ceb5144f02533d2fb82c5594b959efa650c81c14edb84187d8bd6647ab75b227

Sharing

Copy URL Twitter E-mail

General

Target

ceb5144f02533d2fb82c5594b959efa650c81c14edb84187d8bd6647ab75b227
Size

976KB
MD5

83a2d582017a9a564240acf35c13bf23
SHA1

63c7f6407afdfd4ab43783614d1c3f0246df2543
SHA256

ceb5144f02533d2fb82c5594b959efa650c81c14edb84187d8bd6647ab75b227
SHA512

b5b7c6b3e8411b9ad8383530976a66a16fa4f29b9f26d143a1a75e6d9b7589c366580603ac11e7401b81333480bf542981bc66fb3b589a2e29f376281205aa50
SSDEEP

12288:Z5CdZASrsluYMC5q9HwVVkYOh8VHlWlPWKAtSc/wjzdKJ6U:Z5MLArMC5qCVq8VFLKAtScoF46U

Score

N/A

Malware Config

Signatures

Files

ceb5144f02533d2fb82c5594b959efa650c81c14edb84187d8bd6647ab75b227
.exe windows x86

393f88edacaa581b87990d4c0129486e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr71

_fileno
_ftime
_itoa
_wcsupr
wcschr
_atoi64
sprintf
atoi
_wcsnicmp
_wsplitpath
fprintf
fgets
fseek
ftell
_setmode
fopen
fread
memmove
__security_error_handler
strncpy
qsort
strcmp
abort
vfprintf
time
srand
rand
_itow
_wctime
?raw_name@type_info@@QBEPBDXZ
strstr
wprintf
_wtol
mbstowcs
wcstombs
wcsncmp
_wtoi
_wfopen
fwrite
memchr
fclose
wcscat
wcsrchr
memset
memcpy
fflush
_iob
free
wcscpy
_controlfp
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
realloc
wcsstr
_i64toa
strcpy
swscanf
_wcsicmp
_putws
_vsnwprintf
_CxxThrowException
??_U@YAPAXI@Z
_errno
??2@YAPAXI@Z
??_V@YAXPAX@Z
wcscmp
_vsnprintf
_purecall
_mktime64
fgetc
getenv
memcmp
??3@YAXPAX@Z
_time64
_wgetenv
__CxxFrameHandler
_localtime64
wcsftime
_except_handler3
wcsncpy
wcslen
malloc

shlwapi

SHDeleteKeyW
PathFileExistsW
SHCopyKeyW
PathFindExtensionW

user32

wsprintfW
CharNextW
GetUserObjectInformationW
GetProcessWindowStation
PostThreadMessageW
MessageBoxW
KillTimer
UnregisterDeviceNotification
DispatchMessageW
GetDesktopWindow
SetTimer
RegisterDeviceNotificationW
LoadStringW
MessageBoxA
MsgWaitForMultipleObjects
EnumWindows
SendMessageW
GetWindowLongW
GetWindowThreadProcessId
FindWindowW
PeekMessageW
GetMessageW
PostQuitMessage

netapi32

NetUserEnum
NetLocalGroupEnum
NetUserGetLocalGroups
NetWkstaUserEnum
NetQueryDisplayInformation
NetWkstaUserGetInfo
NetApiBufferFree

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

imm32

ImmGetDefaultIMEWnd

zlib

ord26

ui

Init_UI
UI_PromptForMasterPassword
LoadCDForRestoreFile
CopyHeadersToTempDir

mfc71u

ord900
ord6167
ord261
ord4100
ord2260
ord6171
ord6173
ord4074
ord5342
ord5485
ord2742
ord894
ord2745
ord5524
ord860
ord2271
ord5558
ord1476
ord899
ord2261
ord4101
ord5705
ord3990
ord777
ord4078
ord2461
ord2311
ord291
ord290
ord2444
ord5091
ord287
ord774
ord896
ord6306
ord1472
ord2926
ord282
ord1479
ord280
ord293
ord776
ord577
ord2697
ord283
ord6282
ord5316
ord6293
ord5327
ord1571
ord2340
ord3249
ord3925
ord4088
ord386
ord2279
ord2898
ord1431
ord631
ord1908
ord1021
ord1178
ord1182
ord556
ord1443
ord744
ord380
ord3195
ord5489

kernel32

FindFirstChangeNotificationW
GetShortPathNameW
WaitForMultipleObjects
SetFileTime
ConnectNamedPipe
CreateNamedPipeW
OpenEventW
WaitNamedPipeW
SetNamedPipeHandleState
MoveFileExW
ExitProcess
FindCloseChangeNotification
TerminateThread
DisconnectNamedPipe
GetOverlappedResult
GetCurrentDirectoryW
SetCurrentDirectoryW
BackupWrite
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetTimeFormatW
GetDateFormatW
GetLogicalDrives
RemoveDirectoryW
GetVolumeInformationW
FindResourceExW
GetVersionExA
LoadLibraryA
GlobalMemoryStatus
QueryPerformanceCounter
GetTickCount
SetEvent
ResetEvent
DuplicateHandle
CreateEventW
GetStdHandle
GetFileType
CreateThread
GetFileSize
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProcessHeap
HeapAlloc
HeapFree
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileSectionW
GetComputerNameW
ExpandEnvironmentStringsW
LocalAlloc
LocalFree
SetPriorityClass
GetEnvironmentVariableW
SetFilePointer
GetStartupInfoW
GetModuleHandleA
GetCommandLineW
GetCurrentThreadId
lstrcpynW
lstrcmpiW
LoadLibraryExW
GetModuleHandleW
GetUserDefaultLangID
CopyFileW
WriteFile
GetCurrentProcessId
lstrcatW
InterlockedIncrement
OpenProcess
TerminateProcess
SetConsoleCtrlHandler
GetCurrentThread
lstrcpyW
GetLocalTime
GetModuleFileNameW
SetThreadExecutionState
GetWindowsDirectoryW
GetTempPathW
OpenMutexW
GetSystemTimeAsFileTime
GetDiskFreeSpaceExW
SetFileAttributesW
MoveFileW
GetSystemPowerStatus
GetLastError
CloseHandle
GetCurrentProcess
SizeofResource
LockResource
LoadResource
FindResourceW
DeviceIoControl
CreateFileW
GetProcAddress
LoadLibraryW
GetFileAttributesW
MultiByteToWideChar
FreeLibrary
ReadFile
SetLastError
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
ReleaseMutex
Sleep
CreateMutexW
GetExitCodeProcess
CreateProcessW
WideCharToMultiByte
lstrlenW
GetPrivateProfileStringW
CreateDirectoryW
GetVersion
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
InterlockedDecrement

advapi32

RegNotifyChangeKeyValue
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
WriteEncryptedFileRaw
ChangeServiceConfigW
CreateWellKnownSid
RegFlushKey
RegisterEventSourceA
ReportEventA
LookupAccountNameW
ConvertSidToStringSidW
LookupAccountSidW
QueryServiceStatus
ImpersonateLoggedOnUser
GetUserNameW
ImpersonateSelf
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
GetFileSecurityW
GetSecurityDescriptorDacl
GetAclInformation
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
GetSecurityDescriptorControl
SetSecurityDescriptorControl
SetFileSecurityW
AllocateAndInitializeSid
SetNamedSecurityInfoW
FreeSid
RegQueryMultipleValuesW
RegRestoreKeyW
RegEnumValueW
RegSaveKeyW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
RegEnumKeyExW
RegQueryInfoKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenThreadToken
SetServiceStatus
GetTokenInformation
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSid
GetLengthSid
CopySid
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
DeleteService
ControlService
StartServiceW
CreateServiceW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CloseEncryptedFileRaw
OpenEncryptedFileRawW

shell32

SHGetFolderPathW
ord680
ShellExecuteExW

ole32

CoInitialize
CoRevokeClassObject
CoCreateInstance
CoRegisterClassObject
StringFromGUID2
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysAllocString
VariantClear
SysFreeString
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
VariantInit

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

Sections

.text
Size: 548KB - Virtual size: 546KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 233KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xzblzjn
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

393f88edacaa581b87990d4c0129486e

Headers

File Characteristics

Imports

msvcr71

shlwapi

user32

netapi32

wtsapi32

imm32

zlib

ui

mfc71u

kernel32

advapi32

shell32

ole32

oleaut32

msvcp71

Sections

.text Size: 548KB - Virtual size: 546KB

.rdata Size: 236KB - Virtual size: 233KB

.data Size: 40KB - Virtual size: 124KB

.rsrc Size: 148KB - Virtual size: 148KB

xzblzjn Size: - Virtual size: 4KB

.text
Size: 548KB - Virtual size: 546KB

.rdata
Size: 236KB - Virtual size: 233KB

.data
Size: 40KB - Virtual size: 124KB

.rsrc
Size: 148KB - Virtual size: 148KB

xzblzjn
Size: - Virtual size: 4KB