0d87b70a92e53d1caaf327adbf8e9c3fe7dc4f3e32fa2655478c76c9686d847e

Sharing

Copy URL

Twitter E-mail

General

Target

0d87b70a92e53d1caaf327adbf8e9c3fe7dc4f3e32fa2655478c76c9686d847e
Size

389KB
MD5

64dcc1fce8ea23bb4a8e8b6850a6418e
SHA1

58b556a150ac0addebd2d298456926b84997bcda
SHA256

0d87b70a92e53d1caaf327adbf8e9c3fe7dc4f3e32fa2655478c76c9686d847e
SHA512

5dfbeec0e064efa566ac2afb06161b5456f70351ae642e06c892208461fe1c22a68860d9508d9b440f90d30095e0352eeb9a86b120cdc19ff1fad0b9758dede0
SSDEEP

6144:T1mrgyOtcjpggtG9S5jjAz+JynA5QK2F5UOBCu:pAljGAOVF5UOA

Score

N/A

Malware Config

Signatures

Files

0d87b70a92e53d1caaf327adbf8e9c3fe7dc4f3e32fa2655478c76c9686d847e
.exe windows x86

f73a8cbdbe93032207e7d91ab5235ce0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
WTSFreeMemory
WTSQuerySessionInformationW

egisutility

?GetUserDefaultLang@ProductUtility@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?IsReady@ProductUtility@@QAE?AW4ReadyType@1@_N@Z
?GetPath@ProductUtility@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4PathType@1@@Z
??0SingletonUtility@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?GetFeatureState@CFeatureInfo@@QAEJPAU_BX_FEATUREINFO_@@@Z
??0CFeatureInfo@@QAE@XZ
?IsReady@ProductUtility@@QAE?AW4ReadyType@1@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??1SingletonUtility@@QAE@XZ
?GetName@ProductUtility@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4NameType@1@_N@Z
??1CFeatureInfo@@UAE@XZ
?GetPath@ProductUtility@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4PathType@1@ABV23@@Z
?IsExist@SingletonUtility@@QAE_NXZ

frameutility

?SetCurSel@CHMICtrl_EX_Combo@@QAEHH@Z
?Destroy@XWnd@@QAEHH@Z
?GetCurSel@CHMICtrl_EX_Combo@@QBEHXZ
?ShowWindow@XWnd@@QAEHH@Z
?AttachFrame@XWnd@@QAEXPAVCFrame@@PAV1@@Z
?GetSafeHwnd@XWnd@@QBEPAUHWND__@@XZ
?LimitText@CHMICtrl_EX_Edit@@QAEXH@Z
?AddString@CHMICtrl_EX_Combo@@QAEHPB_W@Z
?KillTimer@XWnd@@QAEHI@Z
?OnDestroy@XWnd@@IAEJIJ@Z
?OnHMIEvent@XWnd@@UAEJPAVCHMICtrlBase@@W4_CTRL_EVENT@@IJ@Z
?PreTriggerMessage@XWnd@@MAEHPAUHWND__@@IIJ@Z
?CanDraged@XWnd@@MAEHPAVCFrame@@UtagPOINT@@@Z
?ProcessWindowMessage@XWnd@@UAEHPAUHWND__@@IIJAAJK@Z
??0XWnd@@QAE@XZ
??1XWnd@@UAE@XZ
?SetTimer@XWnd@@QAEIIIP6GXPAUHWND__@@IIK@Z@Z
?OnEsc@XWnd@@MAEJIJ@Z
?OnEnter@XWnd@@MAEJIJ@Z
?InitInstance@XApp@@SAHXZ
MessageBoxW
?DeleteInstance@XApp@@SAXXZ
?DoModal2@XWnd@@QAEHPB_WPAUHWND__@@0PAUtagRECT@@KK@Z
?OnXWndEvent@XWnd@@MAEJQAVCHMICtrlBase@@HIJ@Z
?OnCreate@XWnd@@IAEJIJ@Z
?SetIcon@XWnd@@IAEPAUHICON__@@PB_W@Z
?GetFrame@XWnd@@QBEPAVCFrame@@XZ
?SetCueText@CHMICtrl_EX_Edit@@QAEXPB_WH@Z
?GetInstance@XApp@@SAPAV1@PAUHINSTANCE__@@@Z

libframe

?LoadFile@CFrameMgr@@QAEHPB_W0@Z
?SetVisible@CHMICtrlBase@@QAEXH@Z
?SelectImage@CHMICtrlRect@@QAE_NH@Z
?GetCtrlName@CHMICtrlBase@@QAEPB_WXZ
?GetCtrlByName@CHMICtrlContainer@@QAEPAVCHMICtrlBase@@PB_W@Z
?GetLangStrByKey@CAgent@@QAEPB_WPB_W@Z
?IsVisible@CHMICtrlBase@@QBEHXZ
?GetExStyle@CHMICtrlBase@@QAEKXZ

egisticketproxy

PRX_ApplyTicketToSession
PRX_ApplyTicketToSelf
PRX_GetTicket

egisbiometricproxy

ebfPlaySound
ebfFreeFeature
ebfUninitialize
ebfLoadFeature
ebfInitialize
ebfCancelOperation
ebfVerifyBegin
ebfSetLedStatus

loggerutility

?OutputFormatString@CLoggerManager@@QAAJPB_WZZ
?SetPath@CLoggerManager@@QAEJPB_W@Z
?LoadFile@CLoggerManager@@QAEJPAUHINSTANCE__@@PB_W@Z
??0CLoggerManager@@QAE@XZ
??1CLoggerManager@@QAE@XZ
?Info@CLoggerManager@@QAEXPA_W@Z

kernel32

LocalAlloc
OpenEventW
CreateEventW
WaitForMultipleObjects
GetCurrentThreadId
lstrcpyW
SetEvent
GetCurrentProcessId
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WaitForSingleObject
Sleep
GetProcAddress
GetModuleHandleW
lstrlenW
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
GetCommandLineW
GetComputerNameW
LocalFree
GetLastError
WTSGetActiveConsoleSessionId
RaiseException
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
ResetEvent
HeapFree
HeapAlloc
HeapDestroy
CloseHandle
OutputDebugStringW
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime

user32

SendMessageW
wsprintfW
SetForegroundWindow
SetWindowPos
ShowWindow
CharUpperW
CharNextW
PostThreadMessageW
GetMessageW
DispatchMessageW
TranslateMessage
GetDesktopWindow
IsWindow
LoadIconW
GetWindowThreadProcessId
AttachThreadInput
GetForegroundWindow

advapi32

ConvertSidToStringSidW
LookupAccountNameW
ConvertStringSidToSidW
LogonUserW

ole32

CLSIDFromString
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysAllocString
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
UnRegisterTypeLi
SysFreeString
SysStringLen

atl90

ord32
ord31
ord67
ord49
ord56
ord68
ord61
ord23
ord64
ord20
ord58
ord17

msvcp90

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

msvcr90

_XcptFilter
_exit
_cexit
__wgetmainargs
exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
_controlfp_s
_invoke_watson
__setusermatherr
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__set_app_type
__p__fmode
_wcsicmp
free
__p__commode
_adjust_fdiv
_wcmdln
_initterm
_initterm_e
_configthreadlocale
_amsg_exit
??3@YAXPAX@Z
__CxxFrameHandler3
memset
??2@YAPAXI@Z
memcpy_s
_CxxThrowException
wcsncpy_s
memmove_s
wcscpy_s
wcscat_s
_wcslwr_s
vswprintf_s
??_V@YAXPAX@Z
_purecall
_except_handler4_common

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f73a8cbdbe93032207e7d91ab5235ce0

Headers

DLL Characteristics

File Characteristics

Imports

wtsapi32

egisutility

frameutility

libframe

egisticketproxy

egisbiometricproxy

loggerutility

kernel32

user32

advapi32

ole32

oleaut32

atl90

msvcp90

msvcr90

Sections

.text Size: 29KB - Virtual size: 29KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 285KB - Virtual size: 285KB

.reloc Size: 51KB - Virtual size: 52KB

.text
Size: 29KB - Virtual size: 29KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 285KB - Virtual size: 285KB

.reloc
Size: 51KB - Virtual size: 52KB