7b80bd479a76ee35932b5cb43b07d8ea57adb80fac81f75cf5db338a071b54aa

Sharing

Copy URL Twitter E-mail

General

Target

7b80bd479a76ee35932b5cb43b07d8ea57adb80fac81f75cf5db338a071b54aa
Size

227KB
MD5

9654cd934751150a58718e8ad33d8f49
SHA1

3687d0f96ea79f265ce045cab928b83471628dd5
SHA256

7b80bd479a76ee35932b5cb43b07d8ea57adb80fac81f75cf5db338a071b54aa
SHA512

f511740b104c077338013af28931956f8e7f9d1cdcff58ae081262d9576dc26c1d86a2cb2d85564275818401297fad8256922b2bf471b1a9a380461a63c030f1
SSDEEP

6144:E/H9mcZsdxc9TBNCOKoMUY/8i3kjk++M+0++r+Vkz8wFVrSpK+wj+Ew+Q+o+3+nS:E/H9lZ2xc9TjJYRck++M+0++r+Vkz8wR

Score

N/A

Malware Config

Signatures

Files

7b80bd479a76ee35932b5cb43b07d8ea57adb80fac81f75cf5db338a071b54aa
.dll windows x86

4392f0c52216809dea1c1c49b5a0e43e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyW
lstrlenW
GetLastError
GetModuleFileNameW
CloseHandle
CreateFileW
CreateDirectoryW
MultiByteToWideChar
WideCharToMultiByte
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange

msvcp90

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$allocator@D@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??0?$allocator@D@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z
??1locale@std@@QAE@XZ
?to_char_type@?$char_traits@_W@std@@SA_WABG@Z
?to_int_type@?$char_traits@_W@std@@SAGAB_W@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?thousands_sep@?$numpunct@_W@std@@QBE_WXZ
?grouping@?$numpunct@_W@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0locale@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$numpunct@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
??Bid@locale@std@@QAEIXZ
?id@?$numpunct@_W@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0ABV12@@Z
?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z
??0?$_String_val@_WV?$allocator@_W@std@@@std@@IAE@V?$allocator@_W@1@@Z
??0?$allocator@_W@std@@QAE@XZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?max_size@?$allocator@D@std@@QBEIXZ

shlwapi

PathFileExistsW
HashData

msvcr90

?what@exception@std@@UBEPBDXZ
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
memmove_s
??0bad_cast@std@@QAE@ABV01@@Z
_purecall
abort
malloc
free
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
??0exception@std@@QAE@ABQBD@Z
_vsnprintf
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
??_V@YAXPAX@Z
_CxxThrowException
memset
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z

Exports

Exports

??0CLocationInfo@Exception@Common@@QAE@ABV012@@Z
??0CLocationInfo@Exception@Common@@QAE@PBD0H@Z
??0CLocationInfo@Exception@Common@@QAE@PB_W0H@Z
??0CLocationInfo@Exception@Common@@QAE@XZ
??0CMyBuffer@Buffer@Common@@QAE@XZ
??0CMyStringA@Buffer@Common@@QAE@XZ
??0CMyStringW@Buffer@Common@@QAE@XZ
??0CMyVector@Buffer@Common@@QAE@XZ
??0CRunTimeException@Exception@Common@@QAE@ABV012@@Z
??0CRunTimeException@Exception@Common@@QAE@PBVCLocationInfo@12@PBDK@Z
??0CRunTimeException@Exception@Common@@QAE@PBVCLocationInfo@12@PB_WK@Z
??1CLocationInfo@Exception@Common@@QAE@XZ
??1CMyBuffer@Buffer@Common@@QAE@XZ
??1CMyStringA@Buffer@Common@@QAE@XZ
??1CMyStringW@Buffer@Common@@QAE@XZ
??1CMyVector@Buffer@Common@@QAE@XZ
??1CRunTimeException@Exception@Common@@QAE@XZ
??4CLocationInfo@Exception@Common@@QAEAAV012@ABV012@@Z
??4CRunTimeException@Exception@Common@@QAEAAV012@ABV012@@Z
?Add@CMyVector@Buffer@Common@@QAEHPBDH@Z
?AddNull@CMyVector@Buffer@Common@@QAEHXZ
?Attach@CMyBuffer@Buffer@Common@@QAEXPBDH@Z
?Attach@CMyStringA@Buffer@Common@@QAEXPBD@Z
?Attach@CMyStringW@Buffer@Common@@QAEXPB_W@Z
?GetAppFolder@Path@Common@@YA?BHPAVCMyStringW@Buffer@2@@Z
?GetAt@CMyVector@Buffer@Common@@QBE_NHPAVCMyBuffer@23@@Z
?GetCount@CMyVector@Buffer@Common@@QBEHXZ
?GetDataLength@CMyBuffer@Buffer@Common@@QBEHXZ
?GetErrorCode@CRunTimeException@Exception@Common@@QBEKXZ
?GetErrorMessage@CRunTimeException@Exception@Common@@QBEPB_WXZ
?GetModuleFolder@Path@Common@@YA?BHPAUHINSTANCE__@@PAVCMyStringW@Buffer@2@@Z
?GetSource@CRunTimeException@Exception@Common@@QBEPB_WXZ
?HashData@Data@Common@@YAKPBDHK@Z
?IsDirectoryExists@Path@Common@@YAHPB_W@Z
?IsFileExists@Path@Common@@YAHPB_W@Z
?IsNullAt@CMyVector@Buffer@Common@@QAE_NH@Z
?MakeSureDirectoryPathExists@Path@Common@@YAHPB_W@Z
?Remove@CMyVector@Buffer@Common@@QAEXH@Z
?ToArray@CMyBuffer@Buffer@Common@@QBEPBDXZ
?ToString@CLocationInfo@Exception@Common@@QBEPB_WXZ
?UnicodeToUtf8@Convert@Common@@YAXPB_WPAVCMyStringA@Buffer@2@@Z
?Utf8ToUnicode@Convert@Common@@YAXPBDPAVCMyStringW@Buffer@2@@Z
?c_str@CMyStringA@Buffer@Common@@QBEPBDXZ
?c_str@CMyStringW@Buffer@Common@@QBEPB_WXZ

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4392f0c52216809dea1c1c49b5a0e43e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp90

shlwapi

msvcr90

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 60KB

.rdata Size: 28KB - Virtual size: 28KB

.data Size: 1024B - Virtual size: 8KB

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 3KB - Virtual size: 3KB

.text Size: 132KB - Virtual size: 132KB

.text
Size: 60KB - Virtual size: 60KB

.rdata
Size: 28KB - Virtual size: 28KB

.data
Size: 1024B - Virtual size: 8KB

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 132KB - Virtual size: 132KB