20fa3824f12e90d9995dea40b15f00d3dc7f2462cb8d0dba966f07cc65e6637b

Sharing

Copy URL Twitter E-mail

General

Target

20fa3824f12e90d9995dea40b15f00d3dc7f2462cb8d0dba966f07cc65e6637b
Size

400KB
MD5

8481c7ef6dae4a35fa56a29d448c8c30
SHA1

58197b3a11acab981679354a54bc3387bd69dd9a
SHA256

20fa3824f12e90d9995dea40b15f00d3dc7f2462cb8d0dba966f07cc65e6637b
SHA512

d9dcc42f26dae65eae68f7e710e7a6ca8a1ac6a4a73dd33a314f4894217b97fa66c4d9ecb148d72f786f82883d01f87e3f99a44527b5476b8382d9ade81bad45
SSDEEP

6144:KUHwcmg6QIDRvBu/a62psgSi8kKlXzR7VO3mErONn1RLIPYg:N1VRIDRJuC6dgrWxNn1R8

Score

N/A

Malware Config

Signatures

Files

20fa3824f12e90d9995dea40b15f00d3dc7f2462cb8d0dba966f07cc65e6637b
.exe windows x86

e3faa5f8fa6048c87f3448eeadb1258a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord940
ord2859
ord2860
ord2096
ord4133
ord4297
ord5862
ord5788
ord472
ord1146
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord3619
ord2614
ord641
ord2514
ord5943
ord2621
ord1134
ord2725
ord941
ord939
ord1175
ord922
ord923
ord1200
ord2642
ord3092
ord6334
ord5265
ord4376
ord4998
ord6052
ord1775
ord4425
ord3597
ord324
ord2301
ord2302
ord4234
ord5953
ord6199
ord4710
ord1105
ord4224
ord5280
ord562
ord816
ord6197
ord2452
ord3797
ord2754
ord6119
ord283
ord5781
ord2380
ord2405
ord2864
ord6605
ord6880
ord3089
ord6215
ord2379
ord6453
ord2152
ord6144
ord559
ord384
ord1168
ord1232
ord1270
ord818
ord812
ord686
ord3706
ord3742
ord6383
ord5440
ord6394
ord5450
ord5834
ord2044
ord537
ord354
ord3790
ord665
ord860
ord6927
ord6929
ord2764
ord4129
ord5710
ord535
ord2448
ord858
ord5785
ord323
ord1640
ord815
ord561
ord6194
ord3136
ord3571
ord3596
ord5864
ord6061
ord5571
ord5579
ord5736
ord5678
ord5794
ord5789
ord5873
ord6021
ord6189
ord4330
ord6186
ord5756
ord6192
ord5759
ord2971
ord470
ord540
ord2818
ord6172
ord5875
ord825
ord800
ord1641
ord2414
ord755
ord3626
ord3573
ord3663
ord4275
ord765
ord567
ord3698
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord4078
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord1576
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord640
ord6055
ord823

msvcrt

strrchr
strtoul
_mbsicmp
rand
sprintf
memset
_EH_prolog
memcpy
strlen
strncpy
free
malloc
fclose
fwrite
fopen
strcpy
toupper
strncmp
realloc
floor
ceil
calloc
sin
cos
acos
_purecall
strstr
_ftol
__p__commode
_CxxThrowException
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_controlfp
??1type_info@@UAE@XZ
_except_handler3
__set_app_type
__p__fmode
__CxxFrameHandler
_mbscmp
_setmbcp
_stricmp

kernel32

lstrcmpiA
CloseHandle
GetModuleFileNameA
MulDiv
GetVersionExA
FindClose
FindFirstFileA
HeapFree
FindNextFileA
SetFileAttributesA
SetCurrentDirectoryA
HeapAlloc
GetProcessHeap
GetCurrentDirectoryA
DeleteFileA
GetSystemDirectoryA
GetWindowsDirectoryA
GetCurrentThreadId
lstrcpynA
lstrcmpA
LeaveCriticalSection
GetProcAddress
GetModuleHandleA
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
lstrcpyA
GetLastError
GetVersion
lstrcatA
lstrlenA
GetTempFileNameA
GetTempPathA
CreateEventA
SetEvent
WaitForSingleObject
CreateThread
GetSystemTime
LoadLibraryA
FreeLibrary
GetStartupInfoA
VirtualProtect
FlushInstructionCache
GetCurrentProcess
SetLastError

user32

GetCapture
GetWindowPlacement
DrawMenuBar
IsMenu
EqualRect
SetFocus
GetMenuItemCount
GetMenuItemID
GetSubMenu
ValidateRect
IntersectRect
GetWindowWord
SetWindowWord
GetFocus
IsWindowEnabled
DrawFrameControl
GetWindowTextA
CharUpperBuffA
ShowScrollBar
SetScrollRange
SetScrollPos
GetScrollPos
GetScrollInfo
EnableScrollBar
GetMenu
SetMenu
wsprintfA
GetClassLongA
DrawIconEx
GetSystemMenu
CreatePopupMenu
AppendMenuA
GetMessagePos
SetCursor
GetDesktopWindow
LockWindowUpdate
IsWindowVisible
SetCapture
ReleaseCapture
DestroyWindow
DrawEdge
BeginPaint
EndPaint
InvalidateRect
SetForegroundWindow
UpdateWindow
UnregisterClassA
RegisterClassExA
CreateWindowExA
GetKeyState
GetWindowInfo
GetWindow
IsZoomed
MoveWindow
WindowFromDC
FrameRect
GetWindowDC
SetWindowPos
RemovePropA
SetPropA
SetWindowLongA
RedrawWindow
CallWindowProcA
DispatchMessageA
GetMessageA
UnhookWindowsHookEx
SetWindowsHookExA
GetMenuItemInfoA
DestroyMenu
MapWindowPoints
GetParent
GetWindowLongA
GetClassNameA
GetPropA
GetMenuState
CallNextHookEx
IsIconic
GetSystemMetrics
DrawIcon
LoadIconA
PtInRect
IsRectEmpty
SetRectEmpty
ClientToScreen
ChildWindowFromPointEx
GetDC
ReleaseDC
LoadImageA
CopyRect
DestroyIcon
SystemParametersInfoA
OffsetRect
GetIconInfo
GetWindowRect
SetWindowRgn
KillTimer
WindowFromPoint
GetCursorPos
SetTimer
GetActiveWindow
ScreenToClient
InflateRect
DrawStateA
IsWindow
GetClassInfoA
DefWindowProcA
LoadCursorA
EnableWindow
GrayStringA
DrawTextA
SetRect
SendMessageA
GetClientRect
FillRect
GetSysColor
GetSysColorBrush
FindWindowA
SubtractRect
ShowWindow
PostMessageA
GetScrollRange
SetScrollInfo
TabbedTextOutA

gdi32

RealizePalette
SetWindowOrgEx
PlayEnhMetaFile
CreatePatternBrush
SetBrushOrgEx
PatBlt
UnrealizeObject
GetRgnBox
SelectClipRgn
IntersectClipRect
CreatePen
MoveToEx
LineTo
ExtFloodFill
GetPixel
ExcludeClipRect
PtInRegion
StretchDIBits
GetClipBox
ExtSelectClipRgn
SetStretchBltMode
SetDIBitsToDevice
CreateDIBitmap
SaveDC
RestoreDC
Polygon
SelectPalette
DeleteObject
CreateBitmap
SetBkColor
CreateICA
GetDIBits
GetRegionData
ExtCreateRegion
GetTextExtentPointA
SetTextColor
SetBkMode
GetStockObject
CreateRectRgnIndirect
GetTextColor
GetObjectA
StretchBlt
CreateFontIndirectA
GetTextMetricsA
GetTextExtentPoint32A
GetDeviceCaps
CreateRoundRectRgn
CreatePolygonRgn
CombineRgn
OffsetRgn
FillRgn
FrameRgn
CreateRectRgn
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateCompatibleBitmap
CreateSolidBrush
CreateDIBSection
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC

shell32

ExtractIconExA
SHFileOperationA

comctl32

ImageList_GetIconSize
_TrackMouseEvent
ImageList_Draw
InitCommonControlsEx
ImageList_AddMasked
ImageList_DrawEx
ImageList_GetImageCount
ImageList_GetIcon

msvcirt

_mtlock
?get@istream@@IAEAAV1@PADHH@Z
_mtunlock
??0ifstream@@QAE@XZ
?openprot@filebuf@@2HB
?open@ifstream@@QAEXPBDHH@Z
??1ifstream@@UAE@XZ
??1ios@@UAE@XZ
?close@ifstream@@QAEXXZ
??_Difstream@@QAEXXZ

msvcp60

?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??0_Lockit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1_Lockit@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z

Sections

.text
Size: 232KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e3faa5f8fa6048c87f3448eeadb1258a

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

shell32

comctl32

msvcirt

msvcp60

Sections

.text Size: 232KB - Virtual size: 230KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 12KB - Virtual size: 73KB

.rsrc Size: 92KB - Virtual size: 89KB

.tc Size: 28KB - Virtual size: 28KB

.text
Size: 232KB - Virtual size: 230KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 12KB - Virtual size: 73KB

.rsrc
Size: 92KB - Virtual size: 89KB

.tc
Size: 28KB - Virtual size: 28KB