008ae1ac2793a3a1bc7627cc03999920N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

008ae1ac2793a3a1bc7627cc03999920N.exe
Size

797KB
MD5

008ae1ac2793a3a1bc7627cc03999920
SHA1

9eb1b60fdc1fca2996fb479ea5bce6b873e50269
SHA256

4b44b13e3b7c44a62d88994b49656f2ad225a0608592ecabb8e59ff577d63107
SHA512

8f4f63f8d0d8c8bcf6f5d4c7c0078f7c77e731129c529fd43dfd864f08249d358225109ff7e6ffed529db55218146fe626b4f2a9a274188d4ee3b22a63ee0627
SSDEEP

12288:fOhJ8klPY1oVm36FBFQGIoVq4ON9UaWXuhszC4o9TtvXSQy1RCF:fOhJDlA1smK3qw3E9TtaJ+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
008ae1ac2793a3a1bc7627cc03999920N.exe

Files

008ae1ac2793a3a1bc7627cc03999920N.exe
.dll regsvr32 windows:4 windows x86 arch:x86

16444f52f77b367f1f02f05a84f7f8b1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\work\BaiduHi\dialog_14-5-106-1_BRANCH\Output\pdb\imStorage.pdb

Imports

basement

?MakeDirsEx@File@Help@@YAJPA_W@Z
?GetExeDir@File@Help@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?U16ToUTF8Ex@String@Help@@YA?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@AAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@4@@Z
?UTF8ToU16@String@Help@@YAHPBDHAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?StringToUint64@Misc@Help@@YA_KPA_WPAH@Z
?RC4Cipher@Crypt@Help@@YAHPBEK0KPAEAAK@Z
?GetService@Service@Help@@YAJABU_GUID@@PAPAX@Z
?CreateInstanceFromClassFactory@Com@Help@@YAJABU_GUID@@PAPAX@Z

bull80u

?XLogV@BULL@@YAXIPB_W0PAD@Z
?AssertOut@BULL@@YAJPB_WH_N0@Z

sqlite3

sqlite3_free
sqlite3_create_collation
sqlite3_column_type
sqlite3_errmsg
sqlite3_column_text16
sqlite3_column_int64
sqlite3_column_int
sqlite3_reset
sqlite3_prepare
sqlite3_step
sqlite3_stmt_busy
sqlite3_db_handle
sqlite3_bind_text16
sqlite3_bind_int64
sqlite3_sql
sqlite3_finalize
sqlite3_prepare_v2
sqlite3_open16
sqlite3_key
sqlite3_exec
sqlite3_errmsg16
sqlite3_changes
sqlite3_close
sqlite3_snprintf
sqlite3_last_insert_rowid
sqlite3_column_text
sqlite3_open
sqlite3_clear_bindings
sqlite3_data_count
sqlite3_errcode

kernel32

InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
GetProcAddress
HeapDestroy
GetVersionExA
GetLocaleInfoA
GetACP
InterlockedExchange
LoadLibraryA
HeapAlloc
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
RaiseException
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLastError
lstrlenW
lstrcmpiW
GetModuleHandleW
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
GetFileAttributesExW
FlushInstructionCache
GetCurrentProcess
SetLastError
CloseHandle
WaitForSingleObject
CopyFileW
MoveFileExW
CopyFileExW
DeleteFileW
MoveFileW
MultiByteToWideChar
WideCharToMultiByte
FindClose
FindNextFileW
VirtualFree
GetTickCount
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
GetPrivateProfileIntW
Sleep
SetThreadLocale
GetThreadLocale
GetCurrentThreadId
LoadLibraryW
CreateFileW
GetFileSize
FindFirstFileW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualAlloc

user32

TranslateMessage
PeekMessageW
UnregisterClassA
DispatchMessageW
GetClassInfoExW
LoadCursorW
RegisterClassExW
PostMessageW
CharNextW
PostQuitMessage
CallWindowProcW
GetWindowLongW
DefWindowProcW
CreateWindowExW
DestroyWindow
IsWindow
SetWindowLongW

advapi32

RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW

shell32

SHGetFileInfoW
SHCreateDirectoryExW

ole32

CoCreateInstance
CoInitialize
CoUninitialize
StgCreateStorageEx
StringFromGUID2
CoTaskMemFree
StringFromCLSID
StgOpenStorageEx
IIDFromString

oleaut32

SafeArrayGetVartype
SysStringByteLen
SysAllocStringByteLen
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear
VariantInit
VarBstrCmp
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysAllocString
SysFreeString

atl80

ord58
ord32
ord64
ord22
ord18
ord15
ord44
ord43
ord31
ord30

msvcp80

?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ

msvcr80

calloc
_strdup
__clean_type_info_names_internal
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
_except_handler4_common
_strtoi64
strstr
atoi
strtol
memcpy
_wcstoi64
sscanf_s
_mktime64
fopen_s
fclose
fwrite
vsprintf_s
_vscprintf
wcsrchr
_localtime64_s
_beginthread
_wtoi
vswprintf_s
_vscwprintf
_wcsicmp
_time64
wcsstr
__RTDynamicCast
swscanf_s
iswdigit
wcstol
_wcsnicmp
??3@YAXPAX@Z
_purecall
_CxxThrowException
__CxxFrameHandler3
_invalid_parameter_noinfo
??_V@YAXPAX@Z
swprintf_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
_recalloc
_ui64tow_s
memset
memcpy_s
malloc
free
wcscpy_s
wcsncpy_s
memmove_s
wcschr
_wcslwr_s
_waccess
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
wcsncmp

psapi

GetProcessMemoryInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 558KB - Virtual size: 558KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

16444f52f77b367f1f02f05a84f7f8b1

Headers

File Characteristics

PDB Paths

Imports

basement

bull80u

sqlite3

kernel32

user32

advapi32

shell32

ole32

oleaut32

atl80

msvcp80

msvcr80

psapi

Exports

Exports

Sections

.text Size: 558KB - Virtual size: 558KB

.rdata Size: 157KB - Virtual size: 157KB

.data Size: 18KB - Virtual size: 28KB

.rsrc Size: 1024B - Virtual size: 680B

.reloc Size: 61KB - Virtual size: 60KB

.text
Size: 558KB - Virtual size: 558KB

.rdata
Size: 157KB - Virtual size: 157KB

.data
Size: 18KB - Virtual size: 28KB

.rsrc
Size: 1024B - Virtual size: 680B

.reloc
Size: 61KB - Virtual size: 60KB