2024-10-13_7a2e7f0a0998dbe1075f4636e00d2278_floxif_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-10-13_7a2e7f0a0998dbe1075f4636e00d2278_floxif_mafia
Size

32.4MB
MD5

7a2e7f0a0998dbe1075f4636e00d2278
SHA1

121d29e525210c41bcd7013660c47002826fc132
SHA256

f1ac04197e4bdf1f4c064ff244656741d9eeac8882a06c3d3149904f130928ca
SHA512

7f98b250c90e6f138abbc4928921d9b0ba9dc92867267d686dbfa9a837db9fcab422f554fd6533dd23e4fb9d70707b54b1717eec704be1a294ca6d5bda3e1a85
SSDEEP

393216:Ltq0crDupvqfMsosQvhXssinNkKcSzHgggbMCyalrj9kiDzGLyqP:pq0crKpifM6khspNkKcS7N1Jkrmijk

Score

1^/10

Malware Config

Signatures

Files

2024-10-13_7a2e7f0a0998dbe1075f4636e00d2278_floxif_mafia
.exe windows:5 windows x86 arch:x86

9297499074a4da80c616968da6a1337a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:01
Certificate

Issuer

OU=Starfield Class 2 Certification Authority,O=Starfield Technologies\, Inc.,C=US

Not Before

16/11/2006, 01:15

Not After

16/11/2026, 01:15

Subject

SERIALNUMBER=10688435,CN=Starfield Secure Certification Authority,OU=http://certificates.starfieldtech.com/repository,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:43:0e:53:29:6b:f1
Certificate

Issuer

SERIALNUMBER=10688435,CN=Starfield Secure Certification Authority,OU=http://certificates.starfieldtech.com/repository,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2013, 07:56

Not After

03/05/2016, 20:33

Subject

CN=Foxit Corporation,O=Foxit Corporation,L=Fremont,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b9:30:8e:4d:d0:e1:a2:4c:5e:c5:27:38:a8:36:57:c3:93:6e:57:c4
Signer

Actual PE Digest

b9:30:8e:4d:d0:e1:a2:4c:5e:c5:27:38:a8:36:57:c3:93:6e:57:c4

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Reader_Phantom_6.0.3\TempFiles\Release_LIB_FULL\FoxitReader.pdb

Imports

kernel32

CreateProcessA
GetFileInformationByHandle
GetDateFormatA
GetTimeFormatA
FindFirstFileExW
FindFirstFileExA
GetDriveTypeA
GetEnvironmentVariableW
SetEnvironmentVariableW
SetDllDirectoryW
ResetEvent
VirtualFree
CompareFileTime
GetTimeFormatW
GetDateFormatW
_llseek
_lread
_lcreat
_lwrite
_lopen
_lclose
SetCurrentDirectoryW
WritePrivateProfileStringA
GetPrivateProfileStringA
GetShortPathNameA
GetProfileStringA
lstrcmpiA
OpenMutexW
GetLogicalDriveStringsW
GetSystemDirectoryA
LoadLibraryA
InterlockedCompareExchange
TryEnterCriticalSection
GetThreadPriority
MoveFileA
CopyFileA
DeleteFileA
SetFilePointerEx
InterlockedExchangeAdd
SleepEx
FindNextFileA
FindFirstFileA
GetSystemTime
GetModuleFileNameA
GetFullPathNameA
GetProcessHeap
SetEnvironmentVariableA
InterlockedPopEntrySList
InterlockedPushEntrySList
CreateDirectoryA
FlushInstructionCache
lstrcpyA
GetProcessTimes
GetExitCodeProcess
CreateFileA
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetFileAttributesA
SetConsoleCtrlHandler
FatalAppExitA
GetTimeZoneInformation
GetStringTypeW
GetConsoleMode
GetConsoleCP
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
TerminateProcess
HeapDestroy
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
VirtualAlloc
HeapQueryInformation
HeapSize
GetFileType
SetStdHandle
CreateThread
ExitThread
HeapAlloc
HeapReAlloc
HeapFree
EncodePointer
DecodePointer
RtlUnwind
GetStartupInfoW
HeapSetInformation
LocalLock
LocalUnlock
SearchPathW
GetNumberFormatW
GetFileSizeEx
GetFileAttributesExW
SetErrorMode
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
VirtualProtect
GetAtomNameW
GetDiskFreeSpaceW
ReplaceFileW
GetUserDefaultLCID
GetProfileIntW
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
CompareStringA
GetLocaleInfoW
LoadLibraryExW
InterlockedExchange
FindNextFileW
WaitForMultipleObjects
ReleaseSemaphore
CreateSemaphoreW
GlobalGetAtomNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
MoveFileW
SizeofResource
lstrcmpiW
GetThreadLocale
GetStringTypeExW
ReleaseActCtx
CreateActCtxW
lstrcmpA
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
lstrcmpW
SuspendThread
SetThreadPriority
GlobalSize
FindResourceExW
GetVersionExA
ExitProcess
SetFileAttributesW
CopyFileExW
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
TzSpecificLocalTimeToSystemTime
WinExec
GetDriveTypeW
DeviceIoControl
GetCurrentDirectoryW
GetCommandLineW
CreateMutexW
ReleaseMutex
GetCurrentThread
LocalAlloc
GetProfileStringW
Sleep
TerminateThread
GlobalFree
CreateEventW
ResumeThread
GetExitCodeThread
SetEvent
ActivateActCtx
DeactivateActCtx
SetLastError
GlobalAlloc
GlobalLock
ReadFile
GlobalUnlock
MulDiv
GetWindowsDirectoryW
RemoveDirectoryW
GetTempFileNameW
GetPrivateProfileIntW
WritePrivateProfileStringW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
CreateProcessW
WaitForSingleObject
GetSystemDirectoryW
LoadLibraryW
GetTempPathW
FreeLibrary
InterlockedDecrement
InterlockedIncrement
GetTickCount
GetFullPathNameW
GetFileAttributesW
lstrcpynW
GetACP
QueryPerformanceCounter
QueryPerformanceFrequency
GetLastError
FormatMessageW
LocalFree
CreateDirectoryW
GetPrivateProfileStringW
CopyFileW
DeleteFileW
GetLocalTime
FindFirstFileW
FindClose
GetLongPathNameW
GetVersion
GetShortPathNameW
GetModuleHandleW
SetFilePointer
IsDebuggerPresent
OutputDebugStringW
RaiseException
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
lstrlenA
GetProcAddress
VirtualQuery
CreateFileW
GetFileSize
GetFileTime
CloseHandle
GetSystemTimeAsFileTime
GetModuleFileNameW
GetSystemInfo
GlobalMemoryStatus
MultiByteToWideChar
lstrcpyW
GetVersionExW
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
FileTimeToDosDateTime
lstrlenW
WriteFile
WideCharToMultiByte
FreeResource
FindResourceW
LoadResource
LockResource
PeekNamedPipe

user32

GetWindowThreadProcessId
AttachThreadInput
GetClassInfoW
DefWindowProcW
GetForegroundWindow
LoadImageW
LoadAcceleratorsW
LoadIconW
IsIconic
SetFocus
CallWindowProcW
FindWindowW
RemoveMenu
RegisterWindowMessageW
GetScrollPos
SetScrollPos
SetClipboardData
EmptyClipboard
InvalidateRgn
NotifyWinEvent
SetClassLongW
EnableScrollBar
GetScrollRange
SetScrollRange
GetWindowPlacement
SystemParametersInfoA
GetCursor
GetSysColorBrush
DrawTextW
FrameRect
ModifyMenuW
DeleteMenu
CheckMenuItem
GetAsyncKeyState
GetCapture
LoadMenuW
SetCursorPos
WindowFromPoint
MapWindowPoints
GetSystemMenu
GetMessageW
TranslateMessage
DrawIcon
ScrollDC
EnableMenuItem
GetLastActivePopup
GetCaretPos
SendMessageW
GetSubMenu
GetMenuItemID
RegisterClassExW
GetMenuItemCount
IsRectEmpty
GetWindowContextHelpId
MapDialogRect
DestroyCursor
TabbedTextOutW
DrawTextExW
GrayStringW
AdjustWindowRectEx
GetMenuState
ValidateRect
CallNextHookEx
SetWindowsHookExW
GetWindowDC
BeginPaint
EndPaint
GetMenu
SetWindowPlacement
SetScrollInfo
GetScrollInfo
DeferWindowPos
RegisterClassW
GetClassInfoExW
CreateWindowExW
SetMenu
TrackPopupMenu
TrackPopupMenuEx
ScrollWindow
GetMonitorInfoW
MonitorFromWindow
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
DestroyWindow
GetTopWindow
GetDlgItem
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
GetClassLongW
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
CheckDlgButton
CheckRadioButton
GetDlgItemInt
GetDlgItemTextW
SetDlgItemInt
IsDlgButtonChecked
IsDialogMessageW
IsWindowEnabled
ScrollWindowEx
EndDialog
GetClientRect
GetNextDlgTabItem
CreateDialogIndirectParamW
GetDC
IsWindowVisible
DestroyMenu
GetWindowRect
EnableWindow
DestroyIcon
RedrawWindow
InvalidateRect
SetTimer
KillTimer
LoadCursorW
SetCursor
SetCapture
ReleaseCapture
PtInRect
GetCursorPos
GetKeyState
ReleaseDC
CopyAcceleratorTableW
GetParent
IsWindow
CopyRect
PostMessageW
UpdateWindow
SystemParametersInfoW
GetKeyNameTextW
MapVirtualKeyW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CharUpperW
TranslateAcceleratorW
InsertMenuItemW
GetMenuBarInfo
ReuseDDElParam
UnpackDDElParam
MsgWaitForMultipleObjectsEx
InSendMessage
WindowFromDC
ShowOwnedPopups
SetWindowContextHelpId
PostThreadMessageW
RegisterClipboardFormatW
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
CreateMenu
RealChildWindowFromPoint
CopyImage
EnumDisplayMonitors
SetLayeredWindowAttributes
GetDialogBaseUnits
UnregisterClassW
UnionRect
WaitMessage
CharNextW
GetNextDlgGroupItem
SendNotifyMessageW
GetTabbedTextExtentW
DestroyAcceleratorTable
DrawEdge
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
GetMenuDefaultItem
InvertRect
GetDCEx
MonitorFromPoint
UpdateLayeredWindow
IsMenu
FillRect
DrawFocusRect
GetSysColor
wvsprintfW
wsprintfW
MessageBoxW
SendMessageTimeoutW
VkKeyScanExW
GetKeyboardLayout
CreateIconIndirect
GetIconInfo
UnregisterClassA
SetMenuItemInfoW
GetUpdateRect
CharUpperBuffW
GetDoubleClickTime
IsCharLowerW
GetMenuItemInfoW
GetMenuStringW
SetWindowPos
SetWindowTextW
GetDlgCtrlID
EnumChildWindows
CountClipboardFormats
ShowWindowAsync
IsCharAlphaW
CloseWindow
EnumClipboardFormats
GetClipboardFormatNameW
GetDlgItemTextA
SetDlgItemTextA
GetWindowTextA
SetWindowTextA
GetWindowTextLengthA
LoadMenuA
ModifyMenuA
MessageBoxA
wsprintfA
WinHelpA
LoadCursorA
ShowCursor
SetWindowLongA
GetClassNameA
SendMessageA
CallWindowProcA
MapVirtualKeyExW
SubtractRect
GetWindowRgn
DialogBoxParamA
IsCharAlphaNumericW
ToAsciiEx
FindWindowExW
DispatchMessageW
GetClipboardData
CloseClipboard
OpenClipboard
GetWindowTextW
DrawStateW
DrawFrameControl
GetWindow
ShowWindow
DrawIconEx
LoadMenuIndirectW
LookupIconIdFromDirectory
CreateIconFromResourceEx
SetDlgItemTextW
SetRect
SetRectEmpty
InflateRect
OffsetRect
ClientToScreen
ScreenToClient
GetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetActiveWindow
GetDesktopWindow
GetFocus
SetForegroundWindow
PostQuitMessage
PeekMessageW
GetSystemMetrics
EqualRect
SetWindowRgn
MoveWindow
IsZoomed
IntersectRect
DrawMenuBar
BringWindowToTop
LockWindowUpdate
SetParent
IsChild
LoadBitmapW
SetWindowLongW
GetClassNameW
HideCaret
ShowCaret
SetCaretPos
CreateCaret
DestroyCaret
CreatePopupMenu
AppendMenuW
SetMenuDefaultItem
ShowScrollBar
GetActiveWindow
MessageBeep
InsertMenuW
IsClipboardFormatAvailable
CopyIcon

gdi32

SetROP2
SetStretchBltMode
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
ExcludeClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetLayout
SetLayout
SetArcDirection
SetColorAdjustment
SelectClipRgn
GetClipRgn
SelectClipPath
GetViewportExtEx
GetWindowExtEx
GetPixel
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
CreateDIBPatternBrushPt
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
ExtCreatePen
CreateHatchBrush
SetPolyFillMode
GetMapMode
DPtoLP
SetAbortProc
AbortDoc
CloseMetaFile
DeleteMetaFile
GetViewportOrgEx
GetCharWidthW
StretchDIBits
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetWindowOrgEx
LPtoDP
Ellipse
GetTextAlign
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextFaceW
EnumFontFamiliesExW
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
PtInRegion
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
SetBkMode
RestoreDC
SaveDC
CopyMetaFileW
Escape
RectVisible
PtVisible
GetDIBColorTable
GetBkColor
RealizePalette
CreateHalftonePalette
CreatePalette
ExtTextOutW
SetPixel
RoundRect
Polygon
Polyline
GetDCOrgEx
GetObjectW
GetTextExtentPoint32W
DeleteObject
CreatePen
CreateSolidBrush
GetTextMetricsW
CreateFontW
CreateCompatibleDC
BitBlt
GetDIBits
CreateDIBSection
SelectObject
CreateCompatibleBitmap
TranslateCharsetInfo
GetDeviceCaps
CreateRectRgnIndirect
CreateFontIndirectW
GetStockObject
CreateRoundRectRgn
DeleteDC
IntersectClipRect
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
CreateEllipticRgn
CreatePolygonRgn
FillRgn
StretchBlt
GetTextColor
Rectangle
EndDoc
EndPage
GetCurrentObject
GetFontData
GetCharWidthA
GetOutlineTextMetricsA
CreateFontIndirectA
EnumFontFamiliesExA
GetObjectA
CreateFontA
GetTextFaceA
GetTextMetricsA
CloseFigure
StartPage
StartDocW
CreateDCW
PolyBezier
StrokeAndFillPath
EndPath
BeginPath
TextOutW
PatBlt
CreatePatternBrush
CreateRectRgn
ExtCreateRegion
GetRegionData
CombineRgn
GetRgnBox
SetDIBitsToDevice
SetRectRgn
CreateMetaFileW
SetBitmapBits
CreateBitmapIndirect
GetTextCharset
GetBitmapBits
InvertRgn
EnumFontsW
CreateBrushIndirect
ResetDCW
GetTextExtentExPointW
CreateEllipticRgnIndirect
Arc
ExtEscape
WidenPath
SetMiterLimit
StrokePath
FillPath

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetSaveFileNameA
CommDlgExtendedError
GetFileTitleW
GetOpenFileNameW
GetSaveFileNameW
GetOpenFileNameA

winspool.drv

DeviceCapabilitiesW
GetPrinterW
EnumPrintersW
ord203
GetPrinterDataExW
OpenPrinterW
EnumMonitorsW
EnumPrinterDriversW
ClosePrinter
DocumentPropertiesW
GetJobW
EnumJobsW

advapi32

RegQueryValueW
RegOpenKeyExW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
CryptDestroyKey
CryptSetKeyParam
CryptImportKey
CryptExportKey
CryptGenKey
CryptAcquireContextW
IsTextUnicode
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyW
RegEnumValueW
RegQueryInfoKeyW
FreeSid
RevertToSelf
AccessCheck
GetFileSecurityW
SetFileSecurityW
GetUserNameW
RegEnumKeyW
RegSetValueW
GetTokenInformation
EqualSid
ImpersonateSelf
OpenThreadToken
OpenProcessToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor

shell32

SHChangeNotify
SHGetPathFromIDListW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
ShellExecuteExW
DragAcceptFiles
Shell_NotifyIconW
SHAppBarMessage
DragQueryFileW
DragFinish
SHGetFileInfoW
SHAddToRecentDocs
SHGetSpecialFolderPathW
ExtractIconW
SHGetDesktopFolder
SHGetMalloc
SHBrowseForFolderW
ShellExecuteW

comctl32

_TrackMouseEvent
ImageList_Draw
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Create
ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_Remove
ImageList_DrawEx
ImageList_Add

shlwapi

PathFileExistsW
PathIsRelativeW
UrlGetPartW
PathIsURLW
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathFindExtensionW
StrFormatByteSizeW
PathRemoveExtensionW
PathFindFileNameW
UrlUnescapeW
PathRelativePathToW
PathAppendW
PathIsDirectoryW

ole32

CreateItemMoniker
OleRun
OleIsRunning
OleTranslateAccelerator
CoCreateInstance
IsAccelerator
GetRunningObjectTable
CoGetMalloc
StgIsStorageFile
GetClassFile
CreateFileMoniker
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfile
PropVariantCopy
OleGetClipboard
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoRegisterMessageFilter
CLSIDFromString
CoRevokeClassObject
CoRegisterClassObject
OleRegGetMiscStatus
OleRegEnumVerbs
CoInitializeEx
CoUninitialize
OleDuplicateData
CoTreatAsClass
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoDisconnectObject
StringFromCLSID
CreateStreamOnHGlobal
CoCreateGuid
StringFromGUID2
CLSIDFromProgID
OleDraw
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CreateOleAdviseHolder
CreateDataAdviseHolder
StgCreateDocfileOnILockBytes
WriteClassStm
OleSaveToStream
CreateGenericComposite
CoInitialize
OleSave
OleLockRunning
OleCreateLinkFromData
OleCreateStaticFromData
OleCreate
OleLoad
GetHGlobalFromILockBytes
OleSetContainedObject
OleCreateFromFile
OleCreateLinkToFile
OleGetIconOfClass
CoGetClassObject
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
OleSetMenuDescriptor
OleQueryCreateFromData
OleQueryLinkFromData
DoDragDrop
StgOpenStorage
OleCreateFromData

oleaut32

SysAllocStringLen
SysFreeString
SysStringByteLen
OleLoadPicture
SysAllocString
VarUdateFromDate
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SafeArrayCreateVector
VariantClear
VariantChangeType
VariantInit
SysStringLen
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
VarDateFromStr
SysReAllocStringLen
VarCyFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarBstrFromDate
OleCreateFontIndirect
SysAllocStringByteLen

oledlg

OleUIPasteSpecialW
OleUIEditLinksW
OleUIChangeIconW
OleUIConvertW
OleUIInsertObjectW
OleUIChangeSourceW
OleUIObjectPropertiesW
OleUIBusyW
OleUIUpdateLinksW

urlmon

URLDownloadToCacheFileW
HlinkSimpleNavigateToString

wsock32

recv
connect
send
__WSAFDIsSet
socket
htons
select
WSAGetLastError
sendto
recvfrom
closesocket
gethostbyname
WSACleanup
WSAStartup

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

winmm

PlaySoundW

gdiplus

GdipAlloc
GdipFree
GdiplusShutdown
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipDrawImageI
GdipDrawRectangleI
GdipDeletePen
GdipCreatePen1
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipSaveImageToFile
GdipCloneBrush
GdipCloneBitmapArea
GdipDrawImage
GdipFillPath
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromFile
GdipSetPageUnit
GdipSetWorldTransform
GdipGetDC
GdipCreatePathGradientFromPath
GdipAddPathEllipse
GdipCreateHatchBrush
GdipCreateLineBrush
GdipCreateBitmapFromFileICM
GdipCreateTexture
GdipSetMatrixElements
GdipCreateMatrix2
GdipSetPathGradientCenterPoint
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipDeletePath
GdipCreatePath2
GdipCreatePath
GdipDeleteBrush
GdipDeleteMatrix
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipBitmapUnlockBits

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

imm32

ImmGetProperty
ImmSetCompositionWindow
ImmReleaseContext
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmGetContext
ImmSetOpenStatus
ImmGetOpenStatus
ImmSetCompositionFontW

wininet

InternetQueryOptionW
FtpCreateDirectoryW
InternetCrackUrlW
HttpOpenRequestW
InternetOpenUrlW
GopherOpenFileW
InternetConnectW
FtpFindFirstFileW
GopherCreateLocatorW
FtpCommandW
FtpOpenFileW
GopherGetAttributeW
HttpSendRequestExW
HttpEndRequestW
HttpSendRequestW
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
GopherFindFirstFileW
InternetCloseHandle
InternetFindNextFileW
HttpQueryInfoW
HttpAddRequestHeadersW
InternetErrorDlg
FtpGetFileW
FtpPutFileW
FtpGetCurrentDirectoryW
FtpSetCurrentDirectoryW
FtpRemoveDirectoryW
InternetSetOptionExW
FtpRenameFileW
FtpDeleteFileW
InternetQueryDataAvailable
InternetGetCookieW
InternetSetCookieW
InternetCanonicalizeUrlW

netapi32

Netbios

odbc32

ord117
ord141
ord110
ord61
ord16
ord2
ord1
ord23
ord15
ord9
ord14
ord20
ord48
ord49
ord119
ord12
ord46
ord59
ord72
ord145
ord150
ord51
ord5
ord139
ord176
ord108
ord29
ord43
ord111
ord18
ord127
ord68
ord3
ord4
ord154
ord13
ord31
ord44
ord30

msvfw32

MCIWndCreateW

Exports

Exports

_CertAddCertificateContextToStore@16
_CertCloseStore@8
_CertCreateCertificateContext@12
_CertCreateSelfSignCertificate@32
_CertDeleteCertificateFromStore@4
_CertDuplicateCertificateContext@4
_CertEnumCertificatesInStore@8
_CertEnumSystemStore@16
_CertFindCertificateInStore@24
_CertFreeCertificateContext@4
_CertGetEnhancedKeyUsage@16
_CertGetIntendedKeyUsage@16
_CertGetNameStringW@24
_CertGetSubjectCertificateFromStore@12
_CertNameToStrW@20
_CertOpenStore@20
_CertOpenSystemStoreW@8
_CertSaveStore@24
_CertSetCertificateContextProperty@16
_CertStrToNameW@28
_CryptAcquireCertificatePrivateKey@24
_CryptDecodeObjectEx@32
_CryptEncodeObject@20
_CryptMsgCalculateEncodedLength@24
_CryptMsgClose@4
_CryptMsgGetParam@20
_CryptMsgOpenToEncode@24
_CryptMsgUpdate@16
_CryptSignMessage@28
_CryptVerifyDetachedMessageSignature@32
_CryptVerifyMessageSignature@28
_PFXExportCertStoreEx@20

Sections

.text
Size: 19.0MB - Virtual size: 19.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.6MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

flag_dat
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9297499074a4da80c616968da6a1337a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

02:01Certificate

Key Usages

04:43:0e:53:29:6b:f1Certificate

Extended Key Usages

Key Usages

b9:30:8e:4d:d0:e1:a2:4c:5e:c5:27:38:a8:36:57:c3:93:6e:57:c4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

urlmon

wsock32

oleacc

winmm

gdiplus

rpcrt4

version

imm32

wininet

netapi32

odbc32

msvfw32

Exports

Exports

Sections

.text Size: 19.0MB - Virtual size: 19.0MB

.rdata Size: 5.4MB - Virtual size: 5.4MB

.data Size: 3.6MB - Virtual size: 3.8MB

flag_dat Size: 512B - Virtual size: 4B

.rsrc Size: 3.0MB - Virtual size: 3.0MB

.reloc Size: 1.3MB - Virtual size: 1.3MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

02:01
Certificate

04:43:0e:53:29:6b:f1
Certificate

b9:30:8e:4d:d0:e1:a2:4c:5e:c5:27:38:a8:36:57:c3:93:6e:57:c4
Signer

.text
Size: 19.0MB - Virtual size: 19.0MB

.rdata
Size: 5.4MB - Virtual size: 5.4MB

.data
Size: 3.6MB - Virtual size: 3.8MB

flag_dat
Size: 512B - Virtual size: 4B

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

.reloc
Size: 1.3MB - Virtual size: 1.3MB