df223862bba8a8e2a807eabfc00bae87f92a35f522a7c60c5360e73319c44a9c

Sharing

Copy URL

Twitter E-mail

General

Target

df223862bba8a8e2a807eabfc00bae87f92a35f522a7c60c5360e73319c44a9c
Size

4.9MB
MD5

09bc0833f3393ec595365c94cfb2ef97
SHA1

df0219b5e686e7a6ed9c766ed2899f554dc8d287
SHA256

df223862bba8a8e2a807eabfc00bae87f92a35f522a7c60c5360e73319c44a9c
SHA512

854d21f733e8fe927a23b3473c8feb0b4a5865170135ff026235708359bcc9260e7b8f6a236a3cbf77b6fe7ddf512f817455433ee5b30d1e70c7e744057fac64
SSDEEP

49152:wPyBIoKyIttT7S5xNdnVdhRh7mK9dncA5:wkIo0vS5xNd8cncA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df223862bba8a8e2a807eabfc00bae87f92a35f522a7c60c5360e73319c44a9c

Files

df223862bba8a8e2a807eabfc00bae87f92a35f522a7c60c5360e73319c44a9c
.exe windows:4 windows x86 arch:x86

337f93092e840dd4a86b312f6984d8fd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\Hmxcds_new\Release\HMXCDS.pdb

Imports

gdiplus

GdipDeleteGraphics
GdipDeletePen
GdipCreateSolidFill
GdipSetPenWidth
GdiplusStartup
GdiplusShutdown
GdipDrawImageRectI
GdipGraphicsClear
GdipCreatePen2
GdipGetImageGraphicsContext
GdipBitmapSetResolution
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipGetImageVerticalResolution
GdipDeleteBrush
GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCloneBrush
GdipAlloc
GdipDrawRectangleI
GdipSetSmoothingMode
GdipCreateFromHDC
GdipFree
GdipSetInterpolationMode
GdipGetImageHorizontalResolution

cbn

?SetRadioBtn@CButtonST@@QAEXH@Z
?SetCheck@CButtonST@@QAEKHH@Z
?GetMessageMap@CButtonST@@MBEPBUAFX_MSGMAP@@XZ
?PreSubclassWindow@CButtonST@@MAEXXZ
?PreTranslateMessage@CButtonST@@UAEHPAUtagMSG@@@Z
?DrawItem@CButtonST@@UAEXPAUtagDRAWITEMSTRUCT@@@Z
?DrawBorder@CButtonST@@QAEKHH@Z
?OnDrawBorder@CButtonST@@MAEKPAVCDC@@PAVCRect@@@Z
?DrawTheIcon@CButtonST@@EAEXPAVCDC@@HPAUtagRECT@@PAVCRect@@HH@Z
?DrawTheBitmap@CButtonST@@EAEXPAVCDC@@HPAUtagRECT@@PAVCRect@@HH@Z
?DrawTheText@CButtonST@@EAEXPAVCDC@@PBDPAUtagRECT@@PAVCRect@@HH@Z
??1CButtonST@@UAE@XZ
?SetBitmaps@CButtonST@@QAEKHKHK@Z
?DrawTransparent@CButtonST@@QAEXH@Z
?SizeToContent@CButtonST@@QAEXXZ
?SetTooltipText@CButtonST@@QAEXPBDH@Z
?SetBtnCursor@CButtonST@@QAEKHH@Z
?OnDrawBackground@CButtonST@@MAEKPAVCDC@@PAVCRect@@@Z
??0CButtonST@@QAE@XZ
?SetAlign@CButtonST@@QAEKEH@Z

myrt

?SetRectColor@CMyTracker@@QAEXK@Z
?SetCursor@CMyTracker@@QBEHPAVCWnd@@I@Z
?Draw@CMyTracker@@QBEXPAVCDC@@@Z
??1CMyTracker@@UAE@XZ
?Track@CMyTracker@@QAEHPAVCWnd@@VCPoint@@H0@Z
?HitTest@CMyTracker@@QBEHVCPoint@@@Z
??0CMyTracker@@QAE@XZ

openpic

??0CShowPicOpenDlg@@QAE@HPBD0K0PAVCWnd@@K@Z
?DoModal@CShowPicOpenDlg@@UAEHXZ
??1CShowPicOpenDlg@@UAE@XZ

dlgex

??1CProShowStepDlg@@UAE@XZ
?CreateWnd@CDlgEx@@QAEXPAVCWnd@@@Z
?GetMessageMap@CProShowStepDlg@@MBEPBUAFX_MSGMAP@@XZ
?PreCreateWindow@CProShowStepDlg@@MAEHAAUtagCREATESTRUCTA@@@Z
??0CProShowStepDlg@@QAE@PAVCWnd@@@Z
?DoDataExchange@CProShowStepDlg@@MAEXPAVCDataExchange@@@Z
?PostNcDestroy@CDlgEx@@MAEXXZ
?OnInitDialog@CProShowStepDlg@@MAEHXZ
?OnOK@CDlgEx@@MAEXXZ
?OnCancel@CDlgEx@@MAEXXZ

cnb

?dwogo402lwgqo23@CMyDE@@QAEHPBDHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@VCPoint@@VCTime@3@@Z
??1CMyDE@@UAE@XZ
??0CMyDE@@QAE@XZ

hmt

?Serialize@CHmtObject@@UAEXAAVCArchive@@@Z
??1CHmtObject@@UAE@XZ
?g_strTmpPath@CHmtObject@@2V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@A
??0CHmtObject@@QAE@XZ

mfc71

ord2862
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4486
ord4273
ord578
ord732
ord544
ord5174
ord781
ord3849
ord865
ord297
ord4108
ord3997
ord784
ord2272
ord2322
ord304
ord3351
ord3350
ord4591
ord2044
ord5214
ord4980
ord5988
ord6091
ord4935
ord1482
ord265
ord4081
ord3088
ord4001
ord4123
ord2075
ord1968
ord6017
ord5731
ord1425
ord4306
ord5986
ord3085
ord589
ord5976
ord330
ord5873
ord1486
ord2882
ord6144
ord2263
ord745
ord557
ord3641
ord3441
ord2086
ord1545
ord4232
ord5152
ord3345
ord1362
ord5175
ord2991
ord4261
ord3164
ord572
ord587
ord2092
ord1641
ord2714
ord4238
ord2958
ord3230
ord658
ord3879
ord1794
ord6065
ord4320
ord1489
ord299
ord2933
ord2370
ord6168
ord6090
ord6067
ord5182
ord4890
ord2020
ord1671
ord1670
ord1551
ord5912
ord1401
ord5203
ord4262
ord651
ord605
ord416
ord354
ord1123
ord3875
ord1564
ord4580
ord1198
ord2306
ord1181
ord2259
ord1091
ord6286
ord5320
ord2095
ord1591
ord4240
ord3317
ord741
ord3057
ord3255
ord2346
ord1211
ord1580
ord2654
ord1281
ord5807
ord629
ord584
ord1439
ord1434
ord317
ord383
ord5331
ord6297
ord259
ord907
ord5529
ord3038
ord3056
ord4104
ord2662
ord3182
ord1024
ord630
ord911
ord5563
ord3389
ord5491
ord2021
ord385
ord783
ord1159
ord313
ord1647
ord1589
ord3315
ord739
ord2019
ord333
ord1880
ord6236
ord4212
ord4735
ord4541
ord3683
ord6006
ord5403
ord2475
ord4035
ord6119
ord2248
ord4038
ord4014
ord6278
ord3801
ord6276
ord4326
ord2063
ord2018
ord5583
ord3806
ord1010
ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord5224
ord5226
ord3948
ord4568
ord5230
ord5213
ord5566
ord2838
ord4481
ord3333
ord757
ord566
ord2323
ord786
ord1126
ord5975
ord1054
ord2468
ord3830
ord2371
ord4749
ord709
ord501
ord6283
ord262
ord4307
ord1483
ord4098
ord2089
ord1547
ord4234
ord3171
ord591
ord1554
ord3195
ord620
ord1791
ord2899
ord4109
ord3761
ord1929
ord1885
ord1892
ord2835
ord2731
ord2537
ord5200
ord1599
ord1655
ord1656
ord1964
ord1360
ord4967
ord3344
ord6277
ord3802
ord6279
ord1522
ord2172
ord2178
ord2405
ord2387
ord2385
ord2403
ord2415
ord2392
ord2408
ord2413
ord2396
ord2398
ord2400
ord2394
ord2410
ord2390
ord934
ord930
ord932
ord928
ord923
ord5233
ord5235
ord5960
ord1600
ord4282
ord4722
ord3403
ord4185
ord6275
ord5073
ord1908
ord4244
ord1402
ord3946
ord1617
ord1620
ord5915
ord3974
ord4860
ord4863
ord4379
ord4384
ord4381
ord4399
ord4401
ord4386
ord4776
ord4181
ord4790
ord4444
ord3740
ord310
ord347
ord602
ord3180
ord5719
ord5921
ord5401
ord5414
ord5588
ord5523
ord5647
ord5642
ord5727
ord6037
ord5888
ord6057
ord4161
ord6054
ord5608
ord6060
ord5611
ord2527
ord6062
ord2264
ord1903
ord1283
ord1955
ord3244
ord2094
ord4100
ord5637
ord1279
ord3302
ord1063
ord3161
ord3204
ord1280
ord3163
ord1934
ord3210
ord1084
ord5715
ord3567
ord3672
ord4471
ord4472
ord443
ord676
ord2372
ord5613
ord5442
ord2657
ord762
ord266
ord764
ord4125
ord5713
ord1185
ord1187
ord1191
ord1207
ord1571
ord1931

msvcr71

_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__security_error_handler
__p__commode
strrchr
_swab
_CIfmod
_CIpow
ceil
qsort
ldiv
sprintf
_strnicmp
strncmp
__CxxLongjmpUnwind
_setjmp3
__p__fmode
__set_app_type
memset
longjmp
printf
strncpy
isprint
calloc
floor
realloc
memmove
_time64
time
srand
rand
strftime
_localtime64
_CxxThrowException
exit
atoi
strtok
_CIacos
__CxxFrameHandler
fscanf
fgets
getc
fputc
fflush
ftell
fseek
fwrite
fread
fclose
fopen
_purecall
_except_handler3
free
malloc
_setmode
wcslen
_stricmp
strlen
strcpy
memcpy
pow
fprintf
exp
log
sqrt
fabs
atan2
strstr
_iob
sscanf
getenv
abort
tmpnam
vsprintf
isspace
isdigit
atof
strchr
isalpha
vfprintf
_snprintf
gmtime
strtod
putc
_getcwd
_errno
fgetc
perror
mktime
tmpfile
isupper
_setmbcp
_read
_write
_lseek
_unlink
_close
_open
_controlfp

kernel32

GetLocaleInfoA
GetACP
InterlockedExchange
GlobalFree
GetTickCount
lstrcpynA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateThread
CreateSemaphoreA
ReleaseSemaphore
WriteFile
SetFilePointer
GetLocalTime
CreateFileA
ReadFile
DeviceIoControl
GetFileSize
GetLogicalDriveStringsA
GetDriveTypeA
ResetEvent
CreateEventA
DeleteCriticalSection
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
GetLastError
lstrlenA
QueryPerformanceCounter
QueryPerformanceFrequency
MulDiv
ResumeThread
CloseHandle
WaitForSingleObject
IsDBCSLeadByte
LocalFree
InterlockedDecrement
FindClose
FindNextFileA
FormatMessageA
FindFirstFileA
DeleteFileA
CopyFileA
GetSystemTime
GetTempPathA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcatA
lstrcpyA
GlobalAlloc
CreateDirectoryA

user32

TabbedTextOutA
SetCapture
DrawTextA
DrawTextExA
GrayStringA
GetParent
LoadCursorA
EnableWindow
KillTimer
IsWindowVisible
InvalidateRect
ScreenToClient
ClientToScreen
ReleaseCapture
AppendMenuA
CreatePopupMenu
FillRect
LoadBitmapA
EqualRect
OffsetRect
InflateRect
SetRect
PtInRect
IsRectEmpty
CopyRect
IsWindow
GetWindowRect
GetClassNameA
PostMessageA
SetTimer
GetDesktopWindow
GetWindow
ShowScrollBar
GetSysColor
DrawIcon
GetSystemMenu
IsIconic
LoadIconA
GetSystemMetrics
GetCursorPos
GetFocus
wsprintfA
ReleaseDC
GetDC
MessageBoxA
GetKeyState
SetCursor
ClipCursor
GetClientRect
GetAsyncKeyState
SendMessageA

gdi32

SetDIBitsToDevice
CreatePolygonRgn
GetRgnBox
DeleteDC
EnumFontFamiliesExA
GetStockObject
CreateDIBSection
SaveDC
SetGraphicsMode
SetWorldTransform
CreateSolidBrush
CreatePatternBrush
CreateFontIndirectA
CreateFontA
GetObjectA
CreateCompatibleBitmap
CreateRectRgnIndirect
CombineRgn
CreateCompatibleDC
SetStretchBltMode
ExtSelectClipRgn
GetClipBox
GetDIBits
RealizePalette
PtInRegion
FrameRgn
SetWinMetaFileBits
DeleteEnhMetaFile
GetEnhMetaFileHeader
SetEnhMetaFileBits
PlayEnhMetaFile
SelectPalette
CreatePalette
GetEnhMetaFilePaletteEntries
SetBkColor
GetDeviceCaps
GetBkColor
GetMapMode
DPtoLP
LPtoDP
FillRgn
Ellipse
Rectangle
RoundRect
StretchBlt
GetTextExtentPoint32A
GetTextMetricsA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
BitBlt
SetTextCharacterExtra
SelectObject
CreatePen
RestoreDC
DeleteObject

shell32

DragAcceptFiles

comctl32

InitializeFlatSB
ImageList_GetImageCount
ImageList_Remove
ImageList_Replace
ImageList_SetImageCount
ImageList_Add
FlatSB_EnableScrollBar
ImageList_ReplaceIcon
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragMove
ImageList_DragShowNolock
ImageList_DragEnter
ImageList_DragLeave
ImageList_GetIcon
ImageList_Create
ord17
ImageList_AddMasked

ole32

CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleRun

oleaut32

GetErrorInfo
SysAllocString
VarUdateFromDate
VariantClear
VariantChangeType
VariantCopy
VariantInit
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SystemTimeToVariantTime

ws2_32

ntohs
ntohl
htonl
htons

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

Exports

Exports

??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??0CxImageGIF@@QAE@ABV0@@Z
??0CxImageGIF@@QAE@XZ
??0CxImageJPG@@QAE@ABV0@@Z
??0CxMemFile@@QAE@ABV0@@Z
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??1CxImageGIF@@UAE@XZ
??4CxExifInfo@CxImageJPG@@QAEAAV01@ABV01@@Z
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??4CxImageGIF@@QAEAAV0@ABV0@@Z
??4CxImageJPG@@QAEAAV0@ABV0@@Z
??4CxMemFile@@QAEAAV0@ABV0@@Z
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_7CxImageGIF@@6B@
??_7CxImageJPG@@6B@
??_7CxMemFile@@6B@
??_FCxExifInfo@CxImageJPG@@QAEXXZ
??_FCxIOFile@@QAEXXZ
??_FCxImage@@QAEXXZ
??_FCxMemFile@@QAEXXZ
??_OCxImage@@QAEXABV0@@Z
?Close@CxIOFile@@UAE_NXZ
?Decode@CxImageGIF@@QAE_NPAU_iobuf@@@Z
?Decode@CxImageJPG@@QAE_NPAU_iobuf@@@Z
?DecodeExif@CxImageJPG@@QAE_NPAU_iobuf@@@Z
?Encode@CxImageGIF@@QAE_NPAU_iobuf@@@Z
?Encode@CxImageGIF@@QAE_NPAU_iobuf@@PAPAVCxImage@@H_N@Z
?Encode@CxImageJPG@@QAE_NPAU_iobuf@@@Z
?Eof@CxIOFile@@UAE_NXZ
?Error@CxIOFile@@UAEJXZ
?Flush@CxIOFile@@UAE_NXZ
?GetC@CxIOFile@@UAEJXZ
?GetImageAlpha@CxImage@@QAEHXZ
?GetLeftTop@CxImage@@QAEXAAH0@Z
?GetS@CxIOFile@@UAEPADPADH@Z
?GetSelLayerID@CxImage@@QAEJXZ
?GetShowZoom@CxImage@@QAENXZ
?InitLayer@CxImage@@QAEXXZ
?Open@CxIOFile@@QAE_NPBD0@Z
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Scanf@CxIOFile@@UAEJPBDPAX@Z
?Seek@CxIOFile@@UAE_NJH@Z
?SetImageAlpha@CxImage@@QAEXH@Z
?SetLeftTop@CxImage@@QAEXHHHH@Z
?SetSelLayerID@CxImage@@QAEXJ@Z
?Size@CxIOFile@@UAEJXZ
?Tell@CxIOFile@@UAEJXZ
?Write@CxIOFile@@UAEIPBXII@Z

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 228KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

337f93092e840dd4a86b312f6984d8fd

Headers

File Characteristics

PDB Paths

Imports

gdiplus

cbn

myrt

openpic

dlgex

cnb

hmt

mfc71

msvcr71

kernel32

user32

gdi32

shell32

comctl32

ole32

oleaut32

ws2_32

setupapi

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 228KB - Virtual size: 224KB

.data Size: 24KB - Virtual size: 69KB

.rsrc Size: 3.6MB - Virtual size: 3.6MB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 228KB - Virtual size: 224KB

.data
Size: 24KB - Virtual size: 69KB

.rsrc
Size: 3.6MB - Virtual size: 3.6MB