776b259704b38f7a36280a9a8021c7ad

Sharing

Copy URL Twitter E-mail

General

Target

776b259704b38f7a36280a9a8021c7ad
Size

460KB
MD5

776b259704b38f7a36280a9a8021c7ad
SHA1

388914d6d6c77fdc44371aa7400205a3092c4e90
SHA256

e1980dcf9775a6648db157efd7b687762db489b22b4d8dbcbe5282913f1c4d18
SHA512

d9580d621f204edc6ee50908421c88665ea36134478123b7e867016c523da543cefc6f51ebcbbc90a862c6aba92ef9413e61ac99c79d5e609f9ab5a19ebf25d6
SSDEEP

6144:zqGeehZUjPSmf2S/l4CaJlH8vyS4QOepByPNQPC+hl7/jDY9SQHErKAyANPvAkx/:z4eafl4CaL8vmcByPNQa+rXk4DkLm

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/jiajiawarhelper/ManaBars.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/jiajiawarhelper/ManaBars.dll	upx
static1/unpack001/jiajiawarhelper/WarMpqPlug.exe	upx

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/jiajiawarhelper/ManaBars.dll
unpack002/out.upx
unpack001/jiajiawarhelper/SFmpq.dll
unpack001/jiajiawarhelper/SW3GLib.dll
unpack001/jiajiawarhelper/UpData.exe
unpack001/jiajiawarhelper/WarMpqPlug.exe
unpack003/out.upx
unpack001/jiajiawarhelper/Ӽ.exe

Files

776b259704b38f7a36280a9a8021c7ad
.zip
jiajiawarhelper/Chat/DOTA.txt
jiajiawarhelper/Chat/κ3C.txt
jiajiawarhelper/Chat/Ц.txt
jiajiawarhelper/Chat/ؼ1.txt
jiajiawarhelper/Chat/ؼ2.txt
jiajiawarhelper/Chat/RPG.txt
jiajiawarhelper/Chat/ų.txt
jiajiawarhelper/Chat/.txt
jiajiawarhelper/KeyDim/Dota/Dota ļ˵.txt
jiajiawarhelper/KeyDim/Dota/ĺɫ/ɳ - Crixalis.ini
jiajiawarhelper/KeyDim/Dota/ĺɫ/ʹ֮Դ - Atropos.ini
jiajiawarhelper/KeyDim/Dota/ĺɫ/Ѫħ - Strygwyr.ini
jiajiawarhelper/KeyDim/Dota/ĺɫ/Ӱħ - Nevermore.ini
jiajiawarhelper/KeyDim/Dota/ĺɫ/ϫ - Leviathan.ini
jiajiawarhelper/KeyDim/Dota/ĺɫ/Ѩ֯ - Anub`seran.ini
jiajiawarhelper/KeyDim/Dota/ĺɫ/ - Abaddon.ini
jiajiawarhelper/KeyDim/Dota/ĺɫ/ - Mogul Kahn.ini
jiajiawarhelper/KeyDim/Dota/ĺɫ/ѻ - Barathrum.ini
jiajiawarhelper/KeyDim/Dota/ĺɫ/鷨ʦ - Rotund`jere.ini
jiajiawarhelper/KeyDim/Dota/ĺɫ/ - Pudge.ini
jiajiawarhelper/KeyDim/Dota/ĺɫ/ʦ - Pugna.ini
jiajiawarhelper/KeyDim/Dota/ƻ/Ӱʦ - Dazzle.ini
jiajiawarhelper/KeyDim/Dota/ƻ/ʬ - Dirge.ini
jiajiawarhelper/KeyDim/Dota/ƻ/ - Keal.ini
jiajiawarhelper/KeyDim/Dota/ƻ/زʦ - Meepo.ini
jiajiawarhelper/KeyDim/Dota/ƻ/ڰ - Ish'kafel.ini
jiajiawarhelper/KeyDim/Dota/ƻ/׻ - Harbinger.ini
jiajiawarhelper/KeyDim/Dota/ƻ/Ԩ - Azgalor.ini
jiajiawarhelper/KeyDim/Dota/ƻ/ʿ - Demnok Lannik.ini
jiajiawarhelper/KeyDim/Dota/ƻ/ҽ - Vol'jin.ini
jiajiawarhelper/KeyDim/Dota/ƻ/Ĺ - Mercurial.ini
jiajiawarhelper/KeyDim/Dota//ʥô̿ - Lunaya.ini
jiajiawarhelper/KeyDim/Dota//˫ͷ - Jakiro.ini
jiajiawarhelper/KeyDim/Dota//籩֮ - Raijin Thunderkeg.ini
jiajiawarhelper/KeyDim/Dota//ʿ - Razzil Darkbrew.ini
jiajiawarhelper/KeyDim/Dota//ʿ - Huskar.ini
jiajiawarhelper/KeyDim/Dota// - Rexxar.ini
jiajiawarhelper/KeyDim/Dota//Ů - Puck.ini
jiajiawarhelper/KeyDim/Dota//֮Ů˾ - Mirana Nightshade.ini
jiajiawarhelper/KeyDim/Dota//ĩʹ - Lucifer.ini
jiajiawarhelper/KeyDim/Dota//ʳʬ - N`aix.ini
jiajiawarhelper/KeyDim/Dota//ʹŮ - Akasha.ini
jiajiawarhelper/KeyDim/Dota//ڤ - Viper.ini
jiajiawarhelper/KeyDim/Dota//ҹħ - Balanar.ini
jiajiawarhelper/KeyDim/Dota//Ѩ̿ - Anub`arak.ini
jiajiawarhelper/KeyDim/Dota//߷Ů - Medusa.ini
jiajiawarhelper/KeyDim/Dota//Ļ - Razor.ini
jiajiawarhelper/KeyDim/Dota//ռ - Darkterror.ini
jiajiawarhelper/KeyDim/Dota// - Slardar.ini
jiajiawarhelper/KeyDim/Dota// - Bone Clinkz.ini
jiajiawarhelper/KeyDim/Dota// - King Leoric.ini
jiajiawarhelper/KeyDim/Dota/峿/ˮŮ - Rylai Crestfall.ini
jiajiawarhelper/KeyDim/Dota/峿/徫 - Morphling.ini
jiajiawarhelper/KeyDim/Dota/峿/³ - Syllabear.ini
jiajiawarhelper/KeyDim/Dota/峿/֮ - Shandelzare Silkwood.ini
jiajiawarhelper/KeyDim/Dota/峿/ţ - Raigor Stonehoof.ini
jiajiawarhelper/KeyDim/Dota/峿/ʥ - Yurnero.ini
jiajiawarhelper/KeyDim/Dota/峿/˽ - Sven.ini
jiajiawarhelper/KeyDim/Dota/峿/Ⱥ - Slithice.ini
jiajiawarhelper/KeyDim/Dota/峿/㶺ħʦ - Lina Inverse.ini
jiajiawarhelper/KeyDim/Dota/峿/δ̿ - Rikimaru.ini
jiajiawarhelper/KeyDim/Dota/峿/֮ - Zeus.ini
jiajiawarhelper/KeyDim/Dota/峿/ȻħŮ - Aiushtha.ini
jiajiawarhelper/KeyDim/Dota//ȫʿ - Purist Thunderwrath.ini
jiajiawarhelper/KeyDim/Dota//˾ѻ - Kardel Sharpeye.ini
jiajiawarhelper/KeyDim/Dota//Ӱ - Rhasta.ini
jiajiawarhelper/KeyDim/Dota// - Bradwarden.ini
jiajiawarhelper/KeyDim/Dota//зʦ - Magina.ini
jiajiawarhelper/KeyDim/Dota//ձ - Rigwarl.ini
jiajiawarhelper/KeyDim/Dota//ڰ - Traxex.ini
jiajiawarhelper/KeyDim/Dota//ħս - Jah`rakal.ini
jiajiawarhelper/KeyDim/Dota//ʿ - Knight Davion.ini
jiajiawarhelper/KeyDim/Dota//ͽ - Gondar.ini
jiajiawarhelper/KeyDim/Dota//è - Mangix.ini
jiajiawarhelper/KeyDim/Dota//֮ʿ - Luna Moonfang.ini
jiajiawarhelper/KeyDim/Dota/ҹ/ - Magnus.ini
jiajiawarhelper/KeyDim/Dota/ҹ/ħʦ - Lion.ini
jiajiawarhelper/KeyDim/Dota/ҹ/Ӱ̿ - Mortred.ini
jiajiawarhelper/KeyDim/Dota/ҹ/ʿ - Nessaj.ini
jiajiawarhelper/KeyDim/Dota/ҹ/綾ʿ - Lesale Deathbringer.ini
jiajiawarhelper/KeyDim/Dota/ҹ/ - Banehallow.ini
jiajiawarhelper/KeyDim/Dota/ҹ/ - Terrorblade.ini
jiajiawarhelper/KeyDim/Dota/ҹ/ĥ - Leshrac the Malicious.ini
jiajiawarhelper/KeyDim/Dota/ҹ/ - Visage.ini
jiajiawarhelper/KeyDim/Dota/ҹ/֪ - Krobelus.ini
jiajiawarhelper/KeyDim/Dota/ҹ/ - Kel'Thuzad.ini
jiajiawarhelper/KeyDim/Dota/ҹ/ĸ֩ - Black Arachnia.ini
jiajiawarhelper/KeyDim/Dota//ɽ - Tiny.ini
jiajiawarhelper/KeyDim/Dota//ʥʿ - Chen.ini
jiajiawarhelper/KeyDim/Dota//ʳħħʦ - Aggron Stonebreaker.ini
jiajiawarhelper/KeyDim/Dota//Ĭʿ - Nortrom.ini
jiajiawarhelper/KeyDim/Dota//粼ֹʦ - Squee and Spleen.ini
jiajiawarhelper/KeyDim/Dota//֮ - Ezalor.ini
jiajiawarhelper/KeyDim/Dota//Ӱì - Azwraith.ini
jiajiawarhelper/KeyDim/Dota// - Darchrow.ini
jiajiawarhelper/KeyDim/Dota//ʿ - Rooftrellen.ini
jiajiawarhelper/KeyDim/Dota//֪ - Furion.ini
jiajiawarhelper/KeyDim/Dota//޲ - Boush.ini
jiajiawarhelper/KeyDim/Dota//սʿ - Ulfsaar.ini
jiajiawarhelper/KeyDim/ħͨ.ini
jiajiawarhelper/KeyDim/κ3C - ţͷ.ini
jiajiawarhelper/KeyDim/κ3C - .ini
jiajiawarhelper/KeyDim/ն.ini
jiajiawarhelper/KeyDim/ɷɱ.ini
jiajiawarhelper/KeyDim/ų֮Ұ.ini
jiajiawarhelper/KeyDim/3 - ŷ.ini
jiajiawarhelper/ManaBars.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

UPX0
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
jiajiawarhelper/SFmpq.dll
.dll windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Exports

Exports

DStormDestroy
MpqAddFileFromBuffer
MpqAddFileFromBufferEx
MpqAddFileToArchive
MpqAddFileToArchiveEx
MpqAddWaveFromBuffer
MpqAddWaveToArchive
MpqCloseUpdatedArchive
MpqCompactArchive
MpqDeleteFile
MpqGetVersion
MpqGetVersionString
MpqInitialize
MpqOpenArchiveForUpdate
MpqRenameFile
MpqSetFileLocale
SFCloseArchive
SFCloseFile
SFDCloseArchive
SFDCloseFile
SFDDestroy
SFDGetArchiveName
SFDGetBasePath
SFDGetFileArchive
SFDGetFileName
SFDGetFileSize
SFDOpenArchive
SFDOpenFile
SFDOpenFileEx
SFDReadFile
SFDSetBasePath
SFDSetFilePointer
SFDSetLocale
SFGetFileSize
SFMpqCompareVersion
SFMpqDestroy
SFMpqGetVersion
SFMpqGetVersionString
SFMpqGetVersionString2
SFOpenArchive
SFOpenFile
SFOpenFileEx
SFReadFile
SFSetFilePointer
SFSetLocale
SFileCloseArchive
SFileCloseFile
SFileDestroy
SFileFindMpqHeader
SFileGetArchiveName
SFileGetBasePath
SFileGetFileArchive
SFileGetFileInfo
SFileGetFileName
SFileGetFileSize
SFileListFiles
SFileOpenArchive
SFileOpenFile
SFileOpenFileEx
SFileReadFile
SFileSetArchivePriority
SFileSetBasePath
SFileSetFilePointer
SFileSetLocale
StormDestroy

Sections

.text
Size: 59KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jiajiawarhelper/SW3GLib.dll
.dll windows:5 windows x86 arch:x86

348b62bb5cd5f75c2f868949522b56ec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

UnmapViewOfFile
CloseHandle
MapViewOfFile
CreateFileMappingA
GetFileSize
GetLastError
CreateFileW
MultiByteToWideChar
lstrlenA
RtlUnwind
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
RaiseException
HeapFree
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapSize
VirtualAlloc
HeapReAlloc
WriteFile
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

SwlCloseReplayFile
SwlLoadReplayFile
SwlParseReplayFile
SwlQueryInformationChatLogs
SwlQueryInformationPlayer
SwlQueryReplayInformation

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
jiajiawarhelper/UpData.exe
.exe windows:4 windows x86 arch:x86

797e75375eb633dd3ffdc97c47f78949

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord517
ord518
ord519
ord595
ord598
ord520
ord709
ord631
ord526
EVENT_SINK_AddRef
ord527
ord528
ord529
DllFunctionCall
ord670
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord606
ord608
ord717
ProcCallEngine
ord644
ord537
ord645
ord570
ord648
ord572
ord573
ord681
ord685
ord578
ord100
ord616
ord617
ord618
ord619
ord580

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
jiajiawarhelper/WH_Set.ini
jiajiawarhelper/WarMpqPlug.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 124KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
jiajiawarhelper/Ӽ.exe
.exe windows:4 windows x86 arch:x86

0bf37555b790fbefd247a663474ddcc6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaVarTstGt
__vbaStrI2
__vbaNextEachAry
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
ord588
__vbaLateIdCall
__vbaLenBstr
__vbaStrVarMove
ord696
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaRaiseEvent
__vbaFreeObjList
__vbaR8Sgn
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
ord518
__vbaRecAnsiToUni
ord519
__vbaResume
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
ord660
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
ord662
__vbaNameFile
ord557
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
ord591
ord592
__vbaForEachCollObj
__vbaStrBool
__vbaExitProc
__vbaBoolStr
__vbaFileCloseAll
__vbaObjSet
__vbaOnError
ord595
ord596
_adj_fdiv_m16i
__vbaObjSetAddref
ord702
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaFpR4
ord599
__vbaStrFixstr
__vbaBoolVar
ord520
__vbaStrTextCmp
__vbaRefVarAry
__vbaFpR8
__vbaBoolVarNull
_CIsin
__vbaErase
ord709
ord631
__vbaNextEachCollObj
ord525
ord632
__vbaChkstk
ord526
EVENT_SINK_AddRef
ord527
ord528
__vbaStrCmp
ord529
__vbaVarTstEq
__vbaAryConstruct2
__vbaPrintObj
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
__vbaVarOr
__vbaCastObjVar
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaStrR8
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
_CIsqrt
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaStr2Vec
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord712
ord606
__vbaDateStr
_adj_fprem
_adj_fdivr_m64
ord714
__vbaR8ErrVar
__vbaFailedFriend
__vbaI2Str
ord607
ord608
ord531
__vbaFPException
__vbaInStrVar
ord717
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaCheckType
ord535
__vbaLsetFixstrFree
__vbaI2Var
ord644
ord537
ord645
_CIlog
__vbaVarLateMemCallLdRf
__vbaVar2Vec
__vbaInStr
__vbaR8Str
__vbaNew2
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
ord573
__vbaStrCopy
__vbaI4Str
ord681
__vbaFreeStrList
ord576
_adj_fdivr_m32
__vbaR8Var
ord577
_adj_fdiv_r
ord685
ord578
ord100
ord579
__vbaVarTstNe
__vbaI4Var
__vbaForEachAry
__vbaVarCmpEq
__vbaVarAdd
__vbaLateMemCall
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaFpI2
__vbaVarLateMemCallLd
__vbaVarCopy
ord616
__vbaVarTstGe
__vbaFpI4
__vbaLateMemCallLd
__vbaRecDestructAnsi
ord617
_CIatan
__vbaI2ErrVar
__vbaUI1Str
__vbaStrMove
__vbaCastObj
ord618
__vbaAryCopy
__vbaR8IntI4
__vbaStrVarCopy
__vbaHresultCheckNonvirt
ord619
ord650
_allmul
__vbaLenVarB
__vbaLateIdSt
_CItan
ord546
__vbaUI1Var
__vbaFPInt
__vbaAryUnlock
_CIexp
__vbaMidStmtBstr
ord580
__vbaFreeObj
__vbaFreeStr
__vbaRecAssign
ord581

Sections

.text
Size: 744KB - Virtual size: 742KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 16KB

UPX1 Size: 2KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 960B

.reloc Size: 4KB - Virtual size: 316B

09d0478591d4f788cb3e5ea416c25237

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 59KB - Virtual size: 184KB

.rsrc Size: 7KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 4KB

348b62bb5cd5f75c2f868949522b56ec

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 3KB - Virtual size: 263KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

797e75375eb633dd3ffdc97c47f78949

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 68KB - Virtual size: 66KB

.data Size: - Virtual size: 9KB

.rsrc Size: 24KB - Virtual size: 22KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 124KB

UPX1 Size: 29KB - Virtual size: 32KB

.rsrc Size: 24KB - Virtual size: 28KB

Headers

File Characteristics

Sections

.text Size: 112KB - Virtual size: 109KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 28KB - Virtual size: 24KB

0bf37555b790fbefd247a663474ddcc6

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 744KB - Virtual size: 742KB

.data Size: 4KB - Virtual size: 23KB

.rsrc Size: 44KB - Virtual size: 42KB

UPX0
Size: - Virtual size: 16KB

UPX1
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.text
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 960B

.reloc
Size: 4KB - Virtual size: 316B

.text
Size: 59KB - Virtual size: 184KB

.rsrc
Size: 7KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 4KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 3KB - Virtual size: 263KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB

.text
Size: 68KB - Virtual size: 66KB

.data
Size: - Virtual size: 9KB

.rsrc
Size: 24KB - Virtual size: 22KB

UPX0
Size: - Virtual size: 124KB

UPX1
Size: 29KB - Virtual size: 32KB

.rsrc
Size: 24KB - Virtual size: 28KB

.text
Size: 112KB - Virtual size: 109KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 28KB - Virtual size: 24KB

.text
Size: 744KB - Virtual size: 742KB

.data
Size: 4KB - Virtual size: 23KB

.rsrc
Size: 44KB - Virtual size: 42KB