ID-ALL-1[.]1[.]30[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ID-ALL-1.1.30.exe
Size 328.0MB
Sample260925-wasyaafh74
SHA256 f5a3473dec6631b4225e2c4d2bf4955aca078434cbd80c8128a5d983a48b2854
MD5 9f7a4ea598974da4d9956a063d1ac790
SHA1 12f3e04774e88593770a4364b935166a806089e2
SHA512 6986251b5f7fbe9091dc4964199ab0c866d261db0c45d654e26a97511a536e44a08430fe8f010c7aceacc2b670450f23d9f224312974a22f65f4b338d408e824
SSDEEP 6291456:F/QbF8oV19ptz3CrMLwIPaJ9G4Nq9kbGnk1QyCjN1zAn1ncJQ:qbF8oV19ptLCtIyJ9AIj4jPU1ncJQ
TLSH
T186F83387A2E500D4D47AC0788B1B9507EBB1B81A137167EF61A0A6D62F77BF06D3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ID-ALL-1.1.30.exe

File Explorer

ID-ALL-1.1.30.exe

.exe 328.0MB

ID-ALL-1.1.30.exe

IMPHASH 4cfccbf6efa4240d8835ec783184038d
SHA256 f5a3473dec6631b4225e2c4d2bf4955aca078434cbd80c8128a5d983a48b2854
MD5 9f7a4ea598974da4d9956a063d1ac790
SHA1 12f3e04774e88593770a4364b935166a806089e2
SHA512 6986251b5f7fbe9091dc4964199ab0c866d261db0c45d654e26a97511a536e44a08430fe8f010c7aceacc2b670450f23d9f224312974a22f65f4b338d408e824
SSDEEP 6291456:F/QbF8oV19ptz3CrMLwIPaJ9G4Nq9kbGnk1QyCjN1zAn1ncJQ:qbF8oV19ptLCtIyJ9AIj4jPU1ncJQ
TLSH
T186F83387A2E500D4D47AC0788B1B9507EBB1B81A137167EF61A0A6D62F77BF06D3E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fd:a9:81:d9:70:b6:89:7d:95:53:73:24:b4:48:91:c9:79:18:ce:24:66:55:6e:f9:69:7b:73:e0:10:bb:aa:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=510131930,CN=cardPresso\, Lda,O=cardPresso\, Lda,ST=Região Autónoma da Madeira,C=PT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025054

Chains

Aug 26, 2026

SERIALNUMBER=510131930,CN=cardPresso\, Lda,O=cardPresso\, Lda,ST=Região Autónoma da Madeira,C=PT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025054

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

SERIALNUMBER=510131930,CN=cardPresso\, Lda,O=cardPresso\, Lda,ST=Região Autónoma da Madeira,C=PT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025054

Serial Number

96:ed:9d:c5:29:2e:33:be:2a:93:22:64:5e:9b:78:2a

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 21, 2025 - Jan 21, 2028

Minor OS version

Major OS version

Entry point

14045232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\ID-ALLCMakeWinAgent1\_work\6\s\cardPresso\cardPresso\cpII\installer\x64\Release\cpInstaller.pdb

kernel32

K32EnumProcessModules K32EnumProcesses SetDllDirectoryW LocalFree LocalAlloc OpenProcess K32GetModuleBaseNameW LoadLibraryW GetProcAddress FreeLibrary GetFileAttributesW CreateFileW SetFileTime SetFileAttributesW FindFirstFileW FindNextFileW FindClose WriteConsoleW HeapSize GetProcessHeap GetOEMCP IsValidCodePage SetEnvironmentVariableW HeapReAlloc EnumSystemLocalesW IsValidLocale HeapAlloc HeapFree CloseHandle OutputDebugStringW DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException DecodePointer SetStdHandle GetConsoleOutputCP ReadConsoleW GetConsoleMode FreeLibraryAndExitThread ExitThread GetCommandLineA ExitProcess RtlUnwind SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx GetCPInfo GetStringTypeW FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive lstrcmpW GetModuleHandleW WTSGetActiveConsoleSessionId GlobalAlloc GlobalSize GlobalUnlock GlobalLock GetACP GetCurrentThreadId CheckRemoteDebuggerPresent ExpandEnvironmentStringsW CreateProcessW GetLocaleInfoW LoadLibraryA GetCurrentProcessId GetFileSizeEx ReadFile SetFilePointer WriteFile CreateFileMappingW MapViewOfFile UnmapViewOfFile WideCharToMultiByte GetVolumeInformationW GetDriveTypeW GetConsoleWindow GetUserDefaultLocaleName GetUserDefaultLangID GetLongPathNameW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DisconnectNamedPipe WaitNamedPipeW WaitForMultipleObjectsEx ConnectNamedPipe CreateNamedPipeW GetOverlappedResult SetEvent ResetEvent WaitForSingleObject CreateEventW GetCurrentProcess FormatMessageW WaitForMultipleObjects GlobalFree CompareStringEx GetCommandLineW AllocConsole FreeConsole AttachConsole GetSystemTime GetLocalTime QueryPerformanceCounter QueryPerformanceFrequency GetSystemDirectoryW LoadLibraryExW GetCurrentPackageFullName DuplicateHandle Sleep CreateThread GetCurrentThread SetThreadPriority GetThreadPriority TerminateThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo WaitForSingleObjectEx GetDateFormatW GetTimeFormatW GetCurrencyFormatW GetUserDefaultLCID GetUserPreferredUILanguages GetFileAttributesExW MultiByteToWideChar TerminateProcess IsProcessorFeaturePresent GetComputerNameExW CompareStringW LCMapStringW CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait PeekNamedPipe CancelIoEx GetModuleFileNameW GetTimeZoneInformation GetCurrentDirectoryW CreateDirectoryW DeleteFileW GetFileInformationByHandle GetFullPathNameW GetLogicalDrives RemoveDirectoryW GetTempPathW GetVolumePathNamesForVolumeNameW SetErrorMode DeviceIoControl CopyFileW MoveFileW MoveFileExW TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetFileInformationByHandleEx FlushFileBuffers GetFileType SetEndOfFile SetFilePointerEx GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW GetExitCodeProcess GetProcessId GetModuleHandleExW FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification GetGeoInfoW GetUserGeoID FindFirstFileExW K32GetModuleFileNameExW ReleaseMutex CreateMutexW VirtualAlloc VirtualFree InitializeCriticalSectionAndSpinCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader InitializeSRWLock

user32

GetDC ReleaseDC GetSysColor GetDesktopWindow SystemParametersInfoW DefWindowProcW GetDoubleClickTime IsWindow MessageBeep GetCaretBlinkTime DestroyIcon UpdateLayeredWindowIndirect GetKeyboardLayoutList RegisterWindowMessageW RegisterPowerSettingNotification UnregisterPowerSettingNotification GetClassInfoW RegisterClassExW CreateWindowExW SetWindowPos GetWindowPlacement IsZoomed GetFocus InvalidateRect GetClientRect GetCursorPos ClientToScreen ScreenToClient WindowFromPoint ChildWindowFromPointEx GetWindowLongPtrW GetParent LoadImageW SystemParametersInfoForDpi GetThreadDpiAwarenessContext GetWindowDpiAwarenessContext GetAwarenessFromDpiAwarenessContext AreDpiAwarenessContextsEqual EnableNonClientDpiScaling SetProcessDpiAwarenessContext ChangeWindowMessageFilter RegisterClipboardFormatW GetClipboardFormatNameW RegisterClassW EnumDisplayDevicesW SendMessageW PostMessageW AttachThreadInput IsChild ShowWindow UpdateLayeredWindow SetLayeredWindowAttributes FlashWindowEx MoveWindow DestroyWindow IsWindowVisible IsIconic SetFocus RegisterTouchWindow UnregisterTouchWindow IsTouchWindow GetCapture SetCapture ReleaseCapture GetSystemMetricsForDpi GetMenu GetSystemMenu EnableMenuItem GetForegroundWindow SetForegroundWindow BeginPaint EndPaint GetUpdateRect SetWindowRgn SetWindowTextW GetWindowRect AdjustWindowRectEx AdjustWindowRectExForDpi SetCursor SetWindowLongPtrW SetParent GetWindowThreadProcessId GetWindow DestroyCursor MonitorFromPoint MonitorFromWindow GetMonitorInfoW GetDpiForWindow GetAncestor LoadIconW IsHungAppWindow SetClipboardViewer ChangeClipboardChain AddClipboardFormatListener RemoveClipboardFormatListener SetMenu DrawMenuBar CreateMenu CreatePopupMenu DestroyMenu InsertMenuW AppendMenuW ModifyMenuW RemoveMenu TrackPopupMenu GetMenuItemInfoW SetMenuItemInfoW GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo EnumDisplayMonitors GetMessageW SendInput GetPointerInfo GetKeyboardLayout IsWindowEnabled CreateCaret DestroyCaret ShowCaret SetCaretPos FindWindowA PeekMessageW GetKeyState GetKeyboardState ToAscii ToUnicode MapVirtualKeyW HiliteMenuItem TrackPopupMenuEx SetMenuDefaultItem SetCursorPos GetCursor LoadCursorW CreateCursor CreateIconIndirect GetIconInfo GetCursorInfo TrackMouseEvent GetMessageExtraInfo GetAsyncKeyState GetTouchInputInfo CloseTouchInputHandle GetPointerType GetPointerFrameTouchInfo GetPointerFrameTouchInfoHistory GetPointerPenInfo GetPointerPenInfoHistory SkipPointerFrameMessages GetPointerDeviceRects ChangeWindowMessageFilterEx DrawIconEx MessageBoxW CharNextExA TranslateMessage DispatchMessageW GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer SetCoalescableTimer KillTimer PostThreadMessageW EnumWindows RegisterDeviceNotificationW UnregisterDeviceNotification GetSystemMetrics UnregisterClassW SetWindowPlacement

advapi32

SetSecurityDescriptorDacl SystemFunction036 AddAccessAllowedAceEx GetSidSubAuthority RegOpenKeyExW RegNotifyChangeKeyValue GetUserNameW LookupAccountNameW SetSecurityDescriptorOwner SetSecurityDescriptorGroup InitializeAcl GetTokenInformation GetLengthSid AddAccessAllowedAce OpenProcessToken AddAccessDeniedAceEx CopySid DuplicateToken LookupAccountSidW GetNamedSecurityInfoW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegFlushKey AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetFileSecurityW GetSidSubAuthorityCount RegCloseKey RegCreateKeyExA RegDeleteKeyA RegEnumKeyExA RegOpenKeyA SetEntriesInAclW RegEnumValueW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW SHGetFileInfoW SHCreateDirectoryExW SHGetKnownFolderPath ShellExecuteExW SHGetStockIconInfo ord727 SHCreateItemFromIDList Shell_NotifyIconGetRect SHGetMalloc SHGetPathFromIDListW SHGetKnownFolderIDList SHBrowseForFolderW ShellExecuteW Shell_NotifyIconW SHCreateItemFromParsingName

oleaut32

SysFreeString SetErrorInfo GetErrorInfo VariantInit SafeArrayCreateVector SafeArrayPutElement SysAllocString VariantClear SysStringLen

imm32

ImmGetContext ImmReleaseContext ImmAssociateContext ImmGetVirtualKey ImmAssociateContextEx ImmGetDefaultIMEWnd ImmGetOpenStatus ImmNotifyIME ImmSetCompositionWindow ImmSetCandidateWindow ImmGetCompositionStringW

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiOpenDeviceInterfaceW SetupDiOpenDevRegKey

shlwapi

SHCreateStreamOnFileEx AssocQueryStringW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

api-ms-win-shcore-scaling-l1-1-1

GetProcessDpiAwareness GetDpiForMonitor SetProcessDpiAwareness

d3d9

Direct3DCreate9

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertVerifyTimeValidity CertFindChainInStore PFXImportCertStore CertFreeCertificateChain CertGetCertificateChain CertCreateCertificateContext CertOpenStore CertOpenSystemStoreW CertFindCertificateInStore CertCloseStore CertAddCertificateContextToStore CertAddStoreToCollection

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider

dwmapi

DwmEnableBlurBehindWindow DwmDefWindowProc DwmExtendFrameIntoClientArea DwmGetWindowAttribute DwmSetWindowAttribute

uxtheme

GetThemeBackgroundRegion GetThemePartSize CloseThemeData IsThemeBackgroundPartiallyTransparent GetThemeColor GetThemeBool GetThemeInt ord47 GetThemeTransitionDuration GetThemeEnumValue DrawThemeTextEx SetWindowThemeAttribute GetThemeSysFont DrawThemeBackground OpenThemeData GetCurrentThemeName IsAppThemed IsThemeActive SetWindowTheme GetThemePropertyOrigin GetThemeMargins

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

dwrite

DWriteCreateFactory

iphlpapi

ConvertInterfaceLuidToGuid ConvertInterfaceIndexToLuid ConvertInterfaceLuidToIndex ConvertInterfaceLuidToNameW ConvertInterfaceNameToLuidW GetAdaptersAddresses

secur32

DecryptMessage AcquireCredentialsHandleW FreeCredentialsHandle InitializeSecurityContextW AcceptSecurityContext DeleteSecurityContext ApplyControlToken QueryContextAttributesW FreeContextBuffer InitSecurityInterfaceW EncryptMessage

winhttp

WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpOpen WinHttpGetIEProxyConfigForCurrentUser WinHttpGetDefaultProxyConfiguration

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

userenv

GetUserProfileDirectoryW

authz

AuthzInitializeContextFromSid AuthzInitializeContextFromToken AuthzFreeResourceManager AuthzInitializeResourceManager AuthzAccessCheck AuthzFreeContext

netapi32

NetShareEnum NetApiBufferFree

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

PlaySoundW timeSetEvent timeKillEvent

ws2_32

WSAAsyncSelect WSASocketW WSASendTo WSASend WSARecvFrom WSARecv WSANtohs WSANtohl WSAIoctl WSAHtonl WSAConnect WSAAccept WSAStartup setsockopt select WSACleanup getsockopt closesocket getnameinfo freeaddrinfo listen htons getsockname getaddrinfo ntohl htonl __WSAFDIsSet bind WSAGetLastError getpeername

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

gdi32

DescribePixelFormat GetPixelFormat SwapBuffers GetBitmapBits GetObjectW GetDIBits EnumFontFamiliesExW GetFontData AddFontResourceExW CreateDCW CreateCompatibleDC CreateRectRgn DeleteDC DeleteObject GetRegionData SelectClipRgn SelectObject CreateDIBSection GdiFlush BitBlt CreateBitmap CombineRgn GetDeviceCaps ChoosePixelFormat SetPixelFormat CreateFontIndirectW OffsetRgn SetLayout RemoveFontResourceExW ExtTextOutW SetWorldTransform SetTextAlign SetTextColor SetGraphicsMode SetBkMode GetCharABCWidthsI GetCharWidthI GetTextExtentPoint32W GetOutlineTextMetricsW GetGlyphOutlineW GetCharABCWidthsFloatW GetCharABCWidthsW GetStockObject GetTextFaceW GetTextMetricsW RemoveFontMemResourceEx AddFontMemResourceEx CreateCompatibleBitmap

comdlg32

GetOpenFileNameW GetSaveFileNameW

ole32

CoGetMalloc StringFromGUID2 CoCreateGuid CoUninitialize CoInitializeEx CoCreateFreeThreadedMarshaler DoDragDrop OleIsCurrentClipboard OleGetClipboard OleSetClipboard RevokeDragDrop RegisterDragDrop CoLockObjectExternal ReleaseStgMedium CoTaskMemFree OleUninitialize OleInitialize CoCreateInstance OleFlushClipboard

opengl32

glLoadMatrixf glMatrixMode glOrtho glLoadIdentity

??0QuaAdler32@@QEAA@$$QEAV0@@Z ??0QuaAdler32@@QEAA@AEBV0@@Z ??0QuaAdler32@@QEAA@XZ ??0QuaChecksum32@@QEAA@$$QEAV0@@Z ??0QuaChecksum32@@QEAA@AEBV0@@Z ??0QuaChecksum32@@QEAA@XZ ??0QuaCrc32@@QEAA@$$QEAV0@@Z ??0QuaCrc32@@QEAA@AEBV0@@Z ??0QuaCrc32@@QEAA@XZ ??0QuaZIODevice@@QEAA@PEAVQIODevice@@PEAVQObject@@@Z ??0QuaZip@@QEAA@AEBVQString@@@Z ??0QuaZip@@QEAA@PEAVQIODevice@@@Z ??0QuaZip@@QEAA@XZ ??0QuaZipDir@@QEAA@AEBV0@@Z ??0QuaZipDir@@QEAA@PEAVQuaZip@@AEBVQString@@@Z ??0QuaZipFile@@QEAA@AEBVQString@@0W4CaseSensitivity@QuaZip@@PEAVQObject@@@Z ??0QuaZipFile@@QEAA@AEBVQString@@PEAVQObject@@@Z ??0QuaZipFile@@QEAA@PEAVQObject@@@Z ??0QuaZipFile@@QEAA@PEAVQuaZip@@PEAVQObject@@@Z ??0QuaZipFile@@QEAA@XZ ??0QuaZipFileInfo64@@QEAA@$$QEAU0@@Z ??0QuaZipFileInfo64@@QEAA@AEBU0@@Z ??0QuaZipFileInfo64@@QEAA@XZ ??0QuaZipFileInfo@@QEAA@$$QEAU0@@Z ??0QuaZipFileInfo@@QEAA@AEBU0@@Z ??0QuaZipFileInfo@@QEAA@XZ ??0QuaZipNewInfo@@QEAA@$$QEAU0@@Z ??0QuaZipNewInfo@@QEAA@AEBU0@@Z ??0QuaZipNewInfo@@QEAA@AEBUQuaZipFileInfo64@@@Z ??0QuaZipNewInfo@@QEAA@AEBUQuaZipFileInfo@@@Z ??0QuaZipNewInfo@@QEAA@AEBVQString@@0@Z ??0QuaZipNewInfo@@QEAA@AEBVQString@@@Z ??1QuaZIODevice@@UEAA@XZ ??1QuaZip@@QEAA@XZ ??1QuaZipDir@@QEAA@XZ ??1QuaZipFile@@UEAA@XZ ??1QuaZipFileInfo64@@QEAA@XZ ??1QuaZipFileInfo@@QEAA@XZ ??1QuaZipNewInfo@@QEAA@XZ ??4JlCompress@@QEAAAEAV0@$$QEAV0@@Z ??4JlCompress@@QEAAAEAV0@AEBV0@@Z ??4QuaAdler32@@QEAAAEAV0@$$QEAV0@@Z ??4QuaAdler32@@QEAAAEAV0@AEBV0@@Z ??4QuaChecksum32@@QEAAAEAV0@$$QEAV0@@Z ??4QuaChecksum32@@QEAAAEAV0@AEBV0@@Z ??4QuaCrc32@@QEAAAEAV0@$$QEAV0@@Z ??4QuaCrc32@@QEAAAEAV0@AEBV0@@Z ??4QuaZipDir@@QEAAAEAV0@AEBV0@@Z ??4QuaZipFileInfo64@@QEAAAEAU0@$$QEAU0@@Z ??4QuaZipFileInfo64@@QEAAAEAU0@AEBU0@@Z ??4QuaZipFileInfo@@QEAAAEAU0@$$QEAU0@@Z ??4QuaZipFileInfo@@QEAAAEAU0@AEBU0@@Z ??4QuaZipNewInfo@@QEAAAEAU0@$$QEAU0@@Z ??4QuaZipNewInfo@@QEAAAEAU0@AEBU0@@Z ??8QuaZipDir@@QEAA_NAEBV0@@Z ??9QuaZipDir@@QEAA_NAEBV0@@Z ??AQuaZipDir@@QEBA?AVQString@@H@Z ??_7QuaAdler32@@6B@ ??_7QuaChecksum32@@6B@ ??_7QuaCrc32@@6B@ ??_7QuaZIODevice@@6B@ ??_7QuaZipFile@@6B@ ?atEnd@QuaZipFile@@UEBA_NXZ ?bytesAvailable@QuaZipFile@@UEBA_JXZ ?calculate@QuaAdler32@@UEAAIAEBVQByteArray@@@Z ?calculate@QuaCrc32@@UEAAIAEBVQByteArray@@@Z ?caseSensitivity@QuaZipDir@@QEBA?AW4CaseSensitivity@QuaZip@@XZ ?cd@QuaZipDir@@QEAA_NAEBVQString@@@Z ?cdUp@QuaZipDir@@QEAA_NXZ ?close@QuaZIODevice@@UEAAXXZ ?close@QuaZip@@QEAAXXZ ?close@QuaZipFile@@UEAAXXZ ?compressDir@JlCompress@@SA_NVQString@@0_N@Z ?compressFile@JlCompress@@CA_NPEAVQuaZip@@VQString@@1@Z ?compressFile@JlCompress@@SA_NVQString@@0@Z ?compressFiles@JlCompress@@SA_NVQString@@V?$QList@VQString@@@@@Z ?compressSubDir@JlCompress@@CA_NPEAVQuaZip@@VQString@@1_N@Z ?convertCaseSensitivity@QuaZip@@SA?AW4CaseSensitivity@Qt@@W421@@Z ?count@QuaZipDir@@QEBAIXZ ?csize@QuaZipFile@@QEBA_JXZ ?dirName@QuaZipDir@@QEBA?AVQString@@XZ ?entryInfoList64@QuaZipDir@@QEBA?AV?$QList@UQuaZipFileInfo64@@@@AEBV?$QList@VQString@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z ?entryInfoList64@QuaZipDir@@QEBA?AV?$QList@UQuaZipFileInfo64@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z ?entryInfoList@QuaZipDir@@QEBA?AV?$QList@UQuaZipFileInfo@@@@AEBV?$QList@VQString@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z ?entryInfoList@QuaZipDir@@QEBA?AV?$QList@UQuaZipFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z ?entryList@QuaZipDir@@QEBA?AV?$QList@VQString@@@@AEBV2@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z ?entryList@QuaZipDir@@QEBA?AV?$QList@VQString@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z ?exists@QuaZipDir@@QEBA_NAEBVQString@@@Z ?exists@QuaZipDir@@QEBA_NXZ ?extractDir@JlCompress@@SA?AV?$QList@VQString@@@@VQString@@0@Z ?extractDirEx@JlCompress@@SA?AV?$QList@VQString@@@@VQString@@0PEAVQTextCodec@@@Z ?extractDirToSpecifiedPath@JlCompress@@SA?AV?$QList@VQString@@@@VQString@@000@Z ?extractFile@JlCompress@@CA_NPEAVQuaZip@@VQString@@1@Z ?extractFile@JlCompress@@SA?AVQString@@V2@00@Z ?extractFiles@JlCompress@@SA?AV?$QList@VQString@@@@VQString@@V2@0@Z ?filePath@QuaZipDir@@QEBA?AVQString@@AEBV2@@Z ?filter@QuaZipDir@@QEAA?AV?$QFlags@W4Filter@QDir@@@@XZ ?flush@QuaZIODevice@@UEAA_NXZ ?getActualFileName@QuaZipFile@@QEBA?AVQString@@XZ ?getCaseSensitivity@QuaZipFile@@QEBA?AW4CaseSensitivity@QuaZip@@XZ ?getComment@QuaZip@@QEBA?AVQString@@XZ ?getCommentCodec@QuaZip@@QEBAPEAVQTextCodec@@XZ ?getCurrentFileInfo@QuaZip@@QEBA_NPEAUQuaZipFileInfo64@@@Z ?getCurrentFileInfo@QuaZip@@QEBA_NPEAUQuaZipFileInfo@@@Z ?getCurrentFileName@QuaZip@@QEBA?AVQString@@XZ ?getEntriesCount@QuaZip@@QEBAHXZ ?getFileInfo@QuaZipFile@@QEAA_NPEAUQuaZipFileInfo64@@@Z ?getFileInfo@QuaZipFile@@QEAA_NPEAUQuaZipFileInfo@@@Z ?getFileInfoList64@QuaZip@@QEBA?AV?$QList@UQuaZipFileInfo64@@@@XZ ?getFileInfoList@QuaZip@@QEBA?AV?$QList@UQuaZipFileInfo@@@@XZ ?getFileList@JlCompress@@SA?AV?$QList@VQString@@@@VQString@@@Z ?getFileList@JlCompress@@SA?AV?$QList@VQString@@@@VQString@@AEBV2@@Z ?getFileList@JlCompress@@SA?AV?$QList@VQString@@@@VQString@@AEBV2@AEB_N@Z ?getFileName@QuaZipFile@@QEBA?AVQString@@XZ ?getFileNameCodec@QuaZip@@QEBAPEAVQTextCodec@@XZ ?getFileNameList@QuaZip@@QEBA?AV?$QList@VQString@@@@XZ ?getIoDevice@QuaZIODevice@@QEBAPEAVQIODevice@@XZ ?getIoDevice@QuaZip@@QEBAPEAVQIODevice@@XZ ?getMode@QuaZip@@QEBA?AW4Mode@1@XZ ?getNTFSaTime@QuaZipFileInfo64@@QEBA?AVQDateTime@@PEAH@Z ?getNTFScTime@QuaZipFileInfo64@@QEBA?AVQDateTime@@PEAH@Z ?getNTFSmTime@QuaZipFileInfo64@@QEBA?AVQDateTime@@PEAH@Z ?getPermissions@QuaZipFileInfo64@@QEBA?AV?$QFlags@W4Permission@QFileDevice@@@@XZ ?getPermissions@QuaZipFileInfo@@QEBA?AV?$QFlags@W4Permission@QFileDevice@@@@XZ ?getUnzFile@QuaZip@@QEAAPEAXXZ ?getZip@QuaZipFile@@QEBAPEAVQuaZip@@XZ ?getZipError@QuaZip@@QEBAHXZ ?getZipError@QuaZipFile@@QEBAHXZ ?getZipFile@QuaZip@@QEAAPEAXXZ ?getZipName@QuaZip@@QEBA?AVQString@@XZ ?getZipName@QuaZipFile@@QEBA?AVQString@@XZ ?goToFirstFile@QuaZip@@QEAA_NXZ ?goToNextFile@QuaZip@@QEAA_NXZ ?hasCurrentFile@QuaZip@@QEBA_NXZ ?isAutoClose@QuaZip@@QEBA_NXZ ?isDataDescriptorWritingEnabled@QuaZip@@QEBA_NXZ ?isOpen@QuaZip@@QEBA_NXZ ?isRaw@QuaZipFile@@QEBA_NXZ ?isRoot@QuaZipDir@@QEBA_NXZ ?isSequential@QuaZIODevice@@UEBA_NXZ ?isSequential@QuaZipFile@@UEBA_NXZ ?isZip64Enabled@QuaZip@@QEBA_NXZ ?metaObject@QuaZIODevice@@UEBAPEBUQMetaObject@@XZ ?metaObject@QuaZipFile@@UEBAPEBUQMetaObject@@XZ ?nameFilters@QuaZipDir@@QEBA?AV?$QList@VQString@@@@XZ ?open@QuaZIODevice@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z ?open@QuaZip@@QEAA_NW4Mode@1@PEAUzlib_filefunc_def_s@@@Z ?open@QuaZipFile@@QEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@AEBUQuaZipNewInfo@@PEBDIHH_NHHH@Z ?open@QuaZipFile@@QEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@PEAH1_NPEBD@Z ?open@QuaZipFile@@QEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@PEBD@Z ?open@QuaZipFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z ?path@QuaZipDir@@QEBA?AVQString@@XZ ?pos@QuaZipFile@@UEBA_JXZ ?qt_metacall@QuaZIODevice@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z ?qt_metacall@QuaZipFile@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z ?qt_metacast@QuaZIODevice@@UEAAPEAXPEBD@Z ?qt_metacast@QuaZipFile@@UEAAPEAXPEBD@Z ?qt_static_metacall@QuaZIODevice@@CAXPEAVQObject@@W4Call@QMetaObject@@HPEAPEAX@Z ?qt_static_metacall@QuaZipFile@@CAXPEAVQObject@@W4Call@QMetaObject@@HPEAPEAX@Z ?readData@QuaZIODevice@@MEAA_JPEAD_J@Z ?readData@QuaZipFile@@MEAA_JPEAD_J@Z ?relativeFilePath@QuaZipDir@@QEBA?AVQString@@AEBV2@@Z ?removeFile@JlCompress@@CA_NV?$QList@VQString@@@@@Z ?reset@QuaAdler32@@UEAAXXZ ?reset@QuaCrc32@@UEAAXXZ ?setAutoClose@QuaZip@@QEBAX_N@Z ?setCaseSensitivity@QuaZipDir@@QEAAXW4CaseSensitivity@QuaZip@@@Z ?setComment@QuaZip@@QEAAXAEBVQString@@@Z ?setCommentCodec@QuaZip@@QEAAXPEAVQTextCodec@@@Z ?setCommentCodec@QuaZip@@QEAAXPEBD@Z ?setCurrentFile@QuaZip@@QEAA_NAEBVQString@@W4CaseSensitivity@1@@Z ?setDataDescriptorWritingEnabled@QuaZip@@QEAAX_N@Z ?setDefaultFileNameCodec@QuaZip@@SAXPEAVQTextCodec@@@Z ?setDefaultFileNameCodec@QuaZip@@SAXPEBD@Z ?setFileDateTime@QuaZipNewInfo@@QEAAXAEBVQString@@@Z ?setFileNTFSTimes@QuaZipNewInfo@@QEAAXAEBVQString@@@Z ?setFileNTFSaTime@QuaZipNewInfo@@QEAAXAEBVQDateTime@@H@Z ?setFileNTFScTime@QuaZipNewInfo@@QEAAXAEBVQDateTime@@H@Z ?setFileNTFSmTime@QuaZipNewInfo@@QEAAXAEBVQDateTime@@H@Z ?setFileName@QuaZipFile@@QEAAXAEBVQString@@W4CaseSensitivity@QuaZip@@@Z ?setFileNameCodec@QuaZip@@QEAAXPEAVQTextCodec@@@Z ?setFileNameCodec@QuaZip@@QEAAXPEBD@Z ?setFilePermissions@QuaZipNewInfo@@QEAAXAEBVQString@@@Z ?setFilter@QuaZipDir@@QEAAXV?$QFlags@W4Filter@QDir@@@@@Z ?setIoDevice@QuaZip@@QEAAXPEAVQIODevice@@@Z ?setNameFilters@QuaZipDir@@QEAAXAEBV?$QList@VQString@@@@@Z ?setPath@QuaZipDir@@QEAAXAEBVQString@@@Z ?setPermissions@QuaZipNewInfo@@QEAAXV?$QFlags@W4Permission@QFileDevice@@@@@Z ?setSorting@QuaZipDir@@QEAAXV?$QFlags@W4SortFlag@QDir@@@@@Z ?setZip64Enabled@QuaZip@@QEAAX_N@Z ?setZip@QuaZipFile@@QEAAXPEAVQuaZip@@@Z ?setZipName@QuaZip@@QEAAXAEBVQString@@@Z ?setZipName@QuaZipFile@@QEAAXAEBVQString@@@Z ?size@QuaZipFile@@UEBA_JXZ ?sorting@QuaZipDir@@QEBA?AV?$QFlags@W4SortFlag@QDir@@@@XZ ?staticMetaObject@QuaZIODevice@@2UQMetaObject@@B ?staticMetaObject@QuaZipFile@@2UQMetaObject@@B ?toQuaZipFileInfo@QuaZipFileInfo64@@QEBA_NAEAUQuaZipFileInfo@@@Z ?tr@QuaZIODevice@@SA?AVQString@@PEBD0H@Z ?tr@QuaZipFile@@SA?AVQString@@PEBD0H@Z ?update@QuaAdler32@@UEAAXAEBVQByteArray@@@Z ?update@QuaCrc32@@UEAAXAEBVQByteArray@@@Z ?usize@QuaZipFile@@QEBA_JXZ ?value@QuaAdler32@@UEAAIXZ ?value@QuaCrc32@@UEAAIXZ ?writeData@QuaZIODevice@@MEAA_JPEBD_J@Z ?writeData@QuaZipFile@@MEAA_JPEBD_J@Z qt_startup_hook

Name

.text

Size

13.7MB

Virtual Size

13.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

175KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

652KB

Virtual Size

652KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmimed

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ID-ALL-1.1.30.exe

PE Signature issue

kernel32

user32

advapi32

shell32

oleaut32

imm32

setupapi

shlwapi

wtsapi32

api-ms-win-shcore-scaling-l1-1-1

d3d9

crypt32

bcrypt

dwmapi

uxtheme

d3d11

dxgi

dwrite

iphlpapi

secur32

winhttp

api-ms-win-core-synch-l1-2-0

userenv

authz

netapi32

version

winmm

ws2_32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

gdi32

comdlg32

ole32

opengl32

generic