b1dbae3825ab46df4efc4ae0222f6a540ae34c86c14bc88b1707b4cf6fad11a0N

Sharing

Copy URL Twitter E-mail

General

Target

b1dbae3825ab46df4efc4ae0222f6a540ae34c86c14bc88b1707b4cf6fad11a0N
Size

137KB
MD5

5e4905449779fd22a0ecc333137b34e0
SHA1

4be2fdfb82ee8add26652d3fdbf8a1d27355c0b5
SHA256

b1dbae3825ab46df4efc4ae0222f6a540ae34c86c14bc88b1707b4cf6fad11a0
SHA512

c4ffcaef70a97d5eb228a89cf4fb8aca62784cba65f5141c150966e2d59736d39a6e075441c1efe8eed4231589564c55eba8fdd908cf9233ada3c7404ec46ae6
SSDEEP

3072:Wg+wz6A99Tpyd2GQMyBm1k553sr4TSh/r7h7xhrDLp:W66AR02GQMyb5hsdh7xt/p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cmdial32.dll

Files

b1dbae3825ab46df4efc4ae0222f6a540ae34c86c14bc88b1707b4cf6fad11a0N
.cab
cmdial32.dll
.dll windows:5 windows x86 arch:x86

af049a166893980b87ecc1cdaa0a4186

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cmdial32.pdb

Imports

ntdll

RtlUnwind

cmpbk32

PhoneBookGetPhoneDescA
PhoneBookGetPhoneCanonicalA
PhoneBookGetPhoneNonCanonicalA
PhoneBookGetPhoneDUNA
PhoneBookFreeFilter
PhoneBookParseInfoA
PhoneBookGetCountryNameA
PhoneBookGetCountryId
PhoneBookGetCountryNameW
PhoneBookEnumCountries
PhoneBookGetCurrentCountryId
PhoneBookGetRegionNameA
PhoneBookEnumRegions
PhoneBookGetPhoneDispA
PhoneBookMatchFilter
PhoneBookGetPhoneType
PhoneBookEnumNumbers
PhoneBookEnumNumbersWithRegionsZero
PhoneBookHasPhoneType
PhoneBookCopyFilter
PhoneBookUnload
PhoneBookLoad

cmutil

CmFree
CmMalloc
CmConvertRelativePathW
?GetFile@CIniW@@QBEPBGXZ
CmStrCpyAllocW
CmStrTrimW
CmStrrchrW
CmStrCatAllocW
CmStrchrW
?GPPI@CIniW@@QBEKPBG0K@Z
?GPPS@CIniW@@QBEPAGPBG00@Z
WzToSzWithAlloc
IsLogonAsSystem
CmFmtMsgW
?Log@CmLogFile@@QAAXW4_CMLOG_ITEM@@ZZ
GetOSVersion
CmLoadStringW
GetOSMajorVersion
CmStrStrA
CmCompareStringA
GetOSBuildNumber
?GPPB@CIniW@@QBEHPBG0H@Z
?SetICSDataPath@CIniW@@QAEXPBG@Z
?SetReadICSData@CIniW@@QAEXH@Z
?SetEntryFromIdx@CIniW@@QAEXK@Z
??0CIniW@@QAE@PAUHINSTANCE__@@PBG111@Z
?GetHInst@CIniW@@QBEPAUHINSTANCE__@@XZ
?GetRegPath@CIniW@@QBEPBGXZ
?WPPB@CIniW@@QAEXPBG0H@Z
?WPPI@CIniW@@QAEXPBG0K@Z
?WPPS@CIniW@@QAEXPBG00@Z
?SetWriteICSData@CIniW@@QAEXH@Z
CmAtolW
CmBuildFullPathFromRelativeW
CmLoadSmallIconW
CmLoadIconW
CmParsePathW
CmStrStrW
CmWinHelp
?LoadSection@CIniW@@QBEPAGPBG@Z
?SetSection@CIniW@@QAEXPBG@Z
?SetRegPath@CIniW@@QAEXPBG@Z
?SetPrimaryRegPath@CIniW@@QAEXPBG@Z
UpdateFont
?DeInit@CmLogFile@@QAEJXZ
CmIsDigitW
?Stop@CmLogFile@@QAEJXZ
?Start@CmLogFile@@QAEJH@Z
?SetParams@CmLogFile@@QAEJHKPBG@Z
?Clear@CmLogFile@@QAEXH@Z
CmLoadImageW
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBG@Z
?SetPrimaryFile@CIniW@@QAEXPBG@Z
?SetFile@CIniW@@QAEXPBG@Z
?SetHInst@CIniW@@QAEXPAUHINSTANCE__@@@Z
?Clear@CIniW@@QAEXXZ
CmStripFileNameW
CmStripPathAndExtW
SzToWzWithAlloc
CmStrCpyAllocA
CmStrCatAllocA
CmStrtokW
?SetEntry@CIniW@@QAEXPBG@Z
WzToSz
CmRealloc
CmIsSpaceW
?GetSection@CIniW@@QBEPBGXZ
??1CIniW@@QAE@XZ

advapi32

CreateProcessAsUserW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
FreeSid
AllocateAndInitializeSid
OpenThreadToken
RegSetValueExA
RegQueryValueExW
RegOpenKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetUserNameW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExA
GetLengthSid
AdjustTokenPrivileges

gdi32

DeleteObject
GetDeviceCaps
GetDIBits
GetObjectA
CreatePalette
CreateDIBitmap
RealizePalette
SelectPalette
DeleteDC
StretchBlt
SetStretchBltMode
SelectObject
CreateCompatibleDC
GetStockObject
UnrealizeObject

kernel32

GetLocaleInfoA
GetStringTypeW
GetStringTypeA
SetFilePointer
InitializeCriticalSection
GetCPInfo
GetOEMCP
GetACP
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualQuery
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetStdHandle
SetHandleCount
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
ExitProcess
GetProcessHeap
HeapAlloc
GetVersionExA
HeapFree
GetCommandLineA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
GlobalReAlloc
GlobalUnlock
GlobalFree
GlobalAlloc
GlobalLock
LCMapStringA
LCMapStringW
SetStdHandle
VirtualProtect
GetSystemInfo
FlushFileBuffers
GetFileType
CompareStringW
UnmapViewOfFile
MapViewOfFile
InterlockedDecrement
GetVolumeInformationA
InterlockedIncrement
WritePrivateProfileStringW
SearchPathW
OpenFileMappingW
OpenEventW
LoadLibraryExW
GetVersionExW
GetTimeFormatW
GetTempPathW
GetTempFileNameW
GetStringTypeExW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleW
GetModuleFileNameW
GetFileAttributesW
GetDateFormatW
FindResourceExW
DeleteFileW
CreateMutexW
CreateFileMappingW
CreateEventW
GlobalSize
FreeEnvironmentStringsA
lstrlenW
CloseHandle
CreateProcessW
FreeLibrary
GetProcAddress
GetCurrentThreadId
GetLastError
GetCurrentProcess
LoadLibraryExA
CreateProcessA
lstrcpyA
lstrcatA
GetWindowsDirectoryA
lstrcmpA
GetModuleHandleA
OpenProcess
Sleep
GetTickCount
SetEvent
WritePrivateProfileStringA
DuplicateHandle
GetCurrentProcessId
WaitForSingleObject
lstrcpynW
lstrcpyW
InterlockedExchange
SetLastError
lstrcmpiW
WideCharToMultiByte
GetFileAttributesA
lstrlenA
Beep
CreateFileW
LoadLibraryW
MulDiv
CompareFileTime
GetFileTime
SetFileTime
SystemTimeToFileTime
GetSystemTime
ExpandEnvironmentStringsW
LocalFree
FormatMessageW
CreateDirectoryW
SetCurrentDirectoryW
GetCurrentDirectoryW
FindNextFileW
FindClose
FindFirstFileW
SetFileAttributesW
CopyFileW
IsBadReadPtr
DisableThreadLibraryCalls
GetPrivateProfileSectionW
GetSystemDirectoryW
GetCurrentThread
lstrcatW
ReleaseMutex
MultiByteToWideChar
lstrcmpW
LocalAlloc
LoadLibraryA
OutputDebugStringW
GetPrivateProfileStringA
CreateThread
lstrcpynA
GlobalHandle

user32

ExitWindowsEx
CallWindowProcW
CharLowerW
CharPrevW
CharUpperW
CreateDialogParamW
CreateWindowExW
DefWindowProcW
DialogBoxParamW
DispatchMessageW
FindWindowExW
GetClassLongW
GetMessageW
GetWindowLongW
GetWindowTextW
GetWindowTextLengthW
InsertMenuW
IsDialogMessageW
LoadCursorW
LoadIconW
LoadImageW
LoadMenuW
LoadStringW
PeekMessageW
PostThreadMessageW
RegisterClassExW
RegisterWindowMessageW
SetWindowLongW
SetWindowTextW
UnregisterClassW
WinHelpW
wvsprintfW
GetClassInfoExA
RegisterClassExA
LoadStringA
EnumWindows
ShowWindowAsync
GetWindowTextA
SendMessageW
SendMessageA
ChildWindowFromPointEx
GetDlgCtrlID
SetActiveWindow
DestroyWindow
PostQuitMessage
CharNextW
SendDlgItemMessageA
InvalidateRect
GetDC
ReleaseDC
GetDlgItemInt
SetDlgItemInt
MessageBoxW
IsDlgButtonChecked
BeginPaint
EndPaint
MapWindowPoints
SetWindowPos
GetClientRect
IsWindowEnabled
ChildWindowFromPoint
SetDlgItemTextA
SetForegroundWindow
SystemParametersInfoA
GetSystemMenu
DeleteMenu
EnableMenuItem
SetTimer
KillTimer
IsWindow
GetWindowThreadProcessId
GetWindowRect
ScreenToClient
MoveWindow
SendDlgItemMessageW
GetDlgItemTextW
SetDlgItemTextW
CheckDlgButton
wsprintfA
PostMessageW
ShowCursor
TranslateMessage
GetCursor
SetCursor
UpdateWindow
IsWindowVisible
ShowWindow
GetDlgItem
EndDialog
MessageBoxExW
MsgWaitForMultipleObjects
GetThreadDesktop
GetParent
EnableWindow
GetFocus
SetFocus
wsprintfW
GetUserObjectInformationW

ole32

CoInitialize
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoTaskMemFree

shell32

SHFileOperationW

Exports

Exports

AutoDialFunc
CmCustomDialDlg
CmCustomHangUp
CmReConnect
GetCustomProperty
InetDialHandler
RasCustomDeleteEntryNotify
RasCustomDial
RasCustomDialDlg
RasCustomEntryDlg
RasCustomHangUp
_AutoDialFunc@16
_InetDialHandler@16

Sections

.text
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af049a166893980b87ecc1cdaa0a4186

Headers

File Characteristics

PDB Paths

Imports

ntdll

cmpbk32

cmutil

advapi32

gdi32

kernel32

user32

ole32

shell32

Exports

Exports

Sections

.text Size: 199KB - Virtual size: 199KB

.data Size: 3KB - Virtual size: 11KB

.rsrc Size: 117KB - Virtual size: 117KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 199KB - Virtual size: 199KB

.data
Size: 3KB - Virtual size: 11KB

.rsrc
Size: 117KB - Virtual size: 117KB

.reloc
Size: 13KB - Virtual size: 12KB