3478e26fbe127ad772adc52fee73bf06a70c8df0fb657dba54e6bdcd4723e946

Sharing

Copy URL Twitter E-mail

General

Target

3478e26fbe127ad772adc52fee73bf06a70c8df0fb657dba54e6bdcd4723e946
Size

424KB
MD5

87dba50ff3ddeebc2393c82f09dfbf32
SHA1

351d5cc075248d025381dad369f7d94e115b65ab
SHA256

3478e26fbe127ad772adc52fee73bf06a70c8df0fb657dba54e6bdcd4723e946
SHA512

598d4e3c68b3a554b9accbc9b8c7d95dc164afd1df114640b257c6dbf8417c593be921ae07f3b7733b16e7fd633042ea6309d36ba7fd59b1852f231f976925ce
SSDEEP

6144:+eoIbZD+MKgyUdLDreEpBefBOYjJZfs6TSN16TXf16oSG1DTSXTr3iUhGEoD92YX:5G6LeE0pFXQkphhB

Score

N/A

Malware Config

Signatures

Files

3478e26fbe127ad772adc52fee73bf06a70c8df0fb657dba54e6bdcd4723e946
.exe windows x86

cbae53cfc9e9aab397607d5f2b187024

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidFromStringW

bdutils

?Trace@CBDDebug@@QAAXPB_WZZ
??0CBDDebug@@QAE@H@Z
??1CBDDebug@@QAE@XZ
?SetOutputFile@CBDDebug@@QAEXPB_W@Z
?SetFileMode@CBDDebug@@QAEXH@Z
?SetMode@CBDDebug@@QAEXH@Z

txmlutil

??0TiXmlDocument@@QAE@XZ
??1TiXmlDocument@@UAE@XZ
?QueryIntAttribute@TiXmlElement@@QBEHPB_WPAH@Z
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?NewElementFromText@CBDTinyXml@@SAPAVTiXmlElement@@PB_W@Z
?Attribute@TiXmlElement@@QBEPB_WPB_W@Z
??0CBDTinyXml@@QAE@XZ
?LoadFile@CBDTinyXml@@UAE_NPB_W@Z
?GetRootElement@CBDTinyXml@@QAEPAVTiXmlElement@@XZ
??1CBDTinyXml@@QAE@XZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@PB_W@Z
?Parse@CBDTinyXml@@QAE_NPB_W@Z
?SetAttribute@TiXmlElement@@QAEXPB_WH@Z
?SaveFile@CBDTinyXml@@UBE_NPB_W@Z
?GetText@TiXmlElement@@QBEPB_WXZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@PB_W@Z

npcomm

?releaseEndpoint@NpcPipeEndpoint@@SAXPAV1@@Z
?getNewEndpoint@NpcPipeEndpoint@@SAPAV1@XZ

issues

?CloseDialogs@@YAHPAX@Z
?ShowIssuesDialog@@YAHPAXPAVCWnd@@PB_WHJ@Z
?AddIssues@@YAHPAX@Z
?InitIssues@@YAPAXPAVNpcPipeEndpoint@@P6AHPAXW4RequestMessage@@1@Z@Z
?UnInitIssues@@YAXPAX@Z
?GetIssues@@YAPBV?$map@JVCIssue@@U?$less@J@std@@V?$allocator@U?$pair@$$CBJVCIssue@@@std@@@3@@std@@PAX@Z
?FixIssue@@YAHPAXJ@Z
?ProcessData@@YAHPAXW4ProcessMessage@@0@Z

bdguictl

??0CBDGDIManager@@QAE@XZ
ord1
?SetGDIManager@CBDBaseCtrl@@QAEXPAVCBDGDIManager@@@Z
??1CBDDialog@@UAE@XZ
??0CBDDialog@@QAE@HPAVCWnd@@K@Z
?Init@CBDGDIManager@@QAE_NPB_W@Z
??1CBDGDIManager@@UAE@XZ

wtsapi32

WTSRegisterSessionNotification

mfc80u

ord293
ord2311
ord2680
ord4027
ord266
ord1571
ord762
ord3678
ord2388
ord2404
ord2384
ord931
ord927
ord929
ord925
ord920
ord1899
ord5229
ord5231
ord5956
ord1591
ord4276
ord4716
ord3397
ord2366
ord4255
ord4480
ord5210
ord3943
ord4179
ord2638
ord6271
ord3703
ord5067
ord3713
ord5148
ord3712
ord4238
ord2527
ord1393
ord2640
ord3940
ord2534
ord1608
ord2856
ord1611
ord2708
ord5911
ord3590
ord4301
ord6721
ord2829
ord2725
ord2159
ord2531
ord572
ord4347
ord5196
ord760
ord1590
ord1646
ord1647
ord1955
ord5171
ord1353
ord4961
ord3339
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2397
ord2409
ord2386
ord1894
ord2402
ord2407
ord2390
ord2392
ord2394
ord2239
ord4475
ord2832
ord5562
ord5524
ord5209
ord5226
ord4562
ord3942
ord5222
ord5220
ord900
ord2925
ord3824
ord1911
ord1049
ord3826
ord757
ord5378
ord6177
ord6215
ord5096
ord1007
ord2461
ord3800
ord5579
ord2009
ord2054
ord4320
ord1058
ord6274
ord3795
ord6272
ord4008
ord4032
ord1156
ord1123
ord5119
ord1139
ord3677
ord5971
ord1079
ord566
ord287
ord2460
ord5398
ord6700
ord1121
ord282
ord1086
ord1479
ord334
ord593
ord5113
ord3327
ord4100
ord314
ord6751
ord1472
ord1110
ord1064
ord1067
ord1236
ord4193
ord3930
ord2793
ord6083
ord3785
ord4664
ord6253
ord2560
ord2139
ord4361
ord4357
ord4494
ord2549
ord5511
ord2674
ord290
ord2723
ord6157
ord2257
ord2260
ord6133
ord1384
ord4026
ord985
ord5484
ord2365
ord5388
ord3706
ord3698
ord2812
ord3894
ord1975
ord2632
ord6061
ord6278
ord2468
ord860
ord6063
ord1386
ord6147
ord4920
ord3175
ord4256
ord2709
ord577
ord5199
ord1392
ord1609
ord5908
ord6086
ord6720
ord1542
ord2121
ord1661
ord4334
ord1662
ord2011
ord4884
ord4729
ord4206
ord5178
ord2941
ord3395
ord2636
ord3596
ord604
ord350
ord4119
ord2132
ord5821
ord2809
ord4573
ord5813
ord280
ord3249
ord5316
ord776
ord896
ord1172
ord6282
ord899
ord283
ord1176
ord774
ord2340
ord5485
ord1182
ord777
ord2683
ord1178
ord1908
ord5327
ord6293
ord265
ord764
ord581
ord1200
ord1162
ord1087
ord315
ord765
ord1198
ord5118
ord3634

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
__CxxFrameHandler3
memset
_CxxThrowException
_vsnwprintf
vswprintf_s
_vscwprintf
_wtoi
iswdigit
calloc
memmove_s
wcsrchr
wcscpy_s
swprintf_s
wcsstr
wcscat_s
_wcsicmp
_recalloc
memcpy_s
free
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
_localtime64_s
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
malloc
_difftime64
??0exception@std@@QAE@ABQBD@Z
_time64
??0exception@std@@QAE@XZ
_wtoi64
_purecall
wcsncpy_s
memcpy
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
wcschr
_wcmdln

kernel32

GetModuleHandleW
FreeLibrary
LoadLibraryExW
GetLastError
GetDateFormatW
MultiByteToWideChar
GetTimeFormatW
InitializeCriticalSection
GetTickCount
SizeofResource
LeaveCriticalSection
IsDebuggerPresent
InterlockedDecrement
lstrlenW
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
LocalAlloc
LocalFree
GetProcessHeap
HeapFree
CreateSemaphoreW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
InterlockedExchange
GetCurrentProcess
lstrcmpiW
LockResource
GetVersionExA
GetACP
GetLocaleInfoA
GetThreadLocale
LoadResource
UnhandledExceptionFilter
DeleteCriticalSection
RaiseException
GetModuleFileNameW
EnterCriticalSection
FindResourceW
InterlockedIncrement
WTSGetActiveConsoleSessionId
GetVersionExW
WaitForSingleObject
CreateThread
ResumeThread
OpenEventW
Sleep
CreateEventW
SetEvent
ResetEvent
CopyFileW
CloseHandle
GetCommandLineW
LoadLibraryW
GetProcAddress
ReleaseSemaphore
FindFirstFileW
FindClose
GetCurrentProcessId

user32

GetParent
CharNextW
PostMessageW
IsWindow
SetForegroundWindow
GetForegroundWindow
EnableWindow
AttachThreadInput
GetWindowThreadProcessId
BringWindowToTop
SetWindowLongW
SystemParametersInfoW
SendMessageW
GetWindowLongW
AppendMenuW
UnregisterClassA
GetSystemMenu
KillTimer
PostQuitMessage
SetTimer
LoadIconW
CloseWindow
PostThreadMessageW
GetActiveWindow
GetClientRect
SetParent
GetWindowRect
ShowWindow

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW
RegQueryInfoKeyW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

comctl32

ord17

shlwapi

PathRemoveFileSpecW
PathAppendW
PathRemoveBackslashW

ole32

CoInitialize
OleRun
CoCreateInstance
StringFromGUID2
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize

oleaut32

VarUI4FromStr
LoadRegTypeLi
VarBstrCmp
VariantClear
VariantInit
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
SysAllocStringLen
SysFreeString
LoadTypeLi
SysStringLen

msvcp80

??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cbae53cfc9e9aab397607d5f2b187024

Headers

File Characteristics

Imports

rpcrt4

bdutils

txmlutil

npcomm

issues

bdguictl

wtsapi32

mfc80u

msvcr80

kernel32

user32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

msvcp80

Sections

.text Size: 120KB - Virtual size: 119KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 16KB - Virtual size: 14KB

.rsrc Size: 228KB - Virtual size: 228KB

.text
Size: 120KB - Virtual size: 119KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 16KB - Virtual size: 14KB

.rsrc
Size: 228KB - Virtual size: 228KB