258517d09db85c388e56fb5f6c787580556b4e3980095c408d5afccea299e48e

Sharing

Copy URL Twitter E-mail

General

Target

258517d09db85c388e56fb5f6c787580556b4e3980095c408d5afccea299e48e
Size

228KB
MD5

09bdde4cb67408b494918b95df478470
SHA1

1ca32e59672ff6783c8475e3e6ec6d4fbf226434
SHA256

258517d09db85c388e56fb5f6c787580556b4e3980095c408d5afccea299e48e
SHA512

4600adbdc3fa6e61efe2439763cc31089330daacaab3b75458048078784793b1377f6f2cf6a9ca8e81ffdce2fadacc733fd6762050ee80d9074c9b805c8465c7
SSDEEP

6144:6CQ7HWIo65X/fa1g2QKyibtVj8shzWeZbwry:6CQHWIbVaNpyqd8shzJBUy

Score

N/A

Malware Config

Signatures

Files

258517d09db85c388e56fb5f6c787580556b4e3980095c408d5afccea299e48e
.dll windows x86

0ff2a75a0137532114bf30645e88a12e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

xlfsio

?XLFS_Init@@YGJXZ
?XLFS_OpenFile@@YGJPB_W0PAPAXPAUtagFileOpenCallBackData@@@Z
?XLFS_IsEOF@@YGJPAX@Z
?XLFS_ReadFile@@YG_JPAXPAE_J@Z
?XLFS_CloseFile@@YGJPAX@Z
?XLFS_FixPath@@YGJPB_WPAPA_W@Z

kernel32

GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
ExitProcess
SetLastError
OutputDebugStringW
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
GetCurrentProcessId
OutputDebugStringA
OpenProcess
VirtualQuery
HeapAlloc
HeapFree
GetProcessHeap
HeapCreate
HeapReAlloc
HeapDestroy
ReadProcessMemory
GetModuleFileNameA
FormatMessageA
GetLastError
FreeLibrary
LoadLibraryA
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
UnmapViewOfFile
WaitForSingleObject
ReleaseMutex
OpenFileMappingA
OpenMutexA
MapViewOfFile
CreateFileMappingA
CreateMutexA
InitializeCriticalSection
GetModuleHandleW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection

user32

MessageBoxW

msvcp71

?_Nomemory@std@@YAXXZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AViterator@12@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

msvcr71

sinh
__dllonexit
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_initterm
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
_purecall
??0exception@@QAE@ABV0@@Z
_CxxThrowException
memcpy
memmove
wcsncpy
wcslen
wcscpy
??_V@YAXPAX@Z
strlen
sprintf
memset
atoi
strcpy
realloc
free
strchr
fread
strerror
_errno
fclose
ungetc
fopen
freopen
getc
_iob
fprintf
strcmp
strstr
fputs
isspace
strtoul
abs
pow
floor
fgets
_setjmp3
exit
longjmp
_pclose
_popen
tmpfile
fscanf
clearerr
fwrite
ftell
fseek
setvbuf
fflush
iscntrl
localeconv
isalnum
isdigit
isalpha
fabs
sin
_except_handler3
cos
cosh
tan
tanh
asin
acos
atan
atan2
ceil
fmod
modf
sqrt
log
log10
exp
frexp
ldexp
rand
srand
_HUGE
strrchr
getenv
strtod
strncat
strcspn
strcat
strncpy
system
remove
rename
tmpnam
clock
strftime
localtime
gmtime
time
mktime
difftime
setlocale
memcmp
tolower
toupper
isupper
isxdigit
ispunct
islower
memchr
strpbrk
strcoll
wcsrchr
malloc
_callnewh
??1type_info@@UAE@XZ
__security_error_handler
_onexit

Exports

Exports

XLLRT_DebugCreateLogs
XLLRT_DebugCreateStackMemPool
XLLRT_DebugDesroyStackMemPool
XLLRT_DebugDestroyLogs
XLLRT_DebugDestroyState
XLLRT_DebugGetCallLog
XLLRT_DebugGetCurState
XLLRT_DebugGetDebugeeName
XLLRT_DebugGetDumpList
XLLRT_DebugGetProcessCallLog
XLLRT_DebugGetProcessCurState
XLLRT_DebugGetProcessStackLog
XLLRT_DebugGetStackLog
XLLRT_DebugGetStateFromDump
XLLRT_DebugGetType
XLLRT_DebugInit
XLLRT_DebugLogsPopNextLog
XLLRT_DebugMemPoolGetLogs
XLLRT_DebugOutputLuaStack
XLLRT_GetFunctionAddress
_XLLRT_AddLoadLuaFile@4
_XLLRT_AddRefChunk@4
_XLLRT_AddRefEnv@4
_XLLRT_AddRefRunTime@4
_XLLRT_CreateChunk@16
_XLLRT_CreateChunkFromFile@12
_XLLRT_CreateChunkFromModule@16
_XLLRT_CreateEnv@4
_XLLRT_CreateRunTime@12
_XLLRT_DestroyEnv@4
_XLLRT_DestroyRunTime@8
_XLLRT_DoRegisterClass@8
_XLLRT_ErrorHandle@4
_XLLRT_GetAllLuaState@8
_XLLRT_GetChunkName@4
_XLLRT_GetChunkType@4
_XLLRT_GetEnv@4
_XLLRT_GetLastError@4
_XLLRT_GetLoadLuaFileByIndex@12
_XLLRT_GetLoadLuaFileCount@0
_XLLRT_GetLuaState@4
_XLLRT_GetOwnerEnv@4
_XLLRT_GetRuntime@8
_XLLRT_GetRuntimeFromLuaState@4
_XLLRT_GetVersion@0
_XLLRT_IsClassRegistered@8
_XLLRT_IsGlobalAPIRegistered@8
_XLLRT_IsGlobalObjRegistered@8
_XLLRT_LuaCall@16
_XLLRT_PrepareChunk@8
_XLLRT_PushXLObject@12
_XLLRT_RegisterClass@20
_XLLRT_RegisterGlobalAPI@16
_XLLRT_RegisterGlobalObj@28
_XLLRT_RegisterGlobalSetCallback@12
_XLLRT_ReleaseChunk@4
_XLLRT_ReleaseEnv@4
_XLLRT_ReleaseRunTime@4
_XLLRT_RemoveClassFunctionHook@16
_XLLRT_RemoveGlobalAPI@8
_XLLRT_RemoveGlobalAPIHook@12
_XLLRT_RemoveGlobalObj@8
_XLLRT_RemoveGlobalObjectFunctionHook@16
_XLLRT_RunChunk@8
_XLLRT_SetClassFunctionHook@20
_XLLRT_SetGlobalAPIHook@16
_XLLRT_SetGlobalObjectFunctionHook@20
_XLLRT_Stat@4
_XLLRT_UnRegisterClass@8
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
lua_atpanic
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_loadwithpath
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlevel
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0ff2a75a0137532114bf30645e88a12e

Headers

File Characteristics

Imports

xlfsio

kernel32

user32

msvcp71

msvcr71

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 117KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 4KB - Virtual size: 492B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 120KB - Virtual size: 117KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 4KB - Virtual size: 492B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB

.rmnet
Size: 60KB - Virtual size: 60KB