3dd06114239b34dbda8ff8bc6e462a9ff1d9a55cfe5abd96ae12ae5c93cdcd08

Sharing

Copy URL Twitter E-mail

General

Target

3dd06114239b34dbda8ff8bc6e462a9ff1d9a55cfe5abd96ae12ae5c93cdcd08
Size

4.5MB
MD5

5a262c863b8347120b153610647ae25f
SHA1

a189e2eb9628d98108ab453098a175f29a919edd
SHA256

3dd06114239b34dbda8ff8bc6e462a9ff1d9a55cfe5abd96ae12ae5c93cdcd08
SHA512

c83b1458b5d3edccb3a5b63549a3b02c033be64224565c392d8754c070e1f0402ca4e1b63491770db601cd519267149dd57eb4ae2d87e814628293a27d10aae0
SSDEEP

49152:5zn73CXj04Wkbb+E7TYrOASCy+PvHAEmxO1TBVU2ge2/0vRCXcrHIWCFfRm3bm+N:pCY4WkX+EgjPvXoqj7N8Mr4my+N

Score

N/A

Malware Config

Signatures

Files

3dd06114239b34dbda8ff8bc6e462a9ff1d9a55cfe5abd96ae12ae5c93cdcd08
.exe windows x86

2a8337648e34470801241eb8e57c09b7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

shlwapi

PathMakeSystemFolderA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

ws2_32

gethostname
WSAStartup
WSACleanup

mfc42

ord6021
ord1641
ord1640
ord323
ord470
ord6197
ord6453
ord3610
ord5265
ord4376
ord4853
ord4998
ord6052
ord1775
ord5280
ord4425
ord3597
ord324
ord2289
ord2370
ord2302
ord4234
ord5953
ord4710
ord5981
ord3092
ord6334
ord2301
ord6380
ord6215
ord6199
ord1768
ord1158
ord2820
ord3811
ord551
ord6663
ord922
ord939
ord926
ord4202
ord3619
ord4299
ord6880
ord6605
ord6283
ord6282
ord4204
ord6379
ord3874
ord6378
ord2860
ord5875
ord3089
ord613
ord289
ord5651
ord3127
ord3616
ord958
ord1979
ord6385
ord665
ord5186
ord350
ord354
ord5442
ord715
ord415
ord693
ord6883
ord6143
ord2582
ord4402
ord3370
ord3640
ord6377
ord2575
ord2642
ord2859
ord4476
ord3698
ord765
ord3573
ord6170
ord3797
ord6194
ord4287
ord4284
ord2243
ord5787
ord283
ord5856
ord5572
ord4133
ord4297
ord5788
ord472
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord616
ord2298
ord3317
ord3097
ord3178
ord3318
ord1948
ord2396
ord3346
ord5300
ord5303
ord4079
ord4699
ord5307
ord5289
ord5715
ord4622
ord817
ord565
ord2726
ord4226
ord924
ord859
ord2450
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord5302
ord4698
ord5714
ord3738
ord561
ord815
ord2725
ord5232
ord5718
ord2147
ord1180
ord1568
ord5268
ord3742
ord818
ord777
ord4317
ord6267
ord506
ord556
ord809
ord6358
ord1088
ord2122
ord3988
ord5608
ord5861
ord5823
ord3664
ord5641
ord1871
ord6571
ord5460
ord1081
ord3993
ord996
ord2775
ord5605
ord2822
ord654
ord341
ord5773
ord5858
ord6140
ord6010
ord5603
ord2754
ord5785
ord2405
ord755
ord3596
ord5864
ord6061
ord5571
ord5579
ord5736
ord5678
ord5794
ord5789
ord5873
ord6172
ord6189
ord4330
ord6186
ord5756
ord6192
ord5759
ord2971
ord2414
ord3626
ord567
ord3571
ord3721
ord3402
ord5277
ord4407
ord4277
ord2763
ord6662
ord4278
ord541
ord801
ord536
ord823
ord3311
ord2915
ord2393
ord2764
ord5683
ord1106
ord1175
ord3319
ord860
ord2770
ord2781
ord4058
ord3181
ord1980
ord356
ord268
ord5710
ord4129
ord6877
ord1567
ord668
ord539
ord2919
ord2614
ord941
ord940
ord4203
ord3663
ord1146
ord1644
ord2863
ord6270
ord2438
ord3654
ord2584
ord4220
ord2864
ord540
ord4160
ord4224
ord800
ord537
ord1168
ord1669
ord2514
ord2379
ord795
ord656
ord609
ord640
ord641
ord858
ord535
ord2818
ord1200
ord2652
ord4275
ord825
ord3574
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord6055
ord2452
ord1576

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
wcscmp
wcsrchr
_wcsicmp
wcsncpy
_wcsdup
gmtime
_vsnprintf
strstr
_utime
_chmod
_fileno
_chsize
_strdup
_strlwr
fprintf
fflush
strtok
sscanf
calloc
_CIpow
_fpclass
_finite
_mbsnbicmp
_mbsnbcmp
tolower
toupper
_mbsnbset
vsprintf
_mbsicoll
_mbscoll
_mbscspn
_mbsspn
_mbspbrk
_mbsstr
_mbschr
_ismbcspace
_mbsinc
memmove
_mbsrev
_mbslwr
_mbsupr
_mbsnbcpy
_mbsicmp
strchr
remove
wcscpy
strrchr
_wstat
_wfopen
ftell
fclose
fread
fwrite
_errno
fopen
fseek
realloc
localtime
strftime
malloc
atof
strncpy
atoi
_strrev
_ftol
_stat
strerror
sprintf
wcslen
atol
__CxxFrameHandler
free
swprintf
_mbscmp
_mkdir
_access
_ltoa
_strcmpi
wcschr
wcscat
_setmbcp
_controlfp

kernel32

MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentDirectoryA
GetVersionExA
lstrcpynA
GetCurrentProcess
GetLocaleInfoA
lstrlenW
lstrlenA
OutputDebugStringA
GetCurrentProcessId
GetCurrentThreadId
GetFileSize
SystemTimeToFileTime
RemoveDirectoryA
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetModuleHandleA
GetWindowsDirectoryA
GetLocalTime
GetFileAttributesA
GetFileAttributesW
FindNextFileW
FindClose
FindFirstFileW
LocalFree
FormatMessageA
GetLastError
ResumeThread
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryA
DeleteFileA
WriteFile
CloseHandle
CreateFileA
CompareFileTime
GetFileAttributesExA
Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
GetDriveTypeA
GetTempFileNameA
GetTempPathA
GetDiskFreeSpaceA
GetEnvironmentVariableA
CopyFileA
SetFileAttributesA
CreateProcessA
GetStartupInfoA
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
LockResource
LoadResource
FindResourceA
SetFileTime
GetLogicalDrives
GetVolumeInformationA
GetDiskFreeSpaceExA
GetSystemDirectoryA
CopyFileW
ReadFile
GetFileAttributesExW
CreateDirectoryW
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
CreateFileW
GetModuleFileNameA
SizeofResource

user32

GetSystemMenu
AppendMenuA
SetWindowRgn
MessageBoxExA
ModifyMenuA
RemoveMenu
ScreenToClient
GetWindow
SendNotifyMessageA
ExitWindowsEx
SetCursorPos
ShowCursor
GetWindowLongA
SetWindowLongA
SetWindowTextA
MessageBoxA
SetCursor
FillRect
RedrawWindow
GetSysColor
PeekMessageA
DispatchMessageA
SystemParametersInfoA
GetDC
GetForegroundWindow
SendInput
LoadImageA
ClientToScreen
SetCapture
FindWindowA
DrawIcon
GetClassNameA
ReleaseDC
KillTimer
UpdateWindow
GetWindowRect
GetSystemMetrics
OffsetRect
LoadIconA
wsprintfA
SetTimer
MessageBeep
SetActiveWindow
GrayStringA
DrawTextA
TabbedTextOutA
LoadBitmapA
GetClientRect
ReleaseCapture
IsIconic
GetActiveWindow
IsWindowEnabled
FrameRect
DrawEdge
InvalidateRect
DrawFocusRect
SetForegroundWindow
IsWindow
EnableWindow
EnableMenuItem
CheckMenuItem
GetDesktopWindow
PtInRect
ShowWindow
InsertMenuA
GetCapture
PostThreadMessageA
LoadMenuA
GetCursorPos
GetSubMenu
GetParent
SendMessageA
PostMessageA
EnumWindows
TranslateMessage

gdi32

CreateFontA
CreateRectRgn
CombineRgn
SetROP2
FrameRgn
ExtCreateRegion
OffsetRgn
GetDeviceCaps
Rectangle
GetViewportOrgEx
SetViewportOrgEx
DeleteObject
CreateSolidBrush
SelectObject
CreateFontIndirectA
GetStockObject
Escape
ExtTextOutA
GetObjectA
CreateCompatibleDC
LPtoDP
CreateCompatibleBitmap
GetMapMode
DPtoLP
GetBkColor
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
CreateBitmap
DeleteDC
BitBlt
GetPixel

advapi32

CryptDestroyKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDestroyHash
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGetUserKey
CryptExportKey
CryptGenKey
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegSaveKeyA
RegCreateKeyExA

shell32

Shell_NotifyIconA
ShellExecuteA
DragQueryFileA
DragQueryFileW

comctl32

ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
_TrackMouseEvent

ole32

StgCreateDocfileOnILockBytes
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal

olepro32

ord251

oleaut32

SysAllocStringLen

Exports

Exports

OTI_AddFile
OTI_AddFileW
OTI_CheckArchiveFile
OTI_CheckFileExisted
OTI_CompressArchive
OTI_DeleteFile
OTI_ExtractFile
OTI_GetCumulatedDeletedSize
OTI_ListFile
OTI_UpdatePassword

Sections

.text
Size: 488KB - Virtual size: 485KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2a8337648e34470801241eb8e57c09b7

Headers

File Characteristics

Imports

rpcrt4

shlwapi

version

ws2_32

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

olepro32

oleaut32

Exports

Exports

Sections

.text Size: 488KB - Virtual size: 485KB

.rdata Size: 88KB - Virtual size: 85KB

.data Size: 20KB - Virtual size: 323KB

.rsrc Size: 4.0MB - Virtual size: 4.0MB

.text
Size: 488KB - Virtual size: 485KB

.rdata
Size: 88KB - Virtual size: 85KB

.data
Size: 20KB - Virtual size: 323KB

.rsrc
Size: 4.0MB - Virtual size: 4.0MB