1e15fc37b9058a1607afe41621df62e1

Sharing

Copy URL

Twitter E-mail

General

Target

1e15fc37b9058a1607afe41621df62e1
Size

234KB
MD5

1e15fc37b9058a1607afe41621df62e1
SHA1

087f4c4b39afc4cbda9837c2e85e81bbd8475748
SHA256

eabb567d402c51623e0563016748fdb1b8d701b6bcb0509eb65f8aa05d694162
SHA512

8d8d0774fa4fc2c702210ac2a60e7672ea16c8f835204214d55d6a809a6ca13124780903a5374e3faa2e41c7f68d6ec7e8f9f693fbd553bee6212678626c7717
SSDEEP

6144:/5A6s3TRyFnIAZbU8dmItQ/bFqeqMwtulXZ475WGEP:BA6mlyf9DdmIm/Jfdl452P

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/Lenin_Script/dll/Band/band.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Lenin_Script/dll/Band/band.dll	upx

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Lenin_Script/dll/BARS.MDX
unpack001/Lenin_Script/dll/Band/band.dll
unpack001/Lenin_Script/dll/color.dll
unpack001/Lenin_Script/dll/ctl_gen.mdx
unpack001/Lenin_Script/dll/dialog.mdx
unpack001/Lenin_Script/dll/dlls.dll
unpack001/Lenin_Script/dll/edll.dll
unpack001/Lenin_Script/dll/findfile.dll
unpack001/Lenin_Script/dll/mdx.dll

Files

1e15fc37b9058a1607afe41621df62e1
.rar
Lenin_Script/#Beginner - IRCops, Who they are, and What they do.htm
.html
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/Thumbs.db
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/ball-r.gif
.gif
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/cor-gb2.jpg
.jpg
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/cor-gt2.jpg
.jpg
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/globe2tt.gif
.gif
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/goose-sm3.jpg
.jpg
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/logo6a.gif
.gif
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/mseovert.js
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/spacer.gif
.gif
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/star-r.gif
.gif
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/star.gif
.gif
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/style.css
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/tealline.gif
Lenin_Script/#Beginner - IRCops, Who they are, and What they do_files/vspacer.gif
.gif
Lenin_Script/Commands.htm
.html .js polyglot
Lenin_Script/aliases.ini
Lenin_Script/ascii/ASCII.TXT
Lenin_Script/ascii/BOMB.TXT
Lenin_Script/ascii/BUNNY.TXT
Lenin_Script/ascii/CASTLE.TXT
Lenin_Script/ascii/CAT.TXT
Lenin_Script/ascii/CAT2.TXT
Lenin_Script/ascii/CROSS.TXT
Lenin_Script/ascii/DRAGON.TXT
Lenin_Script/ascii/EAGLE.TXT
Lenin_Script/ascii/EAGLE2.TXT
Lenin_Script/ascii/FIRE.TXT
Lenin_Script/ascii/FISH.TXT
Lenin_Script/ascii/KISS.TXT
Lenin_Script/ascii/NYC.TXT
Lenin_Script/ascii/OPS.TXT
Lenin_Script/ascii/OWL.TXT
Lenin_Script/ascii/P&B1.TXT
Lenin_Script/ascii/PONY.TXT
Lenin_Script/ascii/PRAY.TXT
Lenin_Script/ascii/ROSE3.TXT
Lenin_Script/ascii/SEAHORSE.TXT
Lenin_Script/ascii/SNOWMAN.TXT
Lenin_Script/ascii/TIGGER.TXT
Lenin_Script/ascii/UNIVERSE.TXT
Lenin_Script/ascii/WOLF.TXT
Lenin_Script/ascii/WOLF2.TXT
Lenin_Script/bordem_net full commands.htm
.html .js polyglot
Lenin_Script/bordem_net full commands_files/ads.htm
.html
Lenin_Script/bordem_net full commands_files/bnlogo_4.png
.png
Lenin_Script/bordem_net full commands_files/i-1.htm
.html
Lenin_Script/bordem_net full commands_files/i-1_files/stylebn.css
Lenin_Script/bordem_net full commands_files/i-3.htm
.html
Lenin_Script/bordem_net full commands_files/i-3_files/stylebn.css
Lenin_Script/bordem_net full commands_files/show_ads.js
.js
Lenin_Script/bordem_net full commands_files/stbit_3.png
.png
Lenin_Script/bordem_net full commands_files/stvbit_2.png
.png
Lenin_Script/bordem_net full commands_files/stylebn.css
Lenin_Script/bordem_net full commands_files/tnav_about.png
.png
Lenin_Script/bordem_net full commands_files/tnav_forums.png
.png
Lenin_Script/bordem_net full commands_files/tnav_home.png
.png
Lenin_Script/bordem_net full commands_files/tnav_irc.png
.png
Lenin_Script/bordem_net full commands_files/tnav_left_2.png
.png
Lenin_Script/bordem_net full commands_files/tnav_right.png
.png
Lenin_Script/bordem_net full commands_files/tnav_vpn.png
.png
Lenin_Script/cc.dat
Lenin_Script/control.ini
Lenin_Script/dll/BARS.MDX
.dll windows:4 windows x86 arch:x86

99eee5c933b3e274b3f9aa164c57762c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

InvalidateRect
PostMessageA
SendMessageA
SetWindowLongA
DestroyIcon
CallWindowProcA
GetWindowLongA
DefWindowProcA
CreateWindowExA
DestroyWindow
GetKeyState
LoadIconA
GetClientRect
FillRect
LoadImageA
GetParent
EnableWindow

gdi32

GetObjectA
CreateBrushIndirect
DeleteDC
Rectangle
CreatePen
SelectObject
StretchBlt
BitBlt
CreateCompatibleDC
DeleteObject

shell32

ExtractIconExA

comctl32

ImageList_ReplaceIcon
ImageList_Add
ImageList_Replace
ImageList_Create
ImageList_Destroy
InitCommonControlsEx

msvcrt

??2@YAPAXI@Z
malloc
_adjust_fdiv
_initterm
free
_itoa
_stricmp
strncpy
__CxxFrameHandler
atoi
??3@YAXPAX@Z

kernel32

DisableThreadLibraryCalls

Exports

Exports

getMDXHeader

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lenin_Script/dll/Band/band.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

LoadDll
UnloadDll
band
cicon
color
hide
icon
isshow
menu
show
taskbar
title
version

Sections

UPX0
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Lenin_Script/dll/color.dll
.dll windows:4 windows x86 arch:x86

307f6ce041b4742807da176fa552840b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
lstrcpyA

user32

MessageBoxA
wsprintfA

comdlg32

ChooseColorA

msvcrt

free
malloc
memset
_adjust_fdiv
_initterm

Exports

Exports

Color
DllInfo

Sections

.text
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lenin_Script/dll/ctl_gen.mdx
.dll windows:4 windows x86 arch:x86

36f31ad565ef7d1c14a9e5b079ac75ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
DisableThreadLibraryCalls
ReadFile
LoadLibraryA
CloseHandle
FreeLibrary

user32

PostMessageA
CallWindowProcA
GetScrollPos
LoadImageA
SetWindowPos
EnableWindow
GetScrollInfo
MoveWindow
DestroyWindow
SetCursor
UnregisterClassA
RegisterClassA
SendMessageA
GetCursorPos
ScreenToClient
DefWindowProcA
GetWindowLongA
SetWindowLongA
MessageBoxA
ClientToScreen
GetWindowRect
CreateWindowExA
GetParent
GetClientRect
GetSysColorBrush
FillRect
BeginPaint
GetSysColor
EndPaint
GetCursor
SetScrollPos
SetScrollInfo

gdi32

LineTo
MoveToEx
CreatePen
DeleteObject
SelectObject

comctl32

InitCommonControlsEx

ole32

CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoGetMalloc

msvcrt

__dllonexit
_adjust_fdiv
malloc
_initterm
free
strchr
__CxxFrameHandler
??2@YAPAXI@Z
atoi
strncpy
wcslen
??3@YAXPAX@Z
_onexit
_stricmp
_itoa

Exports

Exports

getMDXHeader

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lenin_Script/dll/dialog.mdx
.dll windows:4 windows x86 arch:x86

252fa339fb91c0295d5e0b214a533f22

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls

user32

ClientToScreen
GetCursorPos
SendMessageA
SetParent
SetTimer
ChildWindowFromPoint
ScreenToClient
IsWindow
CallWindowProcA
PostMessageA
ShowWindow
GetClientRect
GetWindowRect
SetCapture
ReleaseCapture
RedrawWindow
GetParent
GetWindowLongA
SetWindowLongA
SetWindowPos
KillTimer
DefWindowProcA
RegisterWindowMessageA
GetSysColorBrush
FillRect

msvcrt

_strdup
_stricmp
_itoa
_adjust_fdiv
malloc
_initterm
__CxxFrameHandler
atoi
free
strncpy
??3@YAXPAX@Z
??2@YAPAXI@Z

Exports

Exports

getMDXHeader

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lenin_Script/dll/dlls.dll
.dll .js windows:1 windows x86 arch:x86 polyglot

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

ini
name
nc
ncd

Sections

CODE
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 105B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Lenin_Script/dll/edll.dll
.dll windows:4 windows x86 arch:x86

90ada8e0b4781f42f93ff46909622167

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapCreate
VirtualFree
SearchPathA
GetCommandLineA
GetVersion
InterlockedDecrement
InterlockedIncrement
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
RtlUnwind
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapAlloc
GetProcAddress
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
LoadLibraryA

user32

SetWindowTextA
IsWindow
SendMessageA
DestroyIcon

shell32

ExtractIconExA

Exports

Exports

SetIcon
Titlebar
_LoadDll@4
_UnloadDll@4

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lenin_Script/dll/findfile.dll
.dll windows:4 windows x86 arch:x86

93249d734980dc6fa995ed513202b3c3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileType
lstrcatA
FindClose
WriteFile
FindNextFileA
CloseHandle
FindFirstFileA
CreateFileA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
RtlUnwind
LoadLibraryA
GetProcAddress
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
lstrcpyA
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
VirtualAlloc
HeapReAlloc
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP

user32

MessageBoxA
DlgDirListComboBoxA
IsWindow
GetDlgItem
DlgDirListA
wsprintfA
GetClassNameA

Exports

Exports

ComboList
DllInfo
LbList
TxtList

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lenin_Script/dll/mdx.dll
.dll windows:4 windows x86 arch:x86

34b86dab5c0b41a24220fe3732aef3a1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MapViewOfFile
WaitForSingleObject
ReleaseMutex
CreateFileMappingA
UnmapViewOfFile
CloseHandle
GetProcAddress
SetLastError
GetModuleFileNameA
LoadLibraryA
GetLastError
FreeLibrary
GlobalSize
GlobalFree
GlobalLock
GlobalAlloc
GlobalUnlock
GetCurrentProcessId
CreateMutexA

user32

SetWindowPos
GetWindowLongA
PostMessageA
DrawTextA
CreateWindowExA
SetWindowLongA
GetSysColorBrush
RedrawWindow
ChildWindowFromPointEx
GetParent
GetDlgCtrlID
GetWindowRect
ScreenToClient
MoveWindow
GetActiveWindow
SendMessageA
GetDlgItem
SetFocus
ShowWindow
InvalidateRgn
DestroyIcon
GetSysColor
CallWindowProcA
GetClientRect
GetClassNameA
EnumChildWindows
DestroyWindow
EnableWindow
MapWindowPoints
GetWindow
RegisterClipboardFormatA
LoadStringA

gdi32

DeleteDC
GetTextFaceA
GetTextMetricsA
SelectObject
CreateCompatibleDC
DeleteObject
GetObjectA
CreateFontIndirectA
CreateBrushIndirect
GetStockObject
GetBkColor
GetTextColor
SetTextColor
SetBkColor

shell32

ExtractIconExA
DragQueryFileA

ole32

ReleaseStgMedium

msvcrt

_initterm
_onexit
malloc
sprintf
vsprintf
__dllonexit
atoi
strtol
strncpy
_adjust_fdiv
_strdup
__CxxFrameHandler
??2@YAPAXI@Z
free
_stricmp
_itoa
??3@YAXPAX@Z

Exports

Exports

ControlFromPoint
ConvertCoords
DLLInfo
DynamicControl
ErrorInfo
GetFont
LoadDll
MarkDialog
MoveControl
Remove
SetBorderStyle
SetColor
SetControlMDX
SetDialog
SetFont
SetMDXStyle
SetMircVersion

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99eee5c933b3e274b3f9aa164c57762c

Headers

File Characteristics

Imports

user32

gdi32

shell32

comctl32

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 3KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 32KB

UPX1 Size: 17KB - Virtual size: 20KB

UPX2 Size: 1024B - Virtual size: 4KB

307f6ce041b4742807da176fa552840b

Headers

File Characteristics

Imports

kernel32

user32

comdlg32

msvcrt

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 576B

.rdata Size: 512B - Virtual size: 500B

.data Size: 512B - Virtual size: 212B

.reloc Size: 512B - Virtual size: 124B

36f31ad565ef7d1c14a9e5b079ac75ff

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comctl32

ole32

msvcrt

Exports

Exports

Sections

.text Size: 19KB - Virtual size: 18KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 5KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

252fa339fb91c0295d5e0b214a533f22

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

Headers

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB

UPX0
Size: - Virtual size: 32KB

UPX1
Size: 17KB - Virtual size: 20KB

UPX2
Size: 1024B - Virtual size: 4KB

.text
Size: 1024B - Virtual size: 576B

.rdata
Size: 512B - Virtual size: 500B

.data
Size: 512B - Virtual size: 212B

.reloc
Size: 512B - Virtual size: 124B

.text
Size: 19KB - Virtual size: 18KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 5KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

CODE
Size: 38KB - Virtual size: 38KB

DATA
Size: 1024B - Virtual size: 756B

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 105B

.reloc
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 5KB - Virtual size: 5KB

.text
Size: 16KB - Virtual size: 14KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 29KB - Virtual size: 29KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB