702a1b0f102984d5b1263ab87734876f42b0b003918e464f9b348285480eb5fd

Sharing

Copy URL

Twitter E-mail

General

Target

702a1b0f102984d5b1263ab87734876f42b0b003918e464f9b348285480eb5fd
Size

308KB
MD5

27e189da6774e59f3ac420ae4142dfa7
SHA1

291a4c888f073dfc9c28b9fe10f9c9315012073d
SHA256

702a1b0f102984d5b1263ab87734876f42b0b003918e464f9b348285480eb5fd
SHA512

06c2fd2cb8afc18d23ac57d2d9a3c2a5f6de21161ecfaf6e18373d7f953446a1c372b4eb95409ff5f751fbdc325dbe9cfc1e8e71d37f4124ef458b79629b6513
SSDEEP

6144:IzhV5MdA/iC9Os/gWKT+t0NJVxApNAwwIZ6OQu5UV8iFkUxVbd2q3kKJznz3Qk4B:IVLMafOs/gWKT+t0NJVxApNAwwIZ6Oor

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
702a1b0f102984d5b1263ab87734876f42b0b003918e464f9b348285480eb5fd

Files

702a1b0f102984d5b1263ab87734876f42b0b003918e464f9b348285480eb5fd
.exe windows x86

c4f1c48615c3c9dbcc42eb2f6345998c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

inplus

ord1
ord4
ord8
ord2

ws2_32

WSACleanup
WSAStartup
WSAGetOverlappedResult
WSARecv
WSAEventSelect
select
WSASocketW
WSAIoctl
ntohl
socket
accept
WSAAsyncGetHostByName
closesocket
WSACancelAsyncRequest
htonl
setsockopt
getsockopt
ioctlsocket
listen
shutdown
getpeername
connect
send
recv
bind
inet_addr
gethostbyname
WSAAsyncSelect
htons
WSASetLastError
ntohs
WSAGetLastError
inet_ntoa
WSASend

ktpublic

??1CKTXmlNodes@KTXml@@QAE@XZ
??1CKTXmlNode@KTXml@@QAE@XZ
?OpenXml@CKTXml@KTXml@@QAEHPBG@Z
?GetInt@CKTXmlNode@KTXml@@QAEHH@Z
?GetString@CKTXmlNode@KTXml@@QAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@PBG@Z
?GetItem@CKTXmlNodes@KTXml@@QAE?AV?$auto_ptr@VCKTXmlNode@KTXml@@@std@@J@Z
?GetChild@CKTXmlNode@KTXml@@QAE?AV?$auto_ptr@VCKTXmlNode@KTXml@@@std@@PBG@Z
?GetCount@CKTXmlNodes@KTXml@@QAEJXZ
?GetChildren@CKTXmlNode@KTXml@@QAE?AV?$auto_ptr@VCKTXmlNodes@KTXml@@@std@@XZ
?GetRoot@CKTXml@KTXml@@QAE?AV?$auto_ptr@VCKTXmlNode@KTXml@@@std@@XZ
?KTl_Decrypt_str@CKTDEncrypt@@SA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV23@@Z
?ReadRegEx@CKTReg@@SAHPAUHKEY__@@PBG1PAD@Z
?ReadRegEx@CKTReg@@SAHPAUHKEY__@@PBG1PAK@Z
??1CKTXml@KTXml@@QAE@XZ
??0CKTXml@KTXml@@QAE@XZ
?MultiByteToWide@CKTString@@SA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z

imm32

ImmAssociateContext
ImmGetContext
ImmReleaseContext

mfc71u

ord1393
ord5210
ord2985
ord572
ord3902
ord5406
ord461
ord760
ord4574
ord3599
ord1894
ord1785
ord578
ord4112
ord6086
ord2463
ord5829
ord6061
ord310
ord2311
ord777
ord1058
ord1542
ord5231
ord5229
ord2384
ord2394
ord2392
ord2390
ord2386
ord2409
ord2397
ord1647
ord1646
ord1590
ord5803
ord870
ord577
ord1476
ord283
ord3103
ord2461
ord6301
ord4320
ord2009
ord1007
ord5096
ord293
ord566
ord774
ord3990
ord5524
ord1605
ord280
ord776
ord1472
ord6063
ord896
ord3390
ord3927
ord3104
ord2261
ord4074
ord899
ord4026
ord5911
ord2651
ord605
ord354
ord4256
ord4480
ord3943
ord2638
ord3703
ord3713
ord3712
ord2527
ord2640
ord2534
ord2856
ord2708
ord4301
ord2829
ord2725
ord2531
ord5196
ord1955
ord5171
ord1353
ord4961
ord3339
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2402
ord2407
ord2388
ord2404
ord931
ord927
ord929
ord925
ord920
ord5956
ord1591
ord4276
ord4716
ord3397
ord4179
ord6271
ord5067
ord1899
ord5148
ord4238
ord1392
ord3940
ord1608
ord1611
ord5908
ord1661
ord1662
ord2011
ord4884
ord4729
ord1198
ord4206
ord5178
ord1271
ord3155
ord1925
ord3204
ord3435
ord3635
ord762
ord266
ord764
ord265
ord3590
ord2239
ord3824
ord1049
ord757
ord3327
ord4255
ord4475
ord2832
ord5562
ord5209
ord5226
ord4562
ord3942
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord3800
ord5579
ord2054
ord6274
ord3795
ord6272
ord4008
ord4032
ord1079
ord3677
ord4535
ord5199
ord3901

msvcr71

_CxxThrowException
_except_handler3
free
??1exception@@UAE@XZ
??0exception@@QAE@XZ
fclose
fputws
_wfopen
wcscpy
exit
_purecall
_wtoi
wcscat
_wcsdup
fseek
ftell
wcslen
fputs
fopen
wprintf
_vsnwprintf
printf
_vsnprintf
??0exception@@QAE@ABV0@@Z
sprintf
strstr
strncpy
__CxxFrameHandler
fgets
memset
_c_exit
_exit
_XcptFilter
_cexit
_wcmdln
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__security_error_handler
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_controlfp

kernel32

SetEvent
InterlockedDecrement
SetLastError
InitializeCriticalSectionAndSpinCount
GetComputerNameExA
GetPrivateProfileIntW
Sleep
CreateIoCompletionPort
WaitForMultipleObjects
WaitForSingleObject
InterlockedIncrement
ResetEvent
ReleaseMutex
CloseHandle
CreateEventW
CreateMutexW
GetModuleFileNameW
GetLocalTime
MultiByteToWideChar
WideCharToMultiByte
GetTickCount
LoadLibraryW
GetProcAddress
FreeLibrary
PostQueuedCompletionStatus
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThreadId
GetModuleHandleW
GetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetQueuedCompletionStatus
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetCommandLineW
SetCurrentDirectoryW
LocalFree
FormatMessageW
FormatMessageA
MoveFileW
MoveFileA
GetCurrentProcessId
GetModuleHandleA
MapViewOfFile
OpenFileMappingW
UnmapViewOfFile
GlobalAddAtomW
LockResource
LoadResource
SizeofResource
FindResourceW
GetStartupInfoW
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
CreateThread
ResumeThread
GetSystemInfo
GetVersionExA
HeapDestroy
HeapReAlloc
HeapSize
GetVersionExW

user32

DefWindowProcW
GetWindowLongW
PostMessageW
SetWindowLongW
CreateWindowExW
RegisterClassExW
DestroyWindow
GetKeyState
keybd_event
PtInRect
LoadBitmapW
SendMessageW
EnableWindow
ShowWindow
GetWindowRect
SetWindowPos
BringWindowToTop
UnhookWindowsHookEx
LoadImageW
DestroyIcon
SetFocus
SetWindowsHookExW
SetPropW
GetClientRect
MapVirtualKeyW
VkKeyScanW
RemovePropW
GetWindowThreadProcessId
AttachThreadInput
GetWindowTextA
EnumChildWindows
GetClassNameA
GetDesktopWindow
MessageBoxW
GetDC
IsWindowVisible
CallNextHookEx
GetForegroundWindow
SetLayeredWindowAttributes
LoadIconW
IsWindow
wsprintfA
wsprintfW
LoadCursorW
GetCursorPos
SetForegroundWindow
RegisterClassW
SystemParametersInfoW
EnumDisplaySettingsW
SetWindowRgn
RedrawWindow
SetWindowTextW

gdi32

GetBitmapBits
CreateRectRgn
DeleteObject
GetObjectW
SetPixel
GetPixel

winspool.drv

ord203

advapi32

RegOpenKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
RegCloseKey

shell32

Shell_NotifyIconA
Shell_NotifyIconW
CommandLineToArgvW

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW
PathFileExistsA

msvcp71

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?clear@ios_base@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?_Xran@_String_base@std@@QBEXXZ
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z

ktproxy

?SetTimeOut@CKTProxy@@QAEXH@Z
??1CKTProxy@@UAE@XZ
??0CKTProxy@@QAE@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?SetMode@CKTProxy@@QAEXH@Z
?SetGatewayIp@CKTProxy@@QAEXAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?SetGatewayPort@CKTProxy@@QAEXH@Z
?SetListenPort@CKTProxy@@QAEXH@Z
?StopProxy@CKTProxy@@QAEXXZ
?InitProxy@CKTProxy@@QAEHXZ
?StartProxy@CKTProxy@@QAEHXZ
?set_hwnd_rdp@CKTProxy@@QAEXPAUHWND__@@@Z
?Connect_Remote@CKTProxy@@QAEHPAUAPPREQ_MSG@@@Z
?GetListener@CKTProxy@@QAEPAVCListener@@XZ
?GetPort@CListener@@QAEHXZ

Sections

.text
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 132KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4f1c48615c3c9dbcc42eb2f6345998c

Headers

File Characteristics

Imports

inplus

ws2_32

ktpublic

imm32

mfc71u

msvcr71

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

msvcp71

ktproxy

Sections

.text Size: 132KB - Virtual size: 128KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 4KB - Virtual size: 21KB

.rsrc Size: 132KB - Virtual size: 130KB

.text
Size: 132KB - Virtual size: 128KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 4KB - Virtual size: 21KB

.rsrc
Size: 132KB - Virtual size: 130KB