e614177d75900fb717be35e8012cb4409839a7748b45d493247e94196a05f9ee

Sharing

Copy URL

Twitter E-mail

General

Target

e614177d75900fb717be35e8012cb4409839a7748b45d493247e94196a05f9ee
Size

166KB
MD5

49b8bedb90995a3f196ce7556f1c48d0
SHA1

09f6370a242b0836bd0aee7745c5a1d35bcefacc
SHA256

e614177d75900fb717be35e8012cb4409839a7748b45d493247e94196a05f9ee
SHA512

8d400853587a7788b0e449e6dabad279babeaf39876c13092cecac1ef07b3a95672befb6defb1895e3915edc581eda9ffa068c56a06d2ed3d787418002dda5fa
SSDEEP

3072:w1Oxu8VJyqmzO+9dCDZQ8hDInMd37pXJtt2DgU9M52:Pw3quO+9dCDm8hDInMxNDsDHM52

Score

N/A

Malware Config

Signatures

Files

e614177d75900fb717be35e8012cb4409839a7748b45d493247e94196a05f9ee
.exe windows x86

cb4995d906016aac993465d9108c6a52

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc90u

ord280
ord617
ord341
ord4324
ord938
ord2081
ord2479
ord4519
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord6035
ord4179
ord1048
ord5548
ord6741
ord5830
ord4213
ord2087
ord3217
ord3589
ord5676
ord4347
ord4996
ord5680
ord310
ord2771
ord3500
ord3112
ord4728
ord2966
ord3115
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4905
ord4681
ord3670
ord2447
ord5663
ord1137
ord5573
ord1603
ord2694
ord3185
ord5851
ord2537
ord2326
ord2702
ord1333
ord1599
ord6698
ord6697
ord935
ord6690
ord2481
ord2082
ord943
ord821
ord5674
ord601
ord811
ord286
ord909
ord813
ord5567
ord600
ord1250
ord1254
ord296
ord1098
ord4211
ord316
ord4325
ord3186
ord2677
ord2327
ord911
ord582
ord6018
ord784
ord799
ord1272
ord265
ord2983
ord589
ord4043
ord794
ord266
ord801

msvcr90

calloc
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_purecall
_CxxThrowException
_recalloc
wcscmp
atol
iswdigit
iswspace
iswascii
wcslen
memset
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
swscanf_s
_wsplitpath_s
_mktime64
_localtime64_s
vswprintf_s
?what@exception@std@@UBEPBDXZ
wcsrchr
wcsncpy_s
wcscpy_s
wcscat_s
wcsstr
swprintf_s
wcsncmp
wcschr
free
iswprint

kernel32

CreateFileW
CloseHandle
DeleteFileW
Sleep
GetCurrentThreadId
GetCurrentThread
EnterCriticalSection
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
LeaveCriticalSection
GetTempPathW
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
lstrlenA
LocalFree
FormatMessageW
GetPrivateProfileStringW
LockResource
LoadResource
FindResourceW
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
FindClose
FindFirstFileW
GetLastError
CreateMutexW
GetVersionExW
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
GetFileTime

user32

UnhookWindowsHookEx
MessageBoxW
SetWindowsHookExW
LoadStringW
DispatchMessageW
TranslateMessage
IsDialogMessageW
SetActiveWindow
SetForegroundWindow
SystemParametersInfoW
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
FindWindowW
PeekMessageW
IsWindow
CallNextHookEx

advapi32

SetSecurityDescriptorDacl
SetKernelObjectSecurity
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
InitializeSecurityDescriptor

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW
PathAddBackslashW
StrCmpIW
PathIsDirectoryW
PathFileExistsW
PathFindExtensionW
SHGetValueW

ole32

CoInitialize
CoUninitialize

msvcp90

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cb4995d906016aac993465d9108c6a52

Headers

DLL Characteristics

File Characteristics

Imports

mfc90u

msvcr90

kernel32

user32

advapi32

comctl32

shlwapi

ole32

msvcp90

Sections

.text Size: 50KB - Virtual size: 50KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 94KB - Virtual size: 96KB

.text
Size: 50KB - Virtual size: 50KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 94KB - Virtual size: 96KB