cc1b9590f5e03acd61bf9939ecb20d8c606baafa4c2a1f17f7b79af638aaa1bc

Sharing

Copy URL Twitter E-mail

General

Target

cc1b9590f5e03acd61bf9939ecb20d8c606baafa4c2a1f17f7b79af638aaa1bc
Size

412KB
MD5

1e742aef171dbc81cbbdcbed4f7309e0
SHA1

41fc473530f94fe709781ae918dfd67b42f73135
SHA256

cc1b9590f5e03acd61bf9939ecb20d8c606baafa4c2a1f17f7b79af638aaa1bc
SHA512

7f0d6447a28c7b93938e64ae6685691f7efb79ba458934a550eb0122f84a3f9a2625176ca2ed956f7d508081f3f85a1bb46c032fd1b342dd52c97e9209b35ee5
SSDEEP

6144:xTesOZmWPYMW/VaoWC0ccNPfPM/+c7qiteIeV8sO24mghVBulsEdiXw3E:BesOZgWCniPfPMB7qDIywBKPd1E

Score

N/A

Malware Config

Signatures

Files

cc1b9590f5e03acd61bf9939ecb20d8c606baafa4c2a1f17f7b79af638aaa1bc
.exe windows x86

5cd84c1e2bd9b95ff02339a61ae032a8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

xmlstorageimpl

??1CDataIStream@@UAE@XZ
??0CDataIStream@@QAE@PAUIStream@@@Z

msvcp80

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

mfc80u

ord5351
ord3923
ord4190
ord6010
ord4119
ord6086
ord577
ord283
ord293
ord760
ord572
ord2985
ord1955
ord5171
ord4961
ord6271
ord5148
ord5911
ord1605
ord2560
ord3590
ord1970
ord1281
ord2651
ord762
ord280
ord4026
ord899
ord3842
ord2261
ord6173
ord6167
ord3756
ord2155
ord1182
ord1178
ord6282
ord870
ord1202
ord2895
ord774
ord2297
ord1172
ord2250
ord1079
ord3158
ord5210
ord4226
ord1536
ord2077
ord587
ord3165
ord4228
ord1538
ord2080
ord4092
ord1474
ord1922
ord591
ord1299
ord1118
ord2311
ord2167
ord266
ord1785
ord3635
ord6063
ord3927
ord2282
ord5705
ord667
ord584
ord1961
ord2901
ord1425
ord2893
ord317
ord432
ord896
ord4574
ord1908
ord284
ord288
ord5316
ord1154
ord776
ord1435
ord433
ord2121
ord605
ord3176
ord4256
ord5199
ord1392
ord5908
ord6720
ord1542
ord1661
ord1662
ord2011
ord4884
ord5178
ord354
ord1061
ord1060
ord894
ord3841
ord3983
ord3902
ord2366
ord4347
ord2151
ord1906
ord2444
ord3331
ord1156
ord709
ord501
ord1894
ord3395
ord3678
ord629
ord383
ord3981
ord6751
ord314
ord1176
ord4729
ord4206
ord1126
ord1135
ord1067
ord2239
ord3677
ord1386
ord5829
ord757
ord566
ord3327
ord4475
ord2832
ord5562
ord5209
ord5226
ord4562
ord3942
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord5096
ord1007
ord3800
ord5579
ord2009
ord2054
ord4320
ord6274
ord3795
ord6272
ord4008
ord4032
ord593
ord5364
ord5971
ord5113
ord334
ord1049
ord1121
ord4078
ord1479
ord282
ord6700
ord3204
ord1925
ord3198
ord620
ord3189
ord745
ord557
ord4100
ord5524
ord1476
ord3990
ord5442
ord3858
ord2648
ord3508
ord5337
ord1027
ord4098
ord2310
ord5416
ord3460
ord635
ord395
ord4259
ord5161
ord4271
ord1297
ord2164
ord5201
ord5144
ord3939
ord1548
ord4013
ord2418
ord2419
ord2986
ord5352
ord940
ord4898
ord2933
ord4129
ord4303
ord5006
ord5003
ord2609
ord1904
ord2237
ord4293
ord4244
ord1148
ord3642
ord6111
ord1472
ord6299
ord1086
ord721
ord524
ord3288
ord4266
ord1512
ord4274
ord5208
ord1573
ord2027
ord4577
ord1318
ord977
ord6077
ord2662
ord630
ord3082
ord2012
ord385
ord860
ord4588
ord2468
ord2460
ord742
ord553
ord5923
ord5855
ord1220
ord723
ord5447
ord1000
ord531
ord1903
ord2072
ord1343
ord6721
ord1611
ord1608
ord3940
ord1393
ord4238
ord5141
ord277
ord287
ord291
ord6096
ord1899
ord5067
ord6265
ord4179
ord5198
ord3397
ord4716
ord4276
ord1591
ord5956
ord5231
ord5229
ord920
ord925
ord929
ord927
ord931
ord2384
ord2404
ord2388
ord2394
ord2392
ord2390
ord2407
ord2402
ord2386
ord2409
ord2397
ord2379
ord2381
ord2399
ord2169
ord2163
ord1513
ord6273
ord3796
ord6275
ord3339
ord1353
ord5157
ord1953
ord1647
ord1646
ord1590
ord5196
ord2531
ord2725
ord2829
ord4301
ord2708
ord2856
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4480
ord4255
ord764
ord1430
ord1198

msvcr80

_initterm_e
_initterm
_wcmdln
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_wmakepath
_wgetcwd
_wchdir
memmove_s
setlocale
_wcsupr
exit
memset
_recalloc
__RTDynamicCast
_get_heap_handle
wcscat_s
wcsncpy_s
wcscpy_s
_configthreadlocale
_resetstkoflw
wcsspn
wcsncpy
iswalpha
_itow
sscanf
isalnum
_wcsnicmp
_wsplitpath
memcpy_s
memcpy
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
free
malloc
??0exception@std@@QAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
_wcsicmp
_purecall
__CxxFrameHandler3
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_invoke_watson
_controlfp_s
_crt_debugger_hook
wcsstr
?_type_info_dtor_internal_method@type_info@@QAEXXZ

kernel32

DeleteFileW
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
lstrlenW
InterlockedDecrement
InterlockedIncrement
RaiseException
GetLastError
GetProcAddress
LoadLibraryW
SetEvent
LocalFree
FormatMessageW
CreateMutexW
OpenMutexW
lstrcmpiW
GetCurrentThread
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
CreateEventW
WaitForSingleObject
CloseHandle
GetCommandLineW
CreateThread
ResetEvent
SetProcessShutdownParameters
Sleep
GetTempPathW
CopyFileW
LoadLibraryA
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetProcessHeap
HeapFree
GetCurrentProcess
InitializeCriticalSection
CreateFileW
ResumeThread
SuspendThread
GetCurrentThreadId
DuplicateHandle
WideCharToMultiByte
GetLocaleInfoW
GetShortPathNameW
DeleteCriticalSection

user32

SetForegroundWindow
InvalidateRect
GetParent
EnableWindow
GetWindowRect
SendMessageW
MessageBoxW
GetSystemMetrics
RemovePropW
GetPropW
PostMessageW
UnregisterClassA
SetFocus
IsWindow
RegisterWindowMessageW
SetPropW
SetMenu
GetFocus
SetCursor
GetActiveWindow
UpdateWindow
FindWindowW
CharNextW
GetClientRect
LoadCursorW
GetWindow

gdi32

GetStockObject
GetObjectW
CreateFontIndirectW
DeleteObject

advapi32

RegOpenKeyExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW

shell32

ShellExecuteExW

shlwapi

PathRemoveFileSpecW
PathAppendW
PathIsRelativeW
PathIsDirectoryW
PathFindFileNameW
PathRemoveExtensionW
PathRemoveBackslashW
PathFileExistsW
PathFindExtensionW

ole32

CoRegisterMessageFilter
CoInitialize
CoInitializeEx
CoResumeClassObjects
StgCreateDocfile
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemRealloc
CoGetInterfaceAndReleaseStream
StgOpenStorageEx
StringFromGUID2
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
CoCreateInstance
OleRun
CoTaskMemAlloc

oleaut32

RegisterTypeLi
UnRegisterTypeLi
VariantCopy
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayCreateVector
SafeArrayPutElement
LoadTypeLi
CreateErrorInfo
SetErrorInfo
VariantChangeType
GetErrorInfo
LoadRegTypeLi
SysAllocStringLen
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear
VariantInit
SysFreeString
VarUI4FromStr

ot70asu

ord10043
ord10039
ord10040
ord10045
ord10056
ord9891
ord9892
ord9893
ord9894
ord9895
ord10047
ord10048
ord10070
ord9902
ord9890
ord10062
ord9899
ord9904
ord4475
ord9877
ord11929
ord11971
ord11844
ord11847
ord10057
ord9880
ord13251
ord4843
ord4611
ord4875
ord4478
ord4872
ord4598
ord4606
ord4694
ord4693
ord4609
ord4476
ord4684
ord4477
ord4873
ord4495
ord4497
ord4498
ord4499
ord4491
ord4493
ord4482
ord4494
ord4605
ord4599
ord4601
ord4600
ord4602
ord4604
ord4603
ord4486
ord4592
ord4845
ord4902
ord4593
ord4905
ord4682
ord13064
ord13274
ord13275
ord13070
ord13071
ord13245
ord13246
ord13291
ord13286
ord13160
ord13081
ord13080
ord13079
ord13276
ord13083
ord13249
ord13287
ord13248
ord13250
ord10061
ord13169
ord13076
ord13166
ord13167
ord13168
ord13154
ord13153
ord13155
ord13156
ord13157
ord13158
ord13077
ord13159
ord13066
ord13277
ord13010
ord12982
ord13234
ord13009
ord12885
ord12973
ord12883
ord12882
ord12880
ord12881
ord12972
ord13290
ord13007
ord9861
ord10055
ord12221
ord4904
ord12377
ord12163
ord12207
ord12038
ord12161
ord12226
ord12360
ord10041
ord11934
ord9900
ord10038
ord9905
ord11967
ord10018
ord9901

basicsservices

?Read@IDataFileStream@@UAEIPAXI@Z
?Seek@IDataFileStream@@UAEKJW4tagSEEK_ORIGIN@@@Z
?GetLength@IDataFileStream@@UBEKXZ
?Unzip@CCimZiper@@QAE_NXZ
??0CCimZiper@@QAE@PAVCDataStream@@0@Z
??1IDataFileStream@@UAE@XZ
??1CCimZiper@@QAE@XZ
?GetResourceHandle@CCimLangResourceManager@@QAEPAUHINSTANCE__@@VCCimString@@@Z
?GetInstance@CCimLangResourceManager@@SAPAV1@XZ
??0CDataFileStream@@QAE@AAVCFile@@@Z
??1CDataFileStream@@UAE@XZ

Sections

.text
Size: 228KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5cd84c1e2bd9b95ff02339a61ae032a8

Headers

File Characteristics

Imports

xmlstorageimpl

msvcp80

mfc80u

msvcr80

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

oleaut32

ot70asu

basicsservices

Sections

.text Size: 228KB - Virtual size: 224KB

.rdata Size: 104KB - Virtual size: 103KB

.data Size: 8KB - Virtual size: 9KB

.rsrc Size: 8KB - Virtual size: 5KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 228KB - Virtual size: 224KB

.rdata
Size: 104KB - Virtual size: 103KB

.data
Size: 8KB - Virtual size: 9KB

.rsrc
Size: 8KB - Virtual size: 5KB

.rmnet
Size: 60KB - Virtual size: 60KB