bcdeb57ccecf358b1834220c428c335b96b2c81c991fd9b6ec0095da4a4cdd12

Sharing

Copy URL Twitter E-mail

General

Target

bcdeb57ccecf358b1834220c428c335b96b2c81c991fd9b6ec0095da4a4cdd12
Size

688KB
MD5

0c395ac77367096a102ee6b0c9821a8e
SHA1

c344054bbf491f0326acb5c4a0942d6c26a37d63
SHA256

bcdeb57ccecf358b1834220c428c335b96b2c81c991fd9b6ec0095da4a4cdd12
SHA512

1ec6cfd4dd7345dace6423dea62da10591aa61fab707eac86f82633b7ccce30538d89623a3d4eaf9393037a6d49cdd643750f05abd60379bf1289a9c4203785d
SSDEEP

6144:hJecaWabtDJMc3Z4Dh+PDGlWHYaMjbo8L+ZSe1QJkGZyB2D1v2pTnhpC:RWDKCZb7GlWH+/o8qZPUvuThpC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bcdeb57ccecf358b1834220c428c335b96b2c81c991fd9b6ec0095da4a4cdd12

Files

bcdeb57ccecf358b1834220c428c335b96b2c81c991fd9b6ec0095da4a4cdd12
.exe windows:4 windows x86 arch:x86

a33aa77764519014034983fb9d094684

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

stk1util

?BrowseFile@CMyUtil@@SA?AVCString@@HPBD0@Z
??0CRingBuf@@QAE@XZ
??1CRingBuf@@UAE@XZ
?CreateDir@CMyUtil@@SAHPBD@Z
?GetFileDir@CMyUtil@@SA?AVCString@@PBD@Z
?GetBuf@CRingBuf@@QAEHPADHH@Z
?WriteBuf@CRingBuf@@QAEHPADH@Z
?Reset@CRingBuf@@QAEHXZ
?ReverseBytesOrder@CMyUtil@@SAHPAEH@Z
?GetFreeLen@CRingBuf@@QAEHXZ
?ReadCfgInt@CMyUtil@@SAHPBD0H0@Z
?WriteCfgInt@CMyUtil@@SAHPBD0H0@Z
?ByteToHexStr@CMyUtil@@SA?AVCString@@PAEH@Z
?FormatSizeStr@CMyUtil@@SA?AVCString@@_J@Z
?GetMyDir@CMyUtil@@SA?AVCString@@XZ
?ReadCfgStr@CMyUtil@@SA?AVCString@@PBD0H0@Z
?WriteCfgStr@CMyUtil@@SAHPBD000@Z
?WriteSTKLog@CMyUtil@@SAHKPBDZZ
?Inverse32@CMyUtil@@SAXPAD@Z
?SetBufLen@CRingBuf@@QAEHH@Z

wsock32

sendto
closesocket
htonl
setsockopt
socket
WSAStartup
WSAGetLastError
recvfrom
bind
htons
recv
WSACleanup

hwanetwork_d

?SendHwaData@CHwaNetWork@@QAEHPBXKPBUsockaddr_in@@I@Z
?GetAcceptSockAddr@CHwaNetWork@@QAEXHAAUsockaddr_in@@@Z
?SetMainWnd@CHwaNetWork@@QAEXPAUHWND__@@@Z
??0CHwaNetWork@@QAE@XZ
??1CHwaNetWork@@QAE@XZ
?StopServer@CHwaNetWork@@QAEXXZ

hwasocket_d

?GetSocket@CHwaSocket@@QBEIXZ
?ReadComm@CHwaSocket@@QAEKPAEKKI@Z
?WaitForAccept@CHwaSocket@@QAEHXZ
?CreateSocket@CHwaSocket@@QAEHHHHPBDHI@Z
?IsOpen@CHwaSocket@@QBEHXZ

shlwapi

PathFileExistsA

mfc42d

ord293
ord1639
ord316
ord3065
ord2805
ord2827
ord1190
ord3170
ord1638
ord4457
ord723
ord590
ord684
ord714
ord342
ord492
ord736
ord721
ord880
ord1043
ord1136
ord2936
ord643
ord1041
ord410
ord1042
ord2193
ord4264
ord1122
ord5093
ord3382
ord4492
ord2419
ord797
ord803
ord1996
ord1264
ord728
ord1613
ord4256
ord5084
ord4195
ord3629
ord3948
ord4017
ord3831
ord1862
ord4753
ord3362
ord1364
ord3651
ord4176
ord1781
ord4118
ord5076
ord3618
ord2078
ord1310
ord3069
ord3944
ord3670
ord2076
ord1566
ord5078
ord3002
ord4064
ord1344
ord4191
ord1830
ord1631
ord4205
ord2340
ord2481
ord2584
ord3691
ord2473
ord2585
ord2341
ord2432
ord2339
ord3143
ord3144
ord3142
ord2431
ord3367
ord3786
ord3658
ord1952
ord1228
ord2875
ord574
ord317
ord1857
ord3524
ord4634
ord2438
ord901
ord813
ord734
ord2316
ord2435
ord2291
ord4208
ord619
ord945
ord382
ord1757
ord4951
ord4896
ord3281
ord4645
ord4061
ord2593
ord4633
ord2168
ord1510
ord2636
ord4123
ord4705
ord4720
ord3286
ord1790
ord4258
ord4443
ord2597
ord2751
ord2508
ord3889
ord4405
ord3403
ord2640
ord4381
ord3481
ord824
ord2437
ord688
ord454
ord496
ord1212
ord3070
ord3573
ord877
ord450
ord2324
ord4036
ord730
ord1590
ord3290
ord1626
ord719
ord3690
ord3572
ord2385
ord4053
ord3655
ord612
ord617
ord374
ord380
ord1767
ord1761
ord4508
ord4934
ord4792
ord4800
ord2476
ord3015
ord2719
ord2561
ord2406
ord2725
ord3177
ord507
ord3110
ord5056
ord2619
ord3029
ord4475
ord2799
ord2068
ord1863
ord343
ord3024
ord2747
ord3400
ord4682
ord3282
ord5072
ord1100
ord1603
ord2085
ord4696
ord2995
ord485
ord739
ord511
ord3174
ord4566
ord3697
ord2232
ord3717
ord677
ord618
ord475
ord381
ord4801
ord2806
ord943
ord3304
ord1812
ord2353
ord586
ord559
ord335
ord299
ord4589
ord814
ord1772
ord4756
ord1365
ord4216
ord3657
ord2024
ord1288
ord2945
ord429
ord654
ord3553
ord3803
ord3552
ord5077
ord3702
ord1880
ord1860
ord4415
ord3231
ord1033
ord4130
ord1789
ord2661
ord4227
ord4229
ord3366
ord3826
ord4239
ord4215
ord4408
ord3784
ord2021
ord1285
ord2986
ord528
ord706
ord2052
ord2104
ord487
ord565
ord3432
ord1087
ord306
ord4615
ord4703
ord3302
ord4676
ord3355
ord3447
ord3960
ord646
ord1906
ord3201
ord2993
ord413
ord3365
ord2595
ord2383
ord1179
ord4845
ord899
ord2084
ord1313
ord2407
ord2255
ord3555
ord737
ord4403
ord2129
ord3640
ord2863
ord558
ord648
ord1729
ord1714
ord298
ord417
ord1809
ord3563
ord3312
ord1932
ord3592
ord418
ord1358
ord3098
ord2517
ord4458
ord1778
ord470
ord4407
ord4460
ord2208
ord449
ord2120
ord4811
ord3571
ord3415
ord3570
ord1455
ord349
ord596
ord2991
ord573
ord556
ord1799
ord1316
ord2109
ord2773
ord4887
ord2123
ord1900
ord4462
ord1661
ord2659
ord2790

msvcrtd

_setmbcp
_adjust_fdiv
__p__commode
_controlfp
__set_app_type
__CxxFrameHandler
_chkesp
memset
memcpy
memcmp
fwrite
sscanf
fgets
fclose
fopen
vsprintf
strtoul
strlen
atoi
_ftol
fread
ftell
fseek
_atoi64
strrchr
_exit
memmove
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
__p__fmode

kernel32

CreateFileA
GetFileSize
ReadFile
WritePrivateProfileStringA
CloseHandle
Sleep
GetTickCount
CreateThread
CreateEventA
WaitForSingleObject
SetFilePointer
GetPrivateProfileStringA
GetModuleFileNameA
GetModuleHandleA
CreateDirectoryA
SetEvent
GetLastError
lstrlenA
GetStartupInfoA
GetPrivateProfileIntA

user32

GetWindowLongA
DrawFocusRect
GetWindowTextA
SetWindowLongA
GetSystemMetrics

gdi32

CreateSolidBrush

comctl32

_TrackMouseEvent

mfco42d

ord798
ord2062

Sections

.text
Size: 388KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a33aa77764519014034983fb9d094684

Headers

File Characteristics

Imports

stk1util

wsock32

hwanetwork_d

hwasocket_d

shlwapi

mfc42d

msvcrtd

kernel32

user32

gdi32

comctl32

mfco42d

Sections

.text Size: 388KB - Virtual size: 387KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 8KB - Virtual size: 6KB

.idata Size: 12KB - Virtual size: 8KB

.rsrc Size: 232KB - Virtual size: 231KB

.reloc Size: 16KB - Virtual size: 12KB

.text
Size: 388KB - Virtual size: 387KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 8KB - Virtual size: 6KB

.idata
Size: 12KB - Virtual size: 8KB

.rsrc
Size: 232KB - Virtual size: 231KB

.reloc
Size: 16KB - Virtual size: 12KB