3b8471d37cd7e1dc896c35d7513ef9bc47881e327c5a4d3aa9dd51f5d156b9c9

Sharing

Copy URL Twitter E-mail

General

Target

3b8471d37cd7e1dc896c35d7513ef9bc47881e327c5a4d3aa9dd51f5d156b9c9
Size

180KB
MD5

f1661dadab5de04746cbc6a243782ca3
SHA1

9fdfae7d1272a6add93a09c7b7940e2ab0677be0
SHA256

3b8471d37cd7e1dc896c35d7513ef9bc47881e327c5a4d3aa9dd51f5d156b9c9
SHA512

c27bc0a7e0e4306c3cb22b0c9834d816959ea916d362c48ca546119a28c2cbc8df0e84fd21ebf74f60a78886164cb06df6e7bf0343640ac9fe4360bf91df0b7e
SSDEEP

3072:LTmPbqcsj/+el6wqqqr9vLRYQ8fjXeS7WWk/:Nl6wHydRZujXeS7WT/

Score

N/A

Malware Config

Signatures

Files

3b8471d37cd7e1dc896c35d7513ef9bc47881e327c5a4d3aa9dd51f5d156b9c9
.exe windows x86

3cea03618813f70ee1f6f9c4c5e1b3d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
GetCurrentProcess
GlobalUnlock
LocalFree
WideCharToMultiByte
CreateFileA
GetModuleHandleA
lstrlenA
MultiByteToWideChar
lstrcatA
MoveFileA
GetProcessHeap
HeapAlloc
GetCurrentProcessId
GetFileSize
VirtualAlloc
ReadFile
CloseHandle
FindFirstFileA
WriteFile
FindClose
GetLastError
GetStartupInfoA
FreeLibrary
CreateThread
Sleep
GetLocalTime
GetTickCount
LoadLibraryA
InterlockedDecrement
GetProcAddress

user32

DestroyCursor
EmptyClipboard
OpenClipboard
CloseClipboard
GetSystemMetrics
LoadCursorA
ReleaseDC
wsprintfA
CreateWindowExA
IsWindow
SendMessageA
SetRect
GetCursorInfo

gdi32

CreateCompatibleBitmap
GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject

advapi32

RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
DeleteService
StartServiceA

shell32

ShellExecuteA
SHGetSpecialFolderPathA

ole32

CoInitialize
OleRun
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantClear
GetErrorInfo

msvcrt

_strupr
_strnicmp
_onexit
__dllonexit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
memmove
ceil
_ftol
strstr
rand
sprintf
strncpy
strchr
malloc
free
_except_handler3
strrchr
_iob
atoi
wcscpy
strncmp
_errno
exit
strncat
atol
_beginthreadex
calloc
??1type_info@@UAE@XZ
_exit
_XcptFilter
_acmdln
__getmainargs
_strcmpi

ws2_32

recv
inet_addr
gethostname
__WSAFDIsSet
listen
accept
getpeername
bind
sendto
setsockopt
send
socket
gethostbyname
htons
connect
WSAIoctl
closesocket
select
WSACleanup
WSAStartup
WSASocketA
getsockname
ntohs
inet_ntoa
htonl

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile

msvcp60

?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

urlmon

URLDownloadToFileA

netapi32

NetLocalGroupAddMembers
NetUserAdd

msvfw32

ICSeqCompressFrame
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd

Exports

Exports

aabbccdd
daxuewuli
eeffgghh
gaoshu
gongchengshuxue
iijjkkmm

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3cea03618813f70ee1f6f9c4c5e1b3d4

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcrt

ws2_32

wininet

msvcp60

urlmon

netapi32

msvfw32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 119KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 16KB - Virtual size: 18KB

.rsrc Size: 28KB - Virtual size: 25KB

.text
Size: 120KB - Virtual size: 119KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 16KB - Virtual size: 18KB

.rsrc
Size: 28KB - Virtual size: 25KB