mimic | samples[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

samples.zip
Size

12.9MB
MD5

08f4ceb2c87fbf7255b0610a4ddda6dd
SHA1

2899b23e84992e57a014c0c75ef11fe1fbadf3eb
SHA256

fc249baddd791772998825753f2ed6afb5cebab717f2017c5f8c78267173459e
SHA512

8b6334f7b965f6db62b38108fe34ec6fc312558153ad8e35b792b7415b903b24c90ca1aaae28e3d12f231b902fb22ec3ee31653187631d734e548a1b3f314dfe
SSDEEP

393216:GJApVs4LV9/L+7SdSh2S0Tx8Chrg9eymRJrpnVAsMqFabD7E:GJApVD59/c1h2SYx8ChQeymR1pVzMm

Score

10^/10

mimic

Malware Config

Signatures

Detects Mimic ransomware 1 IoCs

resource	yara_rule
static1/unpack001/samples/freeworldencrypting.exe	family_mimic

Mimic family
mimic

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/samples/freeworldencrypting.exe

Files

samples.zip
.zip
samples/$I30
samples/Everything.db
samples/Everything.db.FileSlack
samples/Everything.exe
.exe windows:4 windows x86 arch:x86

bb26afe15301b5fc5c7803c1150db133

Code Sign

0e:ae:3b:a4:9c:f8:c1:7c:12:57:cd:df:59:7d:a8:47
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16-11-2020 00:00

Not After

17-03-2022 23:59

Subject

CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:ba:fc:59:ba:b6:87:e2:7c:0e:ba:b8:55:aa:39:cd:39:a3:8b:7d:65:c3:27:71:59:bd:9c:62:b8:8c:f2:02
Signer

Actual PE Digest

09:ba:fc:59:ba:b6:87:e2:7c:0e:ba:b8:55:aa:39:cd:39:a3:8b:7d:65:c3:27:71:59:bd:9c:62:b8:8c:f2:02

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_GetIconSize
ImageList_DrawEx
_TrackMouseEvent
InitCommonControlsEx

ws2_32

WSAGetLastError
WSACleanup
closesocket
send
recv
socket
connect
WSAAsyncSelect
setsockopt
WSAStartup
shutdown
listen
bind
getpeername
ntohs
htons
gethostbyname
inet_addr
accept
getsockname

shlwapi

SHRegGetUSValueW
PathIsRootW
PathCombineW
PathRemoveFileSpecW

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
SetConsoleScreenBufferSize
SetStdHandle
AllocConsole
FreeConsole
SetFilePointer
FileTimeToSystemTime
GetSystemTime
FreeResource
LockResource
LoadResource
SizeofResource
GetSystemDefaultLangID
LoadLibraryA
TerminateProcess
OpenProcess
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
VirtualAlloc
VirtualFree
SetErrorMode
MoveFileExW
GlobalFree
GlobalUnlock
WriteFile
GlobalAlloc
GetFileSize
GetThreadPriority
FreeLibrary
LocalFileTimeToFileTime
SystemTimeToFileTime
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
WaitForMultipleObjects
GetSystemInfo
GetVersionExA
LocalFree
LocalAlloc
ConnectNamedPipe
GetTimeZoneInformation
MulDiv
CompareStringA
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
InterlockedExchange
RtlUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
CreateThread
ExitThread
FlushFileBuffers
GetStdHandle
GetFileType
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
DeviceIoControl
GetOverlappedResult
ResetEvent
Sleep
FindNextChangeNotification
GetFileInformationByHandle
GetLocalTime
FindCloseChangeNotification
FindClose
GetSystemTimeAsFileTime
GetCurrentThread
SetThreadPriority
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
GetTickCount
LeaveCriticalSection
SetEvent
GetCommandLineW
GetCurrentThreadId
ReadFile
GetLastError
CloseHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapReAlloc
HeapDestroy
HeapCreate
GetACP
GetOEMCP
FreeEnvironmentStringsA
GetEnvironmentStrings
SetHandleCount
GetCurrentProcessId
LCMapStringA
GetStringTypeA
GetLocaleInfoA
HeapSize
GlobalLock

user32

SetCursor
SetCapture
ChangeClipboardChain
DrawEdge
DrawFrameControl
EqualRect
GetSubMenu
GetMenu
SetClipboardViewer
EnumWindows
ActivateKeyboardLayout
IsDlgButtonChecked
SetScrollInfo
UpdateWindow
ScrollWindowEx
SetDlgItemInt
GetMenuItemID
RemoveMenu
GetMenuState
GetMenuDefaultItem
EnableMenuItem
AdjustWindowRect
GetSysColorBrush
OffsetRect
InvalidateRgn
MessageBeep
SetCursorPos
GetDlgItemInt
GetDlgCtrlID
GetDesktopWindow
ValidateRect
CreateIconIndirect
CreateMenu
SetMenuDefaultItem
TrackPopupMenu
DestroyMenu
KillTimer
GetDoubleClickTime
RegisterHotKey
UnregisterHotKey
PostQuitMessage
OpenIcon
GetForegroundWindow
IsWindowVisible
SetActiveWindow
BringWindowToTop
EnumChildWindows
CheckDlgButton
GetKeyboardLayoutList
GetScrollInfo
InvalidateRect
ClientToScreen
ScreenToClient
GetKeyState
IsIconic
GetWindowPlacement
IsZoomed
GetParent
CopyRect
EmptyClipboard
SetClipboardData
SetFocus
PtInRect
SetForegroundWindow
BeginPaint
EndPaint
OpenClipboard
CloseClipboard
FillRect
GetAsyncKeyState
GetClientRect
IsWindowEnabled
GetFocus
GetNextDlgTabItem
SetWindowPos
GetMenuItemCount
CreatePopupMenu
DeleteMenu
AdjustWindowRectEx
GetDlgItem
GetWindowRect
MapWindowPoints
IntersectRect
GetDC
ReleaseDC
WaitMessage
UnhookWindowsHookEx
CallNextHookEx
TranslateMessage
GetSystemMetrics
GetCapture
ReleaseCapture
ShowWindow
SetMenu
RedrawWindow
GetMessagePos
RegisterWindowMessageA
ReplyMessage
AttachThreadInput
GetCursorPos
GetSysColor
EndDialog
DestroyIcon
SetTimer
DestroyWindow
GetWindowThreadProcessId
IsWindow
GetKeyboardLayout
GetLastActivePopup

gdi32

StretchDIBits
BitBlt
CreateCompatibleDC
GetTextAlign
SetStretchBltMode
GetDeviceCaps
GetRegionData
SelectClipRgn
StretchBlt
SetTextAlign
CreateCompatibleBitmap
OffsetClipRgn
OffsetRgn
CombineRgn
GetDCOrgEx
GetRandomRgn
ExtCreateRegion
GetStockObject
GetNearestColor
CreateSolidBrush
CreateRectRgn
CreateDIBSection
GetCurrentObject
ExcludeClipRect
RectVisible
DeleteDC
SetBkMode
CreateBitmapIndirect
CreatePatternBrush
SetBrushOrgEx
SetBkColor
SetTextColor
PatBlt
SelectObject
GetDIBits
DeleteObject

comdlg32

CommDlgExtendedError

advapi32

RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
DeleteService
ControlService
RegOpenKeyA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
QueryServiceConfigW
RegCloseKey
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CreateServiceW
StartServiceW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
SetServiceStatus

shell32

DragFinish
ord16
DragQueryPoint
SHGetDesktopFolder
DragAcceptFiles
SHGetSpecialFolderLocation

ole32

CoTaskMemFree
OleUninitialize
OleInitialize
CoCreateInstance
CoInitializeEx
CoUninitialize
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemAlloc
RevokeDragDrop
DoDragDrop
ReleaseStgMedium
RegisterDragDrop

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 231KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
samples/Everything.ini
samples/Everything.ini.FileSlack
samples/Everything32.dll
.dll windows:4 windows x86 arch:x86

e2215ab9e77ac89648f9e4c61dfefbfc

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:0f:a0:91:94:b2:2d:c5:1d:00:65:31:c9:c1:61:04
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

21-12-2021 00:00

Not After

17-03-2025 23:59

Subject

CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:db:2c:5e:01:d1:64:e3:39:ae:cc:3b:a7:1b:f5:36:de:be:92:47:1d:1b:95:2b:db:7d:55:d0:96:bf:72:74
Signer

Actual PE Digest

4e:db:2c:5e:01:d1:64:e3:39:ae:cc:3b:a7:1b:f5:36:de:be:92:47:1d:1b:95:2b:db:7d:55:d0:96:bf:72:74

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
InitializeCriticalSection
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryW
DeleteCriticalSection
GetModuleHandleW
CloseHandle
WaitForSingleObject
CreateThread
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetCurrentThreadId
GetCommandLineA
GetVersionExA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetLastError
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize

user32

GetClassInfoExW
RegisterClassExW
CreateWindowExW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
WaitMessage
DestroyWindow
PostQuitMessage
DefWindowProcW
FindWindowW
SendMessageW

Exports

Exports

Everything_CleanUp
Everything_DeleteRunHistory
Everything_Exit
Everything_GetBuildNumber
Everything_GetLastError
Everything_GetMajorVersion
Everything_GetMatchCase
Everything_GetMatchPath
Everything_GetMatchWholeWord
Everything_GetMax
Everything_GetMinorVersion
Everything_GetNumFileResults
Everything_GetNumFolderResults
Everything_GetNumResults
Everything_GetOffset
Everything_GetRegex
Everything_GetReplyID
Everything_GetReplyWindow
Everything_GetRequestFlags
Everything_GetResultAttributes
Everything_GetResultDateAccessed
Everything_GetResultDateCreated
Everything_GetResultDateModified
Everything_GetResultDateRecentlyChanged
Everything_GetResultDateRun
Everything_GetResultExtensionA
Everything_GetResultExtensionW
Everything_GetResultFileListFileNameA
Everything_GetResultFileListFileNameW
Everything_GetResultFileNameA
Everything_GetResultFileNameW
Everything_GetResultFullPathNameA
Everything_GetResultFullPathNameW
Everything_GetResultHighlightedFileNameA
Everything_GetResultHighlightedFileNameW
Everything_GetResultHighlightedFullPathAndFileNameA
Everything_GetResultHighlightedFullPathAndFileNameW
Everything_GetResultHighlightedPathA
Everything_GetResultHighlightedPathW
Everything_GetResultListRequestFlags
Everything_GetResultListSort
Everything_GetResultPathA
Everything_GetResultPathW
Everything_GetResultRunCount
Everything_GetResultSize
Everything_GetRevision
Everything_GetRunCountFromFileNameA
Everything_GetRunCountFromFileNameW
Everything_GetSearchA
Everything_GetSearchW
Everything_GetSort
Everything_GetTargetMachine
Everything_GetTotFileResults
Everything_GetTotFolderResults
Everything_GetTotResults
Everything_IncRunCountFromFileNameA
Everything_IncRunCountFromFileNameW
Everything_IsAdmin
Everything_IsAppData
Everything_IsDBLoaded
Everything_IsFastSort
Everything_IsFileInfoIndexed
Everything_IsFileResult
Everything_IsFolderResult
Everything_IsQueryReply
Everything_IsVolumeResult
Everything_QueryA
Everything_QueryW
Everything_RebuildDB
Everything_Reset
Everything_SaveDB
Everything_SaveRunHistory
Everything_SetMatchCase
Everything_SetMatchPath
Everything_SetMatchWholeWord
Everything_SetMax
Everything_SetOffset
Everything_SetRegex
Everything_SetReplyID
Everything_SetReplyWindow
Everything_SetRequestFlags
Everything_SetRunCountFromFileNameA
Everything_SetRunCountFromFileNameW
Everything_SetSearchA
Everything_SetSearchW
Everything_SetSort
Everything_SortResultsByPath
Everything_UpdateAllFolderIndexes

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
samples/Everything32.dll.FileSlack
samples/Everything64.dll
.7z
samples/freeworldencrypting.exe
.exe windows:6 windows x86 arch:x86

1037d132e98a7b058f2e599876e508d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
Wow64RevertWow64FsRedirection
SetCurrentDirectoryW
ExitProcess
SetUnhandledExceptionFilter
HeapFree
HeapAlloc
GetProcessHeap
CancelIo
CreateTimerQueueTimer
DeleteTimerQueue
GetQueuedCompletionStatus
PostQueuedCompletionStatus
lstrcatW
lstrcpyW
CreateIoCompletionPort
CreateTimerQueue
GetCurrentProcess
SetProcessShutdownParameters
LocalAlloc
GetCurrentThread
LocalFree
GetSystemWindowsDirectoryW
QueryDosDeviceW
SetPriorityClass
RemoveDirectoryW
GetVersionExW
K32GetProcessImageFileNameW
DuplicateHandle
CreateToolhelp32Snapshot
GetExitCodeThread
ProcessIdToSessionId
Process32NextW
K32GetProcessMemoryInfo
Process32FirstW
GetNativeSystemInfo
LoadLibraryW
Module32FirstW
GetWindowsDirectoryW
GetProcAddress
WTSGetActiveConsoleSessionId
CreateProcessW
GetModuleHandleW
CreateRemoteThread
Module32NextW
QueryFullProcessImageNameW
K32GetMappedFileNameW
CreateFileMappingW
GetTickCount
IsWow64Process
VirtualQueryEx
GetExitCodeProcess
InitializeCriticalSectionEx
RaiseException
DecodePointer
GetComputerNameExW
GlobalMemoryStatusEx
ReadProcessMemory
GetStdHandle
GetEnvironmentVariableW
GetFileType
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
QueryPerformanceCounter
GetSystemTimeAsFileTime
FormatMessageW
DeleteFiber
ConvertFiberToThread
FreeLibrary
WideCharToMultiByte
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WriteConsoleW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocalTime
DeleteCriticalSection
GetFileInformationByHandle
SetFileAttributesW
GetFileAttributesW
InitializeCriticalSection
LeaveCriticalSection
SetErrorMode
CreateThread
MapViewOfFile
CreateEventA
CreateFileMappingA
ResetEvent
SetEvent
UnmapViewOfFile
ReleaseMutex
CreateMutexA
CreateMutexW
WaitForMultipleObjects
lstrcmpW
GetCurrentProcessId
Sleep
CreateEventW
WaitForSingleObject
FindClose
lstrlenW
FindNextFileW
ReadFile
FindFirstFileW
AllocConsole
GetConsoleWindow
SetConsoleCP
GetFileTime
GetDriveTypeW
FindNextVolumeW
GetSystemTime
GetVolumePathNamesForVolumeNameW
CopyFileW
SystemTimeToFileTime
FindVolumeClose
GetDiskFreeSpaceExW
ExitThread
SetFileTime
FindFirstVolumeW
GetLogicalDrives
GetVolumeInformationW
CreateDirectoryW
lstrcmpiW
GetConsoleOutputCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
ResumeThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
MultiByteToWideChar
lstrcpynW
GetFileSizeEx
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
LockResource
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
SwitchToThread
TryEnterCriticalSection
AreFileApisANSI
GetFullPathNameW
FindFirstFileExW
GetCurrentDirectoryW
QueryPerformanceFrequency
GetStringTypeW
TerminateProcess
Wow64DisableWow64FsRedirection
EnterCriticalSection
GetCommandLineW
CreateFileW
SizeofResource
FlushFileBuffers
MoveFileW
SetFilePointerEx
CloseHandle
DeleteFileW
GetLastError
SetEndOfFile
DeviceIoControl
WriteFile
LoadLibraryA

user32

GetMessageW
wvsprintfW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
ShowWindow
PeekMessageW
RegisterHotKey
SendMessageTimeoutW
FindWindowW
wsprintfW
PostMessageW
UnregisterHotKey

advapi32

LookupAccountSidW
RevertToSelf
GetTokenInformation
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
ConvertSidToStringSidW
SetSecurityInfo
InitializeAcl
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
LookupPrivilegeNameW
RegCloseKey
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetSecurityDescriptorSacl
LookupPrivilegeValueW
QueryServiceStatusEx
DuplicateTokenEx
EnumServicesStatusW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
EqualSid
CreateWellKnownSid
RegGetValueW
GetUserNameW
CloseServiceHandle
OpenSCManagerW
ControlService
EnumDependentServicesW
ChangeServiceConfigW
OpenServiceW
SetThreadToken

shell32

SHEmptyRecycleBinW
SHCreateItemFromParsingName
CommandLineToArgvW

ole32

CoInitializeEx
CoTaskMemFree
CoGetObject
CoCreateInstance
CoInitialize
CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

ws2_32

setsockopt
WSAGetLastError
inet_ntop
getsockopt
gethostname
inet_ntoa
WSAAddressToStringW
socket
WSAStartup
WSASocketW
send
WSASetLastError
htons
shutdown
gethostbyname
closesocket
WSAIoctl
bind
WSACleanup
recv

shlwapi

PathStripPathW
StrStrW
PathFileExistsW
PathRemoveExtensionW
PathGetArgsW
PathFindExtensionW
StrStrIA
PathRemoveFileSpecW
StrStrIW

iphlpapi

GetIpNetTable
GetAdaptersInfo

netapi32

NetShareEnum
NetApiBufferFree

mpr

WNetOpenEnumW
WNetCloseEnum
WNetGetConnectionW
WNetEnumResourceW

rstrtmgr

RmShutdown
RmStartSession
RmGetList
RmRegisterResources
RmEndSession

everything32

Everything_GetNumResults
Everything_SetRequestFlags
Everything_Exit
Everything_CleanUp
Everything_GetLastError
Everything_QueryW
Everything_GetResultFullPathNameW
Everything_SetSearchW
Everything_SetSort
Everything_DeleteRunHistory
Everything_IsDBLoaded
Everything_GetResultSize

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 464KB - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
samples/session.tmp

Sharing

General

Malware Config

Signatures

Files

bb26afe15301b5fc5c7803c1150db133

Code Sign

0e:ae:3b:a4:9c:f8:c1:7c:12:57:cd:df:59:7d:a8:47Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

09:ba:fc:59:ba:b6:87:e2:7c:0e:ba:b8:55:aa:39:cd:39:a3:8b:7d:65:c3:27:71:59:bd:9c:62:b8:8c:f2:02Signer

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

ws2_32

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 231KB - Virtual size: 230KB

.data Size: 56KB - Virtual size: 60KB

.rsrc Size: 40KB - Virtual size: 40KB

.reloc Size: 58KB - Virtual size: 57KB

e2215ab9e77ac89648f9e4c61dfefbfc

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:0f:a0:91:94:b2:2d:c5:1d:00:65:31:c9:c1:61:04Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

4e:db:2c:5e:01:d1:64:e3:39:ae:cc:3b:a7:1b:f5:36:de:be:92:47:1d:1b:95:2b:db:7d:55:d0:96:bf:72:74Signer

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 8KB - Virtual size: 4KB

1037d132e98a7b058f2e599876e508d6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

0e:ae:3b:a4:9c:f8:c1:7c:12:57:cd:df:59:7d:a8:47
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

09:ba:fc:59:ba:b6:87:e2:7c:0e:ba:b8:55:aa:39:cd:39:a3:8b:7d:65:c3:27:71:59:bd:9c:62:b8:8c:f2:02
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 231KB - Virtual size: 230KB

.data
Size: 56KB - Virtual size: 60KB

.rsrc
Size: 40KB - Virtual size: 40KB

.reloc
Size: 58KB - Virtual size: 57KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:0f:a0:91:94:b2:2d:c5:1d:00:65:31:c9:c1:61:04
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

4e:db:2c:5e:01:d1:64:e3:39:ae:cc:3b:a7:1b:f5:36:de:be:92:47:1d:1b:95:2b:db:7d:55:d0:96:bf:72:74
Signer

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 8KB - Virtual size: 4KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 464KB - Virtual size: 464KB

.data
Size: 15KB - Virtual size: 39KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 68KB - Virtual size: 67KB