be79f6a5c75775c87e6232409594606854773c239c139dd4aa80258847a9278e

Sharing

Copy URL Twitter E-mail

General

Target

be79f6a5c75775c87e6232409594606854773c239c139dd4aa80258847a9278e
Size

1.4MB
MD5

10b82802fbf967221336029dfff2731e
SHA1

bf0a0fc18219c4ddf367daea4cba57544a4342dd
SHA256

be79f6a5c75775c87e6232409594606854773c239c139dd4aa80258847a9278e
SHA512

8e371870310ef9aefee98d5a480df7f0ba354a16831f53737399b69f85c44a9aaaec3b0a5c11840054036d73300f015c930f1b8c7d7d74336305f63b4f60113d
SSDEEP

12288:ThRs1PeByJ8JT9kBktXcEDo00l9LBU8qX7zSiWgIsspDK2jekcRbVS:tG1Pe4JUD0l9LBU8qX7zrWhtZjhES

Score

N/A

Malware Config

Signatures

Files

be79f6a5c75775c87e6232409594606854773c239c139dd4aa80258847a9278e
.exe windows x86

0cf6a780209a44ee59bab7fa28574236

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

controlcan

ord2
ord1
ord17
ord5
ord6
ord13
ord16
ord11
ord10
ord18
ord14

mfc100d

ord15240
ord8087
ord955
ord1395
ord369
ord1029
ord954
ord1394
ord8307
ord2197
ord8835
ord10938
ord5600
ord356
ord1024
ord5041
ord4085
ord3424
ord10167
ord2196
ord6128
ord463
ord1095
ord6488
ord3549
ord14609
ord4137
ord2035
ord12417
ord14937
ord5767
ord2685
ord4651
ord10078
ord4131
ord12983
ord13035
ord15818
ord12939
ord10004
ord2964
ord14880
ord6841
ord2838
ord2813
ord12613
ord2842
ord4301
ord4374
ord4407
ord4449
ord4500
ord4452
ord4033
ord9143
ord13362
ord8929
ord9856
ord15148
ord3536
ord4436
ord8102
ord973
ord1411
ord8314
ord2696
ord4663
ord13083
ord1290
ord270
ord6975
ord14380
ord10245
ord5575
ord6122
ord5893
ord4048
ord8796
ord14988
ord14065
ord14943
ord6412
ord7548
ord6942
ord7526
ord15093
ord14348
ord851
ord1334
ord852
ord1309
ord805
ord3487
ord804
ord8861
ord855
ord843
ord13540
ord1471
ord509
ord1128
ord8179
ord6389
ord5741
ord7243
ord10000
ord4424
ord11194
ord8320
ord986
ord1421
ord2244
ord4727
ord1409
ord1382
ord1402
ord7497
ord2693
ord4660
ord11073
ord6309
ord13910
ord13082
ord13131
ord11247
ord8994
ord4983
ord13121
ord13113
ord6497
ord4044
ord16019
ord16022
ord16020
ord16023
ord16018
ord16021
ord8709
ord13440
ord15706
ord12826
ord4887
ord2072
ord8656
ord13929
ord4279
ord4337
ord10266
ord15833
ord8635
ord15835
ord13448
ord13447
ord2559
ord5822
ord16308
ord13844
ord9200
ord9292
ord351
ord1023
ord9202
ord14301
ord2067
ord5641
ord11389
ord971
ord939
ord964
ord9235
ord3987
ord3886
ord9149
ord7675
ord9289
ord8941
ord5577
ord14664
ord15042
ord9298
ord14310
ord8348
ord14354
ord1815
ord14359
ord14703
ord13766
ord14503
ord15245
ord15241
ord1774
ord12481
ord8993
ord862
ord1335
ord14101
ord7506
ord4409
ord11882
ord1434
ord1444
ord503
ord6150
ord474
ord1102
ord6077
ord4041
ord15044
ord4053
ord13449
ord15330
ord15839
ord10061
ord7801
ord417
ord1059
ord8165
ord10105
ord13037
ord444
ord1079
ord6935
ord7667
ord15102
ord3342
ord11241
ord12745
ord11650
ord13421
ord15804
ord1432
ord9177
ord6468
ord8510
ord13755
ord12820
ord8099
ord969
ord1407
ord4849
ord8311
ord15785
ord11642
ord2690
ord4657
ord12960
ord12556
ord5348
ord2839
ord2815
ord12614
ord2840
ord9857
ord3427
ord3539
ord6398
ord1025
ord359
ord3323
ord7854
ord406
ord1054
ord3453
ord3452
ord14072
ord5045
ord2765
ord4062
ord3883
ord5710
ord9618
ord5058
ord8086
ord8321
ord13399
ord871
ord1343
ord14075
ord9679
ord9180
ord3780
ord4482
ord9678
ord9179
ord11489
ord10003
ord3423
ord4435
ord14472
ord8790
ord4047
ord14383
ord5773
ord9613
ord5504
ord6410
ord14753
ord8783
ord4046
ord14729
ord15748
ord5897
ord14431
ord8776
ord9685
ord8503
ord5223
ord3887
ord12993
ord11859
ord12229
ord4281
ord3581
ord3580
ord3334
ord3333
ord6839
ord14876
ord3472
ord3469
ord8986
ord2963
ord16611
ord16613
ord16612
ord16610
ord16614
ord16596
ord16523
ord16524
ord10007
ord12950
ord4028
ord12781
ord15828
ord9834
ord13036
ord4876
ord2742
ord7669
ord11845
ord10126
ord3432
ord15019
ord13138
ord13136
ord1753
ord1760
ord1766
ord16531
ord4874
ord3235
ord15836
ord8636
ord15834
ord7518
ord12557
ord14811
ord6522
ord2871
ord12986
ord4133
ord3544
ord3543
ord3431
ord13032
ord5664
ord6047
ord6306
ord10219
ord6019
ord6334
ord5667
ord5884
ord5647
ord8412
ord8413
ord8403
ord5882
ord8998
ord11078
ord10079
ord4545
ord2597
ord14148
ord9903
ord311
ord6501
ord3199
ord306
ord1731
ord1460
ord6450
ord15536
ord1463
ord2267
ord14465
ord11273
ord2199
ord1727
ord15438
ord3184
ord15152
ord14987
ord12516
ord1351
ord884
ord9163
ord5503
ord316
ord1697
ord7553
ord4074
ord6403
ord14749
ord15111
ord4856
ord1669
ord8509
ord5896
ord15334
ord999
ord322
ord8163
ord4261
ord1442
ord1057
ord14007
ord8599
ord14005
ord7546
ord6358
ord4081
ord1764
ord1771
ord5324
ord5361
ord5332
ord5344
ord5340
ord5336
ord5366
ord5357
ord5328
ord413
ord7799
ord1435
ord15613
ord4803
ord9631
ord7668
ord9243
ord1143
ord532
ord14600
ord7188
ord6356
ord5370
ord5349
ord5315
ord5319
ord2553
ord5352
ord2478
ord2294
ord16627

msvcr100d

__setusermatherr
clock
sprintf_s
strtok_s
memmove
_setmbcp
_ultoa
_itoa
memset
_CxxThrowException
__CxxFrameHandler3
fopen_s
fgets
fclose
_CIsqrt
memcpy
_invoke_watson
_controlfp_s
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_CRT_RTC_INITW
_initterm_e
_initterm
_CrtDbgReportW
_CrtSetCheckCount
_acmdln
_ismbblead
exit
_cexit
_XcptFilter
_exit
__getmainargs
_amsg_exit
__set_app_type
_fmode
_commode
atoi
_configthreadlocale
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
realloc
fprintf
fread
rename
strcat_s
strtod
sscanf_s
fgetc
ftell
fseek
atof
rand
_time64
srand
rewind
fopen
_chdir
atol
free
malloc
fwrite
sprintf
strtok
strstr

kernel32

LocalFree
VirtualQuery
GetModuleFileNameW
GetProcessHeap
HeapAlloc
HeapFree
LoadLibraryW
lstrlenA
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
LoadLibraryA
GetProcAddress
FreeLibrary
GlobalUnlock
GlobalLock
GlobalAlloc
QueryPerformanceFrequency
GetCurrentThreadId
GetCurrentDirectoryA
CreateDirectoryA
CloseHandle
ReleaseMutex
GetLastError
CreateMutexA
QueryPerformanceCounter
GetLocalTime
FindClose
FindNextFileA
FindFirstFileA
SetCurrentDirectoryA
CopyFileA
DeleteFileA
lstrcpyA
Sleep
IsProcessorFeaturePresent

user32

CloseClipboard
SetClipboardData
EmptyClipboard
GetKeyState
UnhookWindowsHookEx
GetSystemMetrics
SetWindowsHookExA
CallNextHookEx
SetRect
GetDlgCtrlID
GetMessagePos
SendMessageA
SetWindowLongA
GetWindowLongA
GetCursorPos

gdi32

CreateSolidBrush

comdlg32

GetOpenFileNameA
GetSaveFileNameA

advapi32

RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA

shell32

ShellExecuteA

shlwapi

PathFileExistsA

ole32

CoCreateGuid

oleaut32

SysAllocString
VariantClear

Sections

.text
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 565KB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 405KB - Virtual size: 405KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0cf6a780209a44ee59bab7fa28574236

Headers

DLL Characteristics

File Characteristics

Imports

controlcan

mfc100d

msvcr100d

kernel32

user32

gdi32

comdlg32

advapi32

shell32

shlwapi

ole32

oleaut32

Sections

.text Size: 246KB - Virtual size: 246KB

.rdata Size: 134KB - Virtual size: 133KB

.data Size: 565KB - Virtual size: 5.0MB

.rsrc Size: 405KB - Virtual size: 405KB

.reloc Size: 45KB - Virtual size: 45KB

Size: 56KB - Virtual size: 60KB

.text
Size: 246KB - Virtual size: 246KB

.rdata
Size: 134KB - Virtual size: 133KB

.data
Size: 565KB - Virtual size: 5.0MB

.rsrc
Size: 405KB - Virtual size: 405KB

.reloc
Size: 45KB - Virtual size: 45KB