7a35e708c07620f0c490b3a38d61f6c2f4e36ed2de31875311e1a311f7ce73f2

Sharing

Copy URL Twitter E-mail

General

Target

7a35e708c07620f0c490b3a38d61f6c2f4e36ed2de31875311e1a311f7ce73f2
Size

4.8MB
MD5

167e97ac981b7b200319e116c72f351e
SHA1

6a6c0ddeaf9d1e200c6e65cdcf79d3024d94d5e8
SHA256

7a35e708c07620f0c490b3a38d61f6c2f4e36ed2de31875311e1a311f7ce73f2
SHA512

06f390ec34afad78b495169b3d01aaedc95987d2e998c766b3a4831ba9417f6facd4c0d676177b7b08866fe11757e34675e14b36f4c475ab70c12dc4e47e9e3f
SSDEEP

49152:wYkDE+blm5QSrvKPpSdRYy7EYxlmIj+x5IWPJb3epuNCM8gS:wG2kxjPmIj4apYCMV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7a35e708c07620f0c490b3a38d61f6c2f4e36ed2de31875311e1a311f7ce73f2

Files

7a35e708c07620f0c490b3a38d61f6c2f4e36ed2de31875311e1a311f7ce73f2
.dll windows:5 windows x86 arch:x86

a95a2dbe2bc5002cb59e86537f7ca42d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayRedim
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey

user32

MessageBoxA
CharNextW
LoadStringW
SetClassLongW
GetClassLongW
SetWindowLongW
GetWindowLongW
CreateWindowExW
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCaret
SetWindowRgn
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetCapture
SetActiveWindow
SendMessageA
SendMessageW
ScrollWindow
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OpenClipboard
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageA
IsDialogMessageW
IsChild
InvalidateRect
InsertMenuItemW
InsertMenuW
HideCaret
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageExtraInfo
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgCtrlID
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameW
GetClassInfoExW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EndMenu
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
CreateAcceleratorTableW
CopyImage
CopyIcon
CloseClipboard
ClientToScreen
CheckMenuItem
CharUpperBuffW
CharUpperW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BeginPaint
AdjustWindowRectEx
ActivateKeyboardLayout
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow

kernel32

Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
VerSetConditionMask
VerifyVersionInfoW
TryEnterCriticalSection
SwitchToThread
SuspendThread
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
RaiseException
IsDebuggerPresent
MultiByteToWideChar
MulDiv
LockResource
LocalFree
LoadResource
LoadLibraryA
LoadLibraryW
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
HeapSize
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GlobalUnlock
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetWindowsDirectoryW
GetVersionExW
GetVersion
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetSystemTimes
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileAttributesW
GetExitCodeThread
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCPInfoExW
GetCPInfo
GetACP
FreeResource
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumSystemLocalesW
EnumResourceNamesW
EnumCalendarInfoW
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateFileW
CreateEventW
CompareStringA
CompareStringW
CloseHandle
Sleep

gdi32

UnrealizeObject
StretchDIBits
StretchBlt
StartPage
StartDocW
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SaveDC
RoundRect
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyBezierTo
PolyBezier
PlayEnhMetaFile
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectW
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
FrameRgn
ExtTextOutW
ExtFloodFill
ExcludeClipRect
EnumFontsW
EnumFontFamiliesExW
EndPage
EndDoc
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateICW
CreateHalftonePalette
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
Chord
BitBlt
ArcTo
Arc
AngleArc
AbortDoc

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize
IsEqualGUID

comctl32

InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Copy
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_SetOverlayImage
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

shell32

Shell_NotifyIconW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

winspool.drv

OpenPrinterW
EnumPrintersW
DocumentPropertiesW
ClosePrinter
GetDefaultPrinterW

Exports

Exports

AAHvDqaw9AiUFEgH
ABRRZradhXxnlFbMk0RkFm
AFNI4iGwdron4xsRyLh
AHyiZwgv40MgRA8taHQSu
AV9OMyLyXYngjLrP1vbt9LRs
AXpPijXeVyQvxLneKHN
AafBaSzrF9iJLJm5hLcXRIiy1mAj71d
AagomnKfgLdyx1T9K9
Afw4gGaxMxSmR5U0lpDdSWScNEN
AptOH1MLEYU0DXWdUQ5tYiXNGbDoMy
ArvrbvrzhKJfVQnr7f
AzFzBVLUySDcrpi1AJW0Q
AzSqHcqQoUG7RJqPcjwm4VTuXwyp
B3kQcpwBIAG3fWITH4Mrn4
BDnX8UctzwKzYMPI
BND89adnzyvkj2YVzQ
BNNQ2aWOhfkSJtIbn36zTw
BNjJqSIDzyFjLWePheJZeQ7
BOMkDacbUrBSSlWXhV8SauX72Mwy
Bbjk2XQHW4IcptOK9LfU1djW
BgZKXZWiKzhlCGXwpgEHEarDUh7FYw
Bj5KqCF6YTj18dEGOUs7EzQYd
BlkrhplqzMNCcFTEggxC
BsXy7rbYzHq3IF5OlcvVFQ1myp
BxHD7GzVW2kxRUjpOIsXzvDJ2x4yF
ByoXT45PcUZAjXdK
C4zO43DiRaEOq7OmjFVxhVlZ
CSbZUmCoO11NoRFiDaV4pH8mF2
CUddY5Om7jCuHNwX
CXK8fS2sk1KOZLUdn1s
Cb4KRuZ1mY27J9UAFgO8qdn3QXy1jI
Cf04ocHpZ3LnVi2HIRaBbD
ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
Cm9VqQEHNFISHEF2HNbEVoZOW
CrashForException
CxUQNrcH8U5mJEOXQehmuu44
D48It8G8Osd75yCRJAd42QucK
D4ZKqvOf06iNL8Cbajmk3JNW
DIXS4DrPjSh62D39
Ds5pQyEGZkeTx79qHSXp
DumpProcess
DumpProcessWithoutCrash
E13gino7Z1zSh23abs
EMPFca4RpJ1afCcBTf3Vo
ESXWCh75OfYwSG8JA
EScEXi8sCaAPcuYsXp
EhWun82Mtg6nfT9QsjrCDsG9Uu
Ew4H6BDebacSx4j2mlC
F2QOGZJfVsGICwtLkVavbh5VZ
F4GXAxCjUt1d1QoGTZVUwdCuJuFl
F8IxJPqLwlmhDEkc4hFM91
F9RT77nngFgbUJzKKw5amnnlLkSi7Py
FQMd2V4CSPRQ9ysztyFV
FV1hagYR4nrM6rsNud
FfQAN1WMJDD0hVys279
Fp5AFegn4YOTiEF6qVvXwYiEp57
FvTnJsq9XjL90unxDzydMaW5OlV9
G1ULHbEDpXexLz6R2r3J4sQ
G2DfkJkz2kRgUgqY0IUEEEO2ht
G2HuKTxT8lal6bGiBhDoc
G5IgW4zKnGxSbYnBTLFoCa6l
GaA8GAFKk7qEgh4JQy
GetHandleVerifier
GfnLl1XN2De0IX7o
Giq0bT4lzoDHTjqiyszqbrg
GiwQMNnc0N3K9V4DSOoZFdCU505Y
GlsnDG60sc6tr73BTcdXyE8VMA1L
GtaCDuEkzMHVo5vy
H0a6gDcufsrPjcne6eR4tMZ
H3SENegadBQTaOg4T6m9rSp3mc2MvRf
H7HO5mR5u8p5usau94UkmBY5d
HTelMccJrqIVS53qLb0NM6b3r8
HUU1l1JixnxSFyIJBWqnKft895s
HUnHAKZkcKBQkAIYbpq
HYfTWsUcHATatpVtMPE8
Hb4dFi9Dx6fF6VjwRJC4DKkoivoiG
HgB6vBtpy6TlboIoIT3J7qBqqRcseNM
HoDQNMZXayyVJCsYje
HzBWcRyRBdJp8afOQi5B17k12DpDAE6
I1rf65mkGpXF0zw3
I3ZvjPJk3QG9LnLA
I9wFN8q0VlT356e21kI9v0
II67kccNoZLAUuBA0j2qCcVakvP2zK4
IVaMGMfJCvTZ1KPwBt4HzMx8LvCBUxQ
IYB1NEHr4Z6snY98daswG3pRKQ8Gw7
IfFNMD3SUXoLtFicDceJx4XNZEWbR
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
IsSandboxedProcess
IvvlDp2C0VVxv8xHwswUB2
J1dtQsy1wisCneV6wY8xQ0bry9h1O
J6XClS9uzeqhzaAw8Q
JBu0vJN8xV1fSHA5jnhtRXV
JWU2mTbwsj1CJRWE5v3Gi88lXgrt
JWrkwfdXtUusPt8vMZecmXKNVv
K0upJ4WTybgZGcwc
K7yjD7bV5LwtWNTpN
K9kpB02IEt9je8hhZSeNcXbLrCu47
KEUO2b06zaTz7ovlX1I3MavBAQSVGS
KgtCKk9Bw6cBjQQXwE86ArUWa
L2aAYHWNxB9X0pdghT8fuiWMOnWJaN
LBpqxlHe0QfVl0fL1UPyatJ3F61
LMmbE20DnMvfn5Yp
LXsYKyknN8lWCiDV5hAhK5IFrMNFwS
La7MUaCnLq7x93Ey
Ly8dsQVhVLyULEZQikwlmAOqOtVhT
LzltI1TiHHYtLLHjEzihuBhm52HDlN
M2ZEyBCbS7WzMzJ6D
MLIf0iSnIa4wLeYLyLaBRHfYcN
MUUlQYMmuJsPz4Wty
MrNI5gHVEVnjjBjUb
Mt5aatkeQVi8jV8EuDZvw
Mvo50qGvKdu3XadcJxeV5iGvft69QR
MyOeI8pseyp9eDz6qQUsp9dJbktbIO
N9UIXceizmHXFdgd
Nd4HGFTjrpkEZxn8S5d
NifPRmQy0eqZiLA4g
NkqlHTP2qFBzIHIF
NxslM6tB5Kf455LHx
NyySVA4YrY5FH0kLyhRavu1
O2dSLrpTzpXdevIH6sfD4b
O6DuxP1mKQbsxhtuw5Hc1
ODDpBV1nN8edR9qwfmSSIBhxu9VAXYZ
OFyOEL8AquJcPq55gRJ5RQPA6
OLafKZJqThTzmWsn
OPoosePenuNqDiXBAjlZ5BitnRdnMLU
OWcCspVZEVoRR6xS
OfQJ015UZsS4Djqp
Ovo2cuUuuYnVpu9qVF
OwfonVAAxb6RCkT7qAV
P4SrQQETL8wpGcwVuHiqzjBOysd
PFIGDqZpskoXNyNyeqJvBpu0uEk0C
PFjxbIjgkQFCUfFEQ9BgvYQzIHjtHoW
PRMTRibx3astM1ZixZUa2V
PXhHplF3zuPgBIsRCkZ5O0t4r
PZyxiOzquZZlEHBAgt5m08JnO
PbT5aseUTxov2sw4yt3iGZ7VCTB
PkmVcxLRwenSOGjY
PrzEBtyj1oN2GX75Kylqn9Yf
PuTe3Bs4af2BK4Pg2eDfd2tKH2
PzpZmt1XuRS3f0UPMDp1r1o
Q05WuXOBRMZIO1ESX2
Q4f4mdxkYOxTbDvws
Q4iB815EunsQe6IPvTCIgIfrqBLL
Q8emife4n7nt6EkU1hGFy
QG1n3z5TzAWN5UYNGh1C9U
QI9CBxfHkuYRYi2DpfdTyaJTpxc01
QLMrR8HQbKechzPNb1E47nv
QWSjHXfkPf9YBCxBkfByq
QeCywpZXUensEKgcdH74FD8Hyxma
QhxaWBRc49V922vv5JVX
QnhF5kOXlMqnhRDw1LbuRzaT
Qv9Ozf8PUPprfJ2mAuXf6FvE9S
Qwecxa7SGecS2quBi
QyiClzoSfR9Yi7YGdNxo8GBWtPtH
QyiXMSFwhy5bFCpjnF0
R7PMwUCj73vyqZvGWA0FtSJGGu2CoXZ
R8721Oo6Jlgb3aXKbA5JxNJHG
R8gRQn4k1QvI5FQJnMZ7
R8yloK4Fzmr7BWlMBgKSL3MqMp9fL
RH9aDKlFwi3GWTaA8LvLhj
RMFK0VBwb0vjCMP1P
RNg2PfztQfNGqHtj7Her
RRhgT73FwMBeD4hEEK
RVzUJddzIkYIsChpryzaO05q91FRp
Rd6VExNKJ8Tz5ihVvynAh4rZP2z6G0
Rvrp0EZR3XqTgFqTsYHfW
RwiNbugEd37sAJITJQl0dXUTd
RwkeB3vR4k4cih6apeGPo
Rz0WaDkhptkyaSEvZJxsYhUe
S08TeEevHPLtEjgUJ
SCcC6oLYNO7wGcw94BT
SFAPSnBYtn5XRa3tfWh6ThEh7eVjj
SOU3XEz6eOzQ3aHn
SPwz6cPmkTquoEIAlTSAnxCPnNogg
SX420RBll4cv97dCVygkGYMvygRhz
SZnPrXmlIHaw4x41BWRF9aKne1nyN
ScbFb8DpnXsV4uS1d9JsBfx2u4iytg
SdHnJegiepiBD2hcg5GMBsA0KnGGP7
SetCrashKeyValueImpl
SpnbbpOExSOm01w2zPR7IumGNjOBfP
T0N39RYfIGWBzxXeWmf2LskwR1
TIL2ljzRXFjldGHuBnPGulCQzQWNi
TJvyw3tmVcRziaG89VPBSF9OvH
TMethodImplementationIntercept
TR1A4dmTcUGnYy1pM9yY25cEPhL
Tdrj6XrfDLCBj4WRXYX9XfmxsSUl4P
TerminateProcessWithoutDump
UClzT8n00y1QjqbUwdBpksw5CkPqx2
UfBFfW1c3DsrPQHGDf
Ux0GMdF8PEKtGBAnKiv6Lfab
VBYx5geUJtnTh9x6rX
VC9wNqL3qF6iuwCuOAukzzPZJ
VQKWDAF00kwWSfGGBKwdx4N1t1rE3
VYojONxW8XUjviQVPuJa2FwQbyJy9yG
Vh3gGOsV2gHdmPwWLPYgAW0oBeMzJ
Vmm9k5kRSAYGLa7Uv
Vnif0iwF5j1EbxBfPYUDQegvWvL0r
VxWp5szWb29hqQofMcRIuQ
VyRNS5JXA359U8aX7MkApzoP62spdU
W5kiRbOuWL7MyMuhcxQwmOHND5n05
WEOc3yYyXGw1YQTbyWzy
WGpMgLZetCYr3YzlurHTUjurXmUsxr
WP9MaS2OEbY53qWaIYAWdMejNco5URF
WTZXK1L6qVlcmlL6K9kBtyQT3
WTdThes7K45EaGzZ8OYSvP1vV
WWRJsfv2zN4FsWJf5MHWmosdM2BYu
WYIp3A1RMbnjS76f
WZCmDX3HVdiqeVVq7XhT
WZGa8vxheHfsX0fcXphTmLhDfnPdiM
WngjsIaDnl3GjBBiSoj
WsIdgQUqhhRpOHjOgzAnqx7LW
WyCwOLwJsUM8ntP4L
XAGY60gHOCbm206qSBh03AA
XDLrYVI3YtYm6baIi2EOfl9QFiY5
XGIBsbTqGMawVRBZDa8G7UQN631evGZ
XKY54GY3Lfl0SK0idwP2Pk
XMBkTj2mU9RklehD09Zz1kPyaI
XMp70mLCSvYaKhW1lHobaVknJ3juH6y
XRhxxozMvo1VCaCHD
XVG3IGwLtC6ckFup
Xc8eMo78G3euIlNZpzc1vx33zmHK1h
XhP2klbVDLzo5g9Dwp5ZE7Eb906GVeJ
XiBe4gfOIoOEcL4ytKSKcb1PRYy1NEZ
XnG1vZLOmVUXS4G9rI
XnHKDSsyCXYTXaBNj
XoE03fQyil6hi2eSTNDgJcjLgMLNtAH
XzWditHsckHKM4bJda
Y3XKY3V5syf8zyJcR1tGYeEKBWO
Y5xU2Azb0qZpSqpbz5RBaPJmJ7mV
Y7yhKFHIppn9RGx6YSQ
YCltT32HeYf0SIaV
YCqhV21BOzIrof41TvfBF
YJi9z1ccSybNxiri4u0XXBuMi3q
YlHH1lFXVXoeLvjg
YtvWcRgvV8ueJI9eQunOz
ZAPP6kLpmLCUHsTdk4rZCaMVB
ZC6CXV6mewoPKtWiY
ZGMcfjTnQpf0JSzEUKENy41iVa1
ZHwKNku9WT0VyrPvUjGEQB
ZMDhYVBnvVC7tZ97O
ZOqIvtrsrqfMbSAjXwgl922jmm
ZhZYlBzjbpICwFew8YME
ZmKtZRnBivsSDq3dikgpk
ZtX9woeRt4J3nJ59L4K
a7nlKgFdTyboJ6MmrxM
aMxUPTtPgjWIuYUG3xM8JuIa
abRY5I4Y5ShNzmxoZ4ZOaMRAakXR
amJeru9Deb95sCrbtwfZD0eoIBWTjw
amZPNPMukE4EKZTItV0CBoXwMKO
aqCizhyNEAORWLdIANgIGoCKV9pR8Y
asTidcqcjvKwx7oK
bBXsqaPWi3zb9UFRoTImOMWfydvez0
bIHvnrhzjvmszL7EYlcbQQPx2PsyUO
bNwe5eb0v4GYiMs01QZMFSoOfIJzT
bPNSxazv4RCK7tV2SuT7Mfs
bYIrPRSvgG9vAwr5tGyJ2gPgSefRfVO
bfpPr3hwtdpjvPsyK1vn8ZGvqSnHp6
boDOR6GhH42Wh10zk1Kxaa
bpeZUWmTDqHcPoBLlSeBy
bsNKjKi14ihGU6CvD
bsRtAgVLOgFhQRDhjZ4Nj39Rz
bx44RKZh8VuBB4El
c4R75wY6u1Wc890M1GwbevUeS
c8IMiXobM7HO3q0BaVXNdXORLW1
cDTZ1bTtnYXS9OLs6cZe
cFZvVRFCCQf6GCtkeHt
cHYAMndr9y1VP24Y2rPffY9W
cKYLgMsvylMVF6sg
cOuR217Vb7L4zy33waboZaUvPhdat2p
cTTteZJowhPKIkdfmnDEWLw6iGxWhv
cYbK1jUPOEJspFFpQtLe9uaW
cZgyGfLLFVZXSBdJpPkA5GyAko6Tx2
cef_add_cross_origin_whitelist_entry
cef_add_web_plugin_directory
cef_add_web_plugin_path
cef_api_hash
cef_base64decode
cef_base64encode
cef_begin_tracing
cef_binary_value_create
cef_browser_host_create_browser
cef_browser_host_create_browser_sync
cef_clear_cross_origin_whitelist
cef_clear_scheme_handler_factories
cef_command_line_create
cef_command_line_get_global
cef_cookie_manager_create_manager
cef_cookie_manager_get_global_manager
cef_create_url
cef_currently_on
cef_dictionary_value_create
cef_do_message_loop_work
cef_drag_data_create
cef_enable_highdpi_support
cef_end_tracing
cef_execute_process
cef_force_web_plugin_shutdown
cef_format_url_for_security_display
cef_get_current_platform_thread_handle
cef_get_current_platform_thread_id
cef_get_extensions_for_mime_type
cef_get_geolocation
cef_get_mime_type
cef_get_min_log_level
cef_get_path
cef_get_vlog_level
cef_initialize
cef_is_web_plugin_unstable
cef_launch_process
cef_list_value_create
cef_log
cef_now_from_system_trace_time
cef_parse_csscolor
cef_parse_json
cef_parse_jsonand_return_error
cef_parse_url
cef_post_data_create
cef_post_data_element_create
cef_post_delayed_task
cef_post_task
cef_print_settings_create
cef_process_message_create
cef_quit_message_loop
cef_refresh_web_plugins
cef_register_extension
cef_register_scheme_handler_factory
cef_register_web_plugin_crash
cef_remove_cross_origin_whitelist_entry
cef_remove_web_plugin_path
cef_request_context_create_context
cef_request_context_get_global_context
cef_request_create
cef_resource_bundle_get_global
cef_response_create
cef_run_message_loop
cef_set_osmodal_loop
cef_shutdown
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_stream_reader_create_for_handler
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_string_ascii_to_utf16
cef_string_ascii_to_wide
cef_string_list_alloc
cef_string_list_append
cef_string_list_clear
cef_string_list_copy
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_clear
cef_string_map_find
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_clear
cef_string_multimap_enumerate
cef_string_multimap_find_count
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_alloc
cef_string_userfree_utf16_free
cef_string_userfree_utf8_alloc
cef_string_userfree_utf8_free
cef_string_userfree_wide_alloc
cef_string_userfree_wide_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf16_to_wide
cef_string_utf8_clear
cef_string_utf8_cmp
cef_string_utf8_set
cef_string_utf8_to_utf16
cef_string_utf8_to_wide
cef_string_wide_clear
cef_string_wide_cmp
cef_string_wide_set
cef_string_wide_to_utf16
cef_string_wide_to_utf8
cef_task_runner_get_for_current_thread
cef_task_runner_get_for_thread
cef_time_delta
cef_time_from_doublet
cef_time_from_timet
cef_time_now
cef_time_to_doublet
cef_time_to_timet
cef_trace_counter
cef_trace_counter_id
cef_trace_event_async_begin
cef_trace_event_async_end
cef_trace_event_async_step_into
cef_trace_event_async_step_past
cef_trace_event_begin
cef_trace_event_end
cef_trace_event_instant
cef_translator_test_create
cef_translator_test_object_child_child_create
cef_translator_test_object_child_create
cef_translator_test_object_create
cef_unregister_internal_web_plugin
cef_uridecode
cef_uriencode
cef_urlrequest_create
cef_v8context_get_current_context
cef_v8context_get_entered_context
cef_v8context_in_context
cef_v8stack_trace_get_current
cef_v8value_create_array
cef_v8value_create_bool
cef_v8value_create_date
cef_v8value_create_double
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_uint
cef_v8value_create_undefined
cef_value_create
cef_version_info
cef_visit_web_plugin_info
cef_write_json
cef_xml_reader_create
cef_zip_reader_create
cfySTCtKk6bfvgmfqSB0wgccyh331C
cnMQOLHcNA0Z31XbWWXSYUgbynJ1
cnvDwjkTF6DYSmhFJybWMCCMuv2u
create_context_shared
d4NBHc4LDMXQYa2HfOtdyP
d63vjA8Y8mF9vz8VrdTMMAz812AgU7
d6wmJAUwMIzDss5d2q5oRdwO6ZhaXla
dEIuZf6A27uOv4zvTd6SdyTJW06
dPdtdcGtv6jym57a3IiqXAkr
dbv4BNrxfb4yvdTPwlvGMBMh
dcSEaebT35Xr6XE4Nc2V85U
dlF5YtvZA5lfEEyKomekL6J3DOBw
eEgvBcyErwxCme2pxwfKVETCK
eEhCkkDRJduwK2qwTA9if
eI3tJW75O1uy12mYUctPXosK
eL5vWwMuiKt0oRSlq6eUuc1ef
eM1RLsax9mhNJkAJme
eN2vX9070lqD9m8nT8d1ik4crnew
eNb61pEe2IpNOgv7YX48
eNf1cf9o8eg8dHTE
ebzpHOOUF6EzoACJ50xi
ejRvfW0lpOCfTGeSjtyNFlri
ekCl1mDzYRL5C0Oa5lfCHlR
eoVkTkHp2V5If4X8a8NAzwRn1iciYq
f1ZeJqLz8TQlcy6L2IhcgNFbQ05K9a
f2zcQXpeN7PKX1A2wwyAtqblr
fSf5GV2DxgAHfTUTpPH9ou
fTOunNvIRGJMJiCgF5lEQpmA
fToLjIvQT4S5LsaZQvgChS0TQ
fhAMRNHjrRwIlNk4thINcXV1qDH
g363JmI5wSx4DtKkJuvESj3zg
gDNM7oZ9cUjLWVhz8EOJeAcymZn6atz
gEds08zzSNAatKFApLjhMMAi5Pt
gbrgCCFF2tzhaUmlontz4FW6Ljezkk
gdk0QCyXKUYB7U0zC7wtofw9mSb3
glo4d5fWI38dh4kruJdN
gn8ggpPRSdIX93e0IuWrNvDGy79eTmx
gq3Rnozt3k7uYGs09e3irHFoxBKijDd
grAqoRq6GiSH1OQcpBXemH06p5X
gyzBq8qeLRCsBv7ZP3pXTDK6YnSV
h14I0Ioqd7xQnJ503DzMMJPpJkKg
h5acAqlA2UQuaLyPuawZY
h70fXnHC0YlHw2kQG4
h9D12PO0Fq7wDkrjdIqfonTGV
hFskKCI1RzabxlcW6xnPdpsh
hQ5ZyAo7YTAGlfhIrp2FcT5
hSxJIsWEC8HhSz1wR09
hVSN711KWLMEDMhRSBKWaQmo8Xlk
hVVaHGaJS6wWPbp9Tmpgz
hWkuEac9Yo96Wut80oi8jMztl30Mz
hl16UTz9zRSXhau6vRByRIOhf
hpuhVnYTQXqHqG5lv7EQ8
hq34QpHSg2h9v2uhJ4Rxa
hrZlcYFv9W24o9JL09yAX6Jyr4d
i1UzIqWJryj9xNFyqTxFZ
iPlQSmLbrB9xRvmVlb4bAVFypAs47v
iYiJx5U4RlcNVn6FM
ir8UShOl2uGXWQ1UlpBHifI
j1yXj1yocCu0h4VIPY
j32K1j9ntioqnFhtJQxcWBzPcDr8HZM
j5kzm2qGUviNYhxg74w
j8y0JLgkjYliS5CvO8TFexh60AnR
jPclrjtJBUuiwd2EWXh0GlW9

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 22KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 389KB - Virtual size: 388KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a95a2dbe2bc5002cb59e86537f7ca42d

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

gdi32

version

ole32

comctl32

shell32

winspool.drv

Exports

Exports

Sections

.text Size: 4.3MB - Virtual size: 4.3MB

.itext Size: 8KB - Virtual size: 7KB

.data Size: 26KB - Virtual size: 26KB

.bss Size: - Virtual size: 22KB

.idata Size: 14KB - Virtual size: 13KB

.didata Size: 2KB - Virtual size: 2KB

.edata Size: 22KB - Virtual size: 22KB

.rdata Size: 512B - Virtual size: 69B

.reloc Size: 389KB - Virtual size: 388KB

.rsrc Size: 81KB - Virtual size: 81KB

.text
Size: 4.3MB - Virtual size: 4.3MB

.itext
Size: 8KB - Virtual size: 7KB

.data
Size: 26KB - Virtual size: 26KB

.bss
Size: - Virtual size: 22KB

.idata
Size: 14KB - Virtual size: 13KB

.didata
Size: 2KB - Virtual size: 2KB

.edata
Size: 22KB - Virtual size: 22KB

.rdata
Size: 512B - Virtual size: 69B

.reloc
Size: 389KB - Virtual size: 388KB

.rsrc
Size: 81KB - Virtual size: 81KB