cf9eea7fa5d0b3ca5e5477f39a1edb1e9904bb5fabbd666fa622946aac07a46a

Sharing

Copy URL Twitter E-mail

General

Target

cf9eea7fa5d0b3ca5e5477f39a1edb1e9904bb5fabbd666fa622946aac07a46a
Size

215KB
MD5

6eb3dd75ca480bcea0d03d68a553acd0
SHA1

35cecae1402cb580e69f352d941559d074e88704
SHA256

cf9eea7fa5d0b3ca5e5477f39a1edb1e9904bb5fabbd666fa622946aac07a46a
SHA512

404e483086a2120c9e17f3b9d25fd25d1f6244300581982ed6623437e285d52acfa9965f5643818c2bf834a27ce89ba6e7c2afaf076b4e21443383a229ade01b
SSDEEP

6144:42z8rhBj0U1p9dycyOmAQART/6gajusdzbGqbA:42ohJHPbajRGqbA

Score

N/A

Malware Config

Signatures

Files

cf9eea7fa5d0b3ca5e5477f39a1edb1e9904bb5fabbd666fa622946aac07a46a
.exe windows x86

7d6e2f4adb3a1e887989b954286bd0be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

RealizePalette
StretchDIBits
GetDeviceCaps
CreateFontIndirectW
CreatePalette
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateSolidBrush
GetStockObject
SetTextColor
SetBkMode
DeleteDC
GetTextMetricsW
GetTextExtentPoint32W
SelectObject
SetBrushOrgEx
DeleteObject

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

WaitForSingleObject
GetCurrentProcessId
LockResource
LoadResource
FindResourceW
GetSystemPowerStatus
CreateEventW
SetEvent
TerminateThread
GetCurrentThreadId
Sleep
lstrlenA
GetLocaleInfoW
SetFileAttributesW
CopyFileW
CreateDirectoryW
GetModuleFileNameW
GetFileAttributesW
GetVersion
DeleteFileW
GetTempFileNameW
GetTempPathW
GetModuleHandleW
GetSystemTime
SetCurrentDirectoryW
GetACP
GetLastError
FreeLibrary
GetWindowsDirectoryW
GetProcAddress
LoadLibraryW
TerminateProcess
OpenProcess
FormatMessageA
ExitThread
LocalFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetStartupInfoW
InterlockedCompareExchange
HeapAlloc
HeapFree
GetTempPathA
GetTempFileNameA
CreateProcessA
GetProcessHeap
GetTickCount
QueryPerformanceCounter
VirtualProtect
GetThreadLocale
InterlockedExchange
GetVersionExA
GetUserDefaultLCID
GetLocaleInfoA
GetSystemTimeAsFileTime
CreateFileW
LoadLibraryA
RaiseException
LocalAlloc
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
GlobalLock
GlobalFree
GlobalUnlock
CloseHandle
GetExitCodeThread
WaitForSingleObjectEx

user32

FillRect
GetSysColor
LoadBitmapW
TrackPopupMenu
SystemParametersInfoW
SetWindowPos
FindWindowW
ShowScrollBar
HideCaret
ReplyMessage
InSendMessage
CreateWindowExW
PostQuitMessage
MessageBoxW
SendMessageTimeoutW
ShowWindow
GetWindowLongW
LoadImageW
DrawIconEx
DrawTextW
DestroyIcon
InvalidateRect
ReleaseDC
GetDC
GetSystemMenu
DispatchMessageW
DestroyWindow
SetWindowsHookExW
UnhookWindowsHookEx
LoadIconW
LoadStringW
EnumWindows
GetDesktopWindow
IsWindowEnabled
GetActiveWindow
SetActiveWindow
EnableWindow
FlashWindow
KillTimer
SetTimer
GetClientRect
GetWindowRect
IsIconic
EnumThreadWindows
GetParent
IsWindowVisible
SetForegroundWindow
GetWindowTextW
GetWindowThreadProcessId
CallNextHookEx
SendMessageW
PostMessageW
LoadMenuW
GetSubMenu
RemovePropW
GetPropW
SetPropW
SetWindowLongW
GetWindowLongA
IsWindowUnicode
GetSystemMetrics
MessageBoxA
EnableMenuItem
AppendMenuW
DrawEdge
PostThreadMessageW
TranslateMessage
PeekMessageW

advapi32

RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteKeyW
RegEnumValueW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA

comctl32

ord17

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetDiskFreeSpaceExW
SHGetFolderPathW

ole32

OleInitialize
CoCreateInstance
CoInitialize
PropVariantClear
StringFromGUID2
CoUninitialize
CoDisconnectObject
OleUninitialize

oleaut32

SysFreeString
SysAllocString

mspgimme

EPLoadMSO
SetupGimme
EPMsoGimmeFile
EPMsoLoadLibraryByName

mfc80u

ord3596
ord3603
ord2140
ord3334
ord1086
ord757
ord2239
ord1121
ord1049
ord5565
ord5564
ord6248
ord5379
ord4032
ord4008
ord3795
ord4320
ord2054
ord5579
ord3800
ord1007
ord5096
ord590
ord1139
ord1119
ord3629
ord1123
ord2132
ord331
ord1220
ord476
ord701
ord3422
ord6215
ord5378
ord3826
ord1911
ord2925
ord5220
ord5222
ord3942
ord4562
ord5226
ord5209
ord5562
ord2832
ord4475
ord3327
ord764
ord266
ord762
ord620
ord605
ord577
ord1955
ord3752
ord1117
ord1479
ord870
ord2895
ord282
ord6700
ord1189
ord1079
ord2366
ord1894
ord572
ord3286
ord4255
ord4480
ord3943
ord2638
ord3703
ord3713
ord3712
ord2985
ord2527
ord2640
ord2534
ord2856
ord2708
ord4301
ord2829
ord2725
ord2531
ord5196
ord1590
ord1646
ord1647
ord5171
ord1353
ord4961
ord3339
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2397
ord2409
ord2386
ord2402
ord2407
ord2390
ord2392
ord2394
ord2388
ord2404
ord2384
ord931
ord927
ord929
ord925
ord920
ord5229
ord5231
ord5956
ord1591
ord4276
ord4716
ord3397
ord5210
ord4179
ord6271
ord5067
ord1899
ord5148
ord4238
ord1393
ord3940
ord1608
ord1611
ord5911
ord6721
ord1572
ord1634
ord715
ord354
ord3176
ord4256
ord5199
ord1392
ord5908
ord6720
ord1542
ord1661
ord1662
ord4884
ord4729
ord5178
ord1785
ord6063
ord6086
ord6059
ord5138
ord1908
ord6061
ord5566
ord3395
ord1622
ord1091
ord313
ord1190
ord5181
ord1058
ord4574
ord1118
ord4206
ord2011
ord2155
ord4026
ord293
ord2651
ord5485
ord283
ord5829
ord2311
ord896
ord776
ord899
ord900
ord774
ord287
ord3635
ord591
ord3435
ord657
ord587
ord5803
ord2656
ord1396
ord3922
ord2809
ord3238
ord2085
ord4094
ord1946
ord2365
ord1274
ord2361
ord3158
ord4226
ord1536
ord2077
ord3223
ord4231
ord1561
ord2082
ord4093
ord1475
ord1924
ord6262
ord1388
ord3165
ord4228
ord1538
ord2080
ord4092
ord1474
ord1922
ord3755
ord4945
ord5522
ord1765
ord1883
ord3927
ord6232
ord2027
ord2167
ord1299
ord630
ord3082
ord2012
ord385
ord3204
ord1925
ord3155
ord1271
ord3280
ord1270
ord5633
ord3311
ord4234
ord1582
ord2086
ord741
ord709
ord602
ord5640
ord347
ord501
ord6013
ord6033
ord5723
ord326
ord2255
ord265
ord589
ord330
ord3678
ord3189
ord6116
ord718
ord516
ord3287
ord4714
ord5207
ord4730
ord4207
ord4838
ord4611
ord4791
ord5064
ord5066
ord5065
ord6744
ord5484
ord6173
ord6167
ord5891
ord4861
ord1472
ord3756
ord5698
ord3661
ord5699
ord3990
ord2310
ord3983
ord2362
ord5414
ord2491
ord5965
ord1403
ord3547
ord3662
ord721
ord4266
ord1512
ord4274
ord5208
ord1573
ord1318
ord977
ord524
ord4109
ord4577
ord3677
ord4535
ord566
ord1198

msvcr80

_configthreadlocale
_stricmp
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
_crt_debugger_hook
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_wcmdln
_initterm_e
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
fopen_s
fwprintf_s
fclose
vsprintf_s
vswprintf_s
_wtol
wcsrchr
_invalid_parameter_noinfo
memmove_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
__CxxFrameHandler3
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_itow_s
_vsnwprintf
memset
_beginthreadex
wcsncpy_s
wcscat_s
_wtoi
ceil
floor
_wcsicmp
_fcvt_s
atof
wcschr
wcsstr
_wcsdup
wcscpy_s
free
_wmakepath_s
_wsplitpath_s

msvcp80

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

msi

ord39

Sections

.text
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.scansrv
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7d6e2f4adb3a1e887989b954286bd0be

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

version

kernel32

user32

advapi32

comctl32

shell32

ole32

oleaut32

mspgimme

mfc80u

msvcr80

msvcp80

msi

Sections

.text Size: 119KB - Virtual size: 118KB

.data Size: 3KB - Virtual size: 4KB

.scansrv Size: 512B - Virtual size: 4B

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 76KB - Virtual size: 76KB

.text
Size: 119KB - Virtual size: 118KB

.data
Size: 3KB - Virtual size: 4KB

.scansrv
Size: 512B - Virtual size: 4B

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 76KB - Virtual size: 76KB