edcfc4fe0473fe349c63c220ea2664aaf3e7b48bfed32f54600bb8647e2d3e2f

Sharing

Copy URL Twitter E-mail

General

Target

edcfc4fe0473fe349c63c220ea2664aaf3e7b48bfed32f54600bb8647e2d3e2f
Size

188KB
MD5

99bc581b60a8c317ff1ad5c9bec06c6e
SHA1

cf8365bd85b727a4d2b230a59efeb3034e79ae53
SHA256

edcfc4fe0473fe349c63c220ea2664aaf3e7b48bfed32f54600bb8647e2d3e2f
SHA512

c28fbccdbb407c6a6fdc41f735ae972ffdfa0099876967c7de8b4d516c47a1248fac2f15ae5307ac57b86e247c30eace10fe02034108832d0f70740170fddd04
SSDEEP

3072:GUzD0ZosgoV+bMMBVlUnYVuEs37espQiwqk8IXss:ZzwZosKlyIs3HHxk8IX

Score

N/A

Malware Config

Signatures

Files

edcfc4fe0473fe349c63c220ea2664aaf3e7b48bfed32f54600bb8647e2d3e2f
.exe windows x86

1dfab2e076f8ddecf57268cb4de41167

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

librscreen

?Initialize@CLibRScreen@@QAEHPBD@Z
??0CLibRScreen@@QAE@XZ
??1CLibRScreen@@QAE@XZ
?Deinitialize@CLibRScreen@@QAEXXZ

iphlpapi

GetAdaptersInfo

lspctrl

LSPCtrl

mfc42

ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord654
ord815
ord541
ord341
ord561
ord801
ord2086
ord2621
ord1134
ord2725
ord535
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord692
ord2863
ord755
ord470
ord4220
ord2584
ord3654
ord2438
ord6270
ord1644
ord665
ord1979
ord5572
ord6385
ord3337
ord3811
ord5186
ord354
ord6883
ord5858
ord6140
ord6143
ord6779
ord6778
ord538
ord6648
ord924
ord922
ord941
ord2764
ord3499
ord6375
ord6379
ord539
ord640
ord2405
ord6157
ord5785
ord1640
ord323
ord1158
ord5861
ord2301
ord1779
ord4055
ord6877
ord668
ord1980
ord2770
ord356
ord3742
ord818
ord2152
ord1233
ord6128
ord4284
ord4274
ord4673
ord2818
ord926
ord1200
ord6880
ord2860
ord5875
ord4275
ord656
ord5252
ord4242
ord674
ord366
ord4427
ord4436
ord1665
ord2649
ord5282
ord5237
ord4077
ord4151
ord2878
ord2879
ord3403
ord5472
ord975
ord5012
ord3350
ord795
ord3721
ord6282
ord6283
ord4224
ord5981
ord939
ord940
ord2121
ord1146
ord1641
ord2096
ord2639
ord808
ord2414
ord3626
ord3663
ord384
ord686
ord3731
ord2554
ord3571
ord4229
ord355
ord2515
ord1834
ord2817
ord765
ord3698
ord3998
ord6907
ord1576
ord6007
ord3286
ord3996
ord2642
ord693
ord609
ord3640
ord3370
ord4402
ord2582
ord3574
ord4396
ord4303
ord4467
ord5103
ord5100
ord3059
ord2390
ord2723
ord1842
ord6394
ord6383
ord5440
ord5450
ord3318
ord5442
ord2763
ord915
ord400
ord2107
ord5683
ord5856
ord4191
ord5484
ord2092
ord5934
ord920
ord837
ord2841
ord3810
ord2575
ord2302
ord616
ord567
ord3582
ord4424
ord3402
ord5290
ord4398
ord1776
ord6055
ord2578
ord4218
ord2023
ord2411
ord2379
ord6453
ord289
ord4299
ord613
ord4853
ord4376
ord860
ord823
ord2614
ord858
ord2915
ord537
ord6334
ord2370
ord2864
ord2142
ord6215
ord540
ord4160
ord1168
ord800
ord3092
ord6199
ord1768
ord5953
ord4710
ord6380
ord6197
ord1175
ord4234
ord641
ord825
ord324
ord3597
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord5265
ord3396
ord4486
ord6605

msvcrt

_vsnprintf
srand
ceil
??1type_info@@UAE@XZ
fclose
_strnicmp
strchr
_mbsrchr
_ftol
_stricmp
__CxxFrameHandler
rand
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strftime
fwrite
__p___argc
__p___argv
sscanf
strncpy
_mbsstr
localtime
time
fseek
fopen
malloc
free
_mbscmp
_makepath
_splitpath
sprintf
strstr
_setmbcp
_CxxThrowException
_itoa

kernel32

GetLocalTime
IsBadWritePtr
GetPrivateProfileIntA
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionA
SystemTimeToFileTime
GetSystemTime
ExpandEnvironmentStringsA
CreateSemaphoreA
OpenSemaphoreA
GetTickCount
ReleaseSemaphore
LockResource
LoadResource
FindResourceA
OutputDebugStringA
GetModuleFileNameA
TerminateProcess
CreateProcessA
lstrcpyA
WinExec
lstrlenA
lstrcatA
CloseHandle
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
CreateThread
GetCurrentProcessId
FreeLibrary
GetProcAddress
LoadLibraryA
GetLastError
CreateEventA
LocalFree
Sleep
TerminateThread
GetVersionExA
ReadFile
GetFileSize
CreateFileA
CreateTimerQueueTimer
CreateTimerQueue
SetEvent
InterlockedExchange
ExitProcess
Beep
GetStartupInfoA
GetModuleHandleA
WriteFile
CreateToolhelp32Snapshot
Process32First
OpenProcess
Process32Next
SetLocalTime
IsBadReadPtr
FormatMessageA
WaitForMultipleObjects
InterlockedDecrement
GetCurrentProcess
WaitForSingleObject
CreateDirectoryA
MultiByteToWideChar
FindFirstFileA
FindNextFileA
DeleteFileA
FindClose

user32

InvalidateRect
SetCursor
BringWindowToTop
MessageBeep
GetCursorPos
LoadBitmapA
SetParent
GetClientRect
RegisterWindowMessageA
LoadMenuA
AppendMenuA
GetSystemMenu
DrawIcon
IsIconic
EnableMenuItem
RemoveMenu
GetWindowLongA
SetWindowLongA
DefWindowProcA
LoadCursorA
RegisterClassExA
SetFocus
SetWindowPos
SetForegroundWindow
SetActiveWindow
ShowCursor
GetDC
ReleaseDC
CreateWindowExA
ShowWindow
UpdateWindow
FindWindowA
EnableWindow
IsWindow
GetForegroundWindow
KillTimer
SetTimer
LoadIconA
wsprintfA
SendMessageA
GetWindowRect
GetSystemMetrics
OffsetRect
PostMessageA
GetAsyncKeyState
GetSubMenu
SystemParametersInfoA
UnhookWindowsHookEx
SetWindowsHookExA
ExitWindowsEx
SetCursorPos
UnregisterHotKey
RegisterHotKey
CallNextHookEx
GetKeyState
DestroyIcon
LoadStringA
LoadImageA
keybd_event
MapVirtualKeyA
MessageBoxA
GetDesktopWindow
ModifyMenuA
EnableScrollBar
TrackPopupMenuEx
CheckMenuItem
ScreenToClient
DestroyMenu
mouse_event

gdi32

SelectPalette
SetStretchBltMode
CreatePalette
StretchDIBits
RealizePalette
DeleteObject
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
StretchBlt
GetBitmapBits
GetObjectA
CreateFontIndirectA
GetStockObject
GetDeviceCaps

advapi32

RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetKernelObjectSecurity
RegDeleteValueA
RegOpenKeyA
RegCreateKeyA
GetUserNameA
RegEnumKeyA
RegQueryValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shell32

ShellExecuteA
Shell_NotifyIconA

comctl32

ImageList_AddMasked

ole32

CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantClear
SysAllocString
SysFreeString

winmm

timeSetEvent
timeKillEvent
mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
mixerGetNumDevs
mixerSetControlDetails
timeGetTime
mixerGetDevCapsA
mixerGetControlDetailsA
PlaySoundA

ws2_32

gethostname
inet_ntoa
inet_addr
WSACleanup
gethostbyname
WSAStartup

simcom

??0CSimSend@@QAE@XZ
SimGetHostIP
RegWriteString
SimInitInstance
RegWriteDWORD
?InitInstance@CSimListen@@QAEHPAUtagParamListen@@@Z
??0tagParamListen@@QAE@XZ
?Release@CSimListen@@QAEXXZ
?Reset@tagParamListen@@QAEHXZ
?InitInstance@CSimSend@@QAEHPAUtagParamSend@@@Z
??0tagParamSend@@QAE@XZ
?Release@CSimSend@@QAEXXZ
SimExitInstance
??0CSimListen@@QAE@XZ
RegReadString
??1CSimSend@@QAE@XZ
??1CSimListen@@UAE@XZ
RegReadDWORD
SimGetCompName
?Send@CSimSend@@QAEHPAXKKH@Z
SimGetNetCard

simcom3

?Release@CSimSend3@@QAEXXZ
?Send@CSimSend3@@QAEHPAEKKG@Z
?InitInstance@CSimSend3@@QAEHPAUtagParamSend3@@@Z
??1CSimSend3@@UAE@XZ
??0CSimSend3@@QAE@XZ

gbm

_gbm_read_header@20
_gbm_io_close@4
_gbm_read_palette@16
_gbm_read_data@16
_gbm_io_open@8
_gbm_guess_filetype@8

lansound

StopSaveSound
BeginSaveSound
SetPausePlaySound
PlaySoundFile
StopRecvSaveFile
StopPlaySoundFile
SetMicrophone
StopRecvSound
SetSaveToMP3
BeginRecvSound
BeginSendSound
StopSendSound
LSCloseDriver
SetRecvSaveFile
LSInitDriver

collusion

ord9
ord8
ord2
ord4
ord6
ord15
ord7
ord5

lancap32

SetVisible
LanInitDriver
LanCloseDriver
SetStretchMode
OnlineSetBroadcastMode
GetSourceScreenSize
SetSourcePosition
JpegCompress
SetPlaybackPause
SetPlayFileName
SetWindowPosition
SetReceiveThreadPriority
SetSTPlayFile
SetPlayEndMessageWindowHand
SetSTRecordAndFileName
SetFullScreenMode
SetScreenReceive
SetCapThreadPriority
SetCapSafeMode
SetBroadcastAddress
SetScreenBroadcast
RequestFullScreen
SetReceiveAddress
SetOwner
SetCursorDisplay
SetMessageDrain
SetScreenReceiveThreadWnd
SetSmoothRenderMode

lanhookex

AddProcessId
InstallHook
InitLanHookEx
ExitLanHookEx

coderes

??0CRegisterDlg@@QAE@PBDPAVCWnd@@@Z
?GetSerialNum@CRegisterDlg@@QAEPBDXZ
??1CRegisterDlg@@UAE@XZ

plantaskclient

??0CClientPlanThread@@QAE@XZ
??1CClientPlanThread@@QAE@XZ
?StartClientPlanThread@CClientPlanThread@@QAEHXZ

sendjobthread

??0COutForThread@@QAE@XZ
??1COutForThread@@QAE@XZ
?BeginThreadForSendJob@COutForThread@@QAEXXZ

Exports

Exports

??4CClientPlanThread@@QAEAAV0@ABV0@@Z
??4COutForThread@@QAEAAV0@ABV0@@Z

Sections

.text
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1dfab2e076f8ddecf57268cb4de41167

Headers

File Characteristics

Imports

librscreen

iphlpapi

lspctrl

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

winmm

ws2_32

simcom

simcom3

gbm

lansound

collusion

lancap32

lanhookex

coderes

plantaskclient

sendjobthread

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 124KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 16KB - Virtual size: 29KB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 128KB - Virtual size: 124KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 16KB - Virtual size: 29KB

.rsrc
Size: 8KB - Virtual size: 4KB