89611cfac7871473374a0de73b6227981459a696779245419c6eb5e89ed62bc9

Sharing

Copy URL

Twitter E-mail

General

Target

89611cfac7871473374a0de73b6227981459a696779245419c6eb5e89ed62bc9
Size

472KB
MD5

2c798b7fa79f2d9e04bd25e6e61ba655
SHA1

245f8771e2da56a7e62d958312a9060560010cb6
SHA256

89611cfac7871473374a0de73b6227981459a696779245419c6eb5e89ed62bc9
SHA512

12994b06717521acc8249afeb450ce2c228795547e0ced327dc44fcb656253f2ec2f1d8515da023191349e854d6ca9b587c7f850956f29ba952afcb02816d0ee
SSDEEP

6144:Yfey9nSvkGiw1q3MDpklTIiWU9mmOQHkS5FyPXvITls6EnO2W5:YSvkGD1qG2HWU9mmOQHkS5EXGsW5

Score

N/A

Malware Config

Signatures

Files

89611cfac7871473374a0de73b6227981459a696779245419c6eb5e89ed62bc9
.exe windows x86

f2b1b344c8ae374901906423aed0f4e1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipDeleteGraphics
GdipDrawImageI
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImagePointRectI
GdiplusShutdown
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusStartup

winmm

timeSetEvent
timeGetTime

avutil-50

ord12
ord32
ord60
ord45
ord31

avformat-52

ord23
ord31
ord51
ord30
ord62
ord496
ord78
ord79
ord487
ord43
ord68
ord82
ord58
ord271
ord81
ord70
ord49

avcodec-52

ord630
ord557
ord514
ord519
ord534
ord513
ord599
ord616
ord518
ord582
ord532
ord602
ord588
ord603
ord584
ord607
ord626
ord601
ord579
ord632
ord558
ord541
ord597
ord595
ord533
ord608

swscale-0

ord69
ord77
ord63

mfc80u

ord709
ord347
ord602
ord1270
ord5633
ord293
ord577
ord776
ord774
ord870
ord2895
ord2587
ord3158
ord4255
ord4480
ord3943
ord2638
ord3703
ord3713
ord3712
ord2527
ord2640
ord2534
ord2856
ord2708
ord4301
ord2829
ord2725
ord2531
ord5196
ord1590
ord1646
ord1647
ord1955
ord5171
ord1353
ord4961
ord3339
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2397
ord2409
ord2386
ord2402
ord2407
ord2390
ord2392
ord2394
ord2388
ord2404
ord2384
ord931
ord927
ord929
ord925
ord920
ord5229
ord5231
ord5956
ord1591
ord4276
ord4716
ord3397
ord5210
ord4179
ord6271
ord5067
ord1899
ord5148
ord4226
ord1393
ord3940
ord1608
ord1611
ord5911
ord6721
ord1536
ord2077
ord3990
ord2261
ord762
ord3435
ord354
ord605
ord3157
ord2086
ord1582
ord4234
ord3311
ord741
ord1785
ord3635
ord4574
ord1118
ord4119
ord2361
ord1386
ord6086
ord2489
ord2860
ord280
ord2311
ord6063
ord501
ord4347
ord4206
ord5727
ord4314
ord1416
ord6111
ord4256
ord5199
ord4238
ord1392
ord5908
ord6720
ord1542
ord1661
ord1662
ord2011
ord4884
ord4729
ord5178
ord1472
ord6700
ord282
ord1479
ord5558
ord5524
ord3189
ord620
ord1922
ord1474
ord4092
ord2080
ord1538
ord4228
ord3165
ord591
ord1638
ord1580
ord3309
ord739
ord5609
ord3756
ord2461
ord3281
ord4117
ord3995
ord5636
ord5637
ord1920
ord2648
ord4686
ord5829
ord567
ord758
ord5638
ord384
ord629
ord5083
ord5319
ord899
ord563
ord753
ord2121
ord3395
ord1006
ord6251
ord6061
ord2460
ord5398
ord3927
ord2952
ord658
ord3645
ord2651
ord2867
ord1545
ord3789
ord3873
ord5869
ord4558
ord5053
ord3224
ord4232
ord2083
ord283
ord4101
ord896
ord284
ord860
ord3590
ord4882
ord1946
ord4094
ord2085
ord3238
ord1058
ord1274
ord6140
ord2365
ord3983
ord4535
ord3677
ord566
ord757
ord3824
ord1117
ord5971
ord3327
ord4475
ord2832
ord5562
ord5209
ord5226
ord4562
ord3942
ord2239
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord5096
ord1007
ord1271
ord5579
ord2009
ord2054
ord4320
ord6274
ord3795
ord6272
ord4008
ord4032
ord2468
ord4026
ord3869
ord4109
ord2155
ord1079
ord385
ord630
ord2012
ord3082
ord2741
ord5742
ord2748
ord5862
ord5867
ord386
ord631
ord2271
ord4098
ord3176
ord3545
ord3286
ord715
ord3133
ord2255
ord1572
ord1634
ord3565
ord3570
ord1182
ord1178
ord6133
ord1476
ord6232
ord6161
ord4100
ord2260
ord1086
ord1156
ord6033
ord433
ord667
ord1430
ord317
ord584
ord319
ord3787
ord3331
ord502
ord1957
ord2066
ord1959
ord1719
ord1894
ord2366
ord3678
ord3155
ord3204
ord1925
ord587
ord572
ord760
ord2985
ord3198
ord1930
ord2362
ord266
ord265
ord764
ord909
ord1198
ord2876
ord3800

msvcr80

memmove_s
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
?what@exception@std@@UBEPBDXZ
__CxxFrameHandler3
memcmp
memcpy
memset
_purecall
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
??1exception@std@@UAE@XZ
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
wcsftime
_time64
wcsncpy
fflush
fclose
fwrite
fread
_ftelli64
_fseeki64
_wfopen
wcschr
wcstol
wcsncmp
_vswprintf
memmove
wcstoul
__iob_func
fprintf
wcsstr
_wtoi
swscanf
_CxxThrowException
??0exception@std@@QAE@ABQBD@Z
_wtol
malloc
free
_resetstkoflw
_onexit
_localtime64_s

kernel32

GetACP
FormatMessageW
GetModuleFileNameW
WritePrivateProfileStringW
GetPrivateProfileStringW
CreateDirectoryW
InitializeCriticalSection
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
LeaveCriticalSection
FindResourceW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
GetCurrentThread
GetThreadPriority
lstrcmpiW
GetModuleHandleW
SetThreadPriority
GetProcAddress
VirtualFree
VirtualAlloc
GetSystemInfo
ReleaseSemaphore
CreateSemaphoreW
WaitForMultipleObjects
SetEvent
GetCurrentThreadId
DuplicateHandle
ResetEvent
CreateEventW
InterlockedDecrement
InterlockedIncrement
lstrcpynW
lstrcmpW
GetVersionExW
MulDiv
FreeResource
SizeofResource
LoadResource
DeleteCriticalSection
CloseHandle
lstrlenW
WideCharToMultiByte
GetTickCount
GetCurrentProcess
GetLastError
lstrcpyW
lstrcatW
WinExec
WaitForSingleObject
CreateThread
TerminateThread
Sleep
lstrlenA
MultiByteToWideChar
GetWindowsDirectoryW
LoadLibraryW
FreeLibrary
EnterCriticalSection

user32

GetMessageW
GetQueueStatus
RegisterWindowMessageW
PostThreadMessageW
wsprintfW
wvsprintfW
MsgWaitForMultipleObjects
PeekMessageW
SetWindowPos
GetDesktopWindow
GetPropW
SetPropW
GetClassNameW
WindowFromPoint
GetWindowDC
DrawIconEx
CreateWindowExW
SystemParametersInfoW
DefWindowProcW
DestroyWindow
RegisterClassW
DestroyIcon
UpdateWindow
SetRectEmpty
GetSysColor
GetParent
GetWindowRect
InvalidateRect
LoadImageW
EnableWindow
GetClientRect
CopyRect
GetDC
ReleaseDC
SetWindowRgn
PostMessageW
SetTimer
KillTimer
ExitWindowsEx
SendMessageW
PtInRect
OffsetRect
SetRect
BeginPaint
IntersectRect
EndPaint
IsRectEmpty
FillRect
GetKeyState
TranslateMessage
DispatchMessageW
DestroyCursor
SetCursor
SetWindowLongW
IsWindow
InflateRect
LoadCursorW
CopyIcon
GetCursorPos
RedrawWindow
GetWindowLongW
GetFocus
LoadMenuW
SetForegroundWindow
GetSubMenu
LoadIconW
GetSystemMenu
AppendMenuW
IsIconic
GetSystemMetrics
DrawIcon
ScreenToClient
EqualRect
GetCapture
SetCapture
ReleaseCapture

gdi32

CreateSolidBrush
CreateDiscardableBitmap
GetTextExtentPoint32W
CreatePen
Rectangle
SelectObject
CreateRoundRectRgn
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC
GetStockObject
GetObjectW
CreateFontIndirectW
DeleteDC
GetDeviceCaps
CreateDIBitmap
DeleteObject

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyExW
RegQueryValueW
RegCloseKey
OpenProcessToken

shell32

ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFindExtensionW
PathFileExistsW

ole32

CoTaskMemAlloc
CoInitialize
CoFreeUnusedLibraries
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
OleLoadPicture

ws2_32

WSAStartup

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IBEPBDXZ

Sections

.text
Size: 324KB - Virtual size: 322KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2b1b344c8ae374901906423aed0f4e1

Headers

File Characteristics

Imports

gdiplus

winmm

avutil-50

avformat-52

avcodec-52

swscale-0

mfc80u

msvcr80

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

ws2_32

msvcp80

Sections

.text Size: 324KB - Virtual size: 322KB

.rdata Size: 116KB - Virtual size: 113KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 24KB - Virtual size: 23KB

.text
Size: 324KB - Virtual size: 322KB

.rdata
Size: 116KB - Virtual size: 113KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 24KB - Virtual size: 23KB