27a3727243022ce1b357e997d8b02a3fc81a68f2939b07ad220b9b3c389ed490

Sharing

Copy URL Twitter E-mail

General

Target

27a3727243022ce1b357e997d8b02a3fc81a68f2939b07ad220b9b3c389ed490
Size

4.2MB
MD5

143912a5f20497557df90417030d45b0
SHA1

1564c0c0912d7c4603e5e9edc44216280aa3ab6b
SHA256

27a3727243022ce1b357e997d8b02a3fc81a68f2939b07ad220b9b3c389ed490
SHA512

e06f2b63163bb5014f4c674ba4879b96ce014c56f2bc15e75a83fe39c1057fe55125cc77f460d99a5c2533a189ad7aa565e3ddb8e5167700b5d7d8b32b4d6cb8
SSDEEP

12288:L8/OzQDVUKmw0lxSLrgrbe7l8Uh1wsLvbIcGwQyZ7XVK:LCOzQDVUKR0lxSLZR1wIswPXs

Score

N/A

Malware Config

Signatures

Files

27a3727243022ce1b357e997d8b02a3fc81a68f2939b07ad220b9b3c389ed490
.exe windows x86

cd570f947d0398e88e98a08295987a83

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord4159
ord6117
ord2621
ord1134
ord617
ord5301
ord5214
ord296
ord1199
ord1205
ord4563
ord5092
ord4554
ord5122
ord5127
ord5128
ord1883
ord4238
ord5751
ord4155
ord2990
ord3415
ord5024
ord3514
ord6344
ord5627
ord1003
ord3449
ord3787
ord3250
ord4697
ord3058
ord3065
ord6336
ord2510
ord2542
ord5244
ord5741
ord1746
ord5577
ord3172
ord5653
ord4421
ord4954
ord4859
ord2401
ord4387
ord3454
ord3198
ord6081
ord6175
ord4623
ord4430
ord734
ord437
ord4824
ord5826
ord1945
ord4273
ord4589
ord4588
ord4899
ord4370
ord4892
ord5076
ord4341
ord4349
ord4723
ord4890
ord4531
ord4545
ord4595
ord4526
ord4529
ord4524
ord4964
ord4961
ord4108
ord3346
ord3748
ord1726
ord4432
ord560
ord813
ord5260
ord616
ord3317
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord2135
ord763
ord483
ord3078
ord2527
ord482
ord6927
ord2763
ord4123
ord5710
ord765
ord1086
ord5601
ord3698
ord384
ord686
ord2096
ord2862
ord804
ord2119
ord2587
ord4406
ord3394
ord3729
ord6785
ord3650
ord783
ord2112
ord3711
ord6128
ord556
ord809
ord1088
ord2122
ord2080
ord2431
ord4278
ord5031
ord1949
ord3528
ord6094
ord4034
ord1200
ord703
ord603
ord2454
ord3318
ord1969
ord273
ord404
ord654
ord5816
ord6140
ord2554
ord1989
ord6139
ord6145
ord6143
ord801
ord541
ord6883
ord4486
ord6375
ord4274
ord4610
ord4612
ord6380
ord3370
ord4243
ord693
ord3640
ord4402
ord2582
ord5284
ord2396
ord5199
ord1089
ord2512
ord3922
ord5731
ord5240
ord4995
ord4413
ord2777
ord1105
ord5255
ord4457
ord402
ord4428
ord4437
ord2383
ord4153
ord2880
ord975
ord3350
ord1085
ord6197
ord4458
ord5254
ord1233
ord674
ord401
ord4427
ord2445
ord4436
ord1665
ord2649
ord5283
ord2382
ord5237
ord4077
ord4152
ord2878
ord2879
ord3403
ord5472
ord976
ord5012
ord3351
ord4303
ord4467
ord5104
ord5100
ord3059
ord2390
ord2723
ord2101
ord5101
ord4245
ord1858
ord3610
ord3721
ord1644
ord2863
ord3654
ord2584
ord4220
ord6270
ord2438
ord1168
ord6930
ord3874
ord289
ord613
ord2243
ord6199
ord2089
ord2116
ord2113
ord818
ord656
ord795
ord3742
ord2864
ord3619
ord2450
ord2078
ord5683
ord4202
ord6194
ord3596
ord5864
ord6061
ord5571
ord5579
ord5736
ord5678
ord5794
ord5873
ord6021
ord6189
ord4330
ord6186
ord5756
ord6192
ord5759
ord2971
ord6215
ord5788
ord6569
ord802
ord542
ord2754
ord6172
ord5789
ord3639
ord4401
ord2581
ord4219
ord2024
ord2413
ord6366
ord1771
ord5785
ord1640
ord1146
ord3571
ord3803
ord323
ord2405
ord640
ord692
ord6007
ord2379
ord4204
ord4468
ord5105
ord5102
ord2391
ord2127
ord3869
ord4246
ord1859
ord2770
ord4277
ord5981
ord6905
ord939
ord3286
ord3301
ord2764
ord6877
ord4129
ord3092
ord941
ord6907
ord2370
ord858
ord823
ord4299
ord535
ord4853
ord3716
ord2086
ord2642
ord2818
ord4376
ord4710
ord6111
ord6334
ord4234
ord2302
ord2781
ord3178
ord2361
ord324
ord641
ord790
ord3597
ord4425
ord5280
ord4407
ord1775
ord6052
ord2514
ord3181
ord4061
ord4039
ord4295
ord4998
ord5265
ord922
ord356
ord668
ord5856
ord6928
ord341
ord6170
ord567
ord3402
ord4133
ord4297
ord3573
ord1641
ord3663
ord3626
ord3693
ord470
ord6119
ord2414
ord5875
ord755
ord4275
ord609
ord3574
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord6055
ord2575
ord924
ord825
ord2478
ord2474
ord537
ord310
ord540
ord860
ord629
ord800
ord5178
ord5177
ord5176
ord1975
ord4289
ord2760
ord1005
ord2608
ord6321
ord2392
ord1744
ord3164
ord3165
ord3166
ord3167
ord5974
ord5975
ord3493
ord3494
ord6074
ord6075
ord5657
ord5945
ord6255
ord4543
ord1809
ord1576

msvcrt

_setmbcp
__CxxFrameHandler
sprintf
atoi
fclose
fwrite
fopen
strlen
strcpy
_mbscmp
sqrt
pow
strcmp
atof
memset
abs
free
labs
malloc
atan2
_close
_read
_lseek
_open
realloc
fread
memcpy
rand
strcat
wcstombs
wcschr
srand
time
toupper
_wtoi
exit
strerror
vfprintf
_iob
strtol
calloc
__dllonexit
_onexit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_ftol
_controlfp

kernel32

CreateThread
MultiByteToWideChar
DeleteFileW
CopyFileW
WideCharToMultiByte
lstrcpynW
lstrcpyW
GlobalHandle
lstrlenW
GlobalAlloc
GetTickCount
SystemTimeToFileTime
GetSystemTime
lstrcmpW
lstrcatW
GetLocalTime
GetTempPathW
CreateDirectoryA
RemoveDirectoryA
FindNextFileA
MoveFileA
DeleteFileA
LocalFree
FormatMessageA
GetModuleHandleA
CopyFileA
lstrcpyA
GlobalUnlock
CloseHandle
WriteFile
CreateFileA
GlobalLock
GlobalSize
GlobalFree
MulDiv
lstrlenA
GetLastError
TerminateThread
GetWindowsDirectoryA
GetDriveTypeA
GetLogicalDrives
SetFileAttributesA
FindClose
FindFirstFileA
GetStartupInfoA

user32

wsprintfA
InvalidateRect
SendMessageA
EnableWindow
GetClientRect
FillRect
GetWindowRect
ReleaseDC
DrawTextA
GrayStringA
IntersectRect
EqualRect
OffsetRect
SetRect
GetSystemMetrics
GetWindowLongA
SetCursor
LoadCursorA
ValidateRect
ReleaseCapture
CopyRect
GetCapture
LoadBitmapA
GetFocus
ClipCursor
EnableMenuItem
GetSubMenu
LoadMenuA
IsWindowVisible
KillTimer
SetTimer
SetForegroundWindow
SetWindowLongA
SetMenu
ShowWindow
FindWindowA
UpdateWindow
LoadIconA
GetScrollPos
SetScrollPos
wsprintfW
SendMessageW
FindWindowW
MessageBoxW
MessageBoxA
GetCursorPos
ScreenToClient
SetCapture
ShowCursor
TabbedTextOutA

gdi32

DeleteObject
RealizePalette
SelectPalette
Ellipse
Rectangle
CreateFontA
CreateFontIndirectA
StartDocA
StartPage
EndPage
AbortDoc
EndDoc
SelectObject
Escape
TextOutA
RectVisible
PtVisible
GetBkColor
CreateCompatibleBitmap
StretchBlt
GetObjectA
BitBlt
CreateCompatibleDC
CreateSolidBrush
GetDeviceCaps
ExtTextOutA
CreatePen

comdlg32

GetSaveFileNameA

advapi32

RegDeleteValueA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteA

comctl32

ImageList_ReplaceIcon

wsock32

getservbyname
recv
closesocket
WSAStartup
WSACleanup
connect
socket
htons
htonl
gethostbyname
WSAGetLastError
send

ltdic15u

ord461
ord334
ord70
ord364
ord366
ord116
ord161
ord100
ord236
ord166
ord148
ord134
ord132
ord160
ord109
ord136
ord138
ord190
ord360
ord418
ord315
ord336
ord354
ord310
ord62
ord157
ord150
ord303
ord127
ord180
ord397
ord144
ord81
ord313
ord406
ord317
ord197
ord402
ord60
ord54
ord390
ord326
ord462
ord55
ord254
ord189
ord279
ord361
ord368
ord453
ord142
ord374
ord13
ord295
ord275
ord105
ord154
ord137
ord1
ord66
ord135
ord362
ord421
ord420
ord430
ord230
ord330
ord449
ord450
ord332
ord6
ord296
ord133
ord5
ord139
ord263
ord264
ord394
ord401
ord400
ord459
ord352
ord61
ord363
ord145
ord146
ord391
ord367
ord375
ord289
ord57
ord398

ltkrn15u

ord251
ord54
ord201
ord8
ord206
ord25
ord26
ord100
ord132
ord51
ord339
ord75
ord40
ord64
ord118
ord129
ord101
ord67
ord32
ord214
ord76

ltann15u

ord215
ord136
ord12
ord168
ord105
ord74
ord205
ord111
ord110
ord27
ord120
ord237
ord224
ord289
ord9
ord28
ord291
ord244
ord126
ord221
ord95
ord214
ord238
ord59
ord290
ord208
ord20
ord15
ord297
ord239
ord99
ord151
ord279
ord125
ord153
ord11
ord8
ord96
ord61
ord32
ord241
ord209
ord274
ord121
ord86
ord165
ord83
ord281
ord195
ord194
ord262
ord14
ord264
ord220
ord219
ord66
ord139
ord169
ord235
ord234
ord230
ord160
ord38

ltfil15u

ord194
ord166
ord32
ord163
ord169

ltdis15u

ord117
ord119
ord118
ord113
ord82
ord34
ord32

ltzmv15u

ord1
ord4
ord5
ord8
ord3
ord2

ltimgefx15u

ord7
ord43

ltimgcor15u

ord29
ord50
ord32
ord3

ltimgclr15u

ord9
ord11
ord36
ord29

mfc42u

ord1197

Sections

.text
Size: 448KB - Virtual size: 447KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cd570f947d0398e88e98a08295987a83

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

comdlg32

advapi32

shell32

comctl32

wsock32

ltdic15u

ltkrn15u

ltann15u

ltfil15u

ltdis15u

ltzmv15u

ltimgefx15u

ltimgcor15u

ltimgclr15u

mfc42u

Sections

.text Size: 448KB - Virtual size: 447KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 12KB - Virtual size: 15KB

Size: 56KB - Virtual size: 52KB

.rsrc Size: 3.6MB - Virtual size: 3.6MB

.text
Size: 448KB - Virtual size: 447KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 12KB - Virtual size: 15KB

.rsrc
Size: 3.6MB - Virtual size: 3.6MB