1aa7f73d3e00e4bb8fd35bae1215309371b702a428de27473a74dc741c666264

Sharing

Copy URL Twitter E-mail

General

Target

1aa7f73d3e00e4bb8fd35bae1215309371b702a428de27473a74dc741c666264
Size

236KB
MD5

9630f9818cb87815bba14a50307de726
SHA1

64e14356982819912b4b623d2416b3b1214952e4
SHA256

1aa7f73d3e00e4bb8fd35bae1215309371b702a428de27473a74dc741c666264
SHA512

df19da1d5e69322863e5ed0d2594f555b4a95ef0feb17360060450ecf623724228571967a1eabd70c33edaadef6dd36a4a164eb218acea53d39882c695a93061
SSDEEP

6144:ODHi7MWK7Gor5+VGkDtG2bi4fhLxfzmxQB0dNx:OT3t+VvDE2bi4fhLxSx

Score

N/A

Malware Config

Signatures

Files

1aa7f73d3e00e4bb8fd35bae1215309371b702a428de27473a74dc741c666264
.dll windows x86

99862367abdb7d179ccbd74637c11913

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord2814
ord2740
ord2801
ord268
ord4129
ord5710
ord5572
ord5683
ord939
ord2763
ord2764
ord6142
ord668
ord356
ord5860
ord3181
ord2781
ord2770
ord4058
ord3701
ord879
ord882
ord2917
ord2803
ord958
ord6312
ord4177
ord6385
ord5442
ord2614
ord1567
ord3227
ord3408
ord5186
ord3180
ord3183
ord3176
ord3507
ord3614
ord354
ord860
ord665
ord5583
ord5645
ord5651
ord3127
ord3616
ord350
ord1979
ord825
ord941
ord500
ord772
ord537
ord2915
ord922
ord2818
ord4202
ord1641
ord800
ord6672
ord3758
ord6010
ord3054
ord273
ord858
ord535
ord540
ord823
ord3425
ord3880
ord938
ord936
ord934
ord932
ord832
ord5933
ord3663
ord342
ord1182
ord1253
ord1168
ord603
ord5773
ord2601
ord3318
ord539

msvcrt

_mbschr
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
strstr
_CxxThrowException
_stat
__CxxFrameHandler
_mbscmp
_mbsinc
_rmdir
_mbsicmp
localtime
setlocale
_mbsrchr

kernel32

GetLogicalDriveStringsA
GetSystemDirectoryA
GetTempPathA
CreateDirectoryA
InterlockedDecrement
DeleteFileA
CopyFileA
GetLastError
GetFileAttributesA
SetErrorMode
GetVersionExA
GetOEMCP
GetLocaleInfoA
GetThreadLocale
LoadLibraryA
FreeLibrary
GetDriveTypeA
MultiByteToWideChar
lstrlenA
LocalFree

user32

LoadBitmapA
LoadStringA

advapi32

GetUserNameA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

ole32

OleUninitialize
CoCreateInstance
OleInitialize

oleaut32

SysFreeString
SysAllocString
VariantClear

Exports

Exports

??0CKArchive@@QAE@ABV0@@Z
??0CKArchive@@QAE@PAVCKFile@@IH@Z
??0CKDateTime@@QAE@J@Z
??0CKDateTime@@QAE@JJJJJJ@Z
??0CKDateTime@@QAE@XZ
??0CKDirSpec@@QAE@AAV0@@Z
??0CKDirSpec@@QAE@AAVCKString@@@Z
??0CKDirSpec@@QAE@XZ
??0CKDirSpecList@@QAE@XZ
??0CKFile@@QAE@XZ
??0CKFileSpec@@QAE@AAV0@@Z
??0CKFileSpec@@QAE@AAVCKString@@@Z
??0CKFileSpec@@QAE@PAD@Z
??0CKFileSpec@@QAE@XZ
??0CKFileSpecList@@QAE@XZ
??0CKPtrArray@@QAE@XZ
??0CKString@@QAE@ABV0@@Z
??0CKString@@QAE@ABVCString@@@Z
??0CKString@@QAE@PBD@Z
??0CKString@@QAE@XZ
??0CKStringList@@QAE@XZ
??0CKSysContext@@QAE@ABV0@@Z
??0CKSysContext@@QAE@XZ
??1CKArchive@@QAE@XZ
??1CKDateTime@@UAE@XZ
??1CKDirSpec@@UAE@XZ
??1CKDirSpecList@@UAE@XZ
??1CKFile@@UAE@XZ
??1CKFileSpec@@UAE@XZ
??1CKFileSpecList@@UAE@XZ
??1CKPtrArray@@UAE@XZ
??1CKString@@UAE@XZ
??1CKStringList@@UAE@XZ
??1CKSysContext@@UAE@XZ
??4CKArchive@@QAEAAV0@ABV0@@Z
??4CKDateTime@@QAEAAV0@AAJ@Z
??4CKDateTime@@QAEAAV0@AAV0@@Z
??4CKDirSpec@@QAEABV0@AAV0@@Z
??4CKFileSpec@@QAEABV0@AAV0@@Z
??4CKString@@QAEAAV0@ABV0@@Z
??4CKSysContext@@QAEAAV0@ABV0@@Z
??8CKDateTime@@QBE_NAAV0@@Z
??8CKDirSpec@@QAE_NAAV0@@Z
??8CKFileSpec@@QAE_NAAV0@@Z
??9CKDateTime@@QBE_NAAV0@@Z
??MCKDateTime@@QBE_NAAV0@@Z
??NCKDateTime@@QBE_NAAV0@@Z
??OCKDateTime@@QBE_NAAV0@@Z
??PCKDateTime@@QBE_NAAV0@@Z
??_7CKDateTime@@6B@
??_7CKDirSpec@@6B@
??_7CKDirSpecList@@6B@
??_7CKFile@@6B@
??_7CKFileSpec@@6B@
??_7CKFileSpecList@@6B@
??_7CKPtrArray@@6B@
??_7CKString@@6B@
??_7CKStringList@@6B@
??_7CKSysContext@@6B@
?Close@CKFile@@UAEXXZ
?CopyFileA@CKFileSpec@@QAEJAAV1@_N@Z
?CreateDir@CKDirSpec@@QAEJXZ
?Delete@CKFile@@SAJVCKFileSpec@@@Z
?DeleteDir@CKDirSpec@@QAEJ_N@Z
?DeleteFileA@CKFileSpec@@QAEJXZ
?DirExists@CKDirSpec@@QAE_NXZ
?FileExists@CKFileSpec@@QAE_NXZ
?Format@CKDateTime@@QAEXAAVCKString@@W4DateTimeFormat@1@@Z
?FreeStorage@CKDirSpecList@@UAEXXZ
?FreeStorage@CKFileSpecList@@UAEXXZ
?FreeStorage@CKStringList@@UAEXXZ
?GetAsSystemTime@CKDateTime@@QAE_NAAU_SYSTEMTIME@@@Z
?GetAtDirSpec@CKDirSpecList@@UAEPAVCKDirSpec@@J@Z
?GetAtFileSpec@CKFileSpecList@@UAEPAVCKFileSpec@@J@Z
?GetAtString@CKStringList@@UAEPAVCKString@@J@Z
?GetBuffer@CKString@@QAEPADXZ
?GetCDROMList@CKDirSpec@@SAJAAVCKDirSpecList@@@Z
?GetCatDirSuffix@CKSysContext@@SAAAVCKString@@XZ
?GetCatPath42@CKSysContext@@SAAAVCKString@@XZ
?GetCatPath4@CKSysContext@@SAAAVCKString@@XZ
?GetCatPath@CKSysContext@@SAAAVCKString@@XZ
?GetColorMode@CKSysContext@@SAJXZ
?GetCreationTime@CKFileSpec@@QAEJAAVCKDateTime@@@Z
?GetCurrLocaleAbbrevLangName@CKSysContext@@SAPADXZ
?GetDay@CKDateTime@@QAEJXZ
?GetDir@CKDirSpec@@QAE?AVCKString@@XZ
?GetDirDevice@CKDirSpec@@QAE?AVCKString@@_N@Z
?GetDirList@CKDirSpec@@AAEJAAVCKDirSpecList@@_N@Z
?GetDirName@CKDirSpec@@QAE?AVCKString@@XZ
?GetDirSpecList@CKDirSpec@@QAEJAAVCKDirSpecList@@_N11@Z
?GetExt@CKFileSpec@@QAE?AVCKString@@XZ
?GetFileDevice@CKFileSpec@@QAE?AVCKString@@_N@Z
?GetFileList@CKDirSpec@@AAEJAAVCKFileSpecList@@VCKString@@_N@Z
?GetFileSpecList@CKDirSpec@@QAEJAAVCKFileSpecList@@VCKString@@_N22@Z
?GetFilename@CKFileSpec@@QAE?AVCKString@@XZ
?GetFilenameSansExt@CKFileSpec@@QAE?AVCKString@@XZ
?GetFullPath@CKFileSpec@@QAE?AVCKString@@XZ
?GetFullPathSansDevice@CKFileSpec@@QAE?AVCKString@@XZ
?GetHour@CKDateTime@@QAEJXZ
?GetIsDefault@CKSysContext@@SA_NXZ
?GetIsInitialized@CKSysContext@@SA_NXZ
?GetKodakModifiedImagePath@CKSysContext@@SAAAVCKString@@XZ
?GetKodakPath@CKSysContext@@SAAAVCKString@@XZ
?GetLengthBytes@CKString@@QAEHXZ
?GetLocaleAbbrevLangName@CKSysContext@@SAPADXZ
?GetMediaPathRootName@CKSysContext@@SAAAVCKString@@XZ
?GetMinute@CKDateTime@@QAEJXZ
?GetModifiedTime@CKFileSpec@@QAEJAAVCKDateTime@@@Z
?GetMonth@CKDateTime@@QAEJXZ
?GetOCSPath@CKSysContext@@SAAAVCKString@@XZ
?GetPCDROMList@CKDirSpec@@SAJAAVCKDirSpecList@@@Z
?GetParentDir@CKDirSpec@@QAEJAAV1@@Z
?GetPath@CKFileSpec@@QAE?AVCKString@@XZ
?GetPosition@CKFile@@UAEJPAK@Z
?GetPrintAtKodakClientID@CKSysContext@@SAPADXZ
?GetProdName@CKSysContext@@SAPADXZ
?GetProdPath@CKSysContext@@SAAAVCKString@@AAV2@@Z
?GetProdVersion@CKSysContext@@SAPADXZ
?GetRegionCode@CKSysContext@@SA?AW4CoreStatus@@AAF@Z
?GetScreenDim@CKSysContext@@SAJXZ
?GetSecond@CKDateTime@@QAEJXZ
?GetSeparator@CKDirSpec@@SA?AVCKString@@XZ
?GetSignature@CKFileSpec@@MAE?AVCKString@@XZ
?GetSize@CKFileSpec@@QAEJAAK@Z
?GetStringBytes@@YAIPAD@Z
?GetSystemDir@CKDirSpec@@SAJAAV1@@Z
?GetSystemTempDir@CKDirSpec@@SAJVCKString@@AAV1@@Z
?GetTypeCharSet@CKSysContext@@SA?AW4TYPECHARSET@1@XZ
?GetTypeCodePage@CKSysContext@@SAIXZ
?GetTypeCompile@CKSysContext@@SA?AW4TYPECOMPILE@1@XZ
?GetTypeProd@CKSysContext@@SA?AW4TYPEPROD@1@XZ
?GetTypeSys@CKSysContext@@SA?AW4TYPESYS@1@XZ
?GetTypeText@CKSysContext@@SA?AW4TYPETEXT@1@XZ
?GetUserNameA@CKSysContext@@SAPADXZ
?GetVersion@CKFileSpec@@MAEGXZ
?GetXPUserName@CKSysContext@@SAPADXZ
?GetYear@CKDateTime@@QAEJXZ
?InitKCoreDll@@YAXXZ
?Initialize@CKSysContext@@SA?AW4CoreStatus@@XZ
?IsDefault@CKSysContext@@SA_NXZ
?IsEmpty@@YA_NPBD@Z
?IsInitialized@CKSysContext@@SA_NXZ
?IsSpecified@CKDirSpec@@QAE_NXZ
?IsSpecified@CKFileSpec@@QAE_NXZ
?IsValid@CKDateTime@@QAE_NXZ
?IsXPSys@CKSysContext@@SA_NXZ
?KSeparator@CKDirSpec@@0VCKString@@B
?KSignature@CKFileSpec@@1VCKString@@B
?KVersion@CKFileSpec@@1GB
?LocateDirSpec@CKDirSpecList@@UAEJAAVCKDirSpec@@_N@Z
?LocateFileSpec@CKFileSpecList@@UAEJAAVCKFileSpec@@_N@Z
?LocateString@CKStringList@@UAEJAAVCKString@@@Z
?Open@CKFile@@UAEJVCKFileSpec@@W4OpenMode@1@@Z
?ReadData@CKFile@@UAEJPAXKPAK@Z
?Rename@CKFile@@SAJVCKFileSpec@@0@Z
?RenameFile@CKFileSpec@@QAEJAAV1@_N@Z
?Seek@CKFile@@UAEJJW4SeekFrom@1@@Z
?SeekToBegin@CKFile@@UAEJXZ
?SeekToEnd@CKFile@@UAEJXZ
?Serialize@CKDateTime@@UAEJPAVCKArchive@@@Z
?Serialize@CKDirSpecList@@UAEJPAVCKArchive@@@Z
?Serialize@CKFileSpec@@QAEJPAVCKArchive@@@Z
?Serialize@CKFileSpecList@@UAEJPAVCKArchive@@@Z
?Serialize@CKStringList@@UAEJPAVCKArchive@@@Z
?Set@CKDateTime@@QAE_NJJJJJJ@Z
?SetCatDirSuffix@CKSysContext@@SAXABVCKString@@@Z
?SetCatDirSuffixToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetCatPath42@CKSysContext@@SAXABVCKString@@@Z
?SetCatPath42ToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetCatPath4@CKSysContext@@SAXABVCKString@@@Z
?SetCatPath4ToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetCatPath@CKSysContext@@SAXABVCKString@@@Z
?SetCatPathToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetColorMode@CKSysContext@@SAXJ@Z
?SetColorModeToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetCurrLocaleAbbrevLangName@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetDir@CKDirSpec@@QAEXVCKString@@@Z
?SetFullPath@CKFileSpec@@QAEXVCKString@@@Z
?SetIsDefault@CKSysContext@@SAX_N@Z
?SetIsInitialized@CKSysContext@@SAX_N@Z
?SetKodakModifiedImagePath@CKSysContext@@SAXABVCKString@@@Z
?SetKodakPath@CKSysContext@@SAXABVCKString@@@Z
?SetKodakPathAndKodakModifiedToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetLocaleAbbrevLangName@CKSysContext@@SAXPAD@Z
?SetLocaleAbbrevLangNameToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetMediaPathRootName@CKSysContext@@SAXABVCKString@@@Z
?SetMediaPathRootNameToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetOCSPath@CKSysContext@@SAXABVCKString@@@Z
?SetOCSPathToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetPrintAtKodakClientID@CKSysContext@@SAXPAD@Z
?SetPrintAtKodakClientIDToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetProdName@CKSysContext@@SAXPAD@Z
?SetProdNameToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetProdVersion@CKSysContext@@SAXPAD@Z
?SetProdVersionToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetScreenDim@CKSysContext@@SAXJ@Z
?SetScreenDimToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetTypeCharSet@CKSysContext@@SAXW4TYPECHARSET@1@@Z
?SetTypeCharSetToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetTypeCodePage@CKSysContext@@SAXI@Z
?SetTypeCodePageToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetTypeCompile@CKSysContext@@SAXW4TYPECOMPILE@1@@Z
?SetTypeCompileToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetTypeProd@CKSysContext@@SAXW4TYPEPROD@1@@Z
?SetTypeSys@CKSysContext@@SAXW4TYPESYS@1@@Z
?SetTypeSysToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetTypeText@CKSysContext@@SAXW4TYPETEXT@1@@Z
?SetTypeTextToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?SetUserName@CKSysContext@@SAXPAD@Z
?SetUserNameToDefault@CKSysContext@@SA?AW4CoreStatus@@XZ
?TraceLastError@@YAXPAD@Z
?TraceWin32Err@@YAXPADK@Z
?WriteData@CKFile@@UAEJPAXK@Z
?m_bIsDefault@CKSysContext@@1_NA
?m_bIsInitialized@CKSysContext@@1_NA
?m_eTypeCharSet@CKSysContext@@1W4TYPECHARSET@1@A
?m_eTypeCompile@CKSysContext@@1W4TYPECOMPILE@1@A
?m_eTypeProd@CKSysContext@@1W4TYPEPROD@1@A
?m_eTypeSys@CKSysContext@@1W4TYPESYS@1@A
?m_eTypeText@CKSysContext@@1W4TYPETEXT@1@A
?m_nColorMode@CKSysContext@@1JA
?m_nScreenDim@CKSysContext@@1JA
?m_nTypeCodePage@CKSysContext@@1IA
?m_strCatDirSuffix@CKSysContext@@1VCKString@@A
?m_strCatPath42@CKSysContext@@1VCKString@@A
?m_strCatPath4@CKSysContext@@1VCKString@@A
?m_strCatPath@CKSysContext@@1VCKString@@A
?m_strKodakModifiedImagePath@CKSysContext@@1VCKString@@A
?m_strKodakPath@CKSysContext@@1VCKString@@A
?m_strMediaPathRootName@CKSysContext@@1VCKString@@A
?m_strOCSPath@CKSysContext@@1VCKString@@A
?m_szCurrLocaleAbbrevLangName@CKSysContext@@1PADA
?m_szLocaleAbbrevLangName@CKSysContext@@1PADA
?m_szPrintAtKodakClientID@CKSysContext@@1PADA
?m_szProdName@CKSysContext@@1PADA
?m_szProdVersion@CKSysContext@@1PADA
?m_szUserName@CKSysContext@@1PADA
?pcdLoadBitmap@@YAHPAUHINSTANCE__@@0HPAVCBitmap@@@Z
?pcdLoadBitmap@@YAHPAUHINSTANCE__@@HPAVCBitmap@@@Z
?pcdLoadResourceDll@@YAPAUHINSTANCE__@@AAVCKFileSpec@@@Z
?pcdLoadResourceDll@@YAPAUHINSTANCE__@@PAD@Z
?pcdLoadString@@YAHPAUHINSTANCE__@@0HPADH@Z
?pcdLoadString@@YAHPAUHINSTANCE__@@HPADH@Z
?pcdUnloadResourceDll@@YAXPAUHINSTANCE__@@@Z
IsIE4OrLater
RunIE

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

99862367abdb7d179ccbd74637c11913

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 32KB

.rsrc Size: 4KB - Virtual size: 888B

.reloc Size: 4KB - Virtual size: 3KB

.text Size: 164KB - Virtual size: 164KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 32KB

.rsrc
Size: 4KB - Virtual size: 888B

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 164KB - Virtual size: 164KB