852b460ef7347efd03f70afb8fece538712efbc46ae041e24633527036f38968

Sharing

Copy URL Twitter E-mail

General

Target

852b460ef7347efd03f70afb8fece538712efbc46ae041e24633527036f38968
Size

192KB
MD5

5416f194bfa602cb038b048bed6e56fa
SHA1

d6ed7a7581d3e6e33dedf3b715443dcaef8d4ee9
SHA256

852b460ef7347efd03f70afb8fece538712efbc46ae041e24633527036f38968
SHA512

42c6ed8d4991548ce8f976b591a67662679a7b303fdd8783dd532805cf1eb36bb78a9ea95c2294ccbbca582376cbd99beea83cc664f2495cddf5afeeb0e6d1b8
SSDEEP

3072:sCYE8y6+TGh4Nywk97bXyXVW4WjQTBfCAOKQtly9ySpvZRgFZRgi+:s5J+TGNwbXg4+QTBqAOKIlwpR

Score

N/A

Malware Config

Signatures

Files

852b460ef7347efd03f70afb8fece538712efbc46ae041e24633527036f38968
.exe windows x86

ea34932826cd64a4fca8595308a62636

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc90u

ord5418
ord4589
ord4596
ord5016
ord5209
ord4807
ord4823
ord4820
ord4802
ord4805
ord4800
ord5296
ord5293
ord4378
ord3354
ord6410
ord1753
ord3681
ord1440
ord5616
ord2969
ord4693
ord430
ord2694
ord5851
ord4519
ord4442
ord280
ord1137
ord4865
ord4866
ord4109
ord5349
ord4945
ord4946
ord5356
ord4987
ord5487
ord4861
ord4789
ord4927
ord5279
ord5407
ord4955
ord4904
ord5408
ord4942
ord5105
ord5384
ord5228
ord4707
ord1599
ord3220
ord285
ord6630
ord3185
ord1607
ord4448
ord4423
ord6801
ord4173
ord4797
ord4798
ord5400
ord5230
ord5142
ord5239
ord5491
ord5401
ord5079
ord5382
ord4933
ord5397
ord5106
ord6803
ord4747
ord2251
ord2206
ord6035
ord4179
ord1048
ord5548
ord6741
ord5830
ord3768
ord611
ord4652
ord1665
ord3622
ord3488
ord3489
ord2274
ord4044
ord333
ord6187
ord5867
ord6094
ord6095
ord4131
ord2592
ord4527
ord4410
ord4541
ord2901
ord6109
ord4549
ord797
ord1262
ord6636
ord4741
ord1149
ord265
ord4213
ord2087
ord3217
ord5674
ord5676
ord2447
ord4347
ord4996
ord5680
ord5663
ord6018
ord3115
ord4905
ord3670
ord589
ord296
ord794
ord4810
ord4009
ord4490
ord811
ord813
ord3070
ord4774
ord2444
ord5760
ord4785
ord5656
ord6635
ord3741
ord6065
ord1686
ord778
ord2283
ord1719
ord3355
ord6411
ord1493
ord4660
ord5664
ord3286
ord4681
ord3654
ord595
ord2069
ord2597
ord286
ord4324
ord909
ord2479
ord939
ord935
ord4548
ord4618
ord600
ord3830
ord6579
ord2904
ord639
ord5632
ord4631
ord5167
ord5324
ord2208
ord1810
ord1809
ord1675
ord3353
ord6408
ord1754
ord1751
ord4345
ord1492
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord5653
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord1376
ord2194
ord4550
ord683
ord799
ord1183
ord2537
ord2106
ord3543
ord3486
ord2645
ord2646
ord2647
ord2644
ord2643
ord5182
ord744
ord524
ord4545
ord795
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord2139
ord1792
ord1791
ord5008
ord4000
ord1727
ord5214
ord4622
ord4043
ord5224
ord1272
ord5650
ord2771
ord2983
ord3112
ord4728
ord2966
ord3140
ord2774
ord2893
ord2764
ord2431
ord1354
ord266
ord2676
ord938
ord6604
ord590
ord3953
ord6577
ord3242
ord4080
ord4081
ord4071
ord2891
ord4348
ord4910
ord4682
ord3515
ord374
ord801

msvcr90

malloc
wcsncat_s
wcslen
swscanf_s
wcscmp
rand
srand
vswprintf_s
wcschr
iswalnum
wcscpy
wcsncmp
_wsplitpath_s
_purecall
memcpy
_read
_lseek
_filelength
_close
_wsopen
_errno
strtoul
calloc
realloc
_wassert
_snwprintf
wcsncpy
_swprintf
_wcsupr
towupper
_wmakepath
_wsplitpath
_wcsdup
fopen
fread
fwrite
ftell
fseek
ferror
mbstowcs
wcsncat
iswspace
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_wfopen_s
fclose
_wunlink
_wtoi
_time32
_wcslwr_s
wcsncpy_s
_localtime32_s
wcsftime
swprintf_s
_time64
wcsstr
wcsrchr
_waccess
wcscpy_s
wcscat_s
wcstod
_wcsicmp
free
__CxxFrameHandler3
_wcsnicmp
memset

kernel32

GetFileSize
InitializeCriticalSection
SetErrorMode
ReadFile
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
ExpandEnvironmentStringsA
GetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
FreeLibrary
lstrcmpiW
GetFullPathNameW
lstrlenA
lstrlenW
WideCharToMultiByte
GetLocalTime
CreateThread
GetExitCodeThread
GetLocaleInfoW
GetModuleHandleW
GetProcAddress
GetVersionExW
LoadLibraryW
OpenMutexW
ReleaseMutex
WriteFile
GetFileAttributesW
SetFileAttributesW
CreateProcessW
GetExitCodeProcess
CreateEventW
WaitForSingleObject
DeleteFileW
CreateFileW
CloseHandle
WritePrivateProfileStringW
LoadLibraryExW
GetModuleFileNameW
Sleep
CreateDirectoryW
MoveFileExW
GetTempPathW
GetPrivateProfileStringW
FindClose
GetLastError
FindNextFileW
RemoveDirectoryW
FindFirstFileW
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
CreateMutexW
GetCommandLineW
OpenProcess
GlobalAlloc
GlobalFree
GetComputerNameW
SetFileTime
MultiByteToWideChar

user32

GetDC
ScreenToClient
DrawStateW
InflateRect
DrawIconEx
FillRect
InvalidateRect
GetFocus
ReleaseDC
GetForegroundWindow
LoadStringW
GetLastActivePopup
GetActiveWindow
IsWindow
DestroyIcon
BeginDeferWindowPos
EndDeferWindowPos
DeferWindowPos
IsWindowVisible
LoadBitmapW
EqualRect
CopyRect
LoadImageW
LoadIconW
GetSystemMetrics
GetClientRect
IsIconic
DrawIcon
MessageBoxW
wsprintfW
GetParent
GetWindowRect
PostMessageW
GetClassNameW
EnableWindow
SendMessageW

gdi32

GetDeviceCaps
SetPixel
GetPixel
GetTextExtentPoint32W
RoundRect
CreateSolidBrush
CreatePen

advapi32

GetTokenInformation
LookupAccountSidW
DuplicateTokenEx
ImpersonateLoggedOnUser
SetThreadToken
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegOpenKeyExA
RegQueryValueExA
GetUserNameW
RevertToSelf
OpenProcessToken

comctl32

ord17
_TrackMouseEvent

oleaut32

VariantClear

msvcp90

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

shell32

ShellExecuteW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea34932826cd64a4fca8595308a62636

Headers

DLL Characteristics

File Characteristics

Imports

mfc90u

msvcr90

kernel32

user32

gdi32

advapi32

comctl32

oleaut32

msvcp90

shell32

version

Sections

.text Size: 99KB - Virtual size: 99KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 5KB - Virtual size: 11KB

.rsrc Size: 48KB - Virtual size: 48KB

.text
Size: 99KB - Virtual size: 99KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 5KB - Virtual size: 11KB

.rsrc
Size: 48KB - Virtual size: 48KB