popup

Report - vbc.exe

UPX Malicious Library DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Internet API FTP ScreenShot Http API Steal credential Downloader P2P AntiDebug AntiVM PE32 PE File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.07.30 10:33 Machine s1_win7_x6401
Filename vbc.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
 Behavior Score
11.4
ZERO API file : clean
VT API (file) 32 detected (AIDetect, malware2, malicious, high confidence, Maria, FLCO, GenericRXAA, Unsafe, Convagent, ZelphiF, eHW@aK7m, Eldorado, Attribute, HighConfidence, EPUT, AveMaria, USMANGT21, AdwareDealPly, susgen, Fareit, score, ai score=100, Behavior, GdSda)
md5 844aa82d8a7faac7c53778f82eebe8c1
sha256 def021666e187281ebe68cdde170775c13c84472199f77ee0d62a1e3ee95f4fe
ssdeep 12288:ZrSTAKfXQD39eT9ufhyGFQ1gBF8UhWdu0SAJ9mvziPkpVtSD6+1G6L:BSk+28ufhEE7r1aG1Ltwt
imphash 04e2fca09a354b909f05dafce23756a7
impfuzzy 192:f3Cnf1sT1/kbuuaxSUvK9/3oaqyrUo7CPbOQw+:f3o1scaq9AIePbOQP
  Network IP location

Signature (23cnts)

Level Description
danger Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually)
danger File has been identified by 32 AntiVirus engines on VirusTotal as malicious
watch Allocates execute permission to another process indicative of possible code injection
watch Creates a thread using CreateRemoteThread in a non-child process indicative of process injection
watch Installs itself for autorun at Windows startup
watch Manipulates memory of a non-child process indicative of process injection
watch Network activity contains more than one unique useragent
watch One or more of the buffers contains an embedded PE file
watch Potential code injection by writing to the memory of another process
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Sends data using the HTTP POST Method
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Command line console output was observed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (38cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Network_Downloader File Downloader memory
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
notice Code_injection Code injection with CreateRemoteThread in a remote process memory
notice Create_Service Create a windows service memory
notice Escalate_priviledges Escalate priviledges memory
notice KeyLogger Run a KeyLogger memory
notice local_credential_Steal Steal credential memory
notice Network_DGA Communication using DGA memory
notice Network_DNS Communications use DNS memory
notice Network_FTP Communications over FTP memory
notice Network_HTTP Communications over HTTP memory
notice Network_P2P_Win Communications over P2P network memory
notice Network_TCP_Socket Communications over RAW Socket memory
notice ScreenShot Take ScreenShot memory
notice Sniff_Audio Record Audio memory
notice Str_Win32_Http_API Match Windows Http API call memory
notice Str_Win32_Internet_API Match Windows Inet API call memory
info anti_dbg Checks if being debugged memory
info antisb_threatExpert Anti-Sandbox checks for ThreatExpert memory
info Check_Dlls (no description) memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerCheck__RemoteAPI (no description) memory
info DebuggerException__ConsoleCtrl (no description) memory
info DebuggerException__SetConsoleCtrl (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info win_hook Affect hook table memory

Network (45cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://www.bransolute.com/6mam/?t6Alv2A=3lOIhqUq6P+U3Pv+KiDZArCwgFDmfekdTy2Nm2rSf3PvYUYfwCDamY7ww9DFIoj1y02HC7Ks&PV=FjVH4F7XA4IHzH0p
whois
US UNIFIEDLAYER-AS-1 192.185.236.169 clean
http://www.cannamalism.com/6mam/
whois
US GOOGLE 34.102.136.180 clean
http://www.mobiessence.com/6mam/
whois
DE AMAZON-02 52.58.78.16 clean
http://www.fuzhourexian.com/6mam/
whois
US LEASEWEB-USA-LAX-11 108.62.76.146 clean
http://www.kykyryky.art/6mam/
whois
RU Domain names registrar REG.RU, Ltd 194.58.112.174 clean
http://www.kykyryky.art/6mam/?t6Alv2A=YhmCqIEbUGfuw5buP1ux4NwPyUbKdSmuBWvVd54Q/24mN/u1gMwH9i6nnbSMiSrA5lPx01TB&PV=FjVH4F7XA4IHzH0p
whois
RU Domain names registrar REG.RU, Ltd 194.58.112.174 clean
http://www.annettebrownlee.com/6mam/
whois
US DIGITALOCEAN-ASN 159.203.181.190 clean
http://www.lawmetricssolicitors.com/6mam/?t6Alv2A=4Gj0yn3nr4YWFpZH4qn2bQ/Mf+Y/K54EnXCw/FRHgkyWUNrW3vdYTE+qdBaiGkNQ4kKGGQ8H&PV=FjVH4F7XA4IHzH0p
whois
US IS-AS-1 66.45.250.213 clean
http://www.beastninjas.com/6mam/?t6Alv2A=oQhTdcG35KVC+c6Wc2Ae/5c2EVHHJUmgpuEXLTkVZHJt0CPiQFk8QVOcUVYqLYUeTWjjNSS/&PV=FjVH4F7XA4IHzH0p
whois
US GOOGLE 34.102.136.180 clean
http://www.beastninjas.com/6mam/
whois
US GOOGLE 34.102.136.180 clean
http://www.annettebrownlee.com/6mam/?t6Alv2A=Ha/mqQzo1OymR3PjStfn+lIoGvmqdNIZRSzA7EGDhkCDDPdeV8pHgJAz15x41PetfVMQIZVa&PV=FjVH4F7XA4IHzH0p
whois
US DIGITALOCEAN-ASN 159.203.181.190 clean
http://www.bransolute.com/6mam/
whois
US UNIFIEDLAYER-AS-1 192.185.236.169 clean
http://www.cannamalism.com/6mam/?t6Alv2A=kn71xoO9iU2mX4j71h7bz8HHhkUEjJyTF2/azklG2erytyCHrh0zJMDeYoghQinFk6RtaMTe&PV=FjVH4F7XA4IHzH0p
whois
US GOOGLE 34.102.136.180 clean
http://www.lawmetricssolicitors.com/6mam/
whois
US IS-AS-1 66.45.250.213 clean
http://www.miamiqueensdress.com/6mam/?t6Alv2A=EBok50QODh/qmCP7J2xI5qJEvLCVP7z6QxySw5ZUrU5I7S6miF2cwhtfnH/LuNQ5P6YcYCdk&PV=FjVH4F7XA4IHzH0p
whois
US AMAZON-02 75.2.115.196 clean
http://www.fuzhourexian.com/6mam/?t6Alv2A=qbpZFH7voKbXHHWLfMfEAiwyGaz4A1Dlq6aJ6MnbqPgDgfYDR2UnLoNROh/k48NFxcmn1xi3&PV=FjVH4F7XA4IHzH0p
whois
US LEASEWEB-USA-LAX-11 108.62.76.146 clean
http://www.mobiessence.com/6mam/?t6Alv2A=KE8gpfUGztMVNWKMFV5goIwNmc44LE6Oi+XDAS05rkp2RTHle1NPjBrPfhHuDJ31Wqk/Ne1S&PV=FjVH4F7XA4IHzH0p
whois
DE AMAZON-02 52.58.78.16 clean
http://www.miamiqueensdress.com/6mam/
whois
US AMAZON-02 75.2.115.196 clean
https://pxqrda.sn.files.1drv.com/y4mVUIaLYjXuhlSuH8C1Poa6N3fD118-kF46y9jgrvjs4vHSLl_xoQY8wtd55BrthF7v-t2d5iFTz3s04C-BMPlOqQiz_sp9Nq8AydX_6J43UIPYHQYcKPvL0MSauM_3AiyMxp9MgKXUTADQfTWxkAFhyB6W1aY9eGKGxPp7V9S8EPug4FwOk9pew7dmpHlBWZpLVhDGiWIkVKnKs_kwtfIdA/Vmxg
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.12 clean
https://pxqrda.sn.files.1drv.com/y4m__S5cMVGcFy7pOBpoFvjnko8AL4p5khOaFXAKHOBONod9wuptZWr2NXTzHqD7-lpVg0Z4e_BbFaeA2ebB7pnq1ItYlfdo7T9V2lPne4uS7rnHRVQMTtbazlN6QF3Xvr5ttEMxOdNqoE0LgqtrG6gcR5LA7BtUZnWvmd77YgDv9vnlh7Jo_tCsgbTdO9ifvgRNPf5-a2WZhEpH7Ud0Xg7oA/Vmxg
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.12 clean
https://onedrive.live.com/download?cid=7AD84143EE0A85E3&resid=7AD84143EE0A85E3%21111&authkey=AJ7X28D7DpibhQI
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 clean
www.cannamalism.com
whois
US GOOGLE 34.102.136.180 clean
onedrive.live.com
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
www.fuzhourexian.com
whois
US LEASEWEB-USA-LAX-11 108.62.76.146 clean
www.mobiessence.com
whois
DE AMAZON-02 52.58.78.16 clean
www.beastninjas.com
whois
US GOOGLE 34.102.136.180 clean
www.miamiqueensdress.com
whois
US AMAZON-02 75.2.115.196 clean
pxqrda.sn.files.1drv.com
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.12 clean
www.bransolute.com
whois
US UNIFIEDLAYER-AS-1 192.185.236.169 clean
www.titanusedcarsworth.com
whois
Unknown clean
www.annettebrownlee.com
whois
US DIGITALOCEAN-ASN 159.203.181.190 clean
www.hanasugisaki.com
whois
DE SEDO GmbH 91.195.240.94 clean
www.lawmetricssolicitors.com
whois
US IS-AS-1 66.45.250.213 clean
www.kykyryky.art
whois
RU Domain names registrar REG.RU, Ltd 194.58.112.174 clean
192.185.236.169
whois
US UNIFIEDLAYER-AS-1 192.185.236.169 clean
52.58.78.16
whois
DE AMAZON-02 52.58.78.16 mailcious
91.195.240.94
whois
DE SEDO GmbH 91.195.240.94 phishing
13.107.42.13
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
13.107.42.12
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.12 malware
159.203.181.190
whois
US DIGITALOCEAN-ASN 159.203.181.190 clean
34.102.136.180
whois
US GOOGLE 34.102.136.180 mailcious
194.58.112.174
whois
RU Domain names registrar REG.RU, Ltd 194.58.112.174 mailcious
108.62.76.146
whois
US LEASEWEB-USA-LAX-11 108.62.76.146 clean
75.2.115.196
whois
US AMAZON-02 75.2.115.196 clean
66.45.250.213
whois
US IS-AS-1 66.45.250.213 clean

Suricata ids

ET MALWARE FormBook CnC Checkin (GET)
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x4c3168 DeleteCriticalSection
 0x4c316c LeaveCriticalSection
 0x4c3170 EnterCriticalSection
 0x4c3174 InitializeCriticalSection
 0x4c3178 VirtualFree
 0x4c317c VirtualAlloc
 0x4c3180 LocalFree
 0x4c3184 LocalAlloc
 0x4c3188 GetVersion
 0x4c318c GetCurrentThreadId
 0x4c3190 InterlockedDecrement
 0x4c3194 InterlockedIncrement
 0x4c3198 VirtualQuery
 0x4c319c WideCharToMultiByte
 0x4c31a0 MultiByteToWideChar
 0x4c31a4 lstrlenA
 0x4c31a8 lstrcpynA
 0x4c31ac LoadLibraryExA
 0x4c31b0 GetThreadLocale
 0x4c31b4 GetStartupInfoA
 0x4c31b8 GetProcAddress
 0x4c31bc GetModuleHandleA
 0x4c31c0 GetModuleFileNameA
 0x4c31c4 GetLocaleInfoA
 0x4c31c8 GetCommandLineA
 0x4c31cc FreeLibrary
 0x4c31d0 FindFirstFileA
 0x4c31d4 FindClose
 0x4c31d8 ExitProcess
 0x4c31dc WriteFile
 0x4c31e0 UnhandledExceptionFilter
 0x4c31e4 RtlUnwind
 0x4c31e8 RaiseException
 0x4c31ec GetStdHandle
user32.dll
 0x4c31f4 GetKeyboardType
 0x4c31f8 LoadStringA
 0x4c31fc MessageBoxA
 0x4c3200 CharNextA
advapi32.dll
 0x4c3208 RegQueryValueExA
 0x4c320c RegOpenKeyExA
 0x4c3210 RegCloseKey
oleaut32.dll
 0x4c3218 SysFreeString
 0x4c321c SysReAllocStringLen
 0x4c3220 SysAllocStringLen
kernel32.dll
 0x4c3228 TlsSetValue
 0x4c322c TlsGetValue
 0x4c3230 LocalAlloc
 0x4c3234 GetModuleHandleA
advapi32.dll
 0x4c323c RegQueryValueExA
 0x4c3240 RegOpenKeyExA
 0x4c3244 RegCloseKey
kernel32.dll
 0x4c324c lstrcpyA
 0x4c3250 lstrcmpA
 0x4c3254 WriteFile
 0x4c3258 WaitForSingleObject
 0x4c325c VirtualQuery
 0x4c3260 VirtualProtect
 0x4c3264 VirtualAlloc
 0x4c3268 Sleep
 0x4c326c SizeofResource
 0x4c3270 SetThreadLocale
 0x4c3274 SetFilePointer
 0x4c3278 SetEvent
 0x4c327c SetErrorMode
 0x4c3280 SetEndOfFile
 0x4c3284 ResetEvent
 0x4c3288 ReadFile
 0x4c328c MultiByteToWideChar
 0x4c3290 MulDiv
 0x4c3294 LockResource
 0x4c3298 LoadResource
 0x4c329c LoadLibraryA
 0x4c32a0 LeaveCriticalSection
 0x4c32a4 InitializeCriticalSection
 0x4c32a8 GlobalUnlock
 0x4c32ac GlobalSize
 0x4c32b0 GlobalReAlloc
 0x4c32b4 GlobalHandle
 0x4c32b8 GlobalLock
 0x4c32bc GlobalFree
 0x4c32c0 GlobalFindAtomA
 0x4c32c4 GlobalDeleteAtom
 0x4c32c8 GlobalAlloc
 0x4c32cc GlobalAddAtomA
 0x4c32d0 GetVersionExA
 0x4c32d4 GetVersion
 0x4c32d8 GetUserDefaultLCID
 0x4c32dc GetTickCount
 0x4c32e0 GetThreadLocale
 0x4c32e4 GetSystemInfo
 0x4c32e8 GetStringTypeExA
 0x4c32ec GetStdHandle
 0x4c32f0 GetProcAddress
 0x4c32f4 GetModuleHandleA
 0x4c32f8 GetModuleFileNameA
 0x4c32fc GetLocaleInfoA
 0x4c3300 GetLocalTime
 0x4c3304 GetLastError
 0x4c3308 GetFullPathNameA
 0x4c330c GetDiskFreeSpaceA
 0x4c3310 GetDateFormatA
 0x4c3314 GetCurrentThreadId
 0x4c3318 GetCurrentProcessId
 0x4c331c GetComputerNameA
 0x4c3320 GetCPInfo
 0x4c3324 GetACP
 0x4c3328 FreeResource
 0x4c332c InterlockedExchange
 0x4c3330 FreeLibrary
 0x4c3334 FormatMessageA
 0x4c3338 FindResourceA
 0x4c333c FindFirstFileA
 0x4c3340 FindClose
 0x4c3344 FileTimeToLocalFileTime
 0x4c3348 FileTimeToDosDateTime
 0x4c334c EnumCalendarInfoA
 0x4c3350 EnterCriticalSection
 0x4c3354 DeleteFileA
 0x4c3358 DeleteCriticalSection
 0x4c335c CreateThread
 0x4c3360 CreateFileA
 0x4c3364 CreateEventA
 0x4c3368 CompareStringA
 0x4c336c CloseHandle
version.dll
 0x4c3374 VerQueryValueA
 0x4c3378 GetFileVersionInfoSizeA
 0x4c337c GetFileVersionInfoA
gdi32.dll
 0x4c3384 UnrealizeObject
 0x4c3388 StretchBlt
 0x4c338c SetWindowOrgEx
 0x4c3390 SetWinMetaFileBits
 0x4c3394 SetViewportOrgEx
 0x4c3398 SetTextColor
 0x4c339c SetStretchBltMode
 0x4c33a0 SetROP2
 0x4c33a4 SetPixel
 0x4c33a8 SetEnhMetaFileBits
 0x4c33ac SetDIBColorTable
 0x4c33b0 SetBrushOrgEx
 0x4c33b4 SetBkMode
 0x4c33b8 SetBkColor
 0x4c33bc SelectPalette
 0x4c33c0 SelectObject
 0x4c33c4 SaveDC
 0x4c33c8 RestoreDC
 0x4c33cc Rectangle
 0x4c33d0 RectVisible
 0x4c33d4 RealizePalette
 0x4c33d8 Polyline
 0x4c33dc Polygon
 0x4c33e0 PlayEnhMetaFile
 0x4c33e4 PatBlt
 0x4c33e8 MoveToEx
 0x4c33ec MaskBlt
 0x4c33f0 LineTo
 0x4c33f4 IntersectClipRect
 0x4c33f8 GetWindowOrgEx
 0x4c33fc GetWinMetaFileBits
 0x4c3400 GetTextMetricsA
 0x4c3404 GetTextExtentPointA
 0x4c3408 GetTextExtentPoint32A
 0x4c340c GetSystemPaletteEntries
 0x4c3410 GetStockObject
 0x4c3414 GetPixel
 0x4c3418 GetPaletteEntries
 0x4c341c GetObjectA
 0x4c3420 GetEnhMetaFilePaletteEntries
 0x4c3424 GetEnhMetaFileHeader
 0x4c3428 GetEnhMetaFileDescriptionA
 0x4c342c GetEnhMetaFileBits
 0x4c3430 GetDeviceCaps
 0x4c3434 GetDIBits
 0x4c3438 GetDIBColorTable
 0x4c343c GetDCOrgEx
 0x4c3440 GetCurrentPositionEx
 0x4c3444 GetClipBox
 0x4c3448 GetBrushOrgEx
 0x4c344c GetBitmapBits
 0x4c3450 GdiFlush
 0x4c3454 ExtTextOutA
 0x4c3458 ExcludeClipRect
 0x4c345c DeleteObject
 0x4c3460 DeleteEnhMetaFile
 0x4c3464 DeleteDC
 0x4c3468 CreateSolidBrush
 0x4c346c CreatePenIndirect
 0x4c3470 CreatePalette
 0x4c3474 CreateHalftonePalette
 0x4c3478 CreateFontIndirectA
 0x4c347c CreateEnhMetaFileA
 0x4c3480 CreateDIBitmap
 0x4c3484 CreateDIBSection
 0x4c3488 CreateCompatibleDC
 0x4c348c CreateCompatibleBitmap
 0x4c3490 CreateBrushIndirect
 0x4c3494 CreateBitmap
 0x4c3498 CopyEnhMetaFileA
 0x4c349c CloseEnhMetaFile
 0x4c34a0 BitBlt
user32.dll
 0x4c34a8 CreateWindowExA
 0x4c34ac WindowFromPoint
 0x4c34b0 WinHelpA
 0x4c34b4 WaitMessage
 0x4c34b8 UpdateWindow
 0x4c34bc UnregisterClassA
 0x4c34c0 UnhookWindowsHookEx
 0x4c34c4 TranslateMessage
 0x4c34c8 TranslateMDISysAccel
 0x4c34cc TrackPopupMenu
 0x4c34d0 SystemParametersInfoA
 0x4c34d4 ShowWindow
 0x4c34d8 ShowScrollBar
 0x4c34dc ShowOwnedPopups
 0x4c34e0 ShowCursor
 0x4c34e4 ShowCaret
 0x4c34e8 SetWindowsHookExA
 0x4c34ec SetWindowTextA
 0x4c34f0 SetWindowPos
 0x4c34f4 SetWindowPlacement
 0x4c34f8 SetWindowLongA
 0x4c34fc SetTimer
 0x4c3500 SetScrollRange
 0x4c3504 SetScrollPos
 0x4c3508 SetScrollInfo
 0x4c350c SetRect
 0x4c3510 SetPropA
 0x4c3514 SetParent
 0x4c3518 SetMenuItemInfoA
 0x4c351c SetMenu
 0x4c3520 SetForegroundWindow
 0x4c3524 SetFocus
 0x4c3528 SetCursor
 0x4c352c SetClipboardData
 0x4c3530 SetClassLongA
 0x4c3534 SetCapture
 0x4c3538 SetActiveWindow
 0x4c353c SendMessageA
 0x4c3540 ScrollWindow
 0x4c3544 ScreenToClient
 0x4c3548 RemovePropA
 0x4c354c RemoveMenu
 0x4c3550 ReleaseDC
 0x4c3554 ReleaseCapture
 0x4c3558 RegisterWindowMessageA
 0x4c355c RegisterClipboardFormatA
 0x4c3560 RegisterClassA
 0x4c3564 RedrawWindow
 0x4c3568 PtInRect
 0x4c356c PostQuitMessage
 0x4c3570 PostMessageA
 0x4c3574 PeekMessageA
 0x4c3578 OpenClipboard
 0x4c357c OffsetRect
 0x4c3580 OemToCharA
 0x4c3584 MsgWaitForMultipleObjects
 0x4c3588 MessageBoxA
 0x4c358c MessageBeep
 0x4c3590 MapWindowPoints
 0x4c3594 MapVirtualKeyA
 0x4c3598 LoadStringA
 0x4c359c LoadKeyboardLayoutA
 0x4c35a0 LoadIconA
 0x4c35a4 LoadCursorA
 0x4c35a8 LoadBitmapA
 0x4c35ac KillTimer
 0x4c35b0 IsZoomed
 0x4c35b4 IsWindowVisible
 0x4c35b8 IsWindowEnabled
 0x4c35bc IsWindow
 0x4c35c0 IsRectEmpty
 0x4c35c4 IsIconic
 0x4c35c8 IsDialogMessageA
 0x4c35cc IsChild
 0x4c35d0 InvalidateRect
 0x4c35d4 IntersectRect
 0x4c35d8 InsertMenuItemA
 0x4c35dc InsertMenuA
 0x4c35e0 InflateRect
 0x4c35e4 HideCaret
 0x4c35e8 GetWindowThreadProcessId
 0x4c35ec GetWindowTextA
 0x4c35f0 GetWindowRect
 0x4c35f4 GetWindowPlacement
 0x4c35f8 GetWindowLongA
 0x4c35fc GetWindowDC
 0x4c3600 GetTopWindow
 0x4c3604 GetSystemMetrics
 0x4c3608 GetSystemMenu
 0x4c360c GetSysColorBrush
 0x4c3610 GetSysColor
 0x4c3614 GetSubMenu
 0x4c3618 GetScrollRange
 0x4c361c GetScrollPos
 0x4c3620 GetScrollInfo
 0x4c3624 GetPropA
 0x4c3628 GetParent
 0x4c362c GetWindow
 0x4c3630 GetMessageTime
 0x4c3634 GetMenuStringA
 0x4c3638 GetMenuState
 0x4c363c GetMenuItemInfoA
 0x4c3640 GetMenuItemID
 0x4c3644 GetMenuItemCount
 0x4c3648 GetMenu
 0x4c364c GetLastActivePopup
 0x4c3650 GetKeyboardState
 0x4c3654 GetKeyboardLayoutList
 0x4c3658 GetKeyboardLayout
 0x4c365c GetKeyState
 0x4c3660 GetKeyNameTextA
 0x4c3664 GetIconInfo
 0x4c3668 GetForegroundWindow
 0x4c366c GetFocus
 0x4c3670 GetDlgItem
 0x4c3674 GetDesktopWindow
 0x4c3678 GetDCEx
 0x4c367c GetDC
 0x4c3680 GetCursorPos
 0x4c3684 GetCursor
 0x4c3688 GetClipboardData
 0x4c368c GetClientRect
 0x4c3690 GetClassNameA
 0x4c3694 GetClassInfoA
 0x4c3698 GetCapture
 0x4c369c GetActiveWindow
 0x4c36a0 FrameRect
 0x4c36a4 FindWindowA
 0x4c36a8 FillRect
 0x4c36ac EqualRect
 0x4c36b0 EnumWindows
 0x4c36b4 EnumThreadWindows
 0x4c36b8 EnumClipboardFormats
 0x4c36bc EndPaint
 0x4c36c0 EnableWindow
 0x4c36c4 EnableScrollBar
 0x4c36c8 EnableMenuItem
 0x4c36cc EmptyClipboard
 0x4c36d0 DrawTextA
 0x4c36d4 DrawStateA
 0x4c36d8 DrawMenuBar
 0x4c36dc DrawIconEx
 0x4c36e0 DrawIcon
 0x4c36e4 DrawFrameControl
 0x4c36e8 DrawFocusRect
 0x4c36ec DrawEdge
 0x4c36f0 DispatchMessageA
 0x4c36f4 DestroyWindow
 0x4c36f8 DestroyMenu
 0x4c36fc DestroyIcon
 0x4c3700 DestroyCursor
 0x4c3704 DeleteMenu
 0x4c3708 DefWindowProcA
 0x4c370c DefMDIChildProcA
 0x4c3710 DefFrameProcA
 0x4c3714 CreatePopupMenu
 0x4c3718 CreateMenu
 0x4c371c CreateIcon
 0x4c3720 CloseClipboard
 0x4c3724 ClientToScreen
 0x4c3728 CheckMenuItem
 0x4c372c CallWindowProcA
 0x4c3730 CallNextHookEx
 0x4c3734 BeginPaint
 0x4c3738 CharNextA
 0x4c373c CharLowerBuffA
 0x4c3740 CharLowerA
 0x4c3744 CharUpperBuffA
 0x4c3748 CharToOemA
 0x4c374c AdjustWindowRectEx
 0x4c3750 ActivateKeyboardLayout
kernel32.dll
 0x4c3758 Sleep
oleaut32.dll
 0x4c3760 SafeArrayPtrOfIndex
 0x4c3764 SafeArrayPutElement
 0x4c3768 SafeArrayGetElement
 0x4c376c SafeArrayUnaccessData
 0x4c3770 SafeArrayAccessData
 0x4c3774 SafeArrayGetUBound
 0x4c3778 SafeArrayGetLBound
 0x4c377c SafeArrayCreate
 0x4c3780 VariantChangeType
 0x4c3784 VariantCopyInd
 0x4c3788 VariantCopy
 0x4c378c VariantClear
 0x4c3790 VariantInit
ole32.dll
 0x4c3798 CreateStreamOnHGlobal
 0x4c379c IsAccelerator
 0x4c37a0 OleDraw
 0x4c37a4 OleSetMenuDescriptor
 0x4c37a8 CoTaskMemFree
 0x4c37ac ProgIDFromCLSID
 0x4c37b0 StringFromCLSID
 0x4c37b4 CoCreateInstance
 0x4c37b8 CoGetClassObject
 0x4c37bc CoUninitialize
 0x4c37c0 CoInitialize
 0x4c37c4 IsEqualGUID
oleaut32.dll
 0x4c37cc GetErrorInfo
 0x4c37d0 GetActiveObject
 0x4c37d4 SysFreeString
comctl32.dll
 0x4c37dc ImageList_SetIconSize
 0x4c37e0 ImageList_GetIconSize
 0x4c37e4 ImageList_Write
 0x4c37e8 ImageList_Read
 0x4c37ec ImageList_GetDragImage
 0x4c37f0 ImageList_DragShowNolock
 0x4c37f4 ImageList_SetDragCursorImage
 0x4c37f8 ImageList_DragMove
 0x4c37fc ImageList_DragLeave
 0x4c3800 ImageList_DragEnter
 0x4c3804 ImageList_EndDrag
 0x4c3808 ImageList_BeginDrag
 0x4c380c ImageList_Remove
 0x4c3810 ImageList_DrawEx
 0x4c3814 ImageList_Replace
 0x4c3818 ImageList_Draw
 0x4c381c ImageList_GetBkColor
 0x4c3820 ImageList_SetBkColor
 0x4c3824 ImageList_ReplaceIcon
 0x4c3828 ImageList_Add
 0x4c382c ImageList_SetImageCount
 0x4c3830 ImageList_GetImageCount
 0x4c3834 ImageList_Destroy
 0x4c3838 ImageList_Create
 0x4c383c InitCommonControls
comdlg32.dll
 0x4c3844 GetSaveFileNameA
 0x4c3848 GetOpenFileNameA
winmm.dll
 0x4c3850 sndPlaySoundA

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure