6502250ba079b3b862ab053e68c6f379

Sharing

Copy URL Twitter E-mail

General

Target

6502250ba079b3b862ab053e68c6f379
Size

818KB
MD5

6502250ba079b3b862ab053e68c6f379
SHA1

5667dda2f016a14949d6a9643c3da427ad8d614f
SHA256

2903691f5c9a94d95988633be0c8866fca4062b2deb084ab6f80e5165c7e4e59
SHA512

7fd05cfc2b87845a13c185bb89360c6e930a53ecf2acec6b11455762043b223a8ef3754434c3b55a3d9f940a4cab001a2da22604795df35434f5cf338f7dc137
SSDEEP

24576:8a96tfReJhDm3XIPK7AgyaboxEV22FU/LNSDdy1:8dfRYgV9EU2uFDq

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fonttxt2411/dll/About11.dll
unpack001/fonttxt2411/dll/Advp.dll
unpack001/fonttxt2411/dll/mhook.dll
unpack001/fonttxt2411/fonttext.exe

Files

6502250ba079b3b862ab053e68c6f379
.rar
fonttxt2411/dll/About11.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

InitAboutForm
ShowAboutForm

Sections

CODE
Size: 692KB - Virtual size: 691KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 7KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
fonttxt2411/dll/Advp.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

LoadAP

Sections

CODE
Size: 398KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
fonttxt2411/dll/mhook.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DisableHook
EnableHook
GetHostHwnd

Sections

CODE
Size: 303KB - Virtual size: 302KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 115B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
fonttxt2411/fonttext.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 8KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 495KB - Virtual size: 495KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
fonttxt2411/help/fonttxt.mht
.eml
- http://otot.w2.icgaya.com/drawtxt/drawtxt.htm
attachment-2
.gif
email-html-1.txt
.html
fonttxt2411/support/Fonttxt.ini
fonttxt2411/support/FonttxtReadme.mht
.eml
- http://otot.w2.icgaya.com/
- http://hi.baidu.com/drawtxt/blog/item/77f718458954b03c869473b0.html
attachment-2
.gif
email-html-1.txt
.html
fonttxt2411/support/QQ.dll
fonttxt2411/support/pen.txt
fonttxt2411/新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 692KB - Virtual size: 691KB

DATA Size: 9KB - Virtual size: 8KB

BSS Size: - Virtual size: 7KB

.idata Size: 9KB - Virtual size: 9KB

.edata Size: 512B - Virtual size: 100B

.reloc Size: 41KB - Virtual size: 40KB

.rsrc Size: 80KB - Virtual size: 80KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 398KB - Virtual size: 397KB

DATA Size: 5KB - Virtual size: 4KB

BSS Size: - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 9KB

.edata Size: 512B - Virtual size: 66B

.reloc Size: 28KB - Virtual size: 28KB

.rsrc Size: 23KB - Virtual size: 23KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 303KB - Virtual size: 302KB

DATA Size: 4KB - Virtual size: 4KB

BSS Size: - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 7KB

.edata Size: 512B - Virtual size: 115B

.reloc Size: 21KB - Virtual size: 21KB

.rsrc Size: 19KB - Virtual size: 19KB

Headers

File Characteristics

Sections

CODE Size: 1.1MB - Virtual size: 1.1MB

DATA Size: 12KB - Virtual size: 12KB

BSS Size: - Virtual size: 8KB

.idata Size: 11KB - Virtual size: 11KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 62KB - Virtual size: 61KB

.rsrc Size: 495KB - Virtual size: 495KB

CODE
Size: 692KB - Virtual size: 691KB

DATA
Size: 9KB - Virtual size: 8KB

BSS
Size: - Virtual size: 7KB

.idata
Size: 9KB - Virtual size: 9KB

.edata
Size: 512B - Virtual size: 100B

.reloc
Size: 41KB - Virtual size: 40KB

.rsrc
Size: 80KB - Virtual size: 80KB

CODE
Size: 398KB - Virtual size: 397KB

DATA
Size: 5KB - Virtual size: 4KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 9KB

.edata
Size: 512B - Virtual size: 66B

.reloc
Size: 28KB - Virtual size: 28KB

.rsrc
Size: 23KB - Virtual size: 23KB

CODE
Size: 303KB - Virtual size: 302KB

DATA
Size: 4KB - Virtual size: 4KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 7KB

.edata
Size: 512B - Virtual size: 115B

.reloc
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 19KB - Virtual size: 19KB

CODE
Size: 1.1MB - Virtual size: 1.1MB

DATA
Size: 12KB - Virtual size: 12KB

BSS
Size: - Virtual size: 8KB

.idata
Size: 11KB - Virtual size: 11KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 62KB - Virtual size: 61KB

.rsrc
Size: 495KB - Virtual size: 495KB