86ebb298bcbfdcaf90d2452573fd968d9534564d8c23d771dccb12c8ea7b4af5

Sharing

Copy URL

Twitter E-mail

General

Target

86ebb298bcbfdcaf90d2452573fd968d9534564d8c23d771dccb12c8ea7b4af5
Size

1.8MB
MD5

65931ceefccfa72acd2955bfd1228fd4
SHA1

5af866171d3adefe626ac3bca9ec95af785ccac0
SHA256

86ebb298bcbfdcaf90d2452573fd968d9534564d8c23d771dccb12c8ea7b4af5
SHA512

321c807deb2966b9ace78c30792993e9af54bfec0eed1b6817ee09ff22bb59a469d9a5e5b81b20b7b60fdb5e79fc0caebd09bc16d5581104fd31c3413683246e
SSDEEP

24576:MqE3aoU2l8pvH5rVFu+8q1PQTnFZdk33xmLINS/UFPL++qKkg0K:gaoU2m9ru+8qgFZumLINS/UFPL++qVu

Score

N/A

Malware Config

Signatures

Files

86ebb298bcbfdcaf90d2452573fd968d9534564d8c23d771dccb12c8ea7b4af5
.exe windows x86

8c54453000f5f6fbf7eff6194eb80d62

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ot60as

ord4758
ord4699
ord4696
ord2484
ord2238
ord2488
ord2496
ord2494
ord2074
ord4702
ord4676
ord2411
ord4754
ord4679
ord2414
ord4747
ord4746
ord4752
ord4698
ord4697
ord4701
ord4704
ord4734
ord4735
ord4736
ord4737
ord4738
ord4739
ord4708
ord2076
ord2110
ord2240
ord2122
ord2123
ord2124
ord2115
ord2117
ord2090
ord2119
ord2104
ord2097
ord2099
ord2098
ord2100
ord2103
ord2102
ord2101
ord5448
ord3072
ord3083
ord3085
ord3088
ord3089
ord2419
ord3090
ord3079
ord3080
ord3092
ord3093
ord3091
ord3097
ord3098
ord3099
ord3094
ord2415
ord4744
ord4727
ord4706
ord4745
ord3226
ord3221
ord3223
ord3225
ord3218
ord3217
ord3216
ord3215
ord3214
ord3213
ord3212
ord3211
ord3209
ord3207
ord3206
ord3202
ord3205
ord3201
ord3200
ord3199
ord3198
ord3197
ord3196
ord3195
ord3194
ord3193
ord3191
ord3192
ord3190
ord3189
ord3188
ord3183
ord3177
ord3073
ord3077
?messageMap@SECMaskEdit@@1UAFX_MSGMAP@@B
ord3084
ord3082
ord3100
ord3101
ord3102
ord3095
ord3096
ord3078
ord4751
ord3087
ord2075
ord2077
ord5444
ord4709
ord4710
ord4748
ord4726
ord4760
ord4743
ord4753
?messageMap@SECFrameWnd@@1UAFX_MSGMAP@@B
?classSECFrameWnd@SECFrameWnd@@2UCRuntimeClass@@B
ord3222
ord3203
ord5393
ord5443
ord3081
ord5421
?messageMap@SEC3DTabWnd@@1UAFX_MSGMAP@@B
ord5381
ord5382
ord5368
ord5371
ord5365
ord5414
ord5372
ord5418
ord5373
ord5423
ord5422
ord5425
ord5424
ord5428
ord5427
ord5426
ord5429
ord5431
ord5430
ord5432
ord5433
ord5437
ord5435
ord5434
ord5438
ord5440
ord5439
ord5454
ord5441
ord5385
ord5386
ord3187
ord3178
ord3185
ord3208
ord3210
ord3182
ord3224
ord3204
ord3184
ord2243
ord2085
?messageMap@SECDialogBar@@1UAFX_MSGMAP@@B
ord2234
ord2237
ord2232
ord2118
ord2067
ord2068
ord2096
ord2239
ord2084
ord2083
ord2244
ord2127

wsock32

inet_addr
htonl
gethostbyname
ntohl
WSAGetLastError
WSACleanup
ioctlsocket
WSAStartup

mpflib

mpf_connect
mpf_cmd
mpf_isobj
mpf_free_autobuf
mpf_close
mpf_delete
mpf_new
mpf_io_source_buffer
mpf_errno
mpf_set_timeout
mpf_io_dest_autobuf
mpf_get_autobuf
mpf_io_sane
mpf_strerror

modcomp

?nukeIncomplete@ModCompListFB@@QAEXXZ
?clear@ModCompListFB@@QAEXXZ
?load@ModCompListFB@@QAE?BHPBD0@Z
??1ModFeatureListFB@@QAE@XZ

cconnectdialog

??1CBetterComboEx@@UAE@XZ
??0CConnectDialog@@QAE@PAVCWnd@@VCString@@H@Z
??_7CBetterComboEx@@6B@
??1CConnectDialog@@UAE@XZ

geoduck

??0GeoValDvcpDevice@@QAE@PAV0@@Z
??0GeoValDvcpGroup@@QAE@PAV0@@Z
?saveCFG_buf_better@Beach@@QAE_NAAVCString@@@Z
??1GeoValDvcpGroup@@QAE@XZ
??1GeoValDvcpFolder@@QAE@XZ
?saveCFG@Beach@@QAE_NABVCString@@@Z
??1GeoVal@@UAE@XZ
??0GeoValDvcpAlias@@QAE@PAV0@@Z
??0Beach@@QAE@XZ
?loadCFG_buf@Beach@@QAE_NVCString@@@Z
?digGeoduck@Beach@@QAEPAVGeoduck@@ABVCString@@0@Z
?tossGeoduck@Beach@@QAE_NAAPAVGeoduck@@@Z
??1Beach@@QAE@XZ
??_7GeoVal@@6B@
??0GeoValDvcpSecurity@@QAE@PAU0@@Z
??1GeoValDvcpContact@@QAE@XZ
??1GeoValDvcpDevice@@QAE@XZ
?delProp@Beach@@QAE_NABVCString@@@Z
?saveCFG_buf@Beach@@QAE_NAAVCString@@@Z
??0GeoValDvcpProp@@QAE@PAV0@@Z
??1GeoValDvcpProp@@QAE@XZ
??1GeoValDvcpPolicy@@QAE@XZ
??1GeoValDvcpReportServer@@QAE@XZ
??0GeoValDvcpReportServer@@QAE@PAV0@@Z
?enumProp@Beach@@QAEHABVCString@@P6AHPBD1PAX@Z2@Z
??0GeoValDvcpTunnelFW@@QAE@PAV0@@Z
??0GeoTunnelService@@QAE@PAV0@@Z
??1GeoTunnelService@@QAE@XZ
??1GeoValDvcpTunnelFW@@QAE@XZ
?loadCFG@Beach@@QAE_NABVCString@@@Z
??0GeoValDvcpFolder@@QAE@PAV0@@Z

cskt

cs_genkey
cs_key2s

cutil

license_get_type
license_validate
NtPasswordHash

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

wgsvc

wgsvc_library_get

wgrpc

wgrpc_library_get

wgpr

wgpr_library_get

libeay32

ord82
ord401
ord907
ord1305
ord1307
ord909
ord1291
ord679
ord484
ord497
ord493
ord251
ord2034
ord778
ord795
ord3106
ord3040
ord3024
ord3033
ord265
ord266
ord264
ord260
ord2437
ord2436
ord2435
ord3873
ord323
ord809
ord794
ord275
ord276
ord274
ord256
ord464
ord2423
ord2126
ord1159
ord2075
ord1882
ord1908
ord304
ord3816
ord270
ord268
ord269
ord267
ord654
ord95
ord78
ord281
ord2117
ord333
ord248
ord2446
ord254
ord80
ord52
ord66
ord641
ord1804
ord196
ord197
ord2415
ord2416
ord2412
ord3212
ord468
ord181
ord421
ord585
ord657

ssleay32

ord74
ord61
ord48
ord43
ord83
ord75
ord21
ord15
ord8
ord6
ord12
ord110
ord96
ord58
ord108
ord42
ord78
ord232
ord183

wsnmp32

ord402
ord302
ord203
ord220
ord300
ord400
ord201
ord200
ord902
ord103
ord605
ord903
ord501
ord600
ord904
ord604
ord603
ord901
ord500
ord101
ord900

msimg32

GradientFill

shlwapi

PathFindExtensionA
PathCompactPathA

mfc42

ord1105
ord2065
ord6930
ord3303
ord5681
ord536
ord2123
ord6473
ord538
ord3790
ord2725
ord1134
ord6438
ord2621
ord6117
ord5484
ord2092
ord4145
ord561
ord815
ord3738
ord5714
ord4698
ord5302
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord4274
ord4676
ord4673
ord3229
ord5808
ord781
ord2111
ord5937
ord6134
ord3708
ord3813
ord5873
ord6172
ord4133
ord2080
ord4047
ord6129
ord5768
ord1233
ord4123
ord2513
ord293
ord353
ord3499
ord2515
ord355
ord2825
ord2089
ord5632
ord3547
ord2737
ord859
ord5143
ord6656
ord2723
ord2390
ord3059
ord5100
ord5103
ord4303
ord3350
ord3403
ord2879
ord2878
ord4077
ord5237
ord1665
ord4436
ord2408
ord5252
ord975
ord6195
ord3870
ord668
ord2770
ord356
ord3584
ord543
ord803
ord3700
ord1158
ord6176
ord1085
ord2824
ord3643
ord3435
ord498
ord1567
ord268
ord817
ord2256
ord564
ord1941
ord4171
ord2149
ord1002
ord3296
ord3290
ord4478
ord940
ord6778
ord4203
ord3753
ord5949
ord472
ord2754
ord2078
ord2649
ord4406
ord6194
ord6128
ord6442
ord783
ord3711
ord4317
ord5788
ord5787
ord4297
ord3693
ord5216
ord932
ord4186
ord5591
ord697
ord395
ord2714
ord289
ord613
ord818
ord6779
ord3021
ord3914
ord3297
ord4271
ord2567
ord3920
ord5785
ord2405
ord4454
ord4076
ord2444
ord5248
ord5279
ord6369
ord5234
ord2389
ord4121
ord5471
ord4056
ord4364
ord6154
ord5875
ord2380
ord1601
ord3573
ord825
ord2652
ord690
ord1988
ord535
ord941
ord5356
ord6657
ord6881
ord1074
ord2818
ord6058
ord5424
ord5204
ord6426
ord800
ord1228
ord389
ord537
ord860
ord540
ord1669
ord1168
ord858
ord2764
ord5265
ord4376
ord4853
ord4998
ord2514
ord6052
ord1775
ord4407
ord5280
ord4425
ord3597
ord3663
ord4644
ord1771
ord6366
ord2413
ord2024
ord4217
ord2576
ord6055
ord4078
ord1776
ord4397
ord5241
ord2385
ord5163
ord6374
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3352
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord3577
ord641
ord567
ord324
ord692
ord2448
ord2302
ord4234
ord5896
ord4710
ord5651
ord3127
ord3616
ord665
ord801
ord1200
ord939
ord6883
ord2817
ord4278
ord4277
ord6663
ord6143
ord541
ord1979
ord5442
ord823
ord3318
ord5186
ord350
ord354
ord6283
ord5861
ord3646
ord802
ord2645
ord6215
ord1199
ord926
ord4189
ord913
ord3438
ord700
ord699
ord2937
ord4160
ord397
ord398
ord542
ord3803
ord6385
ord5890
ord5631
ord5440
ord6383
ord5450
ord6394
ord5834
ord2044
ord2841
ord2370
ord5981
ord6567
ord1175
ord3874
ord6334
ord6907
ord6007
ord3998
ord4284
ord3996
ord3286
ord2379
ord2642
ord3092
ord2107
ord5161
ord5160
ord4948
ord4358
ord4377
ord4854
ord5287
ord4835
ord2358
ord5162
ord1086
ord5594
ord5601
ord2614
ord6199
ord4083
ord4129
ord6569
ord5622
ord5609
ord2765
ord2298
ord4219
ord2581
ord4401
ord3402
ord3639
ord912
ord2301
ord4188
ord1908
ord4715
ord1690
ord2528
ord5288
ord4439
ord2054
ord4431
ord771
ord496
ord497
ord4259
ord2646
ord5850
ord3475
ord4905
ord4742
ord4976
ord3699
ord2582
ord4402
ord3370
ord3640
ord693
ord768
ord489
ord5593
ord4258
ord1768
ord2864
ord1008
ord1907
ord6880
ord3719
ord793
ord924
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord686
ord616
ord384
ord3619
ord3626
ord2414
ord3571
ord1641
ord1146
ord6130
ord2862
ord2096
ord6197
ord6905
ord3301
ord4220
ord2584
ord3654
ord2438
ord6270
ord2863
ord1644
ord3293
ord2575
ord4396
ord3574
ord3610
ord656
ord609
ord3754
ord2097
ord3702
ord773
ord501
ord6888
ord6675
ord6282
ord696
ord5590
ord394
ord2763
ord5683
ord4185
ord909
ord5856
ord2915
ord922
ord4202
ord2587
ord1576
ord3394
ord3729
ord3721
ord804
ord795
ord6785
ord4446
ord3097
ord2294
ord2362
ord3089
ord4476
ord2859
ord6453
ord3811
ord6640
ord6911
ord551
ord3337
ord5600
ord1083
ord2820
ord3910
ord3706
ord5781
ord283
ord3797
ord4299
ord4243
ord755
ord2971
ord470
ord4694
ord5148
ord6222
ord6696
ord6891
ord6678
ord3439
ord6605
ord816
ord5789
ord2860
ord562
ord4275
ord4809
ord2784
ord6008
ord4000
ord4125
ord3317
ord3287

msvcrt

_setmode
clearerr
_iob
fprintf
fread
fwrite
fseek
ftell
fflush
_open
_read
_write
isdigit
_close
calloc
ctime
_snprintf
mktime
strtol
toupper
memchr
memmove
remove
_rmdir
_access
_strnicmp
strtoul
_stricmp
??1type_info@@UAE@XZ
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_acmdln
_CxxThrowException
_ultoa
_ltoa
_timezone
_strcmpi
_unlink
_itoa
_setmbcp
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_lseek
_controlfp
_mbsnbcpy
_strdup
fputs
_ftol
wcslen
strncpy
_atoi64
_stat
difftime
malloc
strstr
_mbsicmp
_mbslen
setlocale
strncmp
sscanf
sprintf
rand
_ismbcdigit
isalpha
_ismbcalpha
_ismbcspace
atol
atof
atoi
time
srand
strtok
_mbscmp
realloc
getenv
strrchr
fopen
fgets
fclose
strchr
free
strncat
__CxxFrameHandler
_purecall

kernel32

GetStartupInfoA
lstrcmpA
GetShortPathNameA
SetThreadPriority
lstrcmpiA
ResetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryA
GetCurrentThreadId
ReleaseMutex
CreateMutexA
GetModuleHandleA
FindResourceA
LoadResource
SizeofResource
LockResource
SetCurrentDirectoryA
CreateEventA
ResumeThread
WaitForMultipleObjects
TerminateThread
SetEvent
GetTempPathA
DeleteFileA
OutputDebugStringA
FindFirstFileA
GetFileAttributesA
FindNextFileA
FindClose
FreeLibrary
lstrcatA
CreateProcessA
CloseHandle
GetPrivateProfileStringA
GetSystemDirectoryA
GetCurrentDirectoryA
InterlockedDecrement
GetLastError
lstrlenA
LocalAlloc
FormatMessageA
LocalFree
GlobalAlloc
GlobalLock
GlobalUnlock
WaitForSingleObject
lstrcpyA
GetLocaleInfoA
MulDiv
GetModuleFileNameA
InterlockedExchange
GetProcAddress
LoadLibraryA
LoadLibraryExA
Sleep
WideCharToMultiByte
GlobalFree

user32

GetMessageA
GetMessagePos
DrawTextA
EnumChildWindows
CreateWindowExA
LoadCursorA
DestroyWindow
ScreenToClient
GetCursorPos
DrawTextW
OffsetRect
InflateRect
SetRectEmpty
SetCursor
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
DrawEdge
DrawIconEx
GetClipboardData
IsClipboardFormatAvailable
ToAscii
GetSubMenu
PeekMessageA
SetCapture
ReleaseCapture
SetTimer
MessageBeep
KillTimer
wsprintfA
LoadStringA
CheckMenuItem
GetMenu
GetLastActivePopup
LoadIconA
SetMenu
ClientToScreen
GetSystemMetrics
EnableScrollBar
SetWindowLongA
LoadBitmapA
GetWindowRect
GetParent
InvalidateRect
UpdateWindow
GetClientRect
EnableWindow
SendMessageA
RemoveMenu
LockWindowUpdate
IsWindowVisible
TranslateMessage
DispatchMessageA
ShowScrollBar
PostMessageA
GetKeyState
CopyRect
GetFocus
FillRect
DrawFocusRect
PtInRect
GetDC
ReleaseDC
IsWindow
SetParent
EnableMenuItem
AppendMenuA
LoadImageA
MapVirtualKeyA
LoadMenuA
GetWindowLongA
GetSysColor
GetKeyboardState

gdi32

RoundRect
PaintRgn
SetPixel
CreatePolygonRgn
CreateFontIndirectA
Rectangle
CreatePen
PatBlt
DPtoLP
CreateBitmap
CreateCompatibleBitmap
GetMapMode
DeleteDC
GetClipBox
CreateRectRgn
SetTextColor
SetBkColor
CreateCompatibleDC
SelectObject
DeleteObject
GetObjectA
BitBlt
GetTextExtentPoint32A
CreateRectRgnIndirect
GetDeviceCaps
CreateFontA
CreateSolidBrush
SetMapMode

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA

comctl32

ImageList_DragShowNolock
ImageList_BeginDrag
ImageList_SetOverlayImage
ImageList_SetBkColor
_TrackMouseEvent
ImageList_Draw
ImageList_AddMasked
ImageList_EndDrag
ImageList_DragLeave
ImageList_DragMove
ImageList_DragEnter

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

msvcp60

??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Xlen@std@@YAXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??1Init@ios_base@std@@QAE@XZ

Exports

Exports

??0ModCompFB@@QAE@XZ
??0ModCompListFB@@QAE@XZ
??0ModCompListItrFB@@QAE@PAVModCompListFB@@@Z
??0ModFeatureFB@@QAE@PBD@Z
??0ModFeatureListFB@@QAE@XZ
??1ModCompFB@@QAE@XZ
??1ModCompListFB@@QAE@XZ
??1ModCompListItrFB@@QAE@XZ
??1ModFeatureFB@@QAE@XZ
??4ModCompFB@@QAEAAV0@ABV0@@Z
??4ModCompListFB@@QAEAAV0@ABV0@@Z
??4ModFeatureListFB@@QAEAAV0@ABV0@@Z
?IsEmpty@ModCompListFB@@QBEHXZ
?basename@ModCompFB@@QBEPBDXZ
?build_host@ModCompFB@@QAEXPBD@Z
?build_host@ModCompFB@@QBEPBDXZ
?builder@ModCompFB@@QAEXPBD@Z
?builder@ModCompFB@@QBEPBDXZ
?cur@ModCompListItrFB@@QAEPAVModCompFB@@XZ
?cvsroot@ModCompFB@@QAEXPBD@Z
?cvsroot@ModCompFB@@QBEPBDXZ
?date@ModCompFB@@QAEXPBD@Z
?date@ModCompFB@@QBEPBDXZ
?desc@ModCompFB@@QAEXPBD@Z
?desc@ModCompFB@@QBEPBDXZ
?filename@ModCompFB@@QBEPBDXZ
?md5csum@ModCompFB@@QAEXPBD@Z
?md5csum@ModCompFB@@QBEPBDXZ
?name@ModCompFB@@QAEXPBD@Z
?name@ModCompFB@@QBEPBDXZ
?name@ModFeatureFB@@QBEPBDXZ
?next@ModCompListItrFB@@QAEXXZ
?offset@ModCompFB@@QAEXI@Z
?offset@ModCompFB@@QBEIXZ
?part@ModCompFB@@QAEXI@Z
?part@ModCompFB@@QBEIXZ
?release@ModCompFB@@QAEXPBD@Z
?release@ModCompFB@@QBEPBDXZ
?reset@ModCompListItrFB@@QAEXXZ
?size@ModCompFB@@QAEXI@Z
?size@ModCompFB@@QBEIXZ
?ssl_base@ModCompFB@@QAEXPBD@Z
?ssl_base@ModCompFB@@QBEPBDXZ
?version@ModCompFB@@QAEXPBD@Z
?version@ModCompFB@@QBEPBDXZ
OPENSSL_Applink

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8c54453000f5f6fbf7eff6194eb80d62

Headers

File Characteristics

Imports

ot60as

wsock32

mpflib

modcomp

cconnectdialog

geoduck

cskt

cutil

version

wgsvc

wgrpc

wgpr

libeay32

ssleay32

wsnmp32

msimg32

shlwapi

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp60

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 264KB - Virtual size: 262KB

.data Size: 56KB - Virtual size: 56KB

.rsrc Size: 120KB - Virtual size: 120KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 264KB - Virtual size: 262KB

.data
Size: 56KB - Virtual size: 56KB

.rsrc
Size: 120KB - Virtual size: 120KB