clion64-patched[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

clion64-patched.exe
Size

3.3MB
MD5

4469d750e2a72840a4680aad3c4091af
SHA1

86d755bfcff0c935239bdd61bd687aece1b1f1ab
SHA256

0d1456fcd79a1633372b3e29bb85b7fb7a109c9c2882174a14dab02baa022bd7
SHA512

28b0c5332d9755b6adc07443b9517d9fe61d27449319e8a1e5d182d97e1fc3daf7e2c4a5ca91ba26c70074621cd8c9d8b4f2afdbd1f079357152f5d4d972f78b
SSDEEP

49152:qQwYxv6+FOLwhd7v8xAlUc9frNOTldAj1SYDAifN:AMec9SyV

Score

1^/10

Malware Config

Signatures

Files

clion64-patched.exe
.dll windows:10 windows x64 arch:x64

86d63fcc59a250884fae714b325d53bf

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e3:24:c1:6a:2e:75:d1:d1:ee:8d:47:5c:14:1b:52:73:d8:be:71:19:10:e8:73:e1:e2:12:93:c3:32:5a:3c:fb
Signer

Actual PE Digest

e3:24:c1:6a:2e:75:d1:d1:ee:8d:47:5c:14:1b:52:73:d8:be:71:19:10:e8:73:e1:e2:12:93:c3:32:5a:3c:fb

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

combase.pdb

Imports

api-ms-win-crt-string-l1-1-0

wcscmp
strnlen
memset
wcsncmp
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__stricmp
_o__strnicmp
_o__ui64tow_s
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o__wcstoui64
_o__wtoi
_o__wtol
memmove
_o_free
_o_malloc
_o_qsort
_o_rand_s
_o_realloc
_o_toupper
_o_wcsncpy_s
_o_wcstok
_o_wcstoul
_o_wmemcpy_s
__C_specific_handler
wcsstr
wcsrchr
__std_terminate
__CxxFrameHandler3
_o__itow_s
_o__itoa_s
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
__CxxFrameHandler4
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
_local_unwind
memcmp
memcpy

rpcrt4

RpcErrorStartEnumeration
RpcErrorGetNextRecord
RpcErrorEndEnumeration
RpcBindingInqObject
RpcRaiseException
RpcAsyncInitializeHandle
RpcAsyncGetCallStatus
RpcServerTestCancel
RpcAsyncCancelCall
RpcServerSubscribeForNotification
RpcServerUnsubscribeForNotification
RpcMgmtSetCancelTimeout
RpcCancelThreadEx
I_RpcFreeBuffer
I_RpcNegotiateTransferSyntax
I_RpcGetBufferWithObject
I_RpcGetBuffer
I_RpcSendReceive
I_RpcFixTransferSyntax
I_RpcAsyncSetHandle
I_RpcSend
I_RpcReceive
I_RpcAsyncAbortCall
RpcStringBindingParseW
RpcServerInqBindingHandle
RpcBindingToStringBindingW
RpcServerInqCallAttributesW
RpcBindingInqAuthInfoExW
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcRevertToSelfEx
RpcImpersonateClient
I_RpcBindingInqCurrentModifiedId
I_RpcSetDCOMAppId
RpcBindingInqAuthClientW
I_RpcOpenClientProcess
RpcCertGeneratePrincipalNameW
RpcServerRegisterAuthInfoW
RpcImpersonateClient2
RpcServerRegisterIf3
RpcServerUnregisterIf
I_RpcExceptionFilter
UuidFromStringW
RpcServerUseProtseqEpW
RpcServerInqBindings
RpcBindingVectorFree
RpcServerUseProtseqExW
RpcServerUseProtseqEpExW
RpcServerUseProtseqW
RpcAsyncCompleteCall
I_RpcMgmtEnableDedicatedThreadPool
I_RpcSystemHandleTypeSpecificWork
I_RpcServerGetAssociationID
I_RpcServerSubscribeForDisconnectNotification2
I_RpcServerUnsubscribeForDisconnectNotification
I_RpcBindingInqTransportType
RpcErrorAddRecord
RpcMgmtSetComTimeout
RpcMgmtInqComTimeout
MesEncodeFixedBufferHandleCreate
MesHandleFree
I_RpcGetSystemHandle
MesBufferHandleReset
NdrMesTypeDecode3
NdrMesTypeEncode3
NdrGetUserMarshalInfo
NdrDllGetClassObject
NdrOleFree
NdrClientCall3
NdrOleAllocate
NdrStubCall3
RpcBindingServerFromClient
NdrStubCall2
NdrServerInitialize
I_RpcRequestMutex
I_RpcFree
I_RpcAllocate
I_RpcClearMutex
NdrClientInitializeNew
I_RpcBCacheAllocate
NdrGetTypeFlags
SimpleTypeAlignment
NdrClearOutParameters
NdrFullPointerXlatFree
NdrFullPointerXlatInit
NdrCorrelationFree
NdrCorrelationInitialize
SimpleTypeMemorySize
I_RpcBCacheFree
SimpleTypeBufferSize
NdrConvert2
NdrClientCall2
NdrAsyncServerCall
NdrServerCall2
RpcExceptionFilter
MesDecodeIncrementalHandleCreate
MesEncodeIncrementalHandleCreate
NdrMesTypeEncode2
NdrMesTypeDecode2
NdrMesTypeFree2
NdrMesTypeAlignSize2
I_RpcFreeSystemHandleCollection
RpcBindingBind
RpcBindingCreateW
I_RpcFreeSystemHandle
I_RpcMgmtQueryDedicatedThreadPool
I_RpcBindingInqLocalClientPID
I_RpcBindingSetPrivateOption
RpcBindingFree
I_RpcSetSystemHandle
RpcBindingSetOption
ord1000
RpcBindingUnbind
RpcBindingCopy
RpcSmDestroyClientContext
UuidCreate
RpcBindingFromStringBindingW
MesDecodeBufferHandleCreate

ntdll

RtlCaptureContext
RtlImageDirectoryEntryToData
RtlGetDeviceFamilyInfoEnum
RtlUpcaseUnicodeChar
RtlCopySid
RtlLengthSid
NtQueryInformationToken
RtlWow64IsWowGuestMachineSupported
RtlWow64GetEquivalentMachineCHPE
RtlSetThreadSubProcessTag
RtlDelete
RtlApplicationVerifierStop
RtlRealSuccessor
RtlCheckForOrphanedCriticalSections
NtQueryInformationThread
NtSetInformationObject
NtQueryObject
NtQueryVolumeInformationFile
RtlCaptureStackBackTrace
EtwEventWrite
RtlVirtualUnwind
RtlInitializeCriticalSectionAndSpinCount
RtlSetThreadWorkOnBehalfTicket
RtlFreeHeap
RtlGetAppContainerNamedObjectPath
NtQueryTimerResolution
NtTerminateProcess
RtlReportException
RtlInitializeConditionVariable
RtlCompareMemory
EtwEventSetInformation
RtlIsMultiSessionSku
EvtIntReportEventAndSourceAsync
NtQuerySystemInformation
RtlQueryPackageClaims
DbgPrint
EtwEventRegister
EtwEventUnregister
RtlCheckTokenCapability
RtlInitializeCriticalSection
RtlInitializeSidEx
RtlImageNtHeader
WinSqmSetDWORD
LdrStandardizeSystemPath
RtlDllShutdownInProgress
NtQuerySystemInformationEx
EtwEventWriteTransfer
NtQuerySecurityAttributesToken
NtQueryValueKey
NtOpenKey
RtlEqualUnicodeString
NtQueryKey
RtlNtStatusToDosError
NtCreateKey
NtLoadKeyEx
RtlNtStatusToDosErrorNoTeb
RtlAdjustPrivilege
NtApphelpCacheControl
NtUnloadKey2
RtlInitUnicodeString
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlFreeUnicodeString
RtlAppendUnicodeToString
RtlLoadString
NtQueryInformationProcess
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
EtwTraceMessage
RtlGetAppContainerSidType
RtlSidDominates
RtlWakeAllConditionVariable
RtlSleepConditionVariableCS
EtwRegisterTraceGuidsW
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
RtlDeleteCriticalSection
NtDeleteKey
RtlRealPredecessor
RtlInitUnicodeStringEx
RtlPcToFileHeader
RtlIsCriticalSectionLockedByThread
RtlLookupFunctionEntry
RtlAllocateHeap
EtwEventActivityIdControl
RtlDeleteNoSplay
RtlIsStateSeparationEnabled
RtlValidRelativeSecurityDescriptor
RtlSplay
RtlQueryPackageIdentity
wcschr
RtlGetThreadWorkOnBehalfTicket

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA
DebugBreak
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsAlloc
FlsFree

api-ms-win-core-fibers-l1-1-1

IsThreadAFiber

api-ms-win-core-file-l1-1-0

DeleteFileW
GetFileAttributesW
CreateFileW
CreateDirectoryW
SetFileAttributesW
GetFileSizeEx
RemoveDirectoryW
GetFinalPathNameByHandleW
FindClose
FindNextFileW
FindFirstFileW
SetFileInformationByHandle
GetFileType

api-ms-win-core-handle-l1-1-0

DuplicateHandle
SetHandleInformation
CloseHandle

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapSize
HeapValidate
HeapCompact
HeapCreate
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
GlobalAlloc
GlobalFree

api-ms-win-core-interlocked-l1-1-0

QueryDepthSList
InterlockedPopEntrySList
InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleExA
FreeLibrary
LoadLibraryExA
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
GetModuleHandleW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
MapViewOfFile
OpenFileMappingW
VirtualAlloc
VirtualProtect
UnmapViewOfFile
VirtualQuery

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW
ExpandEnvironmentStringsW
SearchPathW
GetEnvironmentStringsW
GetCommandLineW

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentProcessId
SetThreadStackGuarantee
GetProcessId
ProcessIdToSessionId
GetThreadPriority
CreateThread
SwitchToThread
GetCurrentThreadId
SetThreadToken
GetCurrentThread
TerminateProcess
OpenProcessToken
GetCurrentProcess

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
GetProcessMitigationPolicy
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegEnumValueW
RegGetValueW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyExW
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
RegNotifyChangeKeyValue
RegLoadMUIStringW
RegOpenCurrentUser
RegDeleteTreeW
RegSetValueExA
RegDeleteKeyExA
RegOpenUserClassesRoot
RegCreateKeyExA
RegGetValueA
RegLoadAppKeyW
RegOpenKeyExW
RegSaveKeyExW
RegSetKeySecurity
RegCloseKey

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW
CompareStringOrdinal

api-ms-win-core-synch-l1-1-0

OpenEventW
SetWaitableTimerEx
InitializeSRWLock
TryAcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
CreateWaitableTimerExW
InitializeCriticalSectionAndSpinCount
SleepEx
WaitForMultipleObjectsEx
OpenEventA
CreateEventW
SetEvent
ResetEvent

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
Sleep
InitOnceExecuteOnce
InitOnceBeginInitialize
WakeByAddressSingle
InitOnceComplete

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemInfo
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetTickCount
GetComputerNameExW
GetSystemTime
GetSystemTimeAsFileTime

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolTimer
CloseThreadpoolWork
SetEventWhenCallbackReturns
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWork
SubmitThreadpoolWork

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-wow64-l1-1-1

GetSystemWow64Directory2W
Wow64SetThreadDefaultGuestMachine

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
GetSidSubAuthority
RevertToSelf
SetSecurityDescriptorDacl
GetLengthSid
CopySid
GetSecurityDescriptorLength
GetSecurityDescriptorDacl
AccessCheckByType
ImpersonateAnonymousToken
MakeSelfRelativeSD
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
DuplicateToken
IsValidSecurityDescriptor
EqualSid
InitializeAcl
SetSecurityDescriptorRMControl
GetSidLengthRequired
InitializeSid
AddAccessAllowedAce
ImpersonateLoggedOnUser
CheckTokenMembership
IsValidSid
AccessCheck
GetAce
MapGenericMask
GetKernelObjectSecurity
PrivilegeCheck
SetSecurityDescriptorSacl
AddAce
InitializeSecurityDescriptor
GetTokenInformation
GetSecurityDescriptorRMControl
SetSecurityDescriptorOwner
ImpersonateSelf
SetSecurityDescriptorGroup
GetSidSubAuthorityCount
GetSecurityDescriptorSacl

api-ms-win-security-base-l1-2-0

GetAppContainerAce

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteEx
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
EventProviderEnabled

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock
GlobalSize
GlobalReAlloc

api-ms-win-core-privateprofile-l1-1-0

GetProfileStringW

api-ms-win-core-sidebyside-l1-1-0

CreateActCtxW
GetCurrentActCtx
FindActCtxSectionStringW
FindActCtxSectionGuid
ActivateActCtx
DeactivateActCtx
ReleaseActCtx
AddRefActCtx

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock
WerUnregisterMemoryBlock

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled
QuirkIsEnabledForProcess

kernelbase

GetSystemMetadataPathForPackage
OpenPackageInfoByFullNameForUser
GetStagedPackagePathByFullName2
OpenPackageInfoByFullNameForMachine
FindPackagesByPackageFamily
IsDeveloperModeEnabled
GetCurrentPackageInfo3
GetApplicationUserModelId
GetCurrentApplicationUserModelId
GetCurrentPackageFamilyName
ParseApplicationUserModelId
VerifyPackageFullName

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

api-ms-win-core-processsnapshot-l1-1-0

PssQuerySnapshot
PssDuplicateSnapshot
PssFreeSnapshot
PssCaptureSnapshot

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CLIPFORMAT_UserFree
CLIPFORMAT_UserFree64
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserMarshal64
CLIPFORMAT_UserSize
CLIPFORMAT_UserSize64
CLIPFORMAT_UserUnmarshal
CLIPFORMAT_UserUnmarshal64
CLSIDFromOle1Class
CLSIDFromProgID
CLSIDFromProgIDEx
CLSIDFromString
CStdAsyncStubBuffer2_Connect
CStdAsyncStubBuffer2_Disconnect
CStdAsyncStubBuffer2_Release
CStdAsyncStubBuffer_AddRef
CStdAsyncStubBuffer_Connect
CStdAsyncStubBuffer_Disconnect
CStdAsyncStubBuffer_Invoke
CStdAsyncStubBuffer_QueryInterface
CStdAsyncStubBuffer_Release
CStdStubBuffer2_Connect
CStdStubBuffer2_CountRefs
CStdStubBuffer2_Disconnect
CStdStubBuffer2_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
CleanupComl2StateInAllTls
CleanupOleStateInAllTls
CleanupTlsComl2State
CleanupTlsOleState
ClearCleanupFlag
CoAddRefServerProcess
CoAllowUnmarshalerCLSID
CoCancelCall
CoCopyProxy
CoCreateErrorInfo
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoCreateInstanceEx
CoCreateInstanceFromApp
CoCreateObjectInContext
CoDeactivateObject
CoDecodeProxy
CoDecrementMTAUsage
CoDisableCallCancellation
CoDisconnectContext
CoDisconnectObject
CoEnableCallCancellation
CoFileTimeNow
CoFreeUnusedLibraries
CoFreeUnusedLibrariesEx
CoGetActivationState
CoGetApartmentID
CoGetApartmentType
CoGetCallContext
CoGetCallState
CoGetCallerTID
CoGetCancelObject
CoGetClassObject
CoGetClassVersion
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCurrentProcess
CoGetDefaultContext
CoGetErrorInfo
CoGetInstanceFromFile
CoGetInstanceFromIStorage
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoGetMarshalSizeMax
CoGetModuleArchitecture
CoGetModuleType
CoGetObjectContext
CoGetPSClsid
CoGetProcessIdentifier
CoGetStandardMarshal
CoGetStdMarshalEx
CoGetSystemSecurityPermissions
CoGetTreatAsClass
CoImpersonateClient
CoIncrementMTAUsage
CoInitializeEx
CoInitializeSecurity
CoInitializeWOW
CoInvalidateRemoteMachineBindings
CoIsHandlerConnected
CoLockObjectExternal
CoMarshalHresult
CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoPopServiceDomain
CoPushServiceDomain
CoQueryAuthenticationServices
CoQueryClientBlanket
CoQueryProxyBlanket
CoReactivateObject
CoRegisterActivationFilter
CoRegisterClassObject
CoRegisterConsoleHandles
CoRegisterDeviceCatalog
CoRegisterInitializeSpy
CoRegisterMallocSpy
CoRegisterMessageFilter
CoRegisterPSClsid
CoRegisterRacActivationToken
CoRegisterSurrogate
CoRegisterSurrogateEx
CoReleaseMarshalData
CoReleaseServerProcess
CoResumeClassObjects
CoRetireServer
CoRevertToSelf
CoRevokeClassObject
CoRevokeConsoleHandles
CoRevokeDeviceCatalog
CoRevokeInitializeSpy
CoRevokeMallocSpy
CoRevokeRacActivationToken
CoSetCancelObject
CoSetErrorInfo
CoSetProxyBlanket
CoSuspendClassObjects
CoSwitchCallContext
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoTestCancel
CoUninitialize
CoUnloadingWOW
CoUnmarshalHresult
CoUnmarshalInterface
CoVrfCheckThreadState
CoVrfGetThreadState
CoVrfReleaseThreadState
CoWaitForMultipleHandles
CoWaitForMultipleObjects
CreateErrorInfo
CreateStreamOnHGlobal
DcomChannelSetHResult
DllDebugObjectRPCHook
DllGetActivationFactory
DllGetClassObject
EnableHookObject
FreePropVariantArray
FreePropVariantArrayWorker
GetCatalogHelper
GetErrorInfo
GetFuncDescs
GetHGlobalFromStream
GetHookInterface
GetRestrictedErrorInfo
HACCEL_UserFree
HACCEL_UserFree64
HACCEL_UserMarshal
HACCEL_UserMarshal64
HACCEL_UserSize
HACCEL_UserSize64
HACCEL_UserUnmarshal
HACCEL_UserUnmarshal64
HBITMAP_UserFree
HBITMAP_UserFree64
HBITMAP_UserMarshal
HBITMAP_UserMarshal64
HBITMAP_UserSize
HBITMAP_UserSize64
HBITMAP_UserUnmarshal
HBITMAP_UserUnmarshal64
HBRUSH_UserFree
HBRUSH_UserFree64
HBRUSH_UserMarshal
HBRUSH_UserMarshal64
HBRUSH_UserSize
HBRUSH_UserSize64
HBRUSH_UserUnmarshal
HBRUSH_UserUnmarshal64
HDC_UserFree
HDC_UserFree64
HDC_UserMarshal
HDC_UserMarshal64
HDC_UserSize
HDC_UserSize64
HDC_UserUnmarshal
HDC_UserUnmarshal64
HGLOBAL_UserFree
HGLOBAL_UserFree64
HGLOBAL_UserMarshal
HGLOBAL_UserMarshal64
HGLOBAL_UserSize
HGLOBAL_UserSize64
HGLOBAL_UserUnmarshal
HGLOBAL_UserUnmarshal64
HICON_UserFree
HICON_UserFree64
HICON_UserMarshal
HICON_UserMarshal64
HICON_UserSize
HICON_UserSize64
HICON_UserUnmarshal
HICON_UserUnmarshal64
HMENU_UserFree
HMENU_UserFree64
HMENU_UserMarshal
HMENU_UserMarshal64
HMENU_UserSize
HMENU_UserSize64
HMENU_UserUnmarshal
HMENU_UserUnmarshal64
HMONITOR_UserFree
HMONITOR_UserFree64
HMONITOR_UserMarshal
HMONITOR_UserMarshal64
HMONITOR_UserSize
HMONITOR_UserSize64
HMONITOR_UserUnmarshal
HMONITOR_UserUnmarshal64
HPALETTE_UserFree
HPALETTE_UserFree64
HPALETTE_UserMarshal
HPALETTE_UserMarshal64
HPALETTE_UserSize
HPALETTE_UserSize64
HPALETTE_UserUnmarshal
HPALETTE_UserUnmarshal64
HRGN_UserFree
HRGN_UserFree64
HRGN_UserMarshal
HRGN_UserMarshal64
HRGN_UserSize
HRGN_UserSize64
HRGN_UserUnmarshal
HRGN_UserUnmarshal64
HSTRING_UserFree
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserMarshal64
HSTRING_UserSize
HSTRING_UserSize64
HSTRING_UserUnmarshal
HSTRING_UserUnmarshal64
HWND_UserFree
HWND_UserFree64
HWND_UserMarshal
HWND_UserMarshal64
HWND_UserSize
HWND_UserSize64
HWND_UserUnmarshal
HWND_UserUnmarshal64
HkOleRegisterObject
IIDFromString
InternalAppInvokeExceptionFilter
InternalCAggIdRelease
InternalCAggIdSetHandler
InternalCCFreeUnused
InternalCCGetClassInformationForDde
InternalCCGetClassInformationFromKey
InternalCCSetDdeServerWindow
InternalCMLSendReceive
InternalCMLSendReceive2
InternalCStdIdentityGetIProxyManager
InternalCStdIdentityGetInternalUnk
InternalCStdIdentityUpdateFlags
InternalCallAsProxyExceptionFilter
InternalCallFrameExceptionFilter
InternalCallerIsAppContainer
InternalCanMakeOutCall
InternalCanMakeOutCall2
InternalCoIsSurrogateProcess
InternalCoRegisterDisconnectCallback
InternalCoRegisterSurrogatedObject
InternalCoStdMarshalObject
InternalCoUnregisterDisconnectCallback
InternalCompleteObjRef
InternalCreateCAggId
InternalCreateIdentityHandler
InternalDoATClassCreate
InternalFillLocalOXIDInfo
InternalFreeObjRef
InternalGetWindowPropInterface
InternalGetWindowPropInterface2
InternalIrotEnumRunning
InternalIrotEnumRunning2
InternalIrotGetObject
InternalIrotGetObject2
InternalIrotGetObject3
InternalIrotGetTimeOfLastChange
InternalIrotGetTimeOfLastChange2
InternalIrotIsRunning
InternalIrotIsRunning2
InternalIrotNoteChangeTime
InternalIrotRegister
InternalIrotRevoke
InternalIsApartmentInitialized
InternalIsProcessInitialized
InternalMarshalObjRef
InternalNotifyDDStartOrStop
InternalOleModalLoopBlockFn
InternalRegisterWindowPropInterface
InternalRegisterWindowPropInterface2
InternalReleaseMarshalObjRef
InternalRevokeWindowPropInterface
InternalSTAInvoke
InternalServerExceptionFilter
InternalSetAptCallCtrlOnTlsIfRequired
InternalSetOleThunkWowPtr
InternalStubInvoke
InternalTlsAllocData
InternalUnmarshalObjRef
IsErrorPropagationEnabled
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrExtStubInitialize
NdrOleDllGetClassObject
NdrOleInitializeExtension
NdrProxyForwardingFunction10
NdrProxyForwardingFunction11
NdrProxyForwardingFunction12
NdrProxyForwardingFunction13
NdrProxyForwardingFunction14
NdrProxyForwardingFunction15
NdrProxyForwardingFunction16
NdrProxyForwardingFunction17
NdrProxyForwardingFunction18
NdrProxyForwardingFunction19
NdrProxyForwardingFunction20
NdrProxyForwardingFunction21
NdrProxyForwardingFunction22
NdrProxyForwardingFunction23
NdrProxyForwardingFunction24
NdrProxyForwardingFunction25
NdrProxyForwardingFunction26
NdrProxyForwardingFunction27
NdrProxyForwardingFunction28
NdrProxyForwardingFunction29
NdrProxyForwardingFunction3
NdrProxyForwardingFunction30
NdrProxyForwardingFunction31
NdrProxyForwardingFunction32
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction6
NdrProxyForwardingFunction7
NdrProxyForwardingFunction8
NdrProxyForwardingFunction9
NdrpFindInterface
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient17
ObjectStublessClient18
ObjectStublessClient19
ObjectStublessClient20
ObjectStublessClient21
ObjectStublessClient22
ObjectStublessClient23
ObjectStublessClient24
ObjectStublessClient25
ObjectStublessClient26
ObjectStublessClient27
ObjectStublessClient28
ObjectStublessClient29
ObjectStublessClient3
ObjectStublessClient30
ObjectStublessClient31
ObjectStublessClient32
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient9
ProgIDFromCLSID
PropVariantClear
PropVariantCopy
ReleaseFuncDescs
RoActivateInstance
RoCaptureErrorContext
RoClearError
RoFailFastWithErrorContext
RoFailFastWithErrorContextInternal
RoFailFastWithErrorContextInternal2
RoFreeParameterizedTypeExtra
RoGetActivatableClassRegistration
RoGetActivationFactory
RoGetAgileReference
RoGetApartmentIdentifier
RoGetErrorReportingFlags
RoGetMatchingRestrictedErrorInfo
RoGetParameterizedTypeInstanceIID
RoGetServerActivatableClasses
RoInitialize
RoInspectCapturedStackBackTrace
RoInspectThreadErrorInfo
RoOriginateError
RoOriginateErrorW
RoOriginateLanguageException
RoParameterizedTypeExtraGetTypeSignature
RoRegisterActivationFactories
RoRegisterForApartmentShutdown
RoReportCapabilityCheckFailure
RoReportFailedDelegate
RoReportUnhandledError
RoResolveRestrictedErrorInfoReference
RoRevokeActivationFactories
RoSetErrorReportingFlags
RoTransformError
RoTransformErrorW
RoUninitialize
RoUnregisterForApartmentShutdown
SetCleanupFlag
SetErrorInfo
SetRestrictedErrorInfo
StringFromCLSID
StringFromGUID2
StringFromIID
UpdateDCOMSettings
UpdateProcessTracing
WdtpInterfacePointer_UserFree
WdtpInterfacePointer_UserFree64
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserMarshal64
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserSize64
WdtpInterfacePointer_UserUnmarshal
WdtpInterfacePointer_UserUnmarshal64
WindowsCompareStringOrdinal
WindowsConcatString
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsDuplicateString
WindowsGetStringLen
WindowsGetStringRawBuffer
WindowsInspectString
WindowsInspectString2
WindowsIsStringEmpty
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsReplaceString
WindowsStringHasEmbeddedNull
WindowsSubstring
WindowsSubstringWithSpecifiedLength
WindowsTrimStringEnd
WindowsTrimStringStart

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.proxy
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 789KB - Virtual size: 789KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86d63fcc59a250884fae714b325d53bf

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

e3:24:c1:6a:2e:75:d1:d1:ee:8d:47:5c:14:1b:52:73:d8:be:71:19:10:e8:73:e1:e2:12:93:c3:32:5a:3c:fbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

rpcrt4

ntdll

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-quirks-l1-1-0

kernelbase

api-ms-win-core-path-l1-1-0

api-ms-win-core-processsnapshot-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.proxy Size: 20KB - Virtual size: 19KB

.rdata Size: 789KB - Virtual size: 789KB

.data Size: 10KB - Virtual size: 23KB

.pdata Size: 171KB - Virtual size: 170KB

.didat Size: 2KB - Virtual size: 1KB

.rsrc Size: 79KB - Virtual size: 79KB

.reloc Size: 54KB - Virtual size: 54KB

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

e3:24:c1:6a:2e:75:d1:d1:ee:8d:47:5c:14:1b:52:73:d8:be:71:19:10:e8:73:e1:e2:12:93:c3:32:5a:3c:fb
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.proxy
Size: 20KB - Virtual size: 19KB

.rdata
Size: 789KB - Virtual size: 789KB

.data
Size: 10KB - Virtual size: 23KB

.pdata
Size: 171KB - Virtual size: 170KB

.didat
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 79KB - Virtual size: 79KB

.reloc
Size: 54KB - Virtual size: 54KB