30e042dadde847e7db80eecd47c92d82

Sharing

Copy URL Twitter E-mail

General

Target

30e042dadde847e7db80eecd47c92d82
Size

151KB
MD5

30e042dadde847e7db80eecd47c92d82
SHA1

2bd7c8094167a84a5639dabd3f47ba3bc8f70390
SHA256

40fa5a80ce6b1f9ccfe03b9ed42491b843329613c989590016cddf968c1a96a3
SHA512

393b50e1d454e56e671829c30e671403ea57c911cb374d42f9a3b4036ad7b3e9ac518cf28f85dcb28f17dde6147a48931c78bb37c7524b3d160cbedd663940a6
SSDEEP

3072:xCeC7utVwOhE4ocOEzoQhfkmISTfsCVVLSlxYcF:xCeC6nachomI69VaxYo

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MSRC4Plugin.dsm
unpack001/SCHook.dll
unpack001/vnchooks.dll
unpack001/winvnc.exe

Files

30e042dadde847e7db80eecd47c92d82
.7z
MSRC4Plugin.dsm
.dll windows:4 windows x86 arch:x86

64cbcbe4dbbe35e6527ec06de42e2c1d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetDlgItemTextA
IsDlgButtonChecked
SetDlgItemTextA
GetDlgItem
EnableWindow
CheckDlgButton
EndDialog
SystemParametersInfoA
GetWindowRect
SetWindowPos
SetForegroundWindow
DialogBoxParamA

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
CryptSetKeyParam
CryptGenRandom
CryptEncrypt
CryptGetUserKey
CryptGetKeyParam
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptReleaseContext
CryptDestroyKey
CryptExportKey
CryptGenKey
CryptImportKey
CryptAcquireContextA
CryptGetProvParam
CryptDecrypt
CryptDestroyHash
RegOpenKeyExA

msvcrt

_splitpath
_snprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
_mbsicmp
__CxxFrameHandler
strtol
sprintf
time
strstr
free
malloc
_except_handler3
_local_unwind2
strncpy
getenv
_makepath
__dllonexit
_initterm
_adjust_fdiv
_onexit

kernel32

CloseHandle
WriteFile
CreateFileA
ReadFile
GetLastError
SetLastError
SetFilePointer
GetVersionExA
lstrcmpiA
GetModuleFileNameA
GetModuleHandleA

Exports

Exports

Description
FreeBuffer
GetParams
Reset
RestoreBuffer
SetParams
Shutdown
Startup
TransformBuffer

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SCHook.dll
.dll windows:4 windows x86 arch:x86

dd0e42918dee983af42f46b4a2656c46

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

UnmapViewOfFile
ReleaseMutex
CloseHandle
GetProcAddress
LoadLibraryA
lstrcmpiA
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
GetModuleHandleA

user32

GetUpdateRgn
GetCursorPos
ClientToScreen
IsWindowVisible
GetClientRect
CallNextHookEx
GetClassNameA
SetRectEmpty
SetWindowsHookExA
UnhookWindowsHookEx
GetWindowRect

gdi32

DeleteObject
CreateRectRgn
GetRegionData

oleaut32

VariantInit

msvcrt

_onexit
__dllonexit
??2@YAPAXI@Z
??3@YAXPAX@Z
free
_initterm
malloc
_adjust_fdiv

Exports

Exports

SetHook
UnSetHook

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SharedD
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
background.bmp
enter.bmp
helpdesk.txt
icon1.ico
icon2.ico
logo.bmp
rc4.key
vnchooks.dll
.dll windows:4 windows x86 arch:x86

d292fb49052583a662f72508f13cbc5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetClientRect
PostMessageA
FindWindowA
GetWindowRect
PostThreadMessageA
GetUpdateRgn
ClientToScreen
IsWindowVisible
GetCursor
GetPropA
SetPropA
CallNextHookEx
EnumWindows
RemovePropA
SetWindowsHookExA
UnhookWindowsHookEx
RegisterWindowMessageA

advapi32

RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA

gdi32

GetRegionData
DeleteObject
CreateRectRgn

kernel32

GetStringTypeW
GetStringTypeA
LCMapStringA
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
LCMapStringW
LeaveCriticalSection
Sleep
GetModuleFileNameA
GetModuleHandleA
GlobalAddAtomA
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
ExitProcess
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA

Exports

Exports

HooksType
SetHooks
SetKeyboardFilterHook
SetMouseFilterHook
UnSetHooks

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SharedD
Size: 4KB - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
winvnc.exe
.exe windows:4 windows x86 arch:x86

9c9a575c671407b3a87e97ea11abd18b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

gethostname
gethostbyname
ioctlsocket
WSAGetLastError
recv
send
getsockname
getpeername
accept
listen
inet_addr
connect
htons
htonl
bind
shutdown
closesocket
socket
setsockopt
WSACleanup
WSAStartup

winmm

timeGetTime

kernel32

MapViewOfFile
OpenFileMappingA
CloseHandle
UnmapViewOfFile
WaitForSingleObject
CreateMutexA
ReleaseMutex
GetComputerNameA
ResumeThread
CreateThread
IsBadWritePtr
IsBadReadPtr
GetLastError
GetSystemTime
FlushFileBuffers
CreateDirectoryA
MoveFileA
SetErrorMode
GetDriveTypeA
GetLogicalDriveStringsA
FileTimeToSystemTime
GetFileTime
CreateFileA
MulDiv
GetCurrentThreadId
SetFilePointer
ReadFile
WriteFile
SetFileTime
SystemTimeToFileTime
SetEndOfFile
Sleep
GetVersionExA
SetThreadPriority
GetCurrentThread
OpenEventA
GlobalUnlock
GlobalLock
GlobalAlloc
SetProcessShutdownParameters
TerminateProcess
CreateProcessA
GetStdHandle
AllocConsole
MoveFileExA
FormatMessageA
SetLastError
WriteConsoleA
OutputDebugStringA
GetCurrentProcessId
OpenProcess
SearchPathA
GlobalFree
TlsGetValue
TlsFree
TlsAlloc
CreateFileMappingA
DuplicateHandle
TlsSetValue
CreateSemaphoreA
ReleaseSemaphore
DeleteCriticalSection
InitializeCriticalSection
GetProcAddress
LoadLibraryA
FindClose
FindNextFileA
FindFirstFileA
GetModuleFileNameA
DeleteFileA
FreeLibrary
CopyFileA
LeaveCriticalSection
EnterCriticalSection
GetSystemInfo
GetVersion
GetStartupInfoA
GetModuleHandleA
lstrlenA
GetCurrentProcess
GetProfileStringA

user32

SetThreadDesktop
GetProcessWindowStation
GetUserObjectInformationA
ExitWindowsEx
EnableWindow
GetSubMenu
OpenInputDesktop
TrackPopupMenu
GetMenuItemID
EnableMenuItem
DestroyMenu
LoadMenuA
ToAscii
SetMenuDefaultItem
VkKeyScanA
GetAsyncKeyState
MapVirtualKeyA
PeekMessageA
WaitMessage
IsIconic
WaitForInputIdle
GetParent
GetClipboardOwner
GetClipboardData
GetForegroundWindow
IsWindowVisible
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetIconInfo
DrawIconEx
SetClipboardViewer
IsWindow
EnumWindows
OpenDesktopA
EnumDesktopWindows
CloseDesktop
FindWindowA
GetClassNameA
ChangeClipboardChain
DestroyWindow
GetDesktopWindow
WindowFromPoint
GetWindowRect
RegisterWindowMessageA
GetThreadDesktop
mouse_event
GetCursorPos
InvalidateRect
wsprintfA
GetKeyboardState
keybd_event
GetDC
ReleaseDC
EnumDisplaySettingsA
GetDlgItemTextA
SetFocus
EndDialog
SetWindowTextA
LoadStringA
DialogBoxParamA
GetScrollInfo
PostMessageA
SetDlgItemTextA
GetDlgItem
SendDlgItemMessageA
SetForegroundWindow
MessageBoxA
SystemParametersInfoA
SendMessageA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
KillTimer
PostQuitMessage
SetTimer
LoadIconA
LoadCursorA
RegisterClassExA
AdjustWindowRect
CreateWindowExA
GetWindowLongA
SetWindowLongA
ShowWindow
GetSystemMetrics
SetWindowPos
IsRectEmpty
LoadImageA
GetWindowTextA

gdi32

RealizePalette
SelectPalette
CreatePalette
CreateDIBSection
SetDIBColorTable
GdiFlush
GetBitmapBits
GetObjectA
GetDeviceCaps
CreateCompatibleBitmap
GetPixel
GetSystemPaletteEntries
SetBkMode
GetStockObject
GetClipBox
CreateCompatibleDC
CreateSolidBrush
SelectObject
DeleteDC
GetDIBits
CreateDCA
DeleteObject
BitBlt
PatBlt
StretchBlt

shell32

Shell_NotifyIconA
ShellExecuteExA
SHAppBarMessage
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteA

advapi32

RegCreateKeyExA
OpenProcessToken
RegSetValueExA
RegCloseKey
RevertToSelf
DuplicateToken
ImpersonateLoggedOnUser
GetUserNameA
RegQueryValueExA
RegOpenKeyExA

ole32

CoInitialize
CoCreateInstance

comctl32

InitCommonControlsEx

msvcrt

sscanf
memmove
memcmp
free
malloc
strcmp
strstr
_snprintf
_purecall
??2@YAPAXI@Z
_ismbcdigit
atoi
_mbsicmp
memcpy
strcpy
strrchr
strlen
strcat
??3@YAXPAX@Z
__CxxFrameHandler
_initterm
sprintf
memset
abs
_strdup
__setusermatherr
_adjust_fdiv
__p__commode
fflush
printf
_dup2
_open_osfhandle
fclose
_iob
_vsnprintf
ctime
time
_stricmp
fgets
fopen
exit
setbuf
_CxxThrowException
__p__fmode
__set_app_type
_except_handler3
??1type_info@@UAE@XZ
_controlfp
strncat
strncpy
_strnicmp
strchr
tolower
calloc
strncmp
_beginthreadex
_endthreadex
fprintf
realloc
__dllonexit
_onexit
_XcptFilter
_acmdln
__getmainargs
_fdopen
_exit
_itoa

msvcp60

??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ

Sections

.text
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64cbcbe4dbbe35e6527ec06de42e2c1d

Headers

File Characteristics

Imports

user32

advapi32

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 21KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 12KB - Virtual size: 11KB

.idata Size: 4KB - Virtual size: 2KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 1KB

dd0e42918dee983af42f46b4a2656c46

Headers

File Characteristics

Imports

kernel32

user32

gdi32

oleaut32

msvcrt

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 4KB - Virtual size: 66KB

.SharedD Size: 4KB - Virtual size: 16B

.rsrc Size: 4KB - Virtual size: 928B

.reloc Size: 4KB - Virtual size: 640B

d292fb49052583a662f72508f13cbc5b

Headers

File Characteristics

Imports

user32

advapi32

gdi32

kernel32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 12KB

.SharedD Size: 4KB - Virtual size: 36B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

9c9a575c671407b3a87e97ea11abd18b

Headers

File Characteristics

Imports

wsock32

winmm

kernel32

user32

gdi32

shell32

advapi32

ole32

comctl32

msvcrt

msvcp60

Sections

.text Size: 156KB - Virtual size: 155KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 32KB - Virtual size: 45KB

.rsrc Size: 16KB - Virtual size: 13KB

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 12KB - Virtual size: 11KB

.idata
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 66KB

.SharedD
Size: 4KB - Virtual size: 16B

.rsrc
Size: 4KB - Virtual size: 928B

.reloc
Size: 4KB - Virtual size: 640B

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 12KB

.SharedD
Size: 4KB - Virtual size: 36B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 156KB - Virtual size: 155KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 32KB - Virtual size: 45KB

.rsrc
Size: 16KB - Virtual size: 13KB