3f56a1ebad102b32634f036e4c4f2bf14cd42fe7e1973c9f5c949fb5b8d89af3

Sharing

Copy URL Twitter E-mail

General

Target

3f56a1ebad102b32634f036e4c4f2bf14cd42fe7e1973c9f5c949fb5b8d89af3
Size

282KB
MD5

0cceffb9a10c524772183de904dd98a0
SHA1

4d9118259f7d5f9e5f301aeeb2d77f60844d0efe
SHA256

3f56a1ebad102b32634f036e4c4f2bf14cd42fe7e1973c9f5c949fb5b8d89af3
SHA512

257dcded34b8433929c636d7c2fa30b568ffbf9423ff5f61033cbd1a5837a321be5ab462858b149b0e556e2000d55ae17578caae7b20a18a4a958e2d6f64dfde
SSDEEP

6144:4ipkJdNnoGffvvFTBLbOuWcGccpccUccL7cc2ccOcc9cc4VcbcoHcIycI3IuHqbz:4THNnfffvvFT9kcGccpccUccL7cc2cc6

Score

N/A

Malware Config

Signatures

Files

3f56a1ebad102b32634f036e4c4f2bf14cd42fe7e1973c9f5c949fb5b8d89af3
.exe windows x86

cddb727dc4fefe7df8390ff1a5ebf2fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

basedll

?ZipCompress@ZipUnZip@Base@@YAHPAXPB_W_N@Z
?Compress@ZipUnZip@Base@@YAHPBXHPAXHAAK@Z
?CloseZip@ZipUnZip@Base@@YAXPAX_N@Z
?CreateZip@ZipUnZip@Base@@YAPAXPB_W_N@Z
?OutputDebugInfoEx@Log@Base@@YAXHPBD0IHPB_WZZ
?SafeLoadLibrary@Library@Base@@YAPAUHINSTANCE__@@PB_WH@Z
?GetFileMD5@MD5@Base@@YGHPB_WPAE@Z
?Md5ToStringA@MD5@Base@@YGXPBEPAD@Z
?OutputDebugInfoEx@Log@Base@@YAXHPBD0IH0ZZ
?QueryKeyValue@Register@Base@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0PA_WPAK@Z

utilsdll

?UnInit@CConfig@Config@Utils@@UAGJPAX@Z
?Init@CConfig@Config@Utils@@UAGJPAX@Z
?Read@CConfig@Config@Utils@@UAEHPB_WPAXKPAK@Z
?Release@CConfig@Config@Utils@@UAGKXZ
?Write@CConfig@Config@Utils@@UAEHPB_WPAXK@Z
?AddRef@CConfig@Config@Utils@@UAGKXZ
?Init@CConfig@Config@Utils@@UAEHHPB_W@Z
??1CConfig@Config@Utils@@MAE@XZ
??0CConfig@Config@Utils@@QAE@XZ
?dec_ref@?$EnableIntrusive@VCConfig@Config@Utils@@@@QAEJXZ
?add_ref@?$EnableIntrusive@VCConfig@Config@Utils@@@@QAEJXZ
?GetInstallVer@Misc@Utils@@YAHPADK@Z
?GetSoftID@Misc@Utils@@YAIXZ
?GetSupplyID@Misc@Utils@@YAHAAH@Z

dbghelp

SymGetLineFromAddr64
SymCleanup
SymGetModuleInfo
SymLoadModule
SymGetSymFromAddr
SymInitialize
SymSetOptions

psapi

GetModuleFileNameExW
GetModuleFileNameExA

wininet

InternetCloseHandle

comctl32

InitCommonControlsEx
ImageList_Create
ImageList_ReplaceIcon

kernel32

InterlockedExchange
GetVersionExA
RaiseException
HeapSize
HeapReAlloc
HeapDestroy
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
GlobalAlloc
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
ReadProcessMemory
VirtualQueryEx
GetThreadSelectorEntry
FindClose
ExpandEnvironmentStringsW
FindFirstFileW
FindNextFileW
SetFilePointer
GetCurrentThreadId
ReadFile
CreateDirectoryW
CreateFileW
CloseHandle
GetTempPathW
GetTickCount
DeleteFileW
GetCurrentProcessId
lstrcpynW
GetModuleFileNameW
GetProcessId
SizeofResource
FindResourceExW
FindResourceW
GetModuleHandleW
GetVersionExW
WideCharToMultiByte
LocalFree
GetStartupInfoW
LoadResource
LocalAlloc
WriteProcessMemory
MultiByteToWideChar
OpenThread
GetProcAddress
CreateFileA
HeapAlloc
WriteFile
VirtualProtect
GetFileSize
HeapFree
SetDllDirectoryW
GetProcessHeap
SetEvent
CreateEventW
OpenProcess
CreateProcessW
WaitForSingleObject
SetCurrentDirectoryW
InterlockedDecrement
InterlockedIncrement
GlobalLock
GlobalFree
GlobalUnlock
LockResource

user32

GetKeyState
FillRect
CallWindowProcW
BeginPaint
SetClipboardData
EndPaint
LoadIconW
ClientToScreen
GetDlgItem
SendMessageW
SetDlgItemTextW
GetWindow
GetWindowRect
ScreenToClient
OpenClipboard
LoadImageW
RegisterClipboardFormatW
EmptyClipboard
SetWindowTextW
ShowWindow
CloseClipboard
DrawIconEx
SendDlgItemMessageW
EndDialog
DialogBoxParamW
EnumChildWindows
GetClassNameW
GetGuiResources
GetWindowThreadProcessId
GetParent
EnumWindows
SetWindowLongW
SetWindowPos
UnregisterClassA

gdi32

SetBkColor
CreateSolidBrush
DeleteObject

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

ShellExecuteW
SHGetDesktopFolder
ord155
SHBindToParent
SHGetFileInfoW

ole32

DoDragDrop
OleInitialize
OleUninitialize

oleaut32

SysStringByteLen
SysStringLen
SysAllocStringByteLen
SysAllocString
SysFreeString

msvcp80

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ

msvcr80

vsprintf_s
_amsg_exit
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
memset
_CxxThrowException
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__iob_func
memcpy
__CxxFrameHandler3
fprintf
fflush
toupper
fgets
strstr
strcpy_s
__RTDynamicCast
srand
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
malloc
wcsncmp
swscanf
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
??3@YAXPAX@Z
wcschr
_invalid_parameter_noinfo
memmove_s
?what@exception@std@@UBEPBDXZ
??2@YAPAXI@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
memcpy_s
??_V@YAXPAX@Z
_wassert
_purecall
wcsrchr
vswprintf_s
_gmtime32
_snwprintf
_vscwprintf
fclose
strrchr
_mbscmp
_wfopen
_wtol
_vscprintf
fread
_snprintf
wcsncpy
_mbslwr_s
__argc
sprintf_s
_beginthreadex
free
__wargv
_wcsnicmp
__wgetmainargs

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cddb727dc4fefe7df8390ff1a5ebf2fc

Headers

DLL Characteristics

File Characteristics

Imports

basedll

utilsdll

dbghelp

psapi

wininet

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp80

msvcr80

version

Sections

.text Size: 112KB - Virtual size: 111KB

.rdata Size: 60KB - Virtual size: 57KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 20KB - Virtual size: 17KB

.reloc Size: 76KB - Virtual size: 76KB

.text
Size: 112KB - Virtual size: 111KB

.rdata
Size: 60KB - Virtual size: 57KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 20KB - Virtual size: 17KB

.reloc
Size: 76KB - Virtual size: 76KB