5b522516fa75f834676def1aeafd0a2ed63488c7c14521ba496d1ee836e30c2b

Sharing

Copy URL Twitter E-mail

General

Target

5b522516fa75f834676def1aeafd0a2ed63488c7c14521ba496d1ee836e30c2b
Size

193KB
MD5

6e1bd7b04c34a5d1fd375f488b46f76c
SHA1

6f56e3e1802aed0fd8144f4b1f4730bd199f2676
SHA256

5b522516fa75f834676def1aeafd0a2ed63488c7c14521ba496d1ee836e30c2b
SHA512

5260a47adac20b8ceb36d04cf2c70dc06c0b83457d0ada2c3bb8ea1585dfaef66466bd48bc1d4ce70b19940d32c9244b6af49a1f5a832fe9abbb7bf6b58ec2ec
SSDEEP

3072:Q7LD+4NOHeC0lpyOJqf61aIwh6WTXd1cOQqndQqz6mTU0q:QvD+3+qOJqSZy6ixQqdRuB0q

Score

N/A

Malware Config

Signatures

Files

5b522516fa75f834676def1aeafd0a2ed63488c7c14521ba496d1ee836e30c2b
.exe windows x86

549cfb8702a1b65d15e2be76996143c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc90u

ord1665
ord4652
ord3489
ord3654
ord4660
ord1719
ord2283
ord3674
ord4910
ord3140
ord5650
ord1727
ord1791
ord1792
ord2139
ord5625
ord1442
ord3226
ord6376
ord5404
ord3682
ord6804
ord4174
ord6802
ord1641
ord2368
ord2375
ord2630
ord2612
ord2610
ord2628
ord2640
ord2617
ord2633
ord2638
ord2621
ord2623
ord2625
ord2619
ord2635
ord2615
ord971
ord967
ord969
ord965
ord960
ord5683
ord5685
ord6466
ord1728
ord4702
ord5154
ord3743
ord5664
ord4603
ord6800
ord5512
ord2074
ord5602
ord4664
ord1493
ord4345
ord1751
ord1754
ord6411
ord3355
ord2069
ord799
ord2537
ord813
ord811
ord4324
ord267
ord6091
ord1353
ord265
ord1354
ord636
ord367
ord613
ord337
ord280
ord1272
ord3953
ord797
ord595
ord4044
ord1262
ord6636
ord2904
ord6187
ord4741
ord3488
ord3543
ord2106
ord1149
ord611
ord3537
ord3286
ord2274
ord4131
ord2592
ord3621
ord5322
ord6065
ord1533
ord4527
ord3741
ord4543
ord2597
ord744
ord2097
ord6547
ord524
ord2593
ord3486
ord6098
ord6096
ord3768
ord3622
ord333
ord5867
ord6094
ord6095
ord4410
ord4541
ord2901
ord6109
ord778
ord1108
ord6579
ord1383
ord2372
ord3185
ord286
ord296
ord1137
ord3589
ord341
ord5573
ord5572
ord617
ord909
ord600
ord1248
ord1254
ord5663
ord5680
ord4347
ord5674
ord3217
ord2087
ord1098
ord266
ord1250
ord1183
ord3670
ord589
ord4213
ord5830
ord6741
ord5548
ord1048
ord5567
ord4179
ord6035
ord2206
ord2251
ord4747
ord6803
ord4173
ord6801
ord4967
ord4211
ord2447
ord6018
ord4996
ord5676
ord4423
ord794
ord4043
ord4448
ord4681
ord4905
ord2771
ord2983
ord4348
ord2891
ord4071
ord4081
ord4080
ord2764
ord2893
ord2774
ord3115
ord2966
ord4728
ord3112
ord801

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
wcscat_s
swprintf_s
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
wcsncat
wcscat
memcpy
__CxxFrameHandler3
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
wcsncpy
_wcsnicmp
exit
memcpy_s
wcslen
memmove_s
wcschr
_wcsupr_s
wcscmp
wcsstr
wcsncat_s
_wcsicmp
wcsncpy_s
_wsplitpath_s
wcsncmp
wcscpy
iswalnum
iswspace
memset
malloc
free
rand
vswprintf_s
_wfopen_s
fclose
swscanf_s
_time64
wcscpy_s
srand
_waccess

kernel32

LoadLibraryW
ExpandEnvironmentStringsA
LoadLibraryA
GetModuleHandleW
GetProcAddress
MulDiv
GlobalAlloc
GlobalLock
WritePrivateProfileStringW
GetPrivateProfileStringW
CreateFileW
DeleteFileW
WaitForSingleObject
CreateEventW
GetExitCodeProcess
CreateProcessW
SetFileAttributesW
GetFileAttributesW
WriteFile
FreeLibrary
LoadLibraryExW
GetLastError
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetVersionExW
GlobalFree
GlobalUnlock
HeapAlloc
FindResourceExW
FindResourceW
LoadResource
SetEvent
SizeofResource
GetModuleFileNameW
LockResource
OpenEventW
CloseHandle
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent

comctl32

_TrackMouseEvent
ord17

ccwkrlib

?getResHandle@CCWCResString@@QAEPAUHINSTANCE__@@XZ
??0CCWCResString@@QAE@XZ
?loadResourceDll@CCWCResString@@QAE_NPB_W0@Z
?loadResourceDll@CCWCResString@@QAE_NPAUHINSTANCE__@@PB_W@Z
?writeData@CCWCConfig@@UAEXXZ
?performSelfTest@CCWkrLib@@SA_NV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@H@Z
?loadFileName@CCWCResString@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PB_W@Z
??0CCWCResString@@QAE@PAUHINSTANCE__@@PB_WH@Z
?getInstallDir@CCWCConfig@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
??1CCWCResString@@QAE@XZ
?LOG_IsDebugEnabled@@YA_NW4ELogLevel@@@Z
?LOG_DebugMessageF@@YAXW4ELogType@@W4ELogLevel@@PB_WZZ
??0CCWCConfig@@QAE@PB_W@Z
??1CCWCConfig@@UAE@XZ
?setTempSubDirMask@CCWCConfig@@QAEXPB_W@Z
?readData@CCWCConfig@@UAEXPAUHINSTANCE__@@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z

user32

PtInRect
GetFocus
IsWindow
ReleaseDC
GetDC
ScreenToClient
InflateRect
LoadIconW
DrawIconEx
SetRectEmpty
SetWindowLongW
SendMessageW
UpdateWindow
EnableWindow
MessageBoxW
GetSystemMetrics
LoadStringW
GetForegroundWindow
FillRect
DrawStateW
GetClientRect
GetIconInfo
LoadImageW
DestroyIcon
GetWindowRect
GetParent
SetRect
LoadCursorW
SetCursor
InvalidateRect
CopyRect
GetActiveWindow
GetLastActivePopup
SetCapture
ReleaseCapture

gdi32

GetTextExtentPoint32W
CreateFontIndirectW
SelectObject
CreateSolidBrush
DeleteObject
CreatePatternBrush
BitBlt
GetDeviceCaps
RealizePalette
GetStockObject
CreatePen
RoundRect
GetPixel
CreatePalette
GetDIBColorTable
CreateCompatibleDC
CreateHalftonePalette
GetObjectW
SetPixel

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

ShellExecuteW

ole32

CreateStreamOnHGlobal

gdiplus

GdipFree
GdipAlloc
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRect
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromResource

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.nrdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

549cfb8702a1b65d15e2be76996143c1

Headers

DLL Characteristics

File Characteristics

Imports

mfc90u

msvcr90

kernel32

comctl32

ccwkrlib

user32

gdi32

advapi32

shell32

ole32

gdiplus

Sections

.text Size: 62KB - Virtual size: 62KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 28KB - Virtual size: 27KB

.nrdata Size: 72KB - Virtual size: 72KB

.text
Size: 62KB - Virtual size: 62KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 28KB - Virtual size: 27KB

.nrdata
Size: 72KB - Virtual size: 72KB