0d00dcebb9d970627a7eb96474a0474efa898805b6a4c11b003324a58f3a2be7

Sharing

Copy URL Twitter E-mail

General

Target
0d00dcebb9d970627a7eb96474a0474efa898805b6a4c11b003324a58f3a2be7
Size 1.8MB
Sample260802-wtlnbavtcy
SHA256 0d00dcebb9d970627a7eb96474a0474efa898805b6a4c11b003324a58f3a2be7
MD5 12176767977859c75b5b0fa9f67772ba
SHA1 ff9b4e79d5cfc840ae296d6ea2a35c2f03bcda49
SHA512 ad3e181d4de7b54605e8b77d4865789f8361d4f04d8d25c95f8f466b4bc68ef32f1dc252f63dd426596b1fa7eabddab50534fc137343c530613138194f271556
SSDEEP 49152:Z9XPZm4Aa5X8erVuuDBlzOWWvyw9bc4NGljImW2WMFrrRu:ZXm25X/rVuuDBlzOWW8jImWjMFH
TLSH
T134956C31B9418436EA5211F19D7CEBFA456D9E301F6910CB83E87A2E6EB05C33B31967
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d00dcebb9d970627a7eb96474a0474efa898805b6a4c11b003324a58f3a2be7

File Explorer

0d00dcebb9d970627a7eb96474a0474efa898805b6a4c11b003324a58f3a2be7

.exe 1.8MB

0d00dcebb9d970627a7eb96474a0474efa898805b6a4c11b003324a58f3a2be7

IMPHASH 1c29d2b8185f559edaf054970b71e527
SHA256 0d00dcebb9d970627a7eb96474a0474efa898805b6a4c11b003324a58f3a2be7
MD5 12176767977859c75b5b0fa9f67772ba
SHA1 ff9b4e79d5cfc840ae296d6ea2a35c2f03bcda49
SHA512 ad3e181d4de7b54605e8b77d4865789f8361d4f04d8d25c95f8f466b4bc68ef32f1dc252f63dd426596b1fa7eabddab50534fc137343c530613138194f271556
SSDEEP 49152:Z9XPZm4Aa5X8erVuuDBlzOWWvyw9bc4NGljImW2WMFrrRu:ZXm25X/rVuuDBlzOWW8jImWjMFH
TLSH
T134956C31B9418436EA5211F19D7CEBFA456D9E301F6910CB83E87A2E6EB05C33B31967
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

618400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\weasel\output\Win32\WeaselServer.pdb

imm32

ImmDisableIME

kernel32

RegisterApplicationRestart MultiByteToWideChar SetThreadLocale GetUserDefaultUILanguage SetThreadUILanguage ExpandEnvironmentStringsW GetThreadUILanguage CloseHandle SetEvent CreateEventA CreateEventW LocalFree FormatMessageA FormatMessageW WideCharToMultiByte WakeAllConditionVariable FindResourceW SizeofResource LockResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW GetCurrentThreadId WriteConsoleW ReadConsoleW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx SetStdHandle SetConsoleCtrlHandler SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW Sleep GetTimeFormatW LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy RaiseException CreateDirectoryW VerifyVersionInfoW VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionEx GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetCurrentThread FreeLibraryAndExitThread ExitThread CreateThread GetStdHandle ExitProcess InitializeCriticalSectionAndSpinCount GetLastError DecodePointer InterlockedFlushSList RtlUnwind CreateWaitableTimerA GetModuleHandleA GetLogicalProcessorInformation GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc ResumeThread SetWaitableTimer OpenEventA WaitForMultipleObjectsEx WaitForSingleObjectEx ReleaseSemaphore ResetEvent GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetTickCount64 GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce LCMapStringEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency GetStringTypeW CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFileW CreateDirectoryExW DeviceIoControl AreFileApisANSI GetTempPathW lstrcmpiW CompareStringW SetFileTime SetFileInformationByHandle SetLastError OutputDebugStringW FindResourceA GetCurrentProcessId CreateMutexW GetModuleHandleExW WaitNamedPipeW SetNamedPipeHandleState CreateFileW WriteFile FlushFileBuffers DisconnectNamedPipe ReadFile CreateNamedPipeW ConnectNamedPipe IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SleepConditionVariableSRW

user32

CreateWindowExW IsWindow DestroyWindow SetTimer MessageBoxA PeekMessageW GetMessageW TranslateMessage DispatchMessageW SetWindowTextW SetRect CallWindowProcW EndPaint BeginPaint DrawIconEx GetMonitorInfoW CopyRect UpdateLayeredWindow GetClientRect InvalidateRect ClientToScreen TrackMouseEvent PtInRect DefWindowProcW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard OffsetRect IsRectEmpty ReleaseDC SetWindowPos GetDC MonitorFromRect LoadCursorW GetClassInfoExW ShowWindow GetSystemMetrics KillTimer LoadMenuW DestroyMenu PostMessageW DrawAnimatedRects RegisterWindowMessageW GetSubMenu GetMenuItemID TrackPopupMenu SetMenuDefaultItem SetActiveWindow SetForegroundWindow RedrawWindow RegisterClassExW LoadStringW UnregisterClassW InflateRect GetWindowRect MessageBoxExW CharNextW SystemParametersInfoW LoadImageW DestroyIcon LoadIconW GetClassNameW FindWindowW EnumChildWindows SetParent SetWindowLongW GetWindowLongW GetCursorPos

advapi32

RegCreateKeyExW RegQueryValueExW RegOpenKeyW GetUserNameW RegCloseKey StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW RegGetValueW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

ShellExecuteW Shell_NotifyIconW SHAppBarMessage

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoCreateInstance CoInitialize

oleaut32

VarUI4FromStr SysFreeString

comctl32

InitCommonControlsEx

winsparkle

win_sparkle_set_registry_path win_sparkle_set_lang win_sparkle_cleanup win_sparkle_init win_sparkle_check_update_with_ui win_sparkle_set_appcast_url

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness GetDpiForMonitor

gdiplus

GdipCombineRegionRegion GdipCloneRegion GdipDeleteRegion GdipCreateRegionPath GdipIsEmptyRegion GdipFree GdipAlloc GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipDisposeImage GdipCreatePen1 GdipDeletePen GdipSetPenColor GdipCreatePath GdipDeletePath GdipAddPathRectangleI GdipCreateFromHDC GdipGetImageGraphicsContext GdipDeleteGraphics GdipSetSmoothingMode GdipDrawPath GdipFillPath GdipDrawImageI GdipCloneImage GdipCreateBitmapFromScan0 GdiplusStartup GdiplusShutdown GdipAddPathLineI GdipAddPathArcI GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipBitmapLockBits GdipBitmapUnlockBits

d2d1

ord1

dwrite

DWriteCreateFactory

rime

rime_get_api

gdi32

DeleteDC SelectObject CreateCompatibleBitmap BitBlt SetViewportOrgEx CreateCompatibleDC DeleteObject

??0?$codecvt_null@_W@archive@boost@@QAE@I@Z ??0?$oserializer@Vtext_woarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vtext_woarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vtext_woarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vtext_woarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vtext_woarchive@archive@boost@@UUIStyle@weasel@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@QAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UUIStyle@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@IAE@XZ ??1?$codecvt_null@_W@archive@boost@@UAE@XZ ??_F?$codecvt_null@_W@archive@boost@@QAEXXZ ?do_always_noconv@?$codecvt_null@_W@archive@boost@@EBE_NXZ ?do_encoding@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_in@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?do_max_length@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_out@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UCandidateInfo@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UText@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UTextAttribute@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UTextRange@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UUIStyle@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UUIStyle@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vtext_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_woarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@UText@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@UTextRange@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@UUIStyle@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@UUIStyle@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@3@XZ ?get_lock@singleton_module@serialization@boost@@AAEAA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vtext_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_woarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$map@Vtext_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@QAE_NXZ ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@AAEAA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@QAEXXZ ?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@UUIStyle@weasel@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?unlock@singleton_module@serialization@boost@@QAEXXZ

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

202KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

275KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0d00dcebb9d970627a7eb96474a0474efa898805b6a4c11b003324a58f3a2be7

imm32

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

winsparkle

api-ms-win-shcore-scaling-l1-1-1

gdiplus

d2d1

dwrite

rime

gdi32

generic