80ed2e79f2ddfe83296eb82400b49c323e90dc7c187538a02afee20ac97416a1

Sharing

Copy URL Twitter E-mail

General

Target

80ed2e79f2ddfe83296eb82400b49c323e90dc7c187538a02afee20ac97416a1
Size

1.0MB
MD5

fddddf8ee1d1d5f41d902ae9aa19257c
SHA1

09873e3c450910e1967f37474b219ddd2df264df
SHA256

80ed2e79f2ddfe83296eb82400b49c323e90dc7c187538a02afee20ac97416a1
SHA512

be08fd19d43328873603c9d7af4f94c10ac0b7cf8088152a7369e5cd4dd6c8c7146f78d8a7d3f62e829986a44305080c70c3944ac9b94c5dc1b1f9f1dd16a4df
SSDEEP

24576:7fi83HKpG1VdeuIEchkyjN5AftkyeBTN58ZZr1RsecMaqV1SefIABDxzYTzDBBO7:LHfdeuIEcvaftwm7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
80ed2e79f2ddfe83296eb82400b49c323e90dc7c187538a02afee20ac97416a1

Files

80ed2e79f2ddfe83296eb82400b49c323e90dc7c187538a02afee20ac97416a1
.dll windows:5 windows x86 arch:x86

572c042072d8dcd60c9ab670d282c9e4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

GetCurrentHwProfileA
AdjustTokenPrivileges
LookupPrivilegeValueA
FreeSid
OpenProcessToken
SetNamedSecurityInfoA
SetEntriesInAclA
AllocateAndInitializeSid
CryptReleaseContext
CryptDestroyKey
CryptDecrypt
CryptAcquireContextA
CryptEncrypt
CryptGenKey
CryptGetUserKey
CryptExportKey
CryptImportKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey

passuninstall

_EnableUnInstall@4
_CheckEntry@0

winmm

timeSetEvent

passconfig

_PassConfig_OpenEMailDlg@16

passcontrol

Pass_Uninit
Pass_Init
Pass_Execute

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA

gdprform

GDPR_FillForm
GDPR_DoModal

passdllclient

?GvData_SetCallBack@GvPassClientData@@QAEXP6GXPBDHPAPAD@Z@Z
??1GvPassClientData@@QAE@XZ
?GvData_IsDialog@GvPassClientData@@QAEHPBD@Z
?GvData_GetDialogParam@GvPassClientData@@QAEXPBDAAHAAPAPAD@Z
??0GvPassClientData@@QAE@XZ
PassC_FreePassClientDll
?GvData_Answer@GvPassClientData@@QAEXPBDHPAPAD@Z

kernel32

FindFirstFileA
InterlockedExchange
LoadLibraryExA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
GetThreadLocale
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetFullPathNameA
CreateFileA
InterlockedIncrement
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
GlobalFlags
GetModuleHandleW
GetCPInfo
GetOEMCP
GetFileAttributesA
GetFileSizeEx
GetFileTime
RtlUnwind
FindClose
HeapFree
FileTimeToLocalFileTime
ExitProcess
RaiseException
GetCommandLineA
VirtualProtect
VirtualAlloc
VirtualQuery
HeapReAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStdHandle
GetConsoleCP
GetConsoleMode
HeapCreate
HeapDestroy
VirtualFree
SetHandleCount
GetFileType
GetStartupInfoA
InitializeCriticalSectionAndSpinCount
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTimeZoneInformation
GetDriveTypeA
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
FileTimeToSystemTime
HeapAlloc
FindNextFileA
GetCurrentThreadId
SizeofResource
LockResource
LoadResource
FindResourceA
WideCharToMultiByte
GetSystemTimeAsFileTime
FreeLibrary
GetLocalTime
OutputDebugStringA
GetProcAddress
LoadLibraryA
MultiByteToWideChar
lstrlenA
GetModuleFileNameA
GetModuleHandleA
GetSystemDefaultLangID
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
GetPrivateProfileIntA
GetWindowsDirectoryA
GetPrivateProfileStringA
ResetEvent
WaitForSingleObject
MulDiv
Sleep
LocalFree
lstrcmpA
FreeResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
SetLastError
QueueUserWorkItem
lstrlenW
LoadLibraryW
WaitForMultipleObjects
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
OpenProcess
OpenMutexA
GetSystemInfo
CreateEventA
GetVersionExA
GetTickCount
GetModuleFileNameW
DeleteFileA
CreateThread
GetCurrentDirectoryA
WinExec
WritePrivateProfileStringA
GetCurrentProcessId
CreateMutexA
SetEvent
OpenEventA
GetVersion
GetVolumeInformationA
FormatMessageA
ReleaseMutex
GetCurrentProcess
CloseHandle
GetLastError

user32

PostThreadMessageA
EndDialog
IsWindowEnabled
MoveWindow
IsDialogMessageA
IsDlgButtonChecked
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetWindowTextLengthA
GetWindowTextA
GetLastActivePopup
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
CharNextA
IsWindowVisible
UpdateWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
GetWindowLongA
SetWindowLongA
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
MessageBoxW
RegisterWindowMessageA
DestroyMenu
GetSysColorBrush
CharUpperA
RegisterClipboardFormatA
MessageBeep
GetNextDlgGroupItem
ReleaseCapture
SetCapture
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableA
SetCursor
PostQuitMessage
GetMessageA
UnregisterClassA
SetWindowContextHelpId
SetMenu
MapDialogRect
TranslateMessage
ValidateRect
WindowFromPoint
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
SetActiveWindow
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
SetForegroundWindow
SendMessageA
SetWindowPos
BringWindowToTop
ShowWindow
IsIconic
GetWindowRect
SetTimer
KillTimer
EnableWindow
LoadIconA
SetWindowTextA
GetSystemMetrics
LoadCursorA
UnhookWindowsHookEx
GetFocus
IsWindow
MessageBoxA
PostMessageA
GetCursorPos
GetDC
ReleaseDC
GetClientRect
OffsetRect
SetWindowsHookExA
GetKeyState
CallNextHookEx
SetFocus
GetParent

gdi32

SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
DeleteObject
GetDeviceCaps
GetObjectA
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreateBitmap
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetMapMode
GetRgnBox
CreateFontA
GetStockObject

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

shell32

SHGetSpecialFolderPathA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteA

shlwapi

PathRemoveFileSpecA
PathFindFileNameA
PathFindExtensionA
PathStripToRootA
PathRemoveFileSpecW
PathIsUNCA

oledlg

ord8

ole32

CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CLSIDFromProgID
CoRevokeClassObject
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoTaskMemFree
CoCreateInstance
OleRun
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
SysStringLen
OleCreateFontIndirect
VariantCopy
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocString
GetErrorInfo

gdiplus

GdipDeleteBrush
GdipFillRectangleI
GdipCreateFromHDC
GdipCreateLineBrushI
GdipCreateSolidFill
GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics

Exports

Exports

??0CPassGvData@@QAE@XZ
??1CPassGvData@@QAE@XZ
??4CPassGvData@@QAEAAV0@ABV0@@Z
?GvData_Answer@CPassGvData@@QAEXPBDHPAPAD@Z
?GvData_GetDialogParam@CPassGvData@@QAEXPBDAAHAAPAPAD@Z
?GvData_IsDialog@CPassGvData@@QAEHPBD@Z
?GvData_SetCallBack@CPassGvData@@QAEXP6GXPBDHPAPAD@Z@Z
ChangePassWD
ChangePassWD_R
CheckOptionDlg
CheckOptionDlgEx
CheckOptionDlgEx_64
CheckOptionDlg_64
ChecknCleanASBit
ExchangID
ExchangIDDialog
ExchangIDDialog_64
ExchangID_64
ExchangID_R
ExchangID_R_64
ExportSaveModeTokenDlg
GetCamCombination
GetCamCombination_64
GetCurUser
GetCurUser_64
GetGeoPWVersion
GetHint
GetHint_R
GetPrivilege
GetPrivilege2
GetPrivilege2_64
GetPrivilegeEX
GetPrivilegeEX_64
GetPrivilege_64
GetPrivilege_64_Encry
GetPrivilege_R
GetPrivilege_R_64
GetReStartID
GuestLimits
GuestLimits_64
GuestLimits_R
GuestLimits_R_64
HaveAccount
IsIDExchanged
IsIDVaild
IsIDVaild_R
IsRemoteClient
IsRemoteServerOnLine
Login
LoginDialog
LoginDialogEx
LoginDialogEx_64
LoginDialog_64
Login_64
Login_R
Login_R_64
Logout
MyGroupIs
MyGroupIs_2
MyGroupIs_R
MyGroupIs_R_2
OpenADSettingDialog
PASS_GetTimeInfo
PASS_IsDoublePW
PASS_IsValidID
PASS_SetPassCallback
PASS_SetPassCallback2
PASS_UpdateInfo
PassBackupExport
PassBackupImport
PassFreeLibrary
PassGetHostsInfo
PassServer_SendUpdate
PassUncoverAVIPassword
SetAutoStartBits
SetEMailCallback
SetHint
SetPassStateCallback
SetReStartID
ShowPassClientDialog
VerifySaveModeTokenDlg

Sections

.text
Size: 515KB - Virtual size: 515KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 385KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

572c042072d8dcd60c9ab670d282c9e4

Headers

File Characteristics

Imports

advapi32

passuninstall

winmm

passconfig

passcontrol

setupapi

gdprform

passdllclient

kernel32

user32

gdi32

comdlg32

winspool.drv

shell32

shlwapi

oledlg

ole32

oleaut32

gdiplus

Exports

Exports

Sections

.text Size: 515KB - Virtual size: 515KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 18KB - Virtual size: 77KB

.rsrc Size: 385KB - Virtual size: 384KB

.reloc Size: 52KB - Virtual size: 52KB

.text
Size: 515KB - Virtual size: 515KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 18KB - Virtual size: 77KB

.rsrc
Size: 385KB - Virtual size: 384KB

.reloc
Size: 52KB - Virtual size: 52KB