6ae984195b661d790fe6bb4142cb488a2db17cb80025d8e72d86e2bc6833195a

Sharing

Copy URL Twitter E-mail

General

Target

6ae984195b661d790fe6bb4142cb488a2db17cb80025d8e72d86e2bc6833195a
Size

4.8MB
MD5

a6507c15e19aa1a99b77101a1d2446f7
SHA1

2752b8e79d3d5540a0dca29ebcd2912d20a4be32
SHA256

6ae984195b661d790fe6bb4142cb488a2db17cb80025d8e72d86e2bc6833195a
SHA512

031d32fe9250ca930d7862bb94ed1d9e874369cefabb8c266855f31b2136a63cbb3446acb4431121386ca55a9e2f8093044f32db126dd74ef102e502258c0573
SSDEEP

49152:jdSeFpiqJeS6jG145izy1Cw9+Wy4WMuyzV1fuZ9pGQYmjDtKryUrK5EIci:jZpifiNzyIpDtKrfr+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ae984195b661d790fe6bb4142cb488a2db17cb80025d8e72d86e2bc6833195a

Files

6ae984195b661d790fe6bb4142cb488a2db17cb80025d8e72d86e2bc6833195a
.dll windows:5 windows x86 arch:x86

a95a2dbe2bc5002cb59e86537f7ca42d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayRedim
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey

user32

MessageBoxA
CharNextW
LoadStringW
SetClassLongW
GetClassLongW
SetWindowLongW
GetWindowLongW
CreateWindowExW
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCaret
SetWindowRgn
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetCapture
SetActiveWindow
SendMessageA
SendMessageW
ScrollWindow
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OpenClipboard
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageA
IsDialogMessageW
IsChild
InvalidateRect
InsertMenuItemW
InsertMenuW
HideCaret
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageExtraInfo
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgCtrlID
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameW
GetClassInfoExW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EndMenu
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
CreateAcceleratorTableW
CopyImage
CopyIcon
CloseClipboard
ClientToScreen
CheckMenuItem
CharUpperBuffW
CharUpperW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BeginPaint
AdjustWindowRectEx
ActivateKeyboardLayout
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow

kernel32

Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
VerSetConditionMask
VerifyVersionInfoW
TryEnterCriticalSection
SwitchToThread
SuspendThread
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
RaiseException
IsDebuggerPresent
MultiByteToWideChar
MulDiv
LockResource
LocalFree
LoadResource
LoadLibraryA
LoadLibraryW
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
HeapSize
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GlobalUnlock
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetWindowsDirectoryW
GetVersionExW
GetVersion
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetSystemTimes
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileAttributesW
GetExitCodeThread
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCPInfoExW
GetCPInfo
GetACP
FreeResource
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumSystemLocalesW
EnumResourceNamesW
EnumCalendarInfoW
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateFileW
CreateEventW
CompareStringA
CompareStringW
CloseHandle
Sleep

gdi32

UnrealizeObject
StretchDIBits
StretchBlt
StartPage
StartDocW
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SaveDC
RoundRect
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyBezierTo
PolyBezier
PlayEnhMetaFile
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectW
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
FrameRgn
ExtTextOutW
ExtFloodFill
ExcludeClipRect
EnumFontsW
EnumFontFamiliesExW
EndPage
EndDoc
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateICW
CreateHalftonePalette
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
Chord
BitBlt
ArcTo
Arc
AngleArc
AbortDoc

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize
IsEqualGUID

comctl32

InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Copy
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_SetOverlayImage
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

shell32

Shell_NotifyIconW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

winspool.drv

OpenPrinterW
EnumPrintersW
DocumentPropertiesW
ClosePrinter
GetDefaultPrinterW

Exports

Exports

AjraH0yI7cC0kIJkhGuntP
AkQpnTdaIGQX7tOPxtLcVspc3
As059uxjSvzY31YpuvV8AkTOI
BBKC46HPou40g7ntOX0iBhuxSFPMtdK
BIsjdKcuc4RdvQ9Xk3Uo0Sar0
BLsItBcebSXnddZLwuS8Q0uY7
BTpIO2d8k2thLoJHnmDkU2
Bcs0nEidTTBTSa8ATbo
BeAH0Iq5Qv4hRl6Kq
BiUqmzdUxnUCJnKqHYypuzt
BlK4JUNleLxdRAZgNkx
C5mQ1ZTv71Le2suj4jZZ
C5pHTjUwQRJ5EASCziUgE8ufkBc
Ca4v3XiiIOJRgODsunoar
CbJaHEKloLSI1aWT0p2NOaU928jt
ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
Co7kbpCEphtcW7T0SQ1C6EOpNHKMqF
CorCrcoFaPGtUmvB1ZoPxNGxKVP2zMn
CrashForException
Csdj2ayTdljNmxAhHToef
CwVbPob1JxiDYIVywtJG53J7
Cy1t1rRGmjEtFhhIqunIyCk
D7T57gglHUFpdkor
DBVzDxx5RyfXKzl7arX483Bd4pxlE
Dj3hk0OwwxIqgSNQBVs3ul9Kj
DumpProcess
DumpProcessWithoutCrash
EIw25o3k3QqxHKnHZaIGF9B17l
ENRh6Xdd0PWSKGfE7
ESwbHk2c221HggE4Sbt6ku1
EV1UN2GDqqdKRSoNFgo
EX7NmuMywVIoiKKyzJ4C
EcLuH0rZOH0hXtEWdYNwkdKbf3C
EpZ0wmxkI6vsrKYvJ53z
EyJOxS3k4AHosp2lbbsTMOih
EzzoYoY8leZBvnYORx
F3RyrgrMqmKTyAeLa6Kjbk77g
F3wY8DgiBAILhpLXRCN2I
F41MHpl7WPb1X39oizQFQ
FJ1bXtUBKLQGluPW1aL
FPFiE6eqE88cXZ3IgRmmGnS5dCWgt
FWLunMUJY7c192Ac
FjekDMbdTAgZXZaagwzXFTpJ5IpI
FrufylOPQqzzzwOuKrwEsSk5YlG8dAc
Ft2460K6EczAvvFHw9wlW
FvzZcMeF2ZwSzdcaaKcQEpJ6
G3FHC2tvj1jESeEeYKiArB8algUqRca
GetHandleVerifier
HJEXTqG6UvaLDk5pnbEsTcNw6W1CdS
HmRdhfCZhxYYndsOrwQRNoTd
HnNQXQdZlDyGbPkhrLwHy4KVsaiPunf
HpWNZCJRQV8o3u02Bt
HqnRwt6xk4SJpiCLXL1oDKqRrzIgw
HrjZjRF1yilrMGMw9CVhIPzFlNWYlX
HwMkSnH8vd4vsxicVU9pOaj7
Hwx8X7fW2zKqcPbj5ovW5gKEGfZ
Hy1puNHmmg5qAuJOjaDBhYzIonH6cQq
I6cyuf5RDRqSoHeEuuU
I8G0oiN6JPclCgdn2SnLUKqtlF23
IIFLqPkG1bP7TKYw
IKNC3bNV8asSFGRZzMDCY
IPs3pcm6xupMhELP7AlgKeHZe9
ISYaFYK6CipxQmFksjb
IUjA7ZUVfttOBnBIE
IePowKcaEcSMN7FxOPwwuJevlsPxNzx
IkT1axCxxVRDUR31ZXpu
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
IqrBZDfk7TwjwBac8yoZ5R
Is0gW3g3SXe8ZkpheTnOGZdxcY6
IsSandboxedProcess
IvMHpXYKoWHMo52yE4K6wqNAsSqt
IwbDxSHrNTNj0sAZSClNYLR
JCjQ8QsI2LyNYWsUES
JKsgyzhOk31vgAJC4kMrm
JUxmIgYhQ7taaHQWBgHo
JbY2xij0qcW12WYE3HndZeEuEa
JldA8IXSw5bBcAeBvxa0pSt9sSfNa
Ju2fmVSVbu9KtKkImB3
K19beGcHUt7hEfHeLp6LeRpTHd8bIl
K6cMwlpWNCM9JHpeAIOdnRfXFytQ
KAl34321wTb3RPsTKQp9BPvVyhD3v
KBmw3V90NSjZn6TG4b
KCuBrNuUU808ljZEGyOV532RTv1Sq
KRET95W5ffMRXibQxJrrmzZUlrsv
KlqLK32JKYdia3ZqLy0071hDuyAT5
L1NkB7wf8zKKZIpE1uUe6
L5uG6E5bRk3KF883VIxxug1V3zc
LBQ1TqlLjwmSBZ35Qz7CkyiTRvrg5a
LCnt6kilzY4SGUMPzyj
Lhf20eOujTZr1C2v
LinR8tKbWEZ3xBuJD0QQqY0
Lm1LX2Cac344kQQaIUshM8EVmk
M1ZfnkDJ5mP6znvmvhQGEOGJn
M8ggv2kLlChPEYZ0zU4X8
MKKEBec0Ges10MYUj1z83RFJ7Uzfo
MT4r73nr5WI9k4XwT9d6D
MTtSZbtWP7Yip6OV0ZleXmUHQN1SWeQ
MbVfw39vE6J4qlAybn9MQFn6kfOyUJ
MgK48D1WLk7H6OEnClRkeYN1Oa
MjR58BRqIszg9zpwVIFY3dk46A96pT
MkCaKwWEEXpnaU1kHEWuo9NA
MsQ8Gw3Q06oe3nIcx5mD6qc0Hande
Mv83AC3SAMvhOf6URgMgDqt4Zbykr
N1ag0Rd6impaYGBnsBrh1
N25TZJ72uAyvk8O0LyHYRfM
N7LR9NGTKUKIT9vsSQsvUb76yYX
NQb4smB59xCF4JG2vtYX6X6hD
NRyhSLxAmylDx8lz6WqXGeaXecLIjK6
NVXcbXmndsvDruiUHOk5xGZ1wlWwT0
NlO5ii8IOCHJiFALbizNDgiMsjLY1v
NmUTcju00NwriVNDMUwiQodzaITKfon
NmdIBXw3DFymWhTYUZrpZPDSLm28CX5
NpytU1oKYEb0m2gp
NzlLZ06J408UGSrVRuqUIvhzd
OBd8clKjxytXpW6uJLNNq8hmT7
OC5JDUukhdT2lFwdm9Subl
OjcVhMzIvFkzbAapvZjjv
OpIlSWF0b46vkAyj2ZOM
OsXWCD3VPVtYFqhj7GF8
Oue9FB42F3ywu24iBA39KsqmGzMzfNd
OvIGtju58oA8Aifzl
P1nMh4T1Zjs3nmOBG3aZPG
P9FJI9wJGqTViRkIzPT7KSEK1K5J
P9Lbwthf8blFH3FqILETLGaNGv6
PBzSgDPEyM1vg727kxfqvuJJvZ
PGl8laR1TfZJjpJtpqvV0nbWc3
PJ8AaiutzHWcehU6OI0XfWY4wfPg
PUwrOxUwWLoK1zTHXW4UR4od6wdX
Petp2wYHFXxj4fCaefxh4R
Q4kDVW1UmsnTcbdZQvCI67Wv
QXJTSSpFIEBS4jawWznvHx6
QeBn2UqKqBToXiZKCO6IZ
QpOjbtt9TUCHsJ73DM05NNk5weJrL
QrXDzPrC1fZHGwhlGUDcC
Qsxi19fIw66hM3kBM5
QygELwYDthCDRQzUBmu6Xo
R5SYI23dYMbpbkz0xwx1
RBV1qskUKEXCYfd5GB2TKypTNUZ
RCERZrIdHqhj915W
RGfhfa35Hzv1FDLe8wNtd
RLmZFpa1TnM1l4rayYzCLcxCEMgpf
Ray4qb7hqrsuOMo4G
Rfe22d5SkKUQ3V0uVV
RjwcMbyqRm3z5wHklRjlkZ
RvWyLMC1QfyUDdomZbdbXULN31z
RzXcQnGNwMmsaQcHgfaDUI9yE
S3xpaHDZjXYCk0jGr4PIkj
S5RabLcd7pVnZYxjCzfrfrgmr0Z
S97xUvCk0VOAHVS7Ysn9AmZnYwZomK
SFeuB8kRxwj6rv4PVeqWByvMXvoF
SG7qr9FceoFP5QOWWp6Z
SGVb7B3RDYh7KLHoLPEG8zPntaUOF
SQcJi6gwyd9NmonU4DDeYIJif
SetCrashKeyValueImpl
SlHPwQKlvRL05lBKVPv5lQsi
SsDJdhIdWizg8NXYR4iOICl
St23QcaUXPyrBm9XNPiLSHAHX7sr
StZMnwFeU7CZ9MdmkanN
Su3ek4xAYCg18yqyGT0V5Ah6huH
T6rCeMxrZFwZpC0pU72U
TCSr7YpzZkWho7mqPOmlv
TEaUjptlCCvThFnDwfM5rVkSKo7bK
TEqymnwjSwZh46uXLkjvNCMugZ
TMethodImplementationIntercept
TerminateProcessWithoutDump
Ts9dHuxagxHQdK3pggdD4n
U2wtdqdE7byqvTNru7SvkT
U5viFLMJI3hzlaZkiNUA5TzaGE1IT
UBSF8vvxlY1WlsKnj44ddCofq4bxC8
UFKOq4dkgpcS9sqg3D1RoW
UIhWBEuxKOUM28LRkW1J6
UJdvtzBUb2jQQHK2UUigG8p8g
UMNFmcg8nN0SHG3W8jKMED3HW
UUXtf4KPGUUyjuRgCiUHDGNnP6AzdP0
UfANAfvUQZIYHCPxa3SYP
UfhTAZbmT4a8gxRuKoEDRP
Up4nVuIzQbZKqNRF7
UvFvWBMeIN47pjUqjCMa
UyLahT9V2NerQVBz2N4jkHAg0anP
V1ufN0x1FOu4KuWScw
V98fPTj2ARlZIhOMZXuxW56cM8O
VHpqhaDoDrCos148O4TzzA32
VJjypDF83oU7ilFb
VKCYn9CK7LPZwJzUXNNzMEg
VLUMMFxsziTNKOgXgUjNxHAhV
VNMseL9lxjsgNrnIqz7czRq
VSkehbEly8ZASD5j
VVtRlrZFuTNNmaBG1h7owYmXEJFFAH6
VXZq4e9jzRnfOyMeahs
VnQAqRJ14hR9Hw25V6EhgLB
VtNBCTeWejxg8PAC91Fz0n0f
WDCZVUbjwDOVahZ8KKQbhks
WFnOhzHAKYG7YwkcztTSXLdrCJK
WLxJgepaVh3ltRbJBmfXCzpvIse8FrC
WiCsUI4FqJ956JIfAzmfLB75wRo
WtnIjcfgcfOW8RvY
X0I1AyXBhsfg8HgS8tZZGMLy6z
X8V87cV26hhtA0elHH2qvXInkk8av
XBVxHhdF75kZiouY
XEMrqt5CpyvgSrHKcGJmEBl2Om6r3l
XEgXbPkPoMTbFsBjV
XK1S0X1irJq25hI9uLB9QF1lm
XX3g1uXynWZceGSqIGvK1PDsg9KBz
XZxTRS1J08G5U325RNZG
XcRslSsPl5bpJegJggGm4QKYH
XjF0qPqq9h5ugRHaAlWzb8
Xq9KY3wPIS25cIZimvLybSm0FAsDQAo
Y0h2tXUj7VPJSj36Yxe
Y3V7m5Bcq87h6daEKiOMEyPerhnBWTm
YAy5F3b4xeuehnwymn9KapRp
YL10N0w0iA5LY4EyZdy99kmbq8AO7p
YRcU5edXoHPveAYass
YSAlihR3wO6xP5MxQ
YUewXfB3re25HXpBlN3
Yf16tywcGyFTfH6wbuIPj
YfGZpKu6vvDsZGtV5F9eXRg
YgGjAh6Jc0vUXdeuU92
YtEkZOURn3CzY77llyCRU6z2FF74
YuXPT1BVN2ZPfc1XtIxLKp4prgP
Z6eIsSFBvFRcvzqBS0HIbnR
Z6vRVhPy2G52cE8LIc
ZEflZO2cdOy99srZMLF8tb99ykMy
ZM2k2oVtQ2V7Sdfpra8hckSPT
ZNcTkqxEWgrc716Ws0AY
ZRUp3uDUvUV6OoUg5Cb12Pb8W
ZTUS2Fmcge29xHXCiC
a49ctRhV5lVBcMhYiQAVSEETdIseN
aLLpGPDpoKERyUTnaxHZGK
aSb2uXAhoCLiQpRU2Upk91PxABW
aUBWNEe2bEZarsPGfjhpLBJR2OAab
aURq5qVnBtUCFMlBfvBG3lnuuhrsG
aaz3MSfbb3k0rxZ8CD7I2g7
apDj7yieufyqY7LwpLd5
arPqUMEjsWwYi7vbp
bJ3wdkrhpYDKiEKQwV9cHeJh5CQ78vs
bPj3QrClwAoR4Yyj8BrS
bWQjQ699B8cLRVzJyfxJG5rgIPOM
bXHQEXLfrwvXQ3tys
bY689ZgOTDiDoxVK4H
bc2tOALLf7DOg134rm0RPsB3sfSJTK
bc7C2u6gWtV8FdYbAilnQgX67GTjV
bgiGp3ygKhRAdtDpg2u2GjzP9GV8bM
c8Mb1nlyvJSxo5R1Bla3Ebr7rld
cFHQLBczBO41wBlAkpdmrBMwUnxT2O
cHGHFFFxyLfFEsJIqSl7HuwGWud
cMAcvek3ALTslsKKA
cO2YSLFdrRWJeJ1UrwrVC08I6pwMhX
cV9CrqaZxYAsMtS0sPK0T5Yw
cZVtQcUD3wAu3sOctr4hLgsizQ2
cb4zWLH7TGy2riO5hX
cef_add_cross_origin_whitelist_entry
cef_add_web_plugin_directory
cef_add_web_plugin_path
cef_api_hash
cef_base64decode
cef_base64encode
cef_begin_tracing
cef_binary_value_create
cef_browser_host_create_browser
cef_browser_host_create_browser_sync
cef_clear_cross_origin_whitelist
cef_clear_scheme_handler_factories
cef_command_line_create
cef_command_line_get_global
cef_cookie_manager_create_manager
cef_cookie_manager_get_global_manager
cef_create_url
cef_currently_on
cef_dictionary_value_create
cef_do_message_loop_work
cef_drag_data_create
cef_enable_highdpi_support
cef_end_tracing
cef_execute_process
cef_force_web_plugin_shutdown
cef_format_url_for_security_display
cef_get_current_platform_thread_handle
cef_get_current_platform_thread_id
cef_get_extensions_for_mime_type
cef_get_geolocation
cef_get_mime_type
cef_get_min_log_level
cef_get_path
cef_get_vlog_level
cef_initialize
cef_is_web_plugin_unstable
cef_launch_process
cef_list_value_create
cef_log
cef_now_from_system_trace_time
cef_parse_csscolor
cef_parse_json
cef_parse_jsonand_return_error
cef_parse_url
cef_post_data_create
cef_post_data_element_create
cef_post_delayed_task
cef_post_task
cef_print_settings_create
cef_process_message_create
cef_quit_message_loop
cef_refresh_web_plugins
cef_register_extension
cef_register_scheme_handler_factory
cef_register_web_plugin_crash
cef_remove_cross_origin_whitelist_entry
cef_remove_web_plugin_path
cef_request_context_create_context
cef_request_context_get_global_context
cef_request_create
cef_resource_bundle_get_global
cef_response_create
cef_run_message_loop
cef_set_osmodal_loop
cef_shutdown
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_stream_reader_create_for_handler
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_string_ascii_to_utf16
cef_string_ascii_to_wide
cef_string_list_alloc
cef_string_list_append
cef_string_list_clear
cef_string_list_copy
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_clear
cef_string_map_find
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_clear
cef_string_multimap_enumerate
cef_string_multimap_find_count
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_alloc
cef_string_userfree_utf16_free
cef_string_userfree_utf8_alloc
cef_string_userfree_utf8_free
cef_string_userfree_wide_alloc
cef_string_userfree_wide_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf16_to_wide
cef_string_utf8_clear
cef_string_utf8_cmp
cef_string_utf8_set
cef_string_utf8_to_utf16
cef_string_utf8_to_wide
cef_string_wide_clear
cef_string_wide_cmp
cef_string_wide_set
cef_string_wide_to_utf16
cef_string_wide_to_utf8
cef_task_runner_get_for_current_thread
cef_task_runner_get_for_thread
cef_time_delta
cef_time_from_doublet
cef_time_from_timet
cef_time_now
cef_time_to_doublet
cef_time_to_timet
cef_trace_counter
cef_trace_counter_id
cef_trace_event_async_begin
cef_trace_event_async_end
cef_trace_event_async_step_into
cef_trace_event_async_step_past
cef_trace_event_begin
cef_trace_event_end
cef_trace_event_instant
cef_translator_test_create
cef_translator_test_object_child_child_create
cef_translator_test_object_child_create
cef_translator_test_object_create
cef_unregister_internal_web_plugin
cef_uridecode
cef_uriencode
cef_urlrequest_create
cef_v8context_get_current_context
cef_v8context_get_entered_context
cef_v8context_in_context
cef_v8stack_trace_get_current
cef_v8value_create_array
cef_v8value_create_bool
cef_v8value_create_date
cef_v8value_create_double
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_uint
cef_v8value_create_undefined
cef_value_create
cef_version_info
cef_visit_web_plugin_info
cef_write_json
cef_xml_reader_create
cef_zip_reader_create
cjfr36v338RiQYGYHNd6z
cmxsNwv2xaNRZ8Pi
cqQOb7zxCJtsSe8MxaAgeAPZTZkHtZv
create_context_shared
csgCJIp5zxZq6hCjilQSZxd9zPGjzD
d41xtwVpzC1iYmnsK85nMpAdfn
d5H8cVRw0dCUAaPCP0
d8ca1J5lrdmhDdCh6KVSUyc9j0
dAFJdUppXaT4VXG1NMrQ
dJTFNsfKqva9tNSIN7Zur3R
dLYk6SXML5kaVhRpOvGLNqB
dkYPs0CppF3kqKM3ZkBfYTkJWUBjFP7
dwUsiFj3l5AefVRniC1Q
e5urJ2sBlpbe2smKj4HWq0B0sguU
e7fWJaleXdqpk2hdODIiG
eIj1kGp9Myhn0G4b7PmwHVuLO
eYv5nr9GOSiSO15Ra30bFU
efoJgvBDzuxPeI0r
eiS58AwGCxUgUP6WnloY4xCQwP
ekLjf3C9va866tHy4bnnRyqS
esXDs3nx5KuFIysq7oMEghm0Aw
f2IOkEvMYwu6jyRVzbXUw
f2YB55VuEhcGBKU3H
fGmI5gtHGaNZpqAe6orKOrRDwbOhl
fTFH8umUo3E2Hju3hUvzjVc4oDdo
fV4USBMmJ1MpTNVNwBq
foUpTcf5Q1hkp4FpHMZtOJgPnp
fzHfVbLr3M1Firfeuk0dH7FHHEbm
g57CwGvYra5S5kOfajVk2VvO
g6xVcixakmD0egPcFJYPpdFRA3
gAqUfPbtNg7Yl79D
gCDtRMOitADVCfWssmFensWekcT0GM
gHQXOhk563TURbAGKT
gP47bYH469XOSJTAtlSxHLZIDWfTZV
gezitlS6TPlvunjwEgPsp
glIWxEE19uFHDx5MXJ9
guTGeGxuAKQ1LBqEWWIHPpi
guagyTi0yncTGtj6TQsJPX8JC
gxJ4OsLFJuuuPfqIcLP7fV0
h66aCMBcbSrGmLegRFCcnH1vD
hASvbLaWrPbqhJeRpR9ZZcWa
hIDAqxXZkIZayM1FBQqxLBJpCizGm
hPZiyhCv1KB5epU6fc1sh
hdyRLsRGpwFXYA638qQ47leVfRDxL4r
hoV9v59eC3tj7RIVSi98OQcWp4Gn
hq4fhNZtaaziz5cXMK8K
hxXbrk4R5ava9fc1X3mCwRZ
iXZBzRUjIjkGi99q8W
icJWohIBPqJVzkYWiic
idse5OvUqrIumJaUr0SyTh
iemCTbFVQtFMR1MNcklqOHRp8Cdb7
iiOlQovB9vBgFShyYLt7CV
imGDRqAYUErZjx86lzmG0QAIPR9loB
ituK6LQ713mrcQSe1vxUI6Uvu
j1qyLorNjPBU6jwzJnOlZ0D7
j3pbDYL0tl2iDKfk14B1L
j9RcqFLyggv9UUz5VHMketCbPxn
jAURzpT6Ma2VFCBJ9tAlXixUfZbC
jDOJ6MvZWikMHhpWGTFOvBJ
jJD3NvahNY7DkyVOQe3QLB1
jUUUYp0LkTjntZIfyO0sDDIlWg
jUrCHK5CY8xsDwZjhPMXd
jjuHQHlIWvbTUgKa6lfWtxhe9UE
jlQqVqlGpaO5GczHbG7LDDOUUPRA
jm77sRAuRndfn44GyTddUB
jsvr2OjYhpKimUROCtt4CJ2ILK
jufmNrgFjjBz6JVJWlMQLTTs35
jwtvZcXTv483Lo8tSmkmSx
k2INZiDEjpFu70oD53SWaF
k6PqeeJ70AYS0XRdDeKk57FI
kHYnlKf5CFcX0uKoSIjqEp
kZofwW6JvdjW9NYsZYlW
kcH3xw3V45DBWOpqWU
kofd69A00OP6y1MNN
kvrsV1zcAKzOP73WJ
kvuxznXr8NfxFGotftNTGYO
l36O9yBB9fWe6OYuARl4I
l8DqohHhEhII4TVJ5u0b0
lEw3qbd1kGKs4LpN26Ydb7bZzH
lLRcIDvlJIoLlHEEpgGvTPnkHx
lQGaEmUfgryQCwietdSQmQs
lV8LvY7SPK4XdBfat67MEbk
lfWo9Z28rr6l0t5hYDxzKaM4tBP
lnerV5mr4XXN7rlNpLPHREcGTo0Wy
ltvuujzu2AaxWSfx

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 22KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 387KB - Virtual size: 386KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a95a2dbe2bc5002cb59e86537f7ca42d

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

gdi32

version

ole32

comctl32

shell32

winspool.drv

Exports

Exports

Sections

.text Size: 4.3MB - Virtual size: 4.3MB

.itext Size: 8KB - Virtual size: 7KB

.data Size: 26KB - Virtual size: 26KB

.bss Size: - Virtual size: 22KB

.idata Size: 14KB - Virtual size: 13KB

.didata Size: 2KB - Virtual size: 2KB

.edata Size: 21KB - Virtual size: 20KB

.rdata Size: 512B - Virtual size: 69B

.reloc Size: 387KB - Virtual size: 386KB

.rsrc Size: 62KB - Virtual size: 62KB

.text
Size: 4.3MB - Virtual size: 4.3MB

.itext
Size: 8KB - Virtual size: 7KB

.data
Size: 26KB - Virtual size: 26KB

.bss
Size: - Virtual size: 22KB

.idata
Size: 14KB - Virtual size: 13KB

.didata
Size: 2KB - Virtual size: 2KB

.edata
Size: 21KB - Virtual size: 20KB

.rdata
Size: 512B - Virtual size: 69B

.reloc
Size: 387KB - Virtual size: 386KB

.rsrc
Size: 62KB - Virtual size: 62KB