AllImageDownloaderSetup_241008[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AllImageDownloaderSetup_241008.exe
Size

13.2MB
MD5

935833372474b84947e08b864b3faa2b
SHA1

2688aceeebd13b90511286766c7e62ad91e10280
SHA256

5780c0ad2ffe1506235b26cb465a03bbee9eb52d4faf6434183fa0c45e6e46d3
SHA512

71adbfa1720e239553b1fcb61be8510a130cf9cdbfd59f8353e14944c7cb9d620293ec49512289a24597a986acc5322dd75174ec56b15800e34174b68446bc28
SSDEEP

393216:wJXOiHXMwuiUhpBHx6AhpCDZo4YjvRO2qAGrY:w5nXQ7x6mpC2bq9Y

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	upx

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
AllImageDownloaderSetup_241008.exe
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/md5dll.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack001/$PLUGINSDIR/nsisdl.dll
unpack001/AllPictureFinder.exe
unpack001/x64/AllPictureFinder.exe

Files

AllImageDownloaderSetup_241008.exe
.exe windows:4 windows x86 arch:x86

61259b55b8912888e90f516ca08dc514

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 116KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/INetC.dll
.dll windows:4 windows x86 arch:x86

163fdad7b5f915e3a0ca7ad1d08b4ff8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW
CreateThread
LocalAlloc
lstrcpynW
SleepEx
MulDiv
GetModuleHandleW
GetTickCount
ReadFile
CreateFileA
CreateFileW
GetFileSize
lstrcmpiW
lstrcatW
LoadLibraryA
lstrcmpW
lstrlenA
MultiByteToWideChar
WriteFile
lstrlenW
CloseHandle
GetLastError
DeleteFileW
GetProcAddress
WideCharToMultiByte
LocalFree
TerminateThread
GlobalAlloc
GlobalFree
SetFilePointer
WaitForSingleObject

user32

wsprintfA
FindWindowExW
GetWindowLongW
IsWindow
CreateDialogParamW
ShowWindow
GetParent
DispatchMessageW
LoadIconW
KillTimer
PostMessageW
IsDialogMessageW
SetWindowPos
SetWindowTextW
GetMessageW
SendDlgItemMessageW
TranslateMessage
EnableWindow
RedrawWindow
UpdateWindow
GetWindowRect
SendMessageW
SetTimer
SetWindowLongW
wsprintfW
SetDlgItemTextW
GetDlgItem
IsWindowVisible
MessageBoxW
GetClientRect
DestroyWindow
SystemParametersInfoW
GetWindowTextW

comctl32

ord17

wininet

HttpSendRequestExW
InternetErrorDlg
InternetWriteFile
HttpSendRequestW
InternetSetFilePointer
HttpAddRequestHeadersA
FtpCreateDirectoryW
InternetCrackUrlW
FtpOpenFileW
InternetSetOptionW
InternetOpenW
InternetGetLastResponseInfoW
HttpEndRequestW
InternetReadFile
HttpAddRequestHeadersW
HttpQueryInfoW
InternetCloseHandle
InternetConnectW
InternetQueryOptionW
HttpOpenRequestW

Exports

Exports

get
head
post
put

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/logo.bmp
$PLUGINSDIR/md5dll.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

GetFileMD5
GetMD5
GetMD5File
GetMD5Random
GetMD5String

Sections

UPX0
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 162B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

6b5c4f7d679059f68f1269aad3a5cecd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc

user32

DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW

gdi32

SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 638B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsProcess.dll
.dll windows:5 windows x86 arch:x86

439074d1c01f7b16781bdf060930814a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
OpenProcess
MultiByteToWideChar
lstrlenA
lstrlenW
LoadLibraryA
lstrcmpiW
lstrcpynW
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetVersionExW
GlobalFree
GlobalAlloc

user32

GetWindowThreadProcessId
EnumWindows
wsprintfW
PostMessageW

Exports

Exports

_CloseProcess
_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 927B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsis7z.dll
.dll windows:6 windows x86 arch:x86

2656ea25cde98f31a490513c2db04ae8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalFree
FormatMessageW
GetFileInformationByHandle
SetLastError
DeviceIoControl
GetModuleHandleW
GetProcAddress
HeapAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GetStdHandle
WaitForMultipleObjects
GetTickCount
GetConsoleMode
AreFileApisANSI
SetFileApisToOEM
SetFileApisToANSI
GlobalAlloc
GlobalFree
lstrcpynW
lstrcpyW
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetCurrentDirectoryW
CreateDirectoryW
CreateSemaphoreW
RemoveDirectoryW
SetFileAttributesW
SetFileTime
GetTempPathW
GetCurrentProcessId
GetCurrentThreadId
MoveFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetModuleHandleA
SetEndOfFile
GetCurrentProcess
GetSystemInfo
GlobalMemoryStatus
GetProcessAffinityMask
IsProcessorFeaturePresent
WriteConsoleW
HeapSize
GetStringTypeW
DecodePointer
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
WaitForSingleObject
CreateEventW
ReleaseSemaphore
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
VirtualFree
VirtualAlloc
GetLastError
CloseHandle
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileW
DeleteFileW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
GetFileSizeEx
GetConsoleCP
FlushFileBuffers
GetFileType
HeapReAlloc
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess

user32

SendMessageW
FindWindowExW
SetWindowTextW
GetDlgItem
wsprintfW
CharUpperW

advapi32

SetFileSecurityW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

oleaut32

VariantClear
SysAllocStringLen
SysStringLen
SysFreeString
VariantCopy

Exports

Exports

Extract
ExtractWithCallback
ExtractWithDetails

Sections

.text
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsisdl.dll
.dll windows:4 windows x86 arch:x86

ed06d61f6957c32cd324837726a5a070

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

wsock32

__WSAFDIsSet
WSAStartup
WSACleanup
send
WSAGetLastError
recv
select
connect
shutdown
closesocket
socket
htons
inet_ntoa
ioctlsocket
gethostbyname

user32

SetWindowLongW
CharPrevA
SetDlgItemTextA
RegisterWindowMessageW
DestroyWindow
EnableWindow
wsprintfA
CallWindowProcW
CreateWindowExW
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExW
SetWindowTextA
GetWindowRect
SendMessageW
GetWindowLongW

kernel32

MultiByteToWideChar
WideCharToMultiByte
lstrcpynW
lstrcpyW
CreateFileW
WriteFile
Sleep
DeleteFileW
GetTickCount
MulDiv
GlobalFree
GlobalAlloc
lstrcatA
lstrlenA
lstrcpynA
WaitForSingleObject
CloseHandle
lstrcmpiA
CreateThread
lstrcpyA

Exports

Exports

download
download_quiet

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 882B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AllPictureFinder.exe
.exe windows:5 windows x86 arch:x86

875c4621c40b138406228e54bbb23f1f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\doc\CodeBase\PicSearcher\PicSearcher\Release\PicSearcher.pdb

Imports

winmm

timeGetTime
PlaySoundW

ws2_32

WSAResetEvent
gethostbyname
select
WSAGetLastError
WSAWaitForMultipleEvents
WSAIoctl
socket
getaddrinfo
freeaddrinfo
bind
accept
WSASetLastError
getnameinfo
ntohs
connect
gethostbyaddr
htonl
htons
WSAEnumNetworkEvents
WSACreateEvent
getpeername
getsockname
WSAEventSelect
WSACloseEvent
WSACancelAsyncRequest
WSAAsyncSelect
WSAAsyncGetHostByName
ntohl
WSACleanup
WSAStartup
shutdown
setsockopt
ioctlsocket
closesocket
sendto
send
recvfrom
recv
listen
inet_ntoa
inet_addr
getsockopt
gethostname
__WSAFDIsSet

iphlpapi

if_indextoname
FreeMibTable
GetUnicastIpAddressTable
if_nametoindex
GetAdaptersInfo
GetAdaptersAddresses
GetBestRoute2

psapi

GetModuleFileNameExW

wininet

InternetGetCookieExA
InternetSetOptionW

dbghelp

MiniDumpWriteDump

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

crypt32

CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CryptDecodeObject
CertOpenSystemStoreW

kernel32

GetExitCodeProcess
GetFileAttributesA
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameA
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetLongPathNameW
GetOEMCP
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathA
GetTimeFormatW
GetUserDefaultLCID
GetVersion
GetVersionExA
GlobalMemoryStatus
GlobalSize
HeapCompact
HeapCreate
HeapDestroy
HeapReAlloc
HeapSetInformation
HeapSize
HeapValidate
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LoadLibraryExW
LockFile
LockFileEx
MulDiv
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserWorkItem
RaiseException
ReadConsoleInputA
ReadConsoleOutputCharacterA
ReadFile
ReleaseSemaphore
ResetEvent
ResumeThread
RtlUnwind
SetConsoleCtrlHandler
SetConsoleCursorPosition
SetConsoleMode
SetEnvironmentVariableA
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFilePointerEx
SetHandleCount
SetHandleInformation
SetNamedPipeHandleState
FreeEnvironmentStringsW
SleepEx
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
VerSetConditionMask
VerifyVersionInfoA
FormatMessageA
WriteConsoleA
WriteConsoleW
lstrcatW
lstrcmpW
lstrlenA
lstrlenW
GetSystemDirectoryW
AreFileApisANSI
WaitForSingleObjectEx
CreateEventA
CreateSemaphoreA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
ReadConsoleA
ReadConsoleW
GetACP
SystemTimeToTzSpecificLocalTime
FlushViewOfFile
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindFirstFileExW
FindFirstFileExA
FindClose
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
ExitThread
EnumSystemLocalesA
EncodePointer
DeleteFileA
DecodePointer
CreateSemaphoreW
CreateFileMappingA
CreateEventW
CheckRemoteDebuggerPresent
GetComputerNameW
OutputDebugStringW
GetCommandLineW
GetStartupInfoW
GetExitCodeThread
CreateThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
SetEndOfFile
SetFilePointer
SetPriorityClass
CreateFileA
DeviceIoControl
GetVolumeInformationW
GetTimeZoneInformation
GetEnvironmentStringsW
GetModuleHandleExW
GetWindowsDirectoryW
LoadResource
LockResource
SizeofResource
FindResourceW
GetTickCount
GetFullPathNameW
SetFileAttributesW
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
GetUserDefaultUILanguage
WaitForSingleObject
IsWow64Process
WriteFile
GlobalLock
GlobalAlloc
GlobalUnlock
lstrcpyW
LocalAlloc
lstrcmpA
FileTimeToLocalFileTime
CompareFileTime
GetEnvironmentVariableA
EnumSystemLocalesW
CompareStringW
GetConsoleOutputCP
MoveFileExW
FreeLibraryAndExitThread
InitializeSListHead
GlobalHandle
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterW
AttachConsole
FreeConsole
GetLogicalDriveStringsW
CreatePipe
CompareStringEx
LCMapStringEx
FileTimeToSystemTime
LocalFree
LoadLibraryW
GetCurrentThread
SetThreadPriority
GetTempPathW
OutputDebugStringA
GetLastError
GlobalFree
DuplicateHandle
CreateMutexW
SetCurrentDirectoryW
CreateMutexA
GetDriveTypeW
SetUnhandledExceptionFilter
GetCurrentThreadId
CreateFileW
MoveFileW
CopyFileW
GetFileAttributesW
IsBadWritePtr
WaitForMultipleObjects
RemoveDirectoryW
CreateDirectoryW
CreateProcessW
Process32NextW
Process32FirstW
ExitProcess
GetModuleFileNameA
GetEnvironmentVariableW
GetDriveTypeA
TerminateProcess
Sleep
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
GetModuleHandleA
OpenProcess
CloseHandle
GetModuleHandleW
GetCurrentProcess
GetVersionExW
GetModuleFileNameW
DeleteFileW
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
InitOnceBeginInitialize
InitOnceComplete
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetDiskFreeSpaceA
GetDateFormatW
GetCurrentDirectoryW
GetCommandLineA
GetSystemTime
GetCPInfo
GetThreadLocale
HeapFree
GetProcessHeap
HeapAlloc
GetNativeSystemInfo
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
IsBadReadPtr
VirtualProtect
SetLastError
VerifyVersionInfoW
SetStdHandle

user32

AppendMenuW
GetSystemMenu
DestroyWindow
IsWindow
GetActiveWindow
mouse_event
SendMessageW
DestroyIcon
SetTimer
PostMessageW
KillTimer
PostQuitMessage
GetWindowDC
GetWindowRect
ReleaseDC
GetDC
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
PostThreadMessageW
AdjustWindowRectEx
BeginDeferWindowPos
BeginPaint
BringWindowToTop
CallNextHookEx
CallWindowProcW
MessageBoxW
DispatchMessageW
TranslateMessage
GetMessageW
UpdateWindow
ShowWindow
CreateWindowExW
GetWindowThreadProcessId
CreateCaret
DestroyCaret
SetCaretPos
NotifyWinEvent
DrawIconEx
CheckMenuItem
GetUserObjectInformationW
GetProcessWindowStation
WaitForInputIdle
UnregisterClassW
UnionRect
UnhookWindowsHookEx
TrackPopupMenu
SystemParametersInfoW
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowLongW
SetScrollInfo
SetParent
SetMenuItemInfoW
SetMenuInfo
SetMenu
ScrollWindow
RemoveMenu
RegisterWindowMessageW
RegisterClassW
RegisterClassExW
PeekMessageW
MsgWaitForMultipleObjects
ModifyMenuW
MessageBoxA
MapWindowPoints
IsWindowVisible
IsWindowEnabled
IsDialogMessageW
InsertMenuW
InsertMenuItemW
GetWindowTextW
GetWindowTextLengthW
GetWindowLongW
GetWindow
GetSystemMetrics
GetSubMenu
GetScrollInfo
GetParent
GetMessageTime
GetMessagePos
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetFocus
GetDlgItem
GetDialogBaseUnits
GetDesktopWindow
GetCursorPos
GetComboBoxInfo
GetClientRect
GetClassNameW
GetClassInfoW
GetCapture
FindWindowExW
EnumDisplaySettingsW
DdeInitializeW
DdeUninitialize
DdeConnect
DdeDisconnect
DdePostAdvise
DdeNameService
DdeClientTransaction
DdeCreateDataHandle
DdeGetData
DdeFreeDataHandle
DdeGetLastError
DdeCreateStringHandleW
DdeQueryStringW
DdeFreeStringHandle
InvalidateRect
GetWindowPlacement
OffsetRect
MonitorFromWindow
GetMonitorInfoW
SetLayeredWindowAttributes
FlashWindowEx
MoveWindow
IsIconic
IsZoomed
DrawMenuBar
SetForegroundWindow
SetWindowRgn
RegisterHotKey
UnregisterHotKey
AnimateWindow
SetFocus
GetKeyState
GetAsyncKeyState
VkKeyScanW
MapVirtualKeyW
SetCapture
ReleaseCapture
GetUpdateRgn
RedrawWindow
SetCursorPos
SetCursor
ScreenToClient
WindowFromPoint
ChildWindowFromPointEx
GetSysColor
FillRect
InflateRect
PtInRect
CreateIconIndirect
GetIconInfo
LoadBitmapW
LoadIconW
LoadImageW
DrawTextW
DrawFocusRect
IsMenu
keybd_event
HideCaret
ShowCaret
DrawStateW
SetRect
SetRectEmpty
ChildWindowFromPoint
IsRectEmpty
LoadCursorW
DestroyCursor
DrawEdge
DrawFrameControl
GetSysColorBrush
GetDoubleClickTime
GetCaretBlinkTime
GetProcessDefaultLayout
GetPropW
RegisterClipboardFormatW
GetClipboardFormatNameW
CreateAcceleratorTableW
DestroyAcceleratorTable
TranslateAcceleratorW
ValidateRect
MessageBeep
EndPaint
ShowCursor
IsClipboardFormatAvailable
ChangeDisplaySettingsExW
MonitorFromPoint
EnumDisplayMonitors
EndDeferWindowPos
EnableWindow
EnableScrollBar
EnableMenuItem
DestroyMenu
DeferWindowPos
DefWindowProcW
CreatePopupMenu
CreateMenu
CreateDialogParamW
CreateDialogIndirectParamW
CopyRect
ClientToScreen
CheckMenuRadioItem

gdi32

SetAbortProc
StartDocW
EndDoc
PolyBezier
SetViewportExtEx
StartPage
EndPage
PlayEnhMetaFile
GetEnhMetaFileHeader
GetEnhMetaFileW
DeleteEnhMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
SetWindowExtEx
SetViewportOrgEx
EnumFontFamiliesExW
GetSystemPaletteEntries
SetDIBColorTable
GetDIBColorTable
CreateDIBSection
CreateDIBitmap
GetTextExtentExPointW
GetCharABCWidthsW
MoveToEx
LineTo
GetBkColor
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
PtInRegion
GetRgnBox
EqualRgn
ExtCreatePen
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectW
GetDeviceCaps
SetWindowOrgEx
DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
ExtCreateRegion
GetRegionData
OffsetRgn
CreateRectRgn
ExcludeClipRect
GetTextMetricsW
SetBrushOrgEx
GdiFlush
CreateFontIndirectW
GetOutlineTextMetricsW
CreateBitmap
CreateBitmapIndirect
SetBkColor
SetBkMode
SetTextColor
CreateSolidBrush
CreatePatternBrush
ExtFloodFill
CreateICW
GetTextExtentPoint32W
CombineRgn
CreateRectRgnIndirect
RectInRegion
SelectClipRgn
StretchBlt
SetStretchBltMode
Arc
Ellipse
GetClipBox
GetGraphicsMode
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
MaskBlt
Pie
PolyPolygon
Rectangle
RoundRect
ExtSelectClipRgn
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPixel
SetPolyFillMode
StretchDIBits
SetROP2
GetWorldTransform
SetWorldTransform
ModifyWorldTransform
ExtTextOutW
CreatePolygonRgn
DPtoLP
LPtoDP
Polygon
Polyline
CreateDCW
CreateHatchBrush
CreatePen

advapi32

RegisterEventSourceA
RegQueryValueExA
RegCloseKey
GetUserNameW
LookupAccountNameW
RegCreateKeyW
RegQueryValueExW
AddAccessDeniedAce
DeregisterEventSource
GetFileSecurityW
InitializeAcl
InitializeSecurityDescriptor
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
ReportEventA
SystemFunction036
RegEnumKeyExA
ReportEventW
RegisterEventSourceW
SetSecurityDescriptorDacl
SetFileSecurityW
RegOpenKeyExA

shell32

DragAcceptFiles
DragFinish
ExtractIconW
DragQueryFileW
CommandLineToArgvW
ExtractIconExW
ord6
ShellExecuteExW
SHOpenFolderAndSelectItems
ord190
SHAssocEnumHandlers
SHBindToParent
DragQueryPoint
ShellExecuteW
SHGetFileInfoW
ShellExecuteA
SHBrowseForFolderW
SHCreateDirectoryExW
SHFileOperationW
SHGetFolderPathW
SHGetMalloc
SHGetPathFromIDListW
Shell_NotifyIconW
SHParseDisplayName

ole32

CoTaskMemFree
CoSetProxyBlanket
CoLockObjectExternal
CoUninitialize
CoInitialize
OleFlushClipboard
OleGetClipboard
OleIsCurrentClipboard
OleLockRunning
OleRun
OleSetClipboard
CoInitializeEx
CoCreateGuid
CoCreateInstance
CoInitializeSecurity
CoTaskMemAlloc
OleSetContainedObject
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop
OleUninitialize
DoDragDrop
CreateStreamOnHGlobal
OleInitialize

oleaut32

VariantClear
VariantChangeType
SysReAllocString
SysStringLen
SafeArrayCreate
SafeArrayDestroy
SafeArrayLock
SysFreeString
SafeArrayGetVartype
VarBstrFromCy
SafeArrayPtrOfIndex
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocString
VariantInit
SafeArrayUnlock

comctl32

ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_ReplaceIcon
ord16
ord17
ImageList_Copy
ImageList_SetDragCursorImage
ImageList_GetIconSize
ImageList_Remove
ImageList_Create
ImageList_Destroy
ImageList_GetImageCount
ImageList_Add
ImageList_SetBkColor
ImageList_Draw
ImageList_Replace
ImageList_GetImageInfo
ImageList_AddMasked

oleacc

CreateStdAccessibleObject
LresultFromObject

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeBackgroundContentRect
IsThemeBackgroundPartiallyTransparent
GetThemeColor
DrawThemeParentBackground
GetThemeMargins
GetThemeBackgroundExtent
SetWindowTheme
GetCurrentThemeName
GetThemeFont
GetThemePartSize
GetThemeInt
GetThemeSysColor
GetThemeSysFont
IsThemeActive
IsAppThemed
IsThemePartDefined

bcrypt

BCryptGenRandom

shlwapi

PathMatchSpecW
SHAutoComplete
AssocQueryStringW
PathFileExistsW
PathRemoveFileSpecW
ord12
ord214
PathIsDirectoryW
PathIsRelativeW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

msimg32

GradientFill
AlphaBlend

winspool.drv

OpenPrinterW
DocumentPropertiesW
GetPrinterW
ClosePrinter

comdlg32

GetSaveFileNameW
PageSetupDlgW
PrintDlgW
ChooseFontW
ChooseColorW
CommDlgExtendedError
GetOpenFileNameW

Sections

.text
Size: 11.3MB - Virtual size: 11.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 402KB - Virtual size: 6.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 726KB - Virtual size: 725KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
config.ini
uninstall.exe.nsis
x64/AllPictureFinder.exe
.exe windows:6 windows x64 arch:x64

890e475520cd2536301ddc0dd2d07533

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\doc\CodeBase\PicSearcher\PicSearcher\x64\Release\PicSearcher.pdb

Imports

winmm

PlaySoundW
timeGetTime

ws2_32

inet_ntoa
listen
recv
recvfrom
select
send
sendto
getnameinfo
accept
__WSAFDIsSet
WSAIoctl
inet_addr
bind
WSAWaitForMultipleEvents
closesocket
ioctlsocket
setsockopt
getsockopt
getsockname
getpeername
gethostname
gethostbyname
shutdown
socket
gethostbyaddr
getaddrinfo
WSAResetEvent
WSAStartup
freeaddrinfo
WSAGetLastError
WSACloseEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
connect
WSASetLastError
ntohs
ntohl
htons
htonl
WSACleanup

iphlpapi

GetAdaptersInfo
if_nametoindex
GetUnicastIpAddressTable
FreeMibTable
if_indextoname
GetAdaptersAddresses
GetBestRoute2

wininet

InternetSetOptionW
InternetGetCookieExA

dbghelp

MiniDumpWriteDump

winhttp

WinHttpCloseHandle
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

crypt32

CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CryptDecodeObject
CertOpenSystemStoreW
CertGetIntendedKeyUsage
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage

kernel32

ExitThread
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushViewOfFile
FreeEnvironmentStringsW
GetCPInfo
GetCommandLineA
GetCurrentDirectoryW
GetDateFormatW
GetDiskFreeSpaceExW
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetLocalTime
GetLocaleInfoW
GetLongPathNameW
GetOEMCP
GetStringTypeW
GetTempFileNameW
GetTimeFormatW
GetUserDefaultLCID
GlobalSize
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LoadLibraryExW
MulDiv
PeekNamedPipe
QueryPerformanceFrequency
QueueUserWorkItem
RaiseException
ReadConsoleOutputCharacterA
ReleaseSemaphore
ResumeThread
RtlUnwind
SetConsoleCtrlHandler
SetConsoleCursorPosition
SetConsoleMode
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFilePointerEx
SetHandleInformation
SetNamedPipeHandleState
SetStdHandle
SetThreadPriority
SleepEx
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoW
DecodePointer
WriteConsoleW
TryEnterCriticalSection
GetSystemDirectoryW
lstrcmpA
lstrcpyW
InitializeCriticalSectionEx
CreateSemaphoreW
CreateEventW
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalAlloc
GetCurrentThread
GetCommandLineW
GetStartupInfoW
GetExitCodeThread
CreateThread
SetPriorityClass
DeviceIoControl
GetVolumeInformationW
GetTimeZoneInformation
GetModuleHandleExW
GetWindowsDirectoryW
LoadResource
LockResource
SizeofResource
FindResourceW
GlobalAlloc
GlobalUnlock
GlobalLock
GetUserDefaultUILanguage
GetFileType
GetEnvironmentVariableW
GetStdHandle
RtlVirtualUnwind
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
SystemTimeToFileTime
GetFileSize
LockFileEx
LocalFree
CreateFileMappingA
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
GetSystemInfo
HeapReAlloc
DeleteFileA
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapCreate
ReadFile
AreFileApisANSI
WaitForSingleObject
GetLastError
GlobalFree
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
ReadConsoleA
CompareFileTime
GetEnvironmentVariableA
EnumSystemLocalesW
CompareStringW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
MoveFileExW
SystemTimeToTzSpecificLocalTime
FreeLibraryAndExitThread
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
RtlLookupFunctionEntry
RtlCaptureContext
GlobalHandle
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterW
AttachConsole
FreeConsole
GetACP
GetLogicalDriveStringsW
CreatePipe
DuplicateHandle
CreateMutexW
SetCurrentDirectoryW
CreateMutexA
SetUnhandledExceptionFilter
GetCurrentThreadId
CreateFileW
MoveFileW
CopyFileW
GetFileAttributesW
IsBadWritePtr
WaitForMultipleObjects
RemoveDirectoryW
CreateDirectoryW
CreateProcessW
Process32NextW
Process32FirstW
ExitProcess
GetModuleFileNameA
TerminateProcess
Sleep
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32FirstW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
EncodePointer
Module32NextW
GetModuleHandleA
OpenProcess
CloseHandle
GetModuleHandleW
GetCurrentProcess
GetVersionExW
GetModuleFileNameW
DeleteFileW
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
LCMapStringEx
CompareStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetProcessHeap
HeapAlloc
WaitForSingleObjectEx
GetNativeSystemInfo
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
IsBadReadPtr
VirtualProtect
SetLastError
WriteConsoleA
InitOnceComplete
InitOnceBeginInitialize
ResetEvent

user32

CreateWindowExW
ShowWindow
UpdateWindow
TranslateMessage
DispatchMessageW
ClientToScreen
GetWindowThreadProcessId
CreateCaret
DestroyCaret
SetCaretPos
NotifyWinEvent
CheckMenuRadioItem
CheckMenuItem
GetMessageW
CopyRect
CreateDialogIndirectParamW
CreateDialogParamW
CreateMenu
CreatePopupMenu
DefWindowProcW
DeferWindowPos
DestroyMenu
EnableMenuItem
EnableScrollBar
EnableWindow
EndDeferWindowPos
EnumDisplayMonitors
EnumDisplaySettingsW
FindWindowExW
GetCapture
GetClassInfoW
GetClassNameW
GetClientRect
GetComboBoxInfo
DestroyWindow
DrawIconEx
DestroyIcon
GetSystemMenu
AppendMenuW
IsWindow
GetActiveWindow
mouse_event
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
SendMessageW
PostThreadMessageW
AdjustWindowRectEx
BeginDeferWindowPos
BeginPaint
BringWindowToTop
CallNextHookEx
HideCaret
GetCursorPos
GetDC
ReleaseDC
GetWindowRect
GetWindowDC
WaitForInputIdle
UnregisterClassW
UnionRect
UnhookWindowsHookEx
TrackPopupMenu
SystemParametersInfoW
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowLongW
SetTimer
SetScrollInfo
SetParent
SetMenuItemInfoW
SetMenuInfo
SetMenu
ScrollWindow
RemoveMenu
RegisterWindowMessageW
RegisterClassW
PostQuitMessage
PostMessageW
PeekMessageW
MsgWaitForMultipleObjects
ModifyMenuW
MessageBoxA
MapWindowPoints
KillTimer
IsWindowVisible
IsWindowEnabled
DdeInitializeW
DdeUninitialize
DdeConnect
DdeDisconnect
DdePostAdvise
DdeNameService
DdeClientTransaction
DdeCreateDataHandle
DdeGetData
DdeFreeDataHandle
DdeGetLastError
DdeCreateStringHandleW
DdeQueryStringW
DdeFreeStringHandle
InvalidateRect
GetWindowPlacement
OffsetRect
MonitorFromWindow
GetMonitorInfoW
SetLayeredWindowAttributes
FlashWindowEx
MoveWindow
IsIconic
IsZoomed
DrawMenuBar
SetForegroundWindow
GetWindowLongPtrW
SetWindowLongPtrW
SetWindowRgn
RegisterHotKey
UnregisterHotKey
AnimateWindow
SetFocus
GetKeyState
GetAsyncKeyState
VkKeyScanW
MapVirtualKeyW
SetCapture
ReleaseCapture
GetUpdateRgn
RedrawWindow
SetCursorPos
SetCursor
ScreenToClient
WindowFromPoint
ChildWindowFromPointEx
GetSysColor
FillRect
InflateRect
PtInRect
CreateIconIndirect
GetIconInfo
LoadBitmapW
LoadIconW
LoadImageW
DrawTextW
DrawFocusRect
IsMenu
keybd_event
GetDesktopWindow
ShowCaret
DrawStateW
SetRect
SetRectEmpty
ChildWindowFromPoint
IsRectEmpty
LoadCursorW
DestroyCursor
DrawEdge
DrawFrameControl
GetSysColorBrush
GetDoubleClickTime
GetCaretBlinkTime
GetProcessDefaultLayout
GetPropW
RegisterClipboardFormatW
GetClipboardFormatNameW
CreateAcceleratorTableW
DestroyAcceleratorTable
TranslateAcceleratorW
ValidateRect
MessageBeep
EndPaint
ShowCursor
IsClipboardFormatAvailable
ChangeDisplaySettingsExW
MonitorFromPoint
IsDialogMessageW
InsertMenuW
InsertMenuItemW
GetWindowTextW
GetWindowTextLengthW
GetWindowLongW
GetWindow
GetSystemMetrics
GetSubMenu
GetScrollInfo
GetParent
GetMessageTime
GetMessagePos
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetFocus
GetDlgItem
GetDialogBaseUnits
CallWindowProcW

gdi32

GetCharABCWidthsW
CreateDIBitmap
MoveToEx
LineTo
SetDIBColorTable
GetSystemPaletteEntries
EnumFontFamiliesExW
CreateDIBSection
GetTextExtentExPointW
GdiFlush
EndPage
StartPage
EndDoc
StartDocW
SetAbortProc
PlayEnhMetaFile
GetBkColor
GetEnhMetaFileHeader
GetEnhMetaFileW
DeleteEnhMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
SetViewportOrgEx
GetPaletteEntries
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectW
GetDeviceCaps
CreateDCW
DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
ExtCreateRegion
GetRegionData
OffsetRgn
CreateRectRgn
ExcludeClipRect
GetTextMetricsW
SetBrushOrgEx
GetDIBColorTable
CreateFontIndirectW
GetOutlineTextMetricsW
CreateBitmap
CreateBitmapIndirect
SetBkColor
SetBkMode
SetTextColor
CreateSolidBrush
CreatePatternBrush
ExtFloodFill
CreateICW
GetTextExtentPoint32W
CombineRgn
CreateRectRgnIndirect
RectInRegion
SelectClipRgn
StretchBlt
SetStretchBltMode
Arc
Ellipse
GetClipBox
GetGraphicsMode
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
MaskBlt
Pie
PolyPolygon
Rectangle
RoundRect
ExtSelectClipRgn
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPixel
SetPolyFillMode
StretchDIBits
SetROP2
GetWorldTransform
SetWorldTransform
ModifyWorldTransform
ExtTextOutW
CreatePolygonRgn
DPtoLP
LPtoDP
Polygon
Polyline
PolyBezier
SetViewportExtEx
SetWindowExtEx
SetWindowOrgEx
CreateHatchBrush
CreatePen
ExtCreatePen
EqualRgn
GetRgnBox
PtInRegion
CreatePalette
GetNearestPaletteIndex

advapi32

RegisterEventSourceW
ReportEventW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameW
LookupAccountNameW
RegQueryValueExW
RegCreateKeyExW
SystemFunction036
RegEnumKeyExA
RegDeleteKeyW
RegDeleteValueW
DeregisterEventSource
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyW

shell32

SHBindToParent
SHAssocEnumHandlers
ord190
ShellExecuteA
ShellExecuteExW
ShellExecuteW
SHGetFileInfoW
SHParseDisplayName
CommandLineToArgvW
DragQueryFileW
DragQueryPoint
DragFinish
DragAcceptFiles
ExtractIconW
ExtractIconExW
ord6
SHBrowseForFolderW
SHCreateDirectoryExW
SHFileOperationW
SHGetFolderPathW
SHGetMalloc
SHGetPathFromIDListW
Shell_NotifyIconW
SHOpenFolderAndSelectItems

ole32

ReleaseStgMedium
RegisterDragDrop
RevokeDragDrop
CreateStreamOnHGlobal
OleSetClipboard
CoInitializeEx
OleIsCurrentClipboard
OleGetClipboard
OleFlushClipboard
CoTaskMemAlloc
CoInitialize
CoLockObjectExternal
CoSetProxyBlanket
CoInitializeSecurity
CoCreateInstance
OleUninitialize
OleInitialize
CoTaskMemFree
DoDragDrop
CoUninitialize
CoCreateGuid

oleaut32

VarBstrFromCy
SafeArrayGetVartype
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SafeArrayCreate
SysStringLen
VariantClear
VariantInit
SysFreeString
SysAllocString
SystemTimeToVariantTime
VariantChangeType

comctl32

ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_ReplaceIcon
ord16
ord17
ImageList_Copy
ImageList_GetImageInfo
ImageList_GetIconSize
ImageList_Remove
ImageList_AddMasked
ImageList_Replace
ImageList_Draw
ImageList_Destroy
ImageList_Create
ImageList_Add
ImageList_GetImageCount
ImageList_SetBkColor

oleacc

CreateStdAccessibleObject
LresultFromObject

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeBackgroundContentRect
IsThemeBackgroundPartiallyTransparent
GetThemeColor
DrawThemeParentBackground
GetThemeMargins
GetThemeBackgroundExtent
SetWindowTheme
GetCurrentThemeName
GetThemeFont
GetThemePartSize
GetThemeInt
GetThemeSysColor
GetThemeSysFont
IsThemeActive
IsAppThemed
IsThemePartDefined

shlwapi

PathRemoveFileSpecW
ord12
PathIsDirectoryW
PathIsRelativeW
ord214
PathMatchSpecW
AssocQueryStringW
SHAutoComplete
PathFileExistsW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

msimg32

GradientFill
AlphaBlend

winspool.drv

ClosePrinter
DocumentPropertiesW
GetPrinterW
OpenPrinterW

comdlg32

ChooseColorW
ChooseFontW
PrintDlgW
PageSetupDlgW
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW

bcrypt

BCryptGenRandom

Sections

.text
Size: 12.2MB - Virtual size: 12.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 456KB - Virtual size: 6.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 506KB - Virtual size: 505KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SHARED
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/config.ini

Sharing

General

Malware Config

Signatures

Files

61259b55b8912888e90f516ca08dc514

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 116KB

.rsrc Size: 39KB - Virtual size: 39KB

163fdad7b5f915e3a0ca7ad1d08b4ff8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

comctl32

wininet

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.data Size: 3KB - Virtual size: 21KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 1KB

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 120B

.reloc Size: 1024B - Virtual size: 662B

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 28KB

UPX1 Size: 3KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 1024B - Virtual size: 992B

.data Size: 512B - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 162B

6b5c4f7d679059f68f1269aad3a5cecd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 116KB

.rsrc
Size: 39KB - Virtual size: 39KB

.text
Size: 16KB - Virtual size: 15KB

.data
Size: 3KB - Virtual size: 21KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 662B

UPX0
Size: - Virtual size: 28KB

UPX1
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 4KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 1024B - Virtual size: 992B

.data
Size: 512B - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 162B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 638B

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 927B

.data
Size: - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 512B - Virtual size: 254B

.text
Size: 323KB - Virtual size: 323KB

.rdata
Size: 73KB - Virtual size: 72KB

.data
Size: 8KB - Virtual size: 35KB

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 17KB - Virtual size: 17KB

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 25KB

.reloc
Size: 1024B - Virtual size: 882B