Setup[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Setup.zip
Size

14.4MB
MD5

95b3b2aab053e963ba9c3f0dbd5046f7
SHA1

f36d5d4e86b4bf8d046e37ba0d158e1724e1ecde
SHA256

b7e4a58e5eabfdad22eeb887f93dacb8da9c7b9b0312100f104562422cf4f734
SHA512

a061e6ded2e74dc950b9111c4a9c106311e6e44227e86de8424a5ac72b9ab872a9d7f9794ba2002fdc98dc7e5657a6a7413f9f09983ef7eeeb5e8d99a78f3ab2
SSDEEP

196608:n0eXJl0vvGOQGPLlgNeYaUdK1M6nPoOQEzCiEMiC9v0+skivcYUcLM+PL1ImiT9T:n9o76N7Svh90+s3UcYwwZfdTvzrmG

Score

1^/10

Malware Config

Signatures

Files

Setup.zip
.zip
Setup.exe
.exe windows:6 windows x64 arch:x64

83fe6159a2d596c21b09b697133902c7

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

03/05/2022, 00:00

Not After

28/04/2023, 23:59

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8b:77:1c:fd:7b:f2:55:13:df:22:6e:c5:d7:57:4a:5a:40:9b:70:d4:ee:50:20:97:ce:ff:ab:fb:5f:35:95:41
Signer

Actual PE Digest

8b:77:1c:fd:7b:f2:55:13:df:22:6e:c5:d7:57:4a:5a:40:9b:70:d4:ee:50:20:97:ce:ff:ab:fb:5f:35:95:41

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

mpc-hc64.pdb

Imports

crypt32

CryptBinaryToStringW

gdiplus

GdipSaveImageToStream
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdipSaveImageToFile
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCreateBitmapFromScan0
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipImageRotateFlip
GdipDisposeImage
GdiplusShutdown
GdipDrawLine
GdipDeletePen
GdipCreatePen1
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipFillPolygon
GdipAlloc
GdipFree
GdipCreateSolidFill
GdipDrawPolygon
GdipDrawLineI
GdipDrawPath
GdipAddPathLine2
GdipDeletePath
GdipCreatePath
GdipDeleteBrush

uxtheme

GetThemePartSize
DrawThemeText
DrawThemeBackground
CloseThemeData
GetThemeSysColor
ord61
IsThemeBackgroundPartiallyTransparent
OpenThemeData
IsThemeActive
IsAppThemed
DrawThemeParentBackground
GetThemeSysSize
GetThemeColor
GetCurrentThemeName
SetWindowTheme
GetWindowTheme

winmm

timeEndPeriod
timeGetDevCaps
PlaySoundW
timeKillEvent
timeSetEvent
timeGetTime
mixerSetControlDetails
waveOutGetVolume
waveOutSetVolume
timeBeginPeriod

dwmapi

DwmSetWindowAttribute
DwmIsCompositionEnabled

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash

kernel32

GetFileType
GetConsoleMode
GetSystemDirectoryW
SetFileTime
SetFileAttributesW
MoveFileW
RemoveDirectoryW
SetFilePointer
SetEndOfFile
FlushFileBuffers
CreateHardLinkW
GetLongPathNameW
GetProcessAffinityMask
CreateTimerQueueTimer
DeleteTimerQueueTimer
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapCreate
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetThreadContext
SetThreadContext
OpenThread
VirtualQuery
OutputDebugStringA
GetModuleHandleExW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
GlobalSize
EncodePointer
GlobalFindAtomW
GetFileSize
LockFile
UnlockFile
lstrcmpiW
GetStringTypeExW
GetThreadLocale
lstrcmpA
GlobalReAlloc
lstrcpyW
GetProfileIntW
GetFileAttributesExW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
FindResourceExW
GlobalFlags
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalHandle
LocalReAlloc
GetSystemDefaultUILanguage
SetErrorMode
SearchPathW
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
MoveFileExW
GetSystemTime
RtlUnwind
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetSystemDirectoryA
UnregisterWait
RegisterWaitForSingleObject
GetSystemWindowsDirectoryW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
LoadLibraryExA
WriteConsoleW
SetEnvironmentVariableA
FindFirstFileExW
GetConsoleCP
ReadConsoleW
GetOEMCP
IsValidCodePage
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetModuleFileNameA
HeapQueryInformation
GetFullPathNameA
SetStdHandle
ExitProcess
GetCommandLineW
GetCommandLineA
GetTimeZoneInformation
FreeLibraryAndExitThread
ExitThread
RtlUnwindEx
CompareStringEx
LCMapStringEx
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
InitOnceBeginInitialize
InitOnceComplete
RtlPcToFileHeader
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetExitCodeThread
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
OutputDebugStringW
GetStdHandle
TzSpecificLocalTimeToSystemTime
LocalFileTimeToFileTime
PeekNamedPipe
SystemTimeToFileTime
SizeofResource
LockResource
LoadResource
FindResourceW
MulDiv
RaiseException
GetWindowsDirectoryW
LoadLibraryW
FreeLibrary
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
GetACP
HeapAlloc
GetProcessHeap
HeapFree
DeleteCriticalSection
SetPriorityClass
GetCurrentProcess
GetFullPathNameW
WideCharToMultiByte
GetLastError
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
VirtualProtect
GetModuleHandleA
InitializeCriticalSection
GetUserDefaultLCID
GetCurrentThreadId
GetModuleFileNameW
SetUnhandledExceptionFilter
LoadLibraryExW
GetFileSizeEx
SetFilePointerEx
ReadFile
CreateFileW
CloseHandle
GetCurrentProcessId
GetLocalTime
Sleep
CreateDirectoryW
CreateEventW
SetEvent
ResetEvent
GlobalLock
GlobalUnlock
GetTickCount64
WriteFile
WaitForSingleObject
TerminateThread
SetThreadExecutionState
SetSystemPowerState
FindFirstFileW
FindClose
GetDiskFreeSpaceExW
FindNextFileW
GetCurrentDirectoryW
LocalFree
GetFileTime
DeleteFileW
CompareFileTime
GetDriveTypeW
GetLocaleInfoA
SleepEx
CreateProcessW
GlobalAlloc
GlobalFree
HeapDestroy
HeapSize
HeapReAlloc
CopyFileW
IsDebuggerPresent
CreateFileA
GetTempPathW
DeviceIoControl
SetDllDirectoryW
HeapSetInformation
SetCurrentDirectoryW
CreateMutexW
ReleaseMutex
GlobalAddAtomW
GlobalDeleteAtom
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDateFormatW
GetTimeFormatW
CancelIo
GetOverlappedResult
ReadDirectoryChangesW
GetUserDefaultUILanguage
DecodePointer
FormatMessageW
SetLastError
GetTempFileNameW
GetVolumeInformationW
GetTickCount
CreateThread
TerminateProcess
CreatePipe
DuplicateHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExpandEnvironmentStringsW
GetExitCodeProcess
GetShortPathNameW
LCIDToLocaleName
NormalizeString
GetStringTypeW
QueryPerformanceFrequency
QueryPerformanceCounter
GetFileAttributesW
GetNumberFormatW
GetLocaleInfoW
IsDBCSLeadByteEx
lstrcmpW
WaitForMultipleObjects
CreateSemaphoreW
ReleaseSemaphore
GetSystemInfo
VirtualAlloc
VirtualFree
GetThreadPriority
GetCurrentThread
SetThreadPriority
lstrlenW
FlushInstructionCache
GlobalGetAtomNameW
LocalAlloc
IsBadReadPtr
IsBadWritePtr
GetLocaleInfoEx
LocaleNameToLCID
AreFileApisANSI
CompareStringA
FoldStringW
CompareStringW
GetCPInfo
IsDBCSLeadByte
FileTimeToLocalFileTime

user32

SetParent
GetMessagePos
UnregisterClassW
SetProcessDefaultLayout
SendNotifyMessageW
SetWindowTextW
TranslateAcceleratorW
TranslateMessage
GetDlgItemTextW
MoveWindow
CreateWindowExW
IntersectRect
EnumDisplayDevicesW
UnregisterHotKey
RegisterHotKey
RegisterRawInputDevices
GetRawInputDeviceInfoW
GetRawInputDeviceList
GetRawInputData
SetWindowPlacement
GetWindowPlacement
ShowWindow
AllowSetForegroundWindow
LockWindowUpdate
ChangeDisplaySettingsExA
MsgWaitForMultipleObjectsEx
GetLastActivePopup
GetDoubleClickTime
TrackMouseEvent
EnumDisplayMonitors
CallNextHookEx
DispatchMessageW
GetMessageTime
GetWindowThreadProcessId
SetWindowsHookExW
UnhookWindowsHookEx
SetMenuDefaultItem
SetCursorPos
MonitorFromRect
FindWindowExW
FindWindowW
MsgWaitForMultipleObjects
ChangeDisplaySettingsExW
EnumDisplaySettingsW
IsMenu
CheckMenuRadioItem
InsertMenuW
CheckMenuItem
LockWorkStation
ExitWindowsEx
GetTopWindow
MonitorFromPoint
GetMenuItemRect
IsIconic
PostThreadMessageW
RegisterWindowMessageW
PostQuitMessage
GetAncestor
GetCapture
RegisterClipboardFormatW
GetKeyState
DrawFrameControl
PeekMessageW
GetDlgCtrlID
SetActiveWindow
GetDesktopWindow
UnionRect
GetMonitorInfoW
MonitorFromWindow
SetCursor
MessageBoxW
GetSysColor
GetWindowDC
GetWindowRgn
EqualRect
GetScrollBarInfo
SetWindowRgn
GetMessageW
EnableWindow
DestroyIcon
GetForegroundWindow
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadIconW
MessageBeep
LoadBitmapW
GrayStringW
SetForegroundWindow
EnableMenuItem
GetSystemMenu
SendMessageW
GetFocus
MapDialogRect
GetIconInfo
GetSystemMetrics
IsWindow
SetRectEmpty
SystemParametersInfoA
GetDlgItem
GetWindowLongW
GetWindowRect
ScreenToClient
SetWindowPos
DestroyWindow
SetWindowLongW
GetClassInfoW
DefWindowProcW
LoadCursorW
InvalidateRect
IsRectEmpty
SetCapture
SetTimer
ReleaseCapture
KillTimer
UpdateWindow
LoadMenuW
GetSubMenu
TrackPopupMenu
DestroyMenu
CreatePopupMenu
AppendMenuW
GetCursorPos
PtInRect
GetClientRect
SetRect
OpenClipboard
CloseClipboard
LoadImageW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetWindow
IsWindowVisible
MapWindowPoints
PostMessageW
GetClassLongPtrW
SetClassLongPtrW
FrameRect
EmptyClipboard
SetClipboardData
GetQueueStatus
GetAsyncKeyState
RegisterClassW
CharLowerBuffW
OemToCharBuffA
CharToOemA
OemToCharA
CharToOemBuffW
CharLowerW
CharUpperW
DialogBoxParamW
EndDialog
CreateDialogIndirectParamW
GetMenu
DrawTextExW
InvertRect
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
WindowFromDC
GetScrollInfo
InflateRect
OffsetRect
DrawIconEx
CopyRect
GetActiveWindow
IsZoomed
RedrawWindow
DrawMenuBar
AdjustWindowRectEx
GetParent
GetClassNameW
GetPropW
CallWindowProcW
SetWindowLongPtrW
SetPropW
SystemParametersInfoW
BeginPaint
EndPaint
GetSysColorBrush
GetDCEx
wsprintfW
GetNextDlgTabItem
IsWindowEnabled
GetMenuStringW
GetMenuState
GetClassInfoExW
IsChild
SetFocus
SetMenu
ValidateRect
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
RemovePropW
GetWindowTextW
GetWindowTextLengthW
SetScrollInfo
WinHelpW
SetDlgItemInt
GetDlgItemInt
SetDlgItemTextW
CheckDlgButton
CheckRadioButton
GetWindowLongPtrW
FillRect
GetDC
ReleaseDC
GetComboBoxInfo
ClientToScreen
WindowFromPoint
DrawTextW
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoW
DeleteMenu
RemoveMenu
SetMenuItemInfoW
GetMenuInfo
SetMenuInfo
TabbedTextOutW
SendDlgItemMessageA
GetNextDlgGroupItem
DrawFocusRect
IsDlgButtonChecked
WaitMessage
CopyImage
GetKeyNameTextW
DestroyCursor
CreateMenu
SubtractRect
GetUpdateRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
CharUpperBuffW
MapVirtualKeyExW
IsCharLowerW
DrawIcon
CopyIcon
HideCaret
GetMenuDefaultItem
EnumChildWindows
ModifyMenuW
NotifyWinEvent
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
InvalidateRgn
CopyAcceleratorTableW
EnableScrollBar
UpdateLayeredWindow
DrawEdge
RealChildWindowFromPoint
ShowOwnedPopups
IsClipboardFormatAvailable
CharNextW
SetLayeredWindowAttributes
DrawStateW
SetWindowContextHelpId
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
InsertMenuItemW
LoadAcceleratorsW
BringWindowToTop
MapVirtualKeyW

gdi32

GetTextFaceW
SetPixelV
GetViewportOrgEx
GetWindowOrgEx
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
SetPaletteEntries
ExtFloodFill
RoundRect
LPtoDP
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
CreateRoundRectRgn
GetRgnBox
Polyline
Polygon
Ellipse
CreateEllipticRgn
StretchDIBits
GetCharWidthW
GetTextCharsetInfo
CreateDIBitmap
RealizePalette
GetDIBits
DPtoLP
GetMapMode
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
SetWindowOrgEx
SetWindowExtEx
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SelectPalette
SaveDC
RestoreDC
RectVisible
PtVisible
OffsetClipRgn
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetObjectType
GetClipBox
Escape
CreatePatternBrush
CreateHatchBrush
ExtTextOutW
CopyMetaFileW
CreatePolygonRgn
GetPixel
GetClipRgn
SetRectRgn
OffsetRgn
GdiFlush
OffsetViewportOrgEx
SelectClipRgn
CreateFontW
GetFontData
AbortPath
GetPath
EndPath
CloseFigure
BeginPath
SetMapMode
TextOutW
AddFontResourceW
TranslateCharsetInfo
EnumFontFamiliesExW
EnumFontFamiliesW
GetStockObject
ExtSelectClipRgn
SetPixel
SetBkMode
SetViewportExtEx
SetViewportOrgEx
SetDIBColorTable
SetStretchBltMode
StretchBlt
LineTo
MoveToEx
CreateDIBSection
DeleteDC
GetICMProfileW
Rectangle
CombineRgn
CreateRectRgn
ExcludeClipRect
CreateRectRgnIndirect
CreatePen
PatBlt
GetTextMetricsW
CreateBitmap
BitBlt
CreateCompatibleBitmap
GetBkMode
GetTextColor
GetBkColor
CreateCompatibleDC
CreateFontIndirectW
SetBkColor
SetTextColor
SelectObject
GetDeviceCaps
DeleteObject
CreateSolidBrush
GetTextExtentPoint32W
GetCurrentObject
CreateDCW
GetObjectW

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

CryptDecrypt
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExA
RegCreateKeyExW
RegDeleteKeyA
RegDeleteKeyW
RegDeleteValueA
RegDeleteValueW
RegEnumKeyExA
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryInfoKeyW
RegQueryValueExA
RegSetValueExA
RegSetValueExW
RegFlushKey
RegCreateKeyA
RegCreateKeyW
RegOpenKeyA
RegOpenKeyW
RegQueryValueA
RegQueryValueW
RegSetValueW
RegSetValueA
RegEnumKeyW
SetFileSecurityW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
CryptDestroyKey
CryptEncrypt
CryptDeriveKey
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
InitiateSystemShutdownExW

shell32

ExtractIconW
ord680
SHChangeNotify
DragQueryFileW
DragFinish
SHCreateDirectoryExW
Shell_NotifyIconW
SHAddToRecentDocs
ExtractIconExW
SHGetFolderPathW
ShellExecuteExW
SHGetPathFromIDListW
SHParseDisplayName
SHOpenFolderAndSelectItems
SHFileOperationW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFileInfoW
SHAppBarMessage
SHBrowseForFolderW
SHGetDesktopFolder
ShellExecuteW

comctl32

ImageList_DragMove
ImageList_DragShowNolock
ImageList_DragLeave
ImageList_BeginDrag
ImageList_AddMasked
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Remove
ImageList_DragEnter
ImageList_Add
ImageList_GetIconSize
ImageList_Draw
ImageList_GetImageInfo
ImageList_GetImageCount
_TrackMouseEvent
ImageList_EndDrag

shlwapi

PathStripPathW
PathStripToRootW
PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW
PathIsURLW
PathFindExtensionW
PathSkipRootW
PathRenameExtensionW
PathRemoveExtensionW
PathMakePrettyW
PathIsRelativeW
PathFindFileNameW
PathCombineW
PathAddExtensionW
PathAddBackslashW
PathAppendW
StrCmpLogicalW
SHCopyKeyW
StrRetToStrW
PathCompactPathW
PathRelativePathToW
PathCanonicalizeW
PathRemoveBackslashW
PathIsPrefixW
UrlUnescapeW
StrStrIA
PathIsUNCW
StrFormatKBSizeW
StrFormatByteSizeW

ole32

CoTaskMemFree
CoCreateInstance
CLSIDFromString
GetRunningObjectTable
CreateItemMoniker
CoWaitForMultipleHandles
CoUninitialize
OleSaveToStream
RegisterDragDrop
CLSIDFromProgID
CoTaskMemAlloc
CoRevokeClassObject
OleLoadFromStream
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoLockObjectExternal
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
CoRegisterMessageFilter
ReleaseStgMedium
OleDuplicateData
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
StringFromGUID2
PropVariantClear
CoInitializeEx
StringFromCLSID
CoFreeUnusedLibraries
CoSetProxyBlanket
CoDisconnectObject
CoCreateGuid
OleGetClipboard
RevokeDragDrop
MkParseDisplayName
CoInitialize
CreateBindCtx

oleaut32

SysAllocStringByteLen
SysStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringLen
VarBstrCmp
VariantChangeType
OleCreateFontIndirect
SafeArrayDestroy
OleCreatePropertyFrame
VariantInit
VariantCopy
VarBstrFromDate
LoadTypeLi
SysAllocString
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SysFreeString

oledlg

OleUIBusyW

ws2_32

WSASetLastError
WSAGetLastError
WSAAsyncSelect
getpeername
__WSAFDIsSet
gethostbyaddr
getservbyport
getservbyname
getsockopt
ioctlsocket
getsockname
htonl
WSACleanup
closesocket
bind
accept
listen
shutdown
WSAStartup
gethostbyname
htons
inet_addr
inet_ntoa
ntohs
recv
recvfrom
select
connect
send
sendto
socket

d3d9

Direct3DCreate9Ex
Direct3DCreate9

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

wininet

HttpEndRequestW
HttpSendRequestExW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetGetLastResponseInfoW
InternetWriteFile
InternetSetFilePointer
InternetOpenUrlW
InternetConnectW
InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetReadFile
InternetSetOptionW
InternetCloseHandle
HttpQueryInfoW
InternetSetStatusCallbackW
InternetQueryDataAvailable
InternetQueryOptionW
InternetGetConnectedState

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Exports

Exports

_libiconv_version

Sections

.text
Size: 8.5MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 129KB - Virtual size: 16.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 345KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

83fe6159a2d596c21b09b697133902c7

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9fCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

8b:77:1c:fd:7b:f2:55:13:df:22:6e:c5:d7:57:4a:5a:40:9b:70:d4:ee:50:20:97:ce:ff:ab:fb:5f:35:95:41Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

gdiplus

uxtheme

winmm

dwmapi

bcrypt

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

ws2_32

d3d9

oleacc

wininet

imm32

version

Exports

Exports

Sections

.text Size: 8.5MB - Virtual size: 8.5MB

.rdata Size: 3.3MB - Virtual size: 3.3MB

.data Size: 129KB - Virtual size: 16.4MB

.pdata Size: 345KB - Virtual size: 344KB

_RDATA Size: 512B - Virtual size: 304B

.rsrc Size: 2.1MB - Virtual size: 2.1MB

.reloc Size: 141KB - Virtual size: 140KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

8b:77:1c:fd:7b:f2:55:13:df:22:6e:c5:d7:57:4a:5a:40:9b:70:d4:ee:50:20:97:ce:ff:ab:fb:5f:35:95:41
Signer

.text
Size: 8.5MB - Virtual size: 8.5MB

.rdata
Size: 3.3MB - Virtual size: 3.3MB

.data
Size: 129KB - Virtual size: 16.4MB

.pdata
Size: 345KB - Virtual size: 344KB

_RDATA
Size: 512B - Virtual size: 304B

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

.reloc
Size: 141KB - Virtual size: 140KB