f24b5545f4b6f6ead715682c62d4a7cacc91be4c0dda346255ffada4c8f0d0c2

Sharing

Copy URL Twitter E-mail

General

Target

f24b5545f4b6f6ead715682c62d4a7cacc91be4c0dda346255ffada4c8f0d0c2
Size

5.9MB
MD5

b0099306f2430371391f83efe4dc3445
SHA1

4610f4046d3856eca67294359baf1c3bf170b587
SHA256

f24b5545f4b6f6ead715682c62d4a7cacc91be4c0dda346255ffada4c8f0d0c2
SHA512

c5a5aef9f628bf43313c4c3579a4d2a79987b80ba99d7f8e35f434f9423ea582fe577563894caeb430d15b794e8ce606af9c75e1956093d0471bdf1e18200072
SSDEEP

49152:f/4TNsYNnEsLOITWB+/scSBbkBfHDNbiB:YTNLnjOIaB+/sctfHxbiB

Score

N/A

Malware Config

Signatures

Files

f24b5545f4b6f6ead715682c62d4a7cacc91be4c0dda346255ffada4c8f0d0c2
.exe windows x86

ad1f40d227af5420dc1d4ab8081c2434

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
SetEndOfFile
FlushFileBuffers
SetStdHandle
VirtualQuery
GetSystemInfo
VirtualProtect
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileAttributesA
GetDriveTypeA
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetOEMCP
GetACP
LCMapStringW
LCMapStringA
HeapSize
TlsAlloc
TlsFree
GetCommandLineA
GetStartupInfoA
ExitProcess
RaiseException
TlsGetValue
TlsSetValue
ExitThread
RtlUnwind
LocalFree
InterlockedExchange
GetFileTime
GetDiskFreeSpaceExA
ResumeThread
GetExitCodeThread
HeapReAlloc
IsBadWritePtr
GetShortPathNameA
GlobalSize
ExpandEnvironmentStringsA
SetErrorMode
GetCurrentThreadId
CreateThread
VirtualFree
GetDateFormatA
CreateDirectoryA
FindResourceA
LoadResource
LockResource
RemoveDirectoryA
GetUserDefaultLangID
CreateMutexA
ReleaseMutex
CreateProcessA
GetLocaleInfoA
GetNumberFormatA
GetCurrentProcess
GetVersionExA
SetThreadExecutionState
GetModuleFileNameA
GetSystemDefaultLangID
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
GetProcAddress
GetProcessHeap
HeapAlloc
HeapFree
WideCharToMultiByte
lstrcatA
SetFileAttributesA
GetCurrentDirectoryA
lstrcmpA
FreeLibrary
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetLocalTime
GetTimeFormatA
ResetEvent
OpenEventA
TerminateThread
MultiByteToWideChar
LoadLibraryA
lstrcpynA
SetEvent
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
FindClose
SetThreadPriority
InterlockedIncrement
DeleteCriticalSection
CreateEventA
InitializeCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
lstrlenW
InterlockedDecrement
Sleep
GetTickCount
GetModuleHandleA
GetTempFileNameA
WriteFile
CopyFileA
GlobalLock
GlobalUnlock
GetFileSize
SetFilePointer
ReadFile
GlobalAlloc
GlobalFree
SetLastError
GetLastError
GetTempPathA
CreateFileA
CloseHandle
DeleteFileA
lstrlenA
lstrcpyA
GetPrivateProfileStringA
lstrcmpiA
GetPrivateProfileIntA
VirtualAlloc

user32

DialogBoxParamA
SendMessageA
GetDlgItem
SendDlgItemMessageA
SetFocus
SendMessageTimeoutA
FindWindowA
MapWindowPoints
UnionRect
SetForegroundWindow
BringWindowToTop
DrawEdge
GetDlgItemInt
SetDlgItemInt
SetWindowTextA
EndDialog
EnableScrollBar
GetParent
SetScrollPos
PostQuitMessage
SystemParametersInfoA
ClientToScreen
SetWindowPos
GetWindow
FindWindowExA
SetDlgItemTextA
GetDlgItemTextA
CreatePopupMenu
TrackPopupMenu
SetCursor
LoadCursorA
SetCursorPos
CreateDialogParamA
ShowWindow
UpdateWindow
CheckDlgButton
EnableWindow
GetFocus
CheckRadioButton
IsDlgButtonChecked
CreateWindowExA
DestroyWindow
CharUpperA
wsprintfA
DrawFocusRect
SetLayeredWindowAttributes
IsZoomed
DestroyIcon
GetDesktopWindow
EnumChildWindows
DispatchMessageA
TranslateMessage
PeekMessageA
MessageBoxA
AttachThreadInput
GetWindowThreadProcessId
LoadStringA
FillRect
GetClassNameA
CharLowerA
MonitorFromWindow
GetMonitorInfoA
LoadImageA
ReleaseDC
GetDC
DefWindowProcA
ReleaseCapture
SetTimer
IsWindow
GetWindowRect
KillTimer
TrackMouseEvent
SetCapture
ScreenToClient
GetCursorPos
EndPaint
OffsetRect
DrawTextA
SetRect
BeginPaint
GetClientRect
PtInRect
PostMessageA
WindowFromPoint
CopyRect
MoveWindow
IsWindowEnabled
SetWindowLongA
GetWindowLongA
SetPropA
CallWindowProcA
RemovePropA
GetKeyState
GetPropA
RedrawWindow
LoadIconA
DrawIcon
InflateRect
DrawFrameControl
GetSysColor
GetWindowTextA
AdjustWindowRect
InvalidateRect
DrawMenuBar
InsertMenuItemA
DeleteMenu
GetSystemMenu
SetScrollInfo
SetWindowsHookExA
GetMessageA
SetProcessDefaultLayout
CallNextHookEx
SetRectEmpty
SetClassLongA
LoadBitmapA
IsRectEmpty
SubtractRect
GetScrollInfo
GetAsyncKeyState
GetSystemMetrics
GetForegroundWindow
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
ShowScrollBar
GetSysColorBrush
RegisterClassExA
EnumWindows
IntersectRect
IsWindowVisible
IsIconic
DestroyMenu

gdi32

StretchDIBits
SetICMMode
SaveDC
AbortDoc
CreateCompatibleBitmap
EndPage
SetAbortProc
StartDocA
StartPage
SelectObject
RestoreDC
CreateCompatibleDC
SetTextColor
SetLayout
GetPixel
SetBkMode
GetStockObject
CreateSolidBrush
GetTextMetricsA
SetDIBitsToDevice
GetDIBits
StretchBlt
PlgBlt
CreateDIBSection
ExcludeClipRect
CreatePatternBrush
SetBrushOrgEx
Rectangle
CreatePen
MoveToEx
LineTo
GetLayout
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
DeleteDC
DeleteObject
GetObjectA
BitBlt
CreateFontA
CreateFontIndirectA
GetDeviceCaps
SetStretchBltMode
EndDoc
SetBkColor
GetSystemPaletteEntries

winspool.drv

ord201
EnumPrintersA
GetJobA

comdlg32

GetOpenFileNameA

advapi32

LookupPrivilegeValueA
RegEnumKeyExA
RegOpenKeyExA
RegEnumValueA
RegQueryValueExA
OpenProcessToken
AdjustTokenPrivileges
RegUnLoadKeyA
RegLoadKeyA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegCloseKey

shell32

SHGetFileInfoA
SHBrowseForFolderA
SHGetPathFromIDListA
SHChangeNotify
ShellExecuteA
SHGetSpecialFolderPathA
DragFinish
DragAcceptFiles
DragQueryFileA
SHGetMalloc
SHFileOperationA
SHGetDesktopFolder
FindExecutableA
SHBindToParent

ole32

DoDragDrop
OleUninitialize
ReleaseStgMedium
RevokeDragDrop
RegisterDragDrop
OleInitialize
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromString
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantClear

comctl32

ImageList_Remove
InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_DragMove
ImageList_DragShowNolock
ImageList_DragLeave
ImageList_EndDrag
ImageList_BeginDrag
ImageList_DragEnter
ord17
ImageList_Destroy
ImageList_Create
ImageList_AddMasked
ord6

cfgmgr32

CM_Get_Child_Ex
CM_Get_Child
CM_Get_Sibling_Ex
CM_Get_Device_IDA

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

imagehlp

MakeSureDirectoryPathExists

shlwapi

StrStrIA
PathRenameExtensionA
PathIsDirectoryA
PathFindExtensionA
PathSetDlgItemPathA
StrStrA
StrCmpNIA
PathAddExtensionA
SHDeleteEmptyKeyA
StrTrimA
StrCSpnIA
PathRemoveBackslashA
PathFindFileNameA
PathRemoveExtensionA
PathAddBackslashA
PathAppendA
StrToIntA
StrChrA

mpnplib

?StretchDIBits@CPictureLibrary@@QAEHPAUHDC__@@HHHHHHHHPBXPAUtagBITMAPINFO@@IK@Z
?ConvTIFF2BMP@CPictureLibrary@@QAEHPAD0H@Z
?MakeThumbnailBMP@CPictureLibrary@@QAEHPAUMPN_FILEINFO@@PAD@Z
?PartOfDIB@CPictureLibrary@@QAEPAXPAXHHHH@Z
?BiCubic@CPictureLibrary@@QAEPAXPAXHH@Z
?ConvFile@CPictureLibrary@@QAEHPAD0HHHHHH@Z
??1CPictureLibrary@@QAE@XZ
?ConvTo@CPictureLibrary@@QAEPAXPAD@Z
??0CPictureLibrary@@QAE@XZ
?PrepareDIB@CPictureLibrary@@QAEPAXHH@Z
?GetImageSize@CPictureLibrary@@QAEHPAUMPN_FILEINFO@@@Z
?RotateDIB2@CPictureLibrary@@QAEPAXPAXH@Z

mpnfimp

??1CFileImporter@@QAE@XZ
??0CFileImporter@@QAE@XZ
?IsSupportedPDF@CFileImporter@@QAEHPAD@Z
?GetPageNumPDF@CFileImporter@@QAEHPAD@Z
?GetLargeImage@CFileImporter@@QAEJPAUMPN_FILEINFO@@H@Z
?LeaveCriticalSectionPDF@CFileImporter@@QAEXXZ
?GetThumbnail@CFileImporter@@QAEJPAUMPN_FILEINFO@@@Z
?EnterCriticalSectionPDF@CFileImporter@@QAEXXZ
?GetDateTime@CFileImporter@@QAEHPADPAH1@Z
?DeleteEnvJpeg@CFileImporter@@QAEXXZ
?IsIntel@CFileImporter@@QAEHXZ
?HasTag@CFileImporter@@QAEHHPAHPAK@Z
?CreateEnvJpeg@CFileImporter@@QAEPAXPADPAH@Z
?GetThumbnailBMP@CFileImporter@@QAEJPAUMPN_FILEINFO@@@Z

mpnfldt

?Initialize@CFolderTree@@QAEXPAUHWND__@@PAD1H@Z
?SaveTreeToReg@CFolderTree@@QAEHPAD0@Z
?SelectDate@CFolderTree@@QAEHHH@Z
?SelectVirtualSearchFolder@CFolderTree@@QAEHH@Z
?AddVirtualSearchFolder@CFolderTree@@QAEHXZ
?SetFocus@CFolderTree@@QAEHXZ
??1CFolderTree@@QAE@XZ
??0CFolderTree@@QAE@XZ
?RefreshFolderTree@CFolderTree@@QAEXXZ
?ShowWaiting@CFolderTree@@QAEHXZ
?SetDate@CFolderTree@@QAEHHPAHHPAD@Z
?LoadTreeFromReg@CFolderTree@@QAEHPAD00H@Z
?SetYMDString@CFolderTree@@QAEXPAD00@Z
?SetResultSearchString@CFolderTree@@QAEXPAD@Z
?SetPrepareString@CFolderTree@@QAEXPAD@Z
?SetPopupString@CFolderTree@@QAEXPAD0@Z
?ChangeFolder@CFolderTree@@QAEHPADJ@Z

mpnscmgr

?Search@CSearchManager@@QAEHPAUHWND__@@PAUMPN_SEARCHPARAM@1@@Z
??0CSearchManager@@QAE@XZ
?EndSearch@CSearchManager@@QAEHXZ
??1CSearchManager@@QAE@XZ

mpnsmgr

??0CScanManager@@QAE@XZ
??1CScanManager@@QAE@XZ
?Init@CScanManager@@QAEHPAUHWND__@@@Z
?ScanStart@CScanManager@@QAEHP6GHHHJPAX@Z0@Z
?SetScanParamater@CScanManager@@QAEHPAU_SCAN_PARAM_HDR@@@Z
?SetParent@CScanManager@@QAEXPAUHWND__@@@Z
?OpenScannerEX@CScanManager@@QAEJPBDHH@Z
?EnumScanner@CScanManager@@QAEKPAUSCANNER_INFO@@KPAK@Z

ltkrn70n

ord115
ord114
ord134

ltfil70n

ord100
ord102
ord103

pafcv2

ord4
ord2
ord10
ord12
ord14
ord15
ord17
ord6
ord11

mpnfexp

??1CFileExporter@@QAE@XZ
?AddPDF@CFileExporter@@QAEHPAD0@Z
?SaveBMP@CFileExporter@@QAEXPADHHPAXHH@Z
??0CFileExporter@@QAE@XZ
?EncodeJPEG_Main@CFileExporter@@QAEJPAD0HHHHH@Z

mscms

OpenColorProfileA
CloseColorProfile
GetColorDirectoryA
DeleteColorTransform
CreateColorTransformA
TranslateBitmapBits
IsColorProfileValid

winmm

timeGetTime
timeBeginPeriod
timeGetDevCaps

cnpapgmg

ord2
ord11
ord14
ord10
ord1

imm32

ImmAssociateContext
ImmGetConversionStatus
ImmGetOpenStatus
ImmGetContext
ImmSetConversionStatus
ImmSetOpenStatus
ImmReleaseContext

mpnprint

ord26
ord24
ord21
ord17
ord20
ord23
ord22
ord16
ord27
ord1
ord3
ord4
ord13
ord15
ord2
ord14
ord18

msimg32

AlphaBlend
TransparentBlt

mpr

WNetGetProviderNameA
WNetOpenEnumA
WNetAddConnection2A
WNetGetConnectionA
WNetCloseEnum

ipdf2spdf

SPTK_close
SPTK_exopen
SPTK_exgetPageImage
SPTK_setpage
SPTK_checkPAFPDF
SPTK_pagenum

Sections

.text
Size: 816KB - Virtual size: 815KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad1f40d227af5420dc1d4ab8081c2434

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

cfgmgr32

setupapi

version

imagehlp

shlwapi

mpnplib

mpnfimp

mpnfldt

mpnscmgr

mpnsmgr

ltkrn70n

ltfil70n

pafcv2

mpnfexp

mscms

winmm

cnpapgmg

imm32

mpnprint

msimg32

mpr

ipdf2spdf

Sections

.text Size: 816KB - Virtual size: 815KB

.rdata Size: 96KB - Virtual size: 94KB

.data Size: 40KB - Virtual size: 4.5MB

.rsrc Size: 4.8MB - Virtual size: 4.8MB

.text
Size: 816KB - Virtual size: 815KB

.rdata
Size: 96KB - Virtual size: 94KB

.data
Size: 40KB - Virtual size: 4.5MB

.rsrc
Size: 4.8MB - Virtual size: 4.8MB