bfc69c8c341b3591e95ebaa618cb809e4314292a7271991c0a07c8687314e3db

Sharing

Copy URL Twitter E-mail

General

Target

bfc69c8c341b3591e95ebaa618cb809e4314292a7271991c0a07c8687314e3db
Size

252KB
MD5

92cb581051b0d1aa31d8d7b4adf41ba0
SHA1

40b06243ced8196ae713dff91cbef7246e526f9b
SHA256

bfc69c8c341b3591e95ebaa618cb809e4314292a7271991c0a07c8687314e3db
SHA512

c3ef4a897e964a03a0a1c32b39eee4ed8d7e15b69443e85f3ed80a90521844b80e46b59bd69147818d85861d37c49999b01dd1cd2ab292650a15dbc87033de5f
SSDEEP

6144:ON06prgH46Hr0OkyQE6pfSfIfxHGxsrPCnhW12dFFdvUA6G127ZI:ONXqH4grvSaMrPy9Fdvp6iuZI

Score

N/A

Malware Config

Signatures

Files

bfc69c8c341b3591e95ebaa618cb809e4314292a7271991c0a07c8687314e3db
.cab
WebDvr.dll
.dll regsvr32 windows x86

0a677843243081eba8cb6adec17e3eeb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

dvrpc

?AttachCallback@dvrpClient@@QAEHPAXP6AH0IK@Z@Z
?SetDisplayMode@dvrpClient@@QAEHHH@Z
?SetUrl@dvrpClient@@QAEHPADH@Z
?Login@dvrpClient@@QAEHPAD0@Z
?IsConnected@dvrpClient@@QAEHXZ
?Logout@dvrpClient@@QAEHXZ
??0dvrpClient@@QAE@XZ
??1dvrpClient@@QAE@XZ

msvfw32

DrawDibOpen
DrawDibClose
DrawDibDraw

kernel32

IsDBCSLeadByte
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcatA
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
GlobalUnlock
lstrcpynA
LeaveCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GlobalLock
GlobalAlloc
GetLastError
GetACP
GetCPInfo
CreateFileA
SetFilePointer
HeapFree
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
TerminateProcess
WriteFile
FlushFileBuffers
CloseHandle
RtlUnwind
ExitProcess
VirtualAlloc
VirtualFree
lstrcmpiA
LoadLibraryExA
SizeofResource
FindResourceA
LoadResource
GetModuleFileNameA
FreeLibrary
WideCharToMultiByte
ReadFile
MultiByteToWideChar
HeapCreate
GetModuleHandleA
GetShortPathNameA
lstrlenA
lstrlenW
DisableThreadLibraryCalls
InitializeCriticalSection
Sleep
DeleteCriticalSection
SetEndOfFile
GetOEMCP
SetStdHandle
GetCommandLineA
GetVersion
GetVersionExA
GetEnvironmentVariableA
GetTimeZoneInformation
HeapAlloc
HeapReAlloc
GetLocalTime
GetSystemTime

user32

GetDC
GetParent
SetFocus
GetClientRect
CopyRect
SetRect
OffsetRect
FillRect
InvalidateRect
CharNextA
SetTimer
LoadMenuA
DefWindowProcA
TrackPopupMenu
GetSubMenu
ClientToScreen
KillTimer
GetKeyState
PtInRect
UnionRect
PostMessageA
CheckMenuItem
BeginPaint
EndPaint
DestroyMenu
ReleaseDC
IntersectRect
EqualRect
SetWindowRgn
SetWindowPos
IsWindow
ShowWindow
wsprintfA
GetFocus
IsChild
DestroyWindow
GetClassInfoExA
LoadCursorA
RegisterClassExA
CreateWindowExA
CallWindowProcA
GetWindowLongA
SetWindowLongA

gdi32

CloseMetaFile
GetDeviceCaps
LPtoDP
SetMapMode
CreateDCA
DeleteDC
SetViewportOrgEx
SaveDC
SetWindowOrgEx
CreateMetaFileA
DeleteMetaFile
CreateRectRgnIndirect
RestoreDC
CreateFontA
SelectObject
GetStockObject
SetTextColor
SetTextAlign
SetBkMode
TextOutA
DeleteObject
SetWindowExtEx

advapi32

RegEnumKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA

ole32

CoTaskMemRealloc
OleRegEnumVerbs
CoTaskMemFree
CoTaskMemAlloc
CreateDataAdviseHolder
OleRegGetUserType
OleRegGetMiscStatus
WriteClassStm
CoCreateInstance
OleLoadFromStream
OleSaveToStream
CreateOleAdviseHolder

oleaut32

SysAllocStringByteLen
OleCreatePropertyFrame
SysStringLen
LoadRegTypeLi
SysStringByteLen
VariantClear
VariantChangeType
RegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
VarUI4FromStr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebDvr.inf
dvr2kern.dll
.dll windows x86

10db2f3cade3c523435ce13390de63cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

telephone

ClientConnectInit
ConnectStop
ConnectStart
ServerConnectInit
TeleRecvPacketStreamAsync
TeleRecvResponseCode
TeleSendResponseCode
TeleSendRequestPacket
TeleRecvString
TeleSendPacketStreamAsync
Telegetack
Teleack
TeleSendPacketBinaryAsync
TeleRecvPacketBinaryAsync
ServerOfferingAnser
TeleSendString
TeleRecvRequestPacket

avifil32

AVISaveOptions
AVIStreamRelease
AVIFileRelease
AVIFileExit
AVIFileCreateStreamA
AVIFileOpenA
AVIFileInit
AVIStreamWrite
AVIStreamSetFormat
AVIMakeCompressedStream

msvfw32

ord2

vcodec

TermAudioDecode
InitAudioDecode
AudioDecode
AudioEncode
InitAudioEncode
TermAudioEncode

wsock32

inet_addr

jpgcodec

TermEncode
Encode
Decode
InitDecode
TermDecode
InitEncode

wscs

SendResponseCode
RecvString
RecvResponseCode
SendString
RecvRequestPacket
RecvPacketBinaryAsync
SendPacketBinaryAsync
ack
getack
SendPacketStreamAsync
RecvPacketStreamAsync
TermWinsock
DisconnectSocket
ConnectSocket
FindHost
InitWinsock
DestroySocket
WaitForClientRequest
CreateSocket
SendRequestPacket

winmm

timeKillEvent
timeSetEvent
timeGetTime

kernel32

GetStringTypeA
GetStringTypeW
LCMapStringW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
LCMapStringA
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetCurrentProcess
TerminateProcess
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleHandleA
FlushFileBuffers
ExitProcess
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetStdHandle
SetHandleCount
SetFilePointer
GetFileType
SetStdHandle
WriteFile
SetEndOfFile
GetVersion
CloseHandle
TerminateThread
CreateThread
LeaveCriticalSection
GetLocalTime
EnterCriticalSection
Sleep
InitializeCriticalSection
SetEvent
DeleteCriticalSection
GetWindowsDirectoryA
GetModuleFileNameA
CreateEventA
WaitForMultipleObjects
WaitForSingleObject
GetDiskFreeSpaceExA
GetDriveTypeA
GetPrivateProfileIntA
WritePrivateProfileStringA
ResetEvent
DeleteFileA
GetLastError
ResumeThread
CreateWaitableTimerA
SetWaitableTimer
SetThreadPriority
GetDateFormatA
FreeLibrary
GetProcAddress
LoadLibraryA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateMutexA
GetCurrentProcessId
ReleaseMutex
GetTempPathA
GetTempFileNameA
CreateDirectoryA
GetProcessHeap
HeapFree
CopyFileA
GetPrivateProfileStringA
WinExec
CreateFileA
DeviceIoControl
GetCommandLineA
RemoveDirectoryA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindNextFileA
FindFirstFileA
GetSystemTime
GetTimeZoneInformation
RtlUnwind
GetFileAttributesA
CompareStringA
CompareStringW
SetEnvironmentVariableA
ReadFile
HeapAlloc

user32

SetTimer
wvsprintfA
SendMessageTimeoutA
MessageBoxA
MsgWaitForMultipleObjects
FindWindowA
SendMessageA
KillTimer
GetDC
FillRect
OffsetRect
DrawTextA
ReleaseDC
SetRect
FrameRect
wsprintfA

gdi32

GetDeviceCaps
SetPixel
CreateCompatibleDC
CreateBitmap
SelectObject
DeleteDC
DeleteObject
GetPixel
GetStockObject
SetTextColor
SetBkMode

Exports

Exports

ActivateOverlay
AttatchUserData
BroadcastServerStatus
ClearOverlayScreen
CreatePlayer
CreateSimpleWebPage
DeletePlayer
DisableDibData
DrawMotionZone
EnableCaptureEx
EnableDibData
EnableFastBackwardPlay
EnableMotionDetection
EnableRecording
EnableSensor
EnableStorageRecycle
EnterAviWriterMode
ExitAviWriterMode
GetBoardId
GetHardwareSpec
GetLastDibFrame
GetLastDibFrameEx
GetRgbData
GetSensorInput
GetStorageStatus
InitDvr2
InitDvr2Driver
InitOverlay
InitSoundPlay
IsLiveBoardInstalled
IsLiveBoardVideoPresent
IsOverlaySupported
IsSoundCardInstalled
LockDayTimeTable
Login
Logout
MoveOverlay
PauseCapture
PlugIn_SetEvent
RequestEchoTest
RequestRemoteProc
ResetStorage
ResumeCapture
SetActiveAudioChannel
SetAgc
SetAlarmOut
SetAudioGainValue
SetBuzzer
SetCaptureColor
SetDate
SetDisplayMode
SetDvrpServerOption
SetExtMonitorOutput
SetExtMonitorOutput2
SetMinute
SetMonth
SetMotionDetectZone
SetPlayerBrightness
SetPlayerSharpBlur
SetRecordingFrameRate
SetRemoteBufferingUnit
SetSensorType
SetVideoSourceType
SetVisibleChannels
StartAviWriter
StartBackup
StartCapture
StartRecording
StartRemoteCaptureImage
StopAviWriter
StopCapture
StopRecording
StopRemoteCaptureImage
TermDvr2
TermDvr2Driver
TermOverlay
TermSoundPlay
UnlockDayTimeTable
play

Sections

.text
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sseg
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dvrpc.dll
.dll windows x86

315bcc02e13144c3865529d7304ff652

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

dvr2kern

Logout
SetDisplayMode
Login
StartRemoteCaptureImage
GetRgbData
CreatePlayer
DeletePlayer

kernel32

GetEnvironmentStringsW
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCommandLineA
GetVersion
HeapAlloc
HeapFree
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

Exports

Exports

??0dvrpClient@@QAE@XZ
??1dvrpClient@@QAE@XZ
??4dvrpClient@@QAEAAV0@ABV0@@Z
?AttachCallback@dvrpClient@@QAEHPAXP6AH0IK@Z@Z
?IsConnected@dvrpClient@@QAEHXZ
?Login@dvrpClient@@QAEHPAD0@Z
?Logout@dvrpClient@@QAEHXZ
?SetDisplayMode@dvrpClient@@QAEHHH@Z
?SetSocketTimeout@dvrpClient@@QAEHH@Z
?SetUrl@dvrpClient@@QAEHPADH@Z
?__notify0@dvrpClient@@QAEHPAX@Z
?__notify1@dvrpClient@@QAEHIPAX@Z

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
jpgcodec.dll
.dll windows x86

c68a98cc0c3e98a3a435847a8f84576b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

free
malloc
printf
_ftol
fclose
atoi
fscanf
fopen
vsprintf
_initterm
_adjust_fdiv

Exports

Exports

Decode
Encode
GetDecFrameInfo
GetEncFrameInfo
InitDecode
InitEncode
TermDecode
TermEncode

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 834B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
telephone.dll
.dll windows x86

07bee06fdf3909a762a1e560e7ebf36d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
LocalAlloc
LocalFree
LocalSize
CloseHandle
SetupComm
PurgeComm
ClearCommError
Sleep
GetLastError
ReadFile
GetOverlappedResult
WaitForSingleObject
WriteFile
CreateEventA
GetProcAddress
LoadLibraryA
SetEnvironmentVariableA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
CompareStringA
CompareStringW

user32

RemovePropA
SetPropA

wsock32

ntohl
htonl

Exports

Exports

ClientConnectInit
ConnectStart
ConnectStop
Line_ReplyError
MakeDummyData
ServerConnectInit
ServerOfferingAnser
TeleRecvPacketBinaryAsync
TeleRecvPacketBinarySync
TeleRecvPacketStreamAsync
TeleRecvPacketStreamSync
TeleRecvRequestPacket
TeleRecvResponseCode
TeleRecvString
TeleSendPacketBinaryAsync
TeleSendPacketBinarySync
TeleSendPacketStreamAsync
TeleSendPacketStreamSync
TeleSendRequestPacket
TeleSendResponseCode
TeleSendString
Teleack
Telegetack
Telesockgets
TestDummyData

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vcodec.dll
.dll windows x86

f4eece3455122e92593ed52c10e509c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
HeapFree
GetCommandLineA
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Exports

Exports

AudioDecode
AudioEncode
InitAudioDecode
InitAudioEncode
TermAudioDecode
TermAudioEncode

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wscs.dll
.dll windows x86

63ac42605b5c2e6ba408a98632287a38

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
Sleep
ResumeThread
CreateThread
SetEnvironmentVariableA
CompareStringW
CompareStringA
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetEndOfFile
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
ReadFile
HeapFree
CloseHandle
InitializeCriticalSection
SetStdHandle
GetFileType
SetFilePointer
SetHandleCount
GetStdHandle
GetStartupInfoA
DeleteCriticalSection
WriteFile
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
RtlUnwind
FlushFileBuffers
CreateFileA
GetCPInfo

wsock32

connect
WSAGetLastError
gethostbyname
listen
accept
inet_addr
socket
setsockopt
htons
bind
closesocket
htonl
ntohl
WSAStartup
WSACleanup
select
__WSAFDIsSet
recv
send

Exports

Exports

ConnectSocket
CreateSocket
DestroySocket
DisconnectSocket
DownloadFile
FindHost
InitWinsock
RecvPacketBinaryAsync
RecvPacketBinarySync
RecvPacketStreamAsync
RecvPacketStreamSync
RecvRequestPacket
RecvResponseCode
RecvString
SendPacketBinaryAsync
SendPacketBinarySync
SendPacketStreamAsync
SendPacketStreamSync
SendRequestPacket
SendResponseCode
SendString
TermWinsock
UploadFile
WaitForClientRequest
ack
getack
sockgets

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0a677843243081eba8cb6adec17e3eeb

Headers

File Characteristics

Imports

dvrpc

msvfw32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 59KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 24KB - Virtual size: 27KB

.rsrc Size: 8KB - Virtual size: 6KB

.reloc Size: 8KB - Virtual size: 6KB

10db2f3cade3c523435ce13390de63cd

Headers

File Characteristics

Imports

telephone

avifil32

msvfw32

vcodec

wsock32

jpgcodec

wscs

winmm

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 176KB - Virtual size: 173KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 36KB - Virtual size: 1.0MB

.sseg Size: 4KB - Virtual size: 2KB

.reloc Size: 16KB - Virtual size: 14KB

315bcc02e13144c3865529d7304ff652

Headers

File Characteristics

Imports

dvr2kern

kernel32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 21KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 13KB

.reloc Size: 4KB - Virtual size: 3KB

c68a98cc0c3e98a3a435847a8f84576b

Headers

File Characteristics

Imports

msvcrt

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 8KB - Virtual size: 10KB

.reloc Size: 4KB - Virtual size: 834B

07bee06fdf3909a762a1e560e7ebf36d

Headers

File Characteristics

Imports

kernel32

user32

wsock32

.text
Size: 60KB - Virtual size: 59KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 24KB - Virtual size: 27KB

.rsrc
Size: 8KB - Virtual size: 6KB

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 176KB - Virtual size: 173KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 36KB - Virtual size: 1.0MB

.sseg
Size: 4KB - Virtual size: 2KB

.reloc
Size: 16KB - Virtual size: 14KB

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 13KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 8KB - Virtual size: 10KB

.reloc
Size: 4KB - Virtual size: 834B

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 23KB

.reloc
Size: 8KB - Virtual size: 5KB

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 12KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 36KB - Virtual size: 33KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 16KB

.reloc
Size: 4KB - Virtual size: 3KB