fa6034c580aff6a35e913210fbcc7a4d7f788908a6d3d460f7bcd35ba9ea2bca

Sharing

Copy URL Twitter E-mail

General

Target

fa6034c580aff6a35e913210fbcc7a4d7f788908a6d3d460f7bcd35ba9ea2bca
Size

383KB
MD5

18edfa6af99bc66e7fef3fbd6f1ca3c0
SHA1

70202686bd947df6cd894a781f395ea79d4613a8
SHA256

fa6034c580aff6a35e913210fbcc7a4d7f788908a6d3d460f7bcd35ba9ea2bca
SHA512

780003f001d433062a89713628bc0c187709e3256ffedb0cb9ff33e11a93f583cd32e1bc49ee0150fd37d9cd6df1714facb55beff39dd12f74f384714b0a3476
SSDEEP

6144:jpgXVItWu6q0kD7ijTBqlXOuplC3B+GJjLYRVvZ4zytbLL:jp6ItJpGjTsF1RVh4zk3

Score

N/A

Malware Config

Signatures

Files

fa6034c580aff6a35e913210fbcc7a4d7f788908a6d3d460f7bcd35ba9ea2bca
.exe windows x86

aeadcd64bd058ec0190a6262045794ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc90u

ord4009
ord4043
ord794
ord296
ord589
ord3670
ord4905
ord3115
ord6018
ord5663
ord5680
ord4996
ord4347
ord2447
ord5676
ord5674
ord3217
ord2087
ord4213
ord5830
ord6741
ord5548
ord1048
ord4179
ord6035
ord2206
ord2251
ord4747
ord5008
ord3741
ord4000
ord1686
ord778
ord2283
ord2695
ord3355
ord6411
ord2431
ord1354
ord265
ord266
ord1493
ord4660
ord1248
ord2702
ord374
ord3515
ord4682
ord4516
ord938
ord1313
ord2676
ord1314
ord4527
ord4530
ord590
ord6807
ord795
ord6577
ord524
ord744
ord5182
ord2643
ord2644
ord2647
ord2646
ord2645
ord2596
ord3486
ord3543
ord813
ord3070
ord4774
ord1719
ord2444
ord2106
ord2537
ord1183
ord6604
ord4545
ord5664
ord3286
ord3768
ord611
ord4652
ord1665
ord3489
ord2274
ord4044
ord333
ord3488
ord6187
ord5867
ord6094
ord6095
ord4131
ord2592
ord4410
ord4541
ord2901
ord6109
ord3622
ord3953
ord797
ord1262
ord6636
ord4741
ord1149
ord683
ord4550
ord2194
ord1376
ord4549
ord5397
ord4933
ord5382
ord5079
ord5401
ord5491
ord5239
ord5142
ord5230
ord5400
ord4798
ord4797
ord4707
ord5228
ord5384
ord5105
ord4942
ord5760
ord4904
ord4955
ord5407
ord5279
ord4927
ord4789
ord4861
ord5487
ord4987
ord5356
ord4946
ord4945
ord5349
ord4109
ord4866
ord4865
ord5224
ord4622
ord5214
ord4810
ord5418
ord4589
ord4596
ord5016
ord5209
ord4807
ord4823
ord4820
ord4802
ord4805
ord4800
ord4681
ord3654
ord595
ord2069
ord2597
ord1250
ord1254
ord1599
ord286
ord4324
ord909
ord2479
ord939
ord935
ord4548
ord4618
ord600
ord3830
ord3965
ord6579
ord2904
ord639
ord5632
ord4631
ord5167
ord5324
ord2208
ord1810
ord1809
ord1675
ord3353
ord6408
ord1754
ord1751
ord4345
ord1492
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord5653
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord2619
ord5296
ord5293
ord4378
ord3354
ord6410
ord1753
ord3681
ord1440
ord5616
ord4693
ord430
ord2694
ord5851
ord4519
ord811
ord4442
ord280
ord1137
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord2139
ord1792
ord1791
ord1727
ord5650
ord2771
ord2983
ord6635
ord5656
ord5408
ord4785
ord1272
ord799
ord3220
ord285
ord3112
ord4728
ord2966
ord3140
ord2774
ord2893
ord2764
ord6630
ord3185
ord1607
ord4448
ord4423
ord6801
ord4173
ord6065
ord6803
ord3242
ord4080
ord4081
ord4071
ord2891
ord4348
ord4910
ord801

msvcr90

_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
wcsncat
mbstowcs
strnlen
wcstombs
strncpy_s
strtok_s
atoi
ferror
fseek
ftell
fread
fopen
_wcsdup
_wsplitpath
_wmakepath
clock
_snwprintf_s
_wfopen
mbstowcs_s
_wcsupr_s
towupper
_wcsupr
_swprintf
wcsncpy
_snwprintf
realloc
_errno
calloc
strtoul
memcpy
_wsopen
_lseek
_close
_read
_filelength
_purecall
_wsplitpath_s
wcsncmp
wcscpy
iswalnum
iswspace
vswprintf_s
srand
rand
wcscmp
wcslen
wcsncat_s
malloc
wcschr
__wgetmainargs
_amsg_exit
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
fgets
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_wcslwr_s
_localtime32_s
fopen_s
_wasctime_s
_itow_s
wcstombs_s
fwrite
memmove_s
_wfopen_s
feof
fclose
_wunlink
_wtoi
_time32
swprintf_s
wcsncpy_s
_time64
memset
_wcsnicmp
__CxxFrameHandler3
free
_wcsicmp
swscanf_s
wcstod
wcscat_s
wcscpy_s
_waccess
wcsrchr
wcsstr
memcpy_s
_localtime64_s

kernel32

ExpandEnvironmentStringsA
GetFileSize
ReadFile
GetFileTime
DosDateTimeToFileTime
LoadLibraryA
SetFileTime
lstrcmpiW
GetFullPathNameW
lstrlenA
lstrlenW
WideCharToMultiByte
CreateThread
GetExitCodeThread
GetLocalTime
GetLocaleInfoW
GetModuleHandleW
GetProcAddress
GetSystemInfo
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
CreateMutexW
OpenMutexW
ReleaseMutex
WriteFile
GetFileAttributesW
SetFileAttributesW
CreateProcessW
GetExitCodeProcess
CreateEventW
WaitForSingleObject
DeleteFileW
CreateFileW
CloseHandle
WritePrivateProfileStringW
LoadLibraryExW
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
SetErrorMode
OpenProcess
GlobalAlloc
GlobalFree
GetComputerNameW
LocalFileTimeToFileTime
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
FindFirstFileW
RemoveDirectoryW
FindNextFileW
GetLastError
FindClose
GetPrivateProfileStringW
GetTempPathW
GetPrivateProfileSectionW
MoveFileExW
CreateDirectoryW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
Sleep
GetModuleFileNameW
GetCommandLineW
LoadLibraryW
MulDiv
FreeLibrary
MultiByteToWideChar

user32

BeginDeferWindowPos
LoadStringW
DestroyIcon
InvalidateRect
FillRect
DrawIconEx
LoadIconW
InflateRect
DrawStateW
ScreenToClient
IsWindow
GetFocus
GetLastActivePopup
GetActiveWindow
EndDeferWindowPos
DeferWindowPos
IsWindowVisible
LoadBitmapW
EqualRect
LoadImageW
SystemParametersInfoW
FindWindowW
MonitorFromWindow
MonitorFromPoint
GetSystemMetrics
GetForegroundWindow
MonitorFromRect
GetMonitorInfoW
GetWindowTextW
SetLayeredWindowAttributes
KillTimer
SetTimer
GetClientRect
IsIconic
GetSystemMenu
EnableMenuItem
DrawIcon
CopyRect
MessageBoxW
wsprintfW
GetDC
ReleaseDC
GetParent
GetWindowRect
PostMessageW
GetClassNameW
EnableWindow
SendMessageW

gdi32

SetPixel
RoundRect
CreatePen
CreateSolidBrush
GetTextExtentPoint32W
GetPixel
GetDeviceCaps

advapi32

LookupAccountSidW
DuplicateTokenEx
ImpersonateLoggedOnUser
SetThreadToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
GetUserNameW
RevertToSelf
OpenProcessToken
RegCreateKeyExW
RegSetValueExW
InitializeSecurityDescriptor
GetTokenInformation

shell32

ord680
ShellExecuteW
SHAppBarMessage

comctl32

ord17
_TrackMouseEvent

shlwapi

AssocQueryStringW

ole32

CoUninitialize
CoInitialize

oleaut32

SysFreeString
VariantClear
SysAllocString

msvcp90

?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

ccwkrlib

?readData@CCWCConfig@@UAEXPAUHINSTANCE__@@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?getProductVersion@CCWCConfig@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
??1CCWCConfig@@UAE@XZ
??0CCWCConfig@@QAE@PB_W@Z

netapi32

DsEnumerateDomainTrustsW
NetServerEnum
NetApiBufferFree
NetWkstaGetInfo

activeds

ord3

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yrdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

aeadcd64bd058ec0190a6262045794ab

Headers

DLL Characteristics

File Characteristics

Imports

mfc90u

msvcr90

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

msvcp90

ccwkrlib

netapi32

activeds

version

Sections

.text Size: 132KB - Virtual size: 131KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 6KB - Virtual size: 12KB

.rsrc Size: 28KB - Virtual size: 27KB

.yrdata Size: 72KB - Virtual size: 72KB

.text
Size: 132KB - Virtual size: 131KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 6KB - Virtual size: 12KB

.rsrc
Size: 28KB - Virtual size: 27KB

.yrdata
Size: 72KB - Virtual size: 72KB