db45ef620f5138db26a092741816804e2580baf62ed823bd58dad4845de22cfc

Sharing

Copy URL Twitter E-mail

General

Target

db45ef620f5138db26a092741816804e2580baf62ed823bd58dad4845de22cfc
Size

608KB
MD5

01ada00e18a29b8aa4fd85efd721bed0
SHA1

e15c43eadb60458b779e0b5d329246a9f45deae8
SHA256

db45ef620f5138db26a092741816804e2580baf62ed823bd58dad4845de22cfc
SHA512

9e1eda621c2ce1be76777ea83cdf69953f072d3531b5b6075de3bae8960308ac8c8715cf0c1f1d7e5ed7f47453b0af1d04fe5bc6d98eaa791057525d9a25cd33
SSDEEP

12288:WNfPcMaham5FiIrMXLOTNRv3EFWT7g3CuPSIN20MtdcG:Wiham5FiIrMuRvEFWOC1t0Mtz

Score

N/A

Malware Config

Signatures

Files

db45ef620f5138db26a092741816804e2580baf62ed823bd58dad4845de22cfc
.dll windows x86

34a55884b96beb41bc435612627946ad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidCreate

mfc71

ord2835
ord4307
ord2714
ord2862
ord2540
ord2646
ord2533
ord2991
ord3718
ord3719
ord3709
ord2644
ord3949
ord4486
ord4261
ord3164
ord572
ord587
ord5182
ord4212
ord4735
ord4890
ord1671
ord1670
ord1551
ord5912
ord1401
ord4244
ord5203
ord4262
ord605
ord354
ord1794
ord1793
ord1892
ord6090
ord4580
ord4038
ord4014
ord6278
ord3801
ord6276
ord4326
ord2063
ord2018
ord5583
ord3806
ord1010
ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord5224
ord5226
ord3948
ord4568
ord5230
ord5213
ord5566
ord2838
ord2990
ord4481
ord3333
ord566
ord757
ord3830
ord2248
ord1084
ord1308
ord2176
ord3182
ord5807
ord2662
ord1123
ord2321
ord1112
ord5661
ord2804
ord300
ord293
ord2130
ord2731
ord783
ord5235
ord5233
ord2390
ord2400
ord2398
ord2396
ord2392
ord2415
ord2403
ord765
ord315
ord1037
ord1206
ord1191
ord1187
ord266
ord265
ord764
ord1185
ord5715
ord578
ord1482
ord745
ord304
ord557
ord1167
ord1092
ord1209
ord1177
ord1175
ord1201
ord1120
ord371
ord1098
ord1208
ord297
ord3997
ord1486
ord781
ord310
ord2328
ord876
ord2271
ord762
ord4035
ord667
ord1970
ord2907
ord432
ord314
ord1917
ord655
ord421
ord2020
ord5284
ord577
ord5286
ord3952
ord3479
ord5660
ord5108
ord2805
ord1151
ord2322
ord1249
ord581
ord2537
ord5200
ord1599
ord1655
ord1656
ord1964
ord5175
ord1362
ord4967
ord3345
ord6277
ord3802
ord6279
ord1522
ord2172
ord2178
ord2405
ord2387
ord2385
ord2408
ord2413
ord2394
ord2410
ord934
ord930
ord932
ord928
ord923
ord5960
ord1600
ord4282
ord4722
ord3403
ord5214
ord4185
ord6275
ord5073
ord1908
ord5152
ord4232
ord1402
ord3946
ord1617
ord1620
ord5915
ord1545
ord2086
ord3441
ord3641
ord6173
ord4085
ord4081
ord5563
ord2451
ord5529
ord865
ord2933
ord299
ord1489
ord6174
ord6180
ord2272
ord4109
ord6179
ord6006
ord1024
ord5491
ord908
ord5710
ord782
ord784
ord2475
ord5403
ord2468
ord911
ord907
ord307
ord1090
ord5490
ord2131

msvcr71

__CppXcptFilter
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
__security_error_handler
memset
_CIpow
_ftol
ftell
fseek
srand
rand
_mbsstr
fread
??0exception@@QAE@ABV0@@Z
fwrite
fprintf
fflush
??0exception@@QAE@XZ
??1exception@@UAE@XZ
isspace
strtol
fopen
fgets
fclose
_strlwr
strncmp
strchr
strtoul
calloc
toupper
iswspace
_wtoi
wcscmp
strtod
_HUGE
_errno
_strtoui64
_strtoi64
_snwprintf
_ultoa
_ui64toa
_i64toa
_fpclass
_gcvt
wcslen
wcsncmp
_vscprintf
_mbschr
memmove
atoi
_msize
realloc
wcschr
_CxxThrowException
_mbsicmp
_mbsnbcpy
vsprintf
strtok
strncpy
_itoa
time
sprintf
_time64
strrchr
__CxxFrameHandler
_except_handler3
free
malloc
_purecall

kernel32

HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
WritePrivateProfileStringA
GetWindowsDirectoryA
WaitForSingleObject
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
IsBadReadPtr
GetModuleHandleA
FormatMessageA
LocalFree
FindResourceExA
FindResourceA
LoadResource
LockResource
SizeofResource
GetPrivateProfileIntA
InitializeCriticalSection
RaiseException
CloseHandle
lstrcatA
CreateFileA
GetModuleFileNameA
IsBadStringPtrA
GlobalFree
SetFilePointer
SetEndOfFile
WriteFile
GetFileSize
ReadFile
lstrcpyA
IsBadWritePtr
GetLocalTime
lstrlenA
lstrlenW
lstrcmpiA
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetPrivateProfileStringA
LoadLibraryExA
LocalAlloc
GetCurrentProcess
FindClose
FindNextFileA
FindFirstFileA
CreateFileW
InterlockedIncrement
InterlockedDecrement
DeleteFileA
SetFileAttributesA
lstrcpynA
FreeResource
MoveFileA
GetFileAttributesA
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapDestroy
DeleteCriticalSection
HeapSize

user32

wvsprintfA
PostMessageA
EnableWindow
wsprintfA

advapi32

LookupPrivilegeValueA
SetEntriesInAclA
AdjustTokenPrivileges
MapGenericMask
IsValidAcl
GetAce
DeleteAce
GetAclInformation
GetLengthSid
InitializeAcl
AddAccessAllowedAce
AddAce
RegCreateKeyExA
RegOpenKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
IsValidSid
EqualSid
GetSecurityDescriptorControl
ConvertSecurityDescriptorToStringSecurityDescriptorA
ConvertStringSecurityDescriptorToSecurityDescriptorA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetNamedSecurityInfoA
GetKernelObjectSecurity
GetNamedSecurityInfoA
MakeAbsoluteSD
IsValidSecurityDescriptor
ConvertStringSidToSidA
LookupAccountNameA
LookupAccountSidA
ConvertSidToStringSidA
RegEnumKeyExA
RegConnectRegistryA
CopySid
OpenProcessToken

shell32

CommandLineToArgvW
SHGetSpecialFolderPathA

ole32

CoInitialize
CoTaskMemFree
StringFromCLSID
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoTaskMemAlloc
CoUninitialize

oleaut32

SysAllocStringLen
VariantClear
VariantInit
SysFreeString

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z

ws2_32

WSASetEvent
gethostbyname
WSAGetLastError
closesocket
WSASocketA
WSAEventSelect
htons
WSARecv
WSAResetEvent
WSASend
WSAGetOverlappedResult
WSAConnect
WSAEnumNetworkEvents
WSACloseEvent
ntohs
getservbyport
gethostbyaddr
inet_addr
WSACleanup
getservbyname
htonl
WSAStartup
inet_ntoa
WSACreateEvent

wininet

HttpAddRequestHeadersA
HttpSendRequestA
InternetQueryOptionA
InternetOpenA
InternetConnectA
InternetReadFile
HttpQueryInfoA
InternetCloseHandle
InternetSetOptionA
HttpOpenRequestA

Exports

Exports

AudibleAAAppendAudioToFile
AudibleAACloseFile
AudibleAAGeneratePartialFile
AudibleAAGeneratePartialFileWithNewMetadata
AudibleAAGetAudioBytePos
AudibleAAGetAudioSection
AudibleAAGetAudioTimePos
AudibleAAGetBlockCount
AudibleAAGetBlockLength
AudibleAAGetCDTrackCount
AudibleAAGetCDTrackSize
AudibleAAMoveNextSection
AudibleAAMovePrevSection
AudibleAAOpenFile
AudibleAAOpenFile_WndPC
AudibleAAOpenFile_WndPCForCDBurn
AudibleAAOpenFile_WndPCForDesktopPlayback
AudibleAAReadCDBurnAudio
AudibleAAReadEncodedAudio
AudibleAAReadPCMAudio
AudibleAASeekToSectionAndBlock
AudibleAASetAudioBytePos
AudibleAASetAudioSection
AudibleAASetAudioTimePos
AudibleAA_GetMetadata
AudibleAA_GetMetadataEmbedded
AudibleAA_GetMetadata_WndPC
AudibleAA_GetMetadata_WndPCW
AudibleActivateDevice
AudibleConvertSubsEntryToDownloadEntry
AudibleCreateActivationRequest
AudibleCreateDownloadAssemblyRequest
AudibleCreateFileCleanupRequest
AudibleCreateSubscriptionRequest
AudibleGenerateActivationFromServerResponse
AudibleGenerateCDBurnerPlayerID
AudibleGeneratePCPlayerID
AudibleGetAAFilesPath
AudibleGetActivationCDBurnerData
AudibleGetActivationDataFromPC
AudibleGetCDBurnRemainSeconds
AudibleGetUserNameAndPassword
AudibleProcessADHFileToDownloadEntry
AudibleProcessAssemblyResponse
AudibleProcessRDLRequest
AudibleProcessSubscriptonFile
AudibleRDLGetAA_FileName
AudibleRDLGetAA_URL
AudibleSetActivationCDBurnerData
AudibleSetActivationDataToPC
AudibleUpdateDRMRecToLightSig
AudibleUpdateFireFoxConfig
EnableDirectorySecurity
EnableRegistryKeySecurity
EnumAudibleBooks
EnumAudibleLibraryBooks
EnumAudibleLibrarySubscriptions
EnumAudibleSubscriptions
GetAuthorizationForMoreBurn
GetDownloadUrl
GetStreamUrl
GetSupportedCodecMask
GetTitleInfo

Sections

.text
Size: 240KB - Virtual size: 238KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

34a55884b96beb41bc435612627946ad

Headers

File Characteristics

Imports

rpcrt4

mfc71

msvcr71

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp71

ws2_32

wininet

Exports

Exports

Sections

.text Size: 240KB - Virtual size: 238KB

.rdata Size: 72KB - Virtual size: 71KB

.data Size: 24KB - Virtual size: 34KB

.rsrc Size: 12KB - Virtual size: 8KB

.reloc Size: 24KB - Virtual size: 20KB

.text Size: 232KB - Virtual size: 232KB

.text
Size: 240KB - Virtual size: 238KB

.rdata
Size: 72KB - Virtual size: 71KB

.data
Size: 24KB - Virtual size: 34KB

.rsrc
Size: 12KB - Virtual size: 8KB

.reloc
Size: 24KB - Virtual size: 20KB

.text
Size: 232KB - Virtual size: 232KB