259a8338469edafc01034e615351cd024bb62af4dbeeefbc399eeaccb7a2245a

Sharing

Copy URL Twitter E-mail

General

Target

259a8338469edafc01034e615351cd024bb62af4dbeeefbc399eeaccb7a2245a
Size

247KB
MD5

35c6ef0447ed8d177c05d0552b382707
SHA1

67b8c0d6bdf17f8175288587e643061bc3f21fe8
SHA256

259a8338469edafc01034e615351cd024bb62af4dbeeefbc399eeaccb7a2245a
SHA512

cb9a192a8876a61f2db1753e72678be4232070af0e0a2681ae4ade08c35ae8d3f5b021f387730e1c7f555fc0f288e05a74ad85ede0602786e89517d45e00cfe5
SSDEEP

3072:TYbqOMAlEY0mM1AaapW5KHCjq4ZSMkWEfmdBO6fdC9j5XzNOkC4C4C4CKC6C4CKF:Wq09gtdiXBOIn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
259a8338469edafc01034e615351cd024bb62af4dbeeefbc399eeaccb7a2245a

Files

259a8338469edafc01034e615351cd024bb62af4dbeeefbc399eeaccb7a2245a
.exe windows:5 windows x86 arch:x86

0d92396cf8c3043b8809a20e00506d46

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

787_custom_widgets

?ags_create_787_custom_widget@@YAPAVAGS_Widget@@W4A661_Widget_Type@@HPAVAGS_Container@@PAVAGS_Layer@@PAVAGS_Input_File@@@Z

ge

?set_ge@AGS_Display_List@@QAEXPAVAGS_GE@@@Z
??0AGS_Exec_Display_List@@QAE@W4AGS_Orientation@@HHHHH@Z
?set_global_resource_list@AGS_Resource_List@@SAXPAV1@@Z
?global_resource_list@AGS_Resource_List@@SAPAV1@XZ
??1AGS_Display_List@@QAE@XZ
?set_display_size@AGS_Display_List@@QAEXHH@Z
?set_display_context@AGS_Display_List@@QAEXPAX@Z
?set_scale_factor_xy@AGS_Display_List@@QAEXMM@Z
?shutdown_graphics@@YAXXZ
?startup_graphics@@YA_NXZ
??1AGS_Resource_List@@QAE@XZ
??1AGS_GE@@QAE@XZ
?create_from_XML@AGS_Resource_List@@SAPAV1@PBVAGS_XML_Element@@PAVAGS_GE@@@Z
?install_on_ge@AGS_Resource_List@@QAEXPAVAGS_GE@@@Z
??0AGS_GE@@QAE@PBVAGS_XML_Element@@HHW4AGS_Orientation@@@Z

input_devices

??0AGS_Cursor@@QAE@W4AGS_Side@@@Z
??0AGS_Tabber@@QAE@W4AGS_Side@@_N@Z
?exceeds_rate@AGS_Tabber@@UAE_NXZ
?set_rate@AGS_Tabber@@UAEXH@Z
?process_tabbing_delays@AGS_Tabber@@MAEXXZ
??1AGS_Tabber@@UAE@XZ
??1AGS_Cursor@@QAE@XZ

foundation

?ags_advance_state_to_software_running@@YAXXZ
?ascii2int@@YAHPBD@Z
?release_all_list_entries@@YAXXZ
?ags_software_state@@YA?AW4AGS_Software_State@@XZ
?read_from_file@AGS_XML_Element@@SAPAV1@PBD@Z
??0Error_Logger@@QAE@XZ
?end_of_file@AGS_Input_File@@QBE_NXZ
?ags_snprintf@@YAHPADIPBDPBX2222222@Z
?file_position@AGS_Input_File@@QBEHXZ
?get_32_bit_unsigned@AGS_Input_File@@QAEIXZ
?ags_error_logger@@3PAVError_Logger@@A
?get_16_bit_unsigned@AGS_Input_File@@QAEGXZ
??1AGS_Input_File@@QAE@XZ
?ags_sprintf@@YAHPADPBDPBX2222222@Z
?get_32_bit_signed@AGS_Input_File@@QAEHXZ
?is_open@AGS_Input_File@@QBE_NXZ
??0AGS_Input_File@@QAE@PBD@Z
?ags_expand_environment_variables@@YAPBDPBD@Z
?get_char@AGS_Input_File@@QAEDXZ
?ags_log_message@@YAXW4AGS_Error_Level@@GPBD@Z
?ags_time_since_startup@@YAIXZ
??1Error_Logger@@QAE@XZ
??2AGS_Object@@SAPAXI@Z
??3AGS_Object@@SAXPAX@Z
?check_invariants@AGS_Object@@UBEXXZ
?post_initialization@AGS_Object@@UAEXPAX@Z
?ags_timer_read@@YAIXZ
?get_8_bit_unsigned@AGS_Input_File@@QAEEXZ
?ags_timer_compare@@YAIII@Z
?release_all_nodes@AGS_XML_Element@@SAXPAV1@@Z

ags_rudp

?rudp_reset_rx_port@@YAXH@Z
?rudp_reset_tx_port@@YAXH@Z
?rudp_set_loopback_health@@YAXH_N@Z
?rudp_send_data@@YAXH@Z
?rudp_connection_alive_and_available@@YAXHAA_N00@Z
?rudp_receive_data@@YAHHPAPADAAHAA_NAAW4AGS_Port_Health@@_N@Z
?rudp_register_tx_port@@YAHHPADH@Z
?rudp_register_rx_port@@YAHHPADH@Z
?rudp_begin_group@@YAXH_N@Z
?rudp_initialize@@YAXXZ
?rudp_terminate@@YAXXZ
?rudp_queue_data@@YA_NPBDHH@Z
?rudp_end_group@@YAXH@Z

ags_framework

?set_all_layers_invisible@AGS_Application@@UAEXXZ
??0AGS_Application@@QAE@XZ
?process_received_661_data@AGS_Application@@UAEXPAXH@Z
?add_layer@AGS_Application@@UAE_NPAVAGS_Layer@@@Z
?remove_held_layers@AGS_Application@@UAEXXZ
?has_visible_layer@AGS_Application@@UAE_NXZ
?find_layer_with_id@AGS_Application@@UAEPAVAGS_Layer@@H@Z
?hold_visibilty_state@AGS_Application@@UAEXXZ
?_window_manager@AGS_Display_Root@@1PAVAGS_Application@@A
?AGS_cycle@@3IA
?master_layer@AGS_Display_Root@@2PAVAGS_Layer@@A
?reset_io_time@AGS_Layer@@SAXXZ
?AGS_One_Second_Counter@@3IA
??0AGS_Display_Cursor@@QAE@PAVAGS_Cursor@@PAVAGS_GE@@PAVAGS_Display_Root@@@Z
?cyclic_processing@AGS_Display_Cursor@@UAEXXZ
?set_pos_x@AGS_Display_Cursor@@UAEXH_N@Z
?set_pos_y@AGS_Display_Cursor@@UAEXH_N@Z
?move_to_widget@AGS_Display_Cursor@@UAEXPAVAGS_Widget@@_N@Z
?move_to_position@AGS_Display_Cursor@@UAEXHH_N@Z
?_layer_count@AGS_Layer@@2HA
?_layer_list@AGS_Layer@@2PAPAV1@A
??1AGS_Display_Cursor@@QAE@XZ
?AGS_draw_cycle@@3IA
?_scratchpad@AGS_Display_Root@@1PAY0BJ@DA
??1AGS_Display_Root@@QAE@XZ
??1AGS_Layer@@QAE@XZ
??1AGS_Basic_Container@@QAE@XZ
?ags_create_framework_widget@@YAPAVAGS_Widget@@W4A661_Widget_Type@@HPAVAGS_Container@@PAVAGS_Layer@@PAVAGS_Input_File@@@Z
??0AGS_Display_Root@@QAE@W4AGS_Orientation@@HHHH@Z
??0AGS_Window@@QAE@HPAVAGS_Container@@PAVAGS_Layer@@@Z
??0AGS_Points_To_Ref_Struct@@QAE@HH@Z
??0AGS_Layer@@QAE@HPAVAGS_Container@@PAVAGS_Application@@H@Z
??1AGS_Application@@QAE@XZ
??0AGS_Basic_Container@@QAE@HPAVAGS_Container@@PAVAGS_Layer@@@Z

ags_widgets

?install_sdl_symbols_on_ge@AGS_SDL_Symbol@@SAXPAVAGS_Display_Root@@PAVAGS_GE@@@Z
?ags_create_widget@@YAPAVAGS_Widget@@W4A661_Widget_Type@@HHPAVAGS_Container@@PAVAGS_Layer@@PAVAGS_Input_File@@@Z
?add_layer_for_current_range@AGS_SDL_Symbol@@SAXPAVAGS_Layer@@@Z
?set_anchor@AGS_SDL_Symbol@@QAEXHH@Z
?ags_create_sdl_widget@@YAPAVAGS_GP_Shape@@W4A661_Widget_Type@@HPAVAGS_Container@@PAVAGS_Layer@@PAVAGS_Input_File@@AAHG@Z
??0AGS_SDL_Symbol@@QAE@H@Z
?_symbol_added@AGS_SDL_Symbol@@2_NA
?set_symbol_indeces@AGS_SDL_Symbol@@SAXXZ

gdiplus

GdipDisposeImage
GdipAlloc
GdipDeleteBrush
GdipDeleteGraphics
GdipImageRotateFlip
GdipCloneImage
GdipCloneBrush
GdipDrawImageRectI
GdipFillRectangleI
GdipCreateFromHDC
GdipCreateSolidFill
GdipCreateBitmapFromHBITMAP
GdipFree

mfc90

ord2616
ord2618
ord2620
ord2614
ord2630
ord2610
ord969
ord965
ord967
ord963
ord958
ord5666
ord5668
ord6446
ord1729
ord4683
ord2375
ord3732
ord1384
ord2369
ord5638
ord4589
ord6780
ord5497
ord2074
ord5581
ord4650
ord1497
ord4330
ord1752
ord1755
ord6391
ord3346
ord1684
ord4415
ord2645
ord2646
ord3278
ord5786
ord978
ord6361
ord3222
ord6359
ord3221
ord5323
ord3224
ord4539
ord4716
ord5435
ord5432
ord2855
ord2079
ord2445
ord5339
ord4970
ord4706
ord1222
ord5598
ord4572
ord2592
ord2069
ord415
ord613
ord337
ord2254
ord2368
ord6557
ord2481
ord817
ord4392
ord820
ord4481
ord1490
ord1884
ord3994
ord1062
ord2691
ord3910
ord5607
ord6476
ord6585
ord5005
ord4975
ord5480
ord3534
ord2106
ord3477
ord1358
ord1357
ord6074
ord6554
ord2587
ord768
ord367
ord567
ord4679
ord1444
ord3218
ord6356
ord3670
ord4688
ord5647
ord5584
ord4331
ord4364
ord5278
ord5281
ord4786
ord4791
ord4788
ord4806
ord4808
ord4793
ord5194
ord4585
ord4576
ord2633
ord5199
ord4608
ord5209
ord4850
ord4851
ord4095
ord636
ord2097
ord2874
ord5081
ord4018
ord2143
ord4474
ord617
ord341
ord1611
ord3178
ord6613
ord305
ord3213
ord5835
ord329
ord3476
ord960
ord1547
ord5792
ord6086
ord5232
ord5285
ord5162
ord4570
ord4695
ord4654
ord1616
ord5795
ord6102
ord610
ord1353
ord3939
ord593
ord4982
ord5660
ord795
ord2448
ord3980
ord1644
ord6784
ord4160
ord6782
ord3671
ord5389
ord6355
ord3217
ord1446
ord2139
ord1792
ord1791
ord1728
ord5633
ord3135
ord4895
ord4671
ord670
ord3808
ord5122
ord650
ord4979
ord2854
ord2862
ord6742
ord2204
ord2239
ord5589
ord6027
ord1466
ord5844
ord3004
ord5928
ord4663
ord5270
ord5156
ord2090
ord4627
ord3331
ord3030
ord6419
ord6533
ord4891
ord4670
ord388
ord3991
ord3792
ord4029
ord4375
ord4981
ord1607
ord6462
ord570
ord994
ord5552
ord5658
ord6291
ord6584
ord1137
ord4431
ord5963
ord6148
ord2447
ord793
ord4434
ord4409
ord6783
ord4159
ord6781
ord4733
ord2628
ord2612
ord2635
ord2623
ord2605
ord2607
ord5403
ord2625
ord2251
ord2206
ord6018
ord4165
ord1046
ord5533
ord6721
ord5813
ord4199
ord2087
ord3209
ord5657
ord5659
ord4333
ord5663
ord5646
ord6001
ord2766
ord2978
ord3107
ord4714
ord2961
ord3110
ord2769
ord2888
ord2759
ord4066
ord4067
ord4057
ord2886
ord4334
ord4890
ord4667
ord3659
ord589
ord300
ord310
ord1667
ord2651
ord1144
ord1260
ord3579
ord579
ord1339
ord4311
ord780
ord910
ord1183
ord316
ord2539
ord601
ord798
ord800
ord6352
ord5139
ord1276

msvcr90

_stricmp
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
strncpy
_ftime64_s
_ctime64
fopen
malloc
free
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
strtok
atoi
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
strstr
memset
isalnum
toupper
printf
sprintf
memcpy
__CxxFrameHandler3
_setmbcp

kernel32

CreateMutexA
WaitForSingleObject
ReleaseMutex
Sleep
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
SetThreadPriority
TerminateThread
GetSystemInfo
GetCurrentProcess
SetProcessAffinityMask
GetModuleFileNameA
SetCurrentDirectoryA
GetLastError
FormatMessageA
MulDiv

user32

SetParent
GetWindowTextA
RealGetWindowClassA
EnumChildWindows
GetDesktopWindow
LoadCursorA
ClientToScreen
ScreenToClient
EnableWindow
SetCursor
GetClientRect
CloseWindow
IsWindow
InvalidateRect
UpdateWindow
BringWindowToTop
PostMessageA
SendMessageA
GetDC
GetKeyState
GetSystemMetrics
ReleaseDC
LoadStringA

gdi32

CreateDiscardableBitmap
CreateCompatibleDC
DPtoLP
SetWindowOrgEx
SetMapMode
DeleteObject
LPtoDP
GetDeviceCaps

ws2_32

inet_addr
htons
getaddrinfo
WSAGetLastError
gethostname

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

winmm

timeEndPeriod
timeBeginPeriod

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 144KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d92396cf8c3043b8809a20e00506d46

Headers

DLL Characteristics

File Characteristics

Imports

787_custom_widgets

ge

input_devices

foundation

ags_rudp

ags_framework

ags_widgets

gdiplus

mfc90

msvcr90

kernel32

user32

gdi32

ws2_32

msvcp90

winmm

Sections

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 144KB - Virtual size: 152KB

.rsrc Size: 13KB - Virtual size: 12KB

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 144KB - Virtual size: 152KB

.rsrc
Size: 13KB - Virtual size: 12KB