b69e83bdc4dbc5463ca82318a383c0dee02b0dee40c7e917f15330308b466e47

Sharing

Copy URL Twitter E-mail

General

Target

b69e83bdc4dbc5463ca82318a383c0dee02b0dee40c7e917f15330308b466e47
Size

736KB
MD5

06baa17a693f59a733cc8e1f99c1f16a
SHA1

6d7dc343afbf0bf0a3df7caa4268e08a723d7069
SHA256

b69e83bdc4dbc5463ca82318a383c0dee02b0dee40c7e917f15330308b466e47
SHA512

9a8ce9de9a0f745aa5d9493bebdb24aa771cf2e7e5220330459561b49a70c1d4d7af0f016688effb0d4d88f58e95ef1c6a2af824eefed67d5609bc4cb16daa2a
SSDEEP

12288:tBAYiJF9ydtDkofiKQjMpy/Ja843Z2rcbtYLPsfEHlWs9ap:EYuF9KN/wjMw/JzBIx+kclEp

Score

N/A

Malware Config

Signatures

Files

b69e83bdc4dbc5463ca82318a383c0dee02b0dee40c7e917f15330308b466e47
.exe windows x86

e7ba2548dc949ba41dc98b0656729be1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ctintrfu

?CTDeleteIniFileKeyName@@YG?AW4tagCTINTRFCRESULT@@PBG00@Z
?CTDeleteIniFileSectionName@@YG?AW4tagCTINTRFCRESULT@@PBG0@Z
?CTGetIniFileKeyNames@@YG?AW4tagCTINTRFCRESULT@@PBG0PAGKPAK@Z
?CTGetIniFileStringValueData@@YG?AW4tagCTINTRFCRESULT@@PBG00PAGKPAK@Z
?CTSetIniFileStringValueData@@YG?AW4tagCTINTRFCRESULT@@PBG000@Z
?CTCopyRegistryKey@@YG?AW4tagCTINTRFCRESULT@@PAUHKEY__@@0PBG1@Z
?CTDeleteRegistryKey@@YG?AW4tagCTINTRFCRESULT@@PAUHKEY__@@PBG@Z
?CTAddRegistryKey@@YG?AW4tagCTINTRFCRESULT@@PAUHKEY__@@PBG@Z
?CTGetRegistryStringValueData@@YG?AW4tagCTINTRFCRESULT@@PAUHKEY__@@PBG1PAGKPAK@Z
?CTSetRegistryStringValueData@@YG?AW4tagCTINTRFCRESULT@@PAUHKEY__@@PBG11@Z
?CTEnumComponents@@YG?AW4tagCTINTRFCRESULT@@PBGPAU_GUID@@PAK@Z
?CTRetrieveComponentPropertyValue@@YG?AW4tagCTINTRFCRESULT@@ABU_GUID@@PBGPAW4tagCTVALUETYPE@@QAEKPAK@Z
?CTCreateInstance@@YG?AW4tagCTINTRFCRESULT@@ABU_GUID@@PAUIUnknown@@K0PAPAX@Z
?CTFreeUnusedLibraries@@YGXXZ

cthtmlu

?SetDialogCaption@IHtmlFrame@@QAEHPBG@Z
?ShowTopic@IHtmlFrame@@QAEHH@Z
??1IHtmlFrame@@UAE@XZ
??0IHtmlFrame@@QAE@XZ
?Initialize@IHtmlFrame@@QAEHPBGHHHH@Z
?GetTopicCount@IHtmlFrame@@QAEKXZ
?GetTopic@IHtmlFrame@@QAEHPAGH@Z

ctaudep

?CTSetAudioEndpoint@@YG?AW4tagCTAUDENDPOINTRESULT@@PAGW4tagCTAUDENDPOINTDATAFLOW@@PBG@Z
?CTRegisterNotificationCallback@@YG?AW4tagCTAUDENDPOINTRESULT@@P6G?AW41@W4tagCTREGISTERNOTIFYPROCMSG@@JJ@ZJPAPAX@Z
?CTGetLastSelectedMidiOutDevice@@YG?AW4tagCTAUDENDPOINTRESULT@@PBGPAUtagCTMIDIOUTDEV@@@Z
?CTCheckForAudioEndpointSupport@@YG?AW4tagCTAUDENDPOINTRESULT@@PAH@Z
?CTReleaseAudioDevice@@YG?AW4tagCTAUDENDPOINTRESULT@@PAUtagCTAUDENDPOINT@@@Z
?CTUnregisterNotificationCallback@@YG?AW4tagCTAUDENDPOINTRESULT@@PAX@Z
?CTGetDefaultMidiOutDevice@@YG?AW4tagCTAUDENDPOINTRESULT@@PAUtagCTMIDIOUTDEV@@@Z
?CTGetDefaultAudioEndpoint@@YG?AW4tagCTAUDENDPOINTRESULT@@W4tagCTAUDENDPOINTDATAFLOW@@W4tagCTAUDENDPOINTROLE@@PAUtagCTAUDENDPOINT@@@Z
?CTGetLastSelectedAudioEndpoint@@YG?AW4tagCTAUDENDPOINTRESULT@@W4tagCTAUDENDPOINTDATAFLOW@@PBGPAUtagCTAUDENDPOINT@@@Z
?CTLaunchAudioEndpointSelectionDlg@@YG?AW4tagCTAUDENDPOINTRESULT@@W4tagCTAUDENDPOINTDATAFLOW@@KPAUtagCTAUDADAPTER@@PBG2K@Z
?CTLaunchMidiOutDeviceSelectionDlg@@YG?AW4tagCTAUDENDPOINTRESULT@@PBG0@Z

ctappasc

?CTQueryAppIsDefaultForFileExt@@YAJPBG0PAH@Z
?CTLaunchAdvancedAssociationUI@@YAJPBG@Z
?CTSetAppAsDefaultForFileExt@@YAJPBG0@Z

winmm

waveOutGetNumDevs
waveInGetNumDevs
midiOutMessage
midiOutGetDevCapsW
waveInGetDevCapsW
waveInMessage
waveOutMessage
mixerGetID
waveOutGetDevCapsW

gdiplus

GdiplusShutdown
GdiplusStartup

mfc42u

ord5886
ord6921
ord2810
ord6140
ord5858
ord6139
ord5857
ord4638
ord1764
ord6362
ord2405
ord2016
ord4212
ord2568
ord6051
ord1768
ord4391
ord5286
ord3347
ord4418
ord3572
ord4214
ord2573
ord4395
ord3397
ord3634
ord567
ord692
ord3737
ord772
ord818
ord500
ord4270
ord4118
ord1761
ord1105
ord6376
ord6193
ord6374
ord4124
ord538
ord1229
ord2078
ord5602
ord6451
ord5856
ord6138
ord2859
ord3420
ord3049
ord3222
ord3403
ord3753
ord3875
ord3805
ord942
ord3629
ord686
ord384
ord2400
ord3282
ord3285
ord2088
ord6004
ord2115
ord3909
ord5977
ord3393
ord3728
ord810
ord2857
ord6238
ord6266
ord6597
ord3291
ord3292
ord4120
ord4215
ord2576
ord3649
ord3658
ord2430
ord1637
ord4983
ord4920
ord4925
ord4930
ord3267
ord3348
ord4616
ord3574
ord6195
ord729
ord786
ord2496
ord1699
ord2453
ord603
ord1961
ord2793
ord882
ord273
ord268
ord519
ord2605
ord1560
ord4524
ord4538
ord5681
ord3269
ord439
ord736
ord703
ord2446
ord1636
ord403
ord3211
ord4037
ord4519
ord879
ord2732
ord4266
ord5491
ord4050
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord3733
ord815
ord561
ord6437
ord1230
ord6279
ord6278
ord2613
ord1202
ord1172
ord2717
ord616
ord790
ord2822
ord2809
ord940
ord2403
ord2015
ord4213
ord2570
ord4392
ord3577
ord3711
ord3870
ord771
ord2520
ord1008
ord2033
ord498
ord2447
ord2756
ord3133
ord925
ord4279
ord5947
ord1775
ord3090
ord2933
ord5679
ord1899
ord5155
ord5156
ord5154
ord4899
ord4970
ord4942
ord4352
ord4371
ord5283
ord4829
ord768
ord489
ord4253
ord4736
ord4848
ord6024
ord3092
ord3981
ord3093
ord1900
ord1683
ord5284
ord4433
ord2046
ord4425
ord496
ord497
ord4254
ord4709
ord3871
ord1771
ord4272
ord2755
ord2840
ord2144
ord755
ord470
ord826
ord269
ord2932
ord2294
ord541
ord559
ord801
ord812
ord823
ord2371
ord4470
ord3084
ord5871
ord1165
ord2634
ord5949
ord4688
ord6871
ord2746
ord4704
ord6107
ord4229
ord4294
ord3087
ord6211
ord641
ord825
ord324
ord3592
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5276
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4847
ord4370
ord5261
ord4155
ord6466
ord860
ord2910
ord5568
ord535
ord858
ord861
ord2606
ord540
ord800
ord600
ord1571
ord1240
ord1173
ord430
ord1569

msvcrt

_initterm
__setusermatherr
__CxxFrameHandler
_wcsicmp
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_controlfp
__wgetmainargs
memset
_waccess
iswspace
memmove
_wcsupr
wcscpy
wcslen
wcsstr
wcsncpy
memcpy
memcmp
wcscmp
wcscat
swprintf
_wtoi
_wsplitpath
_ftol
_wcslwr
wcstok
strcmp
fclose
free
fseek
malloc
fread
_wfopen
floor
ceil
fabs
cos
sin
_wcsnicmp
wcschr
toupper
isalpha
isalnum
calloc
wcsrchr
_exit
_XcptFilter
exit
_wcmdln

kernel32

GetLongPathNameW
GetDiskFreeSpaceExW
InterlockedIncrement
InterlockedDecrement
GetFileAttributesW
FindResourceW
GetCurrentDirectoryW
LocalAlloc
GetModuleHandleW
GetStartupInfoW
GetFileSize
ReadFile
CreateEventW
lstrlenA
MultiByteToWideChar
lstrcmpiW
lstrcmpW
lstrcpynW
lstrlenW
lstrcpyW
GetLastError
CreateDirectoryW
lstrcatW
GetVersionExW
CreateFileW
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
LoadLibraryExW
CreateProcessW
DeleteFileW
GetACP
GetSystemDirectoryW
WaitForSingleObject
ResetEvent
SetCurrentDirectoryW
WideCharToMultiByte
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
ReleaseSemaphore
Sleep
CreateSemaphoreW
SetErrorMode
LocalFree
FormatMessageW
MoveFileW
WriteFile
GetTempFileNameW
CloseHandle
GetTempPathW

user32

InvalidateRect
GetActiveWindow
LoadBitmapW
IsWindow
GetAsyncKeyState
GetClassNameW
CheckMenuItem
CheckMenuRadioItem
EnableMenuItem
GetSystemMenu
LockWindowUpdate
ClientToScreen
SetRectEmpty
PtInRect
TranslateAcceleratorW
CopyRect
GetParent
SetCapture
ValidateRect
GetDC
GetSysColor
DrawTextW
ReleaseDC
ReleaseCapture
SetCursor
LoadCursorW
RegisterClipboardFormatW
AppendMenuW
CreatePopupMenu
GetKeyState
GetFocus
ScreenToClient
GetCursorPos
UpdateWindow
UnhookWindowsHookEx
DestroyIcon
IsZoomed
GetDesktopWindow
SetWindowsHookExW
GetSubMenu
GetDlgItem
GetIconInfo
DrawIcon
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
OffsetRect
KillTimer
SetTimer
LoadIconW
LoadImageW
GetClassInfoW
BringWindowToTop
PostMessageW
SystemParametersInfoW
GetClientRect
WindowFromPoint
GetWindowLongW
DestroyWindow
GetSystemMetrics
GetMenuItemID
GetMenuItemCount
IsIconic
MessageBoxW
FindWindowW
SetForegroundWindow
RegisterWindowMessageW
CharNextW
SendMessageW
EnableWindow
GetWindowRect
wsprintfW
LoadStringW
IsWindowVisible
DefWindowProcW
RegisterClassExW
SetWindowLongW
GetMenuState
GetMenuStringW
SetFocus
LoadMenuW
SetWindowPos

gdi32

CreateFontIndirectW
CreateCompatibleBitmap
SetTextAlign
TextOutW
StretchBlt
GetDIBits
CreateDIBSection
CreateFontW
GetTextExtentPoint32W
CreateRectRgn
CombineRgn
SetBkMode
BitBlt
CreatePen
CreateCompatibleDC
MoveToEx
LineTo
DeleteDC
SelectObject
GetTextColor
SetTextColor
GetBkColor
SetBkColor
GetObjectW
DeleteObject
GetStockObject

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW

shell32

DragAcceptFiles
SHChangeNotify
SHFileOperationW
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW

comctl32

ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_SetBkColor
ord17
_TrackMouseEvent

ole32

CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
PropVariantClear
CoFreeUnusedLibraries

oleaut32

VariantInit

msvcp60

?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

shlwapi

PathRemoveExtensionW
PathRemoveFileSpecW
PathAppendW
PathIsDirectoryW
PathAddBackslashW
PathGetDriveNumberW
PathIsUNCServerW
PathFindExtensionW
PathFindFileNameW
PathIsFileSpecW
PathRemoveBackslashW
StrStrIW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tc
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e7ba2548dc949ba41dc98b0656729be1

Headers

File Characteristics

Imports

ctintrfu

cthtmlu

ctaudep

ctappasc

winmm

gdiplus

mfc42u

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp60

shlwapi

version

Sections

.text Size: 336KB - Virtual size: 335KB

.rdata Size: 48KB - Virtual size: 46KB

.data Size: 40KB - Virtual size: 48KB

.rsrc Size: 112KB - Virtual size: 111KB

.tc Size: 196KB - Virtual size: 196KB

.text
Size: 336KB - Virtual size: 335KB

.rdata
Size: 48KB - Virtual size: 46KB

.data
Size: 40KB - Virtual size: 48KB

.rsrc
Size: 112KB - Virtual size: 111KB

.tc
Size: 196KB - Virtual size: 196KB