2024-10-13_a6f50280222d278596bf1d5b6ed40643_mafia_magniber_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-13_a6f50280222d278596bf1d5b6ed40643_mafia_magniber_revil
Size

9.9MB
MD5

a6f50280222d278596bf1d5b6ed40643
SHA1

ba73b55bc4b96f128213f9d3d13863ca121daa03
SHA256

ebca0839c6368c9946395ef8cbc79841cd163152cff9ba033d007772ebf64388
SHA512

6948576229b99f3bf4f09434e7ec13a7a8c55be2805df1c1f172aee162c85589e2f10aa7e64c99bbd37dac5bd1804ec7631e9785142201e94c7d6c2a3f91332b
SSDEEP

196608:EIkMR9J9bgQSJsTh7U8YWDvdlhcrqNkS0HQ5icBoMIB+7HJhQs:EIXRFgQIUu2dlyrqNqbcBoMIB+bJh

Score

1^/10

Malware Config

Signatures

Files

2024-10-13_a6f50280222d278596bf1d5b6ed40643_mafia_magniber_revil
.exe windows:5 windows x86 arch:x86

72f3fb5ac60a390fd7303a4fcc6d422d

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:63:9a:e7:a9:4e:2f:34:ff:39:2d:6c:4b:e2:24:12
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

10/06/2019, 00:00

Not After

09/06/2021, 23:59

Subject

CN=LULU Software,O=LULU Software,L=Saint-Laurent,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f5:fe:b5:3b:1b:2f:1d:9a:56:93:08:23:01:0d:47:b1:dc:67:9e:91:c8:44:ae:24:c2:d3:47:b8:db:dc:87:a1
Signer

Actual PE Digest

f5:fe:b5:3b:1b:2f:1d:9a:56:93:08:23:01:0d:47:b1:dc:67:9e:91:c8:44:ae:24:c2:d3:47:b8:db:dc:87:a1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\TemporaryBuilds\35\213\src\Trunk\_bin\Win32\Release\GlamInstallerCom\GlamInstallerCom.pdb

Imports

ws2_32

getnameinfo
ntohl
htonl
gethostname
ioctlsocket
listen
accept
recvfrom
sendto
getaddrinfo
shutdown
WSAStartup
freeaddrinfo
connect
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
socket
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSACleanup

crypt32

CertDuplicateCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertGetNameStringW

wldap32

ord46
ord41
ord27
ord143
ord60
ord45
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord22
ord211
ord50
ord217

wininet

InternetReadFile
InternetConnectW
InternetSetOptionW
InternetOpenW
InternetErrorDlg
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
InternetQueryOptionA
InternetSetOptionA
HttpSendRequestA
InternetCombineUrlA
InternetOpenA
HttpQueryInfoA
InternetCloseHandle
HttpSendRequestW
InternetGetLastResponseInfoA
InternetConnectA
HttpOpenRequestA

oleacc

LresultFromObject
AccessibleObjectFromWindow

winmm

PlaySoundA
timeGetDevCaps
timeGetTime
timeSetEvent
timeKillEvent

imm32

ImmReleaseContext
ImmGetCompositionStringW
ImmIsIME
ImmNotifyIME
ImmSetCandidateWindow
ImmGetContext
ImmAssociateContextEx

comctl32

ImageList_GetImageInfo
ImageList_GetIconSize
ImageList_DrawEx

urlmon

FindMimeFromData

kernel32

GetTempPathW
CreateMutexW
DecodePointer
EncodePointer
RtlUnwind
GetTimeFormatA
GetDateFormatA
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
TlsFree
CreateEventA
GetLastError
TlsAlloc
InterlockedExchangeAdd
CloseHandle
SetEvent
LocalFree
LocalAlloc
GetCurrentProcess
GetDriveTypeW
WaitForSingleObjectEx
GetCurrentThreadId
GetProcAddress
GetModuleHandleW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
RaiseException
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateThread
CreateEventW
WideCharToMultiByte
TerminateProcess
GetCurrentProcessId
OutputDebugStringW
GetFileSize
SetUnhandledExceptionFilter
MultiByteToWideChar
lstrlenA
CreateFileW
ReadFile
lstrlenW
GetModuleFileNameW
GetTickCount
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
GetVersionExW
GetFullPathNameW
DeleteFileW
SetFileAttributesW
WriteFile
CopyFileW
CreateProcessW
FindClose
FindNextFileW
FindFirstFileW
RemoveDirectoryW
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentDirectoryW
Sleep
ReleaseSemaphore
CreateSemaphoreA
GetSystemTimeAsFileTime
WaitForMultipleObjectsEx
HeapReAlloc
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
ReleaseMutex
CreateMutexA
CreateDirectoryW
GetUserDefaultLCID
IsWow64Process
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetExitCodeProcess
GetModuleHandleA
LockResource
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryExA
GetModuleFileNameA
VerifyVersionInfoW
VerSetConditionMask
TlsGetValue
TlsSetValue
SetWaitableTimer
PostQueuedCompletionStatus
CreateIoCompletionPort
QueueUserAPC
TerminateThread
WaitForMultipleObjects
GetQueuedCompletionStatus
DuplicateHandle
SetLastError
InterlockedCompareExchange
GetSystemInfo
FormatMessageW
GetComputerNameA
SetConsoleTextAttribute
GetWindowsDirectoryA
GetStdHandle
GetConsoleScreenBufferInfo
OutputDebugStringA
GetTempPathA
lstrcpynW
GetLocaleInfoA
LoadLibraryA
GetTempFileNameA
GlobalSize
SystemTimeToFileTime
GetLocalTime
GetSystemTime
GetTimeZoneInformation
GetDateFormatW
FileTimeToSystemTime
GetThreadLocale
GetLocaleInfoW
MulDiv
ExitThread
GetVersionExA
FindResourceA
SetEndOfFile
SetFilePointer
UnmapViewOfFile
FlushViewOfFile
MapViewOfFile
CreateFileMappingA
GetCPInfo
SetThreadLocale
CompareStringW
GetFileAttributesW
LocalFileTimeToFileTime
GetFileInformationByHandle
GetNumberFormatW
GetCurrencyFormatW
GetStringTypeW
GetStringTypeA
SleepEx
VerifyVersionInfoA
GetSystemDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
ExpandEnvironmentStringsA
PeekNamedPipe
GetFileType
FormatMessageA
GetEnvironmentVariableW
GetConsoleMode
HeapSize
ReadConsoleA
ReadConsoleW
GetModuleHandleExW
GetVersion
DeleteFiber
SwitchToFiber
CreateFiber
LoadLibraryW
ConvertFiberToThread
ConvertThreadToFiber
SetConsoleCtrlHandler
UnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
VirtualQuery
HeapSetInformation
GetStartupInfoW
CreateProcessA
GetFileAttributesA
WriteConsoleW
GetConsoleCP
DeleteFileA
GetTimeFormatW
ExitProcess
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
FlushFileBuffers
EnumSystemLocalesA
IsValidLocale
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
CreatePipe
CreateFileA
GetFullPathNameA
SetEnvironmentVariableA
OpenEventA
ResetEvent
ResumeThread
CreateWaitableTimerA
DeviceIoControl
GetFileAttributesExW
AreFileApisANSI
GetStringTypeExA
GetStringTypeExW
LCMapStringA
IsDBCSLeadByteEx
FoldStringW
lstrcmpiW
SetConsoleMode

user32

RegisterClassExA
UnregisterClassA
RegisterClassW
UnregisterClassW
RegisterWindowMessageA
GetDC
GetMessageW
DispatchMessageW
PostQuitMessage
IntersectRect
SetWindowPlacement
PtInRect
SetWindowRgn
DrawTextA
DrawTextW
InvertRect
GetSysColorBrush
DrawEdge
DrawFrameControl
IsChild
GetActiveWindow
CreateWindowExA
GetKeyboardLayout
DestroyCaret
SetCaretPos
CreateCaret
SetScrollInfo
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
ScrollDC
ScrollWindowEx
RegisterClipboardFormatW
CloseClipboard
EmptyClipboard
OpenClipboard
EnumClipboardFormats
CountClipboardFormats
SetClipboardData
GetClipboardData
IsClipboardFormatAvailable
GetIconInfo
DrawIconEx
CreateIconFromResourceEx
SendMessageTimeoutA
AdjustWindowRectEx
MessageBeep
GetKeyState
GetCaretBlinkTime
GetUserObjectInformationW
GetProcessWindowStation
LoadStringW
GetWindowPlacement
InvalidateRect
KillTimer
WindowFromPoint
GetFocus
SetFocus
SetTimer
GetScrollInfo
SetCapture
GetCapture
ReleaseCapture
RegisterClassA
CreateCursor
UnhookWindowsHookEx
SystemParametersInfoA
GetDoubleClickTime
GetWindowLongA
GetWindowDC
GetSystemMetrics
InflateRect
OffsetRect
GetClassLongA
LoadStringA
DefWindowProcA
ReleaseDC
GetAsyncKeyState
GetDlgCtrlID
SendMessageA
EndPaint
BeginPaint
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
SetParent
EndDialog
DialogBoxIndirectParamW
DestroyMenu
GetCursorPos
AppendMenuW
CreatePopupMenu
RegisterWindowMessageW
SetWindowTextW
IsZoomed
DestroyWindow
DefWindowProcW
GetWindowLongW
SetWindowLongW
UpdateWindow
RegisterClassExW
GetClassInfoExW
SystemParametersInfoW
CreateWindowExW
LoadIconW
CharUpperW
SendMessageTimeoutW
PostMessageA
IsIconic
CharNextW
ExitWindowsEx
PostMessageW
GetWindowThreadProcessId
FindWindowW
GetWindowRect
ShowWindow
IsWindow
SetForegroundWindow
ScreenToClient
GetSystemMenu
EnableMenuItem
TrackPopupMenu
SetWindowLongA
IsWindowUnicode
PeekMessageA
MoveWindow
ClientToScreen
IsWindowEnabled
SetWindowsHookExA
CallNextHookEx
GetSysColor
LoadCursorFromFileA
DestroyIcon
SetCursor
MessageBoxW
PostThreadMessageW
SetWindowPos
GetParent
GetDesktopWindow
SendMessageW
GetMessageA
DispatchMessageA
TranslateMessage
LoadCursorA
NotifyWinEvent
FillRect

gdi32

CreateBitmap
SetPixel
GetPixel
SetBrushOrgEx
CreateHatchBrush
Rectangle
GetTextExtentPoint32W
GetTextExtentPoint32A
RectVisible
PatBlt
CreatePatternBrush
IntersectClipRect
GetTextExtentExPointW
GetCharacterPlacementW
SetBkMode
GetTextAlign
SetTextAlign
TextOutW
TextOutA
GetWindowOrgEx
GetTextMetricsA
CreatePen
CreateRoundRectRgn
GetFontLanguageInfo
GdiFlush
EnumFontFamiliesExA
CreateFontA
AddFontMemResourceEx
CreateDIBPatternBrushPt
CreateDIBSection
StretchDIBits
SetStretchBltMode
StretchBlt
GetDIBits
GetKerningPairsA
GetCurrentObject
GetGlyphOutlineW
CreateRectRgn
GetDeviceCaps
GetObjectA
SetTextColor
RestoreDC
CreateRectRgnIndirect
CombineRgn
ExcludeClipRect
CreateSolidBrush
SetWindowOrgEx
BitBlt
SetLayout
DeleteDC
CreateCompatibleDC
SetBkColor
GetClipBox
SaveDC
DeleteObject
LPtoDP
CreateCompatibleBitmap
SetViewportOrgEx
DPtoLP
SetViewportExtEx
GetViewportExtEx
SetWindowExtEx
GetWindowExtEx
SetMapMode
GetMapMode
GetStockObject
SelectObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW

shell32

Shell_NotifyIconW
SHGetPathFromIDListW
SHGetFileInfoW
ord74
DragQueryFileW
SHChangeNotify
SHGetSpecialFolderPathW
ShellExecuteW
SHBrowseForFolderW

ole32

CoTaskMemRealloc
CoGetClassObject
OleRun
CoCreateInstance
CoInitialize
CoRegisterClassObject
CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
StringFromGUID2
CoTaskMemFree
CoRevokeClassObject
CoCreateGuid
DoDragDrop
ReleaseStgMedium
RegisterDragDrop
RevokeDragDrop

oleaut32

SysStringLen
SysAllocStringLen
SysAllocString
RegisterTypeLi
GetErrorInfo
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
SysFreeString
UnRegisterTypeLi

msi

ord88
ord137
ord45
ord141
ord43
ord111
ord70
ord14
ord205
ord32
ord159
ord160
ord117
ord92
ord8

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shlwapi

UrlEscapeA
PathFileExistsW

psapi

GetProcessImageFileNameW

dbghelp

MiniDumpWriteDump

winhttp

WinHttpGetIEProxyConfigForCurrentUser

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData

Exports

Exports

??0?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@QAE@XZ
??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UtagRECT@@@23@XZ@51
??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ@51
??_B?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ@51
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtagRECT@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UtagRECT@@@23@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ
?get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@UtagRECT@@@23@A
?instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@A
?instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@A
?instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@A
?instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@A
?instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@A
?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@A
?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@A
?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UtagRECT@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@634@A

Sections

.text
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 189KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 407KB - Virtual size: 406KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72f3fb5ac60a390fd7303a4fcc6d422d

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

2c:63:9a:e7:a9:4e:2f:34:ff:39:2d:6c:4b:e2:24:12Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

f5:fe:b5:3b:1b:2f:1d:9a:56:93:08:23:01:0d:47:b1:dc:67:9e:91:c8:44:ae:24:c2:d3:47:b8:db:dc:87:a1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

crypt32

wldap32

wininet

oleacc

winmm

imm32

comctl32

urlmon

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

msi

version

shlwapi

psapi

dbghelp

winhttp

wintrust

Exports

Exports

Sections

.text Size: 5.4MB - Virtual size: 5.4MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 189KB - Virtual size: 285KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 2.8MB - Virtual size: 2.8MB

.reloc Size: 407KB - Virtual size: 406KB

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

2c:63:9a:e7:a9:4e:2f:34:ff:39:2d:6c:4b:e2:24:12
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

f5:fe:b5:3b:1b:2f:1d:9a:56:93:08:23:01:0d:47:b1:dc:67:9e:91:c8:44:ae:24:c2:d3:47:b8:db:dc:87:a1
Signer

.text
Size: 5.4MB - Virtual size: 5.4MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 189KB - Virtual size: 285KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

.reloc
Size: 407KB - Virtual size: 406KB