45cf341a2d12bf92a07157500efba647176ef354bcf6b53edb52daf064cf352a

Sharing

Copy URL Twitter E-mail

General

Target

45cf341a2d12bf92a07157500efba647176ef354bcf6b53edb52daf064cf352a
Size

332KB
MD5

0c688c0e7e082573bdcc5d6f58fd30e0
SHA1

45612cc4e1754bdbfd77d372a39a8e1b8fb99943
SHA256

45cf341a2d12bf92a07157500efba647176ef354bcf6b53edb52daf064cf352a
SHA512

b4e07308a24b02be6cb59a29249bbd69f55cd5ad3a973ff3dcf647429275909cd9fa53c935beadf106582e2303e6a9325ee78e5a6f64fc539c1955127fc5514a
SSDEEP

6144:wnsGlgAsmodXrZPUfbYNo/nS2SzOSO9vjX:wsGlbsmojPUfkafOzd

Score

N/A

Malware Config

Signatures

Files

45cf341a2d12bf92a07157500efba647176ef354bcf6b53edb52daf064cf352a
.dll windows x86

e3a2d4b67862032b601d2afdd576b6aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

SymGetModuleInfo64
SymLoadModule64
SymGetOptions
SymSetOptions
SymGetSymFromAddr64
SymGetLineFromAddr64
SymGetModuleBase64
SymInitialize
SymCleanup
SymLoadModule
SymFunctionTableAccess64
StackWalk64

kernel32

GetVersionExA
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetLastError
HeapAlloc
GetCurrentProcessId
SetLastError
IsBadWritePtr
HeapFree
GetProcessHeap
WriteFile
lstrlenW
OutputDebugStringW
GetThreadContext
GetCurrentProcess
IsDebuggerPresent
GetProcAddress
LoadLibraryW
SearchPathW
GetProfileIntW
CreateFileA
GetModuleFileNameA
WideCharToMultiByte
GetACP
IsBadStringPtrW
MultiByteToWideChar
IsBadStringPtrA
RaiseException
IsBadCodePtr
SetUnhandledExceptionFilter
lstrcpynW
lstrlenA
FormatMessageW
GetModuleHandleW
IsBadReadPtr
ReadProcessMemory
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
ExitProcess
LocalFree
GetModuleFileNameW
OutputDebugStringA
VirtualQueryEx
DebugBreak
GetVersionExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DisableThreadLibraryCalls
VirtualProtect
VirtualQuery
HeapReAlloc
HeapCreate
InitializeCriticalSection
HeapDestroy
TlsSetValue
TlsGetValue
GetPrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileSectionW
TlsAlloc
TlsFree
CloseHandle
CreateFileW
GetCurrentThreadId
OpenProcess
ResumeThread
SuspendThread
OpenThread
SetThreadPriority
GetThreadPriority
FreeLibrary
LocalAlloc
GlobalLock
GlobalAlloc
GetLocaleInfoW
LockResource
LoadResource
FindResourceExW
InterlockedExchange
GetCurrentThread
GlobalUnlock

advapi32

RegCreateKeyW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

msvcr71d

_strcmpi
__CppXcptFilter
_stricmp
_adjust_fdiv
_malloc_dbg
_initterm
_free_dbg
free
memset
__CxxFrameHandler
??3@YAXPAX@Z
wcscpy
wcscmp
memcpy
wcscat
wcslen
strcat
strcpy
strlen
_except_handler3
??_V@YAXPAX@Z
??_U@YAPAXIHPBDH@Z
strrchr
wcsstr
malloc
realloc
_local_unwind2
_CrtDoForAllClientObjects
_CrtCheckMemory
_CrtDbgReport
_CrtSetDumpClient
isprint
bsearch
_CrtSetDbgFlag
_CrtDumpMemoryLeaks
_CrtSetAllocHook
_wcsicmp
_splitpath
_wtol
wcstok
_itow
wcsrchr
wcsncpy
_wcslwr
iswspace
vswprintf
abs
swprintf
_vsnprintf
_vsnwprintf
_CRT_RTC_INIT
__security_error_handler
__dllonexit
_onexit

comctl32

ord17

Exports

Exports

AddClientDV
AddCrashHandlerLimitModule
AddDiagAssertModule
AllocAndFillProcessModuleList
BSUAnsi2Wide
BSUGetModuleBaseNameA
BSUGetModuleBaseNameW
BSUGetModuleFileNameExA
BSUGetModuleFileNameExW
BSUIsInteractiveUser
BSUSetCurrentThreadNameA
BSUSetCurrentThreadNameW
BSUSetThreadNameA
BSUSetThreadNameW
BSUSymInitializeA
BSUSymInitializeW
BSUWide2Ansi
CreateCurrentProcessCrashDumpA
CreateCurrentProcessCrashDumpW
DiagAssertA
DiagAssertW
DiagOutputA
DiagOutputW
GetFaultReason
GetFirstStackTraceString
GetLimitModuleCount
GetLimitModulesArray
GetLoadedModules
GetNextStackTraceString
GetProcessThreadIds
GetRegisterString
GetSuperAssertionCount
HookImportedFunctionsByNameA
HookImportedFunctionsByNameW
HookOrdinalExportA
HookOrdinalExportW
IsMiniDumpFunctionAvailable
IsNT
IsNT4
IsServer2003
IsServer2003orBetter
IsW2K
IsW2KorBetter
IsXP
IsXPorBetter
MemStressInitializeA
MemStressInitializeW
MemStressTerminate
SetCrashHandlerFilter
SetDiagAssertFile
SetDiagAssertOptions
SetDiagOutputFile
SnapCurrentProcessMiniDumpA
SnapCurrentProcessMiniDumpW
SuperAssertionA
SuperAssertionW
ValidateAllBlocks

Sections

.text
Size: 172KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e3a2d4b67862032b601d2afdd576b6aa

Headers

File Characteristics

Imports

dbghelp

kernel32

advapi32

version

msvcr71d

comctl32

Exports

Exports

Sections

.text Size: 172KB - Virtual size: 169KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 4KB - Virtual size: 12KB

.idata Size: 8KB - Virtual size: 5KB

.didat Size: 4KB - Virtual size: 3KB

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 12KB - Virtual size: 10KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 172KB - Virtual size: 169KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 4KB - Virtual size: 12KB

.idata
Size: 8KB - Virtual size: 5KB

.didat
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 12KB - Virtual size: 10KB

.rmnet
Size: 60KB - Virtual size: 60KB