9adc313b64a286f9d056b7efabda5565e2f3d8010d5432975899af6bbe71a0ea[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

9adc313b64a286f9d056b7efabda5565e2f3d8010d5432975899af6bbe71a0ea.zip
Size

137KB
MD5

6d0f871a33c202037c67a957c82bc6ba
SHA1

bbdcbc8edfb8e5445e1644592d7d40da8e71c590
SHA256

9adc313b64a286f9d056b7efabda5565e2f3d8010d5432975899af6bbe71a0ea
SHA512

4e502d24dd8831044393087576170a03e20f0b5f1318939630137e0144d46fb3e2f4fa0ed947ac51e19b7d9dd9d893d9c702c84fbf2229e4a16ecb2c0a0f0a79
SSDEEP

3072:HeaBdSKtLRDnsOlWMTSKv2f0dd7WAVkGuaS3mlOMRjBqW:fdptVDhQK/d7bkGuaS3mlpBqW

Score

1^/10

Malware Config

Signatures

Files

9adc313b64a286f9d056b7efabda5565e2f3d8010d5432975899af6bbe71a0ea.zip
.zip

Password: infected
d7fafabbb381c34185ad30f0d5337ec8072d0705e0e9fb1d91e7358ed934fff3.exe
.dll regsvr32 windows:4 windows x86 arch:x86

ace13c17e53d07ea38e285dca185c74f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

57:55:c3:bf:a9:58:e2:9e:f9:dc:a3:fb:a9:fc:02:d4
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

30/07/2015, 00:00

Not After

29/07/2018, 23:59

Subject

CN=Fortinet Technologies (Canada) Inc.,O=Fortinet Technologies (Canada) Inc.,L=Burnaby,ST=British Columbia,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8e:f8:14:ad:4c:f7:dd:d7:a4:71:54:cf:b3:9d:6e:dc:75:9d:1c:e6:95:68:05:56:5f:94:67:b1:5c:b0:ab:cc
Signer

Actual PE Digest

8e:f8:14:ad:4c:f7:dd:d7:a4:71:54:cf:b3:9d:6e:dc:75:9d:1c:e6:95:68:05:56:5f:94:67:b1:5c:b0:ab:cc

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

CryptDeriveKey
CryptImportKey
AllocateAndInitializeSid
CryptGetHashParam
SetSecurityDescriptorOwner
IsValidSid
GetSecurityDescriptorOwner
RegDeleteKeyW
ConvertSecurityDescriptorToStringSecurityDescriptorW
DestroyPrivateObjectSecurity
RegLoadKeyW
CryptExportKey
CryptDecrypt
GetSidLengthRequired
CopySid
ChangeServiceConfigW
GetSecurityDescriptorGroup
BuildExplicitAccessWithNameW
DuplicateTokenEx
EqualSid
CryptGenRandom
IsTextUnicode
GetSecurityDescriptorControl
DeregisterEventSource
QueryTraceW
QueryServiceConfig2W
StopTraceW
RegEnumKeyExA
CryptHashSessionKey
StartServiceW
CryptSetKeyParam
RegOpenKeyExW
RegisterEventSourceW
LsaQueryInformationPolicy
CheckTokenMembership
GetUserNameW
GetSecurityDescriptorLength
ImpersonateLoggedOnUser
RegCreateKeyExA
RegCloseKey
CreatePrivateObjectSecurityEx
InitializeSid
RegNotifyChangeKeyValue
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptReleaseContext
GetSecurityDescriptorDacl
ReportEventA
CreateWellKnownSid
CreateProcessAsUserW
LsaClose
CryptGetProvParam
GetTokenInformation
GetSecurityDescriptorSacl
RegQueryValueW
LookupPrivilegeDisplayNameW
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityInfo
CryptDestroyKey
ChangeServiceConfig2W
OpenServiceW
RegFlushKey
CryptDestroyHash
GetSidIdentifierAuthority
SetNamedSecurityInfoW
OpenThreadToken
ConvertSidToStringSidW
RegQueryValueExA
InitializeSecurityDescriptor
CryptEncrypt
GetNamedSecurityInfoW
OpenProcessToken
SetSecurityDescriptorSacl
GetLengthSid
SetSecurityDescriptorDacl
GetTraceLoggerHandle
CryptDuplicateHash
CryptSetProvParam
StartServiceCtrlDispatcherW
ReportEventW
AdjustTokenPrivileges
CryptDuplicateKey
MapGenericMask
CreateServiceW
GetTraceEnableFlags
CryptCreateHash
RegConnectRegistryW
EnableTrace
AddAccessAllowedAce
RegisterServiceCtrlHandlerW
LookupPrivilegeValueW
RegCreateKeyExW
AddAce
QueryServiceStatusEx
InitializeAcl
LookupAccountNameW
CryptGetKeyParam
SetFileSecurityW
TraceEvent
RegSetValueExW
RegOpenKeyA
RegQueryInfoKeyW
RegDeleteValueA
RegOpenKeyW
RegDeleteKeyA
LsaOpenPolicy
GetAclInformation
RegCreateKeyA
StartTraceW
UnregisterTraceGuids
OpenSCManagerW
RegDeleteValueW
RegSetKeySecurity
LsaFreeMemory
GetSidSubAuthorityCount
DeleteService
RegUnLoadKeyW
ControlService
CryptVerifySignatureW
FreeSid
TraceMessage
RegSetValueW
SetServiceStatus
GetSidSubAuthority
RegEnumKeyW
CryptAcquireContextW
QueryServiceConfigW
IsWellKnownSid
CryptSetHashParam
IsValidSecurityDescriptor
RegisterTraceGuidsW
FlushTraceW
RegQueryValueExW
MakeSelfRelativeSD
GetAce
RegCreateKeyW
RegOpenKeyExA
RevertToSelf
CryptHashData
SetThreadToken
RegEnumKeyExW
RegEnumValueW
GetSecurityInfo
QueryServiceStatus
LookupAccountSidW
SetEntriesInAclW
GetTraceEnableLevel
CloseServiceHandle
CryptGenKey
GetFileSecurityW
RegQueryInfoKeyA
RegEnumKeyA
RegSetValueExA

certmgr

DllUnregisterServer

cfgmgr32

CM_Get_DevNode_Status

clusapi

GetNodeClusterState

comctl32

CreatePropertySheetPageW

comdlg32

GetFileTitleA
GetFileTitleW

comsvcs

CosGetCallContext

crypt32

CryptSIPLoad
CertCreateCertificateContext
CertFindExtension
CryptDecodeObject
CertFreeCertificateContext
CryptSIPRetrieveSubjectGuid

dnsapi

DnsValidateName_A

dsuiext

DllUnregisterServer

gdi32

LineTo
CreateFontIndirectA
EnumFontFamiliesA
PolyBezier
GetCharWidthA
GetGlyphOutlineA
GetRegionData
ExtTextOutW
GetTextMetricsA
GetSystemPaletteEntries
OffsetRgn
SetPixel
DeleteObject
SetTextJustification
Polygon
GetOutlineTextMetricsA
SetMapMode
SetPolyFillMode
CreatePalette
CreateFontA
MoveToEx
SetPaletteEntries
RealizePalette
PtInRegion
CreateDIBSection
PatBlt
GetDeviceCaps
EnumFontFamiliesExA
GetCharacterPlacementA
GetObjectW
GetDIBits
GetGlyphOutlineW
GetTextMetricsW
CloseMetaFile
GetTextExtentPoint32A
GetPixel
Ellipse
CreateCompatibleBitmap
GetCharABCWidthsA
GetTextExtentPoint32W
GetRgnBox
SetViewportOrgEx
TranslateCharsetInfo
SelectClipRgn
SelectObject
CreateRectRgn
GetTextAlign
FillRgn
RestoreDC
CreatePen
GetCharacterPlacementW
Rectangle
SetDIBits
CreateSolidBrush
CreateHatchBrush
CreateDCW
SetTextColor
SetBkColor
SetBrushOrgEx
Arc
TextOutA
SelectPalette
BitBlt
SetTextAlign
CombineRgn
SetROP2
GetClipBox
LPtoDP
CreateFontIndirectW
UnrealizeObject
CreateCompatibleDC
CreateBitmap
CreateDIBitmap
Chord
SetBkMode
GetFontLanguageInfo
SetArcDirection
GetSystemPaletteUse
ExtTextOutA
StretchDIBits
SetTextCharacterExtra
SetRectRgn
GetCurrentObject
DeleteMetaFile
SetWindowExtEx
RoundRect
GetObjectA
CreateRectRgnIndirect
SetBitmapBits
SaveDC
CreateMetaFileA
GetTextExtentPointA
GetStockObject
SetDIBColorTable
SetWindowOrgEx
Pie
CreatePatternBrush
CreateBrushIndirect
DeleteDC
CreateDCA

iassvcs

IASVariantChangeType

imm32

ImmEnumRegisterWordA
ImmEnumRegisterWordW

kernel32

CreateThread
IsBadCodePtr
ReadFile
SetLastError
HeapCompact
GetThreadContext
IsValidCodePage
FindResourceExA
HeapFree
MapViewOfFile
GetEnvironmentStrings
ChangeTimerQueueTimer
_llseek
GetStringTypeW
OpenMutexW
CopyFileW
GetCurrentDirectoryW
SetEvent
GetConsoleWindow
FlushFileBuffers
LockResource
FindNextFileA
LCMapStringA
TryEnterCriticalSection
CreateProcessA
ReleaseSemaphore
CreateDirectoryA
GetTempFileNameW
QueryPerformanceFrequency
GlobalUnlock
DeleteCriticalSection
SetErrorMode
GlobalLock
ExitThread
GetDiskFreeSpaceExW
GetSystemTimeAdjustment
CreateFileMappingA
TlsFree
HeapCreate
OutputDebugStringA
lstrcatW
InitAtomTable
GetProcAddress
SystemTimeToFileTime
LeaveCriticalSection
GetLocaleInfoA
GlobalAddAtomA
LocalFree
GetTimeFormatA
GetShortPathNameW
CreateSemaphoreW
GetUserDefaultLCID
WritePrivateProfileStringW
WaitForMultipleObjectsEx
LockFileEx
TerminateProcess
CreateFileMappingW
SetFileAttributesW
GetModuleFileNameA
LocalReAlloc
GetQueuedCompletionStatus
GetDriveTypeW
GetCurrentProcess
HeapSize
WideCharToMultiByte
DeviceIoControl
MoveFileW
lstrcmpW
GetExitCodeThread
GetConsoleScreenBufferInfo
SetEndOfFile
GetUserDefaultUILanguage
ResumeThread
RemoveDirectoryW
FindNextFileW
GlobalReAlloc
PostQueuedCompletionStatus
SetLocalTime
GetModuleFileNameW
GetNumberOfConsoleInputEvents
FindResourceW
GetSystemInfo
lstrcpynW
SetEnvironmentVariableW
DebugBreak
GetDateFormatW
GetPrivateProfileSectionNamesW
GetVersionExW
IsValidLocale
GetThreadLocale
SetCurrentDirectoryA
SetThreadPriority
lstrcmpiA
VirtualQuery
GetStringTypeA
ExitProcess
GetCurrentThreadId
GetSystemTime
GetStartupInfoW
GetLastError
GetEnvironmentVariableA
LoadResource
IsDBCSLeadByteEx
Sleep
FindResourceExW
GetLongPathNameW
TlsGetValue
CreateProcessW
HeapAlloc
DeactivateActCtx
GetSystemWindowsDirectoryA
GetConsoleCP
CreateIoCompletionPort
CreatePipe
FileTimeToSystemTime
SetThreadLocale
GetVersionExA
GlobalHandle
TlsSetValue
GetUserDefaultLangID
GetNumberFormatW
lstrlenW
UnlockFileEx
InitializeCriticalSectionAndSpinCount
HeapReAlloc
GetModuleHandleA
LockFile
VerSetConditionMask
GetCurrentDirectoryA
HeapDestroy
GetFullPathNameW
GetDateFormatA
OpenEventA
InterlockedCompareExchange
OutputDebugStringW
AddAtomA
GetEnvironmentVariableW
SetFilePointerEx
GlobalSize
lstrcpyA
DelayLoadFailureHook
FindResourceA
CreateSemaphoreA
VirtualProtect
UnmapViewOfFile
GetEnvironmentStringsW
GetComputerNameA
GetTimeFormatW
_lopen
OpenMutexA
lstrcatA
_lclose
GetConsoleOutputCP
SetFileAttributesA
lstrcmpA
GetExitCodeProcess
lstrcpyW
FindFirstFileA
GetCommandLineW
SetStdHandle
GetDiskFreeSpaceA
UnlockFile
SizeofResource
IsBadReadPtr
CreateMutexW
GetStdHandle
LoadLibraryExA
SetConsoleCtrlHandler
LocalFileTimeToFileTime
IsBadStringPtrW
SetCurrentDirectoryW
GetStringTypeExW
FreeEnvironmentStringsA
DeleteFileA
WinExec
AllocConsole
lstrcmpiW
GetConsoleMode
InterlockedExchangeAdd
LoadLibraryExW
EnumSystemLocalesA
MoveFileA
PeekConsoleInputA
FileTimeToLocalFileTime
VerifyVersionInfoW
CompareFileTime
DeleteFileW
GetPrivateProfileIntW
_lread
GetACP
WriteConsoleW
FreeEnvironmentStringsW
GetModuleHandleW
GetTimeZoneInformation
GlobalMemoryStatus
GetSystemDirectoryW
_lwrite
ReadConsoleA
lstrcpynA
VirtualProtectEx
WaitForMultipleObjects
GetFullPathNameA
DeleteTimerQueueTimer
CreateFileW
ActivateActCtx
LoadLibraryA
FormatMessageW
CreateTimerQueueTimer
WritePrivateProfileStructW
GetVersion
ReadConsoleInputW
GetProcessHeap
IsBadWritePtr
MultiByteToWideChar
CreateDirectoryW
GlobalAlloc
GetFileAttributesW
GlobalDeleteAtom
LCMapStringW
WritePrivateProfileSectionW
WaitForSingleObjectEx
RtlUnwind
GetLocaleInfoW
GetCPInfo
WaitForSingleObject
FindFirstFileW
MulDiv
FormatMessageA
InterlockedIncrement
FlushInstructionCache
FreeResource
VirtualAlloc
FlushViewOfFile
GetTempPathW
OpenEventW
GetSystemWow64DirectoryW
RaiseException
InitializeCriticalSection
SetThreadAffinityMask
GetFileTime
PeekNamedPipe
CloseHandle
WriteConsoleA
GetSystemDirectoryA
VirtualFree
ExpandEnvironmentStringsA
SetFileTime
SetFilePointer
WriteFile
DuplicateHandle
ResetEvent
SetPriorityClass
GetFileAttributesA
GetTempPathA
CompareStringW
GetFileSize
SetEnvironmentVariableA
DeleteAtom
QueueUserWorkItem
GetWindowsDirectoryW
VirtualQueryEx
GetCommandLineA
_lcreat
SwitchToThread
ReadConsoleW
FindAtomA
FatalAppExitA
GetProcessAffinityMask
ExpandEnvironmentStringsW
ReleaseMutex
LoadLibraryW
CreateEventA
GetOEMCP
SetHandleCount
CompareStringA
SetConsoleMode
GetPrivateProfileStringW
Beep
GetCurrentThread
ReadConsoleInputA
RemoveDirectoryA
CreateEventW
SleepEx
HeapWalk
GetCurrentProcessId
IsDBCSLeadByte
InterlockedExchange
GetBinaryTypeA
PulseEvent
TlsAlloc
OpenFileMappingA
GetLocalTime
TerminateThread
lstrlenA
GetSystemDefaultLangID
GetStartupInfoA
GetTempFileNameA
EnterCriticalSection
CreateMutexA
InterlockedDecrement
CreateActCtxW
GetSystemWindowsDirectoryW
SetUnhandledExceptionFilter
GetPrivateProfileStructW
GetComputerNameW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
GetPrivateProfileSectionW
LocalAlloc
SuspendThread
UnhandledExceptionFilter
CreateFileA
FreeLibrary
FindClose
GlobalFree
IsProcessorFeaturePresent
HeapValidate
OpenProcess
DosDateTimeToFileTime
GetFileType
GetTickCount
IsDebuggerPresent
GetDriveTypeA
ReleaseActCtx
MoveFileExW

licmgr10

DllUnregisterServer

mscat32

CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext

mscms

InstallColorProfileW
GetColorDirectoryW
AssociateColorProfileWithDeviceW

msports

SerialPortPropPageProvider

msvcp60

?_Xlen@std@@YAXXZ
?nothrow@std@@3Unothrow_t@1@B
?_Xran@std@@YAXXZ

msvcrt

mktime
modf
strlen
wcsrchr
sqrt
_ultoa
wcstok
_amsg_exit
_fpclass
_mbsnbcpy
mbstowcs
_mbsicmp
_HUGE
wcsncmp
_wsplitpath
iswctype
sscanf
iswspace
_clearfp
memcmp
_onexit
memset
wcsstr
_mbstok
_finite
_unlock
wcscmp
_strtime
iswpunct
fread
atoi
towlower
_wcsicmp
_endthreadex
__dllonexit
_control87
strchr
isspace
_vsnwprintf
realloc
_cexit
_itow
memcpy
_vsnprintf
_aligned_malloc
setlocale
free
localtime
_wmakepath
_wtol
bsearch
_snwprintf
wcstombs
atol
toupper
strrchr
_strdup
wcstol
iswascii
_snprintf
wcstod
__CxxFrameHandler
__getmainargs
strncmp
qsort
isalnum
_aligned_free
_wfindnext
_wcsupr
_controlfp
_tempnam
_fdopen
_ltow
_wtoi
floor
iswdigit
_wfopen
_ftime
calloc
_lock
_strdate
vswprintf
_XcptFilter
wcschr
_strnicmp
memmove
_CxxThrowException
strncpy
_ultow
fflush
longjmp
ceil
_beginthread
cos
printf
_errno
fclose
_mbsncpy
malloc
wcscat
wcscpy
wcsspn
frexp
_mbscpy
_stricmp
_callnewh
strcmp
_findclose
time
__set_app_type
_wcslwr
_wtoi64
__RTDynamicCast
isdigit
_wfindfirst
swprintf
_wchdir
__setusermatherr
ldexp
strstr
isxdigit
wcsncpy
_exit
_iob
iswalpha
_wcsnicmp
sprintf
iswupper
sin
wcstoul
exit
srand
_mbslen
setvbuf
_purecall
wcsncat
__initenv
swscanf
fprintf
tolower
wcslen
isalpha
fopen
_setmbcp
_initterm
rand
?terminate@@YAXXZ
atof
strncat
_open_osfhandle
_isnan

netapi32

NetShareDel
NetLocalGroupAddMembers
NetLocalGroupDelMembers
NetApiBufferFree
NetUserSetInfo
NetUserDel
NetUserGetLocalGroups
DsGetDcNameW

ntdll

NtCreatePort
NtSetInformationFile
NtSetValueKey
NtFlushVirtualMemory
NtOpenObjectAuditAlarm
NtSetInformationThread
_vsnprintf
NtQueryValueKey
RtlDeleteSecurityObject
RtlGetNtVersionNumbers
towlower
RtlEnterCriticalSection
wcsrchr
RtlFreeHeap
_wcsnicmp
NtUnmapViewOfSection
RtlInitializeCriticalSection
RtlAcquireResourceShared
NtCreateSection
NtReadFile
RtlCopyUnicodeString
_wcsicmp
NtCreateFile
RtlAcquireResourceExclusive
NtReplyWaitReceivePort
NtExtendSection
wcsncmp
NtPrivilegeObjectAuditAlarm
_ltow
RtlAreAllAccessesGranted
NtOpenProcessToken
NtWriteFile
RtlDeregisterWait
RtlDosPathNameToNtPathName_U
NtQuerySystemTime
RtlAllocateAndInitializeSid
NtClose
RtlCompareMemory
RtlCreateHeap
NtAccessCheck
NtOpenKey
RtlFreeAnsiString
RtlUnwind
RtlReleaseResource
RtlFreeUnicodeString
RtlFreeSid
NtCreateEvent
RtlInitializeResource
RtlNtStatusToDosError
NtOpenFile
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
NlsMbCodePageTag
RtlLeaveCriticalSection
NtAcceptConnectPort
atol
RtlRaiseStatus
NtAdjustPrivilegesToken
NtDuplicateToken
NtQueryInformationFile
RtlExpandEnvironmentStrings_U
RtlDeleteResource
RtlInitUnicodeString
NtOpenProcess
NtEnumerateKey
RtlCreateUserSecurityObject
RtlxUnicodeStringToAnsiSize
RtlDeleteCriticalSection
RtlTimeToSecondsSince1970
RtlLengthSid
NtPrivilegeCheck
RtlConvertSidToUnicodeString
RtlRegisterWait
NtQueryAttributesFile
NtDuplicateObject
_vsnwprintf
NtPulseEvent
NtMapViewOfSection
NtOpenThreadToken
RtlAllocateHeap
NtNotifyChangeKey
RtlQueueWorkItem
NtCloseObjectAuditAlarm
NtCompleteConnectPort
RtlAdjustPrivilege

occache

FindFirstControl

odbccu32

SQLSetDescRec

ole32

StringFromIID
OleSaveToStream
CoTaskMemFree
CoCreateInstance
PropVariantClear
StringFromGUID2
CoGetMalloc
OleRegEnumVerbs
ComPs_NdrDllUnregisterProxy
StringFromCLSID
CLSIDFromProgID
CreateDataAdviseHolder
OleRegGetMiscStatus
ComPs_NdrDllGetClassObject
CoInitializeEx
CoTaskMemAlloc
CoGetInterceptor
CreateStreamOnHGlobal
StgOpenStorage
CoTaskMemRealloc
CoGetClassObject
CoCreateFreeThreadedMarshaler
CreateBindCtx
WriteClassStm
CoImpersonateClient
CreateOleAdviseHolder
StgOpenStorageEx
ReleaseStgMedium
CoRevertToSelf
ComPs_NdrDllRegisterProxy
CoCreateGuid
CoSetProxyBlanket
CLSIDFromString
CoDisconnectObject
OleRegGetUserType
CoUninitialize
CoInitializeSecurity
CoInitialize

olesvr32

TerminateClients

pdh

PdhParseCounterPathW
PdhBrowseCountersW
PdhTranslateLocaleCounterW
PdhTranslate009CounterW

psapi

GetModuleFileNameExW

rpcrt4

UuidCreateSequential
I_RpcBindingInqLocalClientPID
I_RpcMapWin32Status
IUnknown_AddRef_Proxy
RpcStringBindingParseW
RpcImpersonateClient
UuidCompare
CStdStubBuffer_QueryInterface
NdrDllGetClassObject
RpcBindingFree
RpcBindingToStringBindingW
UuidCreate
NdrServerCall2
UuidCreateNil
CStdStubBuffer_Connect
RpcStringFreeA
NdrOleFree
NdrDllRegisterProxy
NdrDllCanUnloadNow
UuidHash
CStdStubBuffer_AddRef
RpcStringFreeW
CStdStubBuffer_DebugServerRelease
NdrCStdStubBuffer_Release
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
RpcBindingServerFromClient
RpcServerRegisterIfEx
CStdStubBuffer_IsIIDSupported
RpcServerUseProtseqEpW
CStdStubBuffer_CountRefs
IUnknown_QueryInterface_Proxy
NdrDllUnregisterProxy
UuidFromStringA
RpcRevertToSelf
NdrOleAllocate
CStdStubBuffer_Invoke
UuidToStringA
I_RpcBindingIsClientLocal
UuidToStringW
CStdStubBuffer_Disconnect

rtutils

TraceRegisterExW
TraceVprintfExA
TraceDeregisterW

scecli

SceSvcGetInformationTemplate
SceGetScpProfileDescription
SceRollbackTransaction
SceCopyBaseProfile
SceFreeProfileMemory
SceUpdateSecurityProfile
SceAddToNameStatusList
SceAnalyzeSystem
SceOpenProfile
SceAddToNameList
SceAppendSecurityProfileInfo
SceCompareSecurityDescriptors
SceGetServerProductType
SceFreeMemory
SceCommitTransaction
SceSvcUpdateInfo
SceSvcSetInformationTemplate
SceUpdateObjectInfo
SceCreateDirectory
SceSvcQueryInfo
SceCloseProfile
SceConfigureSystem
SceWriteSecurityProfileInfo
SceStartTransaction
SceEnumerateServices
SceCompareNameList
SceGetObjectSecurity
SceSetupGenerateTemplate
SceGetSecurityProfileInfo
SceSvcFree
SceLookupPrivRightName
SceSvcConvertTextToSD
SceGetObjectChildren

secur32

LsaRegisterPolicyChangeNotification
DeleteSecurityPackageA

setupapi

SetupTermDefaultQueueCallback
SetupDiGetDeviceInfoListDetailW
SetupCommitFileQueueW
SetupOpenAppendInfFileW
SetupDiCreateDevRegKeyW
SetupDiCreateDeviceInterfaceW
SetupOpenInfFileW
SetupInstallFromInfSectionW
SetupCloseInfFile
SetupInstallServicesFromInfSectionW
SetupGetMultiSzFieldW
SetupDiGetDeviceInterfaceDetailW
SetupGetIntField
SetupDiGetWizardPage
SetupDiSetSelectedDevice
SetupDiOpenDeviceInterfaceRegKey
SetupQueryInfFileInformationW
SetupOpenFileQueue
SetupDiGetDriverInstallParamsW
SetupQueryInfVersionInformationW
SetupDiCreateDeviceInfoList
SetupDiDeleteDeviceInterfaceRegKey
SetupFindNextMatchLineW
SetupFindFirstLineW
SetupDiGetClassDevsW
SetupDiCreateDeviceInfoW
SetupDiClassGuidsFromNameW
SetupDiGetClassInstallParamsW
SetupDiEnumDriverInfoW
SetupInitDefaultQueueCallbackEx
SetupDiRemoveDeviceInterface
SetupSetDirectoryIdW
SetupDiDeleteDevRegKey
SetupDiGetSelectedDevice
SetupDiGetDeviceInstallParamsW
SetupDiEnumDeviceInterfaces
SetupDiEnumDeviceInfo
SetupDiGetDriverInfoDetailW
SetupDiOpenClassRegKeyExW
SetupQueryInfOriginalFileInformationW
SetupInitDefaultQueueCallback
SetupDiGetActualSectionToInstallW
SetupDiRegisterDeviceInfo
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiGetSelectedDriverW
SetupCloseFileQueue
SetupDiOpenDevRegKey
SetupSetPlatformPathOverrideW
SetupDiCallClassInstaller
SetupGetLineByIndexW
CM_Get_Device_ID_ExW
SetupInstallFilesFromInfSectionW
SetupScanFileQueueW
SetupFindNextLine
SetupGetLineCountW
SetupGetInfInformationW
SetupDiSetDriverInstallParamsW
SetupDefaultQueueCallbackW
SetupDiDestroyDeviceInfoList
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceRegistryPropertyW
SetupDiRemoveDevice
SetupDiInstallDevice
SetupDiClassNameFromGuidW
SetupGetStringFieldW
SetupDiSetClassInstallParamsW

shell32

SHBrowseForFolderW
CommandLineToArgvW
SHGetDesktopFolder
ShellExecuteW
SHGetPathFromIDListW
ExtractIconExW
SHGetFolderPathW
SHChangeNotify
SHSetLocalizedName
SHParseDisplayName
ShellExecuteExW
SHGetSettings
SHBindToParent
SHGetFileInfoW
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetMalloc

shlwapi

PathFindFileNameW
SHQueryValueExW
SHGetThreadRef
StrCmpIW
PathIsDirectoryEmptyW
PathRemoveBlanksW
StrFormatByteSizeW
StrRChrW
StrToIntW
PathFileExistsW
PathIsDirectoryW
StrFormatKBSizeW
AssocCreate
PathAppendW
SHStrDupW
PathCombineW
PathRemoveFileSpecW
PathIsRelativeA
StrRetToBufW
StrDupW
PathFindExtensionW
StrCmpW
StrCmpLogicalW
PathGetDriveNumberW

tapi32

lineGetTranslateCapsW
lineShutdown
lineInitialize
lineTranslateAddressW

urlmon

CoGetClassObjectFromURL
HlinkSimpleNavigateToString
URLOpenStreamA
URLOpenBlockingStreamA
CreateAsyncBindCtx

user32

SendDlgItemMessageW
EndDeferWindowPos
MessageBoxW
GetMessagePos
GetDesktopWindow
GetIconInfo
VkKeyScanA
LoadCursorW
UpdateWindow
IsDialogMessageA
SetPropA
DefWindowProcA
BeginPaint
DialogBoxIndirectParamW
wsprintfW
UnhookWindowsHookEx
SetWindowPos
IsClipboardFormatAvailable
SetRect
wsprintfA
GetKeyState
DestroyWindow
GetCapture
SetDlgItemTextA
KillTimer
GetCursor
ClientToScreen
RegisterClassW
GetDC
ExitWindowsEx
IsWindowUnicode
ShowOwnedPopups
CopyImage
GetThreadDesktop
DrawFrameControl
ToAscii
GetClipCursor
GetWindowThreadProcessId
InvalidateRgn
ChildWindowFromPointEx
SetForegroundWindow
CharLowerW
WindowFromPoint
GetDoubleClickTime
AppendMenuW
AdjustWindowRectEx
IsWindowEnabled
CharPrevW
ChangeDisplaySettingsA
GetClassNameW
DispatchMessageA
GetWindowDC
GetDlgItemTextA
GetWindow
SetWindowLongW
EnumWindows
SetWindowTextW
TrackPopupMenu
DestroyMenu
GetWindowLongW
GetKeyboardState
GetClassLongA
GetCursorPos
GetSystemMenu
CreateCursor
DeleteMenu
FillRect
SetFocus
GetFocus
GetWindowTextW
CloseClipboard
GetForegroundWindow
DialogBoxIndirectParamA
SetWindowRgn
TranslateMessage
PostThreadMessageW
SetScrollPos
GetSystemMetrics
PostThreadMessageA
SendMessageTimeoutW
ShowWindow
MessageBeep
SendMessageTimeoutA
RegisterWindowMessageA
CharUpperA
DefWindowProcW
IsIconic
GetMessageA
LoadImageA
GetMenuItemCount
SystemParametersInfoA
SetMenu
SetWindowsHookExW
SetCursorPos
EnableWindow
DrawMenuBar
CreateIconFromResourceEx
ScreenToClient
wvsprintfA
LoadBitmapW
GetClassInfoExA
SendMessageA
EmptyClipboard
RegisterClipboardFormatW
GetWindowRect
GetMenuItemInfoW
DrawIcon
GetUserObjectInformationA
SetClipboardData
EnableMenuItem
ScrollWindow
GetClassNameA
CheckMenuItem
CreateDialogParamA
LoadStringA
GetMenuItemInfoA
IsWindowVisible
SendDlgItemMessageA
mouse_event
CreateIconIndirect
GetWindowRgn
GetShellWindow
DestroyIcon
LoadCursorA
DrawTextW
SendMessageW
SetScrollRange
GetMenuState
RegisterClassExA
IsRectEmpty
MessageBoxA
CreateDialogParamW
ReleaseDC
SetKeyboardState
SetCapture
WinHelpW
UnregisterClassA
GetParent
OffsetRect
CheckDlgButton
GetActiveWindow
FindWindowA
DrawFocusRect
RedrawWindow
GetWindowTextLengthA
GetWindowLongA
SetDlgItemTextW
ScrollWindowEx
MoveWindow
RemovePropA
SetTimer
IntersectRect
FindWindowW
DialogBoxParamA
OemToCharBuffA
MapVirtualKeyA
DrawTextA
GetScrollInfo
DefMDIChildProcA
ModifyMenuA
ReleaseCapture
SwitchToThisWindow
SetMenuDefaultItem
InvalidateRect
LoadStringW
LoadMenuA
CreatePopupMenu
GetMessageW
CallNextHookEx
LoadIconA
OpenDesktopA
BringWindowToTop
LoadImageW
RegisterClassA
GetLastActivePopup
DefDlgProcA
SystemParametersInfoW
PostQuitMessage
DeferWindowPos
keybd_event
CreateWindowExW
BeginDeferWindowPos
DispatchMessageW
GetSysColor
DrawIconEx
DrawEdge
ChangeDisplaySettingsExA
LoadBitmapA
SetWindowTextA
CharNextA
CharUpperW
SetScrollInfo
LoadIconW
MsgWaitForMultipleObjects
GetWindowTextA
GetDlgItemTextW
InflateRect
GetPropA
OpenInputDesktop
EndPaint
MapWindowPoints
DestroyCursor
RemoveMenu
SetThreadDesktop
PostMessageA
LoadMenuW
wvsprintfW
GetClientRect
OpenClipboard
DialogBoxParamW
WinHelpA
CharNextW
GetMenuDefaultItem
EnableScrollBar
IsWindow
SetRectEmpty
PostMessageW
SetCursor
PtInRect
GetDlgCtrlID
EndDialog
IsDlgButtonChecked
CharPrevA
CharToOemBuffA
UnionRect
CloseDesktop
FrameRect
GetSubMenu
SetWindowsHookExA
EqualRect
SetWindowLongA
CreateWindowExA

userenv

ExpandEnvironmentStringsForUserW

uxtheme

GetThemeSysColor

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetCombineUrlA

winmm

timeBeginPeriod
timeKillEvent
timeGetDevCaps
timeSetEvent
timeEndPeriod

winrnr

RemoveNTDSProvider

winscard

SCardIntroduceCardTypeW
SCardEstablishContext
SCardReleaseContext
SCardForgetCardTypeW

winspool.drv

ClosePrinter
GetPrintProcessorDirectoryW
SetPrinterW
EnumPrinterDataExW
OpenPrinterW
GetPrinterW
EnumPrinterKeyW
EndDocPrinter
GetPrinterDriverDirectoryW
StartDocPrinterW
WritePrinter
EnumJobsW
GetPrinterDriverW
GetJobW
GetPrinterDataExW
EnumPrinterDriversW
SetJobW

wintrust

CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext

xolehlp

DtcGetTransactionManagerExA

Exports

Exports

Tachycardiac
Thumbmark
Providable
Trimesitinic
Molary
Homocoela
Septarium
Elaphodus
Mondayish
Humanism
Elderliness
Syndesmotic
Anoxidative
Mulla
Fulgurator
Pilea
DllRegisterServer
Corymbiferous
Nonparochial
Intersomnial
Chromidae
Frimaire
Bravade
Verrucosity
Oxammite
Unaccountably
Polystichous
Microcephal
Obligatorily
Cynophile
Incudomalleal
Vanner
Lowan
Photomechanically
Basketing
Partitioner
Orneriness
Scragging
Rubicelle
Persulphocyanic
Shovelbill
Acidophilic
Xylotypographic
Clethra
Unroller
Chippable
Quilleted
Bronchoaspergillosis
Insociably
Bebothered
Thiocarbonate
Ignatianist
Counteracting
Renownedly
DllUnregisterServer
Parachromophoric
Ordinative
Postclassical
Hospitably
Superflexion
Prepositional
Ulmaceous
Microcolorimetrically
Sleepingly
Strawfork
Tranquillization
Myophan
Unsurgical
Gymnetrous
Antiphonetic
Arui
Mufty
DllCanUnloadNow
Aluminosis
Entapophysial
Withoutdoors
Unimprovably
Acetenyl
Panlogism
Hemigastrectomy
Athetoid
Worshipfully
Panbabylonism
Alloplastic
Talak
Nonstatement
Mesaticephalism
Concaveness
Sweepback
Nagatelite
Tarsius
Texturally
Undignifiedly
Uterotubal
Candareen
Chirotes
Treacherousness
Paripinnate
Pyrrhus
Decagram
Cutely
Elegancy
Rideable
Pseudoclerical
Dudeen
Peracidite
Tapetal
Unsooty
Gunmaker
Epicurishly
Blindfolder
Lickerishly
Apparently
Subversionary
Sodoku
Metel
Nonconservation
Subinsertion
Unsewed
Warding
Reapposition
Williamsite
Pentyne
Julietta
Girondism
Praefect
Nasoalveola
Ochroleucous
Intrabiontic
Camshach
Ynambu
Additionally
Paraxonic
Spasmodic
Unpossessedness
Truffled
Manichee
Acaricide
Jennet
Benzazine
Indyl
Synoeciously
Backen
Aftergrowth
Jaalin
Kassite
Unornamental
Hairhoof
Podophthalmia
Rodenticidal
Reoccupy
Objectionably
Shehitah
Teleophobia
Handcart
Purveyoress
Uneffete
Speaking
Sackbut
Manius
Luridly
Psychosurgeon
Unclementness
Spaid
Gunite
Stridulate
Prolongably
Sanctanimity
Tyrannical
Prereceiver
Metacarpus
Shirting
Poodleship
Authorization
Appeaser
Campanulales
Wren
Leucospheric
Filoplume
Chlorite
Proritualistic
Proselytistic
Postcart
Verderership
Sandbank
Acroa
Variously
Inobnoxious
Questorship
Scrawliness
Bicentenary
Galactophore
Aurist
Virelay
Bounder
Viridescent
Blacketeer
Noneffete
Hemen
Unfriable
Sialadenoncus
Restigmatize
Statecraft
Macarani
Boschneger
Eudemian
Unreproachfully
Ochotona
Submicron
Canting
Trollimog
Maximalism
Mends
Melocactus
Strider
Phlebodium
Spart
Choriocapillaris
Preaggression
Deflectionization
Myrabolam
Ichthyosism
Noncathedral
Achorion
Auxochromous
Rechange
Agrostographical
Voltize
Dreaminess
Toadlet
Theromores
Aspredinidae
Angelique
Opinionative
Dibatag
Turncoatism
Paraglycogen
Solivagant
Setophaga
Artal
Lestrigon
Anesthesiant
Executorship
Skimback
Dipterist
Recommendable
DllGetClassObject

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

ace13c17e53d07ea38e285dca185c74f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

57:55:c3:bf:a9:58:e2:9e:f9:dc:a3:fb:a9:fc:02:d4Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

8e:f8:14:ad:4c:f7:dd:d7:a4:71:54:cf:b3:9d:6e:dc:75:9d:1c:e6:95:68:05:56:5f:94:67:b1:5c:b0:ab:ccSigner

Headers

File Characteristics

Imports

advapi32

certmgr

cfgmgr32

clusapi

comctl32

comdlg32

comsvcs

crypt32

dnsapi

dsuiext

gdi32

iassvcs

imm32

kernel32

licmgr10

mscat32

mscms

msports

msvcp60

msvcrt

netapi32

ntdll

occache

odbccu32

ole32

olesvr32

pdh

psapi

rpcrt4

rtutils

scecli

secur32

setupapi

shell32

shlwapi

tapi32

urlmon

user32

userenv

uxtheme

version

wininet

winmm

winrnr

winscard

winspool.drv

wintrust

xolehlp

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 91KB

.rdata Size: 122KB - Virtual size: 165KB

.reloc Size: 8KB - Virtual size: 8KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

57:55:c3:bf:a9:58:e2:9e:f9:dc:a3:fb:a9:fc:02:d4
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

8e:f8:14:ad:4c:f7:dd:d7:a4:71:54:cf:b3:9d:6e:dc:75:9d:1c:e6:95:68:05:56:5f:94:67:b1:5c:b0:ab:cc
Signer

.text
Size: 92KB - Virtual size: 91KB

.rdata
Size: 122KB - Virtual size: 165KB

.reloc
Size: 8KB - Virtual size: 8KB