48ea799b30273b224fe5018b607ea04137a60a9829754931f6d8c0add8b28f48

Sharing

Copy URL Twitter E-mail

General

Target

48ea799b30273b224fe5018b607ea04137a60a9829754931f6d8c0add8b28f48
Size

4.6MB
MD5

53523a85319508d79e495b8570dafd79
SHA1

2a950b48b8e5a567e3e9c58542e4971684472614
SHA256

48ea799b30273b224fe5018b607ea04137a60a9829754931f6d8c0add8b28f48
SHA512

5e559b407691a2f273f31137bdd991c3fb2289d4e0146a8baed4dead4a02fe0d6a0a8b033e971e3f8c48b6c07df2fcee7a62ce423a83aaae32085156d5577896
SSDEEP

98304:vTwqrPWzeN2kL7ZPbsPXcZD0S7MMhuuw+/735VOSt:FzWm1nmPsZ/hhrOW

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/VirtualDub.exe
unpack001/auxsetup.exe
unpack001/vdicmdrv.dll
unpack001/vdlaunch.exe
unpack001/vdremote.dll
unpack001/vdsvrlnk.dll
unpack001/vdub.exe

Files

48ea799b30273b224fe5018b607ea04137a60a9829754931f6d8c0add8b28f48
.exe windows:6 windows x86 arch:x86

1195cccda0b79cb2db08ddb913399811

Code Sign

64:1f:c7:db:e5:c1:8e:8a:49:50:f8:a3:ce:fa:cb:75
Certificate

Issuer

CN=Envision Aunt,L=Old Greenwich,C=US

Not Before

19/03/2023, 04:00

Not After

19/03/2026, 04:00

Subject

CN=Lust Jug,L=Dodgewood,C=US

4c:cf:ab:18:83:8e:be:48:b0:0b:3e:66:7b:fa:c6:2f
Certificate

Issuer

CN=Lust Jug,L=Dodgewood,C=US

Not Before

29/10/2023, 04:00

Not After

29/10/2024, 04:00

Subject

CN=Order Conquest,L=Morgantown,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

c5:1b:33:b4:67:be:4f:8c:2e:11:7d:b6:49:ec:47:10:fc:80:9d:2d:93:d3:79:63:35:60:f3:9a:9c:08:4c:97
Signer

Actual PE Digest

c5:1b:33:b4:67:be:4f:8c:2e:11:7d:b6:49:ec:47:10:fc:80:9d:2d:93:d3:79:63:35:60:f3:9a:9c:08:4c:97

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCreateKeyExW
RegOpenKeyExW
OpenServiceA
QueryServiceStatus
OpenSCManagerA

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
SHFileOperationW
SHGetFileInfoW
ShellExecuteExW

ole32

IIDFromString
CoTaskMemFree
OleInitialize
OleUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance

comctl32

ord17
ImageList_AddMasked
ImageList_Create
ImageList_Destroy

user32

ScreenToClient
SetCursor
GetWindowRect
SystemParametersInfoW
TrackPopupMenu
AppendMenuW
EnableMenuItem
wsprintfA
DispatchMessageW
GetLastInputInfo
CreatePopupMenu
GetSystemMenu
GetSystemMetrics
IsWindowEnabled
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
CheckDlgButton
EndDialog
DialogBoxParamW
IsWindowVisible
SetWindowPos
CreateWindowExW
GetClassInfoW
PeekMessageW
CallWindowProcW
GetMessagePos
GetWindowLongW
ExitWindowsEx
SetWindowTextW
SetTimer
CreateDialogParamW
DestroyWindow
LoadImageW
FindWindowExW
SetWindowLongW
InvalidateRect
ReleaseDC
GetDC
SetForegroundWindow
EnableWindow
GetDlgItem
ShowWindow
IsWindow
PostQuitMessage
SendMessageTimeoutW
SendMessageW
wsprintfW
FillRect
GetClientRect
EndPaint
BeginPaint
DrawTextW
DefWindowProcW
SetDlgItemTextW
GetDlgItemTextW
GetSysColor
SetClassLongW
CharNextW
CharNextA
LoadCursorW
CharPrevW
MessageBoxIndirectW
RegisterClassW

gdi32

CreateBrushIndirect
CreateFontIndirectW
DeleteObject
SetBkColor
SelectObject
SetBkMode
GetDeviceCaps
SetTextColor

kernel32

DecodePointer
EncodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LCMapStringW
GetModuleHandleExW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
RtlUnwind
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
IsDebuggerPresent
IsBadReadPtr
LoadLibraryA
VirtualFree
VirtualProtect
VirtualAlloc
GetNativeSystemInfo
GetProcessHeap
HeapFree
HeapAlloc
SetLastError
MoveFileExW
lstrcatW
lstrcpyA
lstrcmpiA
GetProcAddress
GetModuleHandleA
GetSystemDirectoryW
WriteConsoleW
GetModuleFileNameA
K32EnumProcessModules
K32GetModuleFileNameExA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ExpandEnvironmentStringsW
SetCurrentDirectoryW
SearchPathW
CompareFileTime
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFullPathNameW
GetShortPathNameW
ReadFile
SetFileAttributesW
SetFilePointer
SetFileTime
CloseHandle
Sleep
FreeLibrary
GetModuleHandleW
LoadLibraryExW
GlobalAlloc
GlobalFree
MulDiv
lstrcmpW
lstrcmpiW
lstrlenA
GetPrivateProfileStringW
WritePrivateProfileStringW
MoveFileW
MultiByteToWideChar
GetFileSize
GetTickCount
GetModuleFileNameW
GetCommandLineW
SetEnvironmentVariableW
GetTempPathW
SetErrorMode
GetCurrentProcess
ExitProcess
GetWindowsDirectoryW
GetVersionExW
CopyFileW
GetDiskFreeSpaceW
CreateThread
GlobalUnlock
GlobalLock
lstrcpynW
lstrlenW
WideCharToMultiByte
CreateDirectoryW
CreateFileW
GetTempFileNameW
RemoveDirectoryW
WriteFile
GetLastError
WaitForSingleObject
GetExitCodeProcess
CreateProcessW

shlwapi

PathFindFileNameA
PathFindExtensionA

oleaut32

SysAllocString
SysFreeString

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 120KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:6 windows x86 arch:x86

4f33ea844b96a31c8f4690530ba63854

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalSize
GlobalFree
lstrcpynW
lstrcpyW
GetLastError
VirtualAlloc
VirtualProtect
VirtualFree
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
lstrlenW
MultiByteToWideChar
WideCharToMultiByte

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VirtualDub.chm
.chm
VirtualDub.exe
.exe windows:4 windows x86 arch:x86

3baa5cc664ab5641dae5995038b1da8b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\p4root\stable19\out\release\VirtualDub.pdb

Imports

winmm

waveOutReset
waveOutUnprepareHeader
waveOutClose
waveOutOpen
waveOutPrepareHeader
waveOutPause
waveOutGetPosition
waveOutWrite
waveOutRestart
waveInGetDevCapsA
mixerOpen
mixerGetLineInfoA
mixerGetLineControlsA
mixerGetControlDetailsA
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveInReset
waveInUnprepareHeader
waveInClose
mixerSetControlDetails
mixerClose
timeGetTime
timeBeginPeriod
timeSetEvent
timeEndPeriod
timeKillEvent
timeGetDevCaps
waveOutGetDevCapsA
waveOutGetNumDevs
DefDriverProc

msvfw32

ICImageDecompress
ICDecompress
ICCompress
ICRemove
ICGetInfo
ICSendMessage
ICOpen
ICClose
ICInfo

avifil32

AVIFileOpenW
AVIFileExit
AVIFileInit
AVIStreamBeginStreaming
AVIStreamEndStreaming
AVIStreamInfoA
AVIStreamFindSample
AVIStreamRead
AVIStreamStart
AVIStreamLength
AVIStreamReadFormat
AVIFileRelease
AVIFileGetStream
AVIFileOpenA

msacm32

acmStreamOpen
acmStreamUnprepareHeader
acmStreamConvert
acmStreamPrepareHeader
acmStreamSize
acmDriverID
acmStreamClose
acmMetrics
acmDriverEnum
acmDriverOpen
acmFormatTagEnumA
acmDriverClose
acmDriverMessage
acmDriverDetailsA
acmFormatEnumA
acmFormatSuggest
acmFormatDetailsA

comctl32

ImageList_Add
ord6
ImageList_Destroy
ord16
ImageList_Create
ord17

shlwapi

SHDeleteKeyA

kernel32

TerminateProcess
GlobalMemoryStatus
GetVersionExA
UnhandledExceptionFilter
ResumeThread
SuspendThread
SetUnhandledExceptionFilter
SetPriorityClass
ExitProcess
ReleaseSemaphore
GetLastError
SetFilePointer
GetStdHandle
FindClose
FindNextFileA
FindFirstFileA
GetComputerNameA
OpenProcess
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCommandLineW
DeleteFileA
LoadLibraryW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcessTimes
GetVolumeInformationA
GetVolumeInformationW
FindResourceExA
CreateProcessA
CreateProcessW
DeleteFileW
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
IsDebuggerPresent
GetThreadPriority
GetPriorityClass
GetWindowsDirectoryA
TlsAlloc
TlsFree
TlsSetValue
GetCurrentThreadId
FlushFileBuffers
GetExitCodeProcess
GenerateConsoleCtrlEvent
CreateFileMappingA
WaitForMultipleObjects
CreatePipe
PeekNamedPipe
OutputDebugStringA
GetSystemDirectoryA
GetSystemDirectoryW
GetProcessAffinityMask
RaiseException
SetEvent
CreateSemaphoreA
GetThreadContext
CreateEventA
MultiByteToWideChar
SetLastError
QueryPerformanceCounter
FormatMessageA
GetFileAttributesA
GetFileAttributesW
FindFirstFileW
CreateDirectoryA
CreateDirectoryW
GetModuleFileNameW
FindNextFileW
GetLongPathNameA
GetLongPathNameW
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetDriveTypeW
SetEndOfFile
SystemTimeToTzSpecificLocalTime
GetDateFormatA
GetDateFormatW
GetTimeFormatA
GetTimeFormatW
QueryPerformanceFrequency
FindCloseChangeNotification
FindNextChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
GetWindowsDirectoryW
GetOverlappedResult
FlushInstructionCache
EnumResourceNamesA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapCreate
HeapDestroy
GetStartupInfoA
GetProcessHeap
GetCommandLineA
CreateThread
ExitThread
HeapReAlloc
HeapFree
HeapAlloc
RtlUnwind
InterlockedIncrement
GetCurrentThread
DuplicateHandle
InterlockedDecrement
CreateFileW
GetSystemInfo
ReadProcessMemory
WriteFile
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LoadLibraryA
GetCurrentProcess
GetThreadSelectorEntry
CreateFileA
GetFileSize
ReadFile
CloseHandle
VirtualQuery
GetModuleFileNameA
GetFullPathNameA
GetModuleHandleA
GetProcAddress
VirtualProtect
GetTickCount
GetCurrentProcessId
MoveFileW
MoveFileA
GetVersion
VirtualAlloc
VirtualFree
FreeLibrary
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
SetThreadPriority
Sleep
MulDiv
FindResourceA
LoadResource
LockResource
SizeofResource
FreeResource
HeapSize
SetStdHandle
TlsGetValue
FreeEnvironmentStringsA

user32

GetWindowTextA
UnregisterHotKey
DrawEdge
RegisterHotKey
GetCursorPos
SetCursor
GetWindow
SystemParametersInfoA
ReleaseCapture
SetCapture
GetMessagePos
GetDialogBaseUnits
SetScrollInfo
GetScrollInfo
ScrollWindow
HideCaret
ShowCaret
SetScrollRange
SetScrollPos
SetCaretPos
DestroyCaret
CreateCaret
GetWindowTextLengthA
GetFocus
ShowCursor
SetCursorPos
IsWindowEnabled
GetCapture
GetDCEx
AppendMenuA
AppendMenuW
SetMenuItemInfoW
CallWindowProcW
DrawTextW
GetWindowTextW
GetWindowTextLengthW
GetMenuItemInfoW
LockWindowUpdate
InvertRect
GetNextDlgTabItem
CopyAcceleratorTableA
GetKeyNameTextA
GetKeyNameTextW
MapVirtualKeyA
CreateAcceleratorTableA
CreateDialogIndirectParamA
CreateDialogIndirectParamW
DefDlgProcA
DefDlgProcW
DrawFrameControl
InsertMenuItemA
InsertMenuItemW
DrawMenuBar
CheckMenuRadioItem
GetMenuItemCount
DeleteMenu
GetMenu
EnableMenuItem
CheckMenuItem
EnumDisplaySettingsA
RedrawWindow
GetMessageA
ExitWindowsEx
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
InflateRect
GetWindowLongW
SetWindowLongW
GetDlgItemTextA
PostThreadMessageA
SetForegroundWindow
WaitMessage
CreateWindowExW
SetWindowsHookExA
CallNextHookEx
TranslateAcceleratorA
DialogBoxParamW
SetWindowTextW
LoadImageA
BeginDeferWindowPos
EndDeferWindowPos
DeferWindowPos
IsZoomed
GetWindowPlacement
ScrollWindowEx
UnhookWindowsHookEx
IsWindow
IsDialogMessageA
GetKeyState
GetDlgItemInt
SetDlgItemInt
AdjustWindowRectEx
PtInRect
ClientToScreen
TrackMouseEvent
GetSysColor
DrawTextA
LoadAcceleratorsA
GetClassLongA
LoadStringA
LoadCursorA
RegisterClassA
AdjustWindowRect
CreateWindowExA
UnregisterClassA
PeekMessageA
TranslateMessage
DefWindowProcA
IsWindowUnicode
SendMessageW
MapWindowPoints
CallWindowProcA
CreateDialogParamW
IsIconic
GetForegroundWindow
GetWindowThreadProcessId
CreateDialogParamA
RegisterClassW
DefWindowProcW
GetSystemMenu
CreateMenu
SetRect
DestroyAcceleratorTable
GetAsyncKeyState
CreatePopupMenu
SetMenuItemInfoA
SetMenu
GetMenuItemInfoA
SendDlgItemMessageW
TrackPopupMenuEx
MessageBoxW
UnregisterClassW
GetCursorInfo
GetIconInfo
KillTimer
ScreenToClient
MapDialogRect
ScrollDC
ReleaseDC
IntersectRect
DestroyWindow
MsgWaitForMultipleObjects
PostQuitMessage
wvsprintfA
MessageBeep
GetSubMenu
TrackPopupMenu
LoadMenuA
DestroyMenu
SetWindowTextA
MessageBoxA
CheckDlgButton
SetTimer
GetParent
GetWindowRect
GetSystemMetrics
SetWindowPos
SetFocus
DialogBoxParamA
SendDlgItemMessageA
IsDlgButtonChecked
EnableWindow
OffsetRect
UnionRect
InvalidateRect
EndDialog
GetDlgItem
wsprintfA
SetDlgItemTextA
SendMessageA
UpdateWindow
GetClientRect
GetDC
EnumChildWindows
LoadIconA
FillRect
DrawIcon
SetWindowLongA
BeginPaint
EndPaint
PostMessageA
GetWindowLongA
ShowWindow
SetWindowPlacement
RemoveMenu
DispatchMessageA

gdi32

SaveDC
StretchDIBits
SetDIBitsToDevice
LineTo
MoveToEx
SetTextAlign
GetTextMetricsA
Polygon
RestoreDC
ExcludeClipRect
GetObjectA
SetBkMode
SetStretchBltMode
OffsetViewportOrgEx
GetClipBox
ExtTextOutW
RectVisible
GetTextExtentExPointW
Ellipse
PolylineTo
CreateFontIndirectA
GetDeviceCaps
Rectangle
ExtSelectClipRgn
OffsetClipRgn
CreateBitmap
GetDIBits
GetSystemPaletteEntries
CreatePalette
GetNearestPaletteIndex
RealizePalette
SelectPalette
SetTextColor
CreateSolidBrush
ExtTextOutA
Polyline
CreateFontA
GdiFlush
SelectObject
DeleteObject
DeleteDC
GetStockObject
SetDIBits
CreateCompatibleBitmap
StretchBlt
SwapBuffers
SetPixelFormat
ChoosePixelFormat
CreatePen
GetTextExtentPoint32W
GetTextExtentPoint32A
SetBkColor
TextOutA
CreateCompatibleDC
CreateDIBSection
BitBlt
PolyPolyline

comdlg32

GetSaveFileNameA
GetOpenFileNameA
GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError
ChooseColorA

advapi32

RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExW
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
LookupPrivilegeValueA

shell32

DragFinish
SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA
DragQueryFileW
DragAcceptFiles
DragQueryFileA
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ShellExecuteA

ole32

CreateItemMoniker
GetRunningObjectTable
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoGetObject
CoInitializeEx
CoUninitialize
CoInitialize

oleaut32

SysFreeString
OleCreatePropertyFrame

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.const
Size: 512B - Virtual size: 54B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 542KB - Virtual size: 542KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 169B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 325KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
VirtualDub.vdi
auxsetup.exe
.exe windows:4 windows x86 arch:x86

2710d61398df754a051cc1694b6a509f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerInstallFileA

kernel32

FlushFileBuffers
CloseHandle
CreateFileA
HeapSize
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
WriteConsoleW
GetConsoleOutputCP
GetWindowsDirectoryA
GetModuleFileNameA
FormatMessageA
GetLastError
GetFullPathNameA
DeleteFileA
GetLocaleInfoA
SetHandleCount
WriteConsoleA
SetStdHandle
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind

user32

GetMessageA
DispatchMessageA
TranslateMessage
LoadIconA
LoadCursorA
RegisterClassA
CreateDialogParamA
ShowWindow
UpdateWindow
DefWindowProcA
DialogBoxParamA
DestroyWindow
PostQuitMessage
SetDlgItemTextA
EndDialog
GetDlgItem
MessageBoxA
SendMessageA
SetWindowTextA

advapi32

RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
RegSetValueExA

shell32

ShellExecuteA

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
aviproxy/proxyoff.reg
aviproxy/proxyon.reg
aviproxy/readme.txt
copying
plugins32/readme.txt
vdicmdrv.dll
.dll windows:4 windows x86 arch:x86

2f03b88ab0371fb3ca034497f3692f5d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\p4root\stable19\out\release\vdicmdrv.pdb

Imports

winmm

DefDriverProc

kernel32

GetEnvironmentStrings
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringW
LCMapStringA
RtlUnwind
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
RaiseException
Sleep
HeapSize
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
GetStringTypeA
GetStringTypeW

user32

DialogBoxParamA
EndDialog

Exports

Exports

DriverProc

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vdlaunch.exe
.exe windows:4 windows x86 arch:x86

fe9ff1956e52fca4c6c7804b22f856b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\p4root\stable19\out\release\vdlaunch.pdb

Imports

kernel32

GenerateConsoleCtrlEvent
SetErrorMode
WaitForMultipleObjects
CreateProcessW
DuplicateHandle
GetLastError
GetCurrentProcess
CloseHandle
GetVersion
SetStdHandle
GetCurrentProcessId
OpenFileMappingA
GetExitCodeProcess
SetEvent
SetConsoleCtrlHandler
CreateProcessA
MapViewOfFile
UnmapViewOfFile

user32

wsprintfA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vdremote.dll
.dll windows:4 windows x86 arch:x86

02d18d48ef138820b899f45c19af4028

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\p4root\stable19\out\release\vdremote.pdb

Imports

winmm

mmioSeek
mmioClose
mmioRead
mmioOpenA
mmioDescend

avifil32

IID_IAVIStream

kernel32

HeapSize
GetOEMCP
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
AreFileApisANSI
InitializeCriticalSection
GetLocaleInfoA
HeapAlloc
RtlUnwind
RaiseException
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
GetProcessHeap
GetLastError
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW

ole32

CoInitialize
CoCreateInstance
CoUninitialize

vdsvrlnk

GetDubServerInterface

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vdsvrlnk.dll
.dll windows:4 windows x86 arch:x86

4b466ce9389bee1b3c04bbde67277aad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\p4root\stable19\out\release\vdsvrlnk.pdb

Imports

kernel32

GetTickCount
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
CreateMutexA
CloseHandle
MapViewOfFile
GetLastError
CreateFileMappingA
WaitForSingleObject
ReleaseMutex
UnmapViewOfFile
lstrcpyA
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
ExitProcess
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
HeapSize
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InitializeCriticalSection
RtlUnwind

user32

wsprintfA
SendMessageA

Exports

Exports

GetDubServerInterface

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vdub.exe
.exe windows:4 windows x86 arch:x86

1f261e01f868bd1bf8372a2b9d31147b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\p4root\stable19\out\release\vdub.pdb

Imports

kernel32

lstrlenA
CreatePipe
LeaveCriticalSection
GetModuleFileNameA
GetExitCodeProcess
SetErrorMode
CreateProcessA
DeleteCriticalSection
ReadFile
CloseHandle
WaitForSingleObject
LocalFree
CreateThread
lstrcpyA
SleepEx
GetStdHandle
WaitForSingleObjectEx
GetLastError
EnterCriticalSection
FormatMessageA
WriteFile
GetFullPathNameA
GetCommandLineA
GetConsoleScreenBufferInfo
InitializeCriticalSection
SetConsoleCtrlHandler
CreateFileA

user32

PostThreadMessageA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 29B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1195cccda0b79cb2db08ddb913399811

Code Sign

64:1f:c7:db:e5:c1:8e:8a:49:50:f8:a3:ce:fa:cb:75Certificate

4c:cf:ab:18:83:8e:be:48:b0:0b:3e:66:7b:fa:c6:2fCertificate

Extended Key Usages

c5:1b:33:b4:67:be:4f:8c:2e:11:7d:b6:49:ec:47:10:fc:80:9d:2d:93:d3:79:63:35:60:f3:9a:9c:08:4c:97Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

shlwapi

oleaut32

Sections

.text Size: 99KB - Virtual size: 98KB

.rdata Size: 34KB - Virtual size: 33KB

.data Size: 3KB - Virtual size: 3.6MB

.ndata Size: - Virtual size: 120KB

.rsrc Size: 17KB - Virtual size: 17KB

4f33ea844b96a31c8f4690530ba63854

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 68B

.reloc Size: 512B - Virtual size: 492B

3baa5cc664ab5641dae5995038b1da8b

Headers

File Characteristics

PDB Paths

Imports

winmm

msvfw32

avifil32

msacm32

comctl32

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.const Size: 512B - Virtual size: 54B

.rdata Size: 542KB - Virtual size: 542KB

.data Size: 15KB - Virtual size: 150KB

.tls Size: 512B - Virtual size: 169B

.rsrc Size: 325KB - Virtual size: 324KB

2710d61398df754a051cc1694b6a509f

Headers

File Characteristics

Imports

version

kernel32

user32

advapi32

shell32

64:1f:c7:db:e5:c1:8e:8a:49:50:f8:a3:ce:fa:cb:75
Certificate

4c:cf:ab:18:83:8e:be:48:b0:0b:3e:66:7b:fa:c6:2f
Certificate

c5:1b:33:b4:67:be:4f:8c:2e:11:7d:b6:49:ec:47:10:fc:80:9d:2d:93:d3:79:63:35:60:f3:9a:9c:08:4c:97
Signer

.text
Size: 99KB - Virtual size: 98KB

.rdata
Size: 34KB - Virtual size: 33KB

.data
Size: 3KB - Virtual size: 3.6MB

.ndata
Size: - Virtual size: 120KB

.rsrc
Size: 17KB - Virtual size: 17KB

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 68B

.reloc
Size: 512B - Virtual size: 492B

.text
Size: 2.1MB - Virtual size: 2.1MB

.const
Size: 512B - Virtual size: 54B

.rdata
Size: 542KB - Virtual size: 542KB

.data
Size: 15KB - Virtual size: 150KB

.tls
Size: 512B - Virtual size: 169B

.rsrc
Size: 325KB - Virtual size: 324KB

.text
Size: 40KB - Virtual size: 37KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 8KB - Virtual size: 6KB

.text
Size: 36KB - Virtual size: 33KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 5KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 732B

.data
Size: - Virtual size: 4B

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 5KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 4KB