eb3c0cbdfe0e73345ed3cbe37d348da3a334930534e958bbe432620e09e05aec

Sharing

Copy URL Twitter E-mail

General

Target

eb3c0cbdfe0e73345ed3cbe37d348da3a334930534e958bbe432620e09e05aec
Size

328KB
MD5

2b62aa9a97b178ab578105ac996c3bc0
SHA1

9e70b54b9b723db005ab957d7372f3903d19e121
SHA256

eb3c0cbdfe0e73345ed3cbe37d348da3a334930534e958bbe432620e09e05aec
SHA512

d4c5b3649638c5846ddad481d5c31c4e9ef02b5bbd9d6234340440728dbb6ba308d1d442208a527a92c9a4cfc4b0b0d4b9aa5b8729528e7f0d130974fa98b272
SSDEEP

6144:Gw8w0D/EFbPvk89vqPuT760r3z9osWHDqUrrGIhtXltG:ewGEFHSPuKM3zOsWHDWstq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb3c0cbdfe0e73345ed3cbe37d348da3a334930534e958bbe432620e09e05aec

Files

eb3c0cbdfe0e73345ed3cbe37d348da3a334930534e958bbe432620e09e05aec
.dll windows:4 windows x86

ea6a30f0cfc50b012b406b731e9edf7a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wmvcore

WMCreateSyncReader

shlwapi

PathFileExistsA

avi_encdll

AviEncoderGetFPS
AviEncoderGetChunk

mfc42

ord1175
ord3663
ord5440
ord6383
ord5450
ord6394
ord5710
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord926
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord1871
ord6282
ord6283
ord2763
ord2764
ord5773
ord6385
ord4129
ord269
ord826
ord600
ord941
ord3318
ord5442
ord268
ord1567
ord1168
ord4083
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord4224
ord354
ord4278
ord940
ord922
ord939
ord5186
ord1979
ord665
ord5683
ord4277
ord4204
ord535
ord2915
ord537
ord924
ord858
ord2818
ord1200
ord860
ord540
ord800
ord823
ord825
ord1575
ord1176
ord1116
ord3147

msvcrt

_iob
_adjust_fdiv
_initterm
?terminate@@YAXXZ
_except_handler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
exit
_CIpow
fprintf
floor
realloc
_purecall
_mkdir
rewind
fgetc
printf
fseek
ftell
malloc
_stricmp
fread
sscanf
_mbscmp
atof
_mbsicmp
fwrite
fclose
atoi
sprintf
_ftol
__CxxFrameHandler
fopen
free

kernel32

WaitForSingleObject
ReleaseMutex
GetModuleFileNameA
FreeLibrary
CloseHandle
SetFilePointer
GetFileSize
InterlockedIncrement
GetProcAddress
GetLastError
CreateThread
MultiByteToWideChar
lstrlenA
GetTickCount
LocalFree
LocalAlloc
LoadLibraryA
CreateMutexA
OutputDebugStringA
GetPrivateProfileStringA
InterlockedDecrement
ReadFile
GetDiskFreeSpaceExA
CopyFileA
DeleteFileA
GetSystemDefaultLangID
FindFirstFileA
GetSystemTime
GetFileType
CreateFileA
GetTempPathA

user32

PostMessageA
GetWindow
IsWindow
DispatchMessageA
PeekMessageA
TranslateMessage
GetTopWindow
MessageBoxA
GetClassNameA

advapi32

RegCreateKeyA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegOpenKeyA

shell32

ShellExecuteA

ole32

CreateItemMoniker
GetRunningObjectTable
CoTaskMemFree
CoCreateInstance

msvcp60

?_Xlen@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

Exports

Exports

CreateAmvInterface
GetDeviceIdList
resizeFF
run_log

Sections

.text
Size: 220KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea6a30f0cfc50b012b406b731e9edf7a

Headers

File Characteristics

Imports

wmvcore

shlwapi

avi_encdll

mfc42

msvcrt

kernel32

user32

advapi32

shell32

ole32

msvcp60

Exports

Exports

Sections

.text Size: 220KB - Virtual size: 218KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 64KB - Virtual size: 1.0MB

.rsrc Size: 4KB - Virtual size: 952B

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 220KB - Virtual size: 218KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 64KB - Virtual size: 1.0MB

.rsrc
Size: 4KB - Virtual size: 952B

.reloc
Size: 20KB - Virtual size: 19KB