fff47638ecda4152f14ede57337b1c7e6eda123aa253fabeeac3fbde362ec854

Sharing

Copy URL

Twitter E-mail

General

Target

fff47638ecda4152f14ede57337b1c7e6eda123aa253fabeeac3fbde362ec854
Size

684KB
MD5

022816a50d9f44579beca32f631757a0
SHA1

e95480ab4693db943e642dc4b8bac41e7fd71e23
SHA256

fff47638ecda4152f14ede57337b1c7e6eda123aa253fabeeac3fbde362ec854
SHA512

dccd9b99f6f40f31cca9200bb26f13d8f74be3bcfa4e65f311527b73826fef77a3270e206b222e3a4825db6875d2aa57600d490b264146213666470dd17e7f27
SSDEEP

12288:k6n5TP6fbHO2iM8kvAV2h5HGtxCR5H9kJWh5/tjCcFQSsPdv:nn576i2iM8k4VtXCnhh1tjChSoR

Score

N/A

Malware Config

Signatures

Files

fff47638ecda4152f14ede57337b1c7e6eda123aa253fabeeac3fbde362ec854
.exe windows x86

cb7c3f73500194bd12816706a458ff08

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHAutoComplete
PathIsDirectoryW
PathIsRelativeW
PathCompactPathW
PathFileExistsW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

libapr_tsvn

_apr_strnatcasecmp@8
_apr_hash_first@8
_apr_hash_this@16
_apr_hash_next@4
_apr_conv_ucs2_to_utf8@16
_apr_filepath_encoding@8
_apr_pmemdup@12
_apr_pstrmemdup@12
_apr_pstrndup@12
_apr_thread_mutex_lock@4
_apr_hash_get@12
_apr_thread_mutex_unlock@4
_apr_hash_pool_get@4
_apr_array_make@12
_apr_array_push@4
_apr_pvsprintf@12
_apr_pstrdup@8
_apr_hash_make@4
_apr_hash_set@16
apr_pool_cleanup_null
_apr_strtoi64@12
_apr_file_rename@12
_apr_file_write_full@16
_apr_file_seek@12
_apr_file_read_full@16
_apr_file_read@12
_apr_file_info_get@12
_apr_file_getc@8
_apr_pool_userdata_set@16
_apr_pool_userdata_get@12
apr_day_snames
_apr_uid_name_get@12
_apr_uid_current@12
_apr_time_exp_gmt@12
_apr_hash_count@4
_apr_strerror@12
_apr_time_exp_gmt_get@8
_apr_ltoa@8
apr_terminate
_apr_file_name_get@8
_apr_file_attrs_set@16
_apr_pool_cleanup_register@16
_apr_file_close@4
_apr_file_remove@8
_apr_sleep@8
_apr_file_open@20
_apr_stat@16
apr_pstrcat
apr_psprintf
_apr_file_eof@4
_apr_palloc@8
_apr_pool_clear@4
_apr_initialize@0
_apr_pool_destroy@4
_apr_pool_create_ex@16
apr_month_snames

libaprutil_tsvn

_apr_base64_encode_len@4
_apr_xlate_open@16
_apr_base64_encode@12
_apr_xlate_conv_buffer@20
_apr_base64_decode_len@4
_apr_md5@12
_apr_base64_decode@8

intl3_svn

libintl_dgettext
libintl_sprintf

mfc80u

ord4884
ord1647
ord4729
ord1955
ord4206
ord5171
ord5178
ord1353
ord4961
ord3339
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2397
ord2409
ord2386
ord283
ord2402
ord4743
ord2407
ord3435
ord4574
ord2390
ord330
ord2392
ord589
ord2394
ord2388
ord354
ord2404
ord605
ord293
ord2384
ord931
ord577
ord927
ord929
ord2310
ord925
ord920
ord6063
ord5229
ord2651
ord5231
ord5956
ord1058
ord1591
ord4276
ord4716
ord3397
ord1079
ord1894
ord5199
ord4256
ord4179
ord1785
ord4480
ord6271
ord287
ord3943
ord5067
ord2638
ord1899
ord504
ord3703
ord5148
ord710
ord3713
ord4238
ord1650
ord3712
ord1392
ord3635
ord2527
ord3940
ord2640
ord1608
ord2534
ord1611
ord2856
ord5908
ord2708
ord6720
ord4301
ord2829
ord280
ord774
ord776
ord2311
ord3990
ord5524
ord5485
ord899
ord4784
ord4437
ord4438
ord1118
ord1920
ord2254
ord565
ord756
ord4026
ord563
ord753
ord3204
ord3071
ord2151
ord2146
ord5981
ord1006
ord5053
ord3342
ord4558
ord1925
ord5618
ord2460
ord2255
ord5923
ord5398
ord5925
ord5170
ord4300
ord1156
ord4346
ord6700
ord762
ord2369
ord3326
ord3946
ord282
ord3569
ord4267
ord1352
ord1479
ord3338
ord3676
ord347
ord1271
ord602
ord5147
ord1393
ord5633
ord5911
ord1270
ord6721
ord3198
ord4882
ord3968
ord4855
ord4858
ord4373
ord2361
ord4378
ord4100
ord4375
ord2366
ord4393
ord3155
ord4395
ord1472
ord2121
ord4380
ord4771
ord4585
ord896
ord4175
ord2362
ord4166
ord4974
ord578
ord4775
ord1460
ord5210
ord4198
ord300
ord3585
ord6140
ord1946
ord4094
ord2085
ord1274
ord3238
ord5723
ord3280
ord6053
ord2010
ord4155
ord2066
ord3157
ord6050
ord5604
ord6056
ord5607
ord2521
ord5640
ord502
ord5185
ord3080
ord3417
ord3281
ord4117
ord2985
ord3995
ord6061
ord4109
ord3678
ord587
ord5636
ord5637
ord4686
ord5934
ord6058
ord2648
ord4255
ord4226
ord1536
ord3331
ord4101
ord5884
ord3174
ord572
ord760
ord4119
ord5715
ord5638
ord5917
ord5727
ord5397
ord6033
ord5410
ord5584
ord333
ord5519
ord326
ord3349
ord5643
ord3249
ord567
ord758
ord5482
ord6166
ord6172
ord900
ord860
ord3448
ord620
ord1178
ord2083
ord4232
ord2952
ord3869
ord3224
ord5708
ord5558
ord3873
ord5484
ord1476
ord6751
ord2461
ord658
ord370
ord618
ord416
ord651
ord1555
ord6749
ord2364
ord1176
ord5999
ord310
ord5399
ord2469
ord5091
ord2462
ord1174
ord2122
ord1443
ord1240
ord3314
ord3092
ord1908
ord2740
ord2747
ord2744
ord2116
ord5873
ord5342
ord2904
ord5325
ord4054
ord6211
ord6291
ord917
ord556
ord2305
ord744
ord2465
ord6306
ord5343
ord6171
ord380
ord4074
ord2260
ord5489
ord2697
ord3991
ord2696
ord5626
ord4102
ord6169
ord3195
ord6175
ord1646
ord2262
ord904
ord783
ord781
ord6232
ord5829
ord2155
ord1784
ord1883
ord777
ord591
ord1960
ord1957
ord1556
ord426
ord663
ord865
ord4642
ord3016
ord5426
ord2893
ord3165
ord4228
ord1538
ord1474
ord1922
ord4060
ord4092
ord2080
ord894
ord2444
ord6293
ord5327
ord5711
ord5713
ord557
ord745
ord564
ord755
ord6282
ord1172
ord5316
ord6002
ord266
ord265
ord3395
ord3756
ord6251
ord3311
ord4234
ord1582
ord2086
ord741
ord5198
ord357
ord6265
ord606
ord5141
ord5909
ord1334
ord3636
ord4980
ord1343
ord2030
ord2068
ord2072
ord1903
ord3981
ord5351
ord2713
ord3923
ord4190
ord6010
ord1543
ord1953
ord3436
ord5157
ord1338
ord3079
ord4628
ord4284
ord5201
ord5144
ord3939
ord1047
ord4013
ord2418
ord2419
ord2986
ord5352
ord940
ord395
ord2579
ord4898
ord1087
ord2933
ord2027
ord2365
ord4129
ord4303
ord3752
ord5006
ord553
ord5003
ord742
ord4244
ord4293
ord2609
ord1315
ord1904
ord6059
ord4755
ord2237
ord532
ord4098
ord1962
ord4162
ord3201
ord3642
ord595
ord635
ord1548
ord5855
ord5721
ord5161
ord4588
ord3797
ord4945
ord3070
ord1416
ord6086
ord5701
ord4336
ord4259
ord5973
ord2261
ord5762
ord4271
ord4538
ord4921
ord1297
ord4533
ord2164
ord3176
ord356
ord3829
ord5803
ord2159
ord1386
ord5609
ord6279
ord4290
ord4741
ord2225
ord3885
ord3857
ord1633
ord1564
ord562
ord3493
ord751
ord5710
ord3648
ord3240
ord1086
ord1586
ord4035
ord2065
ord1244
ord3460
ord4687
ord431
ord1461
ord2471
ord609
ord4347
ord3499
ord444
ord435
ord677
ord1959

msvcr80

isspace
strncmp
strstr
strtol
strtoul
sscanf
qsort
atol
memchr
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
iscntrl
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
wcspbrk
wcscpy_s
??0exception@std@@QAE@XZ
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
strcpy_s
_invalid_parameter_noinfo
wcsncpy_s
memmove_s
rand
_CxxThrowException
atoi
memset
memcpy
memmove
setlocale
_wcsdup
getenv_s
_wtoi
wcsstr
malloc
wcscat_s
wcsrchr
swprintf_s
swscanf_s
wcstoul
memcpy_s
__doserrno
clearerr
feof
fgets
_recalloc
free
_purecall
abort
_wtol
wcschr
_adjust_fdiv
realloc
__CxxFrameHandler3
tolower

kernel32

lstrcpyW
GetVersionExW
GetModuleHandleW
GetProcAddress
FindFirstFileW
FindClose
FindNextFileW
RaiseException
SetLastError
LoadLibraryW
CreateDirectoryW
CreateFileW
ReadFile
FreeLibrary
GetWindowsDirectoryW
GetFileAttributesW
DeleteFileW
MoveFileW
GetVersion
FindResourceW
LoadResource
LockResource
GetCurrentThreadId
GetTickCount
GlobalAddAtomW
GlobalDeleteAtom
GlobalFindAtomW
GetLocaleInfoW
GetTempPathW
GetTempFileNameW
GetCommandLineW
MultiByteToWideChar
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
FormatMessageW
LoadLibraryA
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
lstrlenW
lstrcmpW
CreateProcessW
GetLastError
LocalFree
WaitForSingleObject
CloseHandle
GlobalAlloc
GlobalLock
GlobalUnlock
WideCharToMultiByte
lstrcpynW
MulDiv
GetModuleFileNameW

user32

PtInRect
LoadIconW
EnableWindow
SetTimer
IsIconic
MessageBoxW
OffsetRect
OpenClipboard
EmptyClipboard
ReleaseDC
IsWindowVisible
LoadImageW
SetClipboardData
CloseClipboard
GetDC
DestroyIcon
GetSysColor
LoadCursorW
DrawIconEx
GetKeyState
SetCursor
InvalidateRect
ScreenToClient
GetFocus
GetDlgCtrlID
DrawEdge
UpdateWindow
AppendMenuW
CreatePopupMenu
CreateWindowExW
FindWindowExW
GetWindowRect
SetWindowPos
SetWindowLongW
CallWindowProcW
DrawFrameControl
TabbedTextOutW
SetCapture
InflateRect
DrawTextW
DrawFocusRect
DrawTextExW
GetCapture
FrameRect
GrayStringW
GetSysColorBrush
GetMessagePos
GetParent
SetRect
SystemParametersInfoW
IsWindow
SetRectEmpty
ReleaseCapture
CopyRect
GetCursorPos
SendMessageW
RegisterWindowMessageW
FillRect
KillTimer
CopyIcon
AdjustWindowRectEx
MenuItemFromPoint
DestroyMenu
GetSystemMenu
GetMenuInfo
GetMenu
GetWindowDC
IsChild
GetIconInfo
SetForegroundWindow
MessageBeep
GetAsyncKeyState
GetDesktopWindow
GetMonitorInfoW
IntersectRect
DefWindowProcW
GetWindowLongW
ValidateRect
MonitorFromRect
WindowFromDC
BeginPaint
SetLayeredWindowAttributes
CopyAcceleratorTableW
EndPaint
MapVirtualKeyW
LoadMenuW
GetKeyNameTextW
GetMenuState
GetMenuItemID
IsRectEmpty
ClientToScreen
RedrawWindow
LoadBitmapW
SetWindowsHookExW
GetClassNameW
GetMenuItemInfoW
UnhookWindowsHookEx
SetPropW
DrawStateW
SetMenu
CallNextHookEx
GetPropW
RemovePropW
IsMenu
GetMenuDefaultItem
SetMenuInfo
GetMenuItemRect
CopyImage
GetMenuItemCount
GetSubMenu
ModifyMenuW
PeekMessageW
GetMessageW
DispatchMessageW
EnableMenuItem
PostMessageW
GetClassLongW
WindowFromPoint
ShowWindow
IsCharAlphaNumericW
DrawIcon
GetClientRect
GetSystemMetrics
SetMenuDefaultItem

gdi32

Polygon
Escape
GetBkColor
GdiFlush
SetDIBitsToDevice
DeleteObject
CreateDiscardableBitmap
GetPixel
CreateDIBSection
CreateFontW
EnumFontFamiliesExW
GetStockObject
CreateSolidBrush
GetTextMetricsW
GetTextColor
StretchBlt
SetPixel
SetBrushOrgEx
UnrealizeObject
GetWindowOrgEx
CreateRectRgn
CombineRgn
GetNearestColor
CreateRectRgnIndirect
CreatePen
SelectClipRgn
CreatePatternBrush
Rectangle
RealizePalette
TextOutW
CreatePalette
RectVisible
PtVisible
SetBkMode
GetObjectW
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
ExtTextOutW
GetTextExtentPoint32W
CreateFontIndirectW
SelectObject
GetDeviceCaps
SetWindowOrgEx
GetCurrentPositionEx
GetTextExtentPointW
MoveToEx
SetTextAlign
GetLayout
RoundRect
GetTextAlign
GetCurrentObject
DeleteDC
SetBkColor
CreateBitmap

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW

shell32

SHGetFileInfoW
SHGetPathFromIDListW
CommandLineToArgvW
SHGetFolderPathA
SHGetFolderPathW
ShellExecuteW
SHBrowseForFolderW
SHGetMalloc
DragQueryFileW

comctl32

_TrackMouseEvent
ord17
ImageList_GetIconSize

ole32

ReleaseStgMedium
RegisterDragDrop
OleDuplicateData
CoCreateInstance

msvcp80

?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Sections

.text
Size: 368KB - Virtual size: 365KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 116KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb7c3f73500194bd12816706a458ff08

Headers

File Characteristics

Imports

shlwapi

version

libapr_tsvn

libaprutil_tsvn

intl3_svn

mfc80u

msvcr80

kernel32

user32

gdi32

comdlg32

advapi32

shell32

comctl32

ole32

msvcp80

Sections

.text Size: 368KB - Virtual size: 365KB

.rdata Size: 116KB - Virtual size: 114KB

.data Size: 48KB - Virtual size: 47KB

.rsrc Size: 148KB - Virtual size: 145KB

.text
Size: 368KB - Virtual size: 365KB

.rdata
Size: 116KB - Virtual size: 114KB

.data
Size: 48KB - Virtual size: 47KB

.rsrc
Size: 148KB - Virtual size: 145KB