ADSVW[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ADSVW.exe
Size

197KB
MD5

4c6e999e8536e205d61ae98be04b6167
SHA1

e207dece54626f1adc187013d21af69f98bd9a31
SHA256

d628c16107dbf5f10252ae4d291b888cd4d3dd1fc96f1f458b7e4d5bd5296ecb
SHA512

071f5e591307adbcf42cf5fb0f6691e73bd1968c45712ba12ea9b99175452bb5c2331359f28bed1a0f969ac7d3795a2cce165482eb18bd69c450439e98694e68
SSDEEP

3072:uYKHBpLHYX587xMlxA1J7aqOVjx2vsRMP7QeLMUYWpE2n8iFidUfL3:uT/nieDOgmU4QeC

Score

1^/10

Malware Config

Signatures

Files

ADSVW.exe
.exe windows x86

cb059be3c78cd8e4bf79a5b687fd5c2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetCurrentProcess
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetModuleHandleA
GetProcAddress
FormatMessageA
WideCharToMultiByte
GetLastError
LocalAlloc
LocalFree
MultiByteToWideChar
GetPrivateProfileStringA
TerminateProcess
GetStartupInfoA
WritePrivateProfileStringA

mfc42

ord800
ord4589
ord4588
ord4899
ord4370
ord4892
ord4532
ord5076
ord4341
ord4349
ord4723
ord4890
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4964
ord4961
ord4108
ord6055
ord4078
ord1776
ord4407
ord5240
ord2385
ord5163
ord6374
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3748
ord5065
ord1726
ord5259
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3399
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4432
ord3734
ord303
ord2096
ord384
ord2915
ord4125
ord3287
ord540
ord1200
ord2862
ord4284
ord641
ord860
ord6141
ord5859
ord2514
ord713
ord414
ord858
ord5265
ord4376
ord4853
ord4998
ord4710
ord6052
ord1775
ord5241
ord5280
ord3749
ord1727
ord5261
ord4425
ord3597
ord324
ord4234
ord2370
ord3402
ord4424
ord3610
ord567
ord656
ord2302
ord939
ord539
ord940
ord535
ord861
ord537
ord922
ord924
ord2614
ord923
ord941
ord6282
ord4204
ord2301
ord1816
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord692
ord1841
ord784
ord4533
ord4340
ord4347
ord4720
ord4889
ord4963
ord4960
ord6054
ord5281
ord1725
ord5260
ord2091
ord4241
ord364
ord2358
ord1825
ord4238
ord6571
ord616
ord609
ord911
ord2086
ord4696
ord3058
ord3065
ord6336
ord813
ord2542
ord5243
ord5740
ord1746
ord5577
ord3172
ord5653
ord4420
ord4953
ord2399
ord4387
ord3454
ord3198
ord6080
ord6175
ord4623
ord4426
ord652
ord396
ord338
ord5592
ord3437
ord6329
ord6215
ord4187
ord4823
ord2575
ord4396
ord3574
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord3317
ord3874
ord3092
ord6199
ord6140
ord5858
ord795
ord804
ord1175
ord4224
ord341
ord5951
ord4047
ord5953
ord5861
ord801
ord541
ord3721
ord2587
ord4406
ord3394
ord3729
ord2299
ord3097
ord1945
ord4273
ord560
ord1830
ord2400
ord5061
ord4938
ord4940
ord4629
ord4586
ord4897
ord4368
ord4891
ord4886
ord1723
ord5251
ord5817
ord344
ord657
ord4239
ord2379
ord5875
ord6170
ord1858
ord674
ord5101
ord2101
ord2723
ord2390
ord3059
ord5100
ord5104
ord4303
ord3351
ord5012
ord976
ord5472
ord3403
ord2879
ord2878
ord4152
ord4077
ord5237
ord2382
ord5283
ord2649
ord1665
ord4436
ord5254
ord2445
ord4427
ord794
ord4458
ord4245
ord527
ord401
ord5852
ord3481
ord2252
ord5651
ord3127
ord3616
ord350
ord665
ord1979
ord5442
ord3318
ord5186
ord354
ord6143
ord2642
ord6883
ord4612
ord4610
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2725
ord402
ord986
ord411
ord2621
ord4858
ord1849
ord4244
ord5253
ord2583
ord5148
ord4403
ord3371
ord3641
ord6283
ord1168
ord1576
ord6008
ord4000
ord1146
ord1641
ord3571
ord2414
ord3626
ord823
ord825
ord3663
ord4272
ord1942
ord2510

msvcrt

_controlfp
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__set_app_type
__CxxFrameHandler
qsort
_setmbcp
free
_ultoa
malloc
atol
wcslen
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_strnicmp
atoi
wcscpy
wcscat
_wcsnicmp
_except_handler3
_itoa
_stricmp
_wcsicmp
isspace
_purecall
isdigit
sscanf
_ltoa
sprintf

user32

wsprintfA
GetClientRect
PeekMessageA
TranslateMessage
DispatchMessageA
UpdateWindow
LoadBitmapA
SendMessageA
EnableWindow
SetCursor
LoadCursorA

ole32

CoGetMalloc
OleInitialize
OleUninitialize
StringFromIID
CLSIDFromString
CoCreateInstance
CoTaskMemFree

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
SysStringLen
SysAllocString
QueryPathOfRegTypeLi
LoadTypeLi
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayCreate
SafeArrayPutElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
VariantChangeType
VariantInit
VariantClear
SysFreeString

comctl32

ImageList_AddMasked

activeds

ord18
ord13
ord4
ord6
ord5
ord3
ord9
ord14
ord15

Sections

.text
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb059be3c78cd8e4bf79a5b687fd5c2b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

mfc42

msvcrt

user32

ole32

oleaut32

comctl32

activeds

Sections

.text Size: 163KB - Virtual size: 162KB

.data Size: 3KB - Virtual size: 3KB

.rsrc Size: 30KB - Virtual size: 29KB

.text
Size: 163KB - Virtual size: 162KB

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 30KB - Virtual size: 29KB