4411b6e9ae321cc32c46211da22d1eadf43ae35172742f36ec66f7fb4d9ed267

Sharing

Copy URL Twitter E-mail

General

Target

4411b6e9ae321cc32c46211da22d1eadf43ae35172742f36ec66f7fb4d9ed267
Size

392KB
MD5

b3b83f7e0de0439563cdeb8b20bbebac
SHA1

b409456c172ddec5cc71608f05bedab5d417f40f
SHA256

4411b6e9ae321cc32c46211da22d1eadf43ae35172742f36ec66f7fb4d9ed267
SHA512

d128de78a6106ea6dfdae2c2fa8b823a7f2609743924ef2da3c71e6e86dff93291ed3c8a8f941bbcef8bc78c090c45d1068fd6b7e7655341d73603c5d2561a7c
SSDEEP

6144:1i7v2jK3Yvb5jGDuE5kmhp5gPTCWxAmCciwqNW0dbtqqDLuVhxX:W2jKIvb5jGDuE5Tp5gz6DdbQqnuV7

Score

1^/10

Malware Config

Signatures

Files

4411b6e9ae321cc32c46211da22d1eadf43ae35172742f36ec66f7fb4d9ed267
.exe windows x86

163a97dffa037c6b0a89af30d82a946d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winexdb

closedb
startdb
dbfgettableinfo
dbfisqlcommand
dbfcommand
dbfBulkCopyIn

dorbase

?update@Rsqlclient@@QAEHPAD0@Z
??0Rsqlclient@@QAE@XZ
?datatypelen@@YAHH@Z
?SetDataNums@RdbMultTypeStore@@QAEXH@Z
?KeyCompare@Bptree@@UAEHPAX0@Z
?QSSKeyCompare@QuickSortSrch@@UAEHPAX0@Z
?QSSKeyCompare@RdbQuickSortSrch@@UAEHPAX0@Z
?DispTableStruct@BaseTable@@UAEHXZ
?GetRecordAddr@BaseTable@@UAEPAXH@Z
?GetRecordCount@BaseTable@@UAEHXZ
?PutColumnBaseValue@BaseTable@@UAEHHPAUBTBL_COLUMNINFO@@PAVVartype_value@@@Z
?GetColumnBaseValue@BaseTable@@UAEHHPAUBTBL_COLUMNINFO@@PAVVartype_value@@@Z
?KeyCompare@RdbKeyBptree@@UAEHPAX0@Z
?OpenTable@RdbLocalTable@@UAEHPAD@Z
?SetRight@RdbLocalTable@@UAEXXZ
?GetRecordCount@RdbLocalTable@@UAEHXZ
?OpenTable@RdbTable@@UAEHPAD@Z
?PutColumnValueBase@RdbSpeedyQuery@@UAEHPADPAX0PAVVartype_value@@@Z
?SetRight@RdbTable@@EAEXXZ
?updateattr@BaseRsql@@QAEHPADEPAX@Z
?updatetable@BaseRsql@@QAEHPAD@Z
?get_intval@RdbMultTypeValue@@QAEHH@Z
?get_value_orderno@RdbMultTypeValue@@QAEHH@Z
??1RdbMultTypeValue@@QAE@XZ
?GetFieldValue@RdbSpeedyPolling@@QAEHPAD0HPAUFIELDINFO@@PAVRdbMultTypeValue@@@Z
??0RdbMultTypeValue@@QAE@XZ
?selectattr@BaseRsql@@QAEHPAD@Z
?where@BaseRsql@@QAEHPADEPAXEE@Z
?GetColumnValueBase@RdbSpeedyQuery@@UAEHPADPAX0PAVVartype_value@@@Z
??1Premalloc@@QAE@XZ
?set_mallocpara@Premalloc@@QAEXHHH@Z
?select@Rsqlclient@@QAEHPAD0@Z
??0Premalloc@@QAE@XZ
??1SplitFieldInfo@@QAE@XZ
??0SplitFieldInfo@@QAE@XZ
??0RdbSpeedyStream@@QAE@XZ
??1RdbSpeedyStream@@QAE@XZ
??1Rsqlclient@@QAE@XZ
?get_floatval@BaseTable@@QAEMHPAD@Z
?selectfrom@BaseRsql@@QAEHPAD@Z

pcnet

?rx_data@link_tx@@UAEHPAXH@Z
?rx_head@link_tx@@UAEHPAUhead_t@@@Z
??1link_tx@@UAE@XZ
?PutDebug@NetDebug@@UAAXHPADZZ
??Anet_cfg@@QAEAAUHOST@@H@Z
?tx_stream@link_tx@@UAEHPADHHHHPAX@Z
?link_to@link_tx@@UAEHUin_addr@@HH@Z
??0link_tx@@QAE@XZ
?net_b_addr@net_cfg@@UAEHHPAUin_addr@@@Z
??1NetDebug@@UAE@XZ
?net_a_addr@net_cfg@@UAEHHPAUin_addr@@@Z
?get_self@net_cfg@@UAEHXZ
??0net_cfg@@QAE@XZ
??0NetDebug@@QAE@XZ
??0link_tx@@QAE@HHH@Z
?put_send@gram_man@@UAEXPAUhead_t@@PADH@Z
?put_recv@gram_man@@UAEXPAUhead_t@@H@Z
?get_gram@gram_man@@UAEHPAUGRAM_HEAD@@@Z
??1gram_man@@UAE@XZ
?get_host_name@@YAXPAD@Z
??0gram_man@@QAE@XZ
?delay_t@@YAXH@Z
?get_last_error@@YAHXZ
?get_main_wnd@parent_id@@UAEPAUHWND__@@XZ
?parent@@3Vparent_id@@A
?ClearAll@NetDebug@@UAEXXZ
?GetDebug@NetDebug@@UAEPADXZ
?saveflag@NetDebug@@UAEHXZ
?ReadRemoteDebug@NetDebug@@UAEHUin_addr@@PAVmem_man@@@Z
?SetRemoteDebug@NetDebug@@UAEHPAHHUin_addr@@H@Z
?StartRemoteDebug@NetDebug@@UAEXPAXHH@Z
?DisplayBuffer@NetDebug@@UAEXHPAXH@Z
?GetDebugInfor@NetDebug@@UAEPADH@Z
?ClearDisplay@NetDebug@@UAEXH@Z
?SetDisplay@NetDebug@@UAEXH@Z
?Clear@NetDebug@@UAEXXZ
?GetBufNum@make_buf@@UAE?AUint64u@@XZ
?get_buf@make_buf@@UAEHHPAX@Z
?get_buf@make_buf@@UAEPAXHPAH@Z
?add_buf@make_buf@@UAEHHPAX@Z
?clear_buf@make_buf@@UAEXXZ
?resize_mem@mem_man@@UAEPAXH@Z
?get_mem_ptr@mem_man@@UAEPAXXZ
?get_mem_len@mem_man@@UAEHXZ
??1make_buf@@UAE@XZ
??0make_buf@@QAE@XZ
??1net_information@@UAE@XZ
??0net_information@@QAE@XZ
?kill_proc@syscon@@UAEHPADUint32s@@@Z
?proc_ctrl@syscon@@UAEHPAD0H@Z
??1shm_db@@UAE@XZ
??Bmem_man@@QAEPAXXZ
?procdb@shm_db@@UAEPAUPROC_DB@@XZ
??0shm_db@@QAE@XZ
?get_proc_infor@syscon@@UAEPAUPROC_DB@@PAD@Z
??1rtdb_proc@@UAE@XZ
?recall@rtdb_proc@@QAEHPAD000@Z
??0rtdb_proc@@QAE@XZ
?switch_server@syscon@@UAEHPAD0@Z
??1syscon@@UAE@XZ
?switch_host@syscon@@UAEHPAD@Z
??0syscon@@QAE@XZ
??1fileproc@@UAE@XZ
??1mem_man@@UAE@XZ
?write_file@fileproc@@UAEHPAXH@Z
?read_file@fileproc@@UAEHPAXH@Z
??0mem_man@@QAE@H@Z
?get_file_len@fileproc@@UAEHXZ
??0fileproc@@QAE@PAD@Z
?CreateProcEvent@proc_man@@EAEXPAD0F@Z
?read_data@proc_man@@EAEXXZ
?clear@proc_man@@UAEXXZ
?check_proc@proc_man@@UAEXXZ
?check_proc@proc_man@@UAEXH@Z
?kill_all@proc_man@@UAEXXZ
?kill_all@proc_man@@UAEXH@Z
?is_proc_exist@proc_man@@UAEHPAD@Z
?start_proc@proc_man@@UAEXPAD00PAUHWND__@@0H@Z
?clear_proc@proc_man@@UAEXXZ
?end_proc@proc_man@@UAEXXZ
?watch_proc@proc_man@@UAEXXZ
?send_signal@proc_man@@UAEXPADH@Z
?CheckParentProc@proc_man@@UAEHXZ
??0proc_man@@QAE@XZ
??1proc_man@@UAE@XZ
??4fileproc@@QAEXPAD@Z
??0mem_man@@QAE@XZ
?tx_stream@link_tx@@UAEHPAUhead_t@@PAX@Z
?main_graph_server@net_cfg@@QAEHXZ
??1mail_box_@@UAE@XZ
?get_host_no@net_cfg@@UAEHPAD@Z
?srv_result_tocln@mail_box_@@QAEHPAUmail_head_t@@PAXHH@Z
?srv_request_frmcln@mail_box_@@QAEHPAUmail_head_t@@0PAPAXPAHPADH@Z
??0mail_box_@@QAE@PAD@Z
?append_file@fileproc@@UAEXPADH@Z
?am_I_main_center@net_cfg@@QAEHXZ
?am_I_server@net_cfg@@QAEHPAD@Z
??1event_proc@@UAE@XZ
?save_event@event_proc@@UAEHPAUSYS_EVENT@@H@Z
?GetEventTime@event_proc@@QAEXPAUSYS_EVENT@@@Z
??0event_proc@@QAE@XZ
?getversion@@YAMXZ
??1net_cfg@@UAE@XZ

iphlpapi

GetAdaptersInfo
GetIfTable

wsock32

sendto
inet_addr
WSAStartup
select
__WSAFDIsSet
accept
socket
htons
htonl
bind
listen
closesocket
send
recv
getpeername
inet_ntoa
setsockopt
ioctlsocket
gethostbyname

historymodel

?GetHisModelIndex@CSavePowerModel@@SAHPAUSHisModelIndex@@@Z
?GetOneModelNO@CSavePowerModel@@SAH_K@Z
??1CSavePowerModel@@QAE@XZ
??0CSavePowerModel@@QAE@XZ
?SaveGraph@CSavePowerModel@@QAEH_KPAD@Z
?SaveData@CSavePowerModel@@QAEH_KPAD@Z

langtrans

?SetLanguageType@@YAHXZ
?_LANGTR@@YAPADPAD@Z

mfc42d

ord1041
ord2076
ord1190
ord4183
ord413
ord646
ord4029
ord4028
ord3400
ord3652
ord4987
ord4061
ord3685
ord711
ord883
ord1096
ord4896
ord3530
ord354
ord3429
ord599
ord1239
ord1969
ord3661
ord3666
ord1309
ord2077
ord4210
ord4174
ord1365
ord3361
ord4756
ord2222
ord2223
ord2717
ord4279
ord973
ord4021
ord2679
ord3575
ord3692
ord4081
ord4078
ord2412
ord1784
ord2103
ord1417
ord2052
ord717
ord4951
ord5065
ord706
ord528
ord2986
ord1285
ord2021
ord3657
ord3784
ord2715
ord4408
ord4215
ord4239
ord3826
ord3366
ord2104
ord4229
ord4227
ord2661
ord1789
ord4130
ord1033
ord3231
ord4415
ord1860
ord1880
ord3702
ord5077
ord3629
ord5099
ord3948
ord3305
ord1846
ord4297
ord4208
ord3831
ord1629
ord972
ord2435
ord1031
ord3173
ord1546
ord2069
ord3524
ord1857
ord1757
ord728
ord317
ord335
ord519
ord492
ord1087
ord2824
ord734
ord574
ord586
ord699
ord2875
ord4492
ord1228
ord1952
ord3658
ord3786
ord3367
ord2431
ord3142
ord3144
ord3143
ord2339
ord2432
ord2341
ord2585
ord2473
ord3691
ord2584
ord2481
ord2340
ord4205
ord1631
ord1830
ord4191
ord1344
ord4064
ord3002
ord5078
ord1566
ord1100
ord3670
ord3944
ord3069
ord1310
ord2078
ord3618
ord5076
ord4118
ord1781
ord4176
ord3651
ord1364
ord3362
ord4753
ord1862
ord4017
ord4195
ord510
ord507
ord897
ord512
ord2408
ord714
ord723
ord345
ord511
ord2133
ord721
ord1179
ord1136
ord1043
ord593
ord2637
ord3112
ord2628
ord684
ord880
ord2489
ord3338
ord2142

msvcrtd

localtime
memcmp
strcpy
printf
exit
memmove
strcmp
strchr
sprintf
fclose
fopen
strstr
strcat
time
strncpy
strncmp
fgets
_ftol
remove
realloc
_errno
rand
srand
_except_handler3
__set_app_type
_setmbcp
memset
memcpy
__CxxFrameHandler
free
malloc
strlen
getenv
_chkesp
isspace
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
_purecall
mktime
fprintf
__dllonexit
_controlfp

kernel32

CloseHandle
GetModuleHandleA
GetLastError
GetStartupInfoA
WinExec
TerminateThread
CreateMutexA
Sleep
SystemTimeToFileTime
OpenProcess
GetProcessTimes
GetProcAddress
GlobalMemoryStatus
OpenFileMappingA
LoadLibraryA
CreateProcessA
GetSystemTime
CreateFileMappingA
MapViewOfFile
GetDiskFreeSpaceA

user32

SendMessageTimeoutA
IsWindow
LoadIconA

shell32

Shell_NotifyIconA

mfcn42d

ord277

msvcirtd

??6ostream@@QAEAAV0@P6AAAV0@AAV0@@Z@Z
?cout@@3Vostream_withassign@@A
?endl@@YAAAVostream@@AAV1@@Z
??6ostream@@QAEAAV0@H@Z
??6ostream@@QAEAAV0@PBD@Z

mfco42d

ord1301

Exports

Exports

??0Arrayvalue@@QAE@XZ
??0BaseTable@@QAE@ABV0@@Z
??0BaseTable@@QAE@XZ
??0Bptree@@QAE@ABV0@@Z
??0Bptree@@QAE@XZ
??0Histable@@QAE@ABV0@@Z
??0MallocSpace@@QAE@H@Z
??0OptimizeRdbSpeedQuery@@QAE@ABV0@@Z
??0QuickSortSrch@@QAE@ABV0@@Z
??0QuickSortSrch@@QAE@XZ
??0RdbColumnInfo@@QAE@XZ
??0RdbKeyBptree@@QAE@ABV0@@Z
??0RdbKeyBptree@@QAE@XZ
??0RdbLineAnalysis@@QAE@PAD@Z
??0RdbLineAnalysis@@QAE@XZ
??0RdbLocalTable@@QAE@ABV0@@Z
??0RdbMixFieldPolling@@QAE@XZ
??0RdbMixFieldStream@@QAE@XZ
??0RdbMultTypeStore@@QAE@H@Z
??0RdbMultTypeStore@@QAE@XZ
??0RdbQuickSortSrch@@QAE@ABV0@@Z
??0RdbQuickSortSrch@@QAE@PAXHHH@Z
??0RdbQuickSortSrch@@QAE@XZ
??0RdbSQL@@QAE@ABV0@@Z
??0RdbSpeedyPolling@@QAE@XZ
??0RdbSpeedyQuery@@QAE@ABV0@@Z
??0RdbSpeedyServer@@QAE@ABV0@@Z
??0RdbTable@@QAE@ABV0@@Z
??0Rsqlclient@@QAE@ABV0@@Z
??0Rsqlserver@@QAE@ABV0@@Z
??0ServerFieldInfo@@QAE@XZ
??0Vartype_value@@QAE@XZ
??1Arrayvalue@@QAE@XZ
??1BaseTable@@QAE@XZ
??1MallocSpace@@QAE@XZ
??1RdbMixFieldPolling@@QAE@XZ
??1RdbMixFieldStream@@QAE@XZ
??1RdbSpeedyPolling@@QAE@XZ
??1ServerFieldInfo@@QAE@XZ
??1Vartype_value@@QAE@XZ
??4Arrayvalue@@QAEAAV0@ABV0@@Z
??4BaseRsql@@QAEAAV0@ABV0@@Z
??4BaseTable@@QAEAAV0@ABV0@@Z
??4Bptree@@QAEAAV0@ABV0@@Z
??4Hislibrary@@QAEAAV0@ABV0@@Z
??4Histable@@QAEAAV0@ABV0@@Z
??4MallocSpace@@QAEAAV0@ABV0@@Z
??4OptimizeRdbSpeedQuery@@QAEAAV0@ABV0@@Z
??4Premalloc@@QAEAAV0@ABV0@@Z
??4QuickSortSrch@@QAEAAV0@ABV0@@Z
??4RdbColumnInfo@@QAEAAV0@ABV0@@Z
??4RdbConfigValue@@QAEAAV0@ABV0@@Z
??4RdbEvent@@QAEAAV0@ABV0@@Z
??4RdbEventNoUser@@QAEAAV0@ABV0@@Z
??4RdbKeyBptree@@QAEAAV0@ABV0@@Z
??4RdbLineAnalysis@@QAEAAV0@ABV0@@Z
??4RdbLocalTable@@QAEAAV0@ABV0@@Z
??4RdbMixFieldPolling@@QAEAAV0@ABV0@@Z
??4RdbMixFieldStream@@QAEAAV0@ABV0@@Z
??4RdbMultTypeStore@@QAEAAV0@ABV0@@Z
??4RdbMultTypeValue@@QAEAAV0@ABV0@@Z
??4RdbQuickSortSrch@@QAEAAV0@ABV0@@Z
??4RdbSQL@@QAEAAV0@ABV0@@Z
??4RdbSpeedyPolling@@QAEAAV0@ABV0@@Z
??4RdbSpeedyQuery@@QAEAAV0@ABV0@@Z
??4RdbSpeedyServer@@QAEAAV0@ABV0@@Z
??4RdbSpeedyStream@@QAEAAV0@ABV0@@Z
??4RdbTable@@QAEAAV0@ABV0@@Z
??4RdbTableLocation@@QAEAAV0@ABV0@@Z
??4RdbTime@@QAEAAV0@ABV0@@Z
??4RdbUser@@QAEAAV0@ABV0@@Z
??4Rsqlclient@@QAEAAV0@ABV0@@Z
??4Rsqlserver@@QAEAAV0@ABV0@@Z
??4ServerFieldInfo@@QAEAAV0@ABV0@@Z
??4ShareMem@@QAEAAV0@ABV0@@Z
??4SplitFieldInfo@@QAEAAV0@ABV0@@Z
??4Vartype_value@@QAEAAV0@ABV0@@Z
??BMallocSpace@@QAEPAXXZ
??_7BaseTable@@6B@
??_7Bptree@@6B@
??_7Histable@@6B@
??_7QuickSortSrch@@6B@
??_7RdbKeyBptree@@6B@
??_7RdbLocalTable@@6B@
??_7RdbQuickSortSrch@@6B@
??_7RdbSQL@@6B@
??_7RdbSpeedyQuery@@6B@
??_7RdbTable@@6B@
??_7Rsqlclient@@6B@
??_7Rsqlserver@@6B@
?ArrayInit@Arrayvalue@@QAEXXZ
?Border@RdbColumnInfo@@QAEHXZ
?FreeFieldInfo@ServerFieldInfo@@QAEXXZ
?GetAddr@MallocSpace@@QAEPAXXZ
?GetColumnValue@RdbSpeedyQuery@@QAEHPADPAX0PAVVartype_value@@@Z
?GetFieldInfo@ServerFieldInfo@@QAEPAUFIELDINFO_SERV@@PAH@Z
?InLine@RdbLineAnalysis@@QAEXPAD@Z
?InitQuickSortSrch@QuickSortSrch@@QAEXPAXHHH@Z
?Initializtion@RdbColumnInfo@@QAEXXZ
?MPutFieldInit@RdbSpeedyPolling@@QAEHXZ
?PutColumnValue@RdbSpeedyQuery@@QAEHPADPAX0PAVVartype_value@@@Z
?ReadRight@BaseTable@@UAEHXZ
?ReadRight@RdbTable@@UAEHXZ
?ServerName@ServerFieldInfo@@QAEPADXZ
?WriteRight@BaseTable@@UAEHXZ
?WriteRight@RdbLocalTable@@UAEHXZ
?WriteRight@RdbTable@@UAEHXZ
?caldecsecs@RdbTime@@QAEHHH@Z
?freespace@Premalloc@@QAEXXZ
?get_mallocinfo@Premalloc@@QAEPAXPAH@Z
?get_value_nums@RdbMultTypeStore@@QAEHXZ
?get_value_nums@RdbMultTypeValue@@QAEHXZ
?getrcdaddr@BaseTable@@QAEPAXH@Z
?getrcdcnt@BaseTable@@QAEHXZ
?valueinfo@Vartype_value@@QAEHPAE@Z

Sections

.text
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_BSS
Size: 4KB - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

163a97dffa037c6b0a89af30d82a946d

Headers

File Characteristics

Imports

winexdb

dorbase

pcnet

iphlpapi

wsock32

historymodel

langtrans

mfc42d

msvcrtd

kernel32

user32

shell32

mfcn42d

msvcirtd

mfco42d

Exports

Exports

Sections

.text Size: 300KB - Virtual size: 299KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 20KB - Virtual size: 24KB

.idata Size: 16KB - Virtual size: 13KB

_BSS Size: 4KB - Virtual size: 260B

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 300KB - Virtual size: 299KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 20KB - Virtual size: 24KB

.idata
Size: 16KB - Virtual size: 13KB

_BSS
Size: 4KB - Virtual size: 260B

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 12KB - Virtual size: 11KB