popup

Report - frownked2.1.exe

Generic Malware Malicious Library UPX PE File PE32 OS Processor Check DLL
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.09.13 09:33 Machine s1_win7_x6403
Filename frownked2.1.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
 Behavior Score
7.6
ZERO API file : clean
VT API (file) 36 detected (AIDetectMalware, Formbook, malicious, high confidence, TrojanPWS, AutoIt, Zbot, Unsafe, V9c1, FileRepMalware, Misc, score, lqnit, Wacatac, 6GHKRQ, Artemis, Chgt, susgen, confidence)
md5 ab7caff90a8347576988a104a322a916
sha256 b14dba44c08182c9c21b34e90409943400645c7d88a6b1388bddc64464f26a73
ssdeep 24576:64lavt0LkLL9IMixoEgea4NlRCGiIpjnUwqVOYKPq9MmCS:Nkwkn9IMHea4vRCkpDsVOhaPCS
imphash bbac62fd99326ea68ec5a33b36925dd1
impfuzzy 192:ut3GC4XSGtI3OzoloZBvi8UCRu2IwVhMycOYRD:s3GZXSGtIe1BqMUwXrcOYRD
  Network IP location

Signature (17cnts)

Level Description
danger File has been identified by 36 AntiVirus engines on VirusTotal as malicious
watch Attempts to identify installed AV products by installation directory
watch Manipulates memory of a non-child process indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice A process attempted to delay the analysis task.
notice Allocates read-write-execute memory (usually to unpack itself)
notice Created a process named as a common system process
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Resolves a suspicious Top Level Domain (TLD)
notice Sends data using the HTTP POST Method
notice Steals private information from local Internet browsers
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info Checks if process is being debugged by a debugger

Rules (11cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (34cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://www.trapkitten.website/vzgx/?Jht=fAt7pIVPpGXAvBzfbofxH6KLA/SKUI8tR0TDZSipM2iZbUNyxYUxThLLESsgo4hlkDzs7nheSjoc1Sj/m3Gn3caq3+Ik36hEeLqFX7XS2ZCHg+ZK2jYSb1UZmcKhE1PtLCklngg=&fl=WtGo
whois
Unknown clean
http://www.dfmagazine.shop/wc8m/
whois
LT UAB Nacionalinis Telekomunikaciju Tinklas 84.32.84.32 clean
http://www.kevin-torkelson.info/gekb/?Jht=5z2j4JvjBCmnxDGmXhsNUCzyBEeNU+efumCOi9/ZiiqSem4bSPmiC7+SQGIeXbOACmsQlkv/nReqN9BPj1atBFP4iljpjZG37OmieLn9iAg49nsR4NFlAX0ACoZEb3mOX8X6rtg=&fl=WtGo
whois
VG CONFLUENCE-NETWORK-INC 208.91.197.27 clean
http://www.disn-china.buzz/za6x/
whois
DE Contabo GmbH 161.97.168.245 clean
http://www.qwefs.org/toq1/
whois
HK POWER LINE DATACENTER 45.114.171.236 clean
http://www.disn-china.buzz/za6x/?Jht=EgAkyEJNK52+6mt3E5/kJbXdEzdYowDWwvgRo5oIQtO9ZSuXgOHTA+BJ7wLJ2gaYF8C47CtaBGKeFv/a+P8O0H1n59GM1zMsYaWK1AmiqPY5ZahcO8GJtNWa29lHrhEg3yNDlxM=&fl=WtGo
whois
DE Contabo GmbH 161.97.168.245 clean
http://www.pmjjewels.online/risb/
whois
Unknown 199.59.243.226 clean
http://www.sqlite.org/2016/sqlite-dll-win32-x86-3120000.zip
whois
US Linode, LLC 45.33.6.223 clean
http://www.sqlite.org/2017/sqlite-dll-win32-x86-3180000.zip
whois
US Linode, LLC 45.33.6.223 clean
http://www.mandemj.top/to69/?Jht=jnxbIh9toY3Lk087C6fRSAIIDhtmtOIIZy5Q1YpSMvmzprTTtz9chlCe8JLifgChZqJUy3cTTTxPfarkAUDrW4VnhfiXjSai62R1N2pl8mrhOBQxiL5e+vemTWR4j4PbfMHKe5c=&fl=WtGo
whois
US NAMECHEAP-NET 162.0.238.43 clean
http://www.trapkitten.website/vzgx/
whois
Unknown clean
http://www.kevin-torkelson.info/gekb/
whois
VG CONFLUENCE-NETWORK-INC 208.91.197.27 clean
http://www.sqlite.org/2021/sqlite-dll-win32-x86-3340000.zip
whois
US Linode, LLC 45.33.6.223 clean
http://www.mandemj.top/to69/
whois
US NAMECHEAP-NET 162.0.238.43 clean
http://www.qwefs.org/toq1/?Jht=uFBHOFjbtFvxqkcdxVd4tJdULw7QnIRXIDe+8RHTfxNdoahKRW8U0UCbhdOPwbKTgOK/uYLPOnJNTHSrlEGfXzyIhJOeIq51xyFm40Ibheoc9HKPcTfbc4gFNH+mWXon7XUk+C8=&fl=WtGo
whois
HK POWER LINE DATACENTER 45.114.171.236 clean
http://www.sqlite.org/2022/sqlite-dll-win32-x86-3370000.zip
whois
US Linode, LLC 45.33.6.223 clean
http://www.dfmagazine.shop/wc8m/?Jht=LNw/HBPP4tr5bvxRqEHHjPwHzHq/oSZ3YB7NlE9rWxPCxu7fGi7WVymEaD0ez69xv6ZMfJiRCRJpj/kbYTwl2Jp3vmj/K6IWSBhtVJ2AAHCG128jD1oExGyyLZzj9OMbCV/AQw0=&fl=WtGo
whois
LT UAB Nacionalinis Telekomunikaciju Tinklas 84.32.84.32 clean
http://www.pmjjewels.online/risb/?Jht=eaaelBCTiJBUEmuLZOnRpNwStkEgMLy/XK1YEbKYGwCJmco23DW+jwYfw/wGti4g6zAdqT8YjPqv8SPTYnHAaF9kOPWwjHlUiv4xVtfBSx2ls1nJs2JEa5QE0YkRP5wLYmM3P0s=&fl=WtGo
whois
Unknown 199.59.243.226 clean
www.pmjjewels.online
whois
Unknown 199.59.243.226 clean
www.trapkitten.website
whois
Unknown clean
www.mandemj.top
whois
US NAMECHEAP-NET 162.0.238.43 clean
www.disn-china.buzz
whois
DE Contabo GmbH 161.97.168.245 clean
www.dfmagazine.shop
whois
LT UAB Nacionalinis Telekomunikaciju Tinklas 84.32.84.32 clean
www.qwefs.org
whois
HK POWER LINE DATACENTER 45.114.171.236 clean
www.mktimediato.online
whois
Unknown clean
www.kevin-torkelson.info
whois
VG CONFLUENCE-NETWORK-INC 208.91.197.27 clean
199.59.243.226
whois
Unknown 199.59.243.226 phishing
84.32.84.32
whois
LT UAB Nacionalinis Telekomunikaciju Tinklas 84.32.84.32 mailcious
208.91.197.27
whois
VG CONFLUENCE-NETWORK-INC 208.91.197.27 mailcious
161.97.168.245
whois
DE Contabo GmbH 161.97.168.245 clean
45.114.171.236
whois
HK POWER LINE DATACENTER 45.114.171.236 clean
45.33.6.223
whois
US Linode, LLC 45.33.6.223 clean
162.0.238.43
whois
US NAMECHEAP-NET 162.0.238.43 mailcious
195.161.68.8
whois
RU JSC RTComm.RU 195.161.68.8 mailcious

Suricata ids

ET INFO HTTP Request to a *.buzz domain
ET INFO HTTP Request to a *.top domain
ET DNS Query to a *.top domain - Likely Hostile

PE API

IAT(Import Address Table) Library

WSOCK32.dll
 0x48d7a8 __WSAFDIsSet
 0x48d7ac recv
 0x48d7b0 send
 0x48d7b4 setsockopt
 0x48d7b8 ntohs
 0x48d7bc recvfrom
 0x48d7c0 select
 0x48d7c4 WSAStartup
 0x48d7c8 htons
 0x48d7cc accept
 0x48d7d0 listen
 0x48d7d4 ind
 0x48d7d8 closesocket
 0x48d7dc connect
 0x48d7e0 WSACleanup
 0x48d7e4 ioctlsocket
 0x48d7e8 sendto
 0x48d7ec WSAGetLastError
 0x48d7f0 inet_addr
 0x48d7f4 gethostbyname
 0x48d7f8 gethostname
 0x48d7fc socket
VERSION.dll
 0x48d74c GetFileVersionInfoW
 0x48d750 VerQueryValueW
 0x48d754 GetFileVersionInfoSizeW
WINMM.dll
 0x48d798 timeGetTime
 0x48d79c waveOutSetVolume
 0x48d7a0 mciSendStringW
COMCTL32.dll
 0x48d088 ImageList_Destroy
 0x48d08c ImageList_Remove
 0x48d090 ImageList_SetDragCursorImage
 0x48d094 ImageList_BeginDrag
 0x48d098 ImageList_DragEnter
 0x48d09c ImageList_DragLeave
 0x48d0a0 ImageList_EndDrag
 0x48d0a4 ImageList_DragMove
 0x48d0a8 ImageList_Create
 0x48d0ac InitCommonControlsEx
 0x48d0b0 ImageList_ReplaceIcon
MPR.dll
 0x48d3e4 WNetUseConnectionW
 0x48d3e8 WNetCancelConnection2W
 0x48d3ec WNetGetConnectionW
 0x48d3f0 WNetAddConnection2W
WININET.dll
 0x48d75c InternetReadFile
 0x48d760 InternetCloseHandle
 0x48d764 InternetOpenW
 0x48d768 InternetSetOptionW
 0x48d76c InternetCrackUrlW
 0x48d770 HttpQueryInfoW
 0x48d774 InternetQueryOptionW
 0x48d778 HttpOpenRequestW
 0x48d77c HttpSendRequestW
 0x48d780 FtpOpenFileW
 0x48d784 FtpGetFileSize
 0x48d788 InternetOpenUrlW
 0x48d78c InternetConnectW
 0x48d790 InternetQueryDataAvailable
PSAPI.DLL
 0x48d468 GetProcessMemoryInfo
IPHLPAPI.DLL
 0x48d154 IcmpCreateFile
 0x48d158 IcmpCloseHandle
 0x48d15c IcmpSendEcho
USERENV.dll
 0x48d730 UnloadUserProfile
 0x48d734 DestroyEnvironmentBlock
 0x48d738 CreateEnvironmentBlock
 0x48d73c LoadUserProfileW
UxTheme.dll
 0x48d744 IsThemeActive
KERNEL32.dll
 0x48d164 WaitForSingleObject
 0x48d168 HeapAlloc
 0x48d16c GetProcessHeap
 0x48d170 HeapFree
 0x48d174 Sleep
 0x48d178 GetCurrentThreadId
 0x48d17c MultiByteToWideChar
 0x48d180 MulDiv
 0x48d184 GetVersionExW
 0x48d188 GetSystemInfo
 0x48d18c FreeLibrary
 0x48d190 LoadLibraryA
 0x48d194 GetProcAddress
 0x48d198 SetErrorMode
 0x48d19c WideCharToMultiByte
 0x48d1a0 lstrcpyW
 0x48d1a4 lstrlenW
 0x48d1a8 GetModuleHandleW
 0x48d1ac QueryPerformanceCounter
 0x48d1b0 VirtualFreeEx
 0x48d1b4 OpenProcess
 0x48d1b8 VirtualAllocEx
 0x48d1bc WriteProcessMemory
 0x48d1c0 ReadProcessMemory
 0x48d1c4 CreateFileW
 0x48d1c8 SetFilePointerEx
 0x48d1cc ReadFile
 0x48d1d0 WriteFile
 0x48d1d4 FlushFileBuffers
 0x48d1d8 TerminateProcess
 0x48d1dc CreateToolhelp32Snapshot
 0x48d1e0 Process32FirstW
 0x48d1e4 Process32NextW
 0x48d1e8 SetFileTime
 0x48d1ec GetFileAttributesW
 0x48d1f0 FindFirstFileW
 0x48d1f4 FindClose
 0x48d1f8 DeleteFileW
 0x48d1fc CloseHandle
 0x48d200 MoveFileW
 0x48d204 CopyFileW
 0x48d208 CreateDirectoryW
 0x48d20c RemoveDirectoryW
 0x48d210 SetSystemPowerState
 0x48d214 QueryPerformanceFrequency
 0x48d218 FindResourceW
 0x48d21c LoadResource
 0x48d220 LockResource
 0x48d224 SizeofResource
 0x48d228 EnumResourceNamesW
 0x48d22c OutputDebugStringW
 0x48d230 GetTempPathW
 0x48d234 GetTempFileNameW
 0x48d238 DeviceIoControl
 0x48d23c GetLocalTime
 0x48d240 CompareStringW
 0x48d244 DeleteCriticalSection
 0x48d248 CreateThread
 0x48d24c LeaveCriticalSection
 0x48d250 GetStdHandle
 0x48d254 CreatePipe
 0x48d258 InterlockedExchange
 0x48d25c TerminateThread
 0x48d260 LoadLibraryExW
 0x48d264 FindResourceExW
 0x48d268 VirtualFree
 0x48d26c FormatMessageW
 0x48d270 GetExitCodeProcess
 0x48d274 GetPrivateProfileStringW
 0x48d278 WritePrivateProfileStringW
 0x48d27c GetPrivateProfileSectionW
 0x48d280 WritePrivateProfileSectionW
 0x48d284 GetPrivateProfileSectionNamesW
 0x48d288 FileTimeToLocalFileTime
 0x48d28c FileTimeToSystemTime
 0x48d290 SystemTimeToFileTime
 0x48d294 LocalFileTimeToFileTime
 0x48d298 GetDriveTypeW
 0x48d29c GetDiskFreeSpaceExW
 0x48d2a0 GetDiskFreeSpaceW
 0x48d2a4 GetVolumeInformationW
 0x48d2a8 SetVolumeLabelW
 0x48d2ac CreateHardLinkW
 0x48d2b0 SetFileAttributesW
 0x48d2b4 GetShortPathNameW
 0x48d2b8 CreateEventW
 0x48d2bc SetEvent
 0x48d2c0 GetEnvironmentVariableW
 0x48d2c4 SetEnvironmentVariableW
 0x48d2c8 GlobalLock
 0x48d2cc GlobalUnlock
 0x48d2d0 GlobalAlloc
 0x48d2d4 GetFileSize
 0x48d2d8 GlobalFree
 0x48d2dc GlobalMemoryStatusEx
 0x48d2e0 Beep
 0x48d2e4 GetSystemDirectoryW
 0x48d2e8 GetComputerNameW
 0x48d2ec GetWindowsDirectoryW
 0x48d2f0 GetCurrentProcessId
 0x48d2f4 GetProcessIoCounters
 0x48d2f8 CreateProcessW
 0x48d2fc SetPriorityClass
 0x48d300 LoadLibraryW
 0x48d304 VirtualAlloc
 0x48d308 GetLastError
 0x48d30c GetModuleFileNameW
 0x48d310 GetFullPathNameW
 0x48d314 SetCurrentDirectoryW
 0x48d318 IsDebuggerPresent
 0x48d31c GetCurrentDirectoryW
 0x48d320 lstrcmpiW
 0x48d324 RaiseException
 0x48d328 InitializeCriticalSectionAndSpinCount
 0x48d32c InterlockedDecrement
 0x48d330 InterlockedIncrement
 0x48d334 DuplicateHandle
 0x48d338 GetCurrentProcess
 0x48d33c EnterCriticalSection
 0x48d340 GetCurrentThread
 0x48d344 ExitProcess
 0x48d348 GetModuleHandleExW
 0x48d34c ExitThread
 0x48d350 GetSystemTimeAsFileTime
 0x48d354 ResumeThread
 0x48d358 GetCommandLineW
 0x48d35c IsProcessorFeaturePresent
 0x48d360 HeapSize
 0x48d364 IsValidCodePage
 0x48d368 GetACP
 0x48d36c GetOEMCP
 0x48d370 GetCPInfo
 0x48d374 SetLastError
 0x48d378 UnhandledExceptionFilter
 0x48d37c SetUnhandledExceptionFilter
 0x48d380 TlsAlloc
 0x48d384 TlsGetValue
 0x48d388 TlsSetValue
 0x48d38c TlsFree
 0x48d390 GetStartupInfoW
 0x48d394 GetStringTypeW
 0x48d398 SetStdHandle
 0x48d39c GetFileType
 0x48d3a0 GetConsoleCP
 0x48d3a4 GetConsoleMode
 0x48d3a8 RtlUnwind
 0x48d3ac ReadConsoleW
 0x48d3b0 SetFilePointer
 0x48d3b4 GetTimeZoneInformation
 0x48d3b8 GetDateFormatW
 0x48d3bc GetTimeFormatW
 0x48d3c0 LCMapStringW
 0x48d3c4 GetEnvironmentStringsW
 0x48d3c8 FreeEnvironmentStringsW
 0x48d3cc HeapReAlloc
 0x48d3d0 WriteConsoleW
 0x48d3d4 SetEndOfFile
 0x48d3d8 FindNextFileW
 0x48d3dc SetEnvironmentVariableA
USER32.dll
 0x48d4ac CopyImage
 0x48d4b0 SetWindowPos
 0x48d4b4 GetCursorInfo
 0x48d4b8 RegisterHotKey
 0x48d4bc ClientToScreen
 0x48d4c0 GetKeyboardLayoutNameW
 0x48d4c4 IsCharAlphaW
 0x48d4c8 IsCharAlphaNumericW
 0x48d4cc IsCharLowerW
 0x48d4d0 IsCharUpperW
 0x48d4d4 GetMenuStringW
 0x48d4d8 GetSubMenu
 0x48d4dc GetCaretPos
 0x48d4e0 IsZoomed
 0x48d4e4 MonitorFromPoint
 0x48d4e8 GetMonitorInfoW
 0x48d4ec SetWindowLongW
 0x48d4f0 SetLayeredWindowAttributes
 0x48d4f4 FlashWindow
 0x48d4f8 GetClassLongW
 0x48d4fc TranslateAcceleratorW
 0x48d500 IsDialogMessageW
 0x48d504 GetSysColor
 0x48d508 InflateRect
 0x48d50c DrawFocusRect
 0x48d510 DrawTextW
 0x48d514 FrameRect
 0x48d518 DrawFrameControl
 0x48d51c FillRect
 0x48d520 PtInRect
 0x48d524 DestroyAcceleratorTable
 0x48d528 CreateAcceleratorTableW
 0x48d52c SetCursor
 0x48d530 GetWindowDC
 0x48d534 GetSystemMetrics
 0x48d538 DrawMenuBar
 0x48d53c GetActiveWindow
 0x48d540 CharNextW
 0x48d544 wsprintfW
 0x48d548 RedrawWindow
 0x48d54c DestroyMenu
 0x48d550 SetMenu
 0x48d554 GetWindowTextLengthW
 0x48d558 CreateMenu
 0x48d55c IsDlgButtonChecked
 0x48d560 DefDlgProcW
 0x48d564 CallWindowProcW
 0x48d568 ReleaseCapture
 0x48d56c SetCapture
 0x48d570 MonitorFromRect
 0x48d574 LoadImageW
 0x48d578 CreateIconFromResourceEx
 0x48d57c mouse_event
 0x48d580 ExitWindowsEx
 0x48d584 SetActiveWindow
 0x48d588 FindWindowExW
 0x48d58c EnumThreadWindows
 0x48d590 SetMenuDefaultItem
 0x48d594 InsertMenuItemW
 0x48d598 IsMenu
 0x48d59c TrackPopupMenuEx
 0x48d5a0 AdjustWindowRectEx
 0x48d5a4 DeleteMenu
 0x48d5a8 CheckMenuRadioItem
 0x48d5ac GetMenuItemID
 0x48d5b0 GetMenuItemCount
 0x48d5b4 SetMenuItemInfoW
 0x48d5b8 GetMenuItemInfoW
 0x48d5bc SetForegroundWindow
 0x48d5c0 IsIconic
 0x48d5c4 UnregisterHotKey
 0x48d5c8 SystemParametersInfoW
 0x48d5cc keybd_event
 0x48d5d0 SendInput
 0x48d5d4 GetAsyncKeyState
 0x48d5d8 SetKeyboardState
 0x48d5dc GetKeyboardState
 0x48d5e0 GetKeyState
 0x48d5e4 VkKeyScanW
 0x48d5e8 LoadStringW
 0x48d5ec DialogBoxParamW
 0x48d5f0 MessageBeep
 0x48d5f4 EndDialog
 0x48d5f8 SendDlgItemMessageW
 0x48d5fc GetDlgItem
 0x48d600 SetWindowTextW
 0x48d604 CopyRect
 0x48d608 ReleaseDC
 0x48d60c GetDC
 0x48d610 EndPaint
 0x48d614 BeginPaint
 0x48d618 GetClientRect
 0x48d61c GetMenu
 0x48d620 DestroyWindow
 0x48d624 EnumWindows
 0x48d628 GetDesktopWindow
 0x48d62c IsWindow
 0x48d630 IsWindowEnabled
 0x48d634 IsWindowVisible
 0x48d638 EnableWindow
 0x48d63c InvalidateRect
 0x48d640 GetWindowLongW
 0x48d644 GetWindowThreadProcessId
 0x48d648 AttachThreadInput
 0x48d64c GetFocus
 0x48d650 ScreenToClient
 0x48d654 SendMessageTimeoutW
 0x48d658 EnumChildWindows
 0x48d65c CharUpperBuffW
 0x48d660 GetClassNameW
 0x48d664 GetParent
 0x48d668 GetDlgCtrlID
 0x48d66c SendMessageW
 0x48d670 MapVirtualKeyW
 0x48d674 PostMessageW
 0x48d678 GetWindowRect
 0x48d67c SetUserObjectSecurity
 0x48d680 CloseDesktop
 0x48d684 CloseWindowStation
 0x48d688 OpenDesktopW
 0x48d68c SetProcessWindowStation
 0x48d690 GetProcessWindowStation
 0x48d694 OpenWindowStationW
 0x48d698 GetUserObjectSecurity
 0x48d69c SetRect
 0x48d6a0 SetClipboardData
 0x48d6a4 EmptyClipboard
 0x48d6a8 CountClipboardFormats
 0x48d6ac CloseClipboard
 0x48d6b0 GetClipboardData
 0x48d6b4 IsClipboardFormatAvailable
 0x48d6b8 OpenClipboard
 0x48d6bc BlockInput
 0x48d6c0 GetMessageW
 0x48d6c4 LockWindowUpdate
 0x48d6c8 DispatchMessageW
 0x48d6cc TranslateMessage
 0x48d6d0 GetCursorPos
 0x48d6d4 PeekMessageW
 0x48d6d8 MessageBoxW
 0x48d6dc DefWindowProcW
 0x48d6e0 MoveWindow
 0x48d6e4 SetFocus
 0x48d6e8 PostQuitMessage
 0x48d6ec KillTimer
 0x48d6f0 CreatePopupMenu
 0x48d6f4 RegisterWindowMessageW
 0x48d6f8 SetTimer
 0x48d6fc ShowWindow
 0x48d700 CreateWindowExW
 0x48d704 RegisterClassExW
 0x48d708 LoadIconW
 0x48d70c LoadCursorW
 0x48d710 GetSysColorBrush
 0x48d714 GetForegroundWindow
 0x48d718 MessageBoxA
 0x48d71c DestroyIcon
 0x48d720 FindWindowW
 0x48d724 CharLowerBuffW
 0x48d728 GetWindowTextW
GDI32.dll
 0x48d0c4 SetPixel
 0x48d0c8 DeleteObject
 0x48d0cc GetTextExtentPoint32W
 0x48d0d0 ExtCreatePen
 0x48d0d4 StrokeAndFillPath
 0x48d0d8 StrokePath
 0x48d0dc GetDeviceCaps
 0x48d0e0 CloseFigure
 0x48d0e4 LineTo
 0x48d0e8 AngleArc
 0x48d0ec CreateCompatibleBitmap
 0x48d0f0 CreateCompatibleDC
 0x48d0f4 MoveToEx
 0x48d0f8 Ellipse
 0x48d0fc PolyDraw
 0x48d100 BeginPath
 0x48d104 SelectObject
 0x48d108 StretchBlt
 0x48d10c GetDIBits
 0x48d110 DeleteDC
 0x48d114 GetPixel
 0x48d118 CreateDCW
 0x48d11c GetStockObject
 0x48d120 Rectangle
 0x48d124 SetViewportOrgEx
 0x48d128 GetObjectW
 0x48d12c SetBkMode
 0x48d130 RoundRect
 0x48d134 SetBkColor
 0x48d138 CreatePen
 0x48d13c CreateSolidBrush
 0x48d140 SetTextColor
 0x48d144 CreateFontW
 0x48d148 GetTextFaceW
 0x48d14c EndPath
COMDLG32.dll
 0x48d0b8 GetSaveFileNameW
 0x48d0bc GetOpenFileNameW
ADVAPI32.dll
 0x48d000 GetAclInformation
 0x48d004 RegEnumValueW
 0x48d008 RegDeleteValueW
 0x48d00c RegDeleteKeyW
 0x48d010 RegEnumKeyExW
 0x48d014 RegSetValueExW
 0x48d018 RegCreateKeyExW
 0x48d01c GetUserNameW
 0x48d020 RegOpenKeyExW
 0x48d024 RegCloseKey
 0x48d028 RegQueryValueExW
 0x48d02c RegConnectRegistryW
 0x48d030 InitializeSecurityDescriptor
 0x48d034 InitializeAcl
 0x48d038 AdjustTokenPrivileges
 0x48d03c OpenThreadToken
 0x48d040 OpenProcessToken
 0x48d044 LookupPrivilegeValueW
 0x48d048 DuplicateTokenEx
 0x48d04c CreateProcessAsUserW
 0x48d050 CreateProcessWithLogonW
 0x48d054 GetLengthSid
 0x48d058 CopySid
 0x48d05c InitiateSystemShutdownExW
 0x48d060 LogonUserW
 0x48d064 AllocateAndInitializeSid
 0x48d068 CheckTokenMembership
 0x48d06c FreeSid
 0x48d070 GetTokenInformation
 0x48d074 GetSecurityDescriptorDacl
 0x48d078 SetSecurityDescriptorDacl
 0x48d07c AddAce
 0x48d080 GetAce
SHELL32.dll
 0x48d470 DragQueryPoint
 0x48d474 ShellExecuteExW
 0x48d478 DragQueryFileW
 0x48d47c SHEmptyRecycleBinW
 0x48d480 SHBrowseForFolderW
 0x48d484 SHGetFolderPathW
 0x48d488 SHFileOperationW
 0x48d48c SHGetPathFromIDListW
 0x48d490 SHGetDesktopFolder
 0x48d494 SHGetMalloc
 0x48d498 ExtractIconExW
 0x48d49c Shell_NotifyIconW
 0x48d4a0 ShellExecuteW
 0x48d4a4 DragFinish
ole32.dll
 0x48d804 CoTaskMemAlloc
 0x48d808 CoTaskMemFree
 0x48d80c CLSIDFromString
 0x48d810 ProgIDFromCLSID
 0x48d814 CLSIDFromProgID
 0x48d818 OleSetMenuDescriptor
 0x48d81c MkParseDisplayName
 0x48d820 OleSetContainedObject
 0x48d824 CoCreateInstance
 0x48d828 IIDFromString
 0x48d82c StringFromGUID2
 0x48d830 CreateStreamOnHGlobal
 0x48d834 CoInitialize
 0x48d838 CoUninitialize
 0x48d83c GetRunningObjectTable
 0x48d840 CoGetInstanceFromFile
 0x48d844 CoGetObject
 0x48d848 CoInitializeSecurity
 0x48d84c CoCreateInstanceEx
 0x48d850 CoSetProxyBlanket
OLEAUT32.dll
 0x48d3f8 RegisterTypeLib
 0x48d3fc LoadTypeLibEx
 0x48d400 VariantCopyInd
 0x48d404 SysReAllocString
 0x48d408 SysFreeString
 0x48d40c SafeArrayDestroyDescriptor
 0x48d410 SafeArrayDestroyData
 0x48d414 SafeArrayUnaccessData
 0x48d418 SafeArrayAccessData
 0x48d41c SafeArrayAllocData
 0x48d420 UnRegisterTypeLib
 0x48d424 SafeArrayCreateVector
 0x48d428 SysAllocString
 0x48d42c SysStringLen
 0x48d430 VariantTimeToSystemTime
 0x48d434 VarR8FromDec
 0x48d438 SafeArrayGetVartype
 0x48d43c OleLoadPicture
 0x48d440 QueryPathOfRegTypeLib
 0x48d444 VariantCopy
 0x48d448 VariantClear
 0x48d44c CreateDispTypeInfo
 0x48d450 CreateStdDispatch
 0x48d454 DispCallFunc
 0x48d458 VariantChangeType
 0x48d45c SafeArrayAllocDescriptorEx
 0x48d460 VariantInit

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure