cd77ef6e2391b219a6679d0b444d7f51

Sharing

Copy URL Twitter E-mail

General

Target

cd77ef6e2391b219a6679d0b444d7f51
Size

492KB
MD5

cd77ef6e2391b219a6679d0b444d7f51
SHA1

ff8b0b0af580befd79c942b3287acbdf81c5d40a
SHA256

70fb7e7e1ee54d19d3c4fd7810291968206040cee8ecdc1895cdef783ed96689
SHA512

7ee7174f4789f38513276aee657cce898acba537f9cc681e7cba708286f422c3712296df1d0b1073242bd63956937869c64ed1effc5860e3ffd7a9d6523deb66
SSDEEP

6144:2yAP6SJo3RAstkZCuFiBR1PWSPfzM808kGLSjKVTQy3:2+SJq5kRkhg804ky

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cd77ef6e2391b219a6679d0b444d7f51

Files

cd77ef6e2391b219a6679d0b444d7f51
.exe windows:4 windows x86 arch:x86

7c3ea74fb4dbc1228fc91e01279a4f12

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Projects\source\winsrc_av7\wsconfig\avconfig\ReleaseUNICODE\AVConfig.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

mfc71u

ord330
ord6115
ord6033
ord2361
ord266
ord265
ord3590
ord6116
ord1091
ord1190
ord4314
ord3417
ord3281
ord4117
ord2077
ord4226
ord3158
ord587
ord326
ord3995
ord5637
ord2648
ord5651
ord5636
ord2255
ord3885
ord5643
ord1921
ord2074
ord1555
ord4882
ord5829
ord6232
ord3192
ord380
ord356
ord3661
ord3546
ord5065
ord5066
ord5064
ord4791
ord4611
ord4861
ord4838
ord4184
ord4207
ord4730
ord5207
ord4714
ord718
ord519
ord516
ord3126
ord3146
ord5493
ord4312
ord3671
ord2869
ord1642
ord1586
ord6010
ord4192
ord3923
ord5351
ord3981
ord1903
ord2072
ord2068
ord2030
ord1343
ord4985
ord1336
ord1342
ord5141
ord6265
ord5198
ord4960
ord5157
ord1953
ord3319
ord751
ord562
ord2364
ord5208
ord502
ord4313
ord977
ord1318
ord2027
ord1573
ord4274
ord1512
ord4266
ord3547
ord3662
ord721
ord528
ord524
ord5638
ord1645
ord1589
ord2981
ord3322
ord754
ord2089
ord1641
ord1585
ord4237
ord2977
ord3318
ord748
ord1556
ord3985
ord2861
ord3064
ord2864
ord5699
ord3065
ord2421
ord1178
ord4577
ord2149
ord1557
ord3215
ord1272
ord746
ord5443
ord558
ord4320
ord2009
ord1007
ord5096
ord566
ord577
ord280
ord1479
ord282
ord2926
ord1118
ord2461
ord283
ord774
ord1476
ord776
ord6063
ord1542
ord5231
ord5229
ord2384
ord2394
ord2392
ord2390
ord2386
ord2409
ord2397
ord1647
ord1646
ord1590
ord5118
ord3756
ord293
ord1582
ord1058
ord899
ord1536
ord5414
ord1719
ord4026
ord777
ord1883
ord1472
ord2311
ord896
ord3990
ord5558
ord5524
ord287
ord5484
ord5485
ord290
ord4101
ord2261
ord4100
ord2321
ord4035
ord1111
ord2396
ord2444
ord1156
ord526
ord2121
ord860
ord3877
ord5864
ord1198
ord2878
ord5398
ord2460
ord6161
ord2266
ord1002
ord1416
ord589
ord347
ord5640
ord1920
ord602
ord3331
ord4119
ord5633
ord1270
ord3280
ord3155
ord354
ord605
ord5199
ord4574
ord3635
ord3395
ord741
ord572
ord760
ord3311
ord2985
ord5210
ord4234
ord1393
ord5911
ord2086
ord2366
ord3198
ord2362
ord3678
ord334
ord593
ord3249
ord5119
ord416
ord651
ord3176
ord4256
ord4480
ord2856
ord5196
ord1955
ord5171
ord1353
ord4961
ord3339
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2402
ord2407
ord2388
ord2404
ord931
ord927
ord929
ord925
ord920
ord5956
ord1591
ord4276
ord4716
ord3397
ord4179
ord6271
ord5067
ord1899
ord5148
ord4238
ord1392
ord3940
ord1608
ord1611
ord5908
ord1661
ord1662
ord4884
ord5178
ord4112
ord4109
ord5609
ord6061
ord1021
ord1386
ord6086
ord2155
ord4729
ord4347
ord2651
ord2422
ord4206
ord5727
ord501
ord709
ord4743
ord1785
ord1051
ord2167
ord1299
ord1894
ord1271
ord3157
ord1925
ord3204
ord1079
ord4642
ord1049
ord762
ord2011
ord1908
ord764
ord5113
ord3327
ord4255
ord4475
ord3943
ord2638
ord3703
ord3713
ord3712
ord2527
ord2640
ord2534
ord2832
ord2708
ord4301
ord2829
ord2725
ord2531
ord5562
ord5209
ord5226
ord4562
ord3942
ord2239
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord3800
ord5579
ord2054
ord6274
ord3795
ord6272
ord4008
ord4032
ord757
ord3677
ord4535
ord1176
ord3875

msvcr71

realloc
wcsncpy
exit
_wcsdup
free
_waccess
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
__CxxFrameHandler
wcslen
_except_handler3
_wcsicmp
_wtoi
wcscmp
wcscpy
time
wcschr
_wcsnicmp
_wsplitpath
_snwprintf
wcsrchr
fclose
wcsstr
fgetws
_wfopen
_wcsupr
malloc
_resetstkoflw
_CxxThrowException
memmove
fputws
swprintf
wcscat
_wunlink
fputc
fflush
wcsncmp
vswprintf
printf
_purecall
srand
rand
swscanf
_wctime
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
wcsncat
strncpy
fwrite
fread
_errno
_close
_read
_eof
_lseek
_filelength
_wsopen
wcstombs
sscanf
mbstowcs
_wgetcwd
wcstok
memset
_c_exit
_exit
_XcptFilter
_cexit
_wcmdln
_controlfp
?terminate@@YAXXZ
__security_error_handler
_onexit
__dllonexit
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wchdir

kernel32

RaiseException
GetSystemDirectoryW
InitializeCriticalSection
GetLocaleInfoA
GetACP
InterlockedExchange
DeleteCriticalSection
OpenEventW
DeleteFileW
CloseHandle
PulseEvent
CopyFileW
ResetEvent
WaitForMultipleObjects
CreateEventW
WriteFile
CreateFileW
GetLastError
LoadLibraryW
WaitForSingleObject
SetEvent
FreeLibrary
GetModuleFileNameW
GetWindowsDirectoryW
CreateDirectoryW
GetShortPathNameW
GetThreadLocale
GetPrivateProfileIntW
GetDriveTypeW
FindClose
FindNextFileW
FindFirstFileW
MoveFileExW
RemoveDirectoryW
Sleep
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetPrivateProfileStringW
GetLocaleInfoW
WritePrivateProfileStringW
CreateProcessW
LocalFree
FormatMessageW
GetCurrentProcess
CreateMutexW
LocalAlloc
GetCurrentThread
GetProcAddress
GetModuleHandleW
SetLastError
SetFileAttributesW
GetFileAttributesW
MulDiv
WideCharToMultiByte
MultiByteToWideChar
GetVolumeInformationW
GetTempPathW
ReadFile
GetFileSize
OutputDebugStringW
FileTimeToSystemTime
SystemTimeToFileTime
lstrlenW
lstrcpynW
lstrcpynA
lstrcpyW
lstrlenA
GetCurrentThreadId
LoadLibraryExW
SetErrorMode
GetModuleHandleA
GetStartupInfoW
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LoadLibraryA
GetVersionExW
GetVersionExA
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetSystemTimeAsFileTime

user32

IsChild
UnregisterClassW
CallNextHookEx
UnhookWindowsHookEx
TranslateAcceleratorW
LoadAcceleratorsW
GetDlgCtrlID
SetWindowPos
IsWindowVisible
OffsetRect
SetRect
GetSysColor
RedrawWindow
LoadIconW
DrawIconEx
GetFocus
InflateRect
CopyRect
GetActiveWindow
GetLastActivePopup
MessageBoxW
GetDC
ReleaseDC
GetIconInfo
DestroyIcon
LoadStringW
LoadImageW
SetRectEmpty
FillRect
GetTopWindow
ScreenToClient
GetClassNameW
GetDlgItem
IsWindow
MoveWindow
GetWindow
GetForegroundWindow
EnumWindows
GetWindowTextW
SetWindowsHookExW
GetSysColorBrush
ExitWindowsEx
PeekMessageW
DispatchMessageW
TranslateMessage
ReleaseCapture
SetWindowLongW
LoadCursorW
GetParent
SetCapture
InvalidateRect
UpdateWindow
PtInRect
SetCursor
GetKeyState
ShowWindow
LoadBitmapW
DrawStateW
UnregisterClassA
wsprintfW
EnableWindow
PostQuitMessage
GetSystemMetrics
GetClientRect
GetWindowRect
IsIconic
SendMessageW
DrawIcon
FindWindowW
PostMessageW
BringWindowToTop
SetForegroundWindow

gdi32

ExtCreatePen
CreatePatternBrush
Rectangle
SetPixel
RoundRect
CreatePen
GetDIBColorTable
GetTextExtentPoint32W
CreateHalftonePalette
CreatePalette
SelectObject
BitBlt
RealizePalette
GetDeviceCaps
CreateCompatibleDC
GetStockObject
CreateFontIndirectW
GetObjectW
DeleteObject
CreateSolidBrush
GetPixel

advapi32

AllocateAndInitializeSid
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
CopySid
GetLengthSid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
SetFileSecurityW
SetEntriesInAclW
GetAclInformation
GetAce
EqualSid
SetNamedSecurityInfoW
AddAce
LookupAccountNameW
GetNamedSecurityInfoW
ImpersonateSelf
OpenThreadToken
RegCloseKey
InitializeSecurityDescriptor
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
FreeSid
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteKeyW

shell32

ShellExecuteW

comctl32

ord17
_TrackMouseEvent
ImageList_GetImageCount
ImageList_Add
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Draw
ImageList_GetImageInfo
ImageList_Remove
ImageList_Create
ImageList_Duplicate

shlwapi

PathIsDirectoryW

oleaut32

SysFreeString

cclib

?isFeatureEnabled@CCLCFControl@@QAE_NK@Z
?String2Password@CCLib@@SA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBGHK@Z
?Password2String@CCLib@@SA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBGHK@Z
??1CCLCFControl@@QAE@XZ
?LoadIconW@CCLCResString@@SAPAUHICON__@@PBGI@Z
?LoadImageW@CCLCResString@@SAPAXPBGIIHHI@Z
?getFileInfo@CCLib@@SA_NPBGPAUCCLIB_FILEINFO@@@Z
?getMRCHandle@CCLCResString@@QAEPAUMRCLIB@@XZ
?LoadColor@CCLCResString@@QAEKPBG@Z
??0CCLCResString@@QAE@PAUHINSTANCE__@@PBGH@Z
?LoadFileName@CCLCResString@@QAEPAGPBG@Z
?LoadResourceDll@CCLCResString@@QAE_NPBGH@Z
?LoadStringW@CCLCResString@@QAEPAGPBG@Z
??1CCLCResString@@QAE@XZ
?performSelfTest@CCLib@@SA_NPBG0H@Z
?getFCNHandle@CCLCFControl@@QAEPAXXZ
?LoadMasterRegKey@CCLCResString@@QAEPAGXZ
?LoadStringW@CCLCResString@@QAA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@IZZ
??0CCLCFControl@@QAE@XZ

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

Sections

.text
Size: 324KB - Virtual size: 321KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7c3ea74fb4dbc1228fc91e01279a4f12

Headers

File Characteristics

PDB Paths

Imports

version

mfc71u

msvcr71

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

oleaut32

cclib

msvcp71

Sections

.text Size: 324KB - Virtual size: 321KB

.rdata Size: 84KB - Virtual size: 80KB

.data Size: 8KB - Virtual size: 14KB

.idata Size: 16KB - Virtual size: 15KB

.rsrc Size: 56KB - Virtual size: 76KB

.text
Size: 324KB - Virtual size: 321KB

.rdata
Size: 84KB - Virtual size: 80KB

.data
Size: 8KB - Virtual size: 14KB

.idata
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 56KB - Virtual size: 76KB