2ef326dc90a6d368feb4c59b6bf3f0dbb9e32e509c915fea65a9cb0b02a0aa15_unpacked_mailpassview

Sharing

Copy URL Twitter E-mail

General

Target

2ef326dc90a6d368feb4c59b6bf3f0dbb9e32e509c915fea65a9cb0b02a0aa15_unpacked_mailpassview
Size

100KB
MD5

54e8ded7b148a13d3363ac7b33f6eb06
SHA1

63dcbe2db9cc14564eb84d5e953f2f9f5c54acd9
SHA256

400b411a9bffd687c5e74f51d43b7dc92cdb8d5ca9f674456b75a5d37587d342
SHA512

bf6d047bb55150b2369bdd7dfea9c815894af2e05e5b45f2eedf67d5d6a9569189ee495870fddf334a173a4beed62d2a08807c000d4c47339ac76b760b4ae349
SSDEEP

1536:dkSw2tYZT/E7mKr1awGUpi2joqDm1WHUZ1Kj4IQFeFB6n9w2KQf:dk52tYtEyKB5GUDlDdccQkW9w2KQf

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
sample	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
sample	MailPassView

Files

2ef326dc90a6d368feb4c59b6bf3f0dbb9e32e509c915fea65a9cb0b02a0aa15_unpacked_mailpassview
.exe windows x86

f62295e96de1ceba9dea2c107634303d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memmove
wcschr
wcslen
wcsncmp
_itoa
_strlwr
qsort
strncmp
_snprintf
_mbsrchr
_mbsnbicmp
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_cexit
_strnicmp
_acmdln
__getmainargs
_initterm
_memicmp
malloc
strrchr
_stricmp
free
modf
memcmp
strtoul
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
sprintf
_mbsicmp
atoi
_strcmpi
strlen
strcmp
exit
_adjust_fdiv
wcsstr
log
_mbscmp
strchr
_purecall
strncat
abs
strcat
_ultoa
strcpy
memset
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
__setusermatherr

comctl32

CreateToolbarEx
ImageList_Create
ImageList_AddMasked
ImageList_SetImageCount
ord17
ImageList_ReplaceIcon
ord6

rpcrt4

UuidFromStringA

kernel32

GetCurrentDirectoryA
GetModuleHandleA
SetCurrentDirectoryA
GetCurrentProcess
ExitProcess
GetCurrentProcessId
ReadProcessMemory
OpenProcess
GetStdHandle
GetPrivateProfileIntA
EnumResourceNamesA
WritePrivateProfileStringA
GetComputerNameA
GetFileSize
CreateFileA
GlobalUnlock
GlobalLock
GetTempPathA
GlobalAlloc
CloseHandle
FindResourceA
LoadResource
EnumResourceTypesA
SizeofResource
LockResource
DeleteFileA
GetStartupInfoA
GetPrivateProfileStringA
MultiByteToWideChar
WideCharToMultiByte
ExpandEnvironmentStringsA
LocalFree
WriteFile
GetPrivateProfileSectionA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
FindFirstFileA
FindNextFileA
SetFilePointer
GetLastError
LoadLibraryExA
GetFileAttributesA
GetTempFileNameA
FindClose
FormatMessageA
GetWindowsDirectoryA
ReadFile
GetVersionExA

user32

GetClassNameA
GetMessageA
TranslateMessage
RegisterWindowMessageA
PostQuitMessage
TrackPopupMenu
PostMessageA
GetFocus
DispatchMessageA
DrawTextExA
IsDialogMessageA
GetWindowTextA
GetMenuItemInfoA
EnumChildWindows
DestroyMenu
GetDlgCtrlID
DialogBoxParamA
ShowWindow
SetCursor
LoadCursorA
ChildWindowFromPoint
GetSysColorBrush
EndDialog
GetDlgItem
CreateWindowExA
InvalidateRect
SetDlgItemInt
BeginPaint
GetClientRect
GetWindow
SetDlgItemTextA
DrawFrameControl
GetDlgItemTextA
SendDlgItemMessageA
SetWindowTextA
GetWindowRect
GetSystemMetrics
GetDlgItemInt
DeferWindowPos
EndPaint
DefWindowProcA
TranslateAcceleratorA
MessageBoxA
GetWindowPlacement
RegisterClassA
UpdateWindow
SetMenu
LoadAcceleratorsA
SetWindowPos
SendMessageA
LoadIconA
GetWindowLongA
SetWindowLongA
SetFocus
BeginDeferWindowPos
EndDeferWindowPos
CheckMenuItem
GetMenuItemCount
SetClipboardData
GetMenuStringA
EnableWindow
DestroyWindow
GetCursorPos
LoadImageA
GetSysColor
MapWindowPoints
GetMenu
CloseClipboard
GetParent
OpenClipboard
GetDC
EmptyClipboard
MoveWindow
GetSubMenu
EnableMenuItem
ReleaseDC
LoadMenuA
LoadStringA
CreateDialogParamA
ModifyMenuA

gdi32

GetDeviceCaps
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject
GetTextExtentPoint32A
SetBkColor
SelectObject

comdlg32

GetOpenFileNameA
GetSaveFileNameA
FindTextA

advapi32

RegEnumKeyA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
GetUserNameA
RegCloseKey

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteA

ole32

CoInitialize
CoTaskMemFree
CoUninitialize

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f62295e96de1ceba9dea2c107634303d

Headers

File Characteristics

Imports

msvcrt

comctl32

rpcrt4

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 69KB - Virtual size: 69KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 12KB - Virtual size: 11KB

.text
Size: 69KB - Virtual size: 69KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 12KB - Virtual size: 11KB