3b0ce67cb41ed9edfa59d59136c32e88e2ce0b09e7b77725f8e030bc54cb2438

Sharing

Copy URL Twitter E-mail

General

Target

3b0ce67cb41ed9edfa59d59136c32e88e2ce0b09e7b77725f8e030bc54cb2438
Size

248KB
MD5

209198c0c9cd997f6450692ae5d3a080
SHA1

1371cf57d2e362c4d4a5a3756475999952bd7fae
SHA256

3b0ce67cb41ed9edfa59d59136c32e88e2ce0b09e7b77725f8e030bc54cb2438
SHA512

d9202f3f5b8587f9ded738ce39a861b5466344cfa905f91b4bda5a3bf9d06a0289ad8999f63311a69ecad971647d5480a58d35a6f00aa61d428d2733547e793e
SSDEEP

3072:hao1kTdbLkpm2r45aYqsnfwXk/AhghIFpivGpE+frBaJ3lkbBSSBLqf9j8tEOLLO:VkTdXbgYqCzcgGnq+fBSSofJ8WWLWj

Score

N/A

Malware Config

Signatures

Files

3b0ce67cb41ed9edfa59d59136c32e88e2ce0b09e7b77725f8e030bc54cb2438
.dll windows x86

7f27613c65b70153847ddebf4d8573c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrCmpNIA
PathFindFileNameA
StrRetToBufA
PathAppendA
PathIsRootA
PathFileExistsA
PathRemoveFileSpecA
PathCombineA
PathIsSameRootA

kernel32

GetProcessHeap
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
CloseHandle
MoveFileA
WriteFile
FindResourceA
FindResourceExA
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileIntA
CreateThread
CreateEventA
GetCommandLineW
lstrcpynA
GetProcAddress
FreeLibrary
LoadLibraryA
DeviceIoControl
lstrlenW
GetVersion
lstrcmpiW
lstrlenA
GetCurrentProcess
GetCurrentThread
SetLastError
CompareStringA
CompareStringW
GetModuleHandleA
SystemTimeToFileTime
GetTickCount
GetSystemTime
OutputDebugStringW
OutputDebugStringA
CreateProcessA
LocalFree
GetStartupInfoA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
GetDriveTypeA
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
WaitForSingleObject
MulDiv
GetModuleFileNameA
OpenEventA
HeapAlloc
CreateFileA
HeapReAlloc
WritePrivateProfileStringA
FindClose
DeleteFileA
RemoveDirectoryA
FindNextFileA
FindFirstFileA
MoveFileExA
GlobalFree
GlobalAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetOEMCP
GetCPInfo
SetEnvironmentVariableA
ExitProcess
SetConsoleCtrlHandler
SetEndOfFile
GetTimeZoneInformation
FlushFileBuffers
SetStdHandle
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
SetFilePointer
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
HeapSize
ReadFile
LCMapStringW
LCMapStringA
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualFree
HeapCreate
GetFileTime
HeapDestroy
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
CreateMutexW
HeapFree
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
WideCharToMultiByte
MultiByteToWideChar
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetSystemDirectoryA
GetVersionExA
lstrcmpiA
lstrcpyA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetCommandLineA
GetCurrentThreadId
RtlUnwind
CreateDirectoryA
GetFileAttributesA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
OpenMutexW
GetLocaleInfoW

user32

CreateWindowExA
SendMessageA
CharNextA
UnregisterClassA
CharLowerA
CharLowerW
CharUpperA
CharUpperW
wsprintfA
GetDesktopWindow
MapDialogRect
CharPrevA
GetClientRect
GetPropA
DestroyWindow
CallWindowProcA
DrawFocusRect
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
IsDialogMessageA
GetMessageA
TranslateMessage
FindWindowExA
PostMessageA
SetPropA
GetWindowRect
MapWindowPoints
CreateDialogParamA
SetWindowPos
DispatchMessageA
BringWindowToTop
ShowWindow
GetSystemMenu
EnableMenuItem
FindWindowA
SetWindowLongA
SetWindowTextA
SetTimer
IsWindow
IsWindowEnabled
KillTimer

gdi32

SetTextColor

comdlg32

GetSaveFileNameA
CommDlgExtendedError
GetOpenFileNameA

advapi32

RegDeleteValueA
GetAclInformation
GetAce
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
ConvertStringSidToSidA
SetTokenInformation
CreateProcessAsUserA
EqualSid
SetNamedSecurityInfoA
DuplicateTokenEx
OpenThreadToken
OpenProcessToken
InitializeAcl
AddAce
GetLengthSid
CopySid
IsValidSid
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetNamedSecurityInfoA

shell32

SHBindToParent
SHGetFolderPathA
CommandLineToArgvW
ShellExecuteA
SHGetMalloc
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetSpecialFolderPathA
SHChangeNotify

ole32

CoUninitialize
CoCreateInstance
CoInitialize
CoCreateGuid
CoTaskMemFree

oleaut32

CreateErrorInfo
SysAllocStringLen
SysFreeString
VariantClear
SetErrorInfo
VariantInit
VariantChangeType
SysAllocString
GetErrorInfo

userenv

UnloadUserProfile

psapi

EnumProcessModules
EnumProcesses
GetModuleFileNameExA

wininet

InternetOpenUrlA
InternetCloseHandle
InternetReadFile
InternetOpenA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Exports

Exports

AuthorizeDirectory
AutoClickButton
ClearDir
CompareDisk
CompareFileModifyTime
Create
Create2
CreateControl
CreateControlEx
CreateInstallEvent
CreateItem
CustomOnClick
CustomUninit
DisableCloseButton
DownloadConfig
DownloadPic
FlashDesktop
GetAppDataPath
GetBindGameIndex
GetCommonDataPath
GetFileName
GetLocalAppDataLowPath
GetLocalLowPath
GetModuleOccupyPrceessName
GetOptionValueFromParamters
GetOriginFileName
GetPartnerID
GetPeerID
GetPeerUrl
GetPrgramDataPath
GetProgramDataPath
GetRenameFileName
GetRootPath
GetShortcutArgu
GetShortcutTarget
GetSystemVersion
GetThunderBHOProfileDirPath
GetThunderBHOProfilePath
GetUUID
GetUserData
GetUserDataPath
GetVirtualPath
GetWorkDirectory
HasIntallDriverLimited
IfNeedConfirm
IsDirectoryWritable
IsDownloadServerRunning
IsEmptyDir
IsFileLinkConfigRunning
IsFileLinkRunning
IsMiniXmpRunning
IsOptionExist
IsPngFile
IsProcessExist
IsRemovableDisk
IsSoftwareCenterRunning
IsSystem64Bit
IsThunder5Running
IsThunder6Running
IsThunderDir
IsThunderOrXMPRunning
IsThunderRunning
IsXMPRunning
IsXMPRunning_un
KillProcess
KillProcessEx
LinkAllExt
ModifyInstallPath
OnBack
OnChange
OnClick
OnNotify
OpenUrl
PendingFileOperationRemove
PinToStartmenu
PinToTaskbar
RememberReboot
ReverseLinkAllExt
SelectFileDialog
SelectFolderDialog
SendStaticsRequest
SetRTL
SetUserData
SetWindowTextEx
Show
StartAsUser
StrFind
UnpinFromStartmenu
UnpinFromTaskbar
WaitForProcess
XLCmpStr
XLGetFileVersion
XLStrStr

Sections

.text
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7f27613c65b70153847ddebf4d8573c6

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

userenv

psapi

wininet

version

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 121KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 8KB - Virtual size: 10KB

.rsrc Size: 4KB - Virtual size: 160B

.reloc Size: 12KB - Virtual size: 8KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 124KB - Virtual size: 121KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 8KB - Virtual size: 10KB

.rsrc
Size: 4KB - Virtual size: 160B

.reloc
Size: 12KB - Virtual size: 8KB

.rmnet
Size: 60KB - Virtual size: 60KB