282eb7e6b92261d63713b44cd49a022b

Sharing

Copy URL

Twitter E-mail

General

Target

282eb7e6b92261d63713b44cd49a022b
Size

423KB
MD5

282eb7e6b92261d63713b44cd49a022b
SHA1

ad347f5ff2b909a616baf618ad8a08b23cb561a9
SHA256

54f2ba03e0e341cb547e35e293ceb05c89488f8c47fa7a4e5539fcff9084b6b2
SHA512

55a1a21dd548f4dc2c016f94972c1b9ba13b7708b20ddd90265c0e41b3b74fd1204cf88974da17c2c7283c8b0c0987d69ae4e7ae7737407c9afcdf592812d3be
SSDEEP

12288:uPedKhZPMtTVQkVX7fo+VpsZDoGLIUsmm3WmcRpG:yRhI+F+D6DF14Wmq

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CCProxy.exe
unpack001/CDial.dll
unpack001/unins000.exe
unpack001/uuid.dll

Files

282eb7e6b92261d63713b44cd49a022b
.rar
AccInfo.ini
CCProxy.exe
.exe windows:4 windows x86 arch:x86

e28ea970c42dbd9419e2664a3c68fcac

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

recvfrom
WSAAccept
WSAConnect
WSARecvFrom
sendto
setsockopt
WSARecv
WSASend
select
__WSAFDIsSet
listen
WSASocketA
WSAGetLastError
htons
bind
socket
getsockname
gethostbyname
WSASendTo
inet_ntoa
shutdown
connect
closesocket
ntohl
inet_addr
ntohs
htonl
getservbyname
gethostbyaddr
getservbyport
recv
send

kernel32

GetVolumeInformationA
GetFullPathNameA
GetThreadLocale
GetFileAttributesA
GetFileTime
RtlUnwind
RaiseException
GetDriveTypeA
GetStartupInfoA
GetCommandLineA
ExitProcess
GetACP
TerminateProcess
HeapReAlloc
HeapSize
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
DuplicateHandle
GetCurrentDirectoryA
GetOEMCP
GetCPInfo
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
SizeofResource
GlobalFlags
WaitForSingleObject
GlobalAlloc
lstrcmpA
GetCurrentThread
lstrcpynA
MulDiv
SetLastError
FormatMessageA
FileTimeToLocalFileTime
WideCharToMultiByte
InterlockedIncrement
GetVersion
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalDeleteAtom
GetModuleHandleA
GlobalLock
GlobalUnlock
GlobalFree
LockResource
FindResourceA
LoadResource
LocalAlloc
LocalFree
HeapAlloc
HeapFree
MultiByteToWideChar
RemoveDirectoryA
CreateEventA
SetEvent
WriteFile
GetTimeZoneInformation
FindFirstFileA
FindNextFileA
FindClose
lstrcatA
lstrlenA
WinExec
TerminateThread
GetModuleFileNameA
CreateFileA
GetFileSize
ReadFile
FileTimeToSystemTime
GetComputerNameA
GetLastError
SleepEx
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetCurrentProcess
DeleteFileA
lstrcpyA
GetTickCount
GlobalAddAtomA
GlobalFindAtomA
GetLocalTime
CreateDirectoryA
CreateThread
CloseHandle
GetWindowsDirectoryA
GetPrivateProfileIntA
DeleteCriticalSection
InitializeCriticalSection
GetLocaleInfoA
Sleep
CreateMailslotA
GetSystemTime
InterlockedDecrement
CopyFileA
EnterCriticalSection
LeaveCriticalSection
WritePrivateProfileStringA
GetPrivateProfileStringA
GetProfileStringA
SetErrorMode

user32

CharNextA
CopyAcceleratorTableA
SetRect
GetNextDlgGroupItem
RegisterClipboardFormatA
PostThreadMessageA
ValidateRect
MapDialogRect
GetAsyncKeyState
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
wvsprintfA
GetMenuCheckMarkDimensions
GetMenuState
SetMenuItemBitmaps
EnableMenuItem
MoveWindow
IsDialogMessageA
SendDlgItemMessageA
MapWindowPoints
PeekMessageA
DispatchMessageA
GetFocus
SetFocus
AdjustWindowRectEx
CopyRect
IsWindowVisible
GetTopWindow
MessageBoxA
IsChild
GetCapture
WinHelpA
GetClassInfoA
CharUpperA
TrackPopupMenu
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetMessageA
UnhookWindowsHookEx
CallWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetWindowPos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetNextDlgTabItem
EndDialog
GetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
RegisterClassExA
GetMenuItemCount
GetMenuStringA
GetMenuItemID
ModifyMenuA
LoadStringA
LoadBitmapA
UpdateWindow
PostQuitMessage
FillRect
DefWindowProcA
RegisterClassA
LoadCursorA
CopyIcon
GetDC
ReleaseDC
InflateRect
GetSysColor
InvalidateRect
SetCursor
ReleaseCapture
RedrawWindow
SetCapture
MessageBeep
GetWindow
GetDesktopWindow
GetClassNameA
SetActiveWindow
GetPropA
SetWindowLongA
RemovePropA
GetWindowThreadProcessId
EnumThreadWindows
ExitWindowsEx
ScreenToClient
LoadMenuA
GetSubMenu
CheckMenuItem
GetCursorPos
RegisterHotKey
UnregisterHotKey
DrawIcon
GetSystemMenu
AppendMenuA
LoadIconA
GetSysColorBrush
WindowFromPoint
DestroyMenu
SetWindowContextHelpId
GetMenu
LoadImageA
IsIconic
ShowWindow
SetForegroundWindow
GetLastActivePopup
SetWindowTextA
wsprintfA
PostMessageA
FindWindowA
GetSystemMetrics
RegisterWindowMessageA
SetTimer
IsWindow
GetWindowRect
GetClientRect
PtInRect
GetKeyState
EnableWindow
GetParent
SendMessageA
SetPropA
TranslateMessage
IsWindowUnicode
DefDlgProcA
DrawFocusRect
ExcludeUpdateRgn
ShowCaret
HideCaret
UnregisterClassA
OffsetRect

gdi32

CreateSolidBrush
CreateHatchBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetMapMode
GetTextColor
GetBkColor
LPtoDP
LineTo
MoveToEx
CreatePen
GetWindowExtEx
GetViewportExtEx
GetDeviceCaps
DeleteObject
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetBkMode
RestoreDC
SaveDC
DeleteDC
PatBlt
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetTextExtentPointA
CreateDIBitmap
GetTextExtentPoint32A
GetObjectA
CreateFontIndirectA
DPtoLP
GetStockObject
IntersectClipRect
ScaleWindowExtEx
SetWindowExtEx

comdlg32

GetFileTitleA
GetOpenFileNameA
GetSaveFileNameA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegQueryValueA
RegOpenKeyExA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
DeleteService
QueryServiceStatus
ControlService
RegCreateKeyExA
AdjustTokenPrivileges
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegDeleteValueA
StartServiceA
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
SetServiceStatus
OpenServiceA

shell32

Shell_NotifyIconA
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteA

comctl32

ord17
ImageList_Destroy
PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA

oledlg

ord8

ole32

CoTaskMemAlloc
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoCreateInstance
CoUninitialize
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize

olepro32

ord253

oleaut32

VariantChangeType
SysAllocString
VariantCopy
VariantClear
VariantTimeToSystemTime
SysStringLen
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysFreeString

wininet

InternetOpenUrlA
GetUrlCacheEntryInfoA
HttpQueryInfoA
InternetCloseHandle
InternetReadFile
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetOpenA

iphlpapi

_PfCreateInterface@24
_PfBindInterfaceToIPAddress@12
_PfAddFiltersToInterface@24
_PfDeleteInterface@4
GetIfTable
GetIpNetTable

wsock32

WSAStartup
WSACleanup

rpcrt4

UuidCreate

Sections

.text
Size: 404KB - Virtual size: 401KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CCProxy.ini
CDial.dll
.dll windows:4 windows x86 arch:x86

faba71898d5754d51096d297353a53bb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

wsprintfA

rasapi32

RasEnumDevicesA
RasSetEntryPropertiesA
RasDialA
RasEnumEntriesA
RasGetErrorStringA
RasHangUpA
RasEnumConnectionsA

kernel32

HeapCreate
HeapDestroy
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
VirtualFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind

Exports

Exports

DialUp
DialUpNew
GetRasEntryNameList
HangUp
IsDialConnected

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Language/ChineseGB.chm
.chm
Language/ChineseGB.ini
Language/English.chm
.chm
Language/English.ini
Log/log20050915.txt
Log/log20050916.txt
Log/log20050923.txt
unins000.dat
unins000.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
uuid.dll
.dll windows:4 windows x86 arch:x86

74dd6eba3edd933c5ceeae5685fddb84

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

CoUninitialize
CoInitialize

rpcrt4

UuidCreateSequential

kernel32

VirtualAlloc
ReadFile
IsBadCodePtr
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FlushFileBuffers
GetStringTypeW
IsBadWritePtr
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetStdHandle
Sleep
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
SetUnhandledExceptionFilter
IsBadReadPtr
RtlUnwind
CloseHandle
InterlockedExchange
RaiseException

Exports

Exports

UUID2K

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
web/_acclist2.htm
.js
web/accadd.htm
.js
web/accheader.htm
.html
web/acclist.htm
.js
web/acclist2.htm
.js
web/account.htm
.html
web/index.html
.html
web/list.htm
.html
web/log.htm
.html
web/proxyadmin.php
web/settings.htm
.html .js polyglot

Sharing

General

Malware Config

Signatures

Files

e28ea970c42dbd9419e2664a3c68fcac

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

wininet

iphlpapi

wsock32

rpcrt4

Sections

.text Size: 404KB - Virtual size: 401KB

.rdata Size: 68KB - Virtual size: 65KB

.data Size: 28KB - Virtual size: 232KB

.rsrc Size: 184KB - Virtual size: 183KB

faba71898d5754d51096d297353a53bb

Headers

File Characteristics

Imports

user32

rasapi32

kernel32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 14KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 2KB

Headers

File Characteristics

Sections

CODE Size: 46KB - Virtual size: 46KB

DATA Size: 1024B - Virtual size: 628B

BSS Size: - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 3KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 7KB - Virtual size: 7KB

74dd6eba3edd933c5ceeae5685fddb84

Headers

File Characteristics

Imports

ole32

rpcrt4

kernel32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 8KB - Virtual size: 11KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 404KB - Virtual size: 401KB

.rdata
Size: 68KB - Virtual size: 65KB

.data
Size: 28KB - Virtual size: 232KB

.rsrc
Size: 184KB - Virtual size: 183KB

.text
Size: 16KB - Virtual size: 14KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 2KB

CODE
Size: 46KB - Virtual size: 46KB

DATA
Size: 1024B - Virtual size: 628B

BSS
Size: - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 3KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 7KB - Virtual size: 7KB

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 8KB - Virtual size: 11KB

.reloc
Size: 8KB - Virtual size: 5KB