698947907d05749578d13a7462afa88fb00c3e589403bbcc6f82111ba9a27e94

Sharing

Copy URL Twitter E-mail

General

Target
698947907d05749578d13a7462afa88fb00c3e589403bbcc6f82111ba9a27e94
Size 2.8MB
Sample260712-d2fg6aew61
SHA256 698947907d05749578d13a7462afa88fb00c3e589403bbcc6f82111ba9a27e94
MD5 e5792e119c7db8704099af544d6f6572
SHA1 27eb50249c5fe06317e654485d38ea09351964db
SHA512 ab3d6542a46441701686389dd0b6b4381034aeb8d6b89e97243c084b7028c41e84ccbc192e971225bfebd1ca5033ecd2845362530b1200491b36ac2e66a69b63
SSDEEP 49152:5C8DQFQ1WhrbivYdQ1EASiwV9SMKAgs242KgOVEAIr0npMkJP8rVnjp4G07vg:5C88+1WEYKiZV1KAR242KDSryptOVnjr
TLSH
T138D533632580DC63E99D1E71BCD85233BE7DBCE30D068F4B9301A643D72614EA1A5BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
698947907d05749578d13a7462afa88fb00c3e589403bbcc6f82111ba9a27e94
unpack001/$PLUGINSDIR/System.dll

File Explorer

698947907d05749578d13a7462afa88fb00c3e589403bbcc6f82111ba9a27e94

.exe 2.8MB
$PLUGINSDIR/FileInfo.dll

.dll 749KB
$PLUGINSDIR/SetupPlugin.dll

.dll 4.7MB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/libcurl_x86.dll

.dll 1.9MB

698947907d05749578d13a7462afa88fb00c3e589403bbcc6f82111ba9a27e94

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 698947907d05749578d13a7462afa88fb00c3e589403bbcc6f82111ba9a27e94
MD5 e5792e119c7db8704099af544d6f6572
SHA1 27eb50249c5fe06317e654485d38ea09351964db
SHA512 ab3d6542a46441701686389dd0b6b4381034aeb8d6b89e97243c084b7028c41e84ccbc192e971225bfebd1ca5033ecd2845362530b1200491b36ac2e66a69b63
SSDEEP 49152:5C8DQFQ1WhrbivYdQ1EASiwV9SMKAgs242KgOVEAIr0npMkJP8rVnjp4G07vg:5C88+1WEYKiZV1KAR242KDSryptOVnjr
TLSH
T138D533632580DC63E99D1E71BCD85233BE7DBCE30D068F4B9301A643D72614EA1A5BDA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/FileInfo.dll

IMPHASH b7d97c0c31dc2f9a08f9367867c81fa6
SHA256 631b02c9cd91e1284fdf0d9bb22af04ce98476f92fd84306fdc80f4f3f0c44dc
MD5 4ddacb62bab27624742460274306608f
SHA1 5ea4ec5ae6aa5a8e602ebf17cd8ee427759b0100
SHA512 213e587cce071061b75b0031f37458c5652c9ae3f37b169d177b3ccd04497729998b64f18c926a59936662081cc2e7551218e5f5a3cbc24408e05e5348ca0f9d
SSDEEP 12288:rhs0LYjI0i41MbufRTOFd8OTSfSNcNsyXy/8KX+IxPor2dfpaZJjpTQdTNBa+DJG:rhnYjI0ioMQ0cLXy/CQPoSdfpgHTQH8P
TLSH
T138F43A213816C037D66D52F11939EFEBAABC5D750FF1A4CBA7C05E3AC9204C1663AE16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

5a:02:40:eb:56:f0:3b:4a:ad:3b:b1:44:ab:76:a6:e3:1f:bd:ee:ae:d5:6b:79:de:39:54:13:a8:71:d8:78:0c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=913101150729060470,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c0ce6b5a6e4b89ce696b0e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Apr 10, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

ed:77:c2:e3:77:f9:c4:b0:75:82:3e:a9:b1:f7:62:5f:5b:c5:d9:c4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Apr 10, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0d:7e:f8:80:11:79:bf:12:a7:46:6f:7d:a5:b3:27:7a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2023 - Jul 7, 2026

Minor OS version

Major OS version

Entry point

400533

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\SafeTrunk\SoftMgrCode\SoftMgr\main\install\FileInfo\bin\Release\FileInfo.pdb

kernel32

SetFilePointer CreateFileW GetFileSize GetModuleFileNameW FindFirstFileW GetLongPathNameW GetFileAttributesExW GetProcAddress LocalFree CreateProcessW GetModuleHandleW GetExitCodeProcess CreateEventW SetEvent ResetEvent FindNextFileW FindClose ReadFile SetFileTime SetEndOfFile CreateDirectoryW GetFullPathNameW lstrlenW RemoveDirectoryW GetTempPathW GetWindowsDirectoryW GetTempFileNameW HeapFree GetCurrentThreadId GetVersionExW HeapAlloc GetProcessHeap LockResource LoadResource WriteFile lstrcmpiW LoadLibraryW FreeLibrary LoadLibraryExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetCurrentProcess GetPrivateProfileStringW WritePrivateProfileStringW OutputDebugStringW GetLocalTime InitializeCriticalSectionAndSpinCount DeviceIoControl GetComputerNameW GetTickCount lstrcpyW WideCharToMultiByte FreeLibraryAndExitThread ExitThread CreateThread GlobalFree GlobalAlloc MultiByteToWideChar lstrcpynW GetCurrentProcessId CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot OpenProcess WaitForSingleObject TerminateProcess MoveFileExW DeleteFileW GetLastError Sleep SetFileAttributesW GetFileAttributesW CreateMutexW SetEnvironmentVariableW ResumeThread MapViewOfFile CreateFileMappingW UnmapViewOfFile OpenFileMappingW GetEnvironmentVariableW FindResourceW ReleaseMutex UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead QueryPerformanceCounter GetSystemTimeAsFileTime IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedPushEntrySList InterlockedFlushSList RaiseException SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetTimeZoneInformation HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetFilePointerEx GetStringTypeW SetStdHandle HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode DecodePointer WriteConsoleW

user32

MessageBoxW

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW

shell32

ShellExecuteW SHGetSpecialFolderLocation SHGetPathFromIDListW

ole32

CoTaskMemFree CoCreateInstance

oleaut32

SysAllocString VariantClear

shlwapi

StrStrIW

Name

.text

Size

580KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/SetupPlugin.dll

IMPHASH cf4bb5da8df1dff32040b1f20cabbcfb
SHA256 2ce3f3f54219d0184aaf41ef5fb162151d76bd7bd030ed03b4f23f74249f8261
MD5 0028a45b9779e4a4ede4ee3c46fb6c93
SHA1 e05083fcf06a6fa02f4214033f3c989ec90a360e
SHA512 d1ebd1dc2929402984b2a00461f0ccc925d4f156cf506a05ee236b469746a142d0d52a5251bfecc9d7104572c231a0a77184730a7a7422830860357bc0dc2e41
SSDEEP 49152:4eXrJepeQyq0qLi1WgqJueLDVCPvwSHWDTJacNHoKKuZMyareb6sFE+DP5bHARcg:4QV6VyvKi64yIn25dHIuZMy+
TLSH
T19036AD21B68BC1BAE45D11F0256DAAEF59283A650B2444C3E3E42F6E69704C33B37F57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

5b:cf:fb:ae:2c:88:a9:af:7a:3e:f0:90:cd:01:91:24:f0:fb:94:db:f5:8b:de:1c:ec:3b:c9:62:e4:3e:aa:72

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

Chains

May 11, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

80:5d:d6:d8:1e:64:e2:43:a9:ce:3d:53:d2:ae:be:f7:85:84:ed:9e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

May 11, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0d:7e:f8:80:11:79:bf:12:a7:46:6f:7d:a5:b3:27:7a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2023 - Jul 7, 2026

Minor OS version

Major OS version

Entry point

3346777

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\jenkins\workspace\pc-2345softmgr-build\SoftMgr\main\bin\Win32\Release\pdb\SetupPlugin.pdb

kernel32

QueryDosDeviceW GlobalMemoryStatusEx SetLastError WaitForMultipleObjects GetTickCount GetComputerNameW GetFileSize SetEndOfFile ReadFile SetEvent WaitForSingleObject VirtualQuery GetProcessHeap LocalFree HeapAlloc HeapFree GetLogicalDriveStringsW Sleep OpenProcess GetEnvironmentVariableW DeviceIoControl ExpandEnvironmentStringsW DeleteFileW OpenThread SetThreadContext GetThreadContext CreateToolhelp32Snapshot SuspendThread Thread32First Thread32Next GetFileInformationByHandle GetVersionExW GetCurrentProcessId GetLocalTime OutputDebugStringW GetCurrentThreadId SetFilePointer WriteFile GetCurrentProcess WritePrivateProfileStringW MoveFileExW GetProcAddress GetPrivateProfileStringW CreateFileW GetModuleHandleW FindResourceW LoadResource LockResource SizeofResource lstrcatW GetFileAttributesW FindClose lstrlenW FindFirstFileW GetDiskFreeSpaceW DeleteCriticalSection DecodePointer GetLastError InitializeCriticalSectionAndSpinCount lstrcpyW WideCharToMultiByte CreateSemaphoreW ReleaseSemaphore WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GlobalFree GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GlobalAlloc MultiByteToWideChar lstrcpynW ExitProcess FreeLibraryAndExitThread ExitThread TlsFree InterlockedFlushSList RtlUnwind GetFileType GetStdHandle FlushFileBuffers LockFileEx UnlockFile HeapCompact HeapReAlloc DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnlockFileEx GetFullPathNameA LockFile AreFileApisANSI LoadLibraryExA VirtualFree VirtualAlloc InterlockedPushEntrySList InterlockedPopEntrySList FlushInstructionCache HeapDestroy HeapCreate OutputDebugStringA VirtualProtect TlsGetValue CreateThread TlsAlloc DisableThreadLibraryCalls GetModuleHandleA TlsSetValue MapViewOfFileEx CreateFileMappingW UnmapViewOfFile GlobalUnlock GlobalLock LocalAlloc MulDiv FreeResource CreateWaitableTimerW SetWaitableTimer lstrcmpW VerifyVersionInfoW VerSetConditionMask InitializeSListHead GetStartupInfoW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW GetSystemTimeAsFileTime LCMapStringEx EncodePointer InitializeCriticalSectionEx QueryPerformanceFrequency QueryPerformanceCounter SleepConditionVariableSRW WakeAllConditionVariable FormatMessageA InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW IsProcessorFeaturePresent RaiseException GetExitCodeThread WaitForSingleObjectEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW GetFileSizeEx LoadLibraryA MoveFileW GetTempFileNameW CopyFileW GetWindowsDirectoryW GetCurrentDirectoryW SetFileAttributesW GetSystemDirectoryW GetTempPathW RemoveDirectoryW GetFullPathNameW CreateDirectoryW GetFileTime SetFileTime MapViewOfFile ResumeThread GetSystemTime SystemTimeToFileTime FreeLibrary LoadLibraryW GetModuleFileNameW OpenMutexW CloseHandle GetCommandLineW CreateMutexW FileTimeToSystemTime LoadLibraryExW ReleaseMutex GetExitCodeProcess CreateProcessW CreateEventW ResetEvent SearchPathW TerminateProcess GetLongPathNameW GetFileAttributesExW GetSystemInfo lstrcmpiW GetACP TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection FindNextFileW

user32

MapWindowPoints GetMonitorInfoW IsWindow ShowWindow SetWindowTextW GetSystemMetrics MonitorFromWindow SetWindowPos GetFocus GetWindow GetWindowTextLengthW GetWindowThreadProcessId GetWindowLongW GetPropW RemovePropW SetPropW GetAsyncKeyState LoadStringW DestroyAcceleratorTable CreateAcceleratorTableW EnumThreadWindows RegisterWindowMessageW GetAncestor GetSysColor GetClassInfoExW CallWindowProcW CloseClipboard EmptyClipboard GetClipboardData SetClipboardData IsClipboardFormatAvailable SetCaretPos GetClassLongW SetRectEmpty FillRect UpdateLayeredWindow SetRect GetIconInfo IsIconic DrawTextW LoadBitmapW LoadImageW GetForegroundWindow PtInRect GetKeyboardState GetCaretBlinkTime ToAscii AdjustWindowRectEx ShowWindowAsync GetDC IsWindowVisible MessageBoxW SetWindowRgn InvalidateRgn OpenClipboard SetTimer IsChild ValidateRect GetWindowTextW MsgWaitForMultipleObjects AttachThreadInput SetFocus GetClientRect GetDesktopWindow SystemParametersInfoW GetParent UnionRect DispatchMessageW CharPrevW PeekMessageW CharNextW MoveWindow SetForegroundWindow TranslateMessage GetActiveWindow EndDialog SetWindowLongW DefWindowProcW UnregisterClassW wsprintfW PostMessageW FindWindowExW GetWindowRect SendMessageW FindWindowW DrawIconEx GetMessageW DestroyWindow CreateWindowExW RegisterClassExW LoadCursorW PostQuitMessage SendMessageTimeoutW GetCursorPos ReleaseDC GetDCEx InvalidateRect IsZoomed SetCursor GetWindowDC IntersectRect IsRectEmpty ClientToScreen CopyRect RedrawWindow OffsetRect EnumChildWindows EqualRect DialogBoxParamW ReleaseCapture SetCapture TrackMouseEvent ScreenToClient GetKeyState EnableWindow EndPaint BeginPaint KillTimer GetDlgItem SetParent GetClassNameW

gdi32

GetFontData SetBkMode GetTextExtentPointI GdiFlush GetStockObject GetObjectW CreateFontIndirectW DeleteDC RemoveFontMemResourceEx DeleteObject SetViewportOrgEx CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt EnumFontsW GetClipBox CreateDIBSection CreatePolygonRgn CreateRectRgnIndirect SetWorldTransform SetGraphicsMode GetDeviceCaps CreateSolidBrush SetBkColor SetTextColor PtInRegion CreateRoundRectRgn GetMapMode SetMapMode GetTextMetricsW GetDIBits CreateDCW ExtTextOutW SetTextAlign GetOutlineTextMetricsW GetGlyphIndicesW GetCharABCWidthsW GetGlyphOutlineW GetRgnBox AddFontMemResourceEx GetFontUnicodeRanges EnumFontFamiliesExW GetTextFaceW

advapi32

RegCloseKey RegQueryInfoKeyW RegSetValueExW RegCreateKeyExW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW ChangeServiceConfig2W DeleteService ControlService StartServiceW OpenServiceW RegDeleteKeyW RegEnumKeyExW RegDeleteValueW RegOpenKeyExW

shell32

DragFinish ShellExecuteW SHGetSpecialFolderPathW SHGetFolderPathW DragQueryFileW SHGetPathFromIDListW SHGetSpecialFolderLocation SHChangeNotify SHBrowseForFolderW

ole32

CreateStreamOnHGlobal CoGetClassObject StringFromGUID2 CLSIDFromProgID CLSIDFromString OleLockRunning CoCreateGuid OleUninitialize CoUninitialize CoInitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree OleInitialize

oleaut32

LoadTypeLi OleCreateFontIndirect DispCallFunc SysStringLen SysAllocStringLen VarUI4FromStr SysAllocString VariantClear SysFreeString LoadRegTypeLi VariantInit

shlwapi

ord12 StrToIntA PathFindFileNameW PathAppendW StrDupW

comctl32

InitCommonControlsEx _TrackMouseEvent

msimg32

AlphaBlend

urlmon

CoInternetCreateZoneManager CoInternetCreateSecurityManager

gdiplus

GdipGetPropertyItemSize GdipGetImageWidth GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipBitmapLockBits GdipImageSelectActiveFrame GdipFree GdipDisposeImage GdipAlloc GdipCreateBitmapFromStream GdipGetPropertyItem GdipBitmapUnlockBits GdipCloneImage GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipCloneBitmapAreaI GdipGetImagePixelFormat GdipSetStringFormatFlags GdipCloneRegion GdipGetFamilyName GdipDeleteMatrix GdipDrawImageRectRectI GdipSetStringFormatAlign GdipCreatePen1 GdipDeletePen GdipTranslateWorldTransform GdipGetFontSize GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipAddPathArc GdipFillRectangleI GdipGetImageGraphicsContext GdipDeleteRegion GdipMeasureString GdipCloneBrush GdipRestoreGraphics GdipRotateWorldTransform GdipStringFormatGetGenericTypographic GdipGetCellAscent GdipSetTextRenderingHint GdipCloneStringFormat GdipGetMatrixElements GdipGetTextureTransform GdipCreateTexture GdipBeginContainer2 GdipFillEllipse GdipCreateFromHDC GdipGetClipBoundsI GdipSetImageAttributesWrapMode GdipDrawString GdipDrawPath GdipSetClipRegion GdipCreateImageAttributes GdiplusShutdown GdipGetSmoothingMode GdipClosePathFigure GdipSetClipRectI GdipScaleWorldTransform GdipSetPixelOffsetMode GdipSetCompositingMode GdipDrawLine GdipSetPenDashStyle GdipGraphicsClear GdipDrawRectangle GdipGetPathWorldBounds GdipFillPath GdipTransformRegion GdipSetStringFormatTrimming GdipGetFontStyle GdipCreateSolidFill GdipCloneBitmapArea GdipGetCellDescent GdipSetInterpolationMode GdipSetLinePresetBlend GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipEndContainer GdipSetSmoothingMode GdipCreateMatrix GdipGetStringFormatAlign GdipDeletePath GdipDisposeImageAttributes GdipCreateMatrix2 GdipDeleteBrush GdipGetLineSpacing GdipSetLineWrapMode GdipCreateLineBrushI GdipDrawImageRectRect GdipSaveGraphics GdipCreateFontFamilyFromName GdipGetEmHeight GdipGetStringFormatLineAlign GdipAddPathString GdipGetTextRenderingHint GdipGetFamily GdipSetCompositingQuality GdipSetImageAttributesColorMatrix GdipGetLineTransform GdipDeleteFontFamily GdipGetInterpolationMode GdipCreateRegionPath GdipAddPathLineI GdipAddPathBezierI GdipCombineRegionPath GdipAddPathEllipseI GdipAddPathArcI GdipAddPathRectangleI GdipCombineRegionRegion GdipGetBrushType GdipSetLineTransform GdipSetTextureTransform GdiplusStartup GdipCreateHBITMAPFromBitmap GdipDrawArcI GdipMultiplyWorldTransform

psapi

GetMappedFileNameW

usp10

ScriptFreeCache ScriptShape ScriptItemize

imm32

ImmNotifyIME ImmAssociateContextEx ImmGetCompositionStringW ImmSetCompositionWindow ImmReleaseContext ImmGetContext

winmm

timeGetTime

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

583KB

Virtual Size

582KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

278KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

165KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/libcurl_x86.dll

IMPHASH a996403d816908e79c3d6e0ea1cbe2e2
SHA256 0e3ed2064e425a79c5375be166446b3e0698710fd27e1bedd47f3f1558631cee
MD5 7b61b308a44540f9832b00c4a9d6919f
SHA1 3b0fb6be61fe3dd36a90b787dc0df36d5e64a400
SHA512 12a8c8d31ebb299a9e5938bf6ef901d4afae8b36bae11a3065c38aca98cb1384c03e6384c32e63f96e7122685e579670bad97e02ddf1cb806c1225b5da7747b8
SSDEEP 49152:2KNRWsevHiD2PUPYd/K0Zq9KyQmyrq7eOP2uQqfbwo:2KNRWse/iD2MPYd/NqgJrq7ec
TLSH
T12595AE03FB819572F5DE017A52BB577F8E3A6624832C85C3CBE128A489711D2773E399
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

bb:3d:5d:d0:3d:03:0c:f0:87:df:14:f2:aa:0c:72:df:8c:d9:98:18:d5:38:5f:b0:41:c4:b6:30:aa:34:bb:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91310115591679552Q,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Mar 22, 2023

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

a7:48:82:7f:c5:56:56:93:12:51:c6:18:5d:ed:72:18:9b:74:1b:0e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

Chains

Mar 22, 2023

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

Serial Number

06:ea:0d:de:d5:5e:c1:e1:a2:9f:c5:fb:5d:ab:4f:b2

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2020 - May 18, 2023

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

Serial Number

05:aa:43:30:0d:17:67:ac:12:49:43:54:21:65:bb:9e

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2020 - May 18, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

Major OS version

Entry point

1357204

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\dev\RCFL\vendor\depends\curl\out\bin\Win32\release_static\pdb\libcurl_x86.pdb

ws2_32

bind closesocket connect getpeername getsockopt htons ntohs recv setsockopt socket WSASetLastError WSAIoctl getaddrinfo freeaddrinfo gethostname accept WSAGetLastError listen ioctlsocket __WSAFDIsSet select send WSAStartup WSACleanup recvfrom sendto getsockname shutdown htonl ntohl gethostbyname getservbyname

wldap32

ord145 ord219 ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord27 ord26 ord118 ord41 ord208 ord216 ord14 ord46

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

kernel32

FindNextFileA SystemTimeToTzSpecificLocalTime GetDriveTypeW FindFirstFileExW FindClose RaiseException ReadConsoleW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetModuleFileNameW GetProcessHeap RtlUnwind FatalAppExitA CreateSemaphoreW GetStartupInfoW FindFirstFileA GetFullPathNameA HeapSize SetEndOfFile WriteConsoleW GetCurrentDirectoryW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SleepEx MultiByteToWideChar WideCharToMultiByte WaitForSingleObject CloseHandle ExpandEnvironmentStringsA Sleep GetLastError SetLastError FormatMessageA VerSetConditionMask FreeLibrary GetProcAddress LoadLibraryW GetModuleHandleW GetSystemDirectoryW QueryPerformanceFrequency VerifyVersionInfoW WaitForMultipleObjects GetFileType GetStdHandle ReadFile PeekNamedPipe GetTickCount QueryPerformanceCounter FlushConsoleInputBuffer WriteFile GetCurrentThreadId GetModuleHandleA GetCurrentProcessId GlobalMemoryStatus LoadLibraryA GetSystemTime SystemTimeToFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess CreateEventW SetCurrentDirectoryW GetFullPathNameW SetEnvironmentVariableA LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetStringTypeW OutputDebugStringW GetTimeZoneInformation CreateFileW SetFileAttributesW GetFileAttributesExW InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA GetConsoleCP IsDebuggerPresent IsProcessorFeaturePresent GetSystemTimeAsFileTime EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW HeapFree HeapAlloc HeapReAlloc SetFilePointerEx FileTimeToLocalFileTime GetFileInformationByHandle FileTimeToSystemTime GetCommandLineA SetConsoleCtrlHandler GetConsoleMode GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleInputA SetConsoleMode ExitProcess GetModuleHandleExW AreFileApisANSI GetCurrentThread UnhandledExceptionFilter SetUnhandledExceptionFilter FlushFileBuffers

user32

ReleaseDC GetDC GetDesktopWindow MessageBoxA GetUserObjectInformationW GetProcessWindowStation

gdi32

DeleteObject GetDeviceCaps GetDIBits GetObjectA CreateCompatibleBitmap

advapi32

RegisterEventSourceA CryptEnumProvidersA CryptSignHashA CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextA ReportEventA DeregisterEventSource

curl_easy_cleanup curl_easy_duphandle curl_easy_escape curl_easy_getinfo curl_easy_init curl_easy_pause curl_easy_perform curl_easy_recv curl_easy_reset curl_easy_send curl_easy_setopt curl_easy_strerror curl_easy_unescape curl_easy_upkeep curl_escape curl_formadd curl_formfree curl_formget curl_free curl_getdate curl_getenv curl_global_cleanup curl_global_init curl_global_init_mem curl_global_sslset curl_maprintf curl_mfprintf curl_mime_addpart curl_mime_data curl_mime_data_cb curl_mime_encoder curl_mime_filedata curl_mime_filename curl_mime_free curl_mime_headers curl_mime_init curl_mime_name curl_mime_subparts curl_mime_type curl_mprintf curl_msnprintf curl_msprintf curl_multi_add_handle curl_multi_assign curl_multi_cleanup curl_multi_fdset curl_multi_info_read curl_multi_init curl_multi_perform curl_multi_remove_handle curl_multi_setopt curl_multi_socket curl_multi_socket_action curl_multi_socket_all curl_multi_strerror curl_multi_timeout curl_multi_wait curl_mvaprintf curl_mvfprintf curl_mvprintf curl_mvsnprintf curl_mvsprintf curl_pushheader_byname curl_pushheader_bynum curl_share_cleanup curl_share_init curl_share_setopt curl_share_strerror curl_slist_append curl_slist_free_all curl_strequal curl_strnequal curl_unescape curl_url curl_url_cleanup curl_url_dup curl_url_get curl_url_set curl_version curl_version_info

Sharing

General

Malware Config

Signatures

File Explorer

698947907d05749578d13a7462afa88fb00c3e589403bbcc6f82111ba9a27e94

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/FileInfo.dll

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic

$PLUGINSDIR/SetupPlugin.dll

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

urlmon

gdiplus

psapi

usp10

imm32

winmm

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/libcurl_x86.dll

PE Signature issue

ws2_32

wldap32

crypt32

kernel32

user32

gdi32

advapi32

generic