7517cff3cbd9fd6c8ee2f5bd813ffecaa6ba08312ce93d12f68296b519e5386a

Sharing

Copy URL Twitter E-mail

General

Target

7517cff3cbd9fd6c8ee2f5bd813ffecaa6ba08312ce93d12f68296b519e5386a
Size

2.5MB
MD5

5e10c2025f71eedcd22e9f31f75f96f8
SHA1

1081da820edcddd02ac54bf61b86c1ed437ba91c
SHA256

7517cff3cbd9fd6c8ee2f5bd813ffecaa6ba08312ce93d12f68296b519e5386a
SHA512

3936e3c73380d90c36f3252ddf8d237d4af643b501502bb0fa5d8bc8b06a86f4b78939a438603ba3e68b650ed6df8409cd213b71a25ffda0ce8c75426d388caa
SSDEEP

24576:vo9IJrut6qtf/q/L9k+klmfipyu22WcmlJujavgJSLZbM1SsVX6wgBDrx8h6douo:vMuyt6y3tQu2XG8ZoIssdBDKu1iEDc

Score

N/A

Malware Config

Signatures

Files

7517cff3cbd9fd6c8ee2f5bd813ffecaa6ba08312ce93d12f68296b519e5386a
.dll windows x86

ad393bb5c6bf3f4e3d4b89c0892ed225

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

Netbios

mfc100

ord13137
ord1906
ord1973
ord6836
ord13256
ord788
ord374
ord11882
ord11941
ord3695
ord3421
ord943
ord1210
ord12128
ord10357
ord11154
ord1727
ord1278
ord5534
ord12535
ord2881
ord2878
ord7349
ord2417
ord14059
ord14061
ord14060
ord14058
ord14062
ord14045
ord13972
ord13973
ord8235
ord11025
ord3395
ord10883
ord13294
ord8070
ord6217
ord9994
ord8351
ord2847
ord12644
ord11190
ord11188
ord1496
ord1503
ord1509
ord1507
ord1514
ord4373
ord4410
ord4381
ord4393
ord4389
ord4385
ord4415
ord4406
ord4377
ord4419
ord4398
ord4364
ord4368
ord4401
ord3991
ord13980
ord3984
ord2661
ord13302
ord7074
ord13300
ord13131
ord10672
ord12482
ord5253
ord2338
ord11060
ord3484
ord2945
ord2944
ord2846
ord11103
ord4622
ord4903
ord5095
ord8439
ord1483
ord300
ord5776
ord337
ord12790
ord12124
ord917
ord4130
ord341
ord11107
ord3970
ord7933
ord381
ord5803
ord8305
ord2416
ord12531
ord5532
ord2752
ord4078
ord7141
ord14116
ord14121
ord868
ord10915
ord1266
ord4785
ord5175
ord13348
ord2538
ord7837
ord322
ord13518
ord1479
ord12657
ord339
ord1437
ord916
ord11781
ord7487
ord11627
ord12091
ord2611
ord13045
ord5242
ord305
ord2626
ord2063
ord2067
ord11277
ord5208
ord421
ord10906
ord977
ord2524
ord1288
ord7584
ord7510
ord11726
ord13767
ord4724
ord2163
ord11420
ord11421
ord13301
ord7073
ord13299
ord8486
ord3676
ord3618
ord11806
ord7091
ord1732
ord14075
ord10922
ord13181
ord11413
ord4881
ord5123
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord7357
ord9286
ord8304
ord6117
ord895
ord878
ord1292
ord3390
ord4345
ord11924
ord2183
ord6070
ord1900
ord5774
ord1294
ord262
ord1316
ord13329
ord11297
ord2818
ord1313
ord13310
ord11274
ord2056
ord6010
ord310
ord2184
ord5830
ord3439
ord316
ord4283
ord1982
ord901
ord5837
ord265
ord266
ord4317
ord4349
ord383
ord946
ord4498
ord11439
ord5207
ord1448
ord2061
ord12716
ord7144
ord1296
ord13483
ord13480
ord1297
ord13485
ord13482
ord13484
ord13481
ord3409
ord5238
ord11172
ord11180
ord7355
ord9449
ord11184
ord11153
ord11787
ord5098
ord9281
ord6112
ord888
ord6835
ord6678
ord8137
ord12962
ord4131
ord9475
ord12865
ord11067
ord10007
ord10360
ord3620
ord2974
ord6128
ord906
ord2090
ord2052
ord2050
ord2079
ord1979
ord2040
ord3406
ord408
ord1948
ord2089
ord2087
ord1940
ord1867
ord1929
ord323
ord2973

msvcr100

_unlink
fclose
_strnicmp
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_stricmp
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_except_handler3
_localtime64_s
_mktime64
toupper
fwrite
rename
strtol
atoi
fopen
fread
_strlwr
_findfirst64i32
_findnext64i32
_findclose
strrchr
memchr
memmove
_vsnprintf
srand
rand
_time64
_CxxThrowException
sscanf
ftell
fseek
strncmp
sprintf
memcpy
ldiv
__CxxFrameHandler3
strchr
atol
strncpy
strstr
strncpy_s
memset

kernel32

WriteProcessMemory
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
VirtualProtectEx
GetSystemTimeAsFileTime
GetVersionExA
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedExchange
DecodePointer
EncodePointer
VirtualAlloc
SuspendThread
SetThreadContext
GetThreadContext
GetCurrentProcess
FlushInstructionCache
ResumeThread
VirtualProtect
InterlockedCompareExchange
VirtualQuery
GetModuleFileNameA
GetPrivateProfileIntA
GetCurrentThread
CreateDirectoryA
GetTickCount
LCMapStringW
LCMapStringA
CopyFileA
DeleteFileA
Sleep
GetLocalTime
RemoveDirectoryA
lstrlenA
OutputDebugStringA
SetLastError
LocalAlloc
GetVersion
GetLastError
FormatMessageA
LocalFree
MulDiv
HeapAlloc
GetCurrentThreadId
GetProcessHeap
HeapFree
LockResource
FindResourceA
SizeofResource
LoadResource
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource
lstrcmpiA
FreeLibrary

user32

SystemParametersInfoA
OffsetRect
GetCursorPos
GetParent
GetWindowTextA
GetWindowLongA
GetClassNameA
GetWindowDC
ReleaseDC
DrawTextA
SendMessageA
IsIconic
InflateRect
FrameRect
FillRect
GetDlgCtrlID
GetSysColorBrush
CopyRect
PtInRect
SetRect
LoadBitmapA
RedrawWindow
SetWindowLongA
GetClientRect
ScreenToClient
GetWindowRect
GetSysColor
DrawTextExW
DrawTextW
DrawTextExA
ShowScrollBar
SetScrollRange
GetScrollRange
GetScrollPos
SetScrollPos
MessageBoxA
MessageBeep
EqualRect
GetScrollInfo
SetPropA
RemovePropA
SetScrollInfo
EnableScrollBar
IsWindowVisible
GetMessagePos
SetRectEmpty
ClientToScreen
GetPropA
ShowWindow
GetDC
IsRectEmpty
ReleaseCapture
GetKeyState
IsWindow
EnableWindow
SetCapture
GetWindowRgn
SetWindowRgn
LoadBitmapW
GetWindowThreadProcessId
EnumThreadWindows
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetSystemMenu
GetMenuState
GetFocus
CallWindowProcA
DefWindowProcA
KillTimer
GetAsyncKeyState
SetTimer
MoveWindow
IsZoomed
PostMessageA
LoadCursorA
SetCursor
EnumChildWindows
InvalidateRect
WindowFromPoint
SetWindowPos
GetSystemMetrics

gdi32

OffsetRgn
DeleteObject
BitBlt
CreateCompatibleBitmap
ExtTextOutW
GetDIBits
SaveDC
RestoreDC
ExtTextOutA
SetStretchBltMode
StretchBlt
ExtCreateRegion
CreateBitmap
GetTextExtentPoint32A
PtInRegion
CombineRgn
CreateRectRgn
GetBitmapBits
GetBkMode
ExcludeClipRect
SetPixel
Ellipse
MoveToEx
LineTo
CreateFontIndirectA
GetObjectA
CreateFontA
CreatePen
RoundRect
SetBkColor
CreateSolidBrush
GetStockObject
SetTextColor
DeleteDC
CreateCompatibleDC
SetBkMode
SelectObject

msimg32

GradientFill

comctl32

_TrackMouseEvent

ole32

CreateStreamOnHGlobal

urlmon

CoInternetSetFeatureEnabled

ws2_32

recv
ntohs
closesocket
__WSAFDIsSet
getsockopt
select
WSAGetLastError
connect
ioctlsocket
gethostbyname
inet_addr
htons
setsockopt
socket
send

gdiplus

GdipAlloc
GdipDeleteGraphics
GdipLoadImageFromStream
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipReleaseDC
GdipDrawImageRectI
GdipCloneImage
GdiplusStartup
GdipFree

Exports

Exports

AddLongTime
AddLongTime_ExceptWeekend
AllTrim
AllTrimEx
Base64Encode
BufToDouble
ClassXP
CloseTdxIni
CopyIt
DeleteDirInfo
DeleteMatchFile
DirectConnect
DoubleToBuf
FormatFloat_XS
GetBackDate
GetCmdLine
GetFileMD5Str
GetForwardDate
GetFriday
GetLocalTodayYMD
GetMonth1st
GetNetCardStr
GetSeason1st
GetTDXProfileInt
GetTDXProfileString
GetTdxPYStr
GetWeek
GetYear1st
HLS_TRANSFORM
IsRecentFile
IsValidFileName
ListCtrl2Txt
LongToTime
MD5BIN_Buffer
MD5_Buffer
MD5_String
MakeBuildNo
OpenTdxIni
ParseMessageStr
ReceiveBytes
RejustDateCtrlRange
RemoveReadOnlyStatus
SCT_DisableProtect
SCT_EnableProtect
SaveTdxIni
SaveToBMPFile
SendToSocket
SoftKey_Close
SoftKey_Switch
SubLongTime
TDXBeep
Tdx_OutputDebugString
TestFileExist
TestFileExist_Ex
TimeToLong
TrimString
UrlDecode
UrlEncode
YmdhmsToTime
tdx_filelength

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vy1
Size: 908KB - Virtual size: 908KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vy0
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.byxm
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vy2
Size: 569KB - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 908KB - Virtual size: 907KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad393bb5c6bf3f4e3d4b89c0892ed225

Headers

DLL Characteristics

File Characteristics

Imports

netapi32

mfc100

msvcr100

kernel32

user32

gdi32

msimg32

comctl32

ole32

urlmon

ws2_32

gdiplus

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 96KB

.rdata Size: 28KB - Virtual size: 28KB

.data Size: 37KB - Virtual size: 44KB

.vy1 Size: 908KB - Virtual size: 908KB

.vy0 Size: 13KB - Virtual size: 16KB

.byxm Size: 16KB - Virtual size: 16KB

.vy2 Size: 569KB - Virtual size: 568KB

.reloc Size: 9KB - Virtual size: 8KB

.rsrc Size: 908KB - Virtual size: 907KB

.text
Size: 96KB - Virtual size: 96KB

.rdata
Size: 28KB - Virtual size: 28KB

.data
Size: 37KB - Virtual size: 44KB

.vy1
Size: 908KB - Virtual size: 908KB

.vy0
Size: 13KB - Virtual size: 16KB

.byxm
Size: 16KB - Virtual size: 16KB

.vy2
Size: 569KB - Virtual size: 568KB

.reloc
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 908KB - Virtual size: 907KB