df4526585c9c9295a745231fd7b383b9

Sharing

Copy URL Twitter E-mail

General

Target

df4526585c9c9295a745231fd7b383b9
Size

590KB
MD5

df4526585c9c9295a745231fd7b383b9
SHA1

7304e403357f272d6911061227919110752987a4
SHA256

e59413054219b1ceb89aca7bf9d4459a9d06d1654ea96d55bc69ec34d5ef60ba
SHA512

ce745197bf1a15c7cd6d85f27c15fade314e9d9e118d80a1bc12e0aaf07e753888912e8e530cac253899abbe168ff800885e499d588506b409ff7ef7847392b9
SSDEEP

12288:VUUSfU8zJeM24o93IwYm4CeVtkp8JgvIn5TgnfSSUptxWs:VUUgp9g3IYyVCnnaSQtx5

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMP/bdtmp/InstDll.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

df4526585c9c9295a745231fd7b383b9
.exe windows:4 windows x86 arch:x86

1bed3305885b0ca596d9cbba22baf78a

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/07/2006, 00:00

Not After

12/08/2009, 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
SetFileTime
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
MulDiv
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCommandLineA

user32

SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
CreateWindowExA
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
GetDlgItem
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
CreateDialogParamA
SetClipboardData
DestroyWindow
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 272KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

9d433976e02d79532f0d635ee81d0b20

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GetModuleHandleA
GetPrivateProfileIntA
GlobalAlloc
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
lstrcmpiA

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
LoadIconA
MapWindowPoints
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadImageA

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 930B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$PROGRAM_FILES/Baidu/bar/Buttons/custom.xml
.xml
$TEMP/bdtmp/InstDll.dll
.dll windows:4 windows x86 arch:x86

e44f82ce77eec687f2bd1fd452dd3940

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
CloseHandle
DeviceIoControl
GetWindowsDirectoryA
CreateFileA

msvcrt

_snprintf
__CxxFrameHandler
free
_initterm
malloc
_adjust_fdiv
__dllonexit
_onexit

shlwapi

SHDeleteKeyA
SHDeleteValueA
SHSetValueA

Exports

Exports

DelKey
DelValue
SetRegValue

Sections

.rdata
Size: 1024B - Virtual size: 785B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
baidubar.dat
baidubar.dll
.dll regsvr32 windows:4 windows x86 arch:x86

a82d3f78bbf17f19fd956af8952f5a32

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/07/2006, 00:00

Not After

12/08/2009, 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetFileAttributesA
GlobalAlloc
GetACP
GetCurrentProcessId
lstrcmpA
GlobalFree
LockResource
CompareStringA
GetFileAttributesA
SetFilePointer
WritePrivateProfileSectionA
GetPrivateProfileSectionA
SetErrorMode
GetEnvironmentVariableA
ReadProcessMemory
VirtualProtect
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
LocalFree
FormatMessageA
GetVolumeInformationA
DeviceIoControl
CopyFileA
OpenMutexA
IsBadStringPtrW
FreeResource
HeapFree
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
SystemTimeToFileTime
GetCurrentDirectoryA
LocalFileTimeToFileTime
SetFileTime
SwitchToThread
SetEvent
ResumeThread
FileTimeToSystemTime
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetLocalTime
VirtualQuery
TerminateThread
MoveFileExA
RemoveDirectoryA
CreateDirectoryA
WritePrivateProfileStringA
GetVersionExA
FindFirstFileA
FindNextFileA
FindClose
DeleteFileA
GetTickCount
CreateFileA
CreateProcessA
WaitForSingleObject
CreateMutexA
GetTempFileNameA
ReleaseMutex
GlobalLock
GlobalUnlock
lstrcatA
lstrcpyA
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
DisableThreadLibraryCalls
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
IsDBCSLeadByte
lstrcpynA
lstrcmpiA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
GetModuleFileNameA
GetShortPathNameA
FlushInstructionCache
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
Sleep
lstrlenW
GetCurrentProcess
WriteProcessMemory
IsBadStringPtrA
CreateThread
WideCharToMultiByte
GetFileSize
GetProcessHeap
HeapAlloc
ReadFile
CloseHandle
MultiByteToWideChar
WriteFile
LoadLibraryA
InterlockedDecrement
GetModuleFileNameW
LoadLibraryW
OutputDebugStringA
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetLastError
SetLastError
GetPrivateProfileIntA
GetPrivateProfileStringA
InterlockedIncrement
lstrlenA
GetExitCodeThread

user32

LoadBitmapA
SetTimer
GetGUIThreadInfo
GetWindowThreadProcessId
IsRectEmpty
EndDialog
AdjustWindowRectEx
SetWindowTextA
ClientToScreen
InsertMenuA
DeleteMenu
IsWindow
GetParent
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EnableMenuItem
GetAsyncKeyState
GetSubMenu
GetClassNameA
EnumChildWindows
IsChild
UnhookWindowsHookEx
DefWindowProcA
DestroyWindow
GetFocus
SetFocus
PostMessageA
SetWindowsHookExA
wsprintfA
LoadCursorA
RegisterClassExA
GetClassInfoExA
CallWindowProcA
CreateWindowExA
GetActiveWindow
GetDlgItem
BeginPaint
SetWindowLongA
GetWindowLongA
SendMessageA
EndPaint
CharNextA
LoadStringA
DestroyIcon
CharLowerA
SetWindowPos
MapWindowPoints
GetClientRect
SystemParametersInfoA
GetWindowRect
GetMenuItemID
GetWindow
DialogBoxParamA
IsWindowVisible
RedrawWindow
CheckMenuItem
ShowWindow
LoadImageA
AdjustWindowRect
SetRect
UpdateWindow
IsMenu
LoadMenuA
DestroyMenu
GetKeyState
MessageBoxA
CreatePopupMenu
AppendMenuA
GetMenuItemCount
EnableWindow
SetCursor
GetWindowTextA
GetWindowTextLengthA
SetRectEmpty
ScreenToClient
GetCursorPos
ReleaseCapture
GetCapture
SetCapture
PtInRect
InvalidateRect
FillRect
OffsetRect
DrawTextA
GetDC
DrawFocusRect
ReleaseDC
DispatchMessageA
TranslateMessage
KillTimer
GetDesktopWindow
GetScrollInfo
SetScrollInfo
ScrollWindow
CharLowerBuffA
CallWindowProcW
IsWindowUnicode
SetWindowLongW
CharNextW
GetMenuItemRect
GetMessageA
PostThreadMessageA
CreateIconFromResourceEx
GetPropA
SetPropA
RemovePropA
FindWindowExA
InflateRect
CreateDialogParamA
SetDlgItemTextA
GetDlgItemTextA
EnumWindows
IsDialogMessageA
CharUpperA
InsertMenuItemA
GetMenuState
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
CopyImage
PeekMessageA
CallNextHookEx
DrawStateA
GetSystemMetrics
RegisterWindowMessageA
TrackPopupMenuEx
GetMessagePos
GetSysColorBrush
FrameRect
GetMenuItemInfoA
SetMenuItemInfoA
IsWindowEnabled
MessageBeep
GetTopWindow
MenuItemFromPoint
GetClassInfoA
GetWindowPlacement
GetDlgCtrlID
GetWindowDC
GetMenuStringA
ModifyMenuA
WindowFromPoint
FindWindowA
LoadIconA
CopyRect
DrawIconEx
GetSysColor
MoveWindow

gdi32

ExcludeClipRect
GetClipBox
SetViewportOrgEx
GetDeviceCaps
DPtoLP
SaveDC
RestoreDC
CreateBitmap
GetTextColor
GetCurrentObject
ExtTextOutA
Rectangle
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateSolidBrush
GetPixel
TextOutA
CreateFontA
DeleteDC
SetTextColor
GetObjectA
CreateFontIndirectA
SetBkMode
SetBkColor
GetStockObject
CreatePen
SelectObject
MoveToEx
LineTo
GetTextExtentPoint32A
DeleteObject

advapi32

RegDeleteKeyA
GetUserNameA
RegSetKeySecurity
AllocateAndInitializeSid
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegGetKeySecurity
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetTokenInformation
GetLengthSid
CopySid
EnumDependentServicesA
ControlService
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
ChangeServiceConfigA
CloseServiceHandle
RegCreateKeyA
RegEnumKeyA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegCreateKeyExA
RegDeleteValueA

shell32

SHGetPathFromIDListA
DragQueryFileA
SHGetFileInfoA
SHGetFileInfoW
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ExtractIconA
ShellExecuteA
SHGetSpecialFolderPathA
SHGetSpecialFolderLocation

ole32

ReleaseStgMedium
GetHGlobalFromStream
CoInitialize
OleInitialize
RevokeDragDrop
CoGetClassObject
CreateStreamOnHGlobal
OleUninitialize
RegisterDragDrop
CoCreateGuid
StringFromGUID2
OleRun
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

CreateErrorInfo
SetErrorInfo
GetErrorInfo
SysStringByteLen
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
OleLoadPicture
SysAllocStringByteLen
SysStringLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
VariantChangeType
VariantInit
VariantCopy
SysAllocString
SysAllocStringLen
VariantClear
SysFreeString

shlwapi

PathIsDirectoryA
PathRemoveFileSpecA
UrlCanonicalizeA
SHDeleteKeyA
PathFileExistsA
PathFindFileNameA
PathRemoveExtensionA
SHSetValueA
SHDeleteValueA
UrlUnescapeA
UrlEscapeA
StrRetToStrW
StrRetToStrA
StrStrIA
SHCopyKeyA
SHGetValueA

oleacc

AccessibleObjectFromPoint

rpcrt4

UuidCreate

imm32

ImmGetDefaultIMEWnd

urlmon

CoInternetGetSession
URLDownloadToFileA

msimg32

TransparentBlt
AlphaBlend

msvcrt

_strcmpi
_stricmp
_wcsnicmp
_wcsupr
_adjust_fdiv
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_endthreadex
strncmp
_memicmp
_access
strtol
_beginthread
_endthread
_local_unwind2
_mbspbrk
tolower
strncat
bsearch
qsort
_fullpath
printf
_vsnprintf
_CxxThrowException
_strnicmp
toupper
strstr
isxdigit
isalnum
_wstat
fputs
fseek
ftell
_mbsnbcmp
__RTDynamicCast
strtod
atol
abs
fwrite
fread
_ftol
_mbsnbcpy
_mbsicoll
sscanf
fopen
fprintf
fclose
_beginthreadex
calloc
localtime
atof
_snwprintf
wcsncpy
wcsstr
wcschr
_wcsicmp
iswdigit
swscanf
iswalpha
_mbstok
_mbsrchr
strcat
malloc
memmove
strcmp
wcscmp
memset
strncpy
strrchr
_stat
_snprintf
srand
rand
memcmp
strcpy
strchr
_mbschr
_ismbcspace
_mbsnbicmp
_except_handler3
free
realloc
_mbsicmp
_mbscmp
_purecall
time
atoi
_ismbcdigit
wcslen
sprintf
strlen
vsprintf
??2@YAPAXI@Z
memcpy
__CxxFrameHandler
_mbsstr

wininet

InternetSetStatusCallback
FtpOpenFileA
InternetAttemptConnect
FindFirstUrlCacheGroup
DeleteUrlCacheGroup
FindNextUrlCacheGroup
DeleteUrlCacheEntry
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetConnectA
InternetConnectW
HttpOpenRequestA
HttpOpenRequestW
InternetCloseHandle
InternetReadFile
InternetQueryOptionA
HttpQueryInfoA
InternetOpenUrlA
InternetSetOptionA
InternetOpenA
GetUrlCacheEntryInfoA
HttpSendRequestA
InternetQueryDataAvailable
InternetSetFilePointer
InternetSetCookieA
InternetGetCookieA
HttpAddRequestHeadersA
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
InternetGetConnectedState
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
FindCloseUrlCache

setupapi

SetupIterateCabinetA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

iphlpapi

GetAdaptersInfo
GetNetworkParams

ws2_32

gethostname
gethostbyname

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Install
Uninstall

Sections

.text
Size: 940KB - Virtual size: 936KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Shared
Size: 4KB - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 252KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
img/imglist.bmp
img/logo.bmp

Sharing

General

Malware Config

Signatures

Files

1bed3305885b0ca596d9cbba22baf78a

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:feCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 262KB

.ndata Size: - Virtual size: 272KB

.rsrc Size: 24KB - Virtual size: 28KB

9d433976e02d79532f0d635ee81d0b20

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 930B

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 92B

.reloc Size: 512B - Virtual size: 494B

e44f82ce77eec687f2bd1fd452dd3940

Headers

File Characteristics

Imports

kernel32

msvcrt

shlwapi

Exports

Exports

Sections

.rdata Size: 1024B - Virtual size: 785B

.data Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 164B

a82d3f78bbf17f19fd956af8952f5a32

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 262KB

.ndata
Size: - Virtual size: 272KB

.rsrc
Size: 24KB - Virtual size: 28KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 930B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 494B

.rdata
Size: 1024B - Virtual size: 785B

.data
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 164B

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

.text
Size: 940KB - Virtual size: 936KB

.rdata
Size: 168KB - Virtual size: 165KB

.data
Size: 80KB - Virtual size: 101KB

.idata
Size: 20KB - Virtual size: 17KB

.Shared
Size: 4KB - Virtual size: 260B

.rsrc
Size: 252KB - Virtual size: 249KB

.reloc
Size: 68KB - Virtual size: 67KB