dc9f7d0b97ceddb8c0fb6ee44b24eb46b1f9eaab95fff0591d315aa662e4359d

Sharing

Copy URL Twitter E-mail

General

Target

dc9f7d0b97ceddb8c0fb6ee44b24eb46b1f9eaab95fff0591d315aa662e4359d
Size

1024KB
MD5

40f805c7d03edb4c59628db31d919f60
SHA1

4595eece76654d6e7b4a8794d8ccc8d89594cb10
SHA256

dc9f7d0b97ceddb8c0fb6ee44b24eb46b1f9eaab95fff0591d315aa662e4359d
SHA512

e53d562d56e3597ca521c1ee38d4f048878b0f1534ec43de62a5f7245ff5c3e5ab72e4ed3eef05531853ae0874af0733ebff45f92173cd97607817ab9f6a2f9f
SSDEEP

24576:jhfQz7hQw99JcemaQB9cljCbYyZk0JtOI/VJeS:jhozamccqUYHk2UItZ

Score

N/A

Malware Config

Signatures

Files

dc9f7d0b97ceddb8c0fb6ee44b24eb46b1f9eaab95fff0591d315aa662e4359d
.dll windows x86

cb9c088eda458b4a3cd407f5a647cfd0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msimg32

AlphaBlend

crypt32

CertFreeCertificateContext
CertGetNameStringA
CertFindExtension
CryptDecodeObject
CertCreateCertificateContext
CertGetEnhancedKeyUsage

msvcp60

?length@?$char_traits@D@std@@SAIPBD@Z
?move@?$char_traits@D@std@@SAPADPADPBDI@Z
?compare@?$char_traits@D@std@@SAHPBD0I@Z
?assign@?$char_traits@D@std@@SAXAADABD@Z
?eq@?$char_traits@D@std@@SA_NABD0@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??Bios_base@std@@QBEPAXXZ
??7ios_base@std@@QBE_NXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?to_char_type@?$char_traits@D@std@@SADABH@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?width@ios_base@std@@QAEHH@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?flags@ios_base@std@@QBEHXZ
?opfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE_NXZ
?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?copy@?$char_traits@D@std@@SAPADPADPBDI@Z

mfc42

ord641
ord4234
ord4710
ord2645
ord2379
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord324
ord3953
ord2725
ord939
ord941
ord858
ord5710
ord5683
ord537
ord2567
ord2860
ord6778
ord940
ord6648
ord2864
ord6453
ord4133
ord4297
ord4284
ord2614
ord4129
ord860
ord1175
ord773
ord6467
ord2818
ord4202
ord4376
ord2301
ord2370
ord2302
ord4853
ord2642
ord4224
ord6215
ord5981
ord3092
ord6334
ord4299
ord1768
ord2086
ord6197
ord2915
ord3089
ord755
ord470
ord3610
ord656
ord4123
ord613
ord289
ord536
ord2754
ord5600
ord3702
ord1083
ord501
ord693
ord2289
ord6905
ord6907
ord3286
ord6380
ord1168
ord2582
ord4402
ord3370
ord3640
ord6007
ord3597
ord4425
ord5280
ord4407
ord1775
ord6052
ord2514
ord4998
ord5265
ord283
ord5785
ord1640
ord3571
ord323
ord640
ord3596
ord5864
ord269
ord826
ord600
ord1578
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1575
ord1176
ord1116
ord6061
ord5571
ord5579
ord5736
ord5678
ord5794
ord5789
ord5873
ord6172
ord6021
ord6189
ord4330
ord6186
ord5756
ord6192
ord5759
ord2971
ord3706
ord3573
ord3693
ord2859
ord472
ord5788
ord5781
ord540
ord3874
ord5572
ord800
ord1641
ord2414
ord3663
ord3626
ord3619
ord5875
ord4275
ord609
ord567
ord3402
ord2575
ord3574
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord6055
ord823
ord815

msvcrt

wcscmp
difftime
toupper
time
_stricmp
_strlwr
strchr
_mbscmp
fopen
fread
fclose
atoi
strcpy
memcmp
strstr
_wcsupr
free
??0exception@@QAE@XZ
strncpy
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
memmove
_CxxThrowException
wcslen
wcscpy
strcmp
__CxxFrameHandler
sprintf
strlen
memset
memcpy
qsort
_pctype
_isctype
__mb_cur_max
tolower
realloc
abort
wcsstr
vfprintf
_iob
memchr
fprintf
_errno
fflush
_setmode
ftell
fseek
fgets
strtoul
strncmp
getenv
sscanf
mbstowcs
_vsnprintf
strcat
atol
_strcmpi
_beginthreadex
_endthreadex
srand
rand
fwrite
_purecall
abs
_ftol
??8type_info@@QBEHABV0@@Z
__RTtypeid
??1type_info@@UAE@XZ
__dllonexit
_onexit
_adjust_fdiv
_initterm
malloc
_fileno

kernel32

GetTempPathA
GetUserDefaultLangID
SetLastError
GetTickCount
GetStdHandle
GetCurrentThreadId
GetCurrentProcessId
MultiByteToWideChar
WideCharToMultiByte
CreateMutexA
CompareFileTime
lstrlenA
GetSystemDirectoryA
InterlockedIncrement
WaitForMultipleObjects
Sleep
CreateFileA
LoadLibraryA
FreeLibrary
TlsFree
TlsAlloc
GetModuleHandleA
GetProcAddress
lstrcpyA
GetCurrentProcess
lstrcmpiA
GetLastError
TlsGetValue
LocalFree
VirtualQuery
CancelIo
ResetEvent
GetOverlappedResult
ReadFile
WriteFile
DeviceIoControl
LocalAlloc
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
TerminateThread
InitializeCriticalSection
QueryPerformanceCounter
GlobalMemoryStatus
GetFileType
GetVersion
GetModuleFileNameA
GetSystemInfo
GetVersionExA
ReleaseMutex
OpenEventA
SetEvent
WaitForSingleObject
CloseHandle
OpenMutexA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
TlsSetValue
IsBadReadPtr
GetShortPathNameA
CreateEventA

user32

SetActiveWindow
MessageBoxA
IsWindowVisible
DialogBoxParamA
SetForegroundWindow
GetDlgItem
IsDlgButtonChecked
GetDlgItemTextA
CheckDlgButton
AttachThreadInput
EndDialog
GetSysColor
EnableWindow
SetDlgItemTextA
CallWindowProcA
GetPropA
SetPropA
GetFocus
KillTimer
SetTimer
GetWindowRect
ReleaseDC
GetWindowThreadProcessId
PtInRect
GetKeyState
SetFocus
SetWindowPos
CloseDesktop
UpdateWindow
GetSystemMetrics
GetDesktopWindow
SystemParametersInfoA
GetThreadDesktop
OpenDesktopA
CreateDesktopA
SetThreadDesktop
SwitchDesktop
GetWindowTextA
SetWindowTextA
GetWindow
GetDlgCtrlID
GetClassNameA
wsprintfA
DefWindowProcA
SetWindowLongA
IsWindow
RegisterClassExA
UnregisterClassA
CreateWindowExA
ShowWindow
GetMessageA
TranslateMessage
DispatchMessageA
GetDC
GetParent
InvalidateRect
PostMessageA
InflateRect
RegisterWindowMessageA
FindWindowA
GetForegroundWindow
SetWindowsHookExA
SendMessageA
UnhookWindowsHookEx
CallNextHookEx
MoveWindow
GetClientRect
SetWindowRgn
SetRect
GetUserObjectInformationW
GetProcessWindowStation
GrayStringA
DrawTextA
TabbedTextOutA
FillRect
CopyRect

gdi32

CreateSolidBrush
CreateFontA
ExtTextOutA
Escape
BitBlt
CreateEllipticRgn
SelectObject
Ellipse
CreatePen
DeleteObject
DeleteDC
Arc
CreateCompatibleBitmap
CreateCompatibleDC
PtVisible
RectVisible
GetStockObject
GetTextExtentPoint32A
CreateRectRgnIndirect
TextOutA
GetDIBits

advapi32

SetSecurityDescriptorSacl
OpenSCManagerA
SetNamedSecurityInfoA
CreateServiceA
OpenServiceA
DeleteService
StartServiceA
CloseServiceHandle
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegSetValueExA
RegDeleteValueA
RegEnumKeyExA
RegOpenKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
GetTokenInformation
DeregisterEventSource
ReportEventA
RegisterEventSourceA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl

shell32

ShellExecuteExA

ole32

CoCreateGuid

hid

HidD_GetAttributes
HidP_GetCaps
HidD_GetPreparsedData
HidD_SetNumInputBuffers
HidD_GetFeature
HidD_SetFeature
HidD_FlushQueue
HidD_FreePreparsedData

setupapi

SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
C_CancelFunction
C_CloseAllSessions
C_CloseSession
C_CopyObject
C_CreateObject
C_Decrypt
C_DecryptDigestUpdate
C_DecryptFinal
C_DecryptInit
C_DecryptUpdate
C_DecryptVerifyUpdate
C_DeriveKey
C_DestroyObject
C_Digest
C_DigestEncryptUpdate
C_DigestFinal
C_DigestInit
C_DigestKey
C_DigestUpdate
C_Encrypt
C_EncryptFinal
C_EncryptInit
C_EncryptUpdate
C_Finalize
C_FindObjects
C_FindObjectsFinal
C_FindObjectsInit
C_GenerateKey
C_GenerateKeyPair
C_GenerateRandom
C_GetAttributeValue
C_GetFunctionList
C_GetFunctionStatus
C_GetInfo
C_GetMechanismInfo
C_GetMechanismList
C_GetObjectSize
C_GetOperationState
C_GetSessionInfo
C_GetSlotInfo
C_GetSlotList
C_GetTokenInfo
C_InitPIN
C_InitToken
C_Initialize
C_Login
C_Logout
C_OpenSession
C_SeedRandom
C_SetAttributeValue
C_SetOperationState
C_SetPIN
C_Sign
C_SignEncryptUpdate
C_SignFinal
C_SignInit
C_SignRecover
C_SignRecoverInit
C_SignUpdate
C_UnwrapKey
C_Verify
C_VerifyFinal
C_VerifyInit
C_VerifyRecover
C_VerifyRecoverInit
C_VerifyUpdate
C_WaitForSlotEvent
C_WrapKey
E_GetAuxFunctionList
eb_RunNoElevated
eb_service

Sections

.text
Size: 648KB - Virtual size: 646KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 168KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ve_share
Size: 4KB - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cb9c088eda458b4a3cd407f5a647cfd0

Headers

File Characteristics

Imports

msimg32

crypt32

msvcp60

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

hid

setupapi

Exports

Exports

Sections

.text Size: 648KB - Virtual size: 646KB

.rdata Size: 168KB - Virtual size: 164KB

.data Size: 64KB - Virtual size: 85KB

ve_share Size: 4KB - Virtual size: 800B

.rsrc Size: 24KB - Virtual size: 20KB

.reloc Size: 52KB - Virtual size: 50KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 648KB - Virtual size: 646KB

.rdata
Size: 168KB - Virtual size: 164KB

.data
Size: 64KB - Virtual size: 85KB

ve_share
Size: 4KB - Virtual size: 800B

.rsrc
Size: 24KB - Virtual size: 20KB

.reloc
Size: 52KB - Virtual size: 50KB

.rmnet
Size: 60KB - Virtual size: 60KB