3d7ca4b48f874a7a79822dd0c650a4215afa168e1e7f153bd6252fb1ad9e896c

Sharing

Copy URL Twitter E-mail

General

Target

3d7ca4b48f874a7a79822dd0c650a4215afa168e1e7f153bd6252fb1ad9e896c
Size

523KB
MD5

807ff94eccfb85626164235bb517ed70
SHA1

691f275ad5644bd83d50b40463d93e4afd231cca
SHA256

3d7ca4b48f874a7a79822dd0c650a4215afa168e1e7f153bd6252fb1ad9e896c
SHA512

c0d4fe8d4e1095d2ac263fd07e546f5f594e3eefc6376edf7ebcb0b2732bcf06eef2a4b42dee45fc039f2a47c88da224a6d061b1b8c4f51b11fc24f227ff2aef
SSDEEP

12288:exxem51Q1jGCFUJDsSiz+2aNsLI42csEFnYQKwuMO:exIm51EiC7S2aNXc/YQZZO

Score

N/A

Malware Config

Signatures

Files

3d7ca4b48f874a7a79822dd0c650a4215afa168e1e7f153bd6252fb1ad9e896c
.exe windows x86

71ee56054d7ec2a00daca5387cc95474

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_addr
gethostbyname
WSAGetLastError
ntohs
getservbyport
htonl
WSASetLastError
getservbyname
htons
gethostbyaddr
inet_ntoa

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

ofcnotifyqueue

?InitNotifySign@@YAHH@Z
?DeinitNotifySign@@YAXXZ
?InitSendNotify@@YAXXZ
?UninitSendNotify@@YAXXZ
?SendNotifyToIPPortDirect@@YAHPBD0KHPAX@Z
?SendNotifyPmcProduct@@YAHPBDHPAD0H@Z
?SendNotifyDirect@@YAHPBDHPAX@Z

cgiresutf8

cgi_GetResourceString

ofcshare

?getMasterDirectory@@YAXPADH@Z

cgishare

?getINIint@@YAHPAD0H0@Z
??6OutputStreamConverter@@QAEAAV0@PBD@Z
?getHomeDir@@YAHPADK@Z
?getINIString@@YAKPAD000K0@Z
?isAliveMasterService@@YA_NXZ
?httpAccessEX@@YAHPADH0H0H00H0H@Z
?flush@OutputStreamConverter@@QAEAAV1@XZ

kernel32

FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
GetVolumeInformationA
GetFullPathNameA
GlobalGetAtomNameA
lstrcmpA
GlobalFlags
SetEvent
GetVersionExA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GetLocaleInfoA
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
RtlUnwind
VirtualAlloc
RaiseException
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
HeapReAlloc
GetCommandLineA
GetFileTime
ReadFile
SetStdHandle
GetFileType
HeapSize
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
GetACP
IsValidCodePage
SetHandleCount
GetStdHandle
GetStartupInfoA
Sleep
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
CreateFileW
SetEnvironmentVariableA
WaitNamedPipeW
SetNamedPipeHandleState
GetFileSize
GetFileAttributesA
GetThreadLocale
GetTimeZoneInformation
InterlockedCompareExchange
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
CreateEventW
CreateWaitableTimerW
GetOverlappedResult
SetWaitableTimer
FindFirstFileA
FindClose
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedDecrement
InterlockedIncrement
GetModuleHandleA
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FindResourceA
LoadResource
LockResource
SizeofResource
GetSystemDirectoryA
GetCurrentProcessId
GetPrivateProfileStringA
LoadLibraryA
GetTickCount
LocalAlloc
GetProcessHeap
HeapAlloc
HeapFree
CreateMutexW
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetProcAddress
SetLastError
FreeLibrary
FormatMessageA
LocalFree
InitializeCriticalSection
CreateIoCompletionPort
PostQueuedCompletionStatus
WaitForMultipleObjects
GetLastError
DeleteCriticalSection
CreateFileA
SetFilePointer
WriteFile
CloseHandle
GetLocalTime
GetPrivateProfileIntA
GetCurrentThreadId
GetModuleFileNameA
GetQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
lstrlenA
WideCharToMultiByte
CompareStringA
CompareStringW
MultiByteToWideChar
GetVersion
InterlockedExchange
GetDriveTypeA

user32

CopyRect
DefWindowProcA
CallWindowProcA
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
SetWindowPos
SetWindowLongA
IsWindow
GetDlgItem
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
GetKeyState
PeekMessageA
ValidateRect
UnregisterClassA
GetFocus
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
SetWindowTextA
GetWindowTextA
GetWindowThreadProcessId
SendMessageA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
UnhookWindowsHookEx
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
AdjustWindowRectEx
RegisterClassA
GetMenuState
GetMenuItemID
GetClassInfoA
GetClassInfoExA
CreateWindowExA
PostMessageA
GetMenu
GetClientRect
GetMenuItemCount
GetSubMenu
MessageBoxA
wsprintfA
CharUpperA
SetForegroundWindow
PostQuitMessage
DestroyMenu
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints

gdi32

SetBkColor
SaveDC
RestoreDC
SetMapMode
PtVisible
RectVisible
ExtTextOutA
Escape
SetTextColor
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
GetClipBox
CreateBitmap
SelectObject
DeleteObject
TextOutA
GetDeviceCaps

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

oleaut32

VariantInit
VariantChangeType
VariantClear

crypt32

CryptUnprotectData

wininet

InternetWriteFile
InternetSetFilePointer
HttpQueryInfoA
InternetGetLastResponseInfoA
InternetSetStatusCallback
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetSetOptionA
HttpAddRequestHeadersA
HttpSendRequestA
InternetQueryOptionA
InternetReadFile
InternetQueryDataAvailable
InternetCloseHandle
InternetCrackUrlA
InternetCanonicalizeUrlA

shlwapi

PathStripToRootA
PathFindFileNameA
PathIsUNCA
UrlUnescapeA

Exports

Exports

??4OutputStreamConverter@@QAEAAV0@ABV0@@Z
??4UTFConverter@@QAEAAV0@ABV0@@Z
??4UTFDataFormatException@@QAEAAV0@ABV0@@Z
??6OutputStreamConverter@@QAEAAV0@P6AAAV0@AAV0@@Z@Z
?endl@@YAAAVOutputStreamConverter@@AAV1@@Z
?flush@@YAAAVOutputStreamConverter@@AAV1@@Z

Sections

.text
Size: 332KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 36KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

71ee56054d7ec2a00daca5387cc95474

Headers

File Characteristics

Imports

ws2_32

advapi32

ofcnotifyqueue

cgiresutf8

ofcshare

cgishare

kernel32

user32

gdi32

comdlg32

winspool.drv

oleaut32

crypt32

wininet

shlwapi

Exports

Exports

Sections

.text Size: 332KB - Virtual size: 330KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 36KB - Virtual size: 56KB

.rsrc Size: 76KB - Virtual size: 76KB

.text
Size: 332KB - Virtual size: 330KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 36KB - Virtual size: 56KB

.rsrc
Size: 76KB - Virtual size: 76KB