345bc8340e24f0a14d71b08cfeb97189f79548fcd50da215399e20217adaea92

Sharing

Copy URL Twitter E-mail

General

Target

345bc8340e24f0a14d71b08cfeb97189f79548fcd50da215399e20217adaea92
Size

576KB
MD5

69ce535161b6e9d789bc07d7087a18b9
SHA1

f3012b8916fa56bb123e5abab33d4351597305f4
SHA256

345bc8340e24f0a14d71b08cfeb97189f79548fcd50da215399e20217adaea92
SHA512

c1e73499ab807df10c01bf73c8280c01fbd05b85be342f504206c5dafc596e05aee1ef265c98f28f4a36f0d01a3a4cb8c318438ea5d6d303d65038d7d273a456
SSDEEP

12288:k9ZRRqcUCEXnDFkHKCDWM3FF6rpwWx2p2wGTqLRQ9:kvqcnEXDGHKCD9FRWxlqG9

Score

N/A

Malware Config

Signatures

Files

345bc8340e24f0a14d71b08cfeb97189f79548fcd50da215399e20217adaea92
.exe windows x86

36435699c7ac01eeb0c1c82517c2f57d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc80u

ord3204
ord1118
ord1925
ord3198
ord1271
ord4078
ord6172
ord6166
ord4121
ord776
ord5609
ord3690
ord6061
ord899
ord647
ord4260
ord2950
ord2711
ord1552
ord5162
ord1351
ord3338
ord5202
ord5147
ord1610
ord5910
ord6763
ord3968
ord4854
ord4857
ord4373
ord4378
ord4375
ord4393
ord4395
ord4380
ord4770
ord4581
ord4172
ord4165
ord4974
ord4383
ord4773
ord4198
ord4784
ord4437
ord4438
ord3734
ord4908
ord4513
ord4514
ord4914
ord4553
ord4433
ord4362
ord4495
ord4840
ord4964
ord4523
ord4474
ord4965
ord4510
ord4942
ord4788
ord4281
ord4370
ord4371
ord4957
ord4790
ord4704
ord4358
ord4799
ord5047
ord4958
ord4643
ord4940
ord4501
ord4955
ord4668
ord4125
ord1293
ord1999
ord4126
ord3378
ord2631
ord2230
ord2413
ord2414
ord2415
ord2412
ord2411
ord5043
ord409
ord4098
ord287
ord896
ord860
ord774
ord2470
ord3756
ord6232
ord6116
ord2797
ord6201
ord747
ord559
ord3168
ord1176
ord266
ord548
ord587
ord3158
ord4226
ord1536
ord777
ord1079
ord3281
ord2366
ord1894
ord2077
ord605
ord3995
ord4117
ord5637
ord2255
ord2066
ord602
ord1957
ord5727
ord1270
ord347
ord1183
ord2010
ord333
ord3678
ord502
ord3677
ord4535
ord566
ord3327
ord4475
ord2832
ord5562
ord5209
ord5226
ord4562
ord3942
ord2239
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord5096
ord1007
ord3800
ord5579
ord2009
ord2054
ord4320
ord6274
ord3795
ord6272
ord4008
ord4032
ord757
ord2011
ord3824
ord4314
ord3249
ord1172
ord1472
ord6282
ord3157
ord3155
ord1058
ord3238
ord2085
ord4094
ord1946
ord1274
ord2365
ord4119
ord2361
ord3311
ord4234
ord1582
ord2086
ord741
ord3165
ord4228
ord1538
ord2080
ord4092
ord1474
ord1922
ord591
ord3189
ord620
ord3051
ord1785
ord2651
ord5869
ord5524
ord6171
ord2159
ord709
ord501
ord630
ord3032
ord2012
ord3050
ord385
ord2860
ord6140
ord5867
ord5829
ord2876
ord2893
ord2877
ord3789
ord5327
ord6293
ord2364
ord3869
ord4109
ord1272
ord1220
ord2634
ord2260
ord2155
ord5485
ord651
ord416
ord354
ord3176
ord4256
ord5199
ord1392
ord5908
ord6720
ord1542
ord1661
ord1662
ord4884
ord4729
ord4206
ord5178
ord6115
ord4574
ord5803
ord3635
ord3435
ord894
ord6161
ord2656
ord658
ord3224
ord2952
ord4232
ord2083
ord2151
ord2654
ord5801
ord5633
ord5862
ord642
ord1920
ord3296
ord1959
ord6058
ord3174
ord5715
ord5917
ord5397
ord5410
ord5584
ord5519
ord5643
ord5638
ord5723
ord6033
ord5884
ord6053
ord4155
ord6050
ord5604
ord6056
ord5607
ord2521
ord1781
ord1883
ord3467
ord4230
ord1549
ord1628
ord1198
ord4755
ord3483
ord4063
ord4061
ord5427
ord868
ord866
ord2362
ord664
ord429
ord427
ord2579
ord5468
ord3019
ord5466
ord666
ord2867
ord3645
ord3417
ord6173
ord6167
ord753
ord1006
ord3927
ord1939
ord2648
ord563
ord3983
ord3395
ord3590
ord897
ord2121
ord3497
ord758
ord567
ord3946
ord5636
ord326
ord629
ord3383
ord384
ord1066
ord1719
ord6111
ord6700
ord282
ord1479
ord6086
ord3470
ord5210
ord265
ord6063
ord760
ord6721
ord5911
ord1611
ord1608
ord3940
ord1393
ord4238
ord5148
ord1899
ord5067
ord6271
ord4179
ord3397
ord4716
ord4276
ord1591
ord5956
ord5231
ord5229
ord920
ord925
ord929
ord927
ord931
ord2384
ord2404
ord2388
ord2394
ord2392
ord2390
ord2407
ord2402
ord2386
ord2409
ord2397
ord2379
ord2381
ord2399
ord2169
ord2163
ord1513
ord6273
ord3796
ord6275
ord3339
ord4961
ord1353
ord5171
ord1955
ord1647
ord1646
ord1590
ord5196
ord2531
ord2725
ord2829
ord4301
ord2708
ord2856
ord2534
ord2640
ord2527
ord2985
ord3712
ord3713
ord3703
ord2638
ord3943
ord4480
ord4255
ord3331
ord572
ord2261
ord762
ord2311
ord5558
ord870
ord1476
ord4101
ord3990
ord4100
ord283
ord280
ord293
ord2895
ord2460
ord5398
ord577
ord1178
ord1182
ord764
ord5316
ord2788

msvcr80

sprintf
__CxxFrameHandler3
_wcsicmp
_itoa
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
_wtol
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_wcsnicmp
memcpy
memset
memcpy_s
_wtoi
exit
_vswprintf_c_l
_invalid_parameter_noinfo
memmove_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
malloc
free
_wsplitpath
_wmakepath
strncpy
sscanf
atoi
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm

kernel32

LoadLibraryA
FreeLibrary
GetProcAddress
GetModuleHandleW
GetPrivateProfileStringA
WritePrivateProfileStringA
lstrcpynA
InterlockedExchange
InterlockedCompareExchange
lstrlenW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetVersionExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfoExW
EnumSystemCodePagesW
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
OutputDebugStringW
CloseHandle
ReadFile
GetFileSize
CreateFileW
FindClose
FindFirstFileW
Sleep
lstrlenA
WriteFile
CreateThread
SetFilePointer
GetLastError
SetEndOfFile
lstrcpynW
OutputDebugStringA
MulDiv
FindNextFileW
GetFileAttributesW
GetLocaleInfoA
GetThreadLocale
GetACP
GetVersionExA
GetStartupInfoW
CreateDirectoryW

user32

AppendMenuW
GetMenuItemCount
GetMenuItemInfoW
SystemParametersInfoW
RegisterClassExW
GetSysColorBrush
SetPropW
GetPropW
TabbedTextOutW
DrawTextW
SetWindowRgn
SetWindowPos
SetWindowLongW
GetFocus
GetCursorPos
LoadIconW
SetForegroundWindow
RedrawWindow
IsZoomed
DrawEdge
LoadMenuW
SetMenuItemBitmaps
GetSubMenu
SetMenuDefaultItem
CreatePopupMenu
DrawIcon
LoadBitmapW
CopyRect
DestroyIcon
MessageBoxW
ScreenToClient
SetWindowTextW
SetCursor
DestroyWindow
UnregisterClassW
RegisterClassW
GetDC
SetCapture
CreateWindowExW
ShowWindow
FillRect
BeginPaint
wsprintfW
MapVirtualKeyW
GetKeyNameTextW
EndPaint
ClientToScreen
WindowFromPoint
GetWindowTextW
GetWindowLongW
IsWindowEnabled
GetMessagePos
DrawIconEx
LoadImageW
GrayStringW
IsIconic
DrawTextExW
GetWindowDC
ReleaseDC
ReleaseCapture
DefWindowProcW
GetSystemMetrics
CreateCursor
GetSysColor
LoadCursorW
GetParent
InvalidateRect
GetClientRect
DrawFocusRect
OffsetRect
InflateRect
SetRect
PtInRect
DestroyCursor
FindWindowExW
CallWindowProcW
CallWindowProcA
keybd_event
EnableWindow
KillTimer
SetTimer
SetWindowTextA
GetKeyState
SendMessageW
PostMessageW
GetWindowRect

gdi32

GetTextColor
CreateBitmap
CreateDIBitmap
GetTextMetricsW
Escape
RectVisible
PtVisible
GetTextExtentPoint32W
SetPixel
CombineRgn
CreateRectRgn
GetObjectW
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
EnumFontFamiliesW
CreateSolidBrush
GetDeviceCaps
CreateFontIndirectW
DeleteObject
MoveToEx
LineTo
GetStockObject
Rectangle
SetBkColor
ExtTextOutW
GetPixel
TextOutW
SelectObject
CreateFontW
PatBlt

advapi32

RegCreateKeyExW
RegSetValueExW
RegCloseKey

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHGetFileInfoW

comctl32

ord17
_TrackMouseEvent

shlwapi

StrFormatByteSizeW
PathIsDirectoryW

oleaut32

VariantCopy
VariantClear
VariantInit
SysFreeString
SysStringLen
SysAllocString

msvcp80

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z

gdiplus

GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipLoadImageFromFile
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipCreateHICONFromBitmap
GdipCreateSolidFill
GdipSetStringFormatAlign
GdipGetImageGraphicsContext
GdipDrawImageRectRect
GdipCloneBrush
GdipCloneImage
GdipGetImageThumbnail
GdipDeleteMatrix
GdipCreatePath
GdipDeletePath
GdipCreateMatrix
GdipCreateFontFamilyFromName
GdipCreateLineBrushFromRect
GdipResetPath
GdipClosePathFigure
GdipAddPathArcI
GdipCreateFromHDC
GdipSetSmoothingMode
GdipSetWorldTransform
GdipFillPath
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipReleaseDC
GdipGraphicsClear
GdipDeleteBrush
GdipAlloc
GdipFree
GdipDeleteGraphics
GdiplusStartup
GdiplusShutdown
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipTranslateMatrix
GdipCreatePen1

abcomfun

ggxxrPdbt
StartUpgrader
OpenUrl

Sections

.text
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 328KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36435699c7ac01eeb0c1c82517c2f57d

Headers

File Characteristics

Imports

mfc80u

msvcr80

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

oleaut32

msvcp80

gdiplus

abcomfun

Sections

.text Size: 176KB - Virtual size: 174KB

.rdata Size: 64KB - Virtual size: 62KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 328KB - Virtual size: 325KB

.text
Size: 176KB - Virtual size: 174KB

.rdata
Size: 64KB - Virtual size: 62KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 328KB - Virtual size: 325KB