General

Malware Config

Signatures

Files

• 92f7c3527f1e671d7c16adaf901e90409597a0c1db797f8bef1fa5f123a2822f

  .dll windows:4 windows x86 arch:x86

  e3159c476ec2746e0e5d4ebd1d990a0b

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  nnotes

  ord12

  ord13

  ord707

  ord2013

  ord2397

  ord2024

  ord2039

  ord2605

  ord939

  ord2847

  ord3802

  ord3803

  ord183

  ord2113

  ord2109

  ord3809

  ord3808

  ord3804

  ord3801

  ord3806

  ord3810

  ord2064

  ord3841

  ord3811

  ord3832

  ord2066

  ord2878

  ord4315

  ord4317

  ord4314

  ord4316

  ord4318

  ord2179

  ord17

  ord357

  ord2256

  ord322

  ord2548

  ord2001

  ord2010

  ord416

  ord938

  ord2005

  ord2411

  ord1562

  ord2549

  ord323

  ord325

  ord2040

  ord2195

  ord2162

  ord143

  ord2009

  ord2185

  ord223

  ord165

  ord2184

  ord2051

  ord2494

  ord2050

  ord2856

  ord320

  ord321

  ord4606

  ord861

  ord391

  ord2178

  ord2940

  ord182

  ord2931

  ord2932

  ord16

  ord2934

  ord2183

  ord2086

  ord2100

  ord2638

  ord2011

  ord2008

  ord2062

  ord3805

  ord2177

  msvcrt

  _vsnprintf

  _adjust_fdiv

  malloc

  _initterm

  strchr

  _chdir

  _endthread

  _beginthread

  atoi

  calloc

  free

  _mbsstr

  _mbscmp

  ??2@YAPAXI@Z

  ??3@YAXPAX@Z

  sprintf

  kernel32

  GetLocalTime

  DisableThreadLibraryCalls

  lstrlenA

  Sleep

  GetProcessHeap

  HeapAlloc

  lstrcpyA

  HeapFree

  GetLastError

  FormatMessageA

  OpenFileMappingA

  MapViewOfFile

  UnmapViewOfFile

  CloseHandle

  GetTickCount

  CreateFileA

  WriteFile

  GetFileSize

  SetFilePointer

  ReadFile

  SetEndOfFile

  user32

  FindWindowA

  LoadStringA

  GetFocus

  MessageBoxA

  SendMessageA

  wsprintfA

  advapi32

  RegCreateKeyExA

  RegSetValueExA

  RegCloseKey

  RegQueryValueExA

  RegOpenKeyExA

  nmlang

  ord1

  Exports

  Exports

  AddMemoAttachment

  AddMemoBody

  AddMessages

  AddNewAddressBookRecord

  AddressMemo

  CPHookDbStampNotes

  CPHookNoteOpen

  CPHookNoteUpdate

  CPHookTerm

  CleanupCPMailDB

  CloseAddressBook

  CloseCPMailDB

  CloseMailDB

  CloseMemo

  CloseNotesSession

  ConstructPath

  CreateMemo

  DeleteAll

  DeleteMessage

  FindMessage

  GetABAddress

  GetABProperties

  GetAddressBooks

  GetMailFileServer

  GetMailServer

  GetSABAddress

  GetServerName

  GetVPIMPrefix

  InitNotesSession

  InstallCallPilotComponents

  MainEntryPoint

  OpenAddressBook

  OpenCPMailDB

  OpenMailDB

  OpenMailDBEx

  RetrieveABNames

  RetrieveAll

  RetrieveSABNames

  RunAgent

  SendMemo

  SendOfflineMessage

  ServerInstallCallPilotComponents

  SetMemoProperties

  SetMessageID

  UnInstallCallPilotComponents

  UpdateMessage

  UpdateUnsentMessage

  Sections

  .text

  Size: 24KB - Virtual size: 23KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  Shared

  Size: 4KB - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 936B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ