Beauty Box[.]aex | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Beauty Box.aex
Size 31.0MB
Sample261014-fwslmsgw2q
SHA256 93b274c174dba19981a038b9ad3148339516caea80f65cac4f404f7202fae1b2
MD5 3e51adc4edb39ada0936dd59b90aabae
SHA1 1d14b06b3f2d9d44b4b11ac83f3aa2d040b327b6
SHA512 4a09928344e0266f9f9b38ab83ad048f84639560491700109487881113ea72357e2b9caf43ab9178e6a123f3769de3feb2d0be6c4e93e0e284b69811796d998e
SSDEEP 393216:i7NKJVPPJrLZzr4e9hx/uxYsdMsc1KOUmM3xKkMnJY1dMxNh6sILKVjOBVK36KrG:i7cTC/Ihx5Vj4VKKKr7TCoy
TLSH
T14C67BF56B1ADA1C9C43BE079566B2903FB71340B03154AF366A094A51F27BE06FFFB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
Beauty Box.aex

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

File Explorer

Beauty Box.aex

.dll 31.0MB

Beauty Box.aex

IMPHASH 99e0ab0ba69e310410e0ce2d27a8c04e
SHA256 93b274c174dba19981a038b9ad3148339516caea80f65cac4f404f7202fae1b2
MD5 3e51adc4edb39ada0936dd59b90aabae
SHA1 1d14b06b3f2d9d44b4b11ac83f3aa2d040b327b6
SHA512 4a09928344e0266f9f9b38ab83ad048f84639560491700109487881113ea72357e2b9caf43ab9178e6a123f3769de3feb2d0be6c4e93e0e284b69811796d998e
SSDEEP 393216:i7NKJVPPJrLZzr4e9hx/uxYsdMsc1KOUmM3xKkMnJY1dMxNh6sILKVjOBVK36KrG:i7cTC/Ihx5Vj4VKKKr7TCoy
TLSH
T14C67BF56B1ADA1C9C43BE079566B2903FB71340B03154AF366A094A51F27BE06FFFB12
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.
Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.

PE Signature issue

Digest

f4:4b:45:21:f2:3c:e1:08:ee:3a:8d:18:d6:20:eb:61:23:e5:f6:df:0d:91:d8:21:de:cc:93:1f:5c:be:c1:a1

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2244549,CN=Digital Anarchy\, Inc.,O=Digital Anarchy\, Inc.,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

May 29, 2025

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

45:41:5a:cf:a3:d5:2f:4a:07:a5:cd:29:54:2f:32:8b

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 8, 2024 - Oct 8, 2027

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

20394764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Jenkins\workspace\beautybox_main\build\win64_optdebug\Beauty Box.pdb

kernel32

DeleteCriticalSection LeaveCriticalSection InitializeCriticalSection GetSystemInfo GetExitCodeThread FindNextFileW FindFirstFileW FindClose WideCharToMultiByte MultiByteToWideChar GlobalAddAtomW DeleteAtom CreateProcessW CreateSemaphoreW WaitForSingleObject ReleaseSemaphore LocalFree InitializeSListHead DisableThreadLibraryCalls QueryPerformanceCounter IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode SystemTimeToFileTime GetSystemTime GetACP GetSystemTimeAsFileTime GetCurrentProcessId CloseHandle GetTempPathW GetTempFileNameW VirtualQuery Sleep LoadLibraryExA TryEnterCriticalSection EnterCriticalSection QueryActCtxW FindActCtxSectionStringW CreateSemaphoreA WriteFile GetFileType GetStdHandle GetEnvironmentVariableW VirtualFree DeactivateActCtx ActivateActCtx CreateActCtxW LoadLibraryW GetProcAddress GetModuleHandleExW GetModuleFileNameW OutputDebugStringA TlsFree TlsSetValue FormatMessageA GetSystemDirectoryA GetCurrentThreadId RtlVirtualUnwind FreeLibrary AcquireSRWLockShared ReleaseSRWLockShared GetModuleHandleA GetLogicalProcessorInformationEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock DeleteFileW CreateDirectoryW VirtualProtect RaiseException GetModuleHandleW GetCurrentProcess GetEnvironmentVariableA LoadLibraryA InitOnceExecuteOnce CreateMutexA ReleaseMutex SetUnhandledExceptionFilter GetLastError SetLastError TlsAlloc TlsGetValue

user32

DialogBoxIndirectParamW SystemParametersInfoW MapDialogRect IsDialogMessageW LoadCursorW GetWindow GetParent SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW SetRect DrawFocusRect ScreenToClient SetCursor MessageBoxW MessageBoxA GetWindowRect GetClientRect GetWindowTextW GetWindowTextA SetWindowTextW SetWindowTextA RemovePropW EndDialog DefWindowProcW RegisterClassW UnregisterClassW CreateWindowExW BeginPaint EndPaint LoadIconW GetProcessWindowStation GetUserObjectInformationW SetPropW ReleaseDC GetDC GetSystemMetrics EnableWindow ReleaseCapture SetCapture IsDlgButtonChecked CheckRadioButton GetDlgItem CreateDialogIndirectParamW SetWindowPos MoveWindow ShowWindow DestroyWindow IsWindow CreateWindowExA CallWindowProcW GetPropW TranslateMessage DispatchMessageW PeekMessageW SendMessageW PostMessageW WaitMessage WaitForInputIdle

gdi32

DescribePixelFormat ChoosePixelFormat CreateFontIndirectW GetStockObject SetTextColor GetObjectW DeleteObject SetPixelFormat

advapi32

CryptSignHashW CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegQueryValueExA GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken RegEnumValueA CryptCreateHash CryptDestroyHash CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource RegQueryValueExW RegOpenKeyExA RegCloseKey CryptEnumProvidersW CryptDecrypt

shell32

SHGetFolderPathW SHGetKnownFolderPath ShellExecuteA

ole32

CoInitializeSecurity CoSetProxyBlanket StringFromGUID2 CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantClear

cfgmgr32

CM_Open_DevNode_Key CM_Get_Device_IDW CM_Get_Device_ID_ListW CM_Get_Device_ID_List_SizeW CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status CM_Get_Sibling CM_Locate_DevNodeW CM_Get_Child

api-ms-win-core-winrt-l1-1-0

RoUninitialize RoInitialize

glu32

gluErrorString

opengl32

glDisable glDeleteTextures glColorMask glColor4f glClearColor glGetError glBindTexture glFlush glFinish wglMakeCurrent glDrawBuffer glGetIntegerv glGetString glReadBuffer glTexParameteriv glLoadIdentity glMatrixMode glOrtho glViewport glClear wglCreateContext wglDeleteContext wglGetProcAddress glVertexPointer glVertex2i glVertex2f glTexSubImage2D glTexParameteri glTexImage2D glTexCoordPointer glTexCoord2i glReadPixels glRasterPos2i glPushAttrib glPopAttrib glPixelZoom glPixelTransferi glPixelTransferf glPixelStorei glHint glGetTexImage glGenTextures glEnd glEnableClientState glEnable glDrawPixels glDrawElements glDrawArrays glDisableClientState glCopyTexSubImage2D glCopyPixels glBlendFunc glBitmap glBegin wglShareLists wglGetCurrentDC wglGetCurrentContext

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW

ws2_32

getsockopt gethostbyname ntohs select getsockname ioctlsocket WSACleanup sendto WSAGetLastError htonl htons inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname WSASetLastError recv send closesocket connect setsockopt socket shutdown getpeername recvfrom WSAStartup

msvcp140

??7ios_base@std@@QEBA_NXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?_Xbad_alloc@std@@YAXXZ ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z ?_Xbad_function_call@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Mtx_unlock _Mtx_lock _Mtx_destroy_in_situ _Mtx_init_in_situ _Thrd_id _Thrd_join _Query_perf_frequency _Query_perf_counter ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_JD@Z ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?eof@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetCredentials WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpSetStatusCallback

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

vcomp140

omp_get_thread_num _vcomp_set_num_threads _vcomp_for_static_simple_init _vcomp_for_static_end _vcomp_fork

vcruntime140

strchr longjmp strstr strrchr __current_exception __current_exception_context memcmp _purecall __C_specific_handler memset memmove memcpy __intrinsic_setjmp _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate wcsstr __std_type_info_destroy_list memchr wcsrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_endthreadex fegetround _invalid_parameter_noinfo_noreturn strerror_s fesetround _beginthreadex terminate _exit set_terminate _errno _seh_filter_dll _initterm_e signal _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _initterm _cexit _crt_atexit raise _execute_onexit_table

api-ms-win-crt-convert-l1-1-0

strtoul strtol atof atoi strtof strtod

api-ms-win-crt-stdio-l1-1-0

ftell fclose fflush fseek fgetpos __acrt_iob_func __stdio_common_vfprintf ferror __stdio_common_vfwprintf _fileno fputs __stdio_common_vfscanf fputc _wfopen _wfopen_s _setmode fread fsetpos setvbuf __stdio_common_vsprintf_s _chsize_s __stdio_common_vsprintf _fseeki64 fwrite _get_stream_buffer_pointers feof fgets __stdio_common_vsscanf fopen __stdio_common_vswprintf __stdio_common_vswprintf_s fgetc ungetc

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 _lock_file _wstat64 _wstat64i32 _unlock_file

api-ms-win-crt-string-l1-1-0

strncpy_s wcslen _wcsicmp wcscat_s strcat_s _strdup strlen strncmp isdigit strcpy_s strncpy _wcsdup strspn strcspn strcmp iscntrl wcsncmp islower strtok wcscpy_s _stricmp isspace isalnum isalpha wcsncpy_s tolower

api-ms-win-crt-math-l1-1-0

floorf log10f sinhf fmodf coshf atanf asinf sqrtf cbrtf atanhf atan2f asinhf acosf powf sinf expf acoshf exp2f logf ceil cos exp sin truncf nearbyintf tanhf round erff modf fmaxf _dclass tanf _finite _isnan ceilf erfcf cosf roundf sqrt

api-ms-win-crt-heap-l1-1-0

malloc _callnewh realloc free _aligned_free calloc _aligned_malloc

api-ms-win-crt-time-l1-1-0

_gmtime64_s strftime _localtime64_s _time64

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-environment-l1-1-0

getenv

Name

.text

Size

19.6MB

Virtual Size

19.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.8MB

Virtual Size

10.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

99KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

388KB

Virtual Size

388KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Beauty Box.aex

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

cfgmgr32

api-ms-win-core-winrt-l1-1-0

glu32

opengl32

crypt32

ws2_32

msvcp140

winhttp

version

vcomp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic