strela | c81ad8df886df3fd8d31063a3b46e434_JaffaCakes118

resource	yara_rule
static1/unpack001/MPALL_F1_EC00_v363_0D.exe	family_strela
static1/unpack001/MPALL_F2_v363_0D.exe	family_strela

resource
unpack001/GetInfo.exe
unpack001/IDBLK_TIMING.dll
unpack001/MPALL_F1_EC00_v363_0D.exe
unpack001/MPALL_F2_v363_0D.exe
unpack001/MPParamEdit_F1.exe
unpack001/MPParamEdit_F2.exe
unpack001/inpout32.dll

c81ad8df886df3fd8d31063a3b46e434_JaffaCakes118

SHA256 de383d620704e530a8375619c5540c10821db5ecb25d65b48ef55864e1a575d5
MD5 c81ad8df886df3fd8d31063a3b46e434
SHA1 2323b858cce4161662030b1fcf247154a3332d65
SHA512 7c6b3473e08a4de9cb671ec90351875e5a5841681ce903a84b0d9d11c9057dc97d7662a1c5f8ac73c0c23f5bd8e89e8eb598a3a902852552bed15690a1a560d8
SSDEEP 49152:JnE3z3yTIS3hYB7WCKT8Q1Gr23U59aCvFe65bsZVKlTGt2xD1Y1RjIy/kbt//rWa:hETyTf3hYUJT8sr3UHXFGVKCUD1SIy/E
MD5 SHA1 SHA512 SSDEEP

03MLC816K.ini

SHA256 448d43b9b7382fca52cbf0e7d0e2aa1a3405d02f222273196bbb444595e883fa
MD5 710132a1c68d729ee53fc9963f5b6d29
SHA1 374415c9d268d6015aeebc47f6df5a94980f6c9f
SHA512 da74e44fff30c5dc4685965bd6093b6c106021fa29705e4aabc6ad0af568f8b03e1a38ca35f6c9b88cbfeb7fd59a87f3c6715d0997163f87d4f5cd678467702a
MD5 SHA1 SHA512

03TLC.ini

SHA256 ff1d03c199c249bc869d57ab8be50d9a82fe65b5c775fb4c650b85a38bb5822f
MD5 07f6089aa1a2c6e460b2ef4b476d7687
SHA1 99a632024c1c651369b87006c930e1a977ad42ba
SHA512 e670a92c5992a31b4dc6812fb57ba9336f24294050ae8b69d5388afb2878323c689cfe424e711b5bcc19d10d97367bd5852c1ce8330b75811d2abba8698acb89
MD5 SHA1 SHA512

BN03VNEW.bin

SHA256 4011e40e5aea475d83e325d769f780bbedde2791417a40278509b7c88021c76a
MD5 a9f40b8cc308273c8127fe8962d1b3e4
SHA1 0b7257ad8d0bb686bfb728fac599e97c4164cc39
SHA512 8075f04353bd539c2ced6ca2de2027af5899f7b914a6569c5c20f0dcc3eb27c8afc6aa760c6d07a57f773f0f00c4bf220ba768440508da4348362f74ae005311
SSDEEP 768:oHnKClAlfRs9sP4HyLXJaLKxQi51e+ay/GfRuybKdZ035SRvbj4BDSa:oHn3AlfRAsP4eeKxx5Babwy4a5SRv/49
MD5 SHA1 SHA512 SSDEEP

FW03(TLC)v010953.bin

SHA256 530a374a3868ea418799f285714b426ec0982e7b44d682bb2fdc9a440c892d54
MD5 91a23c6454b9e5bfc9965943b5263e6d
SHA1 ee4cecabde69d702362c5132fdd11e9936d264bc
SHA512 37ea7276f6c6293fad397f35045087655b097c76c42e2faafbd47b9f3ea987affd347e0ad276553b1dc23cd45a81d55c9aac3e6a126ac8ad43a3947b7a7dfee9
SSDEEP 1536:I4tQMBv3IJFTRqiM+svMHqlxv6y76j9KWunRZwxKAE/e9wkTh2HvCJBc47wr3Wqx:/PlYfe+GdyVuRcKAYEwkA2wqqg/F
MD5 SHA1 SHA512 SSDEEP

FW03MLC 8 16 k NEW.bin

SHA256 3dfa294465c71ccbe6fb8bae5e2a0670569d231b6b52c802a516202f21323088
MD5 be028abc9f5b4743a050692178eaf5fd
SHA1 f924e037b1c1cb7ce46ebfc36ef0bba6f79b9ad3
SHA512 1908a0d5e9841a613da1ac97c6d494d71d2dd2cf277b231af757c5d6483ceec2ecbe8501ab15fe24a0b0816cc92c31cd785cafebd178012a6e7b2f6b0513015c
SSDEEP 3072:9T7JrpsUh/ciSWPe1mMKaYUwQ9Cirv1FkwLth+niPG0uBxa:9v/ciVG1mc1xts0x
MD5 SHA1 SHA512 SSDEEP

GetInfo.exe

IMPHASH c7f9ea7ceb815504f97eeddd3dbd94dc
SHA256 9c08153466efff98e4a406ecc807120c8ef37f996c2477fdbf45372346bbbb6d
MD5 0a9ce3402fbb81d4753bbde8287687eb
SHA1 9543582aa9d73f79542f6795e14bbdb38b285cc1
SHA512 5fec363ac4bc3281c4b43d8486838ab730b846173e3d06d87adfc26e66f9e135e05f0af7e9e1e329426855ac5f2d6f2fc121df952f170ef2370a05544e3889be
SSDEEP 12288:hLKI9hOPYtNE6r+KwXHwW2uiVCMX+0WRkSC5JA3rs35nshWWT7MEPX:hLKIIBiUAW2uiVBXYk/A7s3ER
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

443699

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\work\GetInfo\2012.10.24 GetInfo\GetInfo\ReadOnly\GetInfo-ReadOnly.pdb

hid

HidD_GetIndexedString HidD_GetPreparsedData HidP_GetCaps HidD_FreePreparsedData HidD_SetNumInputBuffers HidD_GetHidGuid HidD_GetAttributes HidD_GetSerialNumberString

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces CM_Get_Device_ID_ExA CM_Get_Sibling_Ex CM_Get_DevNode_Registry_Property_ExA CM_Connect_MachineA CM_Locate_DevNode_ExA CM_Get_Child_Ex CM_Disconnect_Machine CM_Get_Parent SetupDiEnumDeviceInfo SetupDiGetClassDevsA CM_Get_Device_IDA

kernel32

WritePrivateProfileStringA GetCurrentProcessId GetModuleFileNameW InterlockedDecrement VirtualProtect GlobalFlags LocalAlloc LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree InterlockedIncrement GetCPInfo GetOEMCP GetModuleHandleW GetThreadLocale FileTimeToSystemTime SetFilePointer FlushFileBuffers LockFile UnlockFile SetEndOfFile DuplicateHandle FindClose FindFirstFileA GetFullPathNameA FindResourceExA SetErrorMode FileTimeToLocalFileTime GetFileAttributesA GetFileSizeEx GetFileTime HeapFree ExitProcess HeapAlloc GetCommandLineA GetStartupInfoA RtlUnwind RaiseException HeapReAlloc GetSystemTimeAsFileTime VirtualAlloc GetSystemInfo VirtualQuery HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree GetStdHandle InitializeCriticalSectionAndSpinCount GetACP IsValidCodePage LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTimeZoneInformation GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap CompareStringW SetEnvironmentVariableA GetTickCount GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA InterlockedExchange lstrcmpA FormatMessageA LocalFree MulDiv FreeResource GetCurrentThreadId GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom CompareStringA MultiByteToWideChar lstrcmpW GetVersionExA SetLastError WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceA GetModuleHandleA GetModuleFileNameA OutputDebugStringA GetVolumeInformationA SetVolumeLabelA CreateFileA GetLastError WriteFile CloseHandle GetFileSize Sleep GlobalAlloc GlobalLock GlobalFree ReadFile GlobalUnlock DeviceIoControl GetLogicalDrives GetVersion GetCurrentProcess FreeLibrary GetProcAddress lstrcpyA lstrlenA GetComputerNameA GetSystemDefaultLangID GetDriveTypeA LoadLibraryA

user32

PostThreadMessageA CharNextA CopyAcceleratorTableA IsRectEmpty SetRect InvalidateRect InvalidateRgn GetNextDlgGroupItem MessageBeep CharUpperA UnregisterClassA EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA ModifyMenuA GetMenuState EnableMenuItem CheckMenuItem IsWindowEnabled ShowWindow MoveWindow SetWindowTextA IsDialogMessageA SetDlgItemTextA RegisterWindowMessageA SendDlgItemMessageA WinHelpA IsChild GetCapture SetWindowsHookExA CallNextHookEx GetClassLongA GetClassNameA SetPropA RemovePropA GetFocus SetFocus GetWindowTextLengthA ReleaseCapture GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageA GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageA MapWindowPoints GetKeyState SetMenu SetForegroundWindow IsWindowVisible UpdateWindow GetSubMenu GetMenuItemID GetMenuItemCount MessageBoxA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx EqualRect PtInRect DefWindowProcA CallWindowProcA GetMenu GetWindowLongA SetWindowLongA SetWindowPos SetCapture LoadCursorA GetSysColorBrush IntersectRect SystemParametersInfoA GetWindowPlacement GetWindow ReleaseDC GetDC IsWindow DestroyMenu GetWindowThreadProcessId SetCursor GetMessageA TranslateMessage ValidateRect GetDesktopWindow GetActiveWindow CreateDialogIndirectParamA GetNextDlgTabItem EndDialog SetWindowContextHelpId MapDialogRect RegisterClipboardFormatA PostQuitMessage EnableWindow SendMessageA CopyRect OffsetRect GetSysColor GetCursorPos ScreenToClient GetAsyncKeyState GetParent LoadIconA GetWindowRect IsIconic GetSystemMetrics GetClientRect DrawIcon PostMessageA GetDlgCtrlID wsprintfA GetWindowTextA GetPropA

comdlg32

GetOpenFileNameA GetFileTitleA

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCA PathStripToRootA PathFindExtensionA PathRemoveFileSpecW PathFindFileNameA

oledlg

ord8

gdi32

SetMapMode DeleteObject GetViewportExtEx GetWindowExtEx SetTextColor RectVisible RestoreDC ExtTextOutA Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC GetStockObject SaveDC CreateBitmap GetDeviceCaps GetObjectA TextOutA GetClipBox SetBkColor PtVisible GetMapMode GetBkColor GetTextColor GetRgnBox EnumFontFamiliesExA CreateRectRgnIndirect

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegDeleteKeyA RegSetValueExA RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegCloseKey RegOpenKeyA RegQueryValueA RegEnumKeyA

ole32

OleFlushClipboard CoRegisterMessageFilter StgOpenStorageOnILockBytes OleIsCurrentClipboard CoRevokeClassObject CoGetClassObject CoDisconnectObject CoInitializeEx CoCreateInstance CoUninitialize StgCreateDocfileOnILockBytes CLSIDFromProgID OleInitialize CoFreeUnusedLibraries OleUninitialize CoTaskMemAlloc CoTaskMemFree CLSIDFromString CreateILockBytesOnHGlobal

oleaut32

LoadTypeLi SysAllocString VariantCopy SysAllocStringByteLen SysFreeString SysStringLen SysAllocStringLen VariantInit VariantChangeType VariantClear SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect

HubMapping.ini

SHA256 c63c97623fd879e634d3c24082e7270e6b746345682522e74004aa2331dc51a1
MD5 acc20274e0e7d19eb1bcd32a4a0befb0
SHA1 b8410391368f197629379741feed6da761c7a117
SHA512 1fa27eea71173cdaf56a5660fa33323303b2d952d466f57bb4022d0ec94a98fe0a79946e9d582f2b57f77b12496604bbe94e4a0dd5453f560d9c8c36b27b5c11
MD5 SHA1 SHA512

IDBLK_TIMING.dll

IMPHASH 44156c02d5eac118c02c75f924a677e6
SHA256 9deb35f7d378d05a95b6cf8fd03bb5dda1b3bc321604cac2bb79626872f3ae89
MD5 9f435a7fc8c0f480038f13e7f9c08bfe
SHA1 3ebf72b929020c0b66fa21ade8dbfde28dd0c4f4
SHA512 5b2e21d6a495cde88aa1e1819a65148107e8ca68e07bb1cbd1a7f7b9f6381a6ca105be5a8686bf8931c62a476aea2da06fbce7cd1aef6330c222e5fd6105de30
SSDEEP 24576:brGPgNJgDoGFCv0wCNpAI3OZ0L1Bi1mZTxwr:Y
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

101793

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

netapi32

Netbios

ws2_32

WSAStartup htons htonl socket closesocket setsockopt connect inet_addr send recv WSACleanup

mfc42

ord3318 ord665 ord5186 ord939 ord941 ord354 ord861 ord1980 ord2770 ord356 ord5651 ord3127 ord3616 ord860 ord350 ord3126 ord3613 ord3663 ord1168 ord1253 ord342 ord1182 ord2818 ord1158 ord537 ord6282 ord6283 ord6876 ord800 ord539 ord535 ord1200 ord540 ord823 ord825 ord668

msvcrt

strncpy memcmp sprintf _mbsicmp wcscmp _CxxThrowException strcpy strcat _ftol memset memcpy __CxxFrameHandler atoi __dllonexit _onexit ??1type_info@@UAE@XZ free _initterm malloc _adjust_fdiv _except_handler3 wcscat ?terminate@@YAXXZ strlen

kernel32

CloseHandle SetFilePointerEx ReadFile CreateFileW MultiByteToWideChar WideCharToMultiByte OutputDebugStringA EnumResourceNamesA EnumResourceTypesA Sleep GetPrivateProfileIntA DeviceIoControl GetLastError FindResourceA LoadLibraryA GetProcAddress FreeLibrary GetTickCount LoadResource SetLastError GlobalAlloc GlobalFree CreateFileA SizeofResource

msvcp60

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z

MP.ini

SHA256 ff1d03c199c249bc869d57ab8be50d9a82fe65b5c775fb4c650b85a38bb5822f
MD5 07f6089aa1a2c6e460b2ef4b476d7687
SHA1 99a632024c1c651369b87006c930e1a977ad42ba
SHA512 e670a92c5992a31b4dc6812fb57ba9336f24294050ae8b69d5388afb2878323c689cfe424e711b5bcc19d10d97367bd5852c1ce8330b75811d2abba8698acb89
MD5 SHA1 SHA512

MPALL_F1_EC00_v363_0D.exe

IMPHASH 4e647c34b5631b40fa0ac969d49b2595
SHA256 e1c240ec6e3e830c3faab7d1da32512d1f79cf9df14b7f012a446e28f3d5b5cd
MD5 035254b6d72c5ca8fbc429f7ada9b35a
SHA1 41beb7620a9f97dd1cae11f54bfe1c463a40ab02
SHA512 099d0d86989434f87b52b312cb779539d2eeb9253d9932cecae98a842b0f738686f31eae89dfb07df39974305716eb348660e51a0db7cb7086ccd5eda8d700e8
SSDEEP 49152:m10+k5MqYJbQqDH/4vBC9rB/O0K4dxoO7:tMqY5QqDHGBC9rxO0RD7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects Strela Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

401235

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\WorkFolder\MPProgram_2008\MPProgram\Output\release\MPALL_F1_00_v200_00.pdb

inpout32

ord2 ord1

setupapi

SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces CM_Get_Sibling_Ex SetupDiDestroyDeviceInfoList CM_Disconnect_Machine CM_Locate_DevNodeA CM_Get_DevNode_Registry_PropertyA CM_Get_Child CM_Get_Sibling CM_Get_Parent CM_Request_Device_EjectA CM_Connect_MachineA CM_Get_DevNode_Registry_Property_ExA CM_Get_Child_Ex SetupDiGetClassDevsA

shlwapi

PathFindExtensionA PathFindFileNameA PathIsUNCA PathStripToRootA PathFileExistsA StrToIntExA StrToInt64ExA

version

GetFileVersionInfoA GetFileVersionInfoSizeA

netapi32

NetWkstaGetInfo NetApiBufferFree

kernel32

SetCommState SetCommTimeouts SignalObjectAndWait WaitCommEvent WaitForMultipleObjects GetCommMask SetLastError ReleaseMutex TerminateThread GetFileInformationByHandle LCMapStringW LCMapStringA IsValidCodePage GetACP GetStdHandle GetTimeZoneInformation HeapCreate HeapSize GetFileType SetStdHandle RaiseException RtlUnwind GetStartupInfoA GetCommandLineA ExitProcess HeapReAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetDriveTypeW HeapAlloc CreateThread ExitThread GetSystemTimeAsFileTime HeapFree SetErrorMode GetOEMCP GetCPInfo GlobalFlags GetFileTime GetFileSizeEx GetFileAttributesA InterlockedIncrement GetModuleHandleW TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue GetCurrentThread GetCommState EnumResourceLanguagesA GetLocaleInfoA LoadLibraryExA InterlockedExchange GetFullPathNameA DuplicateHandle SetEndOfFile UnlockFile LockFile GetModuleFileNameW FreeResource GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom CompareStringA GetCurrentProcessId FormatMessageA LocalFree MulDiv lstrlenA GetVersionExA SetEnvironmentVariableA CompareStringW GetLocaleInfoW WriteConsoleW GetConsoleOutputCP WriteConsoleA CreateProcessA GetExitCodeProcess GetProcessHeap IsValidLocale EnumSystemLocalesA GetUserDefaultLCID QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP GetStringTypeW GetStringTypeA SetHandleCount CreateFileW GetFullPathNameW PeekNamedPipe ConvertDefaultLocale SetEvent ResetEvent EnterCriticalSection LeaveCriticalSection GetLastError WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceA LocalAlloc SetCommMask CreateEventA GetLocalTime GetCurrentThreadId FileTimeToSystemTime FileTimeToLocalFileTime GlobalUnlock GlobalLock GetCurrentProcess GetModuleHandleA GetWindowsDirectoryA WinExec SetThreadLocale SetFileAttributesA Process32Next TerminateProcess OpenProcess Process32First CreateToolhelp32Snapshot GetVersion GetCurrentDirectoryA InterlockedDecrement GetTickCount GetModuleFileNameA GetFileAttributesW GetShortPathNameA lstrcmpA FlushFileBuffers DeleteCriticalSection InitializeCriticalSection GetComputerNameA GlobalFree GlobalAlloc WriteFile SetVolumeLabelA GetDiskFreeSpaceA GetDiskFreeSpaceExA VirtualFree VirtualAlloc DeviceIoControl SetFilePointer GetFileSize ReadFile CloseHandle CreateFileA MultiByteToWideChar GetVolumeInformationA FindNextFileA FindFirstFileA GetLogicalDrives WritePrivateProfileStringA GetProcAddress LoadLibraryA GetDriveTypeA FindClose FindNextFileW lstrcmpW FindFirstFileW ResumeThread WaitForSingleObject GetPrivateProfileIntA DeleteFileA CreateDirectoryA Sleep CopyFileA GetPrivateProfileStringA FreeLibrary OutputDebugStringA

winscard

SCardStatusA SCardEndTransaction SCardTransmit SCardBeginTransaction SCardDisconnect SCardListReadersA SCardConnectA SCardEstablishContext

ws2_32

socket getpeername getsockname closesocket shutdown accept gethostname bind gethostbyname __WSAFDIsSet getservbyname htons htonl ntohs WSACleanup WSAStartup WSAGetLastError ntohl connect send sendto select recvfrom recv inet_addr

rpcrt4

UuidCreateSequential

user32

SetWindowTextA IsDialogMessageA RegisterWindowMessageA SendDlgItemMessageA WinHelpA GetCapture SetPropA GetPropA RemovePropA GetFocus SetFocus GetWindowTextLengthA GetForegroundWindow SetActiveWindow GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime ShowWindow CheckMenuItem MapWindowPoints SetMenu SetForegroundWindow CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx EnableMenuItem ModifyMenuA LoadBitmapA GetMenuCheckMarkDimensions SetMenuItemBitmaps BeginPaint EndPaint CharUpperA EndDialog CreateDialogIndirectParamA GetDesktopWindow PostQuitMessage GetSysColorBrush LoadCursorA UnregisterClassA GetDlgCtrlID DefWindowProcA CallWindowProcA GetMenu SetWindowLongA SetWindowPos SystemParametersInfoA GetWindowPlacement GetWindow SetWindowsHookExA CallNextHookEx GetMessageA IsWindowVisible GetKeyState GetCursorPos ValidateRect GetWindowThreadProcessId GetLastActivePopup IsWindowEnabled GetMenuState GetMenuItemID GetMenuItemCount GrayStringA DrawTextExA DrawTextA TabbedTextOutA DrawEdge GetClassLongA WindowFromDC SendMessageTimeoutA FindWindowA GetDlgItem MsgWaitForMultipleObjects PeekMessageA DrawIcon GetSystemMetrics IsIconic LoadIconA GetWindowTextA GetClassNameA IsWindow UpdateWindow RedrawWindow DispatchMessageA TranslateMessage MessageBoxA KillTimer PtInRect ScreenToClient GetMessagePos SetTimer FrameRect ReleaseDC GetDC GetSysColor FillRect DrawStateA OffsetRect GetClientRect DrawFocusRect InflateRect CopyRect TrackPopupMenuEx GetSubMenu GetWindowRect GetActiveWindow WindowFromPoint ClientToScreen InvalidateRect SetCursor GetParent GetNextDlgTabItem GetWindowLongA DestroyIcon DestroyMenu DestroyCursor EnableWindow wsprintfA SendMessageA PostMessageA

gdi32

CreateCompatibleDC GetStockObject DeleteObject GetViewportExtEx DPtoLP GetBkColor GetTextExtentPoint32A CreateRectRgn ExtTextOutA PtVisible RectVisible TextOutA Escape GetDeviceCaps GetClipBox SaveDC RestoreDC SetBkMode SetMapMode LineTo MoveToEx SetTextAlign CreateBitmap CreateCompatibleBitmap SelectClipRgn OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx CreatePen BitBlt SelectObject SetBkColor SetTextColor DeleteDC GetObjectA CreateDIBSection CreateSolidBrush Rectangle CreateFontIndirectA GetViewportOrgEx SetViewportOrgEx CreateFontA LPtoDP GetMapMode GetWindowExtEx

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegOpenKeyA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegFlushKey RegDeleteValueA RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegCloseKey RegQueryValueExA

shell32

SHCreateDirectoryExA ShellExecuteExA ShellExecuteA SHGetSpecialFolderPathA

comctl32

_TrackMouseEvent

ole32

OleRun CoCreateInstance CoInitialize

oleaut32

VariantChangeType VariantInit VariantClear SysFreeString GetErrorInfo SysAllocString

generic

count=3, id=150, version=20413,

count=7, id=109, productName=VS2005 build 50727, version=50727,

count=41, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=223, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=16, id=132, productName=VS2008 build 21022, version=21022,

count=2, id=19, version=8034,

count=170, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=30, id=123, productName=VS2005 build 50727, version=50727,

count=2, id=19, version=9049,

count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,

count=658, id=1, productName=Unmarked objects,

count=88, id=138, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

MPALL_F2_v363_0D.exe

IMPHASH 4e647c34b5631b40fa0ac969d49b2595
SHA256 4062dc237b1cdda4f74e506f4d71298ed3b9b2a5a22dd8963fcc95420d1737d6
MD5 a7db016538604761b783789753b8a8fd
SHA1 e6e708b04d323f7e79084b290efb21dcb647628f
SHA512 99cceb5d60da573ff18bb638fcefb0df3c4ab76009edb7f15811296395969585ea20ab7f68ba2def98821bbbd64021fc5c8e1a4a1b4f65a8342c21cdfff82712
SSDEEP 49152:lLF8qlqvgeOdaHWelBLBy2yO7O0k2O6O7:JlqvZOdaHVB1ty2O087
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects Strela Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

401235

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\WorkFolder\MPProgram_2008\MPProgram\Output\release\MPALL_F2_v200_00.pdb

inpout32

ord2 ord1

setupapi

SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces CM_Get_Sibling_Ex SetupDiDestroyDeviceInfoList CM_Disconnect_Machine CM_Locate_DevNodeA CM_Get_DevNode_Registry_PropertyA CM_Get_Child CM_Get_Sibling CM_Get_Parent CM_Request_Device_EjectA CM_Connect_MachineA CM_Get_DevNode_Registry_Property_ExA CM_Get_Child_Ex SetupDiGetClassDevsA

shlwapi

PathFindExtensionA PathFindFileNameA PathIsUNCA PathStripToRootA PathFileExistsA StrToIntExA StrToInt64ExA

version

GetFileVersionInfoA GetFileVersionInfoSizeA

netapi32

NetWkstaGetInfo NetApiBufferFree

kernel32

SetCommState SetCommTimeouts SignalObjectAndWait WaitCommEvent WaitForMultipleObjects GetCommMask SetLastError ReleaseMutex TerminateThread GetFileInformationByHandle LCMapStringW LCMapStringA IsValidCodePage GetACP GetStdHandle GetTimeZoneInformation HeapCreate HeapSize GetFileType SetStdHandle RaiseException RtlUnwind GetStartupInfoA GetCommandLineA ExitProcess HeapReAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetDriveTypeW HeapAlloc CreateThread ExitThread GetSystemTimeAsFileTime HeapFree SetErrorMode GetOEMCP GetCPInfo GlobalFlags GetFileTime GetFileSizeEx GetFileAttributesA InterlockedIncrement GetModuleHandleW TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue GetCurrentThread GetCommState EnumResourceLanguagesA GetLocaleInfoA LoadLibraryExA InterlockedExchange GetFullPathNameA DuplicateHandle SetEndOfFile UnlockFile LockFile GetModuleFileNameW FreeResource GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom CompareStringA GetCurrentProcessId FormatMessageA LocalFree MulDiv lstrlenA GetVersionExA SetEnvironmentVariableA CompareStringW GetLocaleInfoW WriteConsoleW GetConsoleOutputCP WriteConsoleA CreateProcessA GetExitCodeProcess GetProcessHeap IsValidLocale EnumSystemLocalesA GetUserDefaultLCID QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP GetStringTypeW GetStringTypeA SetHandleCount CreateFileW GetFullPathNameW PeekNamedPipe ConvertDefaultLocale SetEvent ResetEvent EnterCriticalSection LeaveCriticalSection GetLastError WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceA LocalAlloc SetCommMask CreateEventA GetLocalTime GetCurrentThreadId FileTimeToSystemTime FileTimeToLocalFileTime GlobalUnlock GlobalLock GetCurrentProcess GetModuleHandleA GetWindowsDirectoryA WinExec SetThreadLocale SetFileAttributesA Process32Next TerminateProcess OpenProcess Process32First CreateToolhelp32Snapshot GetVersion GetCurrentDirectoryA InterlockedDecrement GetTickCount GetModuleFileNameA GetFileAttributesW GetShortPathNameA lstrcmpA FlushFileBuffers DeleteCriticalSection InitializeCriticalSection GetComputerNameA GlobalFree GlobalAlloc WriteFile SetVolumeLabelA GetDiskFreeSpaceA GetDiskFreeSpaceExA VirtualFree VirtualAlloc DeviceIoControl SetFilePointer GetFileSize ReadFile CloseHandle CreateFileA MultiByteToWideChar GetVolumeInformationA FindNextFileA FindFirstFileA GetLogicalDrives WritePrivateProfileStringA GetProcAddress LoadLibraryA GetDriveTypeA FindClose FindNextFileW lstrcmpW FindFirstFileW ResumeThread WaitForSingleObject GetPrivateProfileIntA DeleteFileA CreateDirectoryA Sleep CopyFileA GetPrivateProfileStringA FreeLibrary OutputDebugStringA

winscard

SCardStatusA SCardEndTransaction SCardTransmit SCardBeginTransaction SCardDisconnect SCardListReadersA SCardConnectA SCardEstablishContext

ws2_32

socket getpeername getsockname closesocket shutdown accept gethostname bind gethostbyname __WSAFDIsSet getservbyname htons htonl ntohs WSACleanup WSAStartup WSAGetLastError ntohl connect send sendto select recvfrom recv inet_addr

rpcrt4

UuidCreateSequential

user32

SetWindowTextA IsDialogMessageA RegisterWindowMessageA SendDlgItemMessageA WinHelpA GetCapture SetPropA GetPropA RemovePropA GetFocus SetFocus GetWindowTextLengthA GetForegroundWindow SetActiveWindow GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime ShowWindow CheckMenuItem MapWindowPoints SetMenu SetForegroundWindow CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx EnableMenuItem ModifyMenuA LoadBitmapA GetMenuCheckMarkDimensions SetMenuItemBitmaps BeginPaint EndPaint CharUpperA EndDialog CreateDialogIndirectParamA GetDesktopWindow PostQuitMessage GetSysColorBrush LoadCursorA UnregisterClassA GetDlgCtrlID DefWindowProcA CallWindowProcA GetMenu SetWindowLongA SetWindowPos SystemParametersInfoA GetWindowPlacement GetWindow SetWindowsHookExA CallNextHookEx GetMessageA IsWindowVisible GetKeyState GetCursorPos ValidateRect GetWindowThreadProcessId GetLastActivePopup IsWindowEnabled GetMenuState GetMenuItemID GetMenuItemCount GrayStringA DrawTextExA DrawTextA TabbedTextOutA DrawEdge GetClassLongA WindowFromDC SendMessageTimeoutA FindWindowA GetDlgItem MsgWaitForMultipleObjects PeekMessageA DrawIcon GetSystemMetrics IsIconic LoadIconA GetWindowTextA GetClassNameA IsWindow UpdateWindow RedrawWindow DispatchMessageA TranslateMessage MessageBoxA KillTimer PtInRect ScreenToClient GetMessagePos SetTimer FrameRect ReleaseDC GetDC GetSysColor FillRect DrawStateA OffsetRect GetClientRect DrawFocusRect InflateRect CopyRect TrackPopupMenuEx GetSubMenu GetWindowRect GetActiveWindow WindowFromPoint ClientToScreen InvalidateRect SetCursor GetParent GetNextDlgTabItem GetWindowLongA DestroyIcon DestroyMenu DestroyCursor EnableWindow wsprintfA SendMessageA PostMessageA

gdi32

CreateCompatibleDC GetStockObject DeleteObject GetViewportExtEx DPtoLP GetBkColor GetTextExtentPoint32A CreateRectRgn ExtTextOutA PtVisible RectVisible TextOutA Escape GetDeviceCaps GetClipBox SaveDC RestoreDC SetBkMode SetMapMode LineTo MoveToEx SetTextAlign CreateBitmap CreateCompatibleBitmap SelectClipRgn OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx CreatePen BitBlt SelectObject SetBkColor SetTextColor DeleteDC GetObjectA CreateDIBSection CreateSolidBrush Rectangle CreateFontIndirectA GetViewportOrgEx SetViewportOrgEx CreateFontA LPtoDP GetMapMode GetWindowExtEx

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegOpenKeyA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegFlushKey RegDeleteValueA RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegCloseKey RegQueryValueExA

shell32

SHCreateDirectoryExA ShellExecuteExA ShellExecuteA SHGetSpecialFolderPathA

comctl32

_TrackMouseEvent

ole32

OleRun CoCreateInstance CoInitialize

oleaut32

VariantChangeType VariantInit VariantClear SysFreeString GetErrorInfo SysAllocString

generic

count=3, id=150, version=20413,

count=7, id=109, productName=VS2005 build 50727, version=50727,

count=41, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=223, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=16, id=132, productName=VS2008 build 21022, version=21022,

count=2, id=19, version=8034,

count=170, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=30, id=123, productName=VS2005 build 50727, version=50727,

count=2, id=19, version=9049,

count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,

count=658, id=1, productName=Unmarked objects,

count=88, id=138, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

MPParamEdit_F1.exe

IMPHASH cf8d01bf9c8bb36747de3c2b31b09c57
SHA256 9b221212828ac17122ebaa87ae54c745d9c9c2f432245c62bd549b8d5621a83c
MD5 55147cb2e22d9b4184bd4f7b33b89892
SHA1 d8d7c87a10a2f56fd18cc43f3a07364435250879
SHA512 400b5d3d5a099effbff49300663cc040425cc3f5f1d87ed3cc2e4399ad26ab79c38efbc8f753237501a38145251102b60c868c52be23d9b885b611b6705ee487
SSDEEP 12288:qvBnwZ2dPXLmGI1YDIdTef4ux3RGgfqJgmSPnAV/hLbY0mD+EPpU+:8XCFez9iCmSP8/hLba5D
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

391421

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\work\paramedit\mpparamedit\mpparamedit 2012.11.9\release\MPParamEdit_F1.pdb

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

FileTimeToLocalFileTime GetFileAttributesW GetFileTime HeapFree HeapAlloc GetProcessHeap GetStartupInfoW ExitProcess RtlUnwind RaiseException HeapReAlloc VirtualAlloc GetSystemInfo VirtualQuery SetStdHandle GetFileType HeapSize SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetStartupInfoA SetErrorMode HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetCurrentDirectoryA GetDriveTypeA GetConsoleCP GetConsoleMode GetTimeZoneInformation GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA FindResourceExW GlobalFlags FileTimeToSystemTime TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement GetVersionExW CreateFileW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale InterlockedDecrement VirtualProtect GetTickCount GetCurrentProcessId CloseHandle GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange GetModuleHandleA lstrlenA lstrcmpA FreeResource GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom FreeLibrary CompareStringW LoadLibraryA lstrcmpW GetVersionExA GetLastError SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree MulDiv lstrlenW SetCurrentDirectoryW GetVersion GetPrivateProfileIntW WideCharToMultiByte GetPrivateProfileStringW GetModuleFileNameW WritePrivateProfileStringW GetModuleHandleW GetCurrentDirectoryW SetThreadLocale OutputDebugStringW GetProcAddress LoadLibraryW FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar HeapDestroy

user32

SetRect InvalidateRgn GetNextDlgGroupItem MessageBeep UnregisterClassW DestroyMenu SetWindowContextHelpId MapDialogRect RegisterClipboardFormatW GetWindowThreadProcessId SetCursor GetMessageW TranslateMessage ValidateRect PostQuitMessage GetDesktopWindow GetActiveWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW ReleaseDC GetDC IsWindowEnabled ShowWindow MoveWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW UnregisterClassA IsRectEmpty SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow SetActiveWindow DispatchMessageW GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetForegroundWindow UpdateWindow GetMenu MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect PtInRect DefWindowProcW CallWindowProcW GetWindowLongW SetWindowLongW SetWindowPos IntersectRect SystemParametersInfoA GetWindowPlacement GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW CopyAcceleratorTableW CharNextW PostThreadMessageW ReleaseCapture SetCapture GetFocus ModifyMenuW LoadCursorW GetSysColorBrush RegisterWindowMessageW CharUpperW EnableMenuItem CheckMenuItem GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu InvalidateRect PostMessageW GetDlgCtrlID DrawIcon IsWindowVisible GetClientRect GetSystemMetrics IsIconic AppendMenuW GetSystemMenu GetWindowRect LoadIconW ScreenToClient OffsetRect EnableWindow GetCursorPos CopyRect GetSysColor SendMessageW GetParent GetAsyncKeyState GetLastActivePopup

gdi32

SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC GetStockObject GetMapMode GetBkColor GetTextColor GetRgnBox EnumFontFamiliesExW GetWindowExtEx GetViewportExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible CreateBitmap GetDeviceCaps DeleteObject SetMapMode RestoreDC SaveDC CreateRectRgnIndirect GetObjectW SetBkColor SetTextColor GetClipBox

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegEnumKeyW RegSetValueExW RegCreateKeyExW RegQueryValueW RegCloseKey RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegOpenKeyW

shell32

SHGetPathFromIDListW SHBrowseForFolderW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW PathFindExtensionW PathStripToRootW StrToIntExW PathIsUNCW

oledlg

OleUIBusyW

ole32

CoRevokeClassObject CoGetClassObject CoDisconnectObject CLSIDFromString CLSIDFromProgID OleInitialize CoFreeUnusedLibraries OleUninitialize CoTaskMemAlloc CoTaskMemFree OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal

oleaut32

SysFreeString SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy SysAllocString VariantCopy SysAllocStringLen VariantInit VariantChangeType VariantClear OleCreateFontIndirect LoadTypeLi SysStringLen

MPParamEdit_F2.exe

IMPHASH ea84fac62dcb64443dbdb7e658d2270c
SHA256 d5b7f8db9ccc12309ffce3fedd5a52dc5f71fca617f050e8bfd0e40f81b52e95
MD5 59a380bfaaa12a2138b00233ee3c74cd
SHA1 16ba58c1901a6fdb509cbd1798e289739764538f
SHA512 e046bf1199d2915acf24bf9c0b22cb4175febb66b3f254d68d0f14a0cff3b38c778a58a8f8ad88a79048c9c4131973b103454a22eab47c9f0250975659a85f17
SSDEEP 12288:evBnij8TZyjUxnLDMVXXbFES7/VwA8cUCKWgvCgg+9AOYEPpU+:nHxxLHBgvnf7PD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

396221

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\work\paramedit\mpparamedit\mpparamedit 2012.11.9\f2\MPParamEdit_F2.pdb

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

FileTimeToLocalFileTime GetFileAttributesW GetFileTime HeapFree HeapAlloc GetProcessHeap GetStartupInfoW ExitProcess RtlUnwind RaiseException HeapReAlloc VirtualAlloc GetSystemInfo VirtualQuery SetStdHandle GetFileType HeapSize SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetStartupInfoA SetErrorMode HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent Sleep GetCurrentDirectoryA GetDriveTypeA GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP WriteConsoleW GetStringTypeA GetStringTypeW GetLocaleInfoA CreateFileA SetEnvironmentVariableA FindResourceExW GlobalFlags FileTimeToSystemTime TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement CreateFileW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale InterlockedDecrement VirtualProtect GetVersionExW CloseHandle GetTickCount GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange GetCurrentProcessId GetModuleHandleA FreeResource GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom FreeLibrary CompareStringW LoadLibraryA lstrcmpW GetVersionExA lstrlenA lstrcmpA GetLastError SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree MulDiv lstrlenW SetCurrentDirectoryW GetVersion GetPrivateProfileIntW WideCharToMultiByte GetModuleFileNameW GetPrivateProfileStringW WritePrivateProfileStringW GetModuleHandleW GetCurrentDirectoryW SetThreadLocale OutputDebugStringW GetProcAddress LoadLibraryW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar HeapDestroy

user32

GetNextDlgGroupItem MessageBeep UnregisterClassW DestroyMenu GetMessageW TranslateMessage ValidateRect GetDesktopWindow GetActiveWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog SetWindowContextHelpId MapDialogRect RegisterClipboardFormatW PostQuitMessage GetWindowThreadProcessId SetCursor SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW IsWindowEnabled ShowWindow MoveWindow SetWindowTextW IsDialogMessageW UnregisterClassA SetDlgItemTextW InvalidateRgn ReleaseDC GetDC RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW GetFocus IsWindow SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageW GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetForegroundWindow UpdateWindow GetMenu MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect PtInRect DefWindowProcW CallWindowProcW GetWindowLongW SetWindowLongW SetWindowPos SetRect IsRectEmpty CopyAcceleratorTableW CharNextW PostThreadMessageW ReleaseCapture IntersectRect SystemParametersInfoA SetCapture LoadCursorW GetSysColorBrush CharUpperW GetWindowPlacement GetWindow GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu InvalidateRect GetDlgCtrlID PostMessageW IsWindowVisible DrawIcon GetClientRect GetSystemMetrics IsIconic AppendMenuW GetSystemMenu GetWindowRect LoadIconW SendMessageW GetParent GetAsyncKeyState ScreenToClient OffsetRect EnableWindow GetCursorPos CopyRect GetSysColor RemovePropW

gdi32

SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC CreateBitmap GetStockObject GetMapMode GetBkColor GetTextColor GetRgnBox EnumFontFamiliesExW GetWindowExtEx GetViewportExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible GetDeviceCaps DeleteObject SetMapMode RestoreDC SaveDC CreateRectRgnIndirect GetObjectW SetBkColor SetTextColor GetClipBox PtVisible

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegSetValueExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegOpenKeyW

shell32

SHGetPathFromIDListW SHBrowseForFolderW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW PathFindExtensionW PathStripToRootW StrToIntExW PathIsUNCW

oledlg

OleUIBusyW

ole32

CoRevokeClassObject CoGetClassObject CoDisconnectObject CLSIDFromString CLSIDFromProgID OleInitialize CoFreeUnusedLibraries OleUninitialize CoTaskMemAlloc CoTaskMemFree OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal

oleaut32

SysFreeString SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy SysAllocString VariantCopy SysAllocStringLen VariantInit VariantChangeType VariantClear OleCreateFontIndirect LoadTypeLi SysStringLen

Reports/MP/F1/8ABA-MP-TC.log

SHA256 0a3c599937206ff4c6ac6ce183cfc8522791ff1a50d421ed25fb2d8f3ba2cff1
MD5 9ad47e37976cf52224cbf5b404b0d20a
SHA1 5657cf961c06d2834050176a630dff5dbb002ab3
SHA512 436039442d1968336602a486e0b4df6d9a9a3537bae880d71a7a23cd82f7ab9118fdb2ede973e68fc0f844577aa05105fe79db1c0b164a1832982c064a659f0b
MD5 SHA1 SHA512

Reports/MP/F1/Encode_LOGFILE-03-05-2015_MP-8ABA.psl

SHA256 999b091cf12cf2d660ecdc942eb492b46c33b91c60252162a0126ea422265485
MD5 70c7198573a0b8a814c4bd5d39c2b7cc
SHA1 ca2ce5ce96a3196e9bbc015d89e0a5b49131d79f
SHA512 fac481bf9acd718a7e10235ba78a5a35768136896c7640b8c946b7b1cd451e793e591f2118d2aba9ca62b9cef52eb79c51d228f6d0819b622fac57a04f28dc2e
MD5 SHA1 SHA512

Reports/MP/F1/LOGFILE-03-05-2015_MP-8ABA.txt

SHA256 b01d0f0b23a142f44d42b5943f0835d265ec2090b59e0bc3befc68d69b6a1625
MD5 d3f4a3ffc40d2f7b35d231eb2a0c83dd
SHA1 4d13009defd5db917f0768144fc7eb4adb284509
SHA512 4d49ea6db343cf2dda14a04f7cbdcf6dbfd3a1a4d07b26d380c6274dd994d61ee2bc27a3fd464e98bf49b938e27bd309a11b8a9f9294a69d32250b3bc9bb1707
MD5 SHA1 SHA512

Reports/MP/F1/Result-03-05-2015-MP-8ABA.txt

SHA256 0a3c599937206ff4c6ac6ce183cfc8522791ff1a50d421ed25fb2d8f3ba2cff1
MD5 9ad47e37976cf52224cbf5b404b0d20a
SHA1 5657cf961c06d2834050176a630dff5dbb002ab3
SHA512 436039442d1968336602a486e0b4df6d9a9a3537bae880d71a7a23cd82f7ab9118fdb2ede973e68fc0f844577aa05105fe79db1c0b164a1832982c064a659f0b
MD5 SHA1 SHA512

SERVER-8ABA.TXT

SHA256 040731d5f6dc70c4a918288742762cfa7d0853bc2132ac1af055aabcca678763
MD5 cf5a2b0b1506ef62d624e1825d1b0117
SHA1 523c77cd2fc436bac05c53bb416ca76bde1a8d7b
SHA512 72f05a318afa4a2845df8450bcdb81eb327317c14a5500f47b5a4bfdd223e5008eb3ed4406ec261e8ec9e3d29eef60355d5e56aa58324a58a2aa8623c4caa94a
MD5 SHA1 SHA512

inpout32.dll

IMPHASH f2c4ef3fdf4196d94dfada05f41104db
SHA256 2a08780ecd3a2c42bebda55d3eec3a69a417312e7a884f89b53aecad729b9af3
MD5 99ececb007d9d62941ac0edcdb4c265e
SHA1 eba4d9359ac906809a102695c9cc32be63e40058
SHA512 d9bbb9d63c7fa6327f5edcf142c64da990824a75a5783074cc95c2581378fdb5cef12d65c7e4663eeab15bde90978f4c1704aa0725c69bec4e01a754aff4a8e9
SSDEEP 768:0kKvTva8kE/dkfn3S4P+/+C2n3v8oLeZ9F:0kKvTvaXEmXPqG0oLe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5337

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

c81ad8df886df3fd8d31063a3b46e434_JaffaCakes118

03MLC816K.ini

03TLC.ini

BN03VNEW.bin

FW03(TLC)v010953.bin

FW03MLC 8 16 k NEW.bin

GetInfo.exe

hid

setupapi

kernel32

user32

comdlg32

version

comctl32

shlwapi

oledlg

gdi32

winspool.drv

advapi32

ole32

oleaut32

generic

HubMapping.ini

IDBLK_TIMING.dll

netapi32

ws2_32

mfc42

msvcrt

kernel32

msvcp60

generic

MP.ini

MPALL_F1_EC00_v363_0D.exe

inpout32

setupapi

shlwapi

version

netapi32

kernel32

winscard

ws2_32

rpcrt4

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

generic

MPALL_F2_v363_0D.exe

inpout32

setupapi

shlwapi

version

netapi32

kernel32

winscard

ws2_32

rpcrt4

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

generic

MPParamEdit_F1.exe

version

kernel32