b0f19fd4ab521551b07a7b0aa68dc703c89981db97d7c16440e232db5173c969

Sharing

Copy URL Twitter E-mail

General

Target

b0f19fd4ab521551b07a7b0aa68dc703c89981db97d7c16440e232db5173c969
Size

608KB
MD5

68026f4714f4788ea6c96b0ade80dede
SHA1

4b68157136910dc261bbaaa4b7ecc21d63f432e1
SHA256

b0f19fd4ab521551b07a7b0aa68dc703c89981db97d7c16440e232db5173c969
SHA512

3b145c1b73f51284dc0987f94839ddea7900babdf93180c90696b3008d08b926fbc385b617fd3a2696afba27e073e31b5c24760f46ac6dadd6e33c274df0b6b4
SSDEEP

6144:tCGnyK4SIBH/uu3ZLOR4YgnScYEUbyQlTgALXqo1jmUZxL6xQGQgg:R4xJu++TgScqbPZNLXqs76P

Score

N/A

Malware Config

Signatures

Files

b0f19fd4ab521551b07a7b0aa68dc703c89981db97d7c16440e232db5173c969
.exe windows x86

9730b839dc345fce99d6fce4b4e5bd92

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_ntoa
closesocket
gethostbyname
recvfrom
select
WSAGetLastError
sendto
htons
socket
recv
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
send
connect
inet_addr
WSAStartup
WSACloseEvent
WSASetEvent
WSAResetEvent
WSAWaitForMultipleEvents
ntohs
__WSAFDIsSet
gethostname
getsockname
shutdown
setsockopt
WSASocketA
bind
htonl
listen
WSAConnect
WSASend
WSARecv
WSASendTo
WSARecvFrom
accept
WSACleanup

mswsock

AcceptEx

interface

?DrawServerState@CMyBrush@@QAEXPAVCPaintDC@@AAVCRect@@H11_N2@Z
?TransBmp@CMyBrush@@QAEEPAVCPaintDC@@VCRect@@PAVCBitmap@@@Z
?DrawProgressBar@CMyBrush@@QAEXPAVCPaintDC@@VCRect@@HAAVCString@@H@Z
?getServerIndex@CMyBrush@@QAEXPAF@Z
?setLDownBtn@CMyBrush@@QAEX_N@Z
?DrawMainPic@CMyBrush@@QAEXPAVCPaintDC@@QAVCRect@@HHH@Z
?DrawMainBtns@CMyBrush@@QAEXPAVCPaintDC@@QAVCRect@@HH_N@Z
??1CMyBrush@@UAE@XZ
??0CMyBrush@@QAE@XZ
?DrawPopupWindow@CMyBrush@@QAEXPAVCPaintDC@@VCRect@@HAAVCString@@HHH@Z
?DrawPopupManualWindow@CMyBrush@@QAEXPAVCPaintDC@@VCRect@@HAAVCString@@HHH@Z
?DrawTitle@CMyBrush@@QAEXPAVCWnd@@I@Z
?DrawSysBtn@CMyBrush@@QAEXPAVCWnd@@QAPAVCRect@@H@Z
?SetWindowRgn@CMyBrush@@QAEXPAVCWnd@@H@Z
?SetDefaultFont@CMyBrush@@QAEXPAVCDC@@@Z
?DrawUDPCheckWindow@CMyBrush@@QAEXPAVCPaintDC@@VCRect@@HAAVCString@@H@Z
?DrawSelectBar@CMyBrush@@QAEXPAVCPaintDC@@AAVCRect@@H@Z

winmm

timeGetTime

mfc42

ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord3571
ord640
ord540
ord323
ord825
ord3626
ord3663
ord641
ord2414
ord800
ord2405
ord823
ord755
ord470
ord6215
ord1768
ord2379
ord1105
ord5785
ord5875
ord1641
ord1640
ord858
ord537
ord1146
ord1168
ord1871
ord6571
ord5460
ord1872
ord6311
ord4171
ord6662
ord879
ord2740
ord880
ord882
ord2801
ord887
ord5823
ord415
ord715
ord5605
ord860
ord2824
ord1979
ord1969
ord665
ord603
ord273
ord5186
ord354
ord668
ord1980
ord924
ord1081
ord3178
ord3319
ord5710
ord535
ord4129
ord5683
ord2763
ord3181
ord4058
ord4837
ord2770
ord922
ord356
ord996
ord5442
ord3318
ord3789
ord926
ord2764
ord939
ord5651
ord3616
ord3127
ord1200
ord6385
ord3176
ord2818
ord350
ord6153
ord5773
ord1247
ord324
ord4710
ord6199
ord816
ord562
ord2642
ord2864
ord4853
ord4376
ord6197
ord3619
ord941
ord389
ord2393
ord5356
ord5207
ord5922
ord3215
ord2784
ord3173
ord5311
ord5201
ord676
ord2782
ord2771
ord369
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord4424
ord3738
ord815
ord561
ord384
ord686
ord617
ord5214
ord296
ord5943
ord6438
ord1134
ord2725
ord2302
ord3706
ord2086
ord2859
ord4299
ord3092
ord6453
ord2753
ord1576
ord2915
ord4160
ord1853
ord4204
ord6282
ord701
ord698
ord399
ord396
ord5592
ord3437
ord5633
ord3440
ord5818
ord798
ord914
ord4190
ord5465
ord532
ord6407
ord4187
ord911
ord5597
ord2775
ord1771
ord6366
ord2413
ord2024
ord6055
ord1776
ord4401
ord5290
ord3639
ord567
ord692
ord4275
ord6880
ord6605
ord4284
ord3803
ord2860
ord4123
ord5148
ord1799
ord3353
ord614
ord1194
ord290
ord4220
ord2584
ord3654
ord2863
ord2438
ord1644
ord1175
ord5718
ord6877
ord1138
ord3790
ord3402
ord2135
ord818
ord1949
ord4034
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord5265
ord4234
ord2781
ord5572

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
sscanf
atoi
realloc
malloc
free
__getmainargs
fread
memmove
strstr
_strlwr
sprintf
fopen
fclose
_mbsicmp
_mbscmp
strncpy
__CxxFrameHandler
_setmbcp
_strcmpi
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
ftell
fseek
_filelength
srand
fwrite
strlen
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
memset
memcmp
_CxxThrowException
memcpy
calloc
time
wcslen
rand
rename
remove
_beginthreadex

kernel32

QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetStartupInfoA
CreateProcessA
GetModuleFileNameA
WaitForMultipleObjects
SetEvent
WaitForSingleObject
ResetEvent
WaitForSingleObjectEx
lstrcmpA
CreateThread
GetExitCodeProcess
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateMutexA
GetVersionExA
ReleaseMutex
CopyFileA
GetFileSize
CreateFileA
GetModuleHandleA
MultiByteToWideChar
ResumeThread
CreateEventA
GetCurrentProcessId
CreateDirectoryA
SetFileAttributesA
GetFileAttributesA
Sleep
DeleteFileA
GetLastError
Process32Next
CloseHandle
GetPriorityClass
OpenProcess
Process32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
GetPrivateProfileIntA
SetCurrentDirectoryA
GetTickCount

user32

LoadCursorA
EnableWindow
PostMessageA
GetSystemMetrics
GetWindowRect
LoadBitmapA
ScreenToClient
GetParent
ReleaseCapture
SetCapture
IsZoomed
BringWindowToTop
GetPropA
EnumWindows
SetWindowRgn
SetTimer
SetPropA
SetCursor
GetDC
SetForegroundWindow
IsIconic
KillTimer
UpdateWindow
DrawIcon
LoadIconA
GetSysColor
SetRectEmpty
OffsetRect
RedrawWindow
GetMenuItemID
TrackPopupMenu
GetCursorPos
SetMenuDefaultItem
GetSubMenu
LoadMenuA
wsprintfA
CharPrevA
SendMessageA
PtInRect
GetClientRect
InvalidateRect
ReleaseDC

gdi32

GetObjectA
CreateRoundRectRgn
CreateFontA
GetTextExtentPoint32A
BitBlt
SelectObject
StretchBlt
CreateCompatibleDC
CreateCompatibleBitmap

shell32

Shell_NotifyIconA
SHFileOperationA
ShellExecuteA

ole32

CoCreateInstance
CoCreateGuid

msvcp60

??1_Lockit@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Xlen@std@@YAXXZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0_Lockit@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z

msvcirt

?close@ifstream@@QAEXXZ
?openprot@filebuf@@2HB
??0ifstream@@QAE@PBDHH@Z
??1ifstream@@UAE@XZ
??1ios@@UAE@XZ
_mtlock
?get@istream@@IAEAAV1@PADHH@Z
_mtunlock
??_Difstream@@QAEXXZ

rpcrt4

UuidCreate

Sections

.text
Size: 288KB - Virtual size: 286KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.tc
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9730b839dc345fce99d6fce4b4e5bd92

Headers

File Characteristics

Imports

ws2_32

mswsock

interface

winmm

mfc42

msvcrt

kernel32

user32

gdi32

shell32

ole32

msvcp60

msvcirt

rpcrt4

Sections

.text Size: 288KB - Virtual size: 286KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 12KB - Virtual size: 31KB

.idata Size: 12KB - Virtual size: 11KB

.rsrc Size: 12KB - Virtual size: 8KB

.reloc Size: 16KB - Virtual size: 15KB

.tc Size: 204KB - Virtual size: 204KB

.text
Size: 288KB - Virtual size: 286KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 12KB - Virtual size: 31KB

.idata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 12KB - Virtual size: 8KB

.reloc
Size: 16KB - Virtual size: 15KB

.tc
Size: 204KB - Virtual size: 204KB