97a9db7318ef765e4c8ffe143774ca04a855b41e441101dcbb2997dc1b6bca07

Sharing

Copy URL Twitter E-mail

General

Target

97a9db7318ef765e4c8ffe143774ca04a855b41e441101dcbb2997dc1b6bca07
Size

640KB
MD5

8d6e6a808aa862e5bb1622693f4a3fad
SHA1

13f8931e03c556fdc6db0368548f9ab62512a698
SHA256

97a9db7318ef765e4c8ffe143774ca04a855b41e441101dcbb2997dc1b6bca07
SHA512

a11edf68fad970a89162ee62dc54dfd951c8b7b3258189179b8272b80e174d556e0e028adb7e49a214b3d3e08d073d5fc0ec290d428430d574313af9d29b58b3
SSDEEP

6144:Ms6a/q3ujFxTQ3lzzlhVefKjnrBAGIkYQRs9iNurG1+0NA7TcBpG9oXSlniMixjG:P2OTQ1zki35YQRPbNUTcTGkr9xQCtme

Score

N/A

Malware Config

Signatures

Files

97a9db7318ef765e4c8ffe143774ca04a855b41e441101dcbb2997dc1b6bca07
.exe windows x86

c733d1707b7e1014ebc47bc80a9ee268

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidCreate

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW

ws2_32

WSCDeinstallProvider
WSCInstallProvider
WSCEnumProtocols
WSAStartup
WSCGetProviderPath
WSACleanup

mfc71u

ord1573
ord5208
ord4274
ord1512
ord4266
ord721
ord5609
ord4577
ord1047
ord2422
ord4313
ord3661
ord3546
ord5065
ord6232
ord4791
ord718
ord515
ord519
ord4312
ord6061
ord3678
ord3590
ord760
ord1190
ord6116
ord1091
ord3281
ord4117
ord2361
ord3417
ord326
ord4109
ord3395
ord3995
ord5637
ord5636
ord2362
ord1299
ord2167
ord577
ord2027
ord2009
ord1007
ord5096
ord2261
ord4078
ord776
ord293
ord280
ord1479
ord870
ord2895
ord6111
ord282
ord2926
ord1472
ord566
ord896
ord899
ord4026
ord774
ord283
ord2260
ord5558
ord5524
ord4100
ord3990
ord2461
ord4074
ord2444
ord5485
ord4101
ord3927
ord1536
ord5231
ord5229
ord2384
ord2394
ord2392
ord2390
ord2386
ord2409
ord2397
ord1647
ord1646
ord1590
ord1542
ord6063
ord1582
ord2282
ord3082
ord385
ord2311
ord3877
ord5864
ord5083
ord1058
ord1883
ord5803
ord2657
ord526
ord1106
ord5414
ord3756
ord1318
ord4119
ord977
ord3547
ord3662
ord620
ord3189
ord1545
ord3280
ord330
ord589
ord5640
ord6013
ord3155
ord384
ord629
ord416
ord1198
ord651
ord1556
ord2364
ord3793
ord2861
ord754
ord3674
ord3322
ord1589
ord1645
ord5472
ord3065
ord1021
ord1051
ord3286
ord1572
ord1634
ord5699
ord1367
ord715
ord1785
ord354
ord4314
ord5727
ord4574
ord605
ord5199
ord4729
ord4206
ord3435
ord3635
ord2012
ord630
ord2366
ord3198
ord1271
ord3157
ord1925
ord3204
ord741
ord3311
ord4234
ord2086
ord6086
ord4861
ord265
ord266
ord2651
ord2155
ord5829
ord6115
ord3126
ord4256
ord4714
ord5207
ord4238
ord1392
ord5908
ord1661
ord1662
ord2011
ord4884
ord4730
ord4207
ord5178
ord4184
ord4838
ord4611
ord5064
ord5066
ord587
ord572
ord3158
ord4480
ord2985
ord2856
ord5196
ord1955
ord5171
ord1353
ord4961
ord3339
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2402
ord2407
ord2388
ord2404
ord931
ord927
ord929
ord925
ord920
ord5956
ord1591
ord4276
ord4716
ord3397
ord5210
ord4179
ord6271
ord5067
ord1899
ord5148
ord4226
ord1393
ord3940
ord1608
ord1611
ord5911
ord2077
ord1894
ord2239
ord757
ord3327
ord4255
ord4475
ord3943
ord2638
ord3703
ord3713
ord3712
ord2527
ord2640
ord2534
ord2832
ord2708
ord4301
ord2829
ord2725
ord2531
ord5562
ord5209
ord5226
ord4562
ord3942
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord3800
ord5579
ord2054
ord6274
ord3795
ord6272
ord4008
ord4032
ord1079
ord762
ord764
ord3677
ord4535
ord4320

msvcr71

strtoul
memset
_c_exit
_exit
_XcptFilter
_cexit
_wcmdln
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__security_error_handler
__dllonexit
_onexit
??1type_info@@UAE@XZ
_filelength
_lseek
calloc
_wstat
sprintf
rename
_errno
strstr
strchr
fseek
fgets
sscanf
wcsncmp
wcstok
_wgetenv
mbstowcs
_purecall
_resetstkoflw
_wgetcwd
_wchdir
printf
_wcsdup
realloc
clock
fflush
fputc
vswprintf
time
srand
rand
memmove
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_wopen
_close
_wchmod
_itow
wcschr
swscanf
_wrename
_wcslwr
_wsplitpath
_wunlink
fgetws
wcsstr
_wcsicmp
_wfopen
fputws
fclose
wcsrchr
_snwprintf
wcsncpy
_wsopen
malloc
_eof
_read
_wcsupr
_waccess
exit
wcscpy
wcscat
swprintf
wcslen
_wtoi
wcscmp
__CxxFrameHandler
free
_except_handler3
?terminate@@YAXXZ
_controlfp
_sopen
_write
_stat
_chmod
_chsize
_unlink
_access
wcsncat

kernel32

FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
GetVersionExW
WritePrivateProfileStringW
WriteFile
SetErrorMode
LocalAlloc
HeapAlloc
GetProcessHeap
HeapFree
MultiByteToWideChar
ExpandEnvironmentStringsA
WideCharToMultiByte
LoadLibraryExW
GetCurrentProcess
GetCurrentThread
GetSystemTimeAsFileTime
GetCommandLineW
CreateFileA
GetModuleHandleA
ExitProcess
LoadLibraryW
Sleep
RemoveDirectoryW
GetCurrentThreadId
GetModuleFileNameW
ExpandEnvironmentStringsW
SetFileAttributesW
GetFileAttributesW
GetDiskFreeSpaceExW
GetTempPathW
GetExitCodeProcess
WaitForSingleObject
OpenEventW
DeleteFileW
CreateProcessW
OpenProcess
LockResource
LoadResource
FindResourceW
QueryPerformanceCounter
SystemTimeToFileTime
GetSystemTime
GetShortPathNameW
FindClose
GetLastError
FindNextFileW
FindFirstFileW
GetProcAddress
GetModuleHandleW
CopyFileW
CreateDirectoryW
GetPrivateProfileStringW
CloseHandle
GetFileSize
CreateFileW
GetWindowsDirectoryW
LoadLibraryA
MoveFileExW
GetTickCount
GetFileTime
GetTimeFormatW
GetDateFormatW
GetLocalTime
LocalFree
lstrcpyW
lstrlenW
TerminateProcess
SetEvent
lstrcpynW
GetSystemDirectoryW
ReadFile
GetPrivateProfileIntW
GlobalFree
GlobalAlloc
GetComputerNameW
GetStartupInfoW
GetDriveTypeW
SetLastError
GetLocaleInfoW
ReleaseMutex
CreateMutexW
GetCurrentProcessId
LeaveCriticalSection
GetVersionExA
HeapDestroy
HeapReAlloc
HeapSize
DeviceIoControl
EnterCriticalSection

user32

DrawStateW
GetActiveWindow
GetLastActivePopup
CopyRect
PeekMessageW
LoadStringW
TranslateMessage
MapDialogRect
SetCursor
InflateRect
FillRect
DestroyIcon
DrawIconEx
SetRect
LoadCursorW
MessageBoxW
SendMessageW
wsprintfW
LoadImageW
LoadIconW
ExitWindowsEx
DispatchMessageW
RegisterWindowMessageW
ScreenToClient
PtInRect
GetDC
ReleaseDC
SetCapture
ReleaseCapture
SetWindowLongW
GetSystemMetrics
GetClassNameW
GetClassLongW
SetClassLongW
IsChild
InvalidateRect
GetClientRect
OffsetRect
MessageBeep
GetDesktopWindow
GetMessagePos
GetWindowRect
SetTimer
GetParent
PostMessageW
EnableWindow
KillTimer
GetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
SetForegroundWindow
SetWindowPos
SetFocus

gdi32

SetPixel
GetPixel
RoundRect
CreatePen
GetStockObject
CreatePalette
GetTextExtentPoint32W
SetDIBitsToDevice
StretchDIBits
RealizePalette
GetObjectW
CreateFontW
CreateSolidBrush
GetDIBits
CreateFontIndirectW

comdlg32

GetOpenFileNameW
CommDlgExtendedError

advapi32

EqualSid
GetSecurityDescriptorDacl
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetSecurityInfo
AllocateAndInitializeSid
SetNamedSecurityInfoW
InitializeAcl
AddAce
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
IsValidSid
GetLengthSid
CopySid
CreateProcessAsUserW
GetUserNameW
GetTokenInformation
LookupAccountSidW
CreateServiceW
RegOpenKeyW
QueryServiceStatus
RegCreateKeyW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
ChangeServiceConfigW
DeleteService
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyW
SetThreadToken
OpenProcessToken
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
CloseServiceHandle
GetAce
GetAclInformation
GetNamedSecurityInfoW
FreeSid
RegEnumValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AdjustTokenPrivileges
LookupPrivilegeValueW
StartServiceW
ControlService
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AddAccessAllowedAce
OpenThreadToken
ImpersonateSelf
RegQueryValueExA
RegOpenKeyExA
GetSecurityInfo

shell32

SHBrowseForFolderW
SHGetSpecialFolderPathW
ShellExecuteW
SHGetMalloc
SHGetPathFromIDListW

comctl32

_TrackMouseEvent

shlwapi

PathIsDirectoryW

ole32

CoInitialize
CoCreateInstance
CoGetMalloc
StringFromIID
CoUninitialize

oleaut32

SysFreeString

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHPBG@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z

Sections

.text
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c733d1707b7e1014ebc47bc80a9ee268

Headers

File Characteristics

Imports

rpcrt4

version

ws2_32

mfc71u

msvcr71

kernel32

user32

gdi32

comdlg32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

msvcp71

Sections

.text Size: 340KB - Virtual size: 339KB

.rdata Size: 92KB - Virtual size: 89KB

.data Size: 136KB - Virtual size: 3.4MB

.rsrc Size: 68KB - Virtual size: 72KB

.text
Size: 340KB - Virtual size: 339KB

.rdata
Size: 92KB - Virtual size: 89KB

.data
Size: 136KB - Virtual size: 3.4MB

.rsrc
Size: 68KB - Virtual size: 72KB