6e197954176a01186c7afbff1cabd01dafb1b3f6951ba3d1636711ab2bad97a8

Sharing

Copy URL Twitter E-mail

General

Target

6e197954176a01186c7afbff1cabd01dafb1b3f6951ba3d1636711ab2bad97a8
Size

484KB
MD5

c6fa790d9533fa35a3716f01e65153d3
SHA1

a9b2f566aa3ad964e1cab35870508d5785b72ef0
SHA256

6e197954176a01186c7afbff1cabd01dafb1b3f6951ba3d1636711ab2bad97a8
SHA512

d6e52cf4aea12ab51da5f7704c8388b86e38125bcf735e9cc0bf1a82d1d644180ee3e95181797fe3f8bc2414df522978b8bfb3f1bfb1800219cfdb32d8d5d3a2
SSDEEP

12288:3cDlM2b0DYHtwqXS86BLyi+++Axi0QpeH2NDcHtwqXS8WsmhfFfsAxi0QphU:3bzHFU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e197954176a01186c7afbff1cabd01dafb1b3f6951ba3d1636711ab2bad97a8

Files

6e197954176a01186c7afbff1cabd01dafb1b3f6951ba3d1636711ab2bad97a8
.exe windows x86

c814f897c0f484877ab8c45632bab63c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

xpbtn

??0CDxButton@@QAE@XZ
??1CDxButton@@UAE@XZ

ftpfilepro

?DecString@DsED@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@V23@@Z
??0DsED@@QAE@XZ
?GetName@CFtpGetFile@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@V23@0@Z
?GetIP@CFtpGetFile@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
??0CFtpGetFile@@QAE@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetPWD@CFtpGetFile@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?CloseIniFile@CIniFile@@UAEXXZ
?GetItemString@CIniFile@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0AAV23@@Z
?OpenIniFileForRead@CIniFile@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
??0CIniFile@@QAE@XZ
?WriteItemString@CIniFile@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0@Z
?WriteSection@CIniFile@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?OpenIniFileForWrite@CIniFile@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetUID@CFtpGetFile@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
??1DsED@@QAE@XZ
??1CFtpGetFile@@UAE@XZ
??1CIniFile@@UAE@XZ

ced

??0CColorEdit@@QAE@XZ
??1CColorEdit@@UAE@XZ
?SetTextFont@CColorEdit@@QAEXHH@Z
?SetBackColor@CColorEdit@@QAEXK@Z
?SetTextColor@CColorEdit@@QAEXK@Z
?SetWindowTextA@CColorEdit@@QAEXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z

lex

?AutoSizeColumns@CListCtrlAutoScroll@@QAEXHH@Z
?DelItem@CListCtrlAutoScroll@@QAEXXZ
?DeleteItem@CSortListCtrl@@QAEHH@Z
??1CListCtrlAutoScroll@@UAE@XZ
??0CListCtrlAutoScroll@@QAE@XZ
?AddItem@CListCtrlAutoScroll@@QAEHQAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@HH@Z
?AddItem@CListCtrlAutoScroll@@QAEHQAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@HV23@H@Z
?DeleteAllItems@CSortListCtrl@@QAEHXZ
?AddHeaders@CListCtrlAutoScroll@@QAEXQAPADHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@1HH@Z

wpos

??1CControlPos@@UAE@XZ
?SetParent@CControlPos@@QAEXPAVCWnd@@@Z
?AddControl@CControlPos@@QAEHPAVCWnd@@ABK@Z
??0CControlPos@@QAE@PAVCWnd@@@Z

mfc100

ord12482
ord10672
ord6128
ord13300
ord7074
ord13302
ord2661
ord3984
ord13980
ord3991
ord4401
ord4368
ord4364
ord4398
ord4419
ord4377
ord4406
ord4415
ord4385
ord4389
ord4393
ord4381
ord4410
ord4373
ord1514
ord1507
ord1509
ord1503
ord1496
ord11188
ord11190
ord12644
ord3484
ord8351
ord9994
ord6217
ord11107
ord8070
ord13294
ord10883
ord3395
ord11025
ord8235
ord13973
ord13972
ord14045
ord14062
ord14058
ord14060
ord14061
ord14059
ord2416
ord7349
ord2878
ord2881
ord12531
ord5532
ord2752
ord2973
ord2974
ord3620
ord9475
ord10360
ord10007
ord8137
ord11067
ord946
ord6678
ord12285
ord2611
ord2061
ord1929
ord5837
ord3439
ord5776
ord2184
ord5774
ord1900
ord4345
ord3390
ord3259
ord3373
ord3254
ord3970
ord4785
ord12962
ord4782
ord10030
ord1210
ord788
ord11882
ord978
ord5627
ord3621
ord422
ord12344
ord5175
ord1267
ord1483
ord869
ord2617
ord4150
ord12868
ord13219
ord4790
ord5253
ord2944
ord2846
ord11103
ord5123
ord9286
ord8305
ord5803
ord381
ord1890
ord1985
ord4498
ord11744
ord14116
ord1713
ord7832
ord13125
ord1982
ord11627
ord2119
ord4283
ord1319
ord4285
ord1479
ord7584
ord7510
ord11726
ord13767
ord4724
ord2163
ord11420
ord11421
ord13301
ord7073
ord13299
ord8486
ord3676
ord3618
ord11806
ord7091
ord1732
ord14075
ord10922
ord13181
ord11413
ord7144
ord13483
ord13480
ord13485
ord13482
ord13484
ord13481
ord3409
ord5238
ord11172
ord11180
ord4078
ord7355
ord9449
ord11184
ord11153
ord11787
ord4622
ord4903
ord5095
ord8439
ord4881
ord5098
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord7357
ord9281
ord8304
ord6112
ord888
ord870
ord1316
ord1288
ord1268
ord4144
ord7487
ord1313
ord7875
ord7322
ord266
ord1330
ord310
ord316
ord7581
ord300
ord4505
ord11439
ord1294
ord12095
ord2063
ord2067
ord5242
ord305
ord13045
ord5207
ord1448
ord2626
ord901
ord9399
ord2338
ord2945
ord11060
ord6835
ord1296
ord2847
ord2088

msvcr100

_commode
_fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
free
_invoke_watson
_controlfp_s
?terminate@@YAXXZ
_onexit
__setusermatherr
__dllonexit
_unlock
atof
exit
atoi
malloc
_CxxThrowException
_time64
memcpy_s
strftime
floor
ceil
_configthreadlocale
_initterm_e
_initterm
_acmdln
__getmainargs
_cexit
_exit
_ismbblead
_lock
_XcptFilter
_localtime64_s
__CxxFrameHandler3
_amsg_exit
_setmbcp

kernel32

CreateMutexA
DecodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocalTime
SetLocalTime
lstrlenA
MultiByteToWideChar
GetLastError
InterlockedDecrement
LocalFree
GetModuleFileNameA
ReleaseMutex
EncodePointer
WideCharToMultiByte
GetCommandLineA

user32

GetParent
EnableWindow
LoadIconW
IsChild
GetSystemMetrics
GetWindow
FindWindowA
GetFocus
KillTimer
SetTimer
InvalidateRect
GetWindowRect
IsIconic
PostMessageA
SendMessageA
DrawIcon
FillRect
LoadBitmapW
PtInRect
LoadImageA
GetClientRect

gdi32

CreatePatternBrush
GetStockObject

ole32

CLSIDFromProgID
CoCreateInstance
OleRun
CLSIDFromString

oleaut32

VariantCopy
VariantInit
SysFreeString
SysAllocString
VariantClear
VarUdateFromDate
VariantChangeType
SystemTimeToVariantTime
VariantTimeToSystemTime
GetErrorInfo

gdiplus

GdiplusShutdown
GdiplusStartup

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 396KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c814f897c0f484877ab8c45632bab63c

Headers

DLL Characteristics

File Characteristics

Imports

xpbtn

ftpfilepro

ced

lex

wpos

mfc100

msvcr100

kernel32

user32

gdi32

ole32

oleaut32

gdiplus

Sections

.text Size: 56KB - Virtual size: 55KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 396KB - Virtual size: 396KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 396KB - Virtual size: 396KB

.reloc
Size: 9KB - Virtual size: 8KB