07ba32d6c1d3a1e196e19709dbcae9c13a6efbfecd045127cac35774da26726b

Sharing

Copy URL Twitter E-mail

General

Target

07ba32d6c1d3a1e196e19709dbcae9c13a6efbfecd045127cac35774da26726b
Size

291KB
MD5

364cfaf2f9dc09963712c7f3cc84884d
SHA1

6d9e01dfc4e087b88d7684bb27abc46b9db3a91c
SHA256

07ba32d6c1d3a1e196e19709dbcae9c13a6efbfecd045127cac35774da26726b
SHA512

c170c7c2768cbdbefe747c52b3a1d12c54facda79364b874cb6fc8593961acda79a4e29de704dd7580939c3b0ba7f2a44ecaa7c78635e9bdb9201c0721014e35
SSDEEP

6144:sYsOvz55soFyKDV6LNBoFyKDV/xd58ULPVzkKxt/gIPJ:s1OvzLRFuLMFb58MPBkst4c

Score

3^/10

Malware Config

Signatures

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
unpack001/360未检出/000BDFD4BA476AA823CD82F02A4B02A7
unpack001/360未检出/00C5FC9B35AD7A167E7377750B4A7915
unpack001/360未检出/0A0708A0B8649C1C115E9F0B0E11DDCE
unpack001/360未检出/0A92C8BE3147084485FEEFB4051F2587
unpack001/360未检出/0AA6C58EBF164131B6902629B000EC52
unpack001/360未检出/0D5071730DC92DDBDC7E2D4EE0F7723A
unpack001/360未检出/0E2184A83A5F4328812D563B9555A8FB
unpack001/360未检出/0FB6061F7D37424FB9E6D0E76B019C19
unpack001/360未检出/1AEFB40C177DF322D0E4F476F59A5F71
unpack001/360未检出/1C836CD5AEBE1706326AC45C59038C42

Files

07ba32d6c1d3a1e196e19709dbcae9c13a6efbfecd045127cac35774da26726b
.zip
360未检出/000BDFD4BA476AA823CD82F02A4B02A7
.exe windows:4 windows x86 arch:x86

27c1ec582f660bf6a889b22288fd6f20

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
_adj_fprem1
ord518
ord626
__vbaStrCat
__vbaHresultCheckObj
ord662
ord557
ord558
__vbaLenVar
_adj_fdiv_m32
__vbaForEachCollObj
__vbaExitProc
__vbaObjSet
ord595
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaBoolVar
__vbaBoolVarNull
_CIsin
ord524
__vbaNextEachCollObj
__vbaVarCmpGt
__vbaVarZero
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
__vbaVarTstEq
ord560
__vbaI2I4
__vbaObjVar
__vbaVarOr
_adj_fpatan
__vbaLateIdCallLd
EVENT_SINK_Release
__vbaNew
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord605
ord712
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
__vbaCheckType
_CIlog
__vbaErrorOverflow
__vbaR8Str
__vbaNew2
__vbaVarLateMemCallLdRf
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaVarDup
__vbaFreeVarg
__vbaVarCopy
__vbaVarLateMemCallLd
ord617
__vbaLateMemCallLd
_CIatan
__vbaCastObj
__vbaStrMove
__vbaForEachVar
_allmul
__vbaLateIdSt
_CItan
ord546
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr

Sections

.text
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
360未检出/00C5FC9B35AD7A167E7377750B4A7915
.exe windows:4 windows x86 arch:x86

285fa91a657097c4a2319905f398111e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
ord516
_adj_fprem1
ord518
ord519
ord626
__vbaStrCat
__vbaVarCmpNe
__vbaSetSystemError
__vbaHresultCheckObj
ord662
_adj_fdiv_m32
ord669
__vbaExitProc
__vbaObjSet
__vbaOnError
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaBoolVarNull
_CIsin
ord631
__vbaVarZero
__vbaChkstk
EVENT_SINK_AddRef
ord527
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarOr
__vbaCastObjVar
_adj_fpatan
__vbaLateIdCallLd
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaInStrVar
__vbaVarCat
ord536
_CIlog
__vbaErrorOverflow
__vbaNew2
__vbaVarLateMemCallLdRf
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
ord616
__vbaVarCopy
__vbaVarLateMemCallLd
_CIatan
__vbaStrMove
ord618
__vbaCastObj
__vbaForEachVar
_allmul
__vbaLateIdSt
_CItan
ord546
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
360未检出/0A0708A0B8649C1C115E9F0B0E11DDCE
.exe windows:4 windows x86 arch:x86

ffebde6e9dd8c41369dcca3c96fc0ac5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaVarTstGt
_CIcos
_adj_fptan
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaStrVarMove
ord588
__vbaFreeVarList
__vbaVarIdiv
__vbaEnd
__vbaPut3
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
ord517
_adj_fprem1
ord518
ord626
__vbaResume
__vbaStrCat
__vbaVarCmpNe
ord660
__vbaHresultCheckObj
ord662
_adj_fdiv_m32
__vbaVarCmpGe
__vbaVarForInit
__vbaExitProc
__vbaFileCloseAll
__vbaObjSet
__vbaOnError
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaBoolVar
__vbaBoolVarNull
__vbaVarTstLt
_CIsin
__vbaErase
ord631
__vbaVarCmpGt
__vbaVargVarMove
__vbaVarZero
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
ord529
__vbaVarTstEq
__vbaPrintObj
__vbaObjVar
__vbaVarOr
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaRedim
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaGetOwner3
ord534
__vbaVarCat
ord536
__vbaI2Var
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
ord570
__vbaInStr
__vbaVarLateMemCallLdRf
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarCmpLt
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
__vbaVarAdd
__vbaLateMemCall
__vbaVarDup
__vbaVarMod
__vbaVarCopy
__vbaVarTstGe
ord616
__vbaVarLateMemCallLd
_CIatan
__vbaStrMove
ord618
ord619
__vbaForEachVar
_allmul
_CItan
ord546
__vbaUI1Var
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
360未检出/0A92C8BE3147084485FEEFB4051F2587
.exe windows:5 windows x86 arch:x86

1b5e175e908cb87d205d2e3c55e8b8e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
CreateToolhelp32Snapshot
TerminateProcess
CreateProcessA
Process32Next
Process32First
DeviceIoControl
FlushFileBuffers
GetTempPathA
OpenSemaphoreA
GetProcessTimes
GetFileAttributesA
HeapFree
HeapAlloc
GetProcessHeap
CreateFileW
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
SetStdHandle
GetConsoleMode
GetConsoleCP
HeapReAlloc
LCMapStringW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
OpenProcess
GetCurrentProcess
GetWindowsDirectoryA
ExpandEnvironmentStringsA
GetLastError
GetNativeSystemInfo
GetModuleHandleA
GetProcAddress
GetTickCount
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
OutputDebugStringA
FileTimeToSystemTime
WriteFile
GetLocalTime
InitializeCriticalSection
DeleteCriticalSection
FindFirstFileA
FindNextFileA
FindClose
DeleteFileA
SystemTimeToFileTime
SetFilePointer
GetModuleHandleExA
GetModuleFileNameA
CreateDirectoryA
GetFileSize
WideCharToMultiByte
CreateFileA
GetFileSizeEx
CloseHandle
ReadFile
MultiByteToWideChar
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetLocaleInfoW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapCreate
SetLastError
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
ExitProcess
HeapSize
lstrlenA
GetModuleHandleW
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
RtlUnwind
RaiseException
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
WriteConsoleW

user32

SendMessageW
FindWindowA

shell32

ShellExecuteA

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
VariantInit
SysFreeString

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360未检出/0AA6C58EBF164131B6902629B000EC52
.exe windows:5 windows x86 arch:x86

1b5e175e908cb87d205d2e3c55e8b8e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
CreateToolhelp32Snapshot
TerminateProcess
CreateProcessA
Process32Next
Process32First
DeviceIoControl
FlushFileBuffers
GetTempPathA
OpenSemaphoreA
GetProcessTimes
GetFileAttributesA
HeapFree
HeapAlloc
GetProcessHeap
CreateFileW
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
SetStdHandle
GetConsoleMode
GetConsoleCP
HeapReAlloc
LCMapStringW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
OpenProcess
GetCurrentProcess
GetWindowsDirectoryA
ExpandEnvironmentStringsA
GetLastError
GetNativeSystemInfo
GetModuleHandleA
GetProcAddress
GetTickCount
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
OutputDebugStringA
FileTimeToSystemTime
WriteFile
GetLocalTime
InitializeCriticalSection
DeleteCriticalSection
FindFirstFileA
FindNextFileA
FindClose
DeleteFileA
SystemTimeToFileTime
SetFilePointer
GetModuleHandleExA
GetModuleFileNameA
CreateDirectoryA
GetFileSize
WideCharToMultiByte
CreateFileA
GetFileSizeEx
CloseHandle
ReadFile
MultiByteToWideChar
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetLocaleInfoW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapCreate
SetLastError
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
ExitProcess
HeapSize
lstrlenA
GetModuleHandleW
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
RtlUnwind
RaiseException
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
WriteConsoleW

user32

SendMessageW
FindWindowA

shell32

ShellExecuteA

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
VariantInit
SysFreeString

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360未检出/0D5071730DC92DDBDC7E2D4EE0F7723A
.exe windows:4 windows x86 arch:x86

ece913761cd207b7b0a9199ac9f5c02a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord582
__vbaStrI2
ord583
_CIcos
_adj_fptan
__vbaVarMove
ord585
__vbaVarVargNofree
__vbaFreeVar
__vbaLineInputStr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
_adj_fprem1
ord518
__vbaRecAnsiToUni
ord626
__vbaVarCmpNe
__vbaStrCat
ord660
__vbaLsetFixstr
__vbaSetSystemError
ord662
__vbaHresultCheckObj
__vbaVargVarCopy
_adj_fdiv_m32
__vbaExitProc
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
_adj_fdivr_m16i
ord598
ord520
__vbaFpR8
__vbaBoolVarNull
_CIsin
__vbaVarZero
__vbaVarCmpGt
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaObjVar
__vbaI2I4
__vbaPrintObj
DllFunctionCall
__vbaVarOr
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaR4Var
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
ord712
ord713
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
__vbaI2Str
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaR4ForNextCheck
ord537
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
__vbaNew2
ord648
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaAryLock
__vbaVarAdd
__vbaVarDup
ord614
__vbaFpI2
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
_CIatan
__vbaStrMove
__vbaForEachVar
__vbaStrVarCopy
_allmul
_CItan
ord546
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581

Sections

.text
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
360未检出/0E2184A83A5F4328812D563B9555A8FB
.dll windows:5 windows x64 arch:x64

9717a9ccea72bb07ab2b84a1cabf8c2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

__C_specific_handler
_XcptFilter
malloc
_initterm
free
_amsg_exit
strncat

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
CreateFileA
CloseHandle
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 90B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360未检出/0FB6061F7D37424FB9E6D0E76B019C19
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360未检出/1AEFB40C177DF322D0E4F476F59A5F71
.exe windows:4 windows x86 arch:x86

b1346f79951c115da21a86ab59aa9e13

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
_adj_fprem1
ord518
ord626
__vbaCopyBytes
__vbaStrCat
__vbaVarCmpNe
__vbaSetSystemError
__vbaHresultCheckObj
ord662
_adj_fdiv_m32
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaExitProc
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaBoolVarNull
_CIsin
__vbaErase
__vbaVarZero
__vbaVarCmpGt
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaVarTstEq
__vbaObjVar
DllFunctionCall
ord670
__vbaVarOr
__vbaFpUI1
_adj_fpatan
__vbaStrR8
__vbaRedim
__vbaUI1ErrVar
EVENT_SINK_Release
ord601
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
ord711
ord712
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
ord535
_CIlog
__vbaErrorOverflow
__vbaNew2
__vbaVarLateMemCallLdRf
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaAryLock
__vbaLateMemCall
__vbaVarDup
ord614
__vbaFpI4
__vbaVarCopy
__vbaVarLateMemCallLd
_CIatan
__vbaStrMove
ord619
__vbaForEachVar
_allmul
_CItan
ord546
__vbaUI1Var
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
360未检出/1C836CD5AEBE1706326AC45C59038C42
.exe windows:4 windows x86 arch:x86

481995fea38c057faafd124736a94743

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
_adj_fprem1
ord518
ord626
__vbaStrCat
__vbaVarCmpNe
__vbaSetSystemError
__vbaHresultCheckObj
ord662
__vbaLenVar
_adj_fdiv_m32
__vbaExitProc
__vbaObjSet
__vbaOnError
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord520
__vbaBoolVarNull
_CIsin
ord632
__vbaVarZero
__vbaVarCmpGt
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarOr
__vbaVarLateMemSt
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
__vbaPrintFile
ord712
ord713
_adj_fprem
_adj_fdivr_m64
ord607
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
ord648
__vbaInStr
__vbaVarLateMemCallLdRf
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
__vbaVarCopy
__vbaVarLateMemCallLd
ord616
__vbaFpI4
ord617
_CIatan
__vbaStrMove
__vbaForEachVar
ord619
_allmul
_CItan
ord546
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

27c1ec582f660bf6a889b22288fd6f20

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 80KB - Virtual size: 77KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 3KB

285fa91a657097c4a2319905f398111e

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 36KB - Virtual size: 32KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 1KB

ffebde6e9dd8c41369dcca3c96fc0ac5

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 52KB - Virtual size: 48KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 2KB

1b5e175e908cb87d205d2e3c55e8b8e3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

Sections

.text Size: 109KB - Virtual size: 108KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 13KB - Virtual size: 12KB

1b5e175e908cb87d205d2e3c55e8b8e3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

Sections

.text Size: 109KB - Virtual size: 108KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 13KB - Virtual size: 12KB

ece913761cd207b7b0a9199ac9f5c02a

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 92KB - Virtual size: 90KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 2KB

9717a9ccea72bb07ab2b84a1cabf8c2f

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

.text
Size: 80KB - Virtual size: 77KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 3KB

.text
Size: 36KB - Virtual size: 32KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB

.text
Size: 52KB - Virtual size: 48KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 2KB

.text
Size: 109KB - Virtual size: 108KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 13KB - Virtual size: 12KB

.text
Size: 109KB - Virtual size: 108KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 13KB - Virtual size: 12KB

.text
Size: 92KB - Virtual size: 90KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 2KB

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 512B - Virtual size: 216B

.reloc
Size: 512B - Virtual size: 90B

.text
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 1024B - Virtual size: 880B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 48KB - Virtual size: 44KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB

.text
Size: 84KB - Virtual size: 83KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 3KB