6a01a40160985f8ef5c3777562e66e44193c72ef2c626bfd240abb577ff0c547

Sharing

Copy URL Twitter E-mail

General

Target

6a01a40160985f8ef5c3777562e66e44193c72ef2c626bfd240abb577ff0c547
Size

1.5MB
MD5

99ebaa6773a384b7a9955e6c08b0fd99
SHA1

fed2ebdfc5eff8002e7701f0459fbe2c4780b8bb
SHA256

6a01a40160985f8ef5c3777562e66e44193c72ef2c626bfd240abb577ff0c547
SHA512

ee2380e34687bcc80481aa87e54484929c5e202931157362ca4e17e64e686724609fd07a8b96deb332cc269ea8ae5b405759dc27d3c688f46892857b92cef907
SSDEEP

24576:RuQrJzch0xXdunfYYwL9CnerlIiFmKKJzAwF0GD+Ncx5mqJ1KAvlh:TrJxx8nfYYwknerlIiFmKKJ/3d

Score

N/A

Malware Config

Signatures

Files

6a01a40160985f8ef5c3777562e66e44193c72ef2c626bfd240abb577ff0c547
.exe windows x86

17223c9ed8c1fdf81085226785b71cab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

fnp_act_installer

fnpActSvcUninstallWin
fnpActSvcInstallWin

mfc100

ord2752
ord5532
ord12531
ord2881
ord2878
ord7349
ord2416
ord14059
ord14061
ord14060
ord14058
ord14062
ord14045
ord13972
ord13973
ord8235
ord11025
ord3395
ord10883
ord13294
ord8070
ord11108
ord6217
ord9994
ord8330
ord2847
ord12644
ord1496
ord1503
ord1509
ord1507
ord1514
ord4410
ord4381
ord4415
ord4406
ord4364
ord4368
ord4401
ord3991
ord13980
ord3984
ord2661
ord13302
ord7074
ord13300
ord6128
ord10672
ord12482
ord5253
ord2338
ord11060
ord3484
ord2945
ord2944
ord2846
ord11103
ord5123
ord9286
ord8305
ord5805
ord385
ord6680
ord1900
ord3390
ord4344
ord1929
ord7141
ord1316
ord2617
ord13125
ord948
ord2973
ord1288
ord7584
ord7510
ord11726
ord13767
ord4724
ord2163
ord11420
ord13301
ord7073
ord13299
ord8486
ord3676
ord3618
ord11806
ord7091
ord1732
ord14075
ord10922
ord13181
ord11413
ord7144
ord13483
ord13480
ord13485
ord13482
ord13484
ord13481
ord3409
ord5238
ord11172
ord11180
ord4078
ord2974
ord3620
ord10360
ord10007
ord8137
ord11067
ord7581
ord9475
ord10030
ord1210
ord788
ord300
ord2626
ord305
ord5242
ord7487
ord11781
ord4143
ord1313
ord4144
ord13131
ord266
ord265
ord11627
ord13124
ord2067
ord2063
ord2084
ord1330
ord11439
ord4499
ord7355
ord9449
ord11184
ord11153
ord11787
ord4622
ord4903
ord5095
ord8439
ord4881
ord5098
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord7357
ord9281
ord8304
ord6112
ord888
ord9399
ord3839
ord11744
ord6835
ord5776
ord5837
ord1296
ord1297
ord323
ord1867
ord1940
ord2087
ord7177
ord1314
ord1437
ord1317
ord1483
ord1266
ord2538
ord1479
ord11318
ord3439
ord316
ord4283
ord1982
ord1294
ord901
ord310
ord867
ord7582
ord4273
ord13348
ord7876
ord381
ord5803
ord8351
ord11107
ord3253
ord4785
ord12868
ord6678
ord2611
ord7837
ord11421
ord4398
ord4419
ord4377
ord4385
ord4389
ord4393
ord4373
ord11190
ord11188
ord946
ord906
ord13518
ord2090
ord322
ord2052
ord2050
ord2079
ord1979
ord2040
ord3406
ord408
ord1948
ord2089
ord2088

msvcr100

_setmbcp
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_time32
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_cexit
__getmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
_unlink
_open
_getpid
_getcwd
_stricmp
_strdup
_access
isspace
strncat
_beginthread
_endthread
_putenv
_wunlink
_wremove
remove
_waccess
_wrename
rename
_wstat64i32
_close
_wopen
_wfreopen
freopen
_wfopen
getchar
_popen
fopen
perror
exit
atol
fgetc
fgets
ungetc
clearerr
strtol
_findfirst64i32
_findnext64i32
_findclose
getenv
qsort
toupper
isxdigit
isupper
ispunct
isprint
islower
isgraph
isdigit
iscntrl
isalpha
isalnum
_exit
__sys_nerr
__sys_errlist
longjmp
abs
_errno
vsprintf
fprintf
__iob_func
fflush
strncpy
strrchr
strncmp
tolower
strchr
_localtime64
_setjmp3
calloc
strspn
strcat
_stat64i32
strcpy
strlen
memcmp
strcmp
_purecall
sscanf
__CxxFrameHandler
_vscprintf
__CxxFrameHandler3
__argv
__argc
strstr
_mbscmp
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
atoi
rand
srand
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memset
atof
strcpy_s
_mktime64
_localtime64_s
free
fclose
fwrite
fopen_s
fread
malloc
ftell
fseek
_time64
strncpy_s
strcat_s
sprintf_s
printf
memcpy
memmove
realloc
sprintf
_strlwr
strftime
_vsnprintf_s

kernel32

GetModuleHandleA
GetComputerNameA
GetLastError
GetProcAddress
lstrlenA
LoadLibraryA
GetModuleFileNameA
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
LocalAlloc
LocalFree
VirtualFree
VirtualAlloc
GetDriveTypeA
SetLastError
SetEvent
CreateEventA
ResetEvent
FindClose
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
GetCurrentProcess
GetProcessTimes
GetTickCount
GetTimeZoneInformation
GetLocalTime
SetHandleInformation
SetErrorMode
GetEnvironmentVariableW
GetEnvironmentVariableA
GetCommandLineW
WideCharToMultiByte
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsA
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetWindowsDirectoryA
GetVersionExA
GetVersion
GetSystemDirectoryA
GetCurrentDirectoryA
CopyFileA
DeleteFileA
CreateFileA
CloseHandle
DeviceIoControl
GetFileAttributesA
CreateDirectoryA
lstrcpyA
lstrcmpA
GetVolumeInformationA
FreeLibrary

user32

GetDlgItem
GetWindowLongA
MessageBeep
SetDlgItemTextA
GetDlgItemTextW
GetDlgItemTextA
GetWindowRect
MessageBoxA
GetActiveWindow
GetParent
GetFocus
SetFocus
SetWindowTextA
LoadStringA
GetSystemMetrics
EnableWindow
LoadIconW
GetClientRect
IsIconic
GetSystemMenu
SendMessageA
AppendMenuA
DrawIcon
EndDialog
DialogBoxIndirectParamA
CreateDialogIndirectParamA
wsprintfA
ScreenToClient
MoveWindow
ShowWindow

comdlg32

GetOpenFileNameA

advapi32

RegQueryValueExW
DeleteService
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteValueA
RegOpenKeyA
RegEnumKeyExA
StartServiceA
ControlService
OpenServiceA
CreateServiceA
RegQueryInfoKeyA
GetUserNameW
GetUserNameA
RegSetValueExW
CloseServiceHandle
RegEnumValueA
OpenSCManagerA

shell32

SHGetSpecialFolderPathA

comctl32

ord17
InitCommonControlsEx

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysAllocString
VariantTimeToSystemTime
VariantChangeType
VariantClear
SysFreeString
SysStringLen
VariantInit
SysAllocStringLen

msvcp100

?_Xout_of_range@std@@YAXPBD@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?_Xlength_error@std@@YAXPBD@Z

ws2_32

ntohl
htonl
gethostname
gethostbyname
gethostbyaddr
inet_ntoa
inet_addr
WSACleanup
WSAGetLastError
WSAStartup
getsockname
getsockopt
__WSAFDIsSet
select
connect
socket
htons
getprotobyname
closesocket
recv
send
ioctlsocket
setsockopt
ntohs

netapi32

Netbios

Sections

.text
Size: 409KB - Virtual size: 409KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textidx
Size: 876KB - Virtual size: 876KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fnp_dir
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fnp_mar
Size: 512B - Virtual size: 257B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17223c9ed8c1fdf81085226785b71cab

Headers

DLL Characteristics

File Characteristics

Imports

fnp_act_installer

mfc100

msvcr100

kernel32

user32

comdlg32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp100

ws2_32

netapi32

Sections

.text Size: 409KB - Virtual size: 409KB

.textidx Size: 876KB - Virtual size: 876KB

.rdata Size: 68KB - Virtual size: 68KB

.data Size: 103KB - Virtual size: 121KB

.idata Size: 12KB - Virtual size: 11KB

.fnp_dir Size: 512B - Virtual size: 376B

.fnp_mar Size: 512B - Virtual size: 257B

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 42KB - Virtual size: 42KB

.text
Size: 409KB - Virtual size: 409KB

.textidx
Size: 876KB - Virtual size: 876KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 103KB - Virtual size: 121KB

.idata
Size: 12KB - Virtual size: 11KB

.fnp_dir
Size: 512B - Virtual size: 376B

.fnp_mar
Size: 512B - Virtual size: 257B

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 42KB - Virtual size: 42KB