nl4wKZS3
DOR1ehkbdWEgXthTricJmHzUgX1fa
DTZMxILdyeBvDDqJz
DX1QLkPHFLMbxMSyEOkzqDoA
EKCewO152uvszzWQ5g3Pj
EOjFYT98HAfHrYtCYYyPMQmvlcWcU06
EScssMcLKlv6SnQ6pb
ETSi2A04gexuQi5A8Wt
EawiNmIBXEkoWdfhH6DOEmO5PFz
EsGRuGHJZXOdzGKzyRUVl
Et0R3aeUAmuFSSB9GqJ
F1enfoyujOtk380KyO
FM8nd3jldiaTatyjjUdQHb7hOxTg
FVa7cpYceUeYe0tdE7kSfRUx6Qcf6
FXgAomnLdKgFfJWGtH8kRNh8owZy
FbNO1vKyDcsE6gFMFNfYCxCAlP4
FppWfTjnjIbZkjHvoX6MzH8P21ukSd
G6vV0XrB8iXHKM5cMo
G8vT8eu2iJLleq40c43i3kbGNuDGo3
GEpMy43ytDqVZhaXhY5JY8n401BfbI
GFcb2cUuCmUyx0skkEMuM5c9myI4AR
GKi8qmMyeM5LQtO2A4D3x
GaFNHNjpjWKfK9xlQ
GetHandleVerifier
GjsleMTVOMg8VwJRpLW
GlhzWx63hD8LvWZ9XPDNrAj6
GmalNTt28yTW09sY
Gqu0qG9rGoo4nfAqpgvKOI
Gx26nuZAiTwJD2M5l
H0wAY6mr89GkCjiPWV9zkfZRgPXctWO
H27yTjRUIx3KcasrJeM3dCaIClP
H9XAFmJpCT6AjxX1
HA1Wm0kdrC5vxSejl
HUpvBuBx8CyMHr8uHj9idyv97jU
HYW2Htk4Zgb1b383RGb7m
HarI4Hr3xM00tgOd
HraWuMv3Zd0SMmp92dM4AaoILBxleN
Hzjf4RjPKd9H9KsWDyneoVXOzRh8Yk
ICtEH5jztfQDC28y
IEjXWqnHZmtAztpJ9MqBJEls3iyx1CZ
IIZxEokkTWu7cpsttBHs30f
IsSandboxedProcess
Iugcs3a4ehP8xCyIP
J30R3r5asxbBHTGwaIGy3pp5V6
J7Ti1RfyJTyQVPMmuxiD3nYVFW9OVE3
JFRYEDz1uupdl07FjOAomrUaWVuTeiT
JUoXdiRQhmRkluwUvngsbDJKlr
JYdSBtw6kLQWRRhDIeWoAZQT4Z
JcOiMVN9LoRHSQZlRgK
JkE3xVQxERWIrsw5Tv
JndjBDPbNrjtJBSsWffutIOahzJs
JqXJms6eFDhvK45tWSqWbwLvJM
JsbaLzDehsb7Khi59
KBNYfABTmOiKEcPcEpqebBPrRwRVR
KK6oKS8zC3AKCDW0SGXXm
KOtZR8pk9dvGTlzL
KW8werf8BksWZ2cktip1Y0
KbLUmcxtrKRH8OsPQCxxHTkZBAvk
KfJMZ1OsP67oKwKo3LDoKTwHr6
Kfr5Og4v5aBg0xGBs3txu
L4h1laFDhQL37CRNFPEBPnYf3
LCWkcgY4JvDtCG4j9AzFEQtX3
LJH2Lo6Cp0CRKreMEZGY1IJolny
LKULYsPa69vtmHCOrAwsSyVBVUz8gX5
LR4OMU9UGOkiPrkFAFKEUdzkPNQnw
LSsiAI3KgOcVWesM
Lb7QzyozwxfOCGZ18zXv6tQKj0gV63
LgWNYXlOh6FDexURKis0LG2EeDs
LjVX8rI0gJ65q7lbICGAoxnd2DTnUT
M3yKplPHiccMugDzRc
MHD9FFWiy9cG5JhW
MNFHWy0EMoZUI8TVBi6lCnyfV
MP8Yh84CDLnkkeqXMFoRYyrLINbi
MWhg8OCVtEB4crvX7
MXSgjPWRhZMHr76Kw
MZTN5vXKqyt5orbS0REbV
MfVAGC7op53lCkxPi2VSc
MjhzIAW2XeX2ch34NcpsQP6cvKr238
MkdAPIazOnifapYvHqRra
MuO6KD3HyMFrd33DEJuneE
NJcv4J0tJkRF5OrecpR6vIM
NqFXkmm3l0EqN94yoNmMXIxrI8ysD
O5kzZKllvKbRQF2hWcPoR
OP75VJxFGIhey56zZ9q
Ofuoz9jyeEYKixAZIqHgKq8Y3O
OoytH5fk0cdYlr3i
OsNHQcrj4Nluxbtwwd7a3EXeroy4ynQ
OtqNVK8ptCSj7YWIt1CFv4jk9fnG6y4
P3224gjHU3qdIDKiJZKZl4x1Z2EPoo
P3rRtnJ5LKwydqeOdRMTRK4bGB
PACLR2dFzr6un9kBHik8vM4HXpto3p
PbNB3SRcRkBG5oqqZ
PenC0ExFDVziX4xriw0bCIqQhsWaP
Pjg4MTantgzYJPI8NMVEcNlV5mLdtkZ
Pt7aLlwe6yRQU7BC2Zc8H
QCt8JULx5YMQbE8tdlZIIws9
QfQ5UYBZopoxg12UvEOUh
Qo6hggfi9nYcgKtw6la8JFtRNH
QsoMJLBDUqXSNc41Rvfcwiq3p8BVKE9
REpvbfOpJrTaiIxH7Uv
RH9f8uMpk79cS8bDAFp3V
RMNUUwV75xa6cXXpY
RVv77T4JyUvwGFxFMh
RY3HZxHY1b0Bhorm4wH6a1JZy3
RaR9kAHD56ea1epT5JfUjaUyM5hZ8
RelaunchChromeBrowserWithNewCommandLineIfNeeded
RhZz7fRJ65p5tcDbWMiuQR5VIoxl
RlXW5hKUPx9ZFF4XG6JXMll6Y3s
RoMIqogBYLk9ALjEhQ2MSvebxxMk
RuD88QfOpQMRNgD9gZ9Mcv
RwzWtB5Ll2WjtnVogmi
RxQbfLakxOP19vxpF
RxregSJy0UxBMCVo3Et8s9i5Ie3U
S0305AzObwfthHtpROOoD3JS1
S0T7cbNRbu4rA52j
S3Pj47tQudCqIiURfwmCsF7h6DHMN
S6F44dOzgy1ngghH
SByJP7eDo2vS78MbittMr1k84qN
SD3JjSIhQUjmvhM9gcnWz4
SI5Ogpwns01TqiZiH39Gd3i17H9aRH
SND7T1KkBd5Hc7zcB7dTsF2
STAunQ9152tfojuoONvPjQCoD
SdIpiRAgJTn9svKy
Sg0pzrcTqzuwb4YS6lyHXGEujo
Sl8ArlGjz0DZUKMfht5R87r5soyI
So5mrbpx5dfxrtTk1Fm6E5
T2d82mkQRffXBduvyoWYa
T4JJkdlR382GvFD2eknt4lpQFKnR
T5011G7jaDmbwC5l179zjXjpsAng
TL38M8WlvLOaYN48FLgbiwJyl8o
TMethodImplementationIntercept
TTV2ThOzyGzEcUDQDIz
TlTMgSHFFm7qmtEB1Bmus2UFv0Mu
TsPexPNKqmbl1Bojk
U5D3JMO8Uhl6ioadarv
U8nc3Kuq18MmaVHkex0NEX
UALdmAbs6F7HUqF75
UAk7gIKUQtys75xnFtC
UP6kogYYpYcrMtuywbmdUurXv9S45xT
Ugbq8rzkQ2c79NCBO5H7ZFApGCb37
UhR8vv7Hu2QUBAXtzQrO5FJY4u
UrDhNoeKj3388rwadKA
V52LXLYtp8RceR2nm43jl7fhR
VXW1BZmJHhBsFN67pK6buZjolCdJG9
VahVZ4b9qpVK5EVtz
VcQzvhWiI5DLvDUTrKLpEr38mQfFI
Vh6THlLsSRcow0jdsNU67FU0
VhkQZDKbh95Wh4y26UepmhKUJSY1K
Vw0G72AdVRm6soOmvUXd3S1
VxaWA29ate4IJokOB3l
WBf5xVKiZ5eXvJui0kGVvVuU
WMXmwgYEm9HJn5LVHC2TsEmLgqU19Rl
WY9NkqgCCESGDGC0reZwV
Wb62nUskkwGsfIBHOnaozFrwEPQ
WbK9Skct1gF8oB6mMQUyoit7doxdG
Wf92hLDgRjNo28WFSvEnHL
WgQoXCEnUXxUmJhMfbN3
WkkeJhE9fCzJyo3c9CUXXjZ
WoJu4qy3kXFwRv4ORuyUZxWsS9Zvh5
X7MKK8hHNGfcpOKrcNcaF0mGV0lq
XCD8Xwc01ZdP2OUB8GGNayLI
XJRo2Xu8Ozzutx0xVbl1Ym
XPgL5CcJOjuTRQOZewuoCBO2k7
XVBwqNpwZGF3Zw9fi
XcECKpGy4BDWjVBO616ho
XcHuRc6lgWTLxQxSc
XdmaRPO27KfXPZVWq7Dnxy398X6UAwH
Xev4qvM5fV1WnC5EtFQKm9C
XvL2nz3QIHudx3mTimxIMxv4An
Xyggx4Xx1clEO8cp
Y2dCwcNUKIDPbM9P
Y6LgcH4pkUgJ8GMs
YLIllvsE4kGUGLL5
YLdJr0Txkl71mnTCNhSBbNCROQs4MER
YLoWaZa05u81rqfOgxsJPzAuJSd3
YPw6bhpzVMoctozGeVFRBzH
YWqL7NUtKastK66sM8neEiaDb0m
YhwVBKo775zrxi25qzkhMO0fphALg
Yk0fBq9BztXQZ5ROlBs4R02hXjot
YmgGkCTibELjmSuc17K5E0GrWYT
YsSlZzmSZBV6EBtX
YsW8gDAbQmbKaoyqpFxndu1PTiz9U6
YwtbKzcWQLZ25o1ILlVjl6VRCSiZD
Z6MkE8OVwQOpztVucUNab2zFo
ZUN2rwejFXfQCoGGi
ZWRhnHdUpxreJdhRCm
ZXMMqyyGMhioJRqecT3ornKmUy8E
ZZguoNN0oXeekjs21GB827D6kiwc
ZbYe5V8XyHK31BHL1qyGU5YP5YZuQ4
Zv8rdCQ3fzKLi9fV
ZxL8zOmIWkrHV4Cv
aBrsL3sL0rxp3XZMP1NF
aDO1jKcrOLPiERK1qtV
aLvUOrMtL2EcimnqFsmxr5BVaMF6qJ
aRLsJssnC70exGR7u6oI
aTcicBOVEjLGvh13LS9b0Xqcb0dl
aZ2Zy1zeAScSxTplUXxr9
akWf9OqMrj2FVXH7Hn6t7IxWBV
akt3Z1OcGMBOkPdx9IVDt
alWfhhtcfdNekTwVkArCTEr
apR3JJvXhuqgu4VzM9H57DabWosTAl
auNWmnWsQQDqF1D6Hp
b3tPeMjvvDVpZm6sl3eKPrzoIcqlJr
bRYK2lUxtOk8QYlUV
buQGkDxvP7h3fhcGUK
bxDKyqW5k4OCcoAGrxDus
bzaHf5nfiPuHiPLLOja9
cCuTSnDpcTcnJux85PRWNxHVcAn
cHy9qVhyjbHa7kYQXxyHBSyp2Au0
cLKPdfjTRwU0Gb1Bx
ccW7WVYqezDDsL7Aorr5Ah8U7E
cef_add_cross_origin_whitelist_entry
cef_api_hash
cef_base64decode
cef_base64encode
cef_begin_tracing
cef_binary_value_create
cef_browser_host_create_browser
cef_browser_host_create_browser_sync
cef_browser_view_create
cef_browser_view_get_for_browser
cef_clear_cross_origin_whitelist
cef_clear_scheme_handler_factories
cef_command_line_create
cef_command_line_get_global
cef_cookie_manager_create_manager
cef_cookie_manager_get_blocking_manager
cef_cookie_manager_get_global_manager
cef_crash_reporting_enabled
cef_create_context_shared
cef_create_directory
cef_create_new_temp_directory
cef_create_temp_directory_in_directory
cef_create_url
cef_currently_on
cef_delete_file
cef_dictionary_value_create
cef_directory_exists
cef_display_get_alls
cef_display_get_count
cef_display_get_matching_bounds
cef_display_get_nearest_point
cef_display_get_primary
cef_do_message_loop_work
cef_drag_data_create
cef_enable_highdpi_support
cef_end_tracing
cef_execute_java_script_with_user_gesture_for_tests
cef_execute_process
cef_format_url_for_security_display
cef_get_current_platform_thread_handle
cef_get_current_platform_thread_id
cef_get_extensions_for_mime_type
cef_get_mime_type
cef_get_min_log_level
cef_get_path
cef_get_temp_directory
cef_get_vlog_level
cef_image_create
cef_initialize
cef_is_cert_status_error
cef_is_cert_status_minor_error
cef_is_web_plugin_unstable
cef_label_button_create
cef_launch_process
cef_list_value_create
cef_load_crlsets_file
cef_log
cef_menu_button_create
cef_menu_model_create
cef_now_from_system_trace_time
cef_panel_create
cef_parse_json
cef_parse_jsonand_return_error
cef_parse_url
cef_post_data_create
cef_post_data_element_create
cef_post_delayed_task
cef_post_task
cef_print_settings_create
cef_process_message_create
cef_quit_message_loop
cef_refresh_web_plugins
cef_register_extension
cef_register_scheme_handler_factory
cef_register_web_plugin_crash
cef_register_widevine_cdm
cef_remove_cross_origin_whitelist_entry
cef_request_context_create_context
cef_request_context_get_global_context
cef_request_create
cef_resource_bundle_get_global
cef_response_create
cef_run_message_loop
cef_scroll_view_create
cef_server_create
cef_set_crash_key_value
cef_set_osmodal_loop
cef_shutdown
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_stream_reader_create_for_handler
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_string_ascii_to_utf16
cef_string_ascii_to_wide
cef_string_list_alloc
cef_string_list_append
cef_string_list_clear
cef_string_list_copy
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_clear
cef_string_map_find
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_clear
cef_string_multimap_enumerate
cef_string_multimap_find_count
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_alloc
cef_string_userfree_utf16_free
cef_string_userfree_utf8_alloc
cef_string_userfree_utf8_free
cef_string_userfree_wide_alloc
cef_string_userfree_wide_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_lower
cef_string_utf16_to_upper
cef_string_utf16_to_utf8
cef_string_utf16_to_wide
cef_string_utf8_clear
cef_string_utf8_cmp
cef_string_utf8_set
cef_string_utf8_to_utf16
cef_string_utf8_to_wide
cef_string_wide_clear
cef_string_wide_cmp
cef_string_wide_set
cef_string_wide_to_utf16
cef_string_wide_to_utf8
cef_task_runner_get_for_current_thread
cef_task_runner_get_for_thread
cef_textfield_create
cef_thread_create
cef_time_delta
cef_time_from_doublet
cef_time_from_timet
cef_time_now
cef_time_to_doublet
cef_time_to_timet
cef_trace_counter
cef_trace_counter_id
cef_trace_event_async_begin
cef_trace_event_async_end
cef_trace_event_async_step_into
cef_trace_event_async_step_past
cef_trace_event_begin
cef_trace_event_end
cef_trace_event_instant
cef_translator_test_create
cef_translator_test_ref_ptr_library_child_child_create
cef_translator_test_ref_ptr_library_child_create
cef_translator_test_ref_ptr_library_create
cef_translator_test_scoped_library_child_child_create
cef_translator_test_scoped_library_child_create
cef_translator_test_scoped_library_create
cef_unregister_internal_web_plugin
cef_uridecode
cef_uriencode
cef_urlrequest_create
cef_v8context_get_current_context
cef_v8context_get_entered_context
cef_v8context_in_context
cef_v8stack_trace_get_current
cef_v8value_create_array
cef_v8value_create_array_buffer
cef_v8value_create_bool
cef_v8value_create_date
cef_v8value_create_double
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_uint
cef_v8value_create_undefined
cef_value_create
cef_version_info
cef_visit_web_plugin_info
cef_waitable_event_create
cef_window_create_top_level
cef_write_json
cef_xml_reader_create
cef_zip_directory
cef_zip_reader_create
cy6KRlGFEd3YFyLqvAYnk32dRIzV4QQ
d0Rmsp8Rsr47UmKZ2txNgfV9eEbFZ
d17YkZC20aIlld5oRF9or0C
d5qI8UBSS4WuAP6l9KHNn1U9EOJPPY
dNtBKttHrRXMW5nfwsFZpHeTP9iB5
dgAdWxoHy7VQA9LvfpRI
dm238HX3J1ozmSupaLEirspT13RN
dscUtwlDEDfjPiTogoyiNyh
e0dGFr5O5ZVl5JqiPgn
e81ePamNTiXn3cB2c
eBimo9FOVi2YoPWR3
eIHLYJG5LXXuTgjesB
eO8Y9pXMKWyKq8TkBLc9CMPMYxX
eWqLcXipqAILVvE7gyj0YjMupE
eX0zf1jGLGQNN2XX3XB
eYHpQ1DjayRZ7YS61WlEpOjEEIVeD
efUaqqnB4XCeeLqH8NsRTaLyl
efsdDqRP2dbZYnoDMQTfIdAbn9
elLcnPxLkv4McqUikGkEMM2RXepvWM
elXsZniiW9QanMW6HIVaZDY
enois7EQYllBln73heqtEBEYqVe7eY
essX4hrYW6qVlaoXYDYAOilj0jj
ey2Hcrc3cGPKi6MrLQsE7f514W
f4Xnlv6ND9HabkDQNNqJZ6A
fFWudd8E2aQEb9CT36xctTMc9ERFI
fH8C94PnW4MOUZRAse6j6hs6W
fLIOt6NiDdGBpxW0zgly
fN59RkP7OMeqKMiV
fkswTJXOI99900JDPnwMHbYt0BSTV
fosAdje6sySmtHLyVg29q
fqy17PB17LSqYYK8xHUkT
fxlPRf9CAFsD49lHAKfW12pcav3LtJ
fzwlHL8H0qCee4tS8QnAomOpX214r
g1UEcOHhpNy9JHwmrs4qGJXCobO
g6VVgBtB7EJaFWonax
gF5qItEg0IFPdJhXzph
gMTY0llSz7kZBbmXoTHNW6TQGfg
gN8y2oDathhW0ednCSOAYOcM
gPRHg3LR2S6ftGIxmmoibz5N
gUlAk69DCGliu3DU1zfP0ioJvxpJtw
gW4v1czrS7yQrYYIsjuhW2cH6a
gYWRHp9GLDikNM4uqZEmfNE4tzch
gephcyD6EuAb4jGTxIm
giM2KpDfQByU5goFH3VsMynMmd
girH61CG7vWYjrlvy4UNRJCJq
gkgvp67JQePKdDBlG7M9D
glkLj6vkNUrXZwnaMj4HBfq
gqeZwlpsFmAvKKfJzDHHx3
gtPcP8fak9NwcXhMRQVZy
h2CzsFJjLcdg0qkLqQQgHqyEY0m
hK7Z8JP3bOJyHoyPPVIE
hkgVyconQmyk9R1dg8AUuQAGd5V9x
hkiHfWNtcliscFiDDC
hqMEN1oIDi7ELJ6A4YfqRKO
i5EfNb1a2a0roJpK7IbjDTO6H3E
i8Kc41vk5NIXtUvCaYc9x4UT3DfzjQC
i9mTwA0QCu8VzdU4eDWeQ24wI
iHWcntqbka5cLBqncc
iS0X0GsAV1yTkqLY0
iWCWSv4JLXeG5GjRb5
iYDVGyEuKqSz7XhwGTb6Ks
ikJ4EeS75yA4cl6NbW
j2BgTTLlHkunyi6pz
j6s3vMy6xK8ZvaHao
j8Wi0kaZUVpXvhwDaSuweGmuC1DdP
jCxJA6E3vBo3MJbEfPQYaWsOAHzKV
jEtcPso9DmNJp3fgdePC
jKMVcZEEZsoTyZJ5euxBy3VNQwb7y
jP7Nrtua0j438PYxUzNGpZobuMsl4a
jTpqEyg2oQfrEiQA9CljxYuW

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 22KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

09dfaac34bb5e5f7e32a9b05033e80f0

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

gdi32

version

ole32

comctl32

shell32

winspool.drv

Exports

Exports

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.itext Size: 8KB - Virtual size: 8KB

.data Size: 27KB - Virtual size: 26KB

.bss Size: - Virtual size: 22KB

.idata Size: 14KB - Virtual size: 14KB

.didata Size: 2KB - Virtual size: 2KB

.edata Size: 22KB - Virtual size: 22KB

.rdata Size: 512B - Virtual size: 69B

.reloc Size: 276KB - Virtual size: 276KB

.rsrc Size: 73KB - Virtual size: 73KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.itext
Size: 8KB - Virtual size: 8KB

.data
Size: 27KB - Virtual size: 26KB

.bss
Size: - Virtual size: 22KB

.idata
Size: 14KB - Virtual size: 14KB

.didata
Size: 2KB - Virtual size: 2KB

.edata
Size: 22KB - Virtual size: 22KB

.rdata
Size: 512B - Virtual size: 69B

.reloc
Size: 276KB - Virtual size: 276KB

.rsrc
Size: 73KB - Virtual size: 73KB