4b991ed042937900c27748b74830e1e385e02b4ed171b70ed29f37ac03e07ccd

Sharing

Copy URL Twitter E-mail

General

Target

4b991ed042937900c27748b74830e1e385e02b4ed171b70ed29f37ac03e07ccd
Size

437KB
MD5

81d85e3b935caf6a855bf8993920d4ad
SHA1

aa60274645f03ec01c9ffca09ef6a74d8cdd15f7
SHA256

4b991ed042937900c27748b74830e1e385e02b4ed171b70ed29f37ac03e07ccd
SHA512

689e8de89c5a49b5137cef92dc8a802efabab6fb1da14048055bc264683b060aa308385f9b9a15a3d5e87cd3a155e5526045e4b18e96d059fb6e1e68f7dcb8ef
SSDEEP

12288:KqxYPIIzcicdF6H4WToX1bswb9VOExxLEB:bYtPYWmL+ExW

Score

N/A

Malware Config

Signatures

Files

4b991ed042937900c27748b74830e1e385e02b4ed171b70ed29f37ac03e07ccd
.exe windows x86

fe0184cd2a8474b360fa8a6eda4dfb1f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ngscm

??0CNbuuWindowBackgroundSkin@@QAE@XZ
??0CNbuuComboBoxCtrl@@QAE@XZ
??1CNbuuComboBoxCtrl@@UAE@XZ
??1CNbuuWindowBackgroundSkin@@UAE@XZ
?Init@CNbuuLib@@SAXPAUHINSTANCE__@@0@Z
?PcsLoadFont@@YAXPAUtagLOGFONTW@@@Z
?SetTooltip@?$CNbuuButtonImpl@VCNbuuCommonButtonSkin@@@@QAEXPAG@Z
?PcsLoadColor@@YAKPAUHINSTANCE__@@I@Z
?SetTextColor@CNbuuStaticCtrl@@QAEXK@Z
??0CNbuuStaticCtrl@@QAE@XZ
??1CNbuuStaticCtrl@@UAE@XZ
?LoadBitmapW@CNbuuResourceManager@@SA_NPAPAVCNbuuBitmap@@PAUHINSTANCE__@@IHPBG@Z
?UnloadBitmap@CNbuuResourceManager@@SA_NPAPAVCNbuuBitmap@@@Z
??0CNbuuCommonButtonCtrl@@QAE@XZ
??1CNbuuCommonButtonCtrl@@UAE@XZ
??0CNbuuGraphics@@QAE@PAUHDC__@@@Z
??1CNbuuGraphics@@UAE@XZ
?DrawImage@CNbuuGraphics@@QAEXPAVCNbuuBitmap@@HH@Z
?FlipDialog@CRTLHelper@@SAPAUDLGTEMPLATE@@PAUHINSTANCE__@@PBGH@Z
??0CRTLHelper@@QAE@PBG@Z
??1CRTLHelper@@UAE@XZ
??0CNbuuWindowBackgroundCtrl@@QAE@XZ
??1CNbuuWindowBackgroundCtrl@@UAE@XZ
?PcsInitializeWER@@YAHXZ
?Show@CNbuuCommonMessageBox@@SAHPAUHWND__@@PBG1I@Z
?IsRTL@CRTLHelper@@SAHPBG@Z
?GetLangID@CRTLHelper@@SAPAGPAUHKEY__@@PBG1@Z
?m_dwLayout@CNbuuLib@@0KA
??0CPCSL2InfoReader@@QAE@XZ
??1CPCSL2InfoReader@@QAE@XZ
?ReadPCSL@CPCSL2InfoReader@@QAEHPAG@Z
?GetUIManufacturer@CPCSL2InfoReader@@QAEPBGXZ

shlwapi

PathAddExtensionW
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW
PathRemoveExtensionW
PathAddBackslashW

comctl32

InitCommonControlsEx
ord17

gdiplus

GdiplusStartup
GdiplusShutdown

kernel32

HeapAlloc
IsProcessorFeaturePresent
VirtualFree
GetVersionExA
HeapDestroy
HeapReAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
VirtualAlloc
HeapFree
GetStartupInfoA
CreateProcessW
InterlockedDecrement
GlobalLock
WaitForSingleObject
GlobalAlloc
Sleep
LeaveCriticalSection
ExitThread
RaiseException
EnterCriticalSection
GlobalFree
DeleteCriticalSection
CloseHandle
CreateThread
CreateMutexW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
OpenMutexW
CreateFileMappingW
OpenFileMappingW
ReleaseMutex
FindResourceExW
FindResourceW
LoadResource
GetCurrentProcess
SizeofResource
FlushInstructionCache
LockResource
ExitProcess
GetCommandLineW
InterlockedIncrement
SetEvent
InitializeCriticalSection
CreateEventW
lstrcmpiW
GetCurrentThreadId
FindFirstFileW
FindClose
LoadLibraryExW
GetModuleFileNameW
QueryDosDeviceW
LoadLibraryA
GetProcAddress
WaitForMultipleObjects
ResetEvent
CreateEventA
OpenEventA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
HeapSize
GetProcessHeap

user32

PostThreadMessageW
DispatchMessageW
SetCursor
GetSystemMenu
GetWindowRect
FillRect
LoadImageW
DrawTextW
GetParent
GetClientRect
SetFocus
PtInRect
SystemParametersInfoW
EnableMenuItem
GetDlgItem
SetWindowLongW
RedrawWindow
SetWindowPos
ShowScrollBar
MapWindowPoints
SetWindowTextW
GetProcessDefaultLayout
PeekMessageW
DefWindowProcW
GetWindow
PostQuitMessage
IsIconic
GetLastActivePopup
SetForegroundWindow
GetForegroundWindow
GetDesktopWindow
GetCursorPos
LoadStringW
GetActiveWindow
SetProcessDefaultLayout
MessageBoxW
EnableWindow
DialogBoxIndirectParamW
LoadCursorW
WaitForInputIdle
EnumWindows
BringWindowToTop
GetWindowLongW
GetWindowTextW
EndDialog
ShowWindow
IsWindow
FlashWindow
SendMessageW
GetWindowThreadProcessId
TranslateMessage
GetMessageW
DestroyWindow
GetFocus
LoadIconW
UnregisterClassA
CallWindowProcW
CharNextW

gdi32

SelectObject
DeleteObject
ExcludeClipRect
SetTextColor
CreateFontIndirectW
CreateSolidBrush

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
CoResumeClassObjects
CoInitialize
CoUninitialize

oleaut32

SysFreeString
SysStringLen
SysAllocString

atl80

ord44
ord43
ord49
ord18
ord22
ord42
ord64
ord20
ord61
ord23
ord17
ord32

msvcp80

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z

msvcr80

__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__p__fmode
_unlock
?terminate@@YAXXZ
_CxxThrowException
wcsncmp
wcsncpy
_wtoi
_beginthreadex
_endthreadex
strlen
memcpy_s
memmove_s
wcscmp
_purecall
??_V@YAXPAX@Z
_invalid_parameter_noinfo
wcslen
_swprintf
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
__CxxFrameHandler3
wcscat
free
_recalloc
__dllonexit
memset
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??2@YAPAXI@Z
wcscpy
??3@YAXPAX@Z

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

=@`
Size: 90KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fe0184cd2a8474b360fa8a6eda4dfb1f

Headers

File Characteristics

Imports

ngscm

shlwapi

comctl32

gdiplus

kernel32

user32

gdi32

advapi32

ole32

oleaut32

atl80

msvcp80

msvcr80

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 19KB - Virtual size: 18KB

=@` Size: 90KB - Virtual size: 92KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 19KB - Virtual size: 18KB

=@`
Size: 90KB - Virtual size: 92KB