6e6c0d7206421ff1172807216f38522a50857d159039f443640edea008a27a59

Sharing

Copy URL Twitter E-mail

General

Target

6e6c0d7206421ff1172807216f38522a50857d159039f443640edea008a27a59
Size

512KB
MD5

3b1583eecdd9eebaee2655be20b8e2f0
SHA1

5fd0ab8034aca596a6ca9809a7634cc667f75b18
SHA256

6e6c0d7206421ff1172807216f38522a50857d159039f443640edea008a27a59
SHA512

f2f65be1a17a19ea96ec5f1541736e2d1f03d09c187d47d6ac85fd4458274556d217137da7e8164e6cc3216b85facd39951859f8fb888b97c7ef27e703c0afa6
SSDEEP

12288:eLnICzFfW8p3KUjO7p8gHZw+fDXfr2kfj:5wl3jO2g5wgmk

Score

N/A

Malware Config

Signatures

Files

6e6c0d7206421ff1172807216f38522a50857d159039f443640edea008a27a59
.dll windows x86

66ee91711965e2c0da03bb1e67e0fa9e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitThread
CreateThread
VirtualProtect
VirtualQuery
SetEndOfFile
ReadProcessMemory
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
OpenProcess
FindClose
FindNextFileW
FindFirstFileW
GetVersionExW
CreateProcessA
CreateDirectoryA
ReadFile
IsProcessorFeaturePresent
OutputDebugStringW
IsBadWritePtr
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
lstrcmpW
GlobalUnlock
FreeResource
RemoveDirectoryA
DeleteFileA
MoveFileExA
GetTempFileNameA
MulDiv
FlushInstructionCache
LoadLibraryExW
lstrcmpiW
GetModuleFileNameW
lstrlenA
lstrlenW
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjects
SystemTimeToFileTime
ResumeThread
ResetEvent
CreateMutexA
GetSystemInfo
ReleaseMutex
WaitForSingleObject
SetEvent
InterlockedCompareExchange
InitializeCriticalSection
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InterlockedExchange
FreeLibrary
GetConsoleMode
GetConsoleCP
SetFilePointer
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GlobalLock
GlobalAlloc
LoadResource
SizeofResource
FindResourceW
Sleep
GetLastError
MultiByteToWideChar
GetTempPathA
OutputDebugStringA
HeapFree
GetProcessHeap
HeapAlloc
CloseHandle
CreateEventA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
RaiseException
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
RtlUnwind
LoadLibraryA
GetLocaleInfoW
GetLocaleInfoA
GetModuleHandleA

user32

PostQuitMessage
CreateWindowExA
MoveWindow
IsWindow
SetWindowRgn
DestroyWindow
SetWindowLongW
GetWindowTextA
GetWindowTextLengthA
UnregisterClassA
SendMessageW
LoadCursorW
RegisterClassExA
MessageBoxA
GetWindowRect
GetClientRect
ShowWindow
DefWindowProcW
UpdateLayeredWindow
GetWindowLongW
ReleaseDC
GetWindowDC
InflateRect
CopyRect
AnimateWindow
SystemParametersInfoW
DispatchMessageW
TranslateMessage
CharNextW
CreateWindowExW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
SetWindowPos
ClientToScreen
ScreenToClient
BeginPaint
EndPaint
GetDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
SetFocus
GetWindow
IsChild
GetParent
GetDlgItem
GetClassNameW
GetSysColor
DestroyAcceleratorTable
GetFocus
FillRect
GetDesktopWindow
CreateAcceleratorTableW
ReleaseCapture
RegisterWindowMessageW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
FindWindowW
FindWindowExW
GetWindowThreadProcessId
GetMessageW
UpdateWindow
GetSystemMetrics

gdi32

DeleteObject
GetObjectW
GetStockObject
BitBlt
CreateSolidBrush
GetDeviceCaps
CreateRoundRectRgn
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

advapi32

RegDeleteValueW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteKeyW
RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shell32

SHGetSpecialFolderPathA
SHGetFolderPathW
ShellExecuteW
ShellExecuteA

ole32

CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleInitialize
OleUninitialize
CoTaskMemAlloc
CoInitialize
CreateStreamOnHGlobal
CoUninitialize
StringFromGUID2

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocStringLen
SysAllocString
SysStringLen
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
DispCallFunc

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathAddExtensionW
PathFindFileNameA
PathAddBackslashA
PathRemoveBackslashW
PathRemoveBackslashA
PathAddBackslashW
PathRemoveExtensionW
PathFileExistsA
PathFileExistsW

gdiplus

GdipDeleteGraphics
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI
GdipFree
GdipAlloc
GdipDisposeImage
GdipLoadImageFromStream
GdipCloneImage
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC

tinyxml

??0TiXmlDocument@@QAE@XZ
?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
?Attribute@TiXmlElement@@QBEPBDPBD@Z
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
??1TiXmlDocument@@UAE@XZ
?Next@TiXmlAttribute@@QAEPAV1@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ

httprq

?set_writer_callback@CCurlEasyA@httprq@@UAEXV?$function@$$A6AJPAXJ@Z@boost@@@Z
?SyncRequest@CCurlEasyA@httprq@@UAEJXZ
?set_timeout@CCurlEasyA@httprq@@UAEXJ@Z
??0CCurlEasyA@httprq@@QAE@XZ
??1CCurlEasyA@httprq@@UAE@XZ
?set_header_callback@CCurlEasyA@httprq@@UAEXV?$function@$$A6AJPAXJ@Z@boost@@@Z
?set_progress_callback@CCurlEasyA@httprq@@UAEXV?$function@$$A6AHNNNN@Z@boost@@@Z
?set_url@CCurlEasyA@httprq@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_cookie@CCurlEasyA@httprq@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?url@CCurlEasyA@httprq@@UBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?response_body@CCurlEasyA@httprq@@UBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?cookie@CCurlEasyA@httprq@@UBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Init@CCurlEasyA@httprq@@SA_NXZ

Exports

Exports

??0CAdvertOnline@adbir@@QAE@XZ
??0CResManage@adbir@@AAE@XZ
??0CResManage@adbir@@QAE@ABV01@@Z
??1CAdvertOnline@adbir@@QAE@XZ
??1CResManage@adbir@@AAE@XZ
??4CAdvertOnline@adbir@@QAEAAV01@ABV01@@Z
??4CResManage@adbir@@QAEAAV01@ABV01@@Z
?DoRun@CAdvertOnline@adbir@@AAEXXZ
?GetImage@CResManage@adbir@@QAEPAVImage@Gdiplus@@W4ResType@12@@Z
?ImageFromIDResource@CResManage@adbir@@AAE_NPAUHINSTANCE__@@PB_WIAAPAVImage@Gdiplus@@@Z
?Init@CAdvertOnline@adbir@@QAEXPAUHWND__@@PBD@Z
?Init@CResManage@adbir@@QAEXPAUHINSTANCE__@@@Z
?LoadImageW@CResManage@adbir@@QAEXW4ResType@12@PB_WI@Z
?QuitTaskCount@CAdvertOnline@adbir@@QBEKXZ
?Release@CResManage@adbir@@QAEXXZ
?Run@CAdvertOnline@adbir@@QAEXPBD@Z
?RunQuitTask@CAdvertOnline@adbir@@QAEXXZ
?Version@CAdvertOnline@adbir@@QBEJXZ
?instance@CResManage@adbir@@SAAAV12@XZ

Sections

.text
Size: 328KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

66ee91711965e2c0da03bb1e67e0fa9e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

tinyxml

httprq

Exports

Exports

Sections

.text Size: 328KB - Virtual size: 327KB

.rdata Size: 73KB - Virtual size: 73KB

.data Size: 19KB - Virtual size: 32KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 31KB - Virtual size: 30KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 328KB - Virtual size: 327KB

.rdata
Size: 73KB - Virtual size: 73KB

.data
Size: 19KB - Virtual size: 32KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 31KB - Virtual size: 30KB

.rmnet
Size: 56KB - Virtual size: 60KB