0ee21c612269fe0266ee2b33ce41a506

Sharing

Copy URL Twitter E-mail

General

Target

0ee21c612269fe0266ee2b33ce41a506
Size

297KB
MD5

0ee21c612269fe0266ee2b33ce41a506
SHA1

7f599b0dc6bbe46485200df1cee1500a7ab6b070
SHA256

6d458ba477a79af9543511e6154abc912d3a67f5940a239665bba94a6ebd5f78
SHA512

ed75e32427edef32fd74cf4cf29bc0f6df3587b83987d7bc1a199b76cd6590d882667d074331a6f2daf674428a1c7acb6ef1c74405846cd33d96a105731cacbe
SSDEEP

6144:t2DgGqyd3oxcdz1jcufgM7e3lSQtt0PoOKEtq70uHRinFBqLTabu0QZxj:0DLu+1jcufWlvcoOKEtY/xUBqLSxQZN

Score

1^/10

Malware Config

Signatures

Files

0ee21c612269fe0266ee2b33ce41a506
.exe windows:4 windows x86 arch:x86

559f218add207bd09e3c0df043e9b905

Code Sign

26:f7:53:e5:9e:63:45:bf:43:4a:26:b1:54:15:64:bd
Certificate

Issuer

CN=GggvpYSuFAF7Uqd

Not Before

04/04/2012, 06:53

Not After

31/12/2039, 23:59

Subject

CN=GggvpYSuFAF7Uqd

Extended Key Usages

ExtKeyUsageCodeSigning

4e:12:4f:6c:b9:98:42:fa:85:18:1a:f5:0a:d7:98:f6:ec:5c:f5:38
Signer

Actual PE Digest

4e:12:4f:6c:b9:98:42:fa:85:18:1a:f5:0a:d7:98:f6:ec:5c:f5:38

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
LoadLibraryA
GetProcAddress
GetWindowsDirectoryA
lstrcatA
GetModuleHandleA
lstrcmpA
GetCurrentDirectoryW
FindNextVolumeMountPointW
CreateSemaphoreA
FindFirstFileExA
SetVolumeMountPointA
AllocConsole
ReadConsoleOutputW
GetCalendarInfoA
GetWindowsDirectoryW
ResetWriteWatch
LoadLibraryExA
ReadConsoleInputA
Thread32First
ReadConsoleOutputA
GetPrivateProfileSectionNamesW
GetThreadContext
SetProcessAffinityMask
GetDiskFreeSpaceExW
CreateWaitableTimerW
GetVolumePathNameA
QueueUserAPC
WriteConsoleInputW
GetDiskFreeSpaceW
PrepareTape
SetConsoleCtrlHandler
GetFileSizeEx
lstrcpyn
GetLocaleInfoW
GetDateFormatW
SuspendThread
GetPrivateProfileStringW
SetThreadIdealProcessor
GetBinaryType
InterlockedExchangeAdd
GetShortPathNameA
GetConsoleAliasExesW
FindFirstVolumeA
AddAtomA
MultiByteToWideChar
GetCalendarInfoW
Beep
WriteConsoleOutputW
_llseek
ReplaceFileW
_hwrite
EnumSystemLanguageGroupsW
GetTapePosition
WriteProfileStringW
GetPriorityClass
GetStartupInfoW
EnumTimeFormatsA
MoveFileWithProgressW
GetComputerNameW
LocalFileTimeToFileTime
AddAtomW
WaitNamedPipeW
SetTapePosition
DeleteFileA
GetNamedPipeHandleStateA
SetComputerNameExA
ReadProcessMemory
FormatMessageW
EraseTape
ExpandEnvironmentStringsW
GetCompressedFileSizeW
GlobalDeleteAtom
BackupRead
lstrcpy
BackupWrite
GetLogicalDriveStringsA
GetSystemWindowsDirectoryW
GetCurrentConsoleFont
BuildCommDCBW
SetCalendarInfoA
SetProcessShutdownParameters
GetTimeFormatA
WriteProcessMemory
VerifyVersionInfoA
SwitchToFiber
FreeEnvironmentStringsW
CopyFileExW
SetDefaultCommConfigW
EnumSystemLocalesW
GetProfileStringA
lstrcpynA
WriteFileEx
LockResource
GetComputerNameExW
RemoveDirectoryW
CreateHardLinkA
SetEvent
HeapAlloc
GetLocalTime
FillConsoleOutputCharacterW
GetVersionExA
CreateFileW
SetWaitableTimer
MapUserPhysicalPagesScatter
LeaveCriticalSection
GetFileAttributesW
CreateFileMappingA
GetPrivateProfileStructW
HeapDestroy
DeleteTimerQueue
GetSystemWindowsDirectoryA
FindFirstVolumeMountPointA
ProcessIdToSessionId
SetThreadPriority
GetThreadPriority
FindNextFileA
IsProcessorFeaturePresent
IsBadReadPtr
GlobalFindAtomA
GetFileTime
GetSystemDefaultLCID
SetEndOfFile
IsBadStringPtrA
VerLanguageNameW
EnumDateFormatsW
QueryInformationJobObject
MapViewOfFile
GetSystemPowerStatus
GetPrivateProfileStringA
SetCommTimeouts
DefineDosDeviceW
DisableThreadLibraryCalls
GetSystemInfo
GetLongPathNameW
FillConsoleOutputCharacterA
FindResourceW
GetVolumeNameForVolumeMountPointW
SetFileApisToANSI
FlushInstructionCache
GetSystemTime
WaitForDebugEvent

user32

LoadAcceleratorsA
GetScrollRange
DragDetect
GetWindowModuleFileNameW
DestroyIcon
DefFrameProcW
EnumThreadWindows
DdeDisconnect
GetMenuItemCount
GetMessageA
EnumPropsW
ClipCursor
DdeEnableCallback
SetWindowTextW
SetScrollRange
AttachThreadInput
DispatchMessageA
GetOpenClipboardWindow
TrackMouseEvent
SwapMouseButton
InsertMenuW
DrawTextExW
DlgDirListW
GetDialogBaseUnits
IsDlgButtonChecked
SetSystemCursor
CharUpperA
SetCursor
TranslateAcceleratorA
SendMessageCallbackW
EnableMenuItem
CloseClipboard
DdeFreeDataHandle
SetParent
GetKeyNameTextW
PostThreadMessageA
TileChildWindows
RedrawWindow
MessageBeep
DrawAnimatedRects
GetClassInfoA
DrawCaption
EnumDisplayMonitors
EnumDisplayDevicesW
EndDeferWindowPos
LoadCursorFromFileA
GetUpdateRect
DdeConnect
MapVirtualKeyW
GetKeyNameTextA
ValidateRect
RemovePropW
DdeQueryStringW
DrawStateA
DefWindowProcA
SetWindowPlacement
SendNotifyMessageW
LockSetForegroundWindow
CharUpperW
GetKeyboardType
EndPaint
GetUserObjectSecurity
GetDlgItem
CopyImage
GetDlgItemInt
WindowFromPoint
CharToOemW
GetDoubleClickTime
OemToCharW
WINNLSGetEnableStatus
DdePostAdvise
GetNextDlgGroupItem
RegisterHotKey
GetDlgCtrlID
IsCharLowerW
GetGUIThreadInfo
CascadeChildWindows
PostQuitMessage
GetMenu
SetUserObjectInformationA
GetNextDlgTabItem
OemKeyScan
DdeNameService
CopyIcon
CharPrevA
IsDialogMessageW
GetAltTabInfoW
PaintDesktop
DialogBoxIndirectParamA
BlockInput
LoadBitmapW
IsWindowUnicode
IMPGetIMEA
IsMenu
EnumClipboardFormats
EnumPropsExW
GetForegroundWindow
OpenDesktopA
SystemParametersInfoW
GetWindowPlacement
GetWindowContextHelpId
EndDialog
SetMenuItemInfoA
ChangeDisplaySettingsA
BroadcastSystemMessage
GetLastActivePopup
VkKeyScanExW
IsCharUpperW
BringWindowToTop
DrawIconEx
GetActiveWindow
DdeImpersonateClient
InternalGetWindowText
SendMessageTimeoutW
UserHandleGrantAccess
CopyRect
SetClipboardViewer
GetWindowTextLengthW
UpdateLayeredWindow
CallWindowProcA
GetKeyboardLayoutNameW
CharLowerA
GetGuiResources
RegisterDeviceNotificationW
IsWindowEnabled
AppendMenuW
PeekMessageW
SetLayeredWindowAttributes
GetClientRect
SetPropW
IsCharAlphaNumericW
SystemParametersInfoA
UnhookWinEvent
SetMenu
CreatePopupMenu
ShowScrollBar
GetDlgItemTextA
HiliteMenuItem
GetMenuItemInfoW
SwitchDesktop
mouse_event
IsWindowVisible
SetMenuInfo
RegisterWindowMessageA
ToUnicode
DefFrameProcA
SetThreadDesktop
GetMouseMovePointsEx
DestroyAcceleratorTable
PostThreadMessageW
EnumWindows
GetInputDesktop
DlgDirListComboBoxW
wvsprintfA
SetTimer
LookupIconIdFromDirectory
MapVirtualKeyA
DestroyCaret
IsHungAppWindow
CreateDialogIndirectParamA
GetWindowWord
SendInput
UnregisterClassA
GetCaretBlinkTime
DlgDirSelectComboBoxExA

msvcrt

memcpy

comdlg32

ReplaceTextA
ChooseColorW
GetFileTitleW
PageSetupDlgA
CommDlgExtendedError
PrintDlgExA
PageSetupDlgW
ChooseColorA
GetFileTitleA
ChooseFontW
GetSaveFileNameW
GetOpenFileNameA
GetSaveFileNameA
ChooseFontA
FindTextA
ReplaceTextW
FindTextW
PrintDlgW
GetOpenFileNameW
PrintDlgExW
PrintDlgA

advapi32

RegOpenKeyExW

ole32

STGMEDIUM_UserMarshal
CoGetInterfaceAndReleaseStream
CreateItemMoniker
OleLoad
OleCreateDefaultHandler
SetDocumentBitStg
OleBuildVersion
OleConvertIStorageToOLESTREAMEx
OleConvertIStorageToOLESTREAM
CoDeactivateObject
GetConvertStg
RevokeDragDrop
CoRegisterChannelHook
CoQueryProxyBlanket
GetClassFile
CoGetObjectContext
DllDebugObjectRPCHook
OleLoadFromStream
IsEqualGUID
HICON_UserFree
OleSetMenuDescriptor
WdtpInterfacePointer_UserFree
OleCreateMenuDescriptor
CoGetInstanceFromIStorage
HPALETTE_UserUnmarshal
SNB_UserFree
CoDosDateTimeToFileTime
CoGetCallerTID
CoDisconnectObject
OleGetAutoConvert
OleCreateStaticFromData
CoTreatAsClass
CoRegisterMallocSpy
StgCreateDocfileOnILockBytes
CoTestCancel
CoTaskMemRealloc
OleTranslateAccelerator
CoInitializeWOW
PropVariantClear
OleQueryLinkFromData
CreateClassMoniker
CoGetObject
PropStgNameToFmtId
OleUninitialize
CoIsHandlerConnected
HBRUSH_UserUnmarshal
CoFreeUnusedLibraries
CLIPFORMAT_UserSize
OleNoteObjectVisible
OleDoAutoConvert
CoMarshalHresult
ReadStringStream
CreateDataCache
GetHGlobalFromStream
HMETAFILE_UserUnmarshal
HPALETTE_UserMarshal
OleCreateLinkFromData
CoCancelCall
OleRegGetMiscStatus
StringFromIID
CoGetPSClsid
HBITMAP_UserUnmarshal
DllGetClassObjectWOW
StgConvertVariantToProperty
HACCEL_UserUnmarshal
WriteOleStg
OleRun
CoEnableCallCancellation
UtConvertDvtd32toDvtd16
CoRegisterSurrogateEx
CoAddRefServerProcess
CoReleaseMarshalData
CoCreateGuid
HDC_UserFree
WriteClassStg
WdtpInterfacePointer_UserMarshal
HBRUSH_UserFree
CoSuspendClassObjects
HACCEL_UserSize
CoCopyProxy
OleDestroyMenuDescriptor
CoFreeAllLibraries
CoRegisterPSClsid
CLIPFORMAT_UserMarshal
OleRegEnumFormatEtc
CoCreateInstanceEx
CoGetStandardMarshal
CoFileTimeToDosDateTime
OleCreateFromData
CLSIDFromProgID
StringFromCLSID
StgOpenPropStg
HMENU_UserUnmarshal
CoQueryReleaseObject
OleCreate
GetRunningObjectTable
CoFileTimeNow
CoReleaseServerProcess
WriteClassStm
CoSwitchCallContext
SNB_UserUnmarshal
CoGetCurrentProcess
CoInstall
StgConvertPropertyToVariant
HMETAFILE_UserMarshal
OleCreateLinkFromDataEx
CoLoadLibrary
OleGetClipboard
CoGetMalloc
HGLOBAL_UserMarshal
HBITMAP_UserFree
OleInitialize
CreateBindCtx
CoInitialize
HWND_UserSize
CoRegisterMessageFilter
CreateObjrefMoniker
OpenOrCreateStream
StgCreateStorageEx
CLIPFORMAT_UserFree
HPALETTE_UserFree
HDC_UserSize
PropVariantCopy
OleIsRunning
HMETAFILE_UserSize
CoInitializeEx
GetHookInterface
ReadOleStg
OleGetIconOfClass
HGLOBAL_UserUnmarshal
CoGetApartmentID
CreatePointerMoniker
StgOpenStorageOnILockBytes
MonikerRelativePathTo
UtGetDvtd16Info
HBITMAP_UserMarshal
CoGetCallContext

oleaut32

VarUI2FromI4
SafeArrayCreateVectorEx
VarCyFromUI2
VarFormatPercent
VarDecFromCy
VarCyFromI4
VarI1FromUI1
VarR4FromR8
SafeArrayGetElemsize
VarDecFromDisp
VarNumFromParseNum
LPSAFEARRAY_UserSize
VarR4FromI1
LPSAFEARRAY_UserUnmarshal
VarUI4FromUI2
VarDateFromUI2
DispInvoke
VarMod
VarWeekdayName
VarUI1FromR8
RegisterTypeLi
SafeArrayCreateEx
VarI2FromDec
VarUI1FromI1
VarUI1FromI4
VarI2FromUI1
BSTR_UserSize
VarInt
BSTR_UserUnmarshal
VarDateFromI1
VarR8FromR4
VarCyFix
VarCyMulI4
VarUI1FromStr
VarI4FromUI4
VarI2FromR8
VarBstrFromUI1
VarBstrFromUI2
SafeArrayAccessData
VarDateFromStr
VarSu
OleLoadPictureFile
VarCyAbs
VarDateFromDec
VARIANT_UserMarshal
BSTR_UserMarshal
VarR8FromUI4
SafeArraySetIID
OleLoadPictureFileEx
VarI4FromR8
VarI4FromUI2
VariantTimeToDosDateTime
SafeArrayPutElement
VarR8Pow
GetErrorInfo
VarUI1FromCy
VarR4FromUI4
VARIANT_UserFree
CreateDispTypeInfo
VarCat
VarDecFix
VariantChangeTypeEx
VarUI4FromI1
VarDecInt
VariantInit
VarUI4FromDisp
VarFormat
ClearCustData
VarI1FromI4
VarI1FromUI2
VarCyInt
SafeArrayGetRecordInfo
VarCyFromI2
SysFreeString
VariantCopy
VarUI2FromI1
VarUI1FromDec
VarUI4FromStr
VarI4FromUI1
VariantClear
GetActiveObject
VarBstrFromI2
VarUI4FromUI1
VarCyMul
RegisterActiveObject
VarNot
VarUI4FromI4
VectorFromBstr
LPSAFEARRAY_Unmarshal
SafeArrayCopyData
VarDiv
VarDecFromI1
VarDecCmpR8
VarDateFromR8
VarUI2FromStr
VarR8FromUI2
VarFormatCurrency
VarDecFromUI1
OleLoadPicturePath
VarCyAdd
BSTR_UserFree
VarBoolFromUI4
VarBstrCat
VarCyFromDate
VarCyFromBool
VarUI4FromR4
VarI2FromI1
BstrFromVector
VarR8FromDate
VarR8FromDisp
VarUI1FromUI4
VarBoolFromI4
VarDateFromUdate
VarDecFromR4
VarI4FromBool
VarTokenizeFormatString
VarUI1FromDate
VarDateFromCy
VarI1FromBool
VarR4FromStr
VarI1FromR4
VarI1FromCy
VarDateFromUI1
VarUI1FromUI2
VarUI2FromBool
GetAltMonthNames
VarUdateFromDate
VarR8FromI1
SafeArrayAllocDescriptor
VarUI1FromBool
VarBstrFromDate
OleTranslateColor
VarBoolFromDate
VarI2FromDate
VarUI4FromCy
VarUI2FromI2
VarCyRound
VarDateFromUI4
VarBoolFromUI2
VarDecFromBool
VarI1FromDec
VarFix
VarI4FromDec
LPSAFEARRAY_UserMarshal
VarNeg
SafeArrayCreateVector
VarUI1FromDisp
SysReAllocStringLen
VarDateFromR4
VarCyFromR4
VarI1FromStr
VarUI2FromR4

comctl32

ord16
ImageList_GetIconSize
GetMUILanguage
FlatSB_GetScrollProp
_TrackMouseEvent
ImageList_Draw
ImageList_Remove
DestroyPropertySheetPage
FlatSB_GetScrollPos
ImageList_SetDragCursorImage
FlatSB_SetScrollRange
FlatSB_ShowScrollBar
CreateToolbarEx
ord6
ord2
ImageList_Duplicate
ImageList_SetBkColor
ImageList_Read
FlatSB_GetScrollInfo
ImageList_Replace
ord5
ImageList_SetOverlayImage
CreatePropertySheetPageA
FlatSB_SetScrollProp
ImageList_Copy
CreatePropertySheetPageW
UninitializeFlatSB
ImageList_DrawEx
ImageList_GetDragImage
CreateStatusWindowW
DrawStatusTextW
ord7
ImageList_GetBkColor
FlatSB_SetScrollPos
ImageList_DrawIndirect
FlatSB_EnableScrollBar
ImageList_SetImageCount
PropertySheetA
ImageList_DragMove
ord3
InitializeFlatSB
ImageList_DragLeave
CreateStatusWindow
ImageList_AddIcon
ImageList_LoadImageA
ord15
ImageList_Merge
ImageList_DragShowNolock
ImageList_EndDrag
PropertySheet
ord14
ImageList_DragEnter
CreatePropertySheetPage
FlatSB_SetScrollInfo
ImageList_LoadImageW
ImageList_GetImageRect
InitMUILanguage
PropertySheetW
ord4
ImageList_ReplaceIcon
ord13
ImageList_AddMasked
ImageList_Write
ImageList_SetFilter
ImageList_SetIconSize
ImageList_BeginDrag
InitCommonControlsEx
ImageList_Create
ImageList_GetIcon
ImageList_GetImageInfo

Sections

.text
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.g7
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.g6
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.g5
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.g4
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.g3
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.g2
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

559f218add207bd09e3c0df043e9b905

Code Sign

26:f7:53:e5:9e:63:45:bf:43:4a:26:b1:54:15:64:bdCertificate

Extended Key Usages

4e:12:4f:6c:b9:98:42:fa:85:18:1a:f5:0a:d7:98:f6:ec:5c:f5:38Signer

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

comdlg32

advapi32

ole32

oleaut32

comctl32

Sections

.text Size: 267KB - Virtual size: 267KB

.data Size: 17KB - Virtual size: 17KB

.g7 Size: 1024B - Virtual size: 1000B

.g6 Size: 1024B - Virtual size: 1000B

.g5 Size: 1024B - Virtual size: 1000B

.g4 Size: 1024B - Virtual size: 1000B

.g3 Size: 1024B - Virtual size: 1000B

.g2 Size: 1024B - Virtual size: 1000B

.reloc Size: 4KB - Virtual size: 3KB

26:f7:53:e5:9e:63:45:bf:43:4a:26:b1:54:15:64:bd
Certificate

4e:12:4f:6c:b9:98:42:fa:85:18:1a:f5:0a:d7:98:f6:ec:5c:f5:38
Signer

.text
Size: 267KB - Virtual size: 267KB

.data
Size: 17KB - Virtual size: 17KB

.g7
Size: 1024B - Virtual size: 1000B

.g6
Size: 1024B - Virtual size: 1000B

.g5
Size: 1024B - Virtual size: 1000B

.g4
Size: 1024B - Virtual size: 1000B

.g3
Size: 1024B - Virtual size: 1000B

.g2
Size: 1024B - Virtual size: 1000B

.reloc
Size: 4KB - Virtual size: 3KB