bd3ac701720f61fcbf3b4978395ef33e1fbe909fb76db94e326517a39bdcead8

Sharing

Copy URL Twitter E-mail

General

Target

bd3ac701720f61fcbf3b4978395ef33e1fbe909fb76db94e326517a39bdcead8
Size

152KB
MD5

a0941bd1c75559f1e465fa76b3e8c3b4
SHA1

4489acdf8e6db55534b0c0a919ffd4aa347f1967
SHA256

bd3ac701720f61fcbf3b4978395ef33e1fbe909fb76db94e326517a39bdcead8
SHA512

d04cd556c47da272c8f2ad6ea97a985b2ef0df1c5f7e662ffdb54991ed39276b6b167cda500aa43caecd2202929b64bec4168f1f8cdd74f918fb4106071b7184
SSDEEP

3072:E15DL3ODaqoTV1R9M1Sgf4qcD660vQ48Xv:KODaqkR9cgz6bv4

Score

N/A

Malware Config

Signatures

Files

bd3ac701720f61fcbf3b4978395ef33e1fbe909fb76db94e326517a39bdcead8
.dll windows x86

651372cef6d4e315895eaddd6f454096

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAppendW
StrCpyW

kernel32

RemoveDirectoryW
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
GetCurrentThreadId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentProcessId
GetSystemTimeAsFileTime
FindFirstFileW
FileTimeToSystemTime
DeleteFileW
FindNextFileW
FindClose
CreateDirectoryW
GetLastError
OpenProcess
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
OutputDebugStringW

advapi32

RegCloseKey
RegQueryValueExW
RegCreateKeyExW

shell32

SHGetFolderPathW

msvcr80

__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_decode_pointer
_onexit
_lock
_localtime64
_time64
??_V@YAXPAX@Z
??_U@YAPAXI@Z
_encode_pointer
__dllonexit
_unlock
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
_vsnwprintf
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
_CxxThrowException
??0exception@std@@QAE@ABQBD@Z
??2@YAPAXI@Z
__iob_func
memset
wcsftime
fclose
_wfopen
fprintf
fflush
_errno
strerror
??3@YAXPAX@Z
_purecall
__CxxFrameHandler3
mbstowcs

msvcp80

??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1locale@std@@QAE@XZ
?widen@?$ctype@_W@std@@QBE_WD@Z
??0_Lockit@std@@QAE@H@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
?_Id_cnt@id@locale@std@@0HA
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@@Z
?_Incref@facet@locale@std@@QAEXXZ
?facet_Register@facet@locale@std@@CAXPAV123@@Z
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z

psapi

EnumProcessModules
GetModuleBaseNameW

Exports

Exports

??0CStormLog@@QAE@ABV0@@Z
??0CStormLog@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0CStormLog@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4LogLevel@0@@Z
??0CStormLogOutputHolder@@QAE@XZ
??1CStormLog@@QAE@XZ
??1CStormLogOutputHolder@@QAE@XZ
??4CStormLog@@QAEAAV0@ABV0@@Z
??4CStormLogOutputFactory@@QAEAAV0@ABV0@@Z
??4CStormLogOutputHolder@@QAEAAV0@ABV0@@Z
??_7CStormLog@@6B@
?BUFFER_SIZE@CStormLog@@0HB
?CreateNewDebugOutput@CStormLogOutputFactory@@SAPAVCStormLogOutput@@XZ
?CreateNewFileOutput@CStormLogOutputFactory@@SAPAVCStormLogOutput@@PB_W@Z
?CreateNewNoLogOutput@CStormLogOutputFactory@@SAPAVCStormLogOutput@@XZ
?CreateNewStdOutput@CStormLogOutputFactory@@SAPAVCStormLogOutput@@XZ
?CreateNewXMLFileOutput@CStormLogOutputFactory@@SAPAVCStormLogOutput@@PB_W@Z
?DEFAULT_LEVEL@CStormLog@@2W4LogLevel@1@B
?GetCategory@CStormLog@@QAEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?GetDefaultLevel@CStormLog@@SA?AW4LogLevel@1@XZ
?GetLevel@CStormLog@@QAE?AW4LogLevel@1@XZ
?GetOutput@CStormLogOutputHolder@@QAEPAVCStormLogOutput@@XZ
?InitAPILogging@CStormLog@@AAEXXZ
?SetCategory@CStormLog@@QAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?SetDefaultLevel@CStormLog@@SAXW4LogLevel@1@@Z
?SetLevel@CStormLog@@QAEXW4LogLevel@1@@Z
?SetLogOutput@CStormLog@@SAXPAVCStormLogOutput@@@Z
?SetOutput@CStormLogOutputHolder@@QAEXPAVCStormLogOutput@@@Z
?_defaultLevel@CStormLog@@0W4LogLevel@1@A
?_logAPI@CStormLog@@0_NA
?api@CStormLog@@QAAXPB_WZZ
?debug@CStormLog@@QAAXPB_WZZ
?error@CStormLog@@QAAXPB_WZZ
?info@CStormLog@@QAAXPB_WZZ
?nolevel@CStormLog@@QAAXPB_WZZ
?perror@CStormLog@@QAEXPB_W@Z
?print@CStormLog@@QAAXW4LogLevel@1@PB_WZZ
?print@CStormLog@@UAEXW4LogLevel@1@PB_WPAD@Z

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

651372cef6d4e315895eaddd6f454096

Headers

File Characteristics

Imports

shlwapi

kernel32

advapi32

shell32

msvcr80

msvcp80

psapi

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 14KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 120KB - Virtual size: 177KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 15KB - Virtual size: 14KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 120KB - Virtual size: 177KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB