MFCMapi x86[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

MFCMapi x86.exe
Size

5.2MB
MD5

3545df8b756522b711f3c28faceee4b8
SHA1

49645bd0047a87c07adb00904aeac01f0b523b89
SHA256

93cc506407b2cff02046e6891e48cda42fcea7b0179d6f8572ad20d3821a42d1
SHA512

3492db8118dcabd4f7f36aa113c920697b4e8afddeeb810f44c0e74dc927c45f32a6836a9899d1387222b194f4a2a3e37147c05b9b3ab186d19e67afbbc68b1e
SSDEEP

49152:2AaSOP181fYvmW6t7hU2ZCzWMJnw0Ig4JGxXsTikzL53Nf+KOYJIKBiWeo2ar603:0y1fPLCpBsii+Kz7BteoJ602SihQb

Score

1^/10

Malware Config

Signatures

Files

MFCMapi x86.exe
.exe windows x64

4cb7d2d735e52b519c047f83798913ec

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ce:0c:4a:6f:a5:0b:5e:e5:b7:34:af:75:20:45:64:f4:ad:d4:ef:59:d8:78:f4:b2:6a:eb:a7:94:32:02:f1:02
Signer

Actual PE Digest

ce:0c:4a:6f:a5:0b:5e:e5:b7:34:af:75:20:45:64:f4:ad:d4:ef:59:d8:78:f4:b2:6a:eb:a7:94:32:02:f1:02

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

SearchPathW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
GetConsoleMode
GetTempPathW
GetTimeZoneInformation
SetFilePointerEx
EnumSystemLocalesW
IsValidLocale
LCMapStringW
ExitProcess
GetStdHandle
GetFileType
SetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
HeapQueryInformation
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
CreateThread
RtlPcToFileHeader
RtlUnwindEx
GetProfileIntW
GetUserDefaultLCID
VerifyVersionInfoW
VerSetConditionMask
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FileTimeToLocalFileTime
SetErrorMode
GetWindowsDirectoryW
FindResourceExW
lstrcpyW
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
CreateFileW
DeleteFileW
GetCurrentDirectoryW
VirtualProtect
GlobalFlags
GetUserDefaultUILanguage
GetTempFileNameW
GetSystemDefaultUILanguage
GetLocaleInfoW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GlobalGetAtomNameW
InitializeCriticalSectionAndSpinCount
GetPrivateProfileStringW
GetPrivateProfileIntW
ResumeThread
SetThreadPriority
CreateEventW
WaitForSingleObject
SetEvent
lstrcmpA
GetVersionExW
GetCurrentThread
CopyFileW
GlobalFree
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
CompareStringW
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
SizeofResource
GetModuleHandleExW
SetLastError
OutputDebugStringA
GetCPInfo
LCMapStringEx
EncodePointer
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
GetExitCodeThread
Sleep
WaitForSingleObjectEx
CloseHandle
CompareStringA
lstrcmpW
CreateDirectoryW
GetTickCount
GetModuleFileNameW
GetShortPathNameW
FindClose
FindNextFileW
LoadLibraryExW
FindFirstFileW
GetCurrentThreadId
GetSystemTimeAsFileTime
GetSystemTime
OutputDebugStringW
lstrcmpiW
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
LocalFree
FormatMessageW
FreeLibrary
LoadLibraryW
GetSystemDirectoryW
ExpandEnvironmentStringsW
LocalAlloc
LockResource
LoadResource
FindResourceW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
WritePrivateProfileStringW
GetModuleHandleW
GetProcAddress
GetConsoleOutputCP
MulDiv

user32

TranslateMessage
GetMessageW
PostQuitMessage
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
TabbedTextOutW
GrayStringW
DrawTextExW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
IsDialogMessageW
IsWindowEnabled
CheckDlgButton
ShowWindow
MapVirtualKeyW
GetKeyNameTextW
GetMonitorInfoW
MonitorFromWindow
WinHelpW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetLastActivePopup
GetTopWindow
GetClassLongPtrW
SetWindowLongW
EqualRect
MessageBoxW
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
SetForegroundWindow
SetActiveWindow
UpdateWindow
SetFocus
GetDlgCtrlID
IsIconic
SetWindowPlacement
GetWindowPlacement
DestroyWindow
IsChild
IsWindow
GetClassInfoW
RegisterClassW
CallWindowProcW
GetMessageTime
RegisterWindowMessageW
LoadStringW
EnumWindows
IsWindowVisible
GetWindow
DestroyIcon
DrawIconEx
LoadImageW
GetWindowLongW
DrawFrameControl
IsMenu
GetWindowLongA
GetClassNameW
GetWindowTextW
GetPropW
SetPropW
IsRectEmpty
IntersectRect
SetWindowLongPtrW
InflateRect
GetWindowLongPtrW
ShowOwnedPopups
DrawTextW
GetWindowDC
GetSysColor
GetSysColorBrush
RemoveMenu
GetMenuItemID
SetTimer
GetMenuStringW
SetMenuItemInfoW
GetMenuItemCount
TrackPopupMenu
WindowFromPoint
GetCursorInfo
EndPaint
FillRect
BeginPaint
SetCursor
GetCapture
SetRect
KillTimer
IsClipboardFormatAvailable
CharUpperW
GetMenuDefaultItem
RegisterClassExW
GetClassInfoExW
LoadCursorW
DestroyCursor
AppendMenuW
CreatePopupMenu
InsertMenuW
GetMenuItemInfoW
GetMenu
ShowScrollBar
SystemParametersInfoW
GetTabbedTextExtentW
ScrollWindowEx
SetScrollInfo
GetScrollInfo
GetActiveWindow
DefWindowProcW
GetMenuBarInfo
GetSystemMenu
IsZoomed
ReleaseCapture
SetCapture
MapWindowPoints
PtInRect
GetWindowThreadProcessId
GetForegroundWindow
DispatchMessageW
PeekMessageW
CopyRect
InvalidateRect
EndDeferWindowPos
BeginDeferWindowPos
ReleaseDC
GetDC
RedrawWindow
DrawMenuBar
SetMenuInfo
GetSubMenu
GetNextDlgGroupItem
DrawFocusRect
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
SetLayeredWindowAttributes
EnumDisplayMonitors
OpenClipboard
CloseClipboard
UpdateLayeredWindow
SetClipboardData
CopyImage
SetMenu
CreateMenu
LoadMenuW
DestroyMenu
GetDesktopWindow
LoadIconW
SendDlgItemMessageA
SetRectEmpty
RealChildWindowFromPoint
GetAsyncKeyState
MapDialogRect
FrameRect
DeleteMenu
EnableWindow
CreateWindowExW
SetWindowPos
SendMessageW
TrackMouseEvent
GetCursorPos
PostMessageW
SendMessageA
LoadBitmapW
GetKeyState
GetFocus
GetParent
CharNextW
UnhookWinEvent
SetWinEventHook
UnregisterClassW
MessageBeep
DeferWindowPos
GetMessagePos
ClientToScreen
ScreenToClient
EnableMenuItem
GetDlgItemTextW
GetClientRect
GetDlgItem
GetWindowRect
GetSystemMetrics
OffsetRect
MoveWindow
SetWindowTextW
SetDlgItemTextW
CheckMenuItem
EmptyClipboard
DrawStateW
SetClassLongPtrW
SetWindowRgn
SetParent
DrawEdge
BringWindowToTop
SetCursorPos
CopyIcon
DrawIcon
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetWindowRgn
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
UnionRect
CharUpperBuffW
RegisterClipboardFormatW
ModifyMenuW
GetDoubleClickTime
SetMenuDefaultItem
LockWindowUpdate
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
WaitMessage
PostThreadMessageW
GetComboBoxInfo
MonitorFromPoint
GetMenuState
GetUpdateRect

gdi32

GetViewportExtEx
GetWindowExtEx
IntersectClipRect
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CopyMetaFileW
CreateDCW
CombineRgn
SetRectRgn
GetStockObject
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
GetPixel
GetObjectType
GetClipBox
Escape
CreateRectRgn
CreatePatternBrush
CreateHatchBrush
SetBkColor
ExcludeClipRect
CreateBitmap
CreateRectRgnIndirect
Polygon
CreatePen
SetBkMode
SetTextColor
StretchBlt
GetObjectW
ExtCreatePen
CreateSolidBrush
CreateFontW
EnumFontFamiliesExW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPoint32W
GetTextMetricsW
LineTo
MoveToEx
DeleteDC
BitBlt
GetCurrentObject
OffsetWindowOrgEx
CreateCompatibleBitmap
CreateCompatibleDC
PatBlt
DPtoLP
DeleteObject
SelectObject

msimg32

TransparentBlt
AlphaBlend
GradientFill

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

GetSidSubAuthorityCount
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyW
IsValidSecurityDescriptor
GetSecurityDescriptorLength
RegEnumKeyExW
RegQueryValueW
RegDeleteKeyW
GetAce
GetAclInformation
GetSecurityDescriptorDacl
LookupAccountSidW
GetSidSubAuthority
RegCloseKey
GetSidIdentifierAuthority
IsValidSid
RegFlushKey
RegEnumValueW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
MapGenericMask
MakeSelfRelativeSD

shell32

SHGetSpecialFolderLocation
SHGetFileInfoW
SHGetDesktopFolder
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
DragFinish
SHBrowseForFolderW
DragQueryFileW
SHAppBarMessage

comctl32

ImageList_AddMasked
ord412
ord413
ord410
ImageList_Create

shlwapi

PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
StrFormatKBSizeW
PathRemoveFileSpecW

uxtheme

GetThemePartSize
GetThemeSysColor
IsAppThemed
GetWindowTheme
IsThemeBackgroundPartiallyTransparent
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName

ole32

CoInitializeEx
DoDragDrop
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleLockRunning
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoDisconnectObject
CoInitialize
CoCreateGuid
CoUninitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal
WriteClassStg
StgCreateDocfile
StgOpenStorage
CoCreateInstance

oleaut32

SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
LoadTypeLi
VariantChangeType
VariantCopy
VarBstrFromDate
VariantInit
SysAllocString
VariantClear
SysFreeString
SysAllocStringLen

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Exports

Exports

AddInLog
ComplexDialog
FreeDialogResult
GetMAPIModule
SimpleDialog

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 217KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 417KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4cb7d2d735e52b519c047f83798913ec

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:dfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

ce:0c:4a:6f:a5:0b:5e:e5:b7:34:af:75:20:45:64:f4:ad:d4:ef:59:d8:78:f4:b2:6a:eb:a7:94:32:02:f1:02Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

oleacc

imm32

winmm

version

Exports

Exports

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 217KB - Virtual size: 265KB

.pdata Size: 139KB - Virtual size: 139KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 417KB - Virtual size: 416KB

.reloc Size: 94KB - Virtual size: 94KB

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

ce:0c:4a:6f:a5:0b:5e:e5:b7:34:af:75:20:45:64:f4:ad:d4:ef:59:d8:78:f4:b2:6a:eb:a7:94:32:02:f1:02
Signer

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 217KB - Virtual size: 265KB

.pdata
Size: 139KB - Virtual size: 139KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 417KB - Virtual size: 416KB

.reloc
Size: 94KB - Virtual size: 94KB