ced448efeecf98bf91f54c12d4739e30f8fb318340aebac84222cb32059af4ac

Sharing

Copy URL

Twitter E-mail

General

Target

ced448efeecf98bf91f54c12d4739e30f8fb318340aebac84222cb32059af4ac
Size

499KB
MD5

52398069e2fa6b2eb61a8e23023ca331
SHA1

dde390069c6876ecc225ee000a165353e18eaf2a
SHA256

ced448efeecf98bf91f54c12d4739e30f8fb318340aebac84222cb32059af4ac
SHA512

07771263fc07a9f58d7c6dfe3986bc8e6d6c1b5b3f21a713cf5dc3c4c749e61ed8f730c31ac4c212e1634ee5b2f727f2a5b11021f466b703ad97f730ae448e08
SSDEEP

12288:VRJQIUdAnEHBdA3ImbN8t7z/Tf/CL/Opv:YAEDA3ImZ8tf/TfY2pv

Score

N/A

Malware Config

Signatures

Files

ced448efeecf98bf91f54c12d4739e30f8fb318340aebac84222cb32059af4ac
.exe windows x86

0c3325bf3b19081294fda8207901f9fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc90u

ord4527
ord3741
ord6065
ord4410
ord4541
ord2597
ord2901
ord6109
ord4131
ord6095
ord6094
ord4324
ord5867
ord2274
ord3286
ord3489
ord3622
ord1665
ord4652
ord611
ord3768
ord1149
ord1354
ord2106
ord909
ord3543
ord3488
ord4741
ord6187
ord2074
ord2904
ord6636
ord2069
ord1262
ord4044
ord3355
ord6411
ord1754
ord1751
ord4345
ord1493
ord4664
ord5602
ord5512
ord6800
ord4603
ord5664
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord3185
ord2625
ord2623
ord6013
ord4494
ord899
ord280
ord286
ord935
ord1599
ord813
ord938
ord811
ord3220
ord285
ord1607
ord5663
ord4211
ord1098
ord265
ord266
ord2447
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord2139
ord1792
ord1791
ord1727
ord5650
ord3140
ord4910
ord595
ord797
ord3953
ord2619
ord2592
ord6035
ord4179
ord1048
ord5548
ord6741
ord5830
ord4213
ord2087
ord3217
ord5674
ord5676
ord4347
ord4996
ord5680
ord2771
ord2983
ord3112
ord4728
ord2966
ord3115
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4905
ord4681
ord589
ord794
ord4043
ord3949
ord2372
ord296
ord2537
ord1183
ord600
ord1383
ord1137
ord801
ord799
ord333
ord1272

msvcr90

_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
towupper
_wtol
_wgetenv
swscanf
wcsncat
wcsrchr
clock
fflush
ferror
_wrename
_wsplitpath
_vsnwprintf
wcscmp
wcscat
wcschr
wcslen
wcscpy
_close
wcsnlen
memmove_s
memcpy_s
vswprintf_s
_vscwprintf
_CxxThrowException
atoi
strtok_s
_errno
strnlen
swscanf_s
wcscpy_s
wcsncat_s
wcsncpy_s
realloc
_swprintf
mbstowcs
_wchmod
_time64
_wfopen
__iob_func
fwrite
fclose
memcpy
_wcsnicmp
_waccess
wcscat_s
swprintf_s
_wcsicmp
wcsncpy
rand
srand
_wfopen_s
iswspace
iswalnum
_wcsupr
malloc
wcsncmp
_wtoi
wcsstr
_snwprintf
memset
free
_wsplitpath_s
_filelength
_read
_lseek
_wsopen
strtoul
calloc
printf
_lock_file
_unlock_file
clearerr
fread
_ftelli64
_fseeki64
_wstat64i32
_wunlink
fgets
fputs
fgetc
fputc
ungetc
_vsnwprintf_s
strlen
strncpy
__CxxFrameHandler3
_itow
_wcsdup
memmove
wcstombs

kernel32

lstrcpynW
OpenEventW
RaiseException
GetTimeFormatW
HeapSize
HeapReAlloc
HeapDestroy
VerSetConditionMask
VerifyVersionInfoW
GetCurrentThread
LocalAlloc
CreateDirectoryW
BackupRead
LoadLibraryA
SetFileAttributesW
LoadLibraryExW
SetLastError
SetCurrentDirectoryW
GetDiskFreeSpaceExW
ExitThread
CreateFileW
ReadFile
FindFirstFileW
FindNextFileW
GetCurrentDirectoryW
UnmapViewOfFile
ExpandEnvironmentStringsA
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GlobalFree
InterlockedExchangeAdd
OpenProcess
CreateMutexW
WideCharToMultiByte
SetThreadAffinityMask
GlobalAlloc
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
SystemTimeToFileTime
WritePrivateProfileStringW
SetErrorMode
QueryDosDeviceW
lstrlenW
Beep
MoveFileExW
GetLongPathNameW
GetProcessHeap
HeapAlloc
DeviceIoControl
HeapFree
RemoveDirectoryW
GetPrivateProfileIntW
GetTempPathW
GetVersionExW
GetWindowsDirectoryW
GetFileSize
GetSystemTime
ReleaseSemaphore
CreateSemaphoreW
GetSystemDirectoryW
GetVolumeInformationW
QueryPerformanceCounter
GetLocalTime
CreateProcessW
GetDateFormatW
FileTimeToSystemTime
GetPrivateProfileStringW
FormatMessageW
LocalFree
GetDriveTypeW
MultiByteToWideChar
GetPriorityClass
SetPriorityClass
LoadLibraryW
GetProcAddress
FreeLibrary
SetFilePointer
WriteFile
FlushFileBuffers
ResumeThread
SuspendThread
GetCurrentProcessId
CloseHandle
TerminateThread
WaitForSingleObject
Sleep
SetEvent
WaitForMultipleObjects
SetThreadPriority
CreateThread
ResetEvent
CreateEventW
GetProcessAffinityMask
GetCurrentProcess
DeleteFileW
CopyFileW
GetModuleHandleW
GetExitCodeProcess
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
GetComputerNameW
GetFileAttributesW
FindClose
GetLastError

user32

EnableWindow
MessageBoxW
GetLastActivePopup
GetActiveWindow
DestroyIcon
InvalidateRect
FillRect
LoadIconW
LoadImageW
CopyRect
InflateRect
DrawStateW
GetWindowRect
ScreenToClient
GetDC
ReleaseDC
GetParent
SendMessageW
GetFocus
DispatchMessageW
TranslateMessage
PeekMessageW
wsprintfW
DrawIconEx
MessageBeep
LoadStringW
ExitWindowsEx
GetSystemMetrics
IsWindow
GetForegroundWindow

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyExA
RegQueryValueExA
DuplicateTokenEx
ImpersonateLoggedOnUser
RegDisablePredefinedCache
SetThreadToken
GetSecurityInfo
GetSecurityDescriptorDacl
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetSecurityInfo
CreateProcessAsUserW
LookupAccountSidW
ReportEventW
DeregisterEventSource
RegisterEventSourceW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
ImpersonateSelf
OpenThreadToken
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
RegQueryValueExW
RegCloseKey
OpenProcessToken
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
RegEnumValueW
RegOpenKeyExW
GetUserNameW

shell32

ShellExecuteW

comctl32

_TrackMouseEvent
ord17

ole32

CoCreateInstance
CoInitialize

msvcp90

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z

winmm

sndPlaySoundW

gdi32

GetPixel
CreatePen
CreateSolidBrush
SetPixel
RoundRect
GetTextExtentPoint32W

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 327KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.7rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0c3325bf3b19081294fda8207901f9fb

Headers

DLL Characteristics

File Characteristics

Imports

mfc90u

msvcr90

kernel32

user32

advapi32

shell32

comctl32

ole32

msvcp90

winmm

gdi32

version

Sections

.text Size: 327KB - Virtual size: 327KB

.rdata Size: 54KB - Virtual size: 53KB

.data Size: 8KB - Virtual size: 39KB

.rsrc Size: 27KB - Virtual size: 27KB

.7rdata Size: 76KB - Virtual size: 76KB

.text
Size: 327KB - Virtual size: 327KB

.rdata
Size: 54KB - Virtual size: 53KB

.data
Size: 8KB - Virtual size: 39KB

.rsrc
Size: 27KB - Virtual size: 27KB

.7rdata
Size: 76KB - Virtual size: 76KB