af4f176eda0c5569eeab0014f7cdd05f40b49116e141b6610d828547d11b924c

Sharing

Copy URL Twitter E-mail

General

Target
af4f176eda0c5569eeab0014f7cdd05f40b49116e141b6610d828547d11b924c
Size 140KB
Sample221020-3cypwabbf3
SHA256 af4f176eda0c5569eeab0014f7cdd05f40b49116e141b6610d828547d11b924c
MD5 113f47c2179cd5cb39293e29ee7dac39
SHA1 f12c3569e59a35b2f5cdf875c31ebf4409d02cf7
SHA512 4a97fb59dee48fa45592c937068bef9460910c0d4fe736e216124465d4de47d652e691062a0d3f25c7c72f56e94fad10106355326e0b2e596d79a7b96036efcf
SSDEEP 1536:7lQJRkCN9031eNs12BgzZunimOtO73hkqEI2G:7oRlj03AYwgzZhJc+rG
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

af4f176eda0c5569eeab0014f7cdd05f40b49116e141b6610d828547d11b924c

.exe 140KB

af4f176eda0c5569eeab0014f7cdd05f40b49116e141b6610d828547d11b924c

IMPHASH 08ccb57c4a229943fbc5fb8dabcaa11c
SHA256 af4f176eda0c5569eeab0014f7cdd05f40b49116e141b6610d828547d11b924c
MD5 113f47c2179cd5cb39293e29ee7dac39
SHA1 f12c3569e59a35b2f5cdf875c31ebf4409d02cf7
SHA512 4a97fb59dee48fa45592c937068bef9460910c0d4fe736e216124465d4de47d652e691062a0d3f25c7c72f56e94fad10106355326e0b2e596d79a7b96036efcf
SSDEEP 1536:7lQJRkCN9031eNs12BgzZunimOtO73hkqEI2G:7oRlj03AYwgzZhJc+rG
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

141185

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

container

?CreatePluginContainer@CContainerFactory@@SAPAVIPluginContainer@@PBD@Z ?DestroyPluginContainer@CContainerFactory@@SAXPAVIPluginContainer@@@Z

isaputrace

?instance@CiSAPUTrace@@SAPAV1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?Traceout@CiSAPUTrace@@QAEXHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0H0@Z ?destroy@CiSAPUTrace@@SAXXZ

skinmagicu

ord2 ord1

msvcp71

?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z ??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ?_Nomemory@std@@YAXXZ ?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z ?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z ??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??$?ODU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z

msvcr71

__CxxFrameHandler _CxxThrowException tolower isupper ?terminate@@YAXXZ ??1exception@@UAE@XZ ??0exception@@QAE@XZ ??3@YAXPAX@Z strchr strncmp fclose fwrite fopen sprintf strstr strtol fread ftell fseek _purecall _findclose _findnext _findfirst rename atoi ??_V@YAXPAX@Z wcscmp wcslen _beginthread malloc _callnewh _c_exit _exit _XcptFilter _cexit exit _wcmdln _amsg_exit __wgetmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 ??1type_info@@UAE@XZ __security_error_handler __dllonexit _onexit _controlfp ??0exception@@QAE@ABV0@@Z free memset _itoa

mfc71u

ord1198 ord6063 ord6232 ord501 ord709 ord4743 ord4026 ord1386 ord1785 ord605 ord354 ord3176 ord4256 ord5199 ord4238 ord1392 ord5908 ord1542 ord1661 ord1662 ord2011 ord4574 ord4884 ord4729 ord4206 ord5178 ord1058 ord741 ord572 ord3311 ord4480 ord2985 ord2856 ord5196 ord1590 ord1646 ord1647 ord1955 ord5171 ord1353 ord4961 ord3339 ord6275 ord3796 ord6273 ord1513 ord2163 ord2169 ord2399 ord2381 ord2379 ord2397 ord2409 ord2386 ord2402 ord2407 ord2390 ord2392 ord2394 ord2388 ord2404 ord2384 ord931 ord927 ord929 ord925 ord920 ord5229 ord5231 ord5956 ord1591 ord4276 ord4716 ord3397 ord5210 ord4179 ord6271 ord5067 ord1899 ord5148 ord4234 ord1393 ord3940 ord1608 ord1611 ord5911 ord1582 ord2086 ord1894 ord2365 ord3635 ord3824 ord1049 ord5971 ord293 ord1118 ord6086 ord776 ord280 ord577 ord2239 ord3677 ord1079 ord2366 ord4032 ord4008 ord6272 ord3795 ord6274 ord4320 ord2054 ord2009 ord5579 ord3800 ord1007 ord5096 ord6215 ord5378 ord3826 ord1911 ord2925 ord5220 ord5222 ord3942 ord4562 ord5226 ord5209 ord5562 ord2531 ord2725 ord2829 ord4301 ord2708 ord2832 ord2534 ord2640 ord2527 ord3712 ord3713 ord3703 ord2638 ord3943 ord4475 ord4255 ord3327 ord566 ord757

kernel32

GetModuleFileNameA GetVersionExA DeleteCriticalSection InitializeCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter ExitProcess GetStartupInfoW GetModuleHandleA CreateMutexW GetLastError GetPrivateProfileStringW WinExec GetModuleFileNameW CreateDirectoryW GetExitCodeThread GetCurrentProcess TerminateProcess CreateEventW WaitForSingleObject CloseHandle SetEvent MultiByteToWideChar LoadLibraryW GetProcAddress GetFileAttributesA SetFileAttributesA Sleep FreeLibrary WideCharToMultiByte

user32

AppendMenuW GetSystemMenu IsIconic GetClientRect DrawIcon EnableWindow LoadIconW GetSystemMetrics GetWindow IsWindow GetPropW IsWindowVisible ShowWindow InvalidateRect SetForegroundWindow GetLastActivePopup wsprintfW GetDesktopWindow SendMessageW

comctl32

ord17

shlwapi

PathFileExistsW