OllyDbg[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

OllyDbg.exe
Size

2.6MB
MD5

2c2a3fb503aa15caba5ee2955b94724c
SHA1

1a52cfac8b64695aad19380df6324dce4eb7a1a4
SHA256

d41d33fb3bc277ec35ff7b080bc8f65294032d7dba7296e9f2aeb21eed5768bc
SHA512

978d518bf4934293058818729dc208f5575fedcc81235a7e2b2bf48af6904951fe1d2269642340abd653993d229e1b9d9eeb2a9cbdd776998bf314fe2379ecdb
SSDEEP

49152:5vnuV3otGceLAL7hbov/o9968O1KgOk9mKO/twSFA:U6MNsK4S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OllyDbg.exe

Files

OllyDbg.exe
.exe windows:5 windows x64

7b506eb2a8460dda2f894ea74b09b2fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW
PathCompactPathExW
PathIsDirectoryW
PathRemoveArgsW
PathGetArgsW
PathUnquoteSpacesW
PathFileExistsW
PathCanonicalizeW
PathRelativePathToW

psapi

GetModuleFileNameExW
GetModuleInformation
EnumProcessModules
GetMappedFileNameW
EnumProcesses

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

SetFilePointer
GetFileSize
GetFileAttributesW
QueryDosDeviceW
GetFileType
WriteProcessMemory
ReadProcessMemory
GetCurrentThreadId
SetProcessAffinityMask
GetProcessAffinityMask
GetPrivateProfileStringW
IsBadReadPtr
GetACP
SetUnhandledExceptionFilter
GlobalMemoryStatus
GetSystemDirectoryW
GetCurrentProcess
GetCommandLineW
GetCurrentProcessId
GetModuleFileNameW
GetVersionExW
CreateProcessW
SearchPathW
GetLastError
DebugActiveProcess
OpenProcess
WritePrivateProfileStringW
VirtualAlloc
VirtualFree
IsBadWritePtr
GetCurrentThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SizeofResource
LockResource
LoadResource
FindResourceW
GetThreadTimes
TerminateThread
SetThreadPriority
GetThreadPriority
ReadFile
GetFileInformationByHandle
CreateFileW
FindNextFileW
GlobalSize
FindFirstFileW
FlushFileBuffers
GetLocaleInfoW
SetConsoleCtrlHandler
GetStdHandle
SetHandleCount
GetConsoleMode
GetConsoleCP
WriteFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetStringTypeW
LCMapStringW
SetLastError
FlsFree
FlsAlloc
FlsSetValue
FlsGetValue
IsValidCodePage
GetOEMCP
RtlUnwindEx
VirtualQuery
GetProcessHeap
HeapAlloc
HeapFree
HeapValidate
HeapSize
EncodePointer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetStartupInfoW
GetCommandLineA
ExitProcess
GetModuleHandleW
DecodePointer
lstrlenA
RaiseException
IsDebuggerPresent
DeleteFileW
CopyFileW
MoveFileW
EnumSystemCodePagesW
GetCPInfo
GetCPInfoExW
GlobalAlloc
GlobalLock
GlobalFree
MultiByteToWideChar
GlobalUnlock
GlobalReAlloc
Sleep
DuplicateHandle
CloseHandle
WaitForDebugEvent
DebugActiveProcessStop
TerminateProcess
FlushInstructionCache
ContinueDebugEvent
DebugBreakProcess
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
LoadLibraryW
GetProcAddress
FreeLibrary
VirtualQueryEx
VirtualProtectEx
WideCharToMultiByte
GetTickCount
MulDiv
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetEndOfFile
GetModuleFileNameA
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
HeapReAlloc
HeapQueryInformation
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
CompareStringW
SetEnvironmentVariableW
SetStdHandle
RtlPcToFileHeader
FindClose

user32

IsWindowEnabled
ClientToScreen
GetScrollInfo
GetClassLongPtrA
GetClassLongPtrW
IsWindowUnicode
DeleteMenu
GetMenuItemCount
GetSubMenu
EnableMenuItem
InsertMenuW
GetMenu
CreateMenu
SetMenu
DrawMenuBar
GetMenuItemInfoW
AppendMenuW
InsertMenuItemW
CreatePopupMenu
DestroyMenu
TrackPopupMenu
GetKeyboardState
ToAscii
MonitorFromPoint
GetMonitorInfoW
GetFocus
CreateMDIWindowW
LoadIconW
UpdateWindow
DeferWindowPos
DefMDIChildProcW
GetWindowPlacement
BeginDeferWindowPos
EndDeferWindowPos
AdjustWindowRect
GetSystemMetrics
GetClassNameW
SetWindowLongW
ShowScrollBar
SetScrollInfo
PostMessageW
IsDlgButtonChecked
GetDlgItemInt
LoadCursorW
DestroyCaret
GetCapture
SetCapture
ReleaseCapture
GetCursorPos
DefWindowProcW
EmptyClipboard
EnumWindows
BeginPaint
FrameRect
FillRect
EndPaint
CreateCaret
SetCaretPos
ShowCaret
CheckDlgButton
IsWindowVisible
GetWindowThreadProcessId
SetTimer
KillTimer
DrawEdge
GetDesktopWindow
IsDialogMessageW
TranslateMDISysAccel
WindowFromPoint
TranslateMessage
DispatchMessageW
UnregisterClassW
InSendMessage
OpenClipboard
GetClipboardData
CloseClipboard
EnableWindow
DestroyWindow
EnableScrollBar
SendDlgItemMessageW
GetSysColor
GetSysColorBrush
SetDlgItemTextW
CheckRadioButton
GetDlgItemTextW
DialogBoxParamW
EndDialog
SetWindowLongPtrW
GetDC
LoadBitmapW
CreateWindowExW
GetComboBoxInfo
ReleaseDC
GetClientRect
CallWindowProcW
GetParent
GetWindowLongPtrW
GetDlgCtrlID
SetWindowPos
GetDlgItem
GetWindowRect
ScreenToClient
GetClassInfoW
RegisterClassW
PostThreadMessageW
GetKeyState
MessageBoxW
GetWindowTextW
SetWindowTextW
InvalidateRect
SendMessageW
IsZoomed
ShowWindow
SetFocus
RedrawWindow
PeekMessageW
SetCursor
PostQuitMessage
DefFrameProcW
EnumThreadWindows
GetActiveWindow
EnumChildWindows
BringWindowToTop
IsIconic
OpenIcon
SetForegroundWindow
IntersectRect
SetClipboardData
GetMenuItemID
MoveWindow

gdi32

CreateCompatibleBitmap
GetNearestColor
CreateCompatibleDC
CreateRectRgn
BitBlt
DeleteDC
MoveToEx
LineTo
CreatePen
CreateFontIndirectW
GetTextMetricsW
CreateSolidBrush
ExcludeClipRect
SelectClipRgn
DeleteObject
SetTextAlign
GetStockObject
ExtTextOutW
SetPixel
SetTextColor
SetBkColor
GetObjectW
SelectObject
GetTextExtentExPointW
GetTextExtentPoint32W

comdlg32

ChooseColorW
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ChooseFontW

advapi32

RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
ImpersonateSelf
OpenThreadToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
FreeSid
RegEnumKeyW
RegOpenKeyExW
IsTextUnicode

shell32

DragFinish
DragAcceptFiles
CommandLineToArgvW
ShellExecuteW
SHGetPathFromIDListW
DragQueryFileW
SHBrowseForFolderW
SHGetMalloc

ole32

CoInitialize
CoUninitialize
CoCreateInstance

Exports

Exports

Absolutizepath
Activatetablewindow
Addjump
Addnesteddata
Addrange
Addsorteddata
Addstringtocombolist
Addtohistory
Addtolist
Addtosettings
Alignselection
Arelocaljumpscallstorange
Asciitounicode
Asmindump
Assemble
Assembleallforms
Assembleex
Backupusercode
Binaryedit
Broadcast
Browsedirectory
Browsefilename
Callmenufunction
Cexpression
Checkcondition
Checkfordebugevent
Checkhistory
Closeprocess
Closetaggedfile
Commentaddress
Commentcharacter
Comparecommand
Comparesequence
Compress
Condbreakpoint
Conderror
Condlogbreakpoint
Condyesno
Confirmhardwarebreakpoint
Confirmint3breakpoint
Confirmint3breakpointlist
Confirmoverwrite
Confirmsorteddata
Copydumpselection
Copymemoryhex
Copytableselection
Copywholetable
Createdatadumpwindow
Createdumpwindow
Createframewindow
Createnesteddata
Createottablewindow
Createsorteddata
Createtablechild
Createtablewindow
Createtabwindow
Createtaggedfile
Decodeaddress
Decodeargument
Decoderange
Decoderelativeoffset
Decodestructure
Decodethreadname
Decodetype
Decompress
Defaultactions
Defaultbar
Delayedtableredraw
Deletedatarange
Deletedatarangelist
Deleteinisection
Deletenestedrange
Deletenonconfirmedsorteddata
Deletesorteddata
Deletesorteddatarange
DemanglenameW
Destroynesteddata
Destroysorteddata
Detachprocess
Devicenametodosname
Disasm
Disassembleback
Disassembleforward
Dumpback
Dumpforward
Eexpression
Embeddumpwindow
Emptyrange
Enablehardbreakpoint
Enableint3breakpoint
Enablemembreakpoint
Endotdialog
Ensurememorybackup
Error
Exprcount
Expression
Fastexpression
Filefromini
Filenamefromhandle
Filetoini
Fillcombowithcplist
Fillcombowithgroup
Fillcombowithstruct
Fillmenuwithcplist
Finalizetaggedfile
FindaddressW
Findcontrol
Finddata
Finddataptr
Finddecode
Findfiledump
Findfileoffset
Findfixup
Findfreehardbreakslot
Findglobalcallsto
Findglobaljumpscallsto
Findjumpfrom
Findlabel
Findlocaljumpscallsto
Findlocaljumpsto
Findmainmodule
Findmemory
Findmodule
Findmodulebyname
FindnameW
Findnesteddata
Findnextdata
Findnextdatalist
FindnextnameW
FindnextnamelistW
Findretaddrdata
Findruntracerecord
Findsorteddata
Findsorteddatarange
Findsortedindexrange
Findsource
Findstructureitembyoffset
Findthread
Findthreadbyordinal
Flash
Flushmemorycache
Fnmerge
Fnsplit
Followcall
Followjump
Fullrange
Get3dnow
Getactiveframe
Getactivetab
Getanalysercomment
Getasmsearchmodel
Getcharacterwidth
Getconstantbyname
Getconstantbyvalue
Getcontrolpos
Getcpudisasmdump
Getcpudisasmselection
Getcpudisasmtable
Getcpudumpdump
Getcpuruntracebackstep
Getcpustackdump
Getcputhreadid
Getdword
Getexceptionrange
Getexeversion
Getexportfrommemory
Getextproclimits
Getfloat
Getfpureg
Getfromsettings
Getgotoexpression
Getindexbypredefinedtype
Getinteger
Getintexpression
Getlasterror
Getlasterrorcode
Getmbcharlength
Getmbdumpaddress
Getmbdumpposition
Getmbstringinfo
Getmmx
Getmodulestring
Getmonitorrect
Getnestingdepth
Getnestingpattern
Getoriginaldatasize
Getpredefinedtypebyindex
Getproclimits
Getqword
Getqwordexpression
Getrangebyindex
Getrangebymember
Getrangecount
Getrawdata
Getregister
Getrepstructuretype
Getruntrace
Getseqsearchmodel
Getsetcount
Getsortedbyindex
Getsortedbyselection
Getsourceline
Getsse
Getstring
Getstructureitemcount
Getstructureitemvalue
Getstructuretype
Getswitchcomment
Gettabcount
Gettablebywindow
Gettableselectionxy
Gettabletext
Gettaggedfiledata
Gettaggedrecordsize
Guardmemory
Guidtotext
Hardbreakpoint
Hardlogbreakpoint
Heapsort
Heapsortex
HexdumpW
Hexprint
Hexprint16
Hexprint8
Hexprintn
Info
Initset
Insertdata
InsertnameW
Isdataavailable
Isdatainrange
Isinset
Isnoreturn
Isretaddr
Issortedinit
Isstring
Issystem
IstextA
IstextW
Iszero
Labeladdress
Linecount
Listalternatedatastreams
Listmemory
Maketableareavisible
Maybecommand
Memalloc
Membreakpoint
Memdouble
Memfree
Memlogbreakpoint
Mempurge
Mergequickdata
Message
Movecontrol
Moveprogress
Movetableselection
Nameoffloat
Ndisasm
Nesteddatatoudd
Newdumpselection
Opentaggedfile
Optostring
Pastememoryhex
Pauseprocess
Preparedialog
Printfloat10
Printfloat4
Printfloat8
Printmmx
Processwmmousewheel
Procfromunwind
Progress
Quickinsertdata
QuickinsertnameW
Readfile
Readmemory
Readmemoryex
Redrawcpudisasm
Redrawcpureg
Redrawlist
Registermodifiedbyuser
Relativizepath
Removeanalysis
Removehardbreakpoint
Removeint3breakpoint
Removemembreakpoint
Removerange
Removetableselection
Renumeratesorteddata
Replacegraphs
Replacesorteddatarange
Resumeallthreads
Run
Runthread
Savepackedrecord
Savetaggedrecord
Scan
Scanfloat10
Scrolldumpwindow
Setactivetab
Setautoupdate
Setcase
Setcondition
Setcpu
Setdumptype
Sethardbreakpoint
Setint3breakpoint
Setmembreakpoint
Setstatus
Settableselection
Showsourcecode
Signedhex
Skipspaces
Sortjumpdata
Sortsorteddata
Squeezename
Startnextdata
Startnextdatalist
Startnextnamelist
StrcmpW
StrcopyW
Stringfromini
Stringtotext
StrlenA
StrlenW
StrnstrA
StrnstrW
Substitutehkeyprefix
Sunkenframe
Suspendallthreads
Tempinfo
Threadregisters
Uddtonesteddata
Uncapitalize
Unicodebuffertoascii
Unicodetoascii
Unicodetoutf
Unmarknewsorteddata
Updateframe
Updatetable
Updatetabs
Utftounicode
Virtalloc
Virtfree
Walkhistory
Wipebreakpointrange
Writememory
Writetoini

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 602KB - Virtual size: 602KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 158KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b506eb2a8460dda2f894ea74b09b2fb

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

shlwapi

psapi

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 602KB - Virtual size: 602KB

.data Size: 158KB - Virtual size: 1.1MB

.pdata Size: 28KB - Virtual size: 27KB

.rsrc Size: 188KB - Virtual size: 188KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 602KB - Virtual size: 602KB

.data
Size: 158KB - Virtual size: 1.1MB

.pdata
Size: 28KB - Virtual size: 27KB

.rsrc
Size: 188KB - Virtual size: 188KB

.reloc
Size: 27KB - Virtual size: 27KB