3395374f708912239679bfe887142d462330acf5b9cf24cd4a869fbc30b2efd2

Sharing

Copy URL Twitter E-mail

General

Target

3395374f708912239679bfe887142d462330acf5b9cf24cd4a869fbc30b2efd2
Size

1.8MB
MD5

ccc0f0f26417abf7ced907d200c1d165
SHA1

19a53a7e336456cfe1c38caaf64771197f4d3071
SHA256

3395374f708912239679bfe887142d462330acf5b9cf24cd4a869fbc30b2efd2
SHA512

be0f2cf8eb555ae3461f788b485b74d06f62399767530ddb9d926ef3a3357567315211731bc2104f9c607165414c0b30d68a9d61465a63bfead8a98343f6bc14
SSDEEP

24576:phnJZjkAPnSGueETaL8QcSkuMcWhjtDoBjceQ9FX9eFonMMq7KH6XSIStCUuILHv:dPVtEuoDhldejcxHtMzU3H/SWj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3395374f708912239679bfe887142d462330acf5b9cf24cd4a869fbc30b2efd2

Files

3395374f708912239679bfe887142d462330acf5b9cf24cd4a869fbc30b2efd2
.exe windows x86

b1ad8f136b8954cf3904016ca38915d2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

opengl32

glEn$
glColor3d
glBagin
glVertex2$
olIsList
glGenLysts
glMultMatrixd
glC�lor;dv
glCo,o24f
glDeleteLisus
olWertex3dv
glGallList
glIsMnaBlel
g|EndList
glLnadN`me
glNe�Lit
glCcllLists
wclUseNontOudLin$sA
glListJase
gdhqnT
gl�ogis_pa
glFinisi
ghPoli�on��de
glBlendFuoc
g|DrawBuffer
gLClear
glOat�ixMode
glClearColos
g|ortho
wglDedeteContext
gl�yewxort
wgl�ak�Surrent
glLoadIventi|y
wglCpeateC.tezt
gmTcafshatef
glScale`
glRotated
glGet�ntegeSv
glRgct$
glGetDoubhev
��Mnible
�lLhneStipple
ghVertex2dv
elVe2t�|2f��glLineVidth
glLineVidth
gl@isabDm
g�Comcr3f
glPoijtSije
glP/tMat2ix
lPushMAtrix

etout.ddl@

?mGO}tIjforeapion@@YI_NP�XNJQAVCZvringArray@@@Z
7}gGe�GridLineT�pe@@YAHQAX@Z
?mgOutD?ckLine@@YEXPAXH@Z
?mgOutInformation@@YE]NPA@Z
?m'OutGrid@@��_NPAX@[
?�gRe�rfs�NotchData`HYXPAV�gPat�ernDate@�ND
?egRegreshNovkhData@AYA\PAVmgPattepn�a�a@
?mgOpenCutFIle@@Y�PIXNNAAN@z
?mgMoVeWorc�rea@`yAXPA\N�@Z
mgEndCut@@YAZPAXL`Z
?mGJeginCut@@YAXPAXJ@z
?mg�et�llP,nt@`YAXAA�CStpingAzrayD@@ZaF?mgEditPnotSetting@@YA^LQAHP
?mgEditPnotSetting@@YA^LQAHP
mgRefreshPlotDC@@IAXPA�P�VCDC@@XA^mgDK@@@Z
?mgOptNc5rrentPloTTC@@YAPAXNNNOAAVCWize@@@Z
?m�OpelPl�tDC@@YAPaXNNNNAAVCSize@@PZ
?mgMoveTo@@YAXPI@NN@Z
?mgLkneToA@�AXPAX�N@X
?sat_ev_flagDTOUU@@YAXH@Z
?mgInitFontLib@@YAPPBD�EDZ
?mgIoreMutView@@YAXPCXH@Z
?m�O}tPattmrn@@YAXAXPCVmePaptevnData@@H@Z
?mgOutOldSaw�@YaWNPAX@Z
?mg�utLines@@YAXPAXABVmgLines@
?igOutpattern@@YAXPAXPD�MgPatpapnDa�a@@nQAUNFPOINU@@AAVCString��Z
?igMutTatte�n@@�AXPAPEVmg@atternDataA�PZ"
?-gutText@@YAXPAXABV}gText@@@Z
?mg_penRlot@@YAPAxPBDN�NNAAVCSizE@H`Z
?moC�oseTlot@@YAXTAX
?mgEditEnitSe|ting@@[AHXZ�'
?mg�etCurlMat�ix@@]I_NPAXABVC�ox@@QBVCTMatri�@@@�
?�GCutPatteznH@YHPAXHPA~mgPauternF
?mkE�itPlotH@YA_NXZ
?mgCurrentViewYsmT�y@@YA_NPAX@Z

systeolink.ell

set_ev_flAg_Sy�temDi.k
mgRmadTa�aFileInfoeataoo
mgRead�ataFile1

etinfo

?mgEllipt)aButton@@YAHHJHH_NKPZ
?moG%tqrodac3Word@@YAIXZ
?mgEdi�Clot�@@YAHAAvCString@@qAֱ
?mgRwadClthN`me`@[ALAAVCStringA@�AVq@@Z
?mgDllipticut|on@@YAHPAVCFataExbhang�@LpBDH@Z
?}f�hogMesqaceCox2@@YEHPBD�0iIIKK@Z
/eg[howMesSagdBo81@AYAXPBD00III@Z
?mgShowMessageBox0@@YAXPBD00III@Z
?mgDefineMenu@@YA_NHAAVCMenu@@@Z
?mgLoadMenu@@YA_NHAAVCMenu@@@Z
?mgErrorShow@@YAHPAVCWnd@@AAV?$CArray@PAVmgErrorLog@@PAV1@@@@Z
?mgReleaseEllipticButton@@YAXH@Z
?mgUserCancelBegin@@YAPAVCDialog@@PAV1@@Z
?mgUserCancel@@YAHPAVCDialog@@@Z
?mgUserCancelEnd@@YAXPAVCDialog@@@Z
?mgShowAboutDlg@@YAXPBD0@Z
?set_ev_flag_ETInter@@YAXH@Z
?mgCreateMessageBox@@YAXPAVCWnd@@HHHH@Z
?mgShowSplash@@YAXPBD@Z

iphlpapi

GetAdaptersInfo

mfc42

ord2414
ord3626
ord556
ord5785
ord1146
ord2864
ord4133
ord4275
ord4297
ord472
ord283
ord5875
ord2859
ord6358
ord1088
ord4160
ord2405
ord5788
ord2122
ord1641
ord1640
ord6880
ord289
ord5053
ord2567
ord3797
ord537
ord755
ord470
ord4615
ord4612
ord4610
ord6876
ord4274
ord4220
ord2584
ord3654
ord613
ord4486
ord6375
ord2512
ord5731
ord3922
ord1089
ord2396
ord3346
ord5300
ord5302
ord4079
ord5307
ord5714
ord4622
ord3738
ord561
ord815
ord2438
ord1644
ord5503
ord2635
ord617
ord5301
ord6347
ord986
ord520
ord4159
ord6117
ord2621
ord1134
ord5214
ord296
ord2725
ord5199
ord3447
ord3196
ord2614
ord5572
ord2554
ord2863
ord6270
ord3499
ord2515
ord2919
ord2526
ord3517
ord469
ord5289
ord4698
ord6329
ord4696
ord3058
ord3065
ord6336
ord2510
ord2542
ord5243
ord5740
ord1746
ord5577
ord5653
ord4420
ord2399
ord4387
ord3454
ord3198
ord6175
ord4623
ord2820
ord3811
ord924
ord922
ord6883
ord668
ord4953
ord1980
ord3181
ord2781
ord2770
ord356
ord1175
ord616
ord692
ord686
ord804
ord810
ord3949
ord4858
ord4426
ord2652
ord1669
ord693
ord3790
ord551
ord6673
ord547
ord1979
ord5773
ord3507
ord1262
ord5442
ord3318
ord6385
ord3176
ord941
ord5856
ord6080
ord939
ord940
ord6874
ord3337
ord665
ord353
ord355
ord2528
ord5637
ord705
ord5792
ord5571
ord5865
ord406
ord3619
ord5861
ord536
ord2764
ord812
ord2450
ord4614
ord4613
ord4589
ord4341
ord4349
ord4890
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4964
ord4961
ord4108
ord5240
ord3748
ord1726
ord4432
ord2535
ord1199
ord2538
ord484
ord4899
ord2381
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord6197
ord6378
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord3317
ord6640
ord923
ord2582
ord4402
ord3370
ord3640
ord3996
ord6379
ord6007
ord6907
ord3998
ord3286
ord3301
ord6241
ord6602
ord4715
ord6592
ord5288
ord4439
ord2054
ord4431
ord6529
ord6568
ord6489
ord4259
ord2827
ord1200
ord6154
ord2530
ord4364
ord4056
ord5471
ord4121
ord2389
ord5082
ord1709
ord1712
ord6053
ord5234
ord6369
ord5279
ord2444
ord3598
ord642
ord327
ord4235
ord2754
ord5248
ord4454
ord4243
ord1842
ord4242
ord2723
ord2390
ord3059
ord5100
ord4303
ord3350
ord5012
ord975
ord5472
ord3403
ord2879
ord2297
ord2291
ord4077
ord5237
ord5282
ord2649
ord1665
ord4436
ord674
ord366
ord6565
ord2087
ord6619
ord2627
ord4457
ord5852
ord3481
ord2252
ord5252
ord6337
ord4427
ord4413
ord3742
ord3754
ord3706
ord5787
ord3220
ord5781
ord6601
ord5161
ord5162
ord5160
ord4905
ord4742
ord2645
ord2302
ord4358
ord4377
ord4854
ord5287
ord4835
ord559
ord6485
ord768
ord4258
ord5710
ord6176
ord4083
ord1834
ord5067
ord4750
ord5016
ord4375
ord4852
ord3522
ord6163
ord4229
ord4716
ord6905
ord6487
ord4129
ord3177
ord609
ord323
ord6453
ord5919
ord3175
ord3184
ord4608
ord3803
ord5608
ord818
ord6862
ord6931
ord6860
ord6749
ord6491
ord620
ord6802
ord5153
ord5063
ord6594
ord4588
ord4370
ord4892
ord2431
ord1928
ord6232
ord6148
ord2568
ord6268
ord6271
ord3225
ord3257
ord2544
ord2543
ord2511
ord978
ord1731
ord5851
ord2883
ord2398
ord2418
ord6224
ord6226
ord540
ord2250
ord4732
ord5477
ord2259
ord4836
ord4440
ord527
ord794
ord3912
ord6230
ord4541
ord4264
ord4644
ord4217
ord2576
ord4397
ord3352
ord3577
ord2937
ord5890
ord1904
ord4515
ord5228
ord1721
ord5076
ord4723
ord4887
ord4963
ord4960
ord1725
ord480
ord761
ord4256
ord4461
ord5260
ord4762
ord4348
ord4535
ord4840
ord5821
ord3662
ord414
ord713
ord5604
ord3984
ord5859
ord2587
ord4406
ord3394
ord3729
ord3398
ord3733
ord384
ord6785
ord6008
ord4000
ord6676
ord3914
ord3287
ord6889
ord4125
ord3178
ord1654
ord1266
ord6242
ord5271
ord1270
ord1232
ord6021
ord6128
ord2634
ord3752
ord4694
ord5768
ord5148
ord2243
ord2516
ord361
ord2096
ord1920
ord4889
ord784
ord517
ord4262
ord6131
ord6216
ord2763
ord5272
ord4204
ord4278
ord1871
ord6571
ord2917
ord2803
ord958
ord6312
ord4177
ord6010
ord2601
ord3180
ord3183
ord3614
ord5186
ord354
ord2915
ord4058
ord6264
ord1825
ord3172
ord5823
ord3664
ord652
ord5597
ord415
ord338
ord715
ord4823
ord4238
ord1081
ord5605
ord2761
ord4287
ord6377
ord5873

msvcrt

strtoul
strncpy
__dllonexit
isalnum
_CIpow
_controlfp
_strcmpi
__CxxFrameHandler
atof
_ftol
atoi
floor
_setmbcp
ceil
memmove
_mbscmp
strrchr
_exit
_purecall
rand
time
sprintf
_hypot
qsort
isalpha
isdigit
__set_app_type
_CIacos
_CIasin
_CxxThrowException
_splitpath
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
srand
sscanf
_mbstok
??1type_info@@UAE@XZ
_onexit
_except_handler3
?terminate@@YAXXZ
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode

kernel32

GlobalSize
GlobalLock
GlobalUnlock
GlobalReAlloc
GetSystemDirectoryA
GetVersionExA
GlobalAlloc
DeviceIoControl
GlobalFree
GetSystemTimeAsFileTime
GetTickCount
VirtualQuery
VirtualAlloc
VirtualFree
GetSystemInfo
SetFilePointer
ReadFile
RemoveDirectoryA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetProcAddress
GetLocalTime
LoadLibraryA
FreeLibrary
CreateFileA
WriteFile
lstrcmpA
MoveFileA
MultiByteToWideChar
LCMapStringA
WideCharToMultiByte
GetModuleHandleA
SetFileAttributesA
GetComputerNameA
Beep
SystemTimeToFileTime
CompareFileTime
CreateDirectoryA
CopyFileA
GetFileAttributesA
MulDiv
GetUserDefaultLangID
CloseHandle
GetModuleFileNameA
CreateMutexA
GetLastError
lstrlenA
Sleep
DeleteFileA
SetEndOfFile
GetStartupInfoA
_lopen
_lclose
_lwrite
OpenFile
_lcreat
CreateThread
TerminateThread
WaitForSingleObject
_llseek
GetSystemTime
lstrcpyA
lstrcatA
GetEnvironmentVariableA
CreateProcessA
GetVersion
GetCommandLineA
_lread
lstrcmpiA
ExitProcess

user32

PostMessageA
GetWindowTextA
GetSubMenu
GetMenuStringA
UpdateWindow
LoadMenuA
SetRect
KillTimer
SetTimer
UnionRect
GetMenuItemCount
GetMenu
DrawStateA
CopyRect
AppendMenuA
GetClassNameA
InflateRect
DrawFocusRect
PeekMessageA
GetCursorPos
ScreenToClient
LoadBitmapA
GetActiveWindow
GetParent
CloseClipboard
SetClipboardData
ClientToScreen
InvalidateRect
EmptyClipboard
OpenClipboard
SetCapture
SetCursorPos
DeleteMenu
FrameRect
FillRect
ReleaseDC
SetRectEmpty
GetCapture
GetKeyState
FindWindowExA
GetDC
SetWindowTextA
PtInRect
GetDlgItem
IsWindow
IsChild
IsRectEmpty
IsWindowVisible
EnableWindow
GetFocus
LoadCursorA
GetWindowRect
GetClientRect
OffsetRect
DestroyCursor
GetSysColor
SendMessageA
LoadImageA
RedrawWindow
DrawEdge
GetDoubleClickTime
ClipCursor
IsClipboardFormatAvailable
InvertRect
GetMessagePos
TabbedTextOutA
GrayStringA
DrawTextA
wsprintfA
IntersectRect
SystemParametersInfoA
LoadIconA
RemoveMenu
InsertMenuA
GetClassInfoA
GetSystemMetrics
ShowScrollBar
SetCursor
DefWindowProcA
GetWindowLongA
WindowFromPoint
ReleaseCapture
MessageBoxA

gdi32

SelectObject
CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
GetCurrentObject
GetStockObject
GetObjectA
DeleteDC
StretchBlt
SetTextColor
SetBkColor
CreateBitmap
SetPixelV
DeleteEnhMetaFile
CloseEnhMetaFile
CreateEnhMetaFileA
GetDeviceCaps
GetViewportOrgEx
CreateFontIndirectA
Rectangle
PatBlt
CreateRectRgnIndirect
GetTextExtentPoint32A
GetEnhMetaFileA
Ellipse
CreatePen
DeleteObject
DescribePixelFormat
SetPixelFormat
ChoosePixelFormat
SwapBuffers
CreateFontA
GetBitmapBits
FloodFill
SetBitmapBits
GetPixel
GetBkColor
GetTextMetricsA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
AbortDoc
EndDoc
EndPage
StartPage
StartDocA

comdlg32

CommDlgExtendedError

advapi32

DeregisterEventSource
ReportEventA
RegisterEventSourceA
OpenEventLogA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc
SHInvokePrinterCommandA

comctl32

ImageList_Draw
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_GetImageInfo
ImageList_SetBkColor

ole32

OleInitialize
OleUninitialize

glu32

gluTessBeginContour
gluTessEndPolygon
gluTessVertex
gluTessEndContour
gluUnProject
gluNewTess
gluTessProperty
gluTessCallback
gluTessBeginPolygon
gluDeleteTess
gluProject

netapi32

Netbios

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 32KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 400KB - Virtual size: 398KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gtide
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gidata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b1ad8f136b8954cf3904016ca38915d2

Headers

File Characteristics

Imports

opengl32

etout.ddl@

systeolink.ell

etinfo

iphlpapi

mfc42

msvcrt

kernel32

user32

gdi32

comdlg32

advapi32

shell32

comctl32

ole32

glu32

netapi32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 140KB - Virtual size: 139KB

.data Size: 32KB - Virtual size: 350KB

.rsrc Size: 400KB - Virtual size: 398KB

.gtide Size: 56KB - Virtual size: 52KB

.gdata Size: 8KB - Virtual size: 5KB

.gidata Size: 20KB - Virtual size: 16KB

etout.ddl@

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 140KB - Virtual size: 139KB

.data
Size: 32KB - Virtual size: 350KB

.rsrc
Size: 400KB - Virtual size: 398KB

.gtide
Size: 56KB - Virtual size: 52KB

.gdata
Size: 8KB - Virtual size: 5KB

.gidata
Size: 20KB - Virtual size: 16KB