Widgets[.]exe | Triage

Resubmissions

01-10-2024 08:15

241001-j5yqsszanj 1

01-10-2024 08:10

241001-j2pzgsygrp 1

Sharing

Copy URL

Twitter E-mail

General

Target

Widgets.exe
Size

2.5MB
MD5

59fc98220ef04c8c6d2112515410f21d
SHA1

0e0b33e078fc524f1b00ac4db1924b3982bba4b5
SHA256

5b8bba49f845ed3ac9df10c2017ea03f3d5fcd17c5897af00ebf911061136e06
SHA512

9e25b71b232f964940824605b200a72a811159e7e818132ef0f513716a2a62a158b22f3b58285f89845ae6aa754e63cc00a08e26907227d47ada102d8e1c3f0a
SSDEEP

49152:yjMXMu3xQbZJdX+vC9oLpaaTVD7jlrFke1HS0CqVeGGGz+reUK:FpxSn9oLjpBrHEK

Score

1^/10

Malware Config

Signatures

Files

Widgets.exe
.exe windows:6 windows x64 arch:x64

1c8e274795a9d20d0a2e6e600cac3d72

Code Sign

33:00:00:06:b4:f4:e0:fc:09:08:36:c1:fe:00:00:00:00:06:b4
Certificate

Issuer

CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13-07-2023 22:37

Not After

15-09-2024 22:37

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Development Root Certificate Authority 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28-05-2014 17:33

Not After

28-05-2029 17:43

Subject

CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:3d:04:f3:23:91:93:e9:40:a1:06:0c:94:9f:85:03:81:47:fa:b4:f5:62:16:27:30:ca:c4:d8:97:6c:b1:fe
Signer

Actual PE Digest

44:3d:04:f3:23:91:93:e9:40:a1:06:0c:94:9f:85:03:81:47:fa:b4:f5:62:16:27:30:ca:c4:d8:97:6c:b1:fe

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\__w\1\s\Output\Release\x64\External\V5\Bin\Dashboard\Widgets.pdb

Imports

ntdll

RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion

kernel32

GetModuleHandleW
OutputDebugStringW
FormatMessageW
IsDebuggerPresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateThreadpoolTimer
SetThreadpoolTimer
AcquireSRWLockShared
ReleaseSRWLockShared
SetLastError
GetLastError
CloseHandle
WaitForSingleObjectEx
InitOnceComplete
InitOnceBeginInitialize
LocalFree
GetCurrentPackageId
GetComputerNameW
GetCurrentProcess
SetEvent
CreateEventW
SetErrorMode
GetCommandLineW
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateEventExW
GetModuleFileNameA
CreateSemaphoreExW
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
OpenSemaphoreW
CreateMutexExW
GetCurrentProcessId
WideCharToMultiByte
DebugBreak
InitOnceExecuteOnce
LoadLibraryExA
CompareStringOrdinal
CreateFileW
GetPhysicallyInstalledSystemMemory
GetLogicalProcessorInformation
DeviceIoControl
OpenProcess
TerminateProcess
FreeLibrary
InterlockedPushEntrySList
WakeAllConditionVariable
FormatMessageA
GetCurrentThreadId
LoadLibraryW
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForMultipleObjects
GetSystemTimeAsFileTime
Sleep
ResetEvent
InitializeCriticalSection
WriteFile
SystemTimeToFileTime
QueryUnbiasedInterruptTime
GetPackageFamilyName
GetThreadPreferredUILanguages
GetUserDefaultGeoName
GetUserDefaultLCID
LCIDToLocaleName
EncodePointer
GetStringTypeExW
GetFileSizeEx
ReadFile
CreateDirectoryW
CreateThreadpoolWait
InitializeCriticalSectionEx
MultiByteToWideChar
FindFirstFileW
FindNextFileW
K32GetModuleFileNameExW
GetModuleFileNameW
LocalAlloc
GetTimeFormatEx
FileTimeToSystemTime
CreateNamedPipeW
ConnectNamedPipe
GetLocaleInfoEx
FindClose
GetFileAttributesW
K32GetPerformanceInfo
LoadLibraryExW
OpenEventW
SetEnvironmentVariableW
lstrlenW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetProcessInformation
GetProcAddress
HeapAlloc
HeapFree
GetProcessHeap
SleepConditionVariableSRW
QueryPerformanceCounter
InitializeSListHead
GetSystemTimePreciseAsFileTime
TrySubmitThreadpoolCallback
InterlockedFlushSList

user32

GetCapture
GetSysColor
SystemParametersInfoW
AllowSetForegroundWindow
SetFocus
DestroyWindow
DefWindowProcW
GetWindowLongPtrW
RegisterClassExW
CreateWindowExW
SetWindowLongPtrW
GetSystemMetrics
SetCursor
GetPointerTouchInfo
GetPointerPenInfo
GetPointerType
PostQuitMessage
EqualRect
GetMonitorInfoW
DispatchMessageW
OffsetRect
GetClientRect
TranslateAcceleratorW
UpdateWindow
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
UnhookWinEvent
SendMessageW
GetWindowRect
WindowFromPoint
ClientToScreen
PtInRect
ScreenToClient
GetCursorPos
TrackMouseEvent
UnregisterTouchWindow
EndPaint
BeginPaint
GetTopWindow
RealGetWindowClassW
SetWinEventHook
SetWindowRgn
GetClassNameW
LoadIconW
LoadCursorW
SetCapture
TranslateMessage
SetWindowPos
EnableWindow
GetActiveWindow
GetForegroundWindow
GetWindowTextW
SetActiveWindow
SetForegroundWindow
GetWindowInfo
ReleaseCapture
MonitorFromWindow
RegisterTouchWindow
GetMessageW
SetThreadDpiAwarenessContext
PostThreadMessageW
MonitorFromRect
MonitorFromPoint
RegisterWindowMessageW
FindWindowW
IsWindowVisible
ShowWindow
PostMessageW
GetKeyState

api-ms-win-core-winrt-l1-1-0

RoRegisterActivationFactories
RoRevokeActivationFactories
RoInitialize
RoGetActivationFactory

api-ms-win-core-errorhandling-l1-1-0

RaiseException

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

msvcp140_app

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_signal
_Query_perf_counter
_Query_perf_frequency
_Cnd_timedwait
_Mtx_current_owns
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
_Thrd_detach
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Mtx_trylock
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_register_at_thread_exit
_Cnd_broadcast
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Cnd_wait
_Cnd_unregister_at_thread_exit
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?id@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEB_W4@Z
_Lock_shared_ptr_spin_lock
_Unlock_shared_ptr_spin_lock
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setf@ios_base@std@@QEAAHHH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z
?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_JH@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Winerror_map@std@@YAHH@Z
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1_Locinfo@std@@QEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
_Wcsxfrm
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
_Cnd_do_broadcast_at_thread_exit
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?width@ios_base@std@@QEBA_JXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
?flags@ios_base@std@@QEBAHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
_Thrd_yield
_Thrd_id
_Thrd_join
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_unlock
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Xtime_get_ticks
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Wcscoll

concrt140_app

?_Internal_empty@_Concurrent_queue_base_v4@details@Concurrency@@IEBA_NXZ
?_Internal_pop_if_present@_Concurrent_queue_base_v4@details@Concurrency@@IEAA_NPEAX@Z
?_Internal_push@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXPEBX@Z
??0_Concurrent_queue_base_v4@details@Concurrency@@IEAA@_K@Z
??1_Concurrent_queue_base_v4@details@Concurrency@@MEAA@XZ
?_Internal_throw_exception@_Concurrent_queue_base_v4@details@Concurrency@@IEBAXXZ
?_Internal_finish_clear@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXXZ
?_Internal_size@_Concurrent_queue_base_v4@details@Concurrency@@IEBA_KXZ

vcruntime140_1_app

__CxxFrameHandler4

vcruntime140_app

__std_terminate
wcsstr
memcmp
_purecall
__std_exception_copy
memcpy
_CxxThrowException
__current_exception_context
memset
memmove
__current_exception
__C_specific_handler
__std_exception_destroy
__std_type_info_compare
strchr

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
terminate
_register_thread_local_exe_atexit_callback
_c_exit
abort
_invalid_parameter_noinfo_noreturn
_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_errno
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo
_configure_wide_argv
_initialize_wide_environment
exit
_initterm
_get_wide_winmain_command_line
_initterm_e

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vswprintf
__p__commode
__stdio_common_vswprintf_s

api-ms-win-crt-string-l1-1-0

iswspace
toupper
towlower
wcscmp
_wcsicmp
_wcsnicmp

api-ms-win-crt-heap-l1-1-0

_callnewh
realloc
malloc
free
_set_new_mode

api-ms-win-crt-convert-l1-1-0

wcstombs_s
wcstol

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_mktime64

api-ms-win-crt-math-l1-1-0

__setusermatherr
roundf
ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func

webview2loader

CompareBrowserVersions
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString

api-ms-win-shcore-stream-winrt-l1-1-0

CreateRandomAccessStreamOverStream
CreateStreamOverRandomAccessStream

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 482KB - Virtual size: 482KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

1c8e274795a9d20d0a2e6e600cac3d72

Code Sign

33:00:00:06:b4:f4:e0:fc:09:08:36:c1:fe:00:00:00:00:06:b4Certificate

Extended Key Usages

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03Certificate

Key Usages

44:3d:04:f3:23:91:93:e9:40:a1:06:0c:94:9f:85:03:81:47:fa:b4:f5:62:16:27:30:ca:c4:d8:97:6c:b1:feSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

kernel32

user32

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-memory-l1-1-0

msvcp140_app

concrt140_app

vcruntime140_1_app

vcruntime140_app

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

webview2loader

api-ms-win-shcore-stream-winrt-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 482KB - Virtual size: 482KB

.data Size: 47KB - Virtual size: 64KB

.pdata Size: 132KB - Virtual size: 132KB

.didat Size: 1024B - Virtual size: 712B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 16KB

33:00:00:06:b4:f4:e0:fc:09:08:36:c1:fe:00:00:00:00:06:b4
Certificate

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03
Certificate

44:3d:04:f3:23:91:93:e9:40:a1:06:0c:94:9f:85:03:81:47:fa:b4:f5:62:16:27:30:ca:c4:d8:97:6c:b1:fe
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 482KB - Virtual size: 482KB

.data
Size: 47KB - Virtual size: 64KB

.pdata
Size: 132KB - Virtual size: 132KB

.didat
Size: 1024B - Virtual size: 712B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 16KB