df632a159a7d934c0d9a01675d4a773f1b3b136342db00a982ad023d2fdd763b

Sharing

Copy URL Twitter E-mail

General

Target

df632a159a7d934c0d9a01675d4a773f1b3b136342db00a982ad023d2fdd763b
Size

328KB
MD5

2b84e2dcef9201af2bda5b1a7ddaafe0
SHA1

3141c41ecb07c619c14a2a4ffad108ee90955e5f
SHA256

df632a159a7d934c0d9a01675d4a773f1b3b136342db00a982ad023d2fdd763b
SHA512

d08336a1c080de92ed109f57a825de271fb899c64482942937af096d9aee1f81195d4126fd0a958b1e18516a622af180afe26f33ab0962c81c888d0b9f7a5a13
SSDEEP

6144:w+5nKlvnjkw9UkOTJ0H4plpXa7ioOtRmfRx9LHBDSOr0Izx:w+JKJjItV0H4plpX9SLHBDVD

Score

N/A

Malware Config

Signatures

Files

df632a159a7d934c0d9a01675d4a773f1b3b136342db00a982ad023d2fdd763b
.dll windows x86

ff4619ffa9ffed7069aa6c1d703e7d5a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteCriticalSection
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
SetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCurrentProcessId
GetTickCount
GetTempPathW
DebugBreak
OutputDebugStringW
lstrlenA
CreateFileW
SetFilePointer
CloseHandle
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
lstrcmpiW
LoadLibraryW
MulDiv
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
EnterCriticalSection
GetProcAddress
GetLastError
RaiseException
lstrlenW
MultiByteToWideChar
GetModuleFileNameW
LeaveCriticalSection
SizeofResource
InitializeCriticalSection
GetModuleHandleW
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
InterlockedIncrement
WideCharToMultiByte
InterlockedDecrement

user32

GetWindowTextW
GetWindowTextLengthW
SendMessageW
MoveWindow
SetWindowTextW
CallWindowProcW
DefWindowProcW
CreateWindowExW
GetWindowRect
IsWindow
ShowWindow
GetCursorPos
SetWindowPos
GetClientRect
InvalidateRect
GetUpdateRect
BeginPaint
EndPaint
SetFocus
SetCapture
ReleaseCapture
ScreenToClient
RegisterClassExW
DialogBoxIndirectParamW
GetDlgItem
GetWindow
LoadStringW
wvsprintfW
CreatePopupMenu
AppendMenuW
GetActiveWindow
MapWindowPoints
GetParent
GetMonitorInfoW
MonitorFromWindow
EndDialog
ClientToScreen
GetMessageW
GetFocus
TranslateMessage
DispatchMessageW
GetDesktopWindow
GetDC
ReleaseDC
IntersectRect
DestroyMenu
GetClassInfoExW
PostMessageW
DestroyWindow
GetWindowLongW
SetWindowLongW
CharNextW
UnregisterClassA
TrackPopupMenu
RemoveMenu
EnableMenuItem
CheckMenuItem
GetMenuItemCount
GetMenuItemID
GetMenuStringW
GetSubMenu
LoadCursorW

gdi32

ExtTextOutW
DeleteObject
GetDeviceCaps
SetBkColor
CreateFontIndirectW

advapi32

RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

VarUI4FromStr

msvcp90

??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z

shlwapi

StrRChrW

comctl32

_TrackMouseEvent

gdiplus

GdipLoadImageFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromFile
GdipFillRectangleI
GdipDrawImageRectRectI
GdipDrawString
GdipDeleteBrush
GdipCreateSolidFill
GdipSetStringFormatTrimming
GdipMeasureString
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdiplusShutdown
GdiplusStartup
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipDeleteFont
GdipDrawImagePointRectI
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipFree
GdipAlloc
GdipCreateFromHDC
GdipResetClip
GdipSetClipRectI
GdipGetLogFontW
GdipDeleteGraphics
GdipCreateFromHWND

msvcr90

_CxxThrowException
rewind
ftell
fseek
strrchr
strcpy_s
sscanf_s
calloc
memcpy
__CxxFrameHandler3
atoi
fwrite
wcsrchr
_wtoi
iswdigit
fclose
fread
_wfopen
_purecall
memmove_s
swprintf_s
wcscpy_s
memcpy_s
_recalloc
wcsstr
malloc
free
wcsncpy_s
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
strstr
??_V@YAXPAX@Z
??3@YAXPAX@Z
fprintf
_vsnprintf_s
isspace
tolower
isalpha
isalnum
strchr
strncmp
memset
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal

Exports

Exports

?XUI_CHECK_GET@@YGHPAX@Z
?XUI_CHECK_SET@@YGXPAXH@Z
?XUI_COLOR_GET@@YGKPBD@Z
?XUI_COLOR_SET@@YGXPAXHPBD@Z
?XUI_COMMON_GET@@YGHPAXPADK1K1KPAH@Z
?XUI_DATAFILE_GET@@YGPAXPBD@Z
?XUI_DATAFILE_GET_LENTH@@YGHPBD@Z
?XUI_DATA_GET@@YGHPAX@Z
?XUI_DATA_SET@@YGXPAX0@Z
?XUI_ENABLE_GET@@YGHPAX@Z
?XUI_ENABLE_SET@@YGXPAXH@Z
?XUI_EXPAND_SET@@YGXPAXH@Z
?XUI_FONT_GET@@YGPAUHFONT__@@PBD@Z
?XUI_IMAGE_GET@@YGHPAXE@Z
?XUI_IMAGE_SET@@YGXPAXHE@Z
?XUI_IMAGE_SET@@YGXPAXPBDH@Z
?XUI_ITEM_APPEND@@YGHPAX0@Z
?XUI_ITEM_DATA@@YGHPAXH@Z
?XUI_ITEM_MOVETO@@YGXPAXH@Z
?XUI_ITEM_QUERY@@YGPAXPAXHPBD@Z
?XUI_ITEM_REMOVE@@YGXPAXH@Z
?XUI_ITEM_RESET@@YGXPAX@Z
?XUI_ITEM_SORT@@YGXPAXP6A_N00@Z@Z
?XUI_LAYOUT_SET@@YGXPAXE@Z
?XUI_LOAD@@YGHPAVAppHandler@@PB_WPBD@Z
?XUI_MENU_CHECKITEM@@YGHPAXPBDH@Z
?XUI_MENU_ENABLEITEM@@YGHPAXPBDH@Z
?XUI_MENU_FIX@@YGXPAX@Z
?XUI_MENU_GETITEMTEXT@@YGPB_WPAXPBD@Z
?XUI_MENU_POPUP@@YGPBDPAX0HHH@Z
?XUI_MENU_QUERY@@YGPAXPBD@Z
?XUI_MENU_REMOVEITEM@@YGHPAXPBD@Z
?XUI_PERCENT_GET@@YGMPAX@Z
?XUI_PERCENT_SET@@YGXPAXM@Z
?XUI_RESOURCE_FREE@@YGXPAX@Z
?XUI_SIZE_GET@@YGXPAXAAH111H@Z
?XUI_SIZE_SET@@YGXPAXHHHHH@Z
?XUI_STRING_GET@@YGPB_WPBD@Z
?XUI_TEXT_GET@@YGPB_WPAX@Z
?XUI_TEXT_SET@@YGXPAXPB_WK@Z
?XUI_VCL_QUERY@@YGPAXPAXPBD@Z
?XUI_VISIBLE_GET@@YGHPAX@Z
?XUI_VISIBLE_SET@@YGXPAXH@Z
?XUI_WIN_CREATE@@YGHPAX0@Z
?XUI_WIN_DESTROY@@YGXPAX@Z
?XUI_WIN_ENDMODAL@@YGXPAXH@Z
?XUI_WIN_MODAL@@YGHPAX0@Z
?XUI_WIN_RAW@@YGPAUHWND__@@PAX@Z
?XUI_WIN_REGISTER@@YGPAXPBDPAVWinHandler@@@Z

Sections

.text
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 113KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ff4619ffa9ffed7069aa6c1d703e7d5a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

msvcp90

shlwapi

comctl32

gdiplus

msvcr90

Exports

Exports

Sections

.text Size: 151KB - Virtual size: 151KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 9KB - Virtual size: 12KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 13KB

.rmnet Size: 113KB - Virtual size: 116KB

.text
Size: 151KB - Virtual size: 151KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 9KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 13KB

.rmnet
Size: 113KB - Virtual size: 116KB