41db66b83b00102a9db31c2ad406418c

Sharing

Copy URL Twitter E-mail

General

Target

41db66b83b00102a9db31c2ad406418c
Size

2.6MB
MD5

41db66b83b00102a9db31c2ad406418c
SHA1

d20f737c9262528dbe75aab96abab0a2d9b41299
SHA256

2ce606b943c8ab3747504f0bf5d2a55b0427d3bb3f771885f92f4d799b9b7df0
SHA512

dd6751bd8f0545edaba0e8d1ee9f0004198634c177b9ebeefc92d45505adf91b72ce8de6900708d2d7fcc29349a45aceff5b1966feb0907fb4f5740e5a54ceba
SSDEEP

49152:oi2dS7ym5XqFFG/WH39Q4SPq+gspzf67QF7ek4b8vuMs9nTkh5Mw:oioS7y+4FG/Mh1MfRFm4mvQh5Mw

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Green/Uxtheme patcher/UXTheme Multi-Patcher 5.5.exe
unpack001/Green/Vistart/ViStart.exe
unpack001/Green/Vistart/mainhook.dll
unpack001/Green/Visual Style/Shell/NormalColor/shellstyle.dll
unpack001/Green/Visual Style/VistaLive.msstyles

Files

41db66b83b00102a9db31c2ad406418c
.rar
Green/Styler toolbar/VistaLive green/Details.png
.png
Green/Styler toolbar/VistaLive green/Favorites.png
.png
Green/Styler toolbar/VistaLive green/IE.png
.png
Green/Styler toolbar/VistaLive green/Search.png
.png
Green/Styler toolbar/VistaLive green/SearchOption.png
.png
Green/Styler toolbar/VistaLive green/Searchbar.png
.png
Green/Styler toolbar/VistaLive green/Thumbs.db
Green/Styler toolbar/VistaLive green/back.png
.png
Green/Styler toolbar/VistaLive green/bkg.png
.png
Green/Styler toolbar/VistaLive green/bkgIE.png
.png
Green/Styler toolbar/VistaLive green/customize.png
.png
Green/Styler toolbar/VistaLive green/explorer.PNG
.png
Green/Styler toolbar/VistaLive green/forward.png
.png
Green/Styler toolbar/VistaLive green/history.png
.png
Green/Styler toolbar/VistaLive green/home.png
.png
Green/Styler toolbar/VistaLive green/icon.png
.png
Green/Styler toolbar/VistaLive green/list.png
.png
Green/Styler toolbar/VistaLive green/option.png
.png
Green/Styler toolbar/VistaLive green/print.png
.png
Green/Styler toolbar/VistaLive green/refresh.png
.png
Green/Styler toolbar/VistaLive green/stop.png
.png
Green/Styler toolbar/VistaLive green/thumbnails.png
.png
Green/Styler toolbar/VistaLive green/tile.png
.png
Green/Styler toolbar/VistaLive green/toolbar.ini
Green/Styler toolbar/VistaLive green/tree.png
.png
Green/Styler toolbar/VistaLive green/up.png
.png
Green/Styler toolbar/VistaLive green/zoom+.png
.png
Green/Styler toolbar/VistaLive green/zoom-.png
.png
Green/Thumbs.db
Green/Uxtheme patcher/UXTheme Multi-Patcher 5.5.exe
.exe windows:4 windows x86 arch:x86

e41c25ab7824b3df73334188c40518ae

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

kernel32

lstrcpyA
GetCommandLineA
SetErrorMode
lstrlenA
MulDiv
GetTempFileNameA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
FormatMessageA
lstrcatA
GetLastError
_lwrite
_llseek
GlobalUnlock
_lopen
GlobalAlloc
GlobalFree
_lclose
_lcreat
LoadLibraryA
GetProcAddress
FreeLibrary
OpenFile
GetVersionExA
GetCurrentProcess
WinExec
ExitProcess
_lread
LocalFree
GetTempPathA
GlobalLock

user32

GetDC
BeginPaint
EndPaint
InvalidateRect
PostQuitMessage
SendMessageA
DefWindowProcA
GetClientRect
CreateWindowExA
DrawTextA
ReleaseDC
ShowWindow
SetWindowPos
UpdateWindow
SetTimer
LoadIconA
wsprintfA
MessageBoxA
ExitWindowsEx
RegisterClassA
LoadCursorA

gdi32

DeleteObject
GetStockObject
GetDeviceCaps
PatBlt
CreateSolidBrush
TextOutA
SetTextColor
SetBkMode
SelectObject
StretchDIBits
CreateFontA
RealizePalette
SelectPalette
CreatePalette

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

Exports

Exports

_MainWndProc@16
_StubFileWrite@12

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Green/Vistart/ViStart.exe
.exe windows:4 windows x86 arch:x86

526a6df99bb36ddc54ccc443059af522

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames
ord693
ord695
ord588
MethCallEngine
EVENT_SINK_Invoke
ord516
ord517
ord518
ord629
ord660
ord661
ord558
ord666
ord667
Zombie_GetTypeInfo
ord592
ord300
ord301
ord595
ord598
ord306
ord520
ord307
ord522
ord632
ord526
EVENT_SINK_AddRef
ord561
ord562
DllFunctionCall
ord563
ord670
Zombie_GetTypeInfoCount
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord314
ord606
ord315
ord607
ord316
ord608
ord716
ord717
ord319
ProcCallEngine
ord537
ord644
ord647
ord649
ord573
ord681
ord685
ord100
ord320
ord321
ord616
ord617
ord618
ord619
ord581

Sections

.text
Size: 436KB - Virtual size: 432KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Green/Vistart/copy to fonts/segoeui.ttf
Green/Vistart/copy to fonts/segoeuib.ttf
Green/Vistart/copy to fonts/segoeuii.ttf
Green/Vistart/copy to fonts/segoeuiz.ttf
Green/Vistart/mainhook.dll
.dll windows:4 windows x86 arch:x86

73eb0e7a4a37ba512c04f76b7c43ddc0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TlsFree
CloseHandle
UnmapViewOfFile
LocalFree
TlsGetValue
TlsSetValue
LocalAlloc
TlsAlloc
MapViewOfFile
GetLastError
CreateFileMappingA
GetCurrentThreadId
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
FlushFileBuffers
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
ExitProcess
TerminateProcess
GetCurrentProcess
SetLastError
GetCurrentThread
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
IsBadWritePtr
IsBadReadPtr
HeapValidate
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
SetConsoleCtrlHandler
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
UnhandledExceptionFilter
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetFilePointer
Sleep
SetStdHandle
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetEnvironmentVariableA

user32

UnhookWindowsHookEx
SendMessageA
SetWindowsHookExA
CallNextHookEx

Exports

Exports

InstallFilterDLL
SetSharedData
UnInstallFilterDLL

Sections

.text
Size: 176KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Green/Vistart/readme-en.txt
Green/Vistart/resources/Thumbs.db
Green/Vistart/resources/allprograms.png
.png
Green/Vistart/resources/bottombuttons_arrow.png
.png
Green/Vistart/resources/bottombuttons_logoff.png
.png
Green/Vistart/resources/bottombuttons_shutdown.png
.png
Green/Vistart/resources/button.png
.png
Green/Vistart/resources/programs_arrow.png
.png
Green/Vistart/resources/startmenu.PNG
.png
Green/Vistart/resources/userframe.png
.png
Green/Vistart/rollover/Thumbs.db
Green/Vistart/rollover/computer.png
.png
Green/Vistart/rollover/connect.png
.png
Green/Vistart/rollover/control.png
.png
Green/Vistart/rollover/defaultprograms.png
.png
Green/Vistart/rollover/documents.png
.png
Green/Vistart/rollover/games.png
.png
Green/Vistart/rollover/help.png
.png
Green/Vistart/rollover/music.png
.png
Green/Vistart/rollover/network.png
.png
Green/Vistart/rollover/pictures.png
.png
Green/Vistart/rollover/recent.png
.png
Green/Vistart/rollover/run.png
.png
Green/Vistart/rollover/search.png
.png
Green/Vistart/rollover/userfolder.png
.png
Green/Vistart/rollover/videos.png
.png
Green/Vistart/settings.xml
Green/Visual Style/Shell/NormalColor/shellstyle.dll
.dll windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 567KB - Virtual size: 566KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Green/Visual Style/VistaLive.msstyles
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Green/цветок.jpg
.jpg

Sharing

General

Malware Config

Signatures

Files

e41c25ab7824b3df73334188c40518ae

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 48KB - Virtual size: 48KB

526a6df99bb36ddc54ccc443059af522

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 436KB - Virtual size: 432KB

.data Size: - Virtual size: 80KB

.rsrc Size: 136KB - Virtual size: 135KB

73eb0e7a4a37ba512c04f76b7c43ddc0

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 176KB - Virtual size: 172KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 20KB - Virtual size: 25KB

.idata Size: 4KB - Virtual size: 2KB

.shared Size: 4KB - Virtual size: 280B

.reloc Size: 8KB - Virtual size: 6KB

Headers

File Characteristics

Sections

.text Size: 512B - Virtual size: 116B

.rsrc Size: 567KB - Virtual size: 566KB

.reloc Size: 512B - Virtual size: 8B

Headers

File Characteristics

Sections

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 48KB - Virtual size: 48KB

.text
Size: 436KB - Virtual size: 432KB

.data
Size: - Virtual size: 80KB

.rsrc
Size: 136KB - Virtual size: 135KB

.text
Size: 176KB - Virtual size: 172KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 20KB - Virtual size: 25KB

.idata
Size: 4KB - Virtual size: 2KB

.shared
Size: 4KB - Virtual size: 280B

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 512B - Virtual size: 116B

.rsrc
Size: 567KB - Virtual size: 566KB

.reloc
Size: 512B - Virtual size: 8B

.rsrc
Size: 2.0MB - Virtual size: 2.0MB