popup

Report - go.exe

Malicious Library UPX AntiDebug AntiVM PE File PE32 OS Processor Check MSOffice File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.03.25 09:24 Machine s1_win7_x6401
Filename go.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
7
 Behavior Score
5.6
ZERO API file : clean
VT API (file) 39 detected (Common, Injects, ts93, Malicious, score, Genericuh, GenericKD, unsafe, Save, Attribute, HighConfidence, high confidence, Artemis, AGEN, AMADEY, YXECUZ, Acll, awbz, ai score=85, AutoIt, Eldorado, BScope, Static AI, Malicious PE, susgen, PossibleThreat)
md5 4e937db554cf18265ab7f3915db42b2c
sha256 d2c0a67e9f5a36e878853d5f8a0e493d7d29362c2cff1b805cb7b29f52cd0faf
ssdeep 12288:3qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaSTB:3qDEvCTbMWu7rQYlBQcBiT6rprG8ayB
imphash 948cc502fe9226992dce9417f952fce3
impfuzzy 192:SQtZJ57YYiI3OHehnR1ji8UEh6urw6BUUhjvNDJB:SGZJ5YYiICqfOyrwmjvNDJB
  Network IP location

Signature (13cnts)

Level Description
danger File has been identified by 39 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice An application raised an exception which may be indicative of an exploit crash
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info One or more processes crashed

Rules (14cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE32 (no description) binaries (upload)
info Microsoft_Office_File_Zero Microsoft Office File binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (16cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Dko%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=ko&ifkv=ARZ0qKK
whois
US GOOGLE 74.125.23.84 clean
https://www.google.com/favicon.ico
whois
US GOOGLE 142.250.204.68 clean
https://ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png
whois
US GOOGLE 216.58.203.67 clean
https://accounts.google.com/_/bscframe
whois
US GOOGLE 74.125.23.84 clean
https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Dko%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredi
whois
US GOOGLE 74.125.23.84 clean
https://accounts.google.com/generate_204?vBL53Q
whois
US GOOGLE 74.125.23.84 clean
https://www.youtube.com/account
whois
US GOOGLE 142.251.222.206 clean
https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Dko%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=ko&passive=true&service=youtu
whois
US GOOGLE 74.125.23.84 clean
www.youtube.com
whois
US GOOGLE 142.250.206.206 mailcious
ssl.gstatic.com
whois
US GOOGLE 172.217.26.227 clean
accounts.google.com
whois
US GOOGLE 64.233.188.84 clean
www.google.com
whois
US GOOGLE 142.250.206.196 clean
142.251.222.206
whois
US GOOGLE 142.251.222.206 clean
142.250.204.68
whois
US GOOGLE 142.250.204.68 clean
216.58.203.67
whois
US GOOGLE 216.58.203.67 clean
74.125.23.84
whois
US GOOGLE 74.125.23.84 clean

Suricata ids

SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)

PE API

IAT(Import Address Table) Library

WSOCK32.dll
 0x49c7d8 gethostbyname
 0x49c7dc recv
 0x49c7e0 send
 0x49c7e4 socket
 0x49c7e8 inet_ntoa
 0x49c7ec setsockopt
 0x49c7f0 ntohs
 0x49c7f4 WSACleanup
 0x49c7f8 WSAStartup
 0x49c7fc sendto
 0x49c800 htons
 0x49c804 __WSAFDIsSet
 0x49c808 select
 0x49c80c accept
 0x49c810 listen
 0x49c814 ind
 0x49c818 inet_addr
 0x49c81c ioctlsocket
 0x49c820 recvfrom
 0x49c824 WSAGetLastError
 0x49c828 closesocket
 0x49c82c gethostname
 0x49c830 connect
VERSION.dll
 0x49c77c GetFileVersionInfoW
 0x49c780 VerQueryValueW
 0x49c784 GetFileVersionInfoSizeW
WINMM.dll
 0x49c7c8 timeGetTime
 0x49c7cc waveOutSetVolume
 0x49c7d0 mciSendStringW
COMCTL32.dll
 0x49c088 ImageList_ReplaceIcon
 0x49c08c ImageList_Destroy
 0x49c090 ImageList_Remove
 0x49c094 ImageList_SetDragCursorImage
 0x49c098 ImageList_BeginDrag
 0x49c09c ImageList_DragEnter
 0x49c0a0 ImageList_DragLeave
 0x49c0a4 ImageList_EndDrag
 0x49c0a8 ImageList_DragMove
 0x49c0ac InitCommonControlsEx
 0x49c0b0 ImageList_Create
MPR.dll
 0x49c408 WNetGetConnectionW
 0x49c40c WNetCancelConnection2W
 0x49c410 WNetUseConnectionW
 0x49c414 WNetAddConnection2W
WININET.dll
 0x49c78c HttpOpenRequestW
 0x49c790 InternetCloseHandle
 0x49c794 InternetOpenW
 0x49c798 InternetSetOptionW
 0x49c79c InternetCrackUrlW
 0x49c7a0 HttpQueryInfoW
 0x49c7a4 InternetQueryOptionW
 0x49c7a8 InternetConnectW
 0x49c7ac HttpSendRequestW
 0x49c7b0 FtpOpenFileW
 0x49c7b4 FtpGetFileSize
 0x49c7b8 InternetOpenUrlW
 0x49c7bc InternetReadFile
 0x49c7c0 InternetQueryDataAvailable
PSAPI.DLL
 0x49c494 GetProcessMemoryInfo
IPHLPAPI.DLL
 0x49c154 IcmpSendEcho
 0x49c158 IcmpCloseHandle
 0x49c15c IcmpCreateFile
USERENV.dll
 0x49c760 DestroyEnvironmentBlock
 0x49c764 LoadUserProfileW
 0x49c768 CreateEnvironmentBlock
 0x49c76c UnloadUserProfile
UxTheme.dll
 0x49c774 IsThemeActive
KERNEL32.dll
 0x49c164 DuplicateHandle
 0x49c168 CreateThread
 0x49c16c WaitForSingleObject
 0x49c170 HeapAlloc
 0x49c174 GetProcessHeap
 0x49c178 HeapFree
 0x49c17c Sleep
 0x49c180 GetCurrentThreadId
 0x49c184 MultiByteToWideChar
 0x49c188 MulDiv
 0x49c18c GetVersionExW
 0x49c190 IsWow64Process
 0x49c194 GetSystemInfo
 0x49c198 FreeLibrary
 0x49c19c LoadLibraryA
 0x49c1a0 GetProcAddress
 0x49c1a4 SetErrorMode
 0x49c1a8 GetModuleFileNameW
 0x49c1ac WideCharToMultiByte
 0x49c1b0 lstrcpyW
 0x49c1b4 lstrlenW
 0x49c1b8 GetModuleHandleW
 0x49c1bc QueryPerformanceCounter
 0x49c1c0 VirtualFreeEx
 0x49c1c4 OpenProcess
 0x49c1c8 VirtualAllocEx
 0x49c1cc WriteProcessMemory
 0x49c1d0 ReadProcessMemory
 0x49c1d4 CreateFileW
 0x49c1d8 SetFilePointerEx
 0x49c1dc SetEndOfFile
 0x49c1e0 ReadFile
 0x49c1e4 WriteFile
 0x49c1e8 FlushFileBuffers
 0x49c1ec TerminateProcess
 0x49c1f0 CreateToolhelp32Snapshot
 0x49c1f4 Process32FirstW
 0x49c1f8 Process32NextW
 0x49c1fc SetFileTime
 0x49c200 GetFileAttributesW
 0x49c204 FindFirstFileW
 0x49c208 FindClose
 0x49c20c GetLongPathNameW
 0x49c210 GetShortPathNameW
 0x49c214 DeleteFileW
 0x49c218 IsDebuggerPresent
 0x49c21c CopyFileExW
 0x49c220 MoveFileW
 0x49c224 CreateDirectoryW
 0x49c228 RemoveDirectoryW
 0x49c22c SetSystemPowerState
 0x49c230 QueryPerformanceFrequency
 0x49c234 LoadResource
 0x49c238 LockResource
 0x49c23c SizeofResource
 0x49c240 OutputDebugStringW
 0x49c244 GetTempPathW
 0x49c248 GetTempFileNameW
 0x49c24c DeviceIoControl
 0x49c250 LoadLibraryW
 0x49c254 GetLocalTime
 0x49c258 CompareStringW
 0x49c25c GetCurrentThread
 0x49c260 EnterCriticalSection
 0x49c264 LeaveCriticalSection
 0x49c268 GetStdHandle
 0x49c26c CreatePipe
 0x49c270 InterlockedExchange
 0x49c274 TerminateThread
 0x49c278 LoadLibraryExW
 0x49c27c FindResourceExW
 0x49c280 CopyFileW
 0x49c284 VirtualFree
 0x49c288 FormatMessageW
 0x49c28c GetExitCodeProcess
 0x49c290 GetPrivateProfileStringW
 0x49c294 WritePrivateProfileStringW
 0x49c298 GetPrivateProfileSectionW
 0x49c29c WritePrivateProfileSectionW
 0x49c2a0 GetPrivateProfileSectionNamesW
 0x49c2a4 FileTimeToLocalFileTime
 0x49c2a8 FileTimeToSystemTime
 0x49c2ac SystemTimeToFileTime
 0x49c2b0 LocalFileTimeToFileTime
 0x49c2b4 GetDriveTypeW
 0x49c2b8 GetDiskFreeSpaceExW
 0x49c2bc GetDiskFreeSpaceW
 0x49c2c0 GetVolumeInformationW
 0x49c2c4 SetVolumeLabelW
 0x49c2c8 CreateHardLinkW
 0x49c2cc SetFileAttributesW
 0x49c2d0 CreateEventW
 0x49c2d4 SetEvent
 0x49c2d8 GetEnvironmentVariableW
 0x49c2dc SetEnvironmentVariableW
 0x49c2e0 GlobalLock
 0x49c2e4 GlobalUnlock
 0x49c2e8 GlobalAlloc
 0x49c2ec GetFileSize
 0x49c2f0 GlobalFree
 0x49c2f4 GlobalMemoryStatusEx
 0x49c2f8 Beep
 0x49c2fc GetSystemDirectoryW
 0x49c300 HeapReAlloc
 0x49c304 HeapSize
 0x49c308 GetComputerNameW
 0x49c30c GetWindowsDirectoryW
 0x49c310 GetCurrentProcessId
 0x49c314 GetProcessIoCounters
 0x49c318 CreateProcessW
 0x49c31c GetProcessId
 0x49c320 SetPriorityClass
 0x49c324 VirtualAlloc
 0x49c328 GetCurrentDirectoryW
 0x49c32c lstrcmpiW
 0x49c330 DecodePointer
 0x49c334 GetLastError
 0x49c338 RaiseException
 0x49c33c InitializeCriticalSectionAndSpinCount
 0x49c340 DeleteCriticalSection
 0x49c344 InterlockedDecrement
 0x49c348 InterlockedIncrement
 0x49c34c ResetEvent
 0x49c350 WaitForSingleObjectEx
 0x49c354 IsProcessorFeaturePresent
 0x49c358 UnhandledExceptionFilter
 0x49c35c SetUnhandledExceptionFilter
 0x49c360 GetCurrentProcess
 0x49c364 CloseHandle
 0x49c368 GetFullPathNameW
 0x49c36c GetStartupInfoW
 0x49c370 GetSystemTimeAsFileTime
 0x49c374 InitializeSListHead
 0x49c378 RtlUnwind
 0x49c37c SetLastError
 0x49c380 TlsAlloc
 0x49c384 TlsGetValue
 0x49c388 TlsSetValue
 0x49c38c TlsFree
 0x49c390 EncodePointer
 0x49c394 ExitProcess
 0x49c398 GetModuleHandleExW
 0x49c39c ExitThread
 0x49c3a0 ResumeThread
 0x49c3a4 FreeLibraryAndExitThread
 0x49c3a8 GetACP
 0x49c3ac GetDateFormatW
 0x49c3b0 GetTimeFormatW
 0x49c3b4 LCMapStringW
 0x49c3b8 GetStringTypeW
 0x49c3bc GetFileType
 0x49c3c0 SetStdHandle
 0x49c3c4 GetConsoleCP
 0x49c3c8 GetConsoleMode
 0x49c3cc ReadConsoleW
 0x49c3d0 GetTimeZoneInformation
 0x49c3d4 FindFirstFileExW
 0x49c3d8 IsValidCodePage
 0x49c3dc GetOEMCP
 0x49c3e0 GetCPInfo
 0x49c3e4 GetCommandLineA
 0x49c3e8 GetCommandLineW
 0x49c3ec GetEnvironmentStringsW
 0x49c3f0 FreeEnvironmentStringsW
 0x49c3f4 SetEnvironmentVariableA
 0x49c3f8 SetCurrentDirectoryW
 0x49c3fc FindNextFileW
 0x49c400 WriteConsoleW
USER32.dll
 0x49c4dc GetKeyboardLayoutNameW
 0x49c4e0 IsCharAlphaW
 0x49c4e4 IsCharAlphaNumericW
 0x49c4e8 IsCharLowerW
 0x49c4ec IsCharUpperW
 0x49c4f0 GetMenuStringW
 0x49c4f4 GetSubMenu
 0x49c4f8 GetCaretPos
 0x49c4fc IsZoomed
 0x49c500 GetMonitorInfoW
 0x49c504 SetWindowLongW
 0x49c508 SetLayeredWindowAttributes
 0x49c50c FlashWindow
 0x49c510 GetClassLongW
 0x49c514 TranslateAcceleratorW
 0x49c518 IsDialogMessageW
 0x49c51c GetSysColor
 0x49c520 InflateRect
 0x49c524 DrawFocusRect
 0x49c528 DrawTextW
 0x49c52c FrameRect
 0x49c530 DrawFrameControl
 0x49c534 FillRect
 0x49c538 PtInRect
 0x49c53c DestroyAcceleratorTable
 0x49c540 CreateAcceleratorTableW
 0x49c544 SetCursor
 0x49c548 GetWindowDC
 0x49c54c GetSystemMetrics
 0x49c550 GetActiveWindow
 0x49c554 CharNextW
 0x49c558 wsprintfW
 0x49c55c RedrawWindow
 0x49c560 DrawMenuBar
 0x49c564 DestroyMenu
 0x49c568 SetMenu
 0x49c56c GetWindowTextLengthW
 0x49c570 CreateMenu
 0x49c574 IsDlgButtonChecked
 0x49c578 DefDlgProcW
 0x49c57c CallWindowProcW
 0x49c580 ReleaseCapture
 0x49c584 SetCapture
 0x49c588 PeekMessageW
 0x49c58c GetInputState
 0x49c590 UnregisterHotKey
 0x49c594 CharLowerBuffW
 0x49c598 MonitorFromPoint
 0x49c59c MonitorFromRect
 0x49c5a0 LoadImageW
 0x49c5a4 mouse_event
 0x49c5a8 ExitWindowsEx
 0x49c5ac SetActiveWindow
 0x49c5b0 FindWindowExW
 0x49c5b4 EnumThreadWindows
 0x49c5b8 SetMenuDefaultItem
 0x49c5bc InsertMenuItemW
 0x49c5c0 IsMenu
 0x49c5c4 ClientToScreen
 0x49c5c8 GetCursorPos
 0x49c5cc DeleteMenu
 0x49c5d0 CheckMenuRadioItem
 0x49c5d4 GetMenuItemID
 0x49c5d8 GetMenuItemCount
 0x49c5dc SetMenuItemInfoW
 0x49c5e0 GetMenuItemInfoW
 0x49c5e4 SetForegroundWindow
 0x49c5e8 IsIconic
 0x49c5ec FindWindowW
 0x49c5f0 SystemParametersInfoW
 0x49c5f4 LockWindowUpdate
 0x49c5f8 SendInput
 0x49c5fc GetAsyncKeyState
 0x49c600 SetKeyboardState
 0x49c604 GetKeyboardState
 0x49c608 GetKeyState
 0x49c60c VkKeyScanW
 0x49c610 LoadStringW
 0x49c614 DialogBoxParamW
 0x49c618 MessageBeep
 0x49c61c EndDialog
 0x49c620 SendDlgItemMessageW
 0x49c624 GetDlgItem
 0x49c628 SetWindowTextW
 0x49c62c CopyRect
 0x49c630 ReleaseDC
 0x49c634 GetDC
 0x49c638 EndPaint
 0x49c63c BeginPaint
 0x49c640 GetClientRect
 0x49c644 GetMenu
 0x49c648 DestroyWindow
 0x49c64c EnumWindows
 0x49c650 GetDesktopWindow
 0x49c654 IsWindow
 0x49c658 IsWindowEnabled
 0x49c65c IsWindowVisible
 0x49c660 EnableWindow
 0x49c664 InvalidateRect
 0x49c668 GetWindowLongW
 0x49c66c GetWindowThreadProcessId
 0x49c670 AttachThreadInput
 0x49c674 GetFocus
 0x49c678 GetWindowTextW
 0x49c67c SendMessageTimeoutW
 0x49c680 EnumChildWindows
 0x49c684 CharUpperBuffW
 0x49c688 GetClassNameW
 0x49c68c GetParent
 0x49c690 GetDlgCtrlID
 0x49c694 SendMessageW
 0x49c698 MapVirtualKeyW
 0x49c69c PostMessageW
 0x49c6a0 GetWindowRect
 0x49c6a4 SetUserObjectSecurity
 0x49c6a8 CloseDesktop
 0x49c6ac CloseWindowStation
 0x49c6b0 OpenDesktopW
 0x49c6b4 RegisterHotKey
 0x49c6b8 GetCursorInfo
 0x49c6bc SetWindowPos
 0x49c6c0 CopyImage
 0x49c6c4 AdjustWindowRectEx
 0x49c6c8 SetRect
 0x49c6cc SetClipboardData
 0x49c6d0 EmptyClipboard
 0x49c6d4 CountClipboardFormats
 0x49c6d8 CloseClipboard
 0x49c6dc GetClipboardData
 0x49c6e0 IsClipboardFormatAvailable
 0x49c6e4 OpenClipboard
 0x49c6e8 BlockInput
 0x49c6ec TrackPopupMenuEx
 0x49c6f0 GetMessageW
 0x49c6f4 SetProcessWindowStation
 0x49c6f8 GetProcessWindowStation
 0x49c6fc OpenWindowStationW
 0x49c700 GetUserObjectSecurity
 0x49c704 MessageBoxW
 0x49c708 DefWindowProcW
 0x49c70c MoveWindow
 0x49c710 SetFocus
 0x49c714 PostQuitMessage
 0x49c718 KillTimer
 0x49c71c CreatePopupMenu
 0x49c720 RegisterWindowMessageW
 0x49c724 SetTimer
 0x49c728 ShowWindow
 0x49c72c CreateWindowExW
 0x49c730 RegisterClassExW
 0x49c734 LoadIconW
 0x49c738 LoadCursorW
 0x49c73c GetSysColorBrush
 0x49c740 GetForegroundWindow
 0x49c744 MessageBoxA
 0x49c748 DestroyIcon
 0x49c74c DispatchMessageW
 0x49c750 keybd_event
 0x49c754 TranslateMessage
 0x49c758 ScreenToClient
GDI32.dll
 0x49c0c4 EndPath
 0x49c0c8 DeleteObject
 0x49c0cc GetTextExtentPoint32W
 0x49c0d0 ExtCreatePen
 0x49c0d4 StrokeAndFillPath
 0x49c0d8 GetDeviceCaps
 0x49c0dc SetPixel
 0x49c0e0 CloseFigure
 0x49c0e4 LineTo
 0x49c0e8 AngleArc
 0x49c0ec MoveToEx
 0x49c0f0 Ellipse
 0x49c0f4 CreateCompatibleBitmap
 0x49c0f8 CreateCompatibleDC
 0x49c0fc PolyDraw
 0x49c100 BeginPath
 0x49c104 Rectangle
 0x49c108 SetViewportOrgEx
 0x49c10c GetObjectW
 0x49c110 SetBkMode
 0x49c114 RoundRect
 0x49c118 SetBkColor
 0x49c11c CreatePen
 0x49c120 SelectObject
 0x49c124 StretchBlt
 0x49c128 CreateSolidBrush
 0x49c12c SetTextColor
 0x49c130 CreateFontW
 0x49c134 GetTextFaceW
 0x49c138 GetStockObject
 0x49c13c CreateDCW
 0x49c140 GetPixel
 0x49c144 DeleteDC
 0x49c148 GetDIBits
 0x49c14c StrokePath
COMDLG32.dll
 0x49c0b8 GetSaveFileNameW
 0x49c0bc GetOpenFileNameW
ADVAPI32.dll
 0x49c000 GetAce
 0x49c004 RegEnumValueW
 0x49c008 RegDeleteValueW
 0x49c00c RegDeleteKeyW
 0x49c010 RegEnumKeyExW
 0x49c014 RegSetValueExW
 0x49c018 RegOpenKeyExW
 0x49c01c RegCloseKey
 0x49c020 RegQueryValueExW
 0x49c024 RegConnectRegistryW
 0x49c028 InitializeSecurityDescriptor
 0x49c02c InitializeAcl
 0x49c030 AdjustTokenPrivileges
 0x49c034 OpenThreadToken
 0x49c038 OpenProcessToken
 0x49c03c LookupPrivilegeValueW
 0x49c040 DuplicateTokenEx
 0x49c044 CreateProcessAsUserW
 0x49c048 CreateProcessWithLogonW
 0x49c04c GetLengthSid
 0x49c050 CopySid
 0x49c054 LogonUserW
 0x49c058 AllocateAndInitializeSid
 0x49c05c CheckTokenMembership
 0x49c060 FreeSid
 0x49c064 GetTokenInformation
 0x49c068 RegCreateKeyExW
 0x49c06c GetSecurityDescriptorDacl
 0x49c070 GetAclInformation
 0x49c074 GetUserNameW
 0x49c078 AddAce
 0x49c07c SetSecurityDescriptorDacl
 0x49c080 InitiateSystemShutdownExW
SHELL32.dll
 0x49c49c DragFinish
 0x49c4a0 DragQueryPoint
 0x49c4a4 ShellExecuteExW
 0x49c4a8 DragQueryFileW
 0x49c4ac SHEmptyRecycleBinW
 0x49c4b0 SHGetPathFromIDListW
 0x49c4b4 SHBrowseForFolderW
 0x49c4b8 SHCreateShellItem
 0x49c4bc SHGetDesktopFolder
 0x49c4c0 SHGetSpecialFolderLocation
 0x49c4c4 SHGetFolderPathW
 0x49c4c8 SHFileOperationW
 0x49c4cc ExtractIconExW
 0x49c4d0 Shell_NotifyIconW
 0x49c4d4 ShellExecuteW
ole32.dll
 0x49c838 CoTaskMemAlloc
 0x49c83c CoTaskMemFree
 0x49c840 CLSIDFromString
 0x49c844 ProgIDFromCLSID
 0x49c848 CLSIDFromProgID
 0x49c84c OleSetMenuDescriptor
 0x49c850 MkParseDisplayName
 0x49c854 OleSetContainedObject
 0x49c858 CoCreateInstance
 0x49c85c IIDFromString
 0x49c860 StringFromGUID2
 0x49c864 CreateStreamOnHGlobal
 0x49c868 OleInitialize
 0x49c86c OleUninitialize
 0x49c870 CoInitialize
 0x49c874 CoUninitialize
 0x49c878 GetRunningObjectTable
 0x49c87c CoGetInstanceFromFile
 0x49c880 CoGetObject
 0x49c884 CoInitializeSecurity
 0x49c888 CoCreateInstanceEx
 0x49c88c CoSetProxyBlanket
OLEAUT32.dll
 0x49c41c CreateStdDispatch
 0x49c420 CreateDispTypeInfo
 0x49c424 UnRegisterTypeLib
 0x49c428 UnRegisterTypeLibForUser
 0x49c42c RegisterTypeLibForUser
 0x49c430 RegisterTypeLib
 0x49c434 LoadTypeLibEx
 0x49c438 VariantCopyInd
 0x49c43c SysReAllocString
 0x49c440 SysFreeString
 0x49c444 VariantChangeType
 0x49c448 SafeArrayDestroyData
 0x49c44c SafeArrayUnaccessData
 0x49c450 SafeArrayAccessData
 0x49c454 SafeArrayAllocData
 0x49c458 SafeArrayAllocDescriptorEx
 0x49c45c SafeArrayCreateVector
 0x49c460 SysStringLen
 0x49c464 QueryPathOfRegTypeLib
 0x49c468 SysAllocString
 0x49c46c VariantInit
 0x49c470 VariantClear
 0x49c474 DispCallFunc
 0x49c478 VariantTimeToSystemTime
 0x49c47c VarR8FromDec
 0x49c480 SafeArrayGetVartype
 0x49c484 SafeArrayDestroyDescriptor
 0x49c488 VariantCopy
 0x49c48c OleLoadPicture

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure