67a991c3f1899c508f744ecf22e20ee7a24c5a9b1b732a32f16eca00defb2aba

Sharing

Copy URL Twitter E-mail

General

Target

67a991c3f1899c508f744ecf22e20ee7a24c5a9b1b732a32f16eca00defb2aba
Size

3.6MB
MD5

b629a33c702b66010c9ad225a0693de3
SHA1

4fd107cc26a9810c52d51c7e716642a85d10f7db
SHA256

67a991c3f1899c508f744ecf22e20ee7a24c5a9b1b732a32f16eca00defb2aba
SHA512

691d30eab151af482253bc72576ffbea70a13e4f8e78f7b352974a8c0f238a7a40836dacb6f32f9f0b34b9f1d450fd61a3a5c94eb0918e20469bbff59347d0c4
SSDEEP

98304:yGlGhpYKEkOEZPvvk8/NmvrYizFrZplGoyuNUo9zis8nlDC:ykGfYKpOyP3k8FozFrZplcuNUoN78nxC

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Ring/Ring/ring.exe	upx
static1/unpack001/Ring/ƶ/Client.exe	upx

Files

67a991c3f1899c508f744ecf22e20ee7a24c5a9b1b732a32f16eca00defb2aba
.zip
Ring/Ring/DelPasswd.reg
Ring/Ring/Install.bat
Ring/Ring/Time1.ini
Ring/Ring/Time2.ini
Ring/Ring/config.ini
Ring/Ring/ring.dll
.dll windows x86

fc4670872d72cdf946febce996a7513f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
GetTickCount
ReadFile
IsBadCodePtr
GetCPInfo
GetFileType
GetStartupInfoA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetHandleCount
GetStdHandle
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
SetThreadPriority
CloseHandle
WaitForSingleObject
GetCurrentThread
CreateEventA
SetEvent
GetModuleHandleA
GetThreadPriority
Sleep
LoadLibraryA
GetProcAddress
GetExitCodeThread
CreateThread
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
HeapAlloc
HeapFree
GetLastError
TlsSetValue
ExitThread
GetTimeZoneInformation
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
SetStdHandle
lstrcpyA
GetFileInformationByHandle
PeekNamedPipe
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
IsBadWritePtr
UnhandledExceptionFilter
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
SetFilePointer
IsBadReadPtr
GetStringTypeW
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
CreateFileA
FlushFileBuffers

user32

DispatchMessageA
PeekMessageA
GetDC
wsprintfA
DestroyWindow
UnregisterClassA
RegisterClassA
CreateWindowExA
SetWindowLongA
PostThreadMessageA
PostMessageA
GetMessageA
MsgWaitForMultipleObjects
MessageBoxA
GetWindowLongA
DefWindowProcA
TranslateMessage

gdi32

SetDIBitsToDevice

winmm

waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveOutRestart
mixerGetLineControlsA
mixerGetLineInfoA
mixerClose
mixerGetDevCapsA
mixerOpen
mixerSetControlDetails
waveOutSetVolume
waveOutPause
mixerGetControlDetailsA
waveOutWrite
waveOutPrepareHeader
waveOutGetPosition
waveOutGetNumDevs
waveOutSetPlaybackRate
waveOutGetDevCapsA
waveOutGetVolume

wsock32

recvfrom
recv
select
ntohl
ntohs
getsockname
closesocket
WSACleanup
send
bind
htonl
htons
socket
gethostbyname
WSAGetLastError
connect
WSAStartup
accept
listen
sendto

Exports

Exports

pvFreeMp3
pvGetMp3Info
pvInitMp3
pvPauseMp3
pvPlayMp3
pvResumeMp3
pvStopMp3

Sections

.text
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ring/Ring/ring.exe
.exe windows x86

e31a9a4686544932219eb31d3898d957

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

FileTimeToLocalFileTime
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess

user32

OemToCharA
MessageBoxA

advapi32

RegEnumValueA

oleaut32

SafeArrayPtrOfIndex

version

VerQueryValueA

gdi32

RealizePalette

ole32

ProgIDFromCLSID

comctl32

ImageList_Add

shell32

Shell_NotifyIconA

wininet

InternetCheckConnectionA

comdlg32

GetOpenFileNameA

winmm

waveOutSetVolume

wsock32

WSAAsyncGetHostByName

ring

pvStopMp3

Sections

CODE
Size: - Virtual size: 695KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 20B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX1
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX2
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ring/Ring/ring.ocx
.dll regsvr32 windows x86

fce50bf1c0506c8e10587d0d2d52c136

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
HeapFree
RaiseException
HeapSize
HeapReAlloc
GetACP
GetTimeZoneInformation
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
TerminateProcess
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
ExitProcess
GetCommandLineA
RtlUnwind
GetProfileIntA
GetFileTime
GetFileSize
GetFileAttributesA
FindResourceExA
SizeofResource
GetOEMCP
GetCPInfo
FileTimeToLocalFileTime
FileTimeToSystemTime
CopyFileA
GlobalSize
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetCurrentProcess
DuplicateHandle
FormatMessageA
GetProcessVersion
WritePrivateProfileStringA
GlobalFlags
GetLastError
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalFree
LocalAlloc
lstrcpynA
MulDiv
SetLastError
LoadLibraryA
FreeLibrary
FindResourceA
LoadResource
LockResource
GetVersion
lstrcatA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetModuleHandleA
GetProcAddress
GetUserDefaultLCID
IsDBCSLeadByte
GlobalFree
GlobalUnlock
InterlockedDecrement
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
lstrcpyA
lstrlenA
InterlockedIncrement
CloseHandle
GetModuleFileNameA
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
HeapCreate
Sleep

user32

FillRect
AppendMenuA
RemoveMenu
GetTabbedTextExtentA
GetDialogBaseUnits
GetDCEx
GetMenuStringA
InsertMenuA
UnregisterClassA
LockWindowUpdate
EnumChildWindows
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
EndDialog
CreateDialogIndirectParamA
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
MapWindowPoints
SetActiveWindow
IsWindow
SetFocus
AdjustWindowRectEx
EqualRect
GetTopWindow
WinHelpA
GetClassInfoA
RegisterClassA
GetDlgItem
CharUpperA
GetDlgCtrlID
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetRect
GetSysColor
GrayStringA
DrawTextA
TabbedTextOutA
GetClientRect
SetRectEmpty
ReleaseDC
GetDC
GetCapture
ReleaseCapture
SetCapture
LoadCursorA
PtInRect
GetSystemMetrics
RegisterClipboardFormatA
MoveWindow
ScreenToClient
IsChild
IsRectEmpty
IntersectRect
CreateMenu
DestroyMenu
GetMenuItemCount
GetMenu
GetSubMenu
GetMenuItemID
UpdateWindow
InflateRect
GetWindowRect
ShowWindow
OffsetRect
InvalidateRect
DrawEdge
CopyRect
SetParent
SetWindowPos
CallWindowProcA
DefWindowProcA
SetWindowLongA
DestroyWindow
UnhookWindowsHookEx
DestroyIcon
LoadStringA
GetWindowTextA
GetSysColorBrush
wsprintfA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
EnableWindow
SetTimer
GetDesktopWindow
LoadIconA
DrawIcon
GetClassNameA

gdi32

GetViewportExtEx
MoveToEx
GetWindowExtEx
CreatePen
CreateSolidBrush
CreatePatternBrush
GetMapMode
PatBlt
SetRectRgn
CreateRectRgn
CreateFontIndirectA
CopyMetaFileA
CreateDCA
GetTextMetricsA
GetTextExtentPoint32A
GetTextAlign
EnumFontFamiliesExA
UnrealizeObject
Rectangle
SelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
DeleteObject
GetCurrentPositionEx
CreateRectRgnIndirect
CreateBitmap
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetROP2
SetBkMode
GetStockObject
SelectObject
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CombineRgn
CreateMetaFileA
DeleteDC
CloseMetaFile
DeleteMetaFile
LPtoDP
GetDeviceCaps

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegDeleteKeyA
RegQueryValueA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegCreateKeyA
RegSetValueA
RegSetValueExA
RegOpenKeyA
RegEnumKeyA

shell32

ExtractIconA

comctl32

ord17

ole32

CoRegisterClassObject
CoCreateInstance
OleDuplicateData
CoRevokeClassObject
StringFromGUID2
CreateDataCache
CoTaskMemAlloc
OleLoadFromStream
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CreateDataAdviseHolder
ReleaseStgMedium
OleSaveToStream
CoTaskMemFree
CreateOleAdviseHolder
StringFromCLSID
CoDisconnectObject
ReadFmtUserTypeStg
ReadClassStm
CreateStreamOnHGlobal

olepro32

ord252
ord251
ord253
ord250

oleaut32

SysStringLen
SysAllocStringByteLen
SysAllocStringLen
VariantCopy
SysAllocString
VariantChangeType
VariantClear
LoadTypeLi
RegisterTypeLi
SysStringByteLen
SysFreeString
LoadRegTypeLi

ws2_32

closesocket
WSAStartup
WSASocketA
htonl
htons
bind
WSAAsyncSelect
inet_addr
WSACleanup
WSARecvFrom
WSASendTo

winmm

waveInStart
waveInReset
waveOutReset
waveInUnprepareHeader
waveOutUnprepareHeader
waveInClose
waveOutClose
waveOutWrite
waveInStop
waveOutOpen
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveOutPrepareHeader

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ring/ƶ/Client.exe
.exe windows x86

b3a6bd4245297802b29299564eb587d7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetStdHandle
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess

user32

SetWindowLongA
MessageBoxA

advapi32

RegCloseKey

oleaut32

SysFreeString

version

GetFileVersionInfoSizeA

gdi32

GetTextExtentPointA

ole32

OleSetMenuDescriptor

comctl32

ImageList_SetImageCount

shell32

ShellExecuteA

wsock32

gethostbyname

Sections

CODE
Size: - Virtual size: 452KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 20B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX1
Size: - Virtual size: 699KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX2
Size: 983KB - Virtual size: 982KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ring/ƶ/Install.bat
Ring/ƶ/cfg.ini
Ring/ƶ/ring.ocx
.dll regsvr32 windows x86

fce50bf1c0506c8e10587d0d2d52c136

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
HeapFree
RaiseException
HeapSize
HeapReAlloc
GetACP
GetTimeZoneInformation
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
TerminateProcess
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
ExitProcess
GetCommandLineA
RtlUnwind
GetProfileIntA
GetFileTime
GetFileSize
GetFileAttributesA
FindResourceExA
SizeofResource
GetOEMCP
GetCPInfo
FileTimeToLocalFileTime
FileTimeToSystemTime
CopyFileA
GlobalSize
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetCurrentProcess
DuplicateHandle
FormatMessageA
GetProcessVersion
WritePrivateProfileStringA
GlobalFlags
GetLastError
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalFree
LocalAlloc
lstrcpynA
MulDiv
SetLastError
LoadLibraryA
FreeLibrary
FindResourceA
LoadResource
LockResource
GetVersion
lstrcatA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetModuleHandleA
GetProcAddress
GetUserDefaultLCID
IsDBCSLeadByte
GlobalFree
GlobalUnlock
InterlockedDecrement
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
lstrcpyA
lstrlenA
InterlockedIncrement
CloseHandle
GetModuleFileNameA
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
HeapCreate
Sleep

user32

FillRect
AppendMenuA
RemoveMenu
GetTabbedTextExtentA
GetDialogBaseUnits
GetDCEx
GetMenuStringA
InsertMenuA
UnregisterClassA
LockWindowUpdate
EnumChildWindows
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
EndDialog
CreateDialogIndirectParamA
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
MapWindowPoints
SetActiveWindow
IsWindow
SetFocus
AdjustWindowRectEx
EqualRect
GetTopWindow
WinHelpA
GetClassInfoA
RegisterClassA
GetDlgItem
CharUpperA
GetDlgCtrlID
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetRect
GetSysColor
GrayStringA
DrawTextA
TabbedTextOutA
GetClientRect
SetRectEmpty
ReleaseDC
GetDC
GetCapture
ReleaseCapture
SetCapture
LoadCursorA
PtInRect
GetSystemMetrics
RegisterClipboardFormatA
MoveWindow
ScreenToClient
IsChild
IsRectEmpty
IntersectRect
CreateMenu
DestroyMenu
GetMenuItemCount
GetMenu
GetSubMenu
GetMenuItemID
UpdateWindow
InflateRect
GetWindowRect
ShowWindow
OffsetRect
InvalidateRect
DrawEdge
CopyRect
SetParent
SetWindowPos
CallWindowProcA
DefWindowProcA
SetWindowLongA
DestroyWindow
UnhookWindowsHookEx
DestroyIcon
LoadStringA
GetWindowTextA
GetSysColorBrush
wsprintfA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
EnableWindow
SetTimer
GetDesktopWindow
LoadIconA
DrawIcon
GetClassNameA

gdi32

GetViewportExtEx
MoveToEx
GetWindowExtEx
CreatePen
CreateSolidBrush
CreatePatternBrush
GetMapMode
PatBlt
SetRectRgn
CreateRectRgn
CreateFontIndirectA
CopyMetaFileA
CreateDCA
GetTextMetricsA
GetTextExtentPoint32A
GetTextAlign
EnumFontFamiliesExA
UnrealizeObject
Rectangle
SelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
DeleteObject
GetCurrentPositionEx
CreateRectRgnIndirect
CreateBitmap
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetROP2
SetBkMode
GetStockObject
SelectObject
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CombineRgn
CreateMetaFileA
DeleteDC
CloseMetaFile
DeleteMetaFile
LPtoDP
GetDeviceCaps

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegDeleteKeyA
RegQueryValueA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegCreateKeyA
RegSetValueA
RegSetValueExA
RegOpenKeyA
RegEnumKeyA

shell32

ExtractIconA

comctl32

ord17

ole32

CoRegisterClassObject
CoCreateInstance
OleDuplicateData
CoRevokeClassObject
StringFromGUID2
CreateDataCache
CoTaskMemAlloc
OleLoadFromStream
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CreateDataAdviseHolder
ReleaseStgMedium
OleSaveToStream
CoTaskMemFree
CreateOleAdviseHolder
StringFromCLSID
CoDisconnectObject
ReadFmtUserTypeStg
ReadClassStm
CreateStreamOnHGlobal

olepro32

ord252
ord251
ord253
ord250

oleaut32

SysStringLen
SysAllocStringByteLen
SysAllocStringLen
VariantCopy
SysAllocString
VariantChangeType
VariantClear
LoadTypeLi
RegisterTypeLi
SysStringByteLen
SysFreeString
LoadRegTypeLi

ws2_32

closesocket
WSAStartup
WSASocketA
htonl
htons
bind
WSAAsyncSelect
inet_addr
WSACleanup
WSARecvFrom
WSASendTo

winmm

waveInStart
waveInReset
waveOutReset
waveInUnprepareHeader
waveOutUnprepareHeader
waveInClose
waveOutClose
waveOutWrite
waveInStop
waveOutOpen
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveOutPrepareHeader

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
readme.txt
˵.htm
.html

Sharing

General

Malware Config

Signatures

Files

fc4670872d72cdf946febce996a7513f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

wsock32

Exports

Exports

Sections

.text Size: 144KB - Virtual size: 140KB

.rdata Size: 92KB - Virtual size: 89KB

.data Size: 12KB - Virtual size: 16KB

.reloc Size: 12KB - Virtual size: 8KB

e31a9a4686544932219eb31d3898d957

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

version

gdi32

ole32

comctl32

shell32

wininet

comdlg32

winmm

wsock32

ring

Sections

CODE Size: - Virtual size: 695KB

DATA Size: - Virtual size: 12KB

BSS Size: - Virtual size: 4KB

.idata Size: - Virtual size: 11KB

.tls Size: - Virtual size: 20B

.rdata Size: - Virtual size: 24B

.UPX0 Size: - Virtual size: 48KB

.rsrc Size: 28KB - Virtual size: 127KB

.UPX1 Size: - Virtual size: 1.7MB

.UPX2 Size: 2.2MB - Virtual size: 2.2MB

.reloc Size: 512B - Virtual size: 88B

fce50bf1c0506c8e10587d0d2d52c136

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

olepro32

oleaut32

ws2_32

winmm

Exports

Exports

Sections

.text Size: 196KB - Virtual size: 195KB

.rdata Size: 48KB - Virtual size: 46KB

.data Size: 36KB - Virtual size: 68KB

.rsrc Size: 12KB - Virtual size: 8KB

.reloc Size: 28KB - Virtual size: 24KB

b3a6bd4245297802b29299564eb587d7

Headers

File Characteristics

Imports

.text
Size: 144KB - Virtual size: 140KB

.rdata
Size: 92KB - Virtual size: 89KB

.data
Size: 12KB - Virtual size: 16KB

.reloc
Size: 12KB - Virtual size: 8KB

CODE
Size: - Virtual size: 695KB

DATA
Size: - Virtual size: 12KB

BSS
Size: - Virtual size: 4KB

.idata
Size: - Virtual size: 11KB

.tls
Size: - Virtual size: 20B

.rdata
Size: - Virtual size: 24B

.UPX0
Size: - Virtual size: 48KB

.rsrc
Size: 28KB - Virtual size: 127KB

.UPX1
Size: - Virtual size: 1.7MB

.UPX2
Size: 2.2MB - Virtual size: 2.2MB

.reloc
Size: 512B - Virtual size: 88B

.text
Size: 196KB - Virtual size: 195KB

.rdata
Size: 48KB - Virtual size: 46KB

.data
Size: 36KB - Virtual size: 68KB

.rsrc
Size: 12KB - Virtual size: 8KB

.reloc
Size: 28KB - Virtual size: 24KB

CODE
Size: - Virtual size: 452KB

DATA
Size: - Virtual size: 6KB

BSS
Size: - Virtual size: 4KB

.idata
Size: - Virtual size: 9KB

.tls
Size: - Virtual size: 20B

.rdata
Size: - Virtual size: 24B

.UPX0
Size: - Virtual size: 34KB

.rsrc
Size: 28KB - Virtual size: 55KB

.UPX1
Size: - Virtual size: 699KB

.UPX2
Size: 983KB - Virtual size: 982KB

.reloc
Size: 512B - Virtual size: 184B

.text
Size: 196KB - Virtual size: 195KB

.rdata
Size: 48KB - Virtual size: 46KB

.data
Size: 36KB - Virtual size: 68KB

.rsrc
Size: 12KB - Virtual size: 8KB

.reloc
Size: 28KB - Virtual size: 24KB