9815bfb7ae3d84a44e59b56dc8b568df6dcf0f9a9e3843b3cefa469869bd8414

Sharing

Copy URL Twitter E-mail

General

Target

9815bfb7ae3d84a44e59b56dc8b568df6dcf0f9a9e3843b3cefa469869bd8414
Size

272KB
MD5

4fd3948d3d6b6967bc895a00080278f0
SHA1

2efb0196310197471075539a8f18acadf507fd9d
SHA256

9815bfb7ae3d84a44e59b56dc8b568df6dcf0f9a9e3843b3cefa469869bd8414
SHA512

9cfa8561c0e12285ce7d0bd747fac0f0b7c7666a64e4a799ad864d4a8a330f19f2852d0444cc75e8f5bf06e471167102849997cdd75c90532570d9bf19618c31
SSDEEP

6144:t5PLvDnp+iFFotI4WqesBJRVaqLOEgU7tIncQ3:t5PLLotI4WuazUIncc

Score

N/A

Malware Config

Signatures

Files

9815bfb7ae3d84a44e59b56dc8b568df6dcf0f9a9e3843b3cefa469869bd8414
.dll regsvr32 windows x86

a9ef3e3a91258bb906160d5ca0b00a98

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_addr

wininet

InternetQueryOptionA

mp

mp_gv
mp_ms
mp_gt

crypto

aes_decrypt
aes_encrypt
aes_set_key
sha1_finish
sha1_update
sha1_starts

kernel32

DeleteCriticalSection
GetLastError
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryA
WaitForMultipleObjects
GetModuleFileNameA
GetModuleHandleA
InitializeCriticalSection
MultiByteToWideChar
VirtualQuery
IsBadCodePtr
lstrcatA
lstrcpyA
WideCharToMultiByte
lstrlenW
lstrlenA
ExitProcess
LoadLibraryExA
FindResourceA
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
QueryPerformanceCounter
GetCurrentProcessId
LoadResource
SizeofResource
IsDBCSLeadByte
lstrcpynA
DisableThreadLibraryCalls
lstrcmpiA
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionA
GetCurrentThreadId
SetEvent
GetSystemTimeAsFileTime
CloseHandle
WaitForSingleObject
CreateEventA

user32

CharNextA

advapi32

RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoUninitialize
StringFromGUID2
CLSIDFromString
CoTaskMemFree
StringFromIID
IIDFromString
CoTaskMemRealloc

oleaut32

RegisterTypeLi
SysAllocString
SysFreeString
LoadTypeLi
UnRegisterTypeLi
VarUI4FromStr

msvcp71

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?clear@ios_base@std@@QAEXH_N@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@II@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??$?5DU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAD@Z
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z

shlwapi

PathFindExtensionA

msvcr71

__CxxFrameHandler
_CxxThrowException
memcpy
??1exception@@UAE@XZ
??0exception@@QAE@XZ
strncpy
memmove
rand
strcmp
sprintf
_ultoa
_ui64toa
atol
_atoi64
strrchr
sscanf
memcmp
_purecall
_putenv
strlen
malloc
_resetstkoflw
wcsncpy
realloc
__security_error_handler
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
__CppXcptFilter
??0exception@@QAE@ABV0@@Z
_except_handler3
memset
free
_itoa

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
_msize
add_emule_server
add_emule_server_byLink
add_networkmsg_callback
cancel_speed_limit
close_bt_reimport_task
connect_emule_server
create_continued_bt_task
create_continued_emule_task
create_continued_emule_task2
create_continued_task
create_ed2k_link
create_new_bt_task
create_new_emule_task
create_new_emule_task2
create_new_task
create_predownload_task
create_upload_bt_task
create_upload_emule_task
create_upload_emule_task2
debug_p2p_pipe_choke_remote
debug_p2p_pipe_query_info
debug_p2p_pipe_release_info
debug_p2p_pipe_simulate_remote_choke_local
delete_emule_server
delete_emule_temp_files
delete_emule_temp_files2
delete_file_basic_info_table
delete_task
delete_tempfile
emule_tempfile_reimport
emule_tempfile_reimport2
enable_file_upload
erase_emule_tempfile_reimport_result
fetch_server_connection_info
fix_pre_download_parameter
fix_task_parameter
generate_ed2k_link
get_bt_cfg_file_list
get_bt_data_file_list
get_bt_file_id
get_bt_file_info
get_bt_peer_info_list
get_bt_reimport_progress
get_bt_reimport_root_path
get_bt_task_info
get_client_hash
get_connect_period
get_connector_parameter
get_credits_file
get_crypt_option
get_current_upload_speed
get_dht_status
get_download_bandwidth
get_download_lib
get_dspider_ctrl_flag
get_ed2k_server_link
get_emule_hub_host
get_emule_hub_port
get_emule_kad_port
get_emule_listen_port
get_emule_peer_info_list
get_emule_server_count
get_emule_server_info
get_emule_server_list
get_emule_status
get_emule_task_AICH_hash
get_emule_task_bcid
get_emule_task_cid
get_emule_task_fileid
get_emule_task_gcid
get_emule_task_info
get_emule_tempfile_reimport_result
get_enrollsp1_info
get_external_info
get_failure_detail
get_file_name
get_file_upload_speed_by_type
get_final_filename
get_global_connection_limit
get_http_request_header
get_http_request_method
get_kad_search_result
get_kademlia_node_hash
get_kadnode_file
get_last_modified
get_mod_version
get_network_status
get_nickname
get_origin_readbytes
get_origin_res_connect_state
get_peer_id
get_play_id
get_play_port
get_post_data
get_reconnect_period
get_reimport_ed2k_link
get_reimport_file_name
get_res_searcher_state
get_secure_file
get_secureident_option
get_server_list_file
get_server_search_result
get_small_file_size
get_source_search_period
get_source_upmost
get_task_ext_from_hub
get_task_gcid
get_task_url
get_temp_file_list
get_temp_file_list2
get_thunder_peer_extern_credit
get_torrent_file_name
get_upload_credit
get_upnp_status
get_url_str
hold_connect_ranking
import_clients_credit
init
is_AICH_enable
is_bt_tempfile_exist
is_compress_enable
is_ed2k_enable
is_emule_temp_file_exist
is_emule_temp_file_exist2
is_kad_enable
is_nated
is_p2sp_enable
is_protocol_forbidded
is_registered
is_source_exchange_enable
is_support_dispatch_strategy
is_support_schema
is_task_download_module_failed
is_tempfile_exist
notify_del_uncomp_task
notify_hub_bt_deleted
notify_hub_bt_moved
notify_hub_deleted
notify_hub_moved
on_playing
parse_ed2k_server_url
parse_ed2k_url
parse_filename
parse_seed_file
parse_url
query_new_connect_info
query_part_cid
query_resource_info
query_task_info
query_upload_file_array
read_ie_proxy
register_client
release_bt_data_file_list
release_bt_peer_info_list
release_ed2k_link
release_peer_info_list
release_seed_file_info
release_temp_file_list
release_upload_file_array
remove_networkmsg_callback
report_crack
report_crack_cancel
reset_bt_task_need_download_file
sametime_connecting_peers
set_AICH_enable
set_added_resource_count
set_bt_file_download_order
set_bt_task_stat_para
set_client_hash
set_complete_file_name
set_compress_enable
set_connector_parameter
set_cookie
set_crypt_option
set_cur_language
set_dap_priority_list
set_dht_switch
set_dispatch_strategy
set_ed2k_enable
set_emule_crypt_option
set_emule_hub_host
set_emule_hub_port
set_emule_kad_port
set_emule_listen_port
set_emule_server_priority
set_emule_switch
set_emule_task_stat_para
set_external_info
set_file_name
set_forbid_p2p_service
set_global_connection_limit
set_http_request_header
set_http_request_method
set_hub_proxy
set_iobuffer_size
set_kad_enable
set_kademlia_node_hash
set_last_modified
set_listen_port
set_nichname
set_p2sp_enable
set_partner_id
set_plugin_id
set_post_data
set_product_flag
set_product_identifier
set_proxy_info
set_recommend_info
set_ref_send_strategy
set_reference_source
set_report_strategy
set_res_query_cid
set_res_use_strategy
set_retry_strategy
set_sametime_connecting_peers
set_secureident_option
set_source_exchange_enable
set_source_upmost
set_speed_limit
set_speed_limit_mode
set_stat_ref_url
set_task_download_speed_limit
set_task_hub_type
set_task_type
set_thread_num
set_thunder_peer_extern_credit
set_thunder_version
set_upload_speed_limit
set_upnp_switch
set_user_name
set_xl_file_system_bufsize
set_xl_file_system_flush_bufsize
start_bt_reimport_task
start_kad_search
start_predownload_task
start_server_search
start_task
stop_batch_task
stop_emule_server
stop_kad_search
stop_server_search
stop_task
uninit
update_datafile
url_info_to_str
verify_proxy

Sections

.text
Size: 132KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a9ef3e3a91258bb906160d5ca0b00a98

Headers

File Characteristics

Imports

ws2_32

wininet

mp

crypto

kernel32

user32

advapi32

ole32

oleaut32

msvcp71

shlwapi

msvcr71

version

Exports

Exports

Sections

.text Size: 132KB - Virtual size: 129KB

.rdata Size: 48KB - Virtual size: 44KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 568B

.reloc Size: 20KB - Virtual size: 17KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 132KB - Virtual size: 129KB

.rdata
Size: 48KB - Virtual size: 44KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 568B

.reloc
Size: 20KB - Virtual size: 17KB

.rmnet
Size: 60KB - Virtual size: 60KB