a3988c330fd625c4ccf216cae5d357c8ae13861974534f975b214f11f87657fd

Sharing

Copy URL

Twitter E-mail

General

Target

a3988c330fd625c4ccf216cae5d357c8ae13861974534f975b214f11f87657fd
Size

322KB
MD5

b76762e9867c92afdd182f7e39ad1426
SHA1

8f77d50d674ba2890d8a0f82515f9f3cb18d496b
SHA256

a3988c330fd625c4ccf216cae5d357c8ae13861974534f975b214f11f87657fd
SHA512

3bbb9dd9fae11c3db7e6fc6f34d648c70defaaf3939db58c002dd57c92070bf07d715669f2439353917d30a0c523507a196c9f8b97afd870539a4d8f2090a926
SSDEEP

6144:LH3wI+pfLMvD5fppraPg1MMVY1eU0VSX434LcSoz+9EVtJPNX4j8kxos:LH3f+1GD5fp0g13YJX434oYj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3988c330fd625c4ccf216cae5d357c8ae13861974534f975b214f11f87657fd

Files

a3988c330fd625c4ccf216cae5d357c8ae13861974534f975b214f11f87657fd
.dll windows:6 windows x64 arch:x64

149675ae6ac2b02aa49ffebf125aa13a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\DevOps\git\repos\affinity\build\bin\x64\Serif.WinRT.pdb

Imports

d2d1

ord1

dwrite

DWriteCreateFactory

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
LoadLibraryExA
GetProcAddress

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoIncrementMTAUsage
CoTaskMemAlloc

api-ms-win-core-winrt-string-l1-1-0

WindowsPreallocateStringBuffer
WindowsCreateString
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsCreateStringReference
WindowsPromoteStringBuffer
WindowsGetStringRawBuffer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-ntuser-sysparams-l1-1-0

SystemParametersInfoW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExA

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentPackageFullName

user32

SetTimer
GetClientRect
LoadCursorW
SetWindowLongPtrW
GetWindowLongPtrW
ScreenToClient
SetWindowPos
ShowWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
GetWindowRect
KillTimer
GetKeyState

shell32

SHGetKnownFolderPath
ShellExecuteW

libacs

?ToString@CloudServices@Affinity@@YAPEBDW4BuildKind@12@@Z
?GetSettings@CloudServices@Affinity@@YA?AV?$Counted@$$CBVSettings@CloudServices@Affinity@@@Kernel@@XZ

libaffinity

?FindReflected@Reflection@Affinity@@SA?AV?$Counted@VReflected@Kernel@@@Kernel@@AEBV?$vector@V?$Counted@VReflected@Kernel@@@Kernel@@V?$allocator@V?$Counted@VReflected@Kernel@@@Kernel@@@std@@@std@@I@Z
?EnumerateReflecteds@DialReflection@Affinity@@SA?AV?$vector@V?$Counted@VReflected@Kernel@@@Kernel@@V?$allocator@V?$Counted@VReflected@Kernel@@@Kernel@@@std@@@std@@V?$Counted@VReflectable@Kernel@@@Kernel@@_N@Z
?Map@NonLinearRangeAttribute@Affinity@@QEBANNNN@Z
?GetProductShortName@Affinity@@YA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@W4Product@1@@Z
?Current@Application@Affinity@@SAPEAV12@XZ
?GetLicenceProvider@Application@Affinity@@QEAAAEAVLicenceProvider@2@XZ
?GetCloudServicesInterface@Application@Affinity@@QEAA?AV?$Counted@VInterface@CloudServices@Affinity@@@Kernel@@XZ
?HasEntitlementToRunApplication@Affinity@@YA_NAEBULicenceInfo@1@@Z
?IsTrialRunning@Affinity@@YA_NAEBULicenceInfo@1@@Z
?GetLicenceInfo@LicenceProvider@Affinity@@QEBA?AULicenceInfo@2@W4Product@2@W4BuildKind@CloudServices@2@AEAVInterface@62@@Z
?GetRGB@SaturationColourRangeAttribute@Affinity@@QEBAXNNAEAE00@Z
?Unmap@NonLinearRangeAttribute@Affinity@@QEBANNNN@Z
?GetElements@ReflectedGroup@Affinity@@QEAAAEAV?$vector@V?$Counted@VReflected@Kernel@@@Kernel@@V?$allocator@V?$Counted@VReflected@Kernel@@@Kernel@@@std@@@std@@XZ

libkernel

?Trace@Kernel@@YAXPEBD@Z
?Trace@Kernel@@YAXAEBV?$StringT@UTEncUtf8@Kernel@@@1@@Z
??$AppendFormatVT@V?$StringT@UTEncUtf8@Kernel@@@Kernel@@@Kernel@@YAHAEAV?$StringT@UTEncUtf8@Kernel@@@0@PEBDPEBV?$FormatHolderT@V?$StringT@UTEncUtf8@Kernel@@@Kernel@@@0@_K@Z
??$ToStringT@V?$StringT@UTEncUtf8@Kernel@@@Kernel@@@Kernel@@YA?AV?$StringT@UTEncUtf8@Kernel@@@0@HW4SignStyle@0@PEBUCharacterGrouping@0@@Z
??$ConvertEnc@UTEncUtf8@Kernel@@UTEncUtf16@2@@Kernel@@YAXAEAV?$StringT@UTEncUtf8@Kernel@@@0@PEB_WH@Z
?GetLength@?$BaseCharTraits@D@Kernel@@SAHPEBD@Z
?Copy@?$BaseCharTraits@D@Kernel@@SAXPEADPEBDH@Z
?Retain@Countable@Kernel@@QEBAXXZ
?Release@Countable@Kernel@@QEBAXXZ
??0Timer@Kernel@@QEAA@XZ
?Reset@Timer@Kernel@@QEAAXXZ
?GetSeconds@Timer@Kernel@@QEBANXZ
??BLocalisedString@Kernel@@QEBA?AV?$StringT@UTEncUtf8@Kernel@@@1@XZ
?ToString@LocalisedString@Kernel@@QEBAAEBV?$StringT@UTEncUtf8@Kernel@@@2@XZ
??1LocalisedString@Kernel@@QEAA@XZ
?GetUnitTypeCategory@UnitValue@Kernel@@SA?AW4UnitCategory@12@W4UnitType@12@@Z
?WriteLine@LogInterface@Kernel@@QEAAXPEBD@Z
?Append@PathTraitsDos@Kernel@@SAHPEADPEBD_K22@Z
??$ConvertEnc@UTEncUtf16@Kernel@@UTEncUtf8@2@@Kernel@@YAXAEAV?$StringT@UTEncUtf16@Kernel@@@0@PEBDH@Z
??$ConvertEnc@UTEncUtf8@Kernel@@U12@@Kernel@@YAXAEAV?$StringT@UTEncUtf8@Kernel@@@0@PEBDH@Z
?GetDedupeId@Notification@Kernel@@UEBAHXZ
Log
??0CriticalSectionSpin@Kernel@@QEAA@XZ
??1CriticalSectionSpin@Kernel@@QEAA@XZ
?AcquireLock@CriticalSectionSpin@Kernel@@QEAAXXZ
?ReleaseLock@CriticalSectionSpin@Kernel@@QEAAXXZ
?ValidatePower@UnitValue@Kernel@@SAHW4UnitType@12@H@Z
?GetValueAsString@UnitValue@Kernel@@QEBA?AV?$StringT@UTEncUtf8@Kernel@@@2@I_N00@Z
?GetUnitTypePrecision@UnitValue@Kernel@@QEBAEXZ
?GetUnitType@UserUnits@Kernel@@QEBA?AW4UnitType@UnitValue@2@W4UserUnitType@2@@Z
?GetEnv@Kernel@@YAPEADPEBD@Z
?GetLength@?$BaseCharTraits@_W@Kernel@@SAHPEB_W@Z
?Find@?$BaseCharTraits@_W@Kernel@@SAHPEB_WH_WH@Z
?ConcatString@Kernel@@YAXAEAV?$StringT@UTEncUtf8@Kernel@@@1@PEBDH1H@Z
?ConcatString@Kernel@@YAXAEAV?$StringT@UTEncUtf16@Kernel@@@1@PEB_WH1H@Z
?ToStringBase@Kernel@@YA?AV?$StringT@UTEncUtf8@Kernel@@@1@JIHW4PadStyle@1@_N@Z
?AcquireLock@CriticalSection@Kernel@@QEAAXXZ
?ReleaseLock@CriticalSection@Kernel@@QEAAXXZ
?WriteLineI@LogInterface@Kernel@@AEAAXPEBD_N@Z
?Exists@FileSystem@Kernel@@SA_NAEBV?$StringT@UTEncUtf8@Kernel@@@2@@Z
??$AppendFormatVT@V?$StringT@UTEncUtf16@Kernel@@@Kernel@@@Kernel@@YAHAEAV?$StringT@UTEncUtf16@Kernel@@@0@PEB_WPEBV?$FormatHolderT@V?$StringT@UTEncUtf16@Kernel@@@Kernel@@@0@_K@Z
?GetUnitAsLocalisedShortString@UnitValue@Kernel@@SA?AVLocalisedString@2@W4UnitType@12@@Z
??$ToStringT@V?$StringT@UTEncUtf16@Kernel@@@Kernel@@@Kernel@@YA?AV?$StringT@UTEncUtf16@Kernel@@@0@HW4SignStyle@0@PEBUCharacterGrouping@0@@Z
?Compare@?$BaseCharTraits@D@Kernel@@SAHPEBDH0H@Z
?ToStringBase@Kernel@@YA?AV?$StringT@UTEncUtf8@Kernel@@@1@HIHW4PadStyle@1@_N@Z
?IsDirectoryEmpty@FileSystem@Kernel@@SA_NAEBV?$StringT@UTEncUtf8@Kernel@@@2@@Z
?DefaultSeparatorString@PathTraitsDos@Kernel@@2QEBDEB
?Find@?$BaseCharTraits@D@Kernel@@SAHPEBDHDH@Z

libpersona

?GetUserUnits@Tool@@QEBA?AV?$Counted@$$CBVUserUnits@Kernel@@@Kernel@@XZ
?GetSafeDocumentController@Tool@@QEBA?AV?$Counted@VDocumentControllerSession@@@Kernel@@XZ
?GetUnsafeDocumentController@Tool@@QEBA?AV?$NonCounted@$$CBVDocumentController@@@Kernel@@XZ
??0DocumentNotification@@IEAA@AEBV?$Counted@$$CBVDocumentController@@@Kernel@@_N@Z
?GetToolByID@DocumentController@@QEBA?AV?$Counted@VTool@@@Kernel@@W4ToolID@@@Z
?GetDocumentController@DocumentControllerSession@@QEAA?AV?$NonCounted@$$CBVDocumentController@@@Kernel@@XZ
?GetSize@Selection@@QEBA_KXZ
?begin@Selection@@QEBA?AV?$_Vector_const_iterator@V?$_Vector_val@U?$_Simple_types@V?$Counted@$$CBVSelectionItem@@@Kernel@@@std@@@std@@@std@@XZ
?end@Selection@@QEBA?AV?$_Vector_const_iterator@V?$_Vector_val@U?$_Simple_types@V?$Counted@$$CBVSelectionItem@@@Kernel@@@std@@@std@@@std@@XZ
?GetInstance@PersonaController@@SAAEAV1@XZ
?RequiredForPreviewing@DocumentNotification@@UEAA_NXZ
?FrontEndProcessingTimeIsCritical@DocumentNotification@@UEAA_NXZ
?MustProcessWithoutDocumentLock@DocumentNotification@@UEAA_NXZ
?Merge@DocumentNotification@@UEAA?AV?$Counted@VNotification@Kernel@@@Kernel@@V23@@Z
?tagCollectionFillsUID@CommonPropertyCollections@@3UIDTag@Kernel@@B
?tagCollectionMacrosUID@CommonPropertyCollections@@3UIDTag@Kernel@@B
?tagCollectionObjectStylesUID@CommonPropertyCollections@@3UIDTag@Kernel@@B
?tagCollectionRasterBrushesUID@CommonPropertyCollections@@3UIDTag@Kernel@@B
?tagCollectionVectorBrushesUID@CommonPropertyCollections@@3UIDTag@Kernel@@B
?tagCollectionAdjustmentsUID@CommonPropertyCollections@@3UIDTag@Kernel@@B
?tagCollectionAssetsUID@CommonPropertyCollections@@3UIDTag@Kernel@@B
??1DocumentNotification@@MEAA@XZ

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Thrd_join
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z

shlwapi

PathFileExistsW

dcomp

DCompositionCreateDevice

version

GetFileVersionInfoSizeW

vcruntime140

memmove
memcpy
__RTtypeid
_purecall
memset
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__RTDynamicCast
__std_type_info_destroy_list
__std_terminate
__current_exception
__std_type_info_hash
__C_specific_handler
__current_exception_context
__std_type_info_compare

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

iswspace

api-ms-win-crt-runtime-l1-1-0

_initterm_e
terminate
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_initterm
_crt_atexit
abort
_initialize_narrow_environment
_configure_narrow_argv
_beginthreadex
_cexit
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

api-ms-win-crt-math-l1-1-0

floor
ceil
cosf
sinf
acos

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
FormatMessageA
FormatMessageW

api-ms-win-core-file-l1-1-0

CreateDirectoryW
CreateFileW
SetFileInformationByHandle
GetFileAttributesExW
FindFirstFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileInformationByHandle

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx
CreateHardLinkW
MoveFileExW
CreateSymbolicLinkW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SysFreeString
SysStringLen

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree

Exports

Exports

??0Dial@detail@WinRT@Serif@@AEAA@XZ
??0ExternalApp@WinRT@Serif@@QEAA@$$QEAV012@@Z
??0ExternalApp@WinRT@Serif@@QEAA@AEBV012@@Z
??0ExternalApp@WinRT@Serif@@QEAA@XZ
??1Dial@detail@WinRT@Serif@@UEAA@XZ
??1ExternalApp@WinRT@Serif@@UEAA@XZ
??4ExternalApp@WinRT@Serif@@QEAAAEAV012@$$QEAV012@@Z
??4ExternalApp@WinRT@Serif@@QEAAAEAV012@AEBV012@@Z
??4Factory@WinRT@Serif@@QEAAAEAV012@$$QEAV012@@Z
??4Factory@WinRT@Serif@@QEAAAEAV012@AEBV012@@Z
??4Package@WinRT@Serif@@QEAAAEAV012@$$QEAV012@@Z
??4Package@WinRT@Serif@@QEAAAEAV012@AEBV012@@Z
??_7Dial@detail@WinRT@Serif@@6B@
??_7ExternalApp@WinRT@Serif@@6B@
?Create@Dial@detail@WinRT@Serif@@SA?AV?$Counted@VDial@detail@WinRT@Serif@@@Kernel@@PEAUHWND__@@PEAUIDialCallbacks@34@@Z
?CreateContext@WinRT@Serif@@YAPEAX_N@Z
?CreateDial@Factory@WinRT@Serif@@SA?AV?$Counted@UIDial@WinRT@Serif@@@Kernel@@PEAXPEAUHWND__@@PEAUIDialCallbacks@23@@Z
?CurrentItemChanged@Dial@detail@WinRT@Serif@@AEAAXXZ
?DestroyContext@WinRT@Serif@@YAXPEAX@Z
?EnumerateReflecteds@Dial@detail@WinRT@Serif@@AEAA?AV?$vector@UReflectable@Dial@detail@WinRT@Serif@@V?$allocator@UReflectable@Dial@detail@WinRT@Serif@@@std@@@std@@V?$Counted@VTool@@@Kernel@@_N@Z
?FinaliseInitialisation@Package@WinRT@Serif@@SAXXZ
?FindForEditIn@ExternalApp@WinRT@Serif@@SA?AV?$Counted@VExternalApp@WinRT@Serif@@@Kernel@@W4Product@Affinity@@AEBV?$StringT@UTEncUtf8@Kernel@@@5@W4BuildKind@CloudServices@7@@Z
?FindForReleaseToBetaMigration@ExternalApp@WinRT@Serif@@SA?AV?$Counted@VExternalApp@WinRT@Serif@@@Kernel@@W4Product@Affinity@@AEBV?$StringT@UTEncUtf8@Kernel@@@5@_N@Z
?FindForStudioLink@ExternalApp@WinRT@Serif@@SA?AV?$Counted@VExternalApp@WinRT@Serif@@@Kernel@@W4Product@Affinity@@AEBV?$StringT@UTEncUtf8@Kernel@@@5@W4BuildKind@CloudServices@7@@Z
?FlattenReflectables@Dial@detail@WinRT@Serif@@AEAA?AV?$vector@V?$Counted@VReflected@Kernel@@@Kernel@@V?$allocator@V?$Counted@VReflected@Kernel@@@Kernel@@@std@@@std@@AEBV?$vector@UReflectable@Dial@detail@WinRT@Serif@@V?$allocator@UReflectable@Dial@detail@WinRT@Serif@@@std@@@6@@Z
?GetAppDataPathForAllUsers@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@XZ
?GetAppDataPathForCurrentUser@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@XZ
?GetAppDataPathForCurrentUserPersisted@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@XZ
?GetCommonDataPathForAllUsers@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@XZ
?GetCommonDataPathForCurrentUser@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@XZ
?GetCommonDataPathForCurrentUserPersisted@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@XZ
?GetCommonDataPathForCurrentUserPersistedBuildInvariant@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@XZ
?GetCurrentItem@Dial@detail@WinRT@Serif@@AEBA?AV?$Counted@VReflected@Kernel@@@Kernel@@XZ
?GetDialButtonReflected@Dial@detail@WinRT@Serif@@AEBA?AV?$Counted@V?$ReflectedBinding@_N@Kernel@@@Kernel@@XZ
?GetDialPositionReflected@Dial@detail@WinRT@Serif@@AEBA?AV?$Counted@V?$ReflectedBinding@V?$PointT@N@Kernel@@@Kernel@@@Kernel@@XZ
?GetLinearValue@Dial@detail@WinRT@Serif@@AEBANNNNN@Z
?GetPackageApplicationId@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@W4Product@Affinity@@W4BuildKind@CloudServices@7@@Z
?GetPackageFamilyName@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@W4Product@Affinity@@W4BuildKind@CloudServices@7@@Z
?GetPackagedAppDataForCurrentUserPersisted@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@W4Product@Affinity@@W4BuildKind@CloudServices@7@@Z
?GetPackagedCommonForCurrentUserPersisted@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@W4BuildKind@CloudServices@Affinity@@@Z
?GetRampedValue@Dial@detail@WinRT@Serif@@AEBANNNNNN@Z
?GetStudioLinkState@ExternalApp@WinRT@Serif@@SA?AW4StudioLinkState@23@W4Product@Affinity@@AEBV?$StringT@UTEncUtf8@Kernel@@@Kernel@@W4BuildKind@CloudServices@6@@Z
?GetTempPathForCurrentUser@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@XZ
?GetUnpackagedAppDataForCurrentUserPersisted@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@W4Product@Affinity@@W4BuildKind@CloudServices@7@@Z
?GetUnpackagedCommonForCurrentUserPersisted@Package@WinRT@Serif@@SA?AV?$StringT@UTEncUtf8@Kernel@@@Kernel@@W4BuildKind@CloudServices@Affinity@@@Z
?GetV2BetaApps@ExternalApp@WinRT@Serif@@SA?AV?$vector@V?$Counted@VExternalApp@WinRT@Serif@@@Kernel@@V?$allocator@V?$Counted@VExternalApp@WinRT@Serif@@@Kernel@@@std@@@std@@AEAV?$StringT@UTEncUtf8@Kernel@@@Kernel@@@Z
?GetValue@Dial@detail@WinRT@Serif@@AEBAN_NNNNNN@Z
?InitialiseCurrentPackage@Package@WinRT@Serif@@SAXW4Product@Affinity@@W4BuildKind@CloudServices@5@@Z
?IsAnyV2ReleaseAppInstalled@ExternalApp@WinRT@Serif@@SA_NAEBV?$StringT@UTEncUtf8@Kernel@@@Kernel@@@Z
?IsAvailableForEditIn@ExternalApp@WinRT@Serif@@SA_NW4Product@Affinity@@AEBV?$StringT@UTEncUtf8@Kernel@@@Kernel@@W4BuildKind@CloudServices@5@@Z
?IsSandboxed@Package@WinRT@Serif@@SA_NXZ
?Notify@Dial@detail@WinRT@Serif@@AEAAX_N@Z
?OnButtonClicked@Dial@detail@WinRT@Serif@@AEAAJAEBUIRadialController@Input@UI@Windows@winrt@@AEBUIRadialControllerButtonClickedEventArgs@6789@@Z
?OnControlAcquired@Dial@detail@WinRT@Serif@@AEAAJAEBUIRadialController@Input@UI@Windows@winrt@@AEBUIRadialControllerControlAcquiredEventArgs@6789@@Z
?OnControlLost@Dial@detail@WinRT@Serif@@AEAAJAEBUIRadialController@Input@UI@Windows@winrt@@AEBUIInspectable@Foundation@89@@Z
?OnItemInvoked@Dial@detail@WinRT@Serif@@AEAAJAEBUIRadialControllerMenuItem@Input@UI@Windows@winrt@@AEBUIInspectable@Foundation@89@@Z
?OnNotify@Dial@detail@WinRT@Serif@@UEAAXV?$Counted@VNotification@Kernel@@@Kernel@@@Z
?OnRotationChanged@Dial@detail@WinRT@Serif@@AEAAJAEBUIRadialController@Input@UI@Windows@winrt@@AEBUIRadialControllerRotationChangedEventArgs@6789@@Z
?OnScreenContactContinued@Dial@detail@WinRT@Serif@@AEAAJAEBUIRadialController@Input@UI@Windows@winrt@@AEBUIRadialControllerScreenContactContinuedEventArgs@6789@@Z
?OnScreenContactEnded@Dial@detail@WinRT@Serif@@AEAAJAEBUIRadialController@Input@UI@Windows@winrt@@AEBUIInspectable@Foundation@89@@Z
?OnScreenContactStarted@Dial@detail@WinRT@Serif@@AEAAJAEBUIRadialController@Input@UI@Windows@winrt@@AEBUIRadialControllerScreenContactStartedEventArgs@6789@@Z
?OnTimer@Dial@detail@WinRT@Serif@@AEAAX_K@Z
?OnTimer@Dial@detail@WinRT@Serif@@CAXPEAUHWND__@@I_KK@Z
?RegisterEvents@Dial@detail@WinRT@Serif@@AEAAXXZ
?SelectMenuItem@Dial@detail@WinRT@Serif@@QEAA_NV?$Counted@VReflected@Kernel@@@Kernel@@@Z
?SetCurrentWindow@Dial@detail@WinRT@Serif@@UEAAXPEAUHWND__@@@Z
?SetDialContact@Dial@detail@WinRT@Serif@@AEAAXW4DialContact@1234@URadialControllerScreenContact@Input@UI@Windows@winrt@@@Z
?SetResourcesDirectory@Dial@detail@WinRT@Serif@@UEAAXAEBV?$StringT@UTEncUtf8@Kernel@@@Kernel@@@Z
?Update@Dial@detail@WinRT@Serif@@UEAAXV?$Counted@VTool@@@Kernel@@_N@Z
?UpdateRadialControllerConfiguration@Dial@detail@WinRT@Serif@@CAXUIRadialControllerConfiguration@Input@UI@Windows@winrt@@_N@Z
?UpdateRadialControllerMenu@Dial@detail@WinRT@Serif@@CA_NQEAV1234@UIRadialController@Input@UI@Windows@winrt@@UIRadialControllerConfiguration@6789@_NAEBV?$vector@V?$Counted@VReflected@Kernel@@@Kernel@@V?$allocator@V?$Counted@VReflected@Kernel@@@Kernel@@@std@@@std@@V?$Counted@VReflected@Kernel@@@Kernel@@@Z
?UpdateViewLogicalDialCentre@Dial@detail@WinRT@Serif@@AEAA_NAEBURect@Foundation@Windows@winrt@@@Z

Sections

.text
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

149675ae6ac2b02aa49ffebf125aa13a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d2d1

dwrite

d3d11

dxgi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-appmodel-runtime-l1-1-0

user32

shell32

libacs

libaffinity

libkernel

libpersona

msvcp140

shlwapi

dcomp

version

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

api-ms-win-core-heap-l1-1-0

Exports

Exports

Sections

.text Size: 190KB - Virtual size: 190KB

.rdata Size: 87KB - Virtual size: 87KB

.data Size: 31KB - Virtual size: 33KB

.pdata Size: 10KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 190KB - Virtual size: 190KB

.rdata
Size: 87KB - Virtual size: 87KB

.data
Size: 31KB - Virtual size: 33KB

.pdata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB