d274af3db05864abb24e552bb6c8fe4a9e145ad51a89f2514f73c0999e2a7d9a

Sharing

Copy URL Twitter E-mail

General

Target

d274af3db05864abb24e552bb6c8fe4a9e145ad51a89f2514f73c0999e2a7d9a
Size

384KB
MD5

18986ff251d3eabedf9eed7dfe9ab3a0
SHA1

896777d5c2adc890f9b13b542665ba1184352edb
SHA256

d274af3db05864abb24e552bb6c8fe4a9e145ad51a89f2514f73c0999e2a7d9a
SHA512

f1bcd83eea04136d9d9f96eb483168e5d55934e9aa836e8b253df01e212bcfd2fc1673af4c4291affb479aacf160a49de166931cb6f71fff07459e94f084d305
SSDEEP

6144:0O5HM6eD7PjncuMbc2TC5mD/SuxeBS+sNXwlixDFMKUVSNkQBHSj4D:0AMJt4Tbeq5aPajc4

Score

N/A

Malware Config

Signatures

Files

d274af3db05864abb24e552bb6c8fe4a9e145ad51a89f2514f73c0999e2a7d9a
.dll windows x86

22f15775859dcd24e8c6886f8c48d9aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

vstringball

STR_DisposeBall
FILE_Dispose
U_Death
EMUL_ShutdownGraf
EMUL_ShutdownFonts
EMUL_ShutdownDialogs
EMUL_ShutdownResources
EMUL_ShutdownMemory
EMUL_InitializeMemorySubsystem
InitResources
U_Birth
LoadResource
FILE_New
FILE_OpenResFile
STR_NewBall
FILE_CloseResFile
STR_BallStringLookup

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathFindExtensionW
PathRemoveBackslashW

imagerenderer

IR_ScaleConvertPacked

ameproperties

?InitializeAMEProperties@Vindaloo@@YAKPAVIVServicesManager@1@@Z

adobedocmeta

ord3
ord1
ord2
ord4
ord10
ord11
ord15

bib

ord5
ord11
ord4

fileinfo

FileInfoTerminateFileInfoLibrary
FileInfoInitializeFileInfoLibraryWithBIB

kernel32

FindNextFileW
EnumResourceNamesA
FindResourceA
FindFirstFileW
FreeResource
GetFileInformationByHandle
FileTimeToSystemTime
WideCharToMultiByte
GetCurrentDirectoryW
SetCurrentDirectoryW
MultiByteToWideChar
CreateDirectoryA
GetFileAttributesA
SetCurrentDirectoryA
GetTickCount
GetLongPathNameW
TerminateThread
GetExitCodeThread
ReadDirectoryChangesW
SleepEx
CreateThread
GetSystemTime
GetModuleFileNameW
GetEnvironmentVariableW
CompareFileTime
GetDiskFreeSpaceExW
GetFileSizeEx
LockResource
GetCurrentDirectoryA
DeleteFileW
CloseHandle
GetLastError
CreateFileW
ReadFile
SetFilePointer
WriteFile
GetFileSize
SetEndOfFile
GetTempPathA
GetTempFileNameA
FindClose
FindNextFileA
FindFirstFileA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
LoadLibraryA
LoadLibraryExA
FreeLibrary
GetCurrentThreadId
LoadLibraryW

shell32

SHCreateDirectoryExW

msvcp71

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??_D?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?str@?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z
??0?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?_Nomemory@std@@YAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z

msvcr71

wcscmp
sprintf
_wtoi
wcsstr
fread
fclose
fopen
remove
fflush
fwrite
_mkdir
_mbsinc
_mbsrchr
wcsncat
ceil
_CIacos
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
malloc
_callnewh
?terminate@@YAXXZ
_except_handler3
??1type_info@@UAE@XZ
__dllonexit
_onexit
free
_initterm
_adjust_fdiv
__CppXcptFilter
_wcsicmp
_itoa
_purecall
??3@YAXPAX@Z
??_V@YAXPAX@Z
wcscpy
wcslen
__CxxFrameHandler
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_splitpath
memmove
_itow
swprintf
atof
wcscat

Exports

Exports

??0CFilePort@Vindaloo@@QAE@ABV01@@Z
??0CFilePort@Vindaloo@@QAE@W4AccessMode@1@E@Z
??0CPort@Vindaloo@@QAE@ABV01@@Z
??0CPort@Vindaloo@@QAE@W4AccessMode@1@E@Z
??0CReadStream@Vindaloo@@QAE@AAVCPort@1@W4VindByteOrdering@1@KKE@Z
??0CReadStream@Vindaloo@@QAE@ABV01@@Z
??0CReadStream@Vindaloo@@QAE@PAVCPort@1@W4VindByteOrdering@1@KKE@Z
??0CStaticRamFilePort@Vindaloo@@QAE@ABV01@@Z
??0CStaticRamFilePort@Vindaloo@@QAE@PAXKW4AccessMode@1@E@Z
??0CWriteStream@Vindaloo@@QAE@AAVCPort@1@W4VindByteOrdering@1@KKE@Z
??0CWriteStream@Vindaloo@@QAE@ABV01@@Z
??0CWriteStream@Vindaloo@@QAE@PAVCPort@1@W4VindByteOrdering@1@KKE@Z
??0VCustomData@Vindaloo@@QAE@XZ
??0_VHeaderAttributes@Vindaloo@@QAE@ABU01@@Z
??0_VHeaderAttributes@Vindaloo@@QAE@XZ
??1CFilePort@Vindaloo@@UAE@XZ
??1CPort@Vindaloo@@UAE@XZ
??1CReadStream@Vindaloo@@UAE@XZ
??1CStaticRamFilePort@Vindaloo@@UAE@XZ
??1CWriteStream@Vindaloo@@UAE@XZ
??1VCustomData@Vindaloo@@QAE@XZ
??1_VHeaderAttributes@Vindaloo@@QAE@XZ
??4CFilePort@Vindaloo@@QAEAAV01@ABV01@@Z
??4CPort@Vindaloo@@QAEAAV01@ABV01@@Z
??4CReadStream@Vindaloo@@QAEAAV01@ABV01@@Z
??4CStaticRamFilePort@Vindaloo@@QAEAAV01@ABV01@@Z
??4CWriteStream@Vindaloo@@QAEAAV01@ABV01@@Z
??4VCustomData@Vindaloo@@QAEAAU01@ABU01@@Z
??4_VHeaderAttributes@Vindaloo@@QAEAAU01@ABU01@@Z
??_7CFilePort@Vindaloo@@6B@
??_7CPort@Vindaloo@@6B@
??_7CReadStream@Vindaloo@@6B@
??_7CStaticRamFilePort@Vindaloo@@6B@
??_7CWriteStream@Vindaloo@@6B@
?AddRef@CReadStream@Vindaloo@@UAEKXZ
?AddRef@CWriteStream@Vindaloo@@UAEKXZ
?Close@CFilePort@Vindaloo@@UAEKXZ
?Close@CStaticRamFilePort@Vindaloo@@UAEKXZ
?FilePort@CPort@Vindaloo@@SA?AV?$CVAutoPtr@VCPort@Vindaloo@@@2@PBDW4AccessMode@2@@Z
?FlipBytes@CReadStream@Vindaloo@@QBE_NXZ
?FlipBytes@CWriteStream@Vindaloo@@QBE_NXZ
?Flush@CPort@Vindaloo@@UAEKXZ
?Flush@CWriteStream@Vindaloo@@UAEKE@Z
?GetComments@_VHeaderAttributes@Vindaloo@@QBEXPAGPAK@Z
?GetCustomData@_VHeaderAttributes@Vindaloo@@QBEXKAAUVCustomData@2@@Z
?GetCustomDataCount@_VHeaderAttributes@Vindaloo@@QBEKXZ
?GetData@VCustomData@Vindaloo@@QBEXPAGPAK@Z
?GetFourCC@_VHeaderAttributes@Vindaloo@@QBEXPAGPAK@Z
?GetName@VCustomData@Vindaloo@@QBEXPAGPAK@Z
?GetName@_VHeaderAttributes@Vindaloo@@QBEXPAGPAK@Z
?GetPos@CReadStream@Vindaloo@@UBEKPAK@Z
?GetPos@CWriteStream@Vindaloo@@UBEKPAK@Z
?GetSize@CReadStream@Vindaloo@@UBEKPAK@Z
?GetVersion@_VHeaderAttributes@Vindaloo@@QBEXPAGPAK@Z
?IsSequential@CPort@Vindaloo@@UBE_NXZ
?Mode@CPort@Vindaloo@@QBE?AW4AccessMode@2@XZ
?Open@CFilePort@Vindaloo@@UAEKPBD@Z
?Open@CFilePort@Vindaloo@@UAEKPBG@Z
?OwnsResource@CPort@Vindaloo@@QBEEXZ
?PeekByte@CReadStream@Vindaloo@@UAEKPAE@Z
?PutBackByte@CReadStream@Vindaloo@@UAEKE@Z
?PutBool@CWriteStream@Vindaloo@@UAEKE@Z
?PutByte@CWriteStream@Vindaloo@@UAEKE@Z
?PutDouble@CWriteStream@Vindaloo@@UAEKN@Z
?PutFloat@CWriteStream@Vindaloo@@UAEKM@Z
?PutInt@CWriteStream@Vindaloo@@UAEKJ@Z
?PutShort@CWriteStream@Vindaloo@@UAEKF@Z
?PutZeroPadding@CWriteStream@Vindaloo@@UAEKJ@Z
?QueryInterface@CReadStream@Vindaloo@@UAEKABU_VGUID@2@PAPAX@Z
?QueryInterface@CWriteStream@Vindaloo@@UAEKABU_VGUID@2@PAPAX@Z
?Read@CFilePort@Vindaloo@@UBEKKJPAX@Z
?Read@CReadStream@Vindaloo@@UBEKKPBX@Z
?Read@CStaticRamFilePort@Vindaloo@@UBEKKJPAX@Z
?ReadBool@CReadStream@Vindaloo@@UBEKPAE@Z
?ReadByte@CReadStream@Vindaloo@@UBEKPAE@Z
?ReadDouble@CReadStream@Vindaloo@@UBEKPAN@Z
?ReadFloat@CReadStream@Vindaloo@@UBEKPAM@Z
?ReadInt@CReadStream@Vindaloo@@UBEKPAJ@Z
?ReadOnlyRamPort@CPort@Vindaloo@@SA?AV?$CVAutoPtr@VCPort@Vindaloo@@@2@PBXK@Z
?ReadSequential@CPort@Vindaloo@@UBEXKJAAJPAX@Z
?ReadShort@CReadStream@Vindaloo@@UBEKPAF@Z
?Release@CReadStream@Vindaloo@@UAEKXZ
?Release@CWriteStream@Vindaloo@@UAEKXZ
?SetComments@_VHeaderAttributes@Vindaloo@@QAEXPBG@Z
?SetCustomData@_VHeaderAttributes@Vindaloo@@QAEXKAAUVCustomData@2@@Z
?SetCustomData@_VHeaderAttributes@Vindaloo@@QAEXKPBG0@Z
?SetCustomDataCount@_VHeaderAttributes@Vindaloo@@QAEXK@Z
?SetData@VCustomData@Vindaloo@@QAEXPBG@Z
?SetFourCC@_VHeaderAttributes@Vindaloo@@QAEXPBG@Z
?SetName@VCustomData@Vindaloo@@QAEXPBG@Z
?SetName@_VHeaderAttributes@Vindaloo@@QAEXPBG@Z
?SetPos@CReadStream@Vindaloo@@UAEKK@Z
?SetPos@CWriteStream@Vindaloo@@UAEKK@Z
?SetVersion@_VHeaderAttributes@Vindaloo@@QAEXPBG@Z
?Size@CFilePort@Vindaloo@@UAEKK@Z
?Size@CFilePort@Vindaloo@@UBEKXZ
?Size@CStaticRamFilePort@Vindaloo@@UAEKK@Z
?Size@CStaticRamFilePort@Vindaloo@@UBEKXZ
?Skip@CReadStream@Vindaloo@@UAEKK@Z
?StaticRamPort@CPort@Vindaloo@@SA?AV?$CVAutoPtr@VCPort@Vindaloo@@@2@PAXK@Z
?Write@CFilePort@Vindaloo@@UAEKKJPBX@Z
?Write@CStaticRamFilePort@Vindaloo@@UAEKKJPBX@Z
?Write@CWriteStream@Vindaloo@@UAEKKPBX@Z
CreateTranscoderEngine
GetServiceManager

Sections

.text
Size: 232KB - Virtual size: 229KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

22f15775859dcd24e8c6886f8c48d9aa

Headers

File Characteristics

Imports

vstringball

shlwapi

imagerenderer

ameproperties

adobedocmeta

bib

fileinfo

kernel32

shell32

msvcp71

msvcr71

Exports

Exports

Sections

.text Size: 232KB - Virtual size: 229KB

.rdata Size: 56KB - Virtual size: 52KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 21KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 232KB - Virtual size: 229KB

.rdata
Size: 56KB - Virtual size: 52KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 21KB

.rmnet
Size: 60KB - Virtual size: 60KB