48dbb620517623762377fbf33330e56a7edaee7dffeb126f6b47794a46d9dbb3

Sharing

Copy URL Twitter E-mail

General

Target

48dbb620517623762377fbf33330e56a7edaee7dffeb126f6b47794a46d9dbb3
Size

2.1MB
MD5

e669264e8b6ea56ded0556364e2dd520
SHA1

4756b6cf28e04852779f04450317034fce2d3ae1
SHA256

48dbb620517623762377fbf33330e56a7edaee7dffeb126f6b47794a46d9dbb3
SHA512

943281da0c7481bc89455b44add36a0f21b5e487860eb213dd92e0eb8a6f8094fab2e0413b6b563b449834746874fa254111a9ae55a156e0027dcac34ec637f8
SSDEEP

24576:vCJP8XYPOUKiJSRqU+Uh/LT56oFhD5ZQkHh5FURTHMzvIl5TIvIl5TIvIl5T3Ik6:vC98n6Ihbl7PkTsEVVDIklYnfp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48dbb620517623762377fbf33330e56a7edaee7dffeb126f6b47794a46d9dbb3

Files

48dbb620517623762377fbf33330e56a7edaee7dffeb126f6b47794a46d9dbb3
.exe windows:5 windows x86 arch:x86

62a807b478e7db8db9d6155078e5f71e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\winapps\gu6\exe\vc\Undelete\sourcecode\Release\FileUndelete.pdb

Imports

mfc90u

ord4347
ord4996
ord5680
ord5663
ord6018
ord3115
ord4905
ord3670
ord2447
ord791
ord6482
ord1098
ord4211
ord794
ord589
ord4043
ord4967
ord778
ord2676
ord2551
ord4741
ord4046
ord6760
ord6552
ord633
ord3511
ord1674
ord2470
ord3741
ord6577
ord1603
ord4519
ord6659
ord6013
ord1298
ord5632
ord4631
ord5324
ord2208
ord1810
ord1809
ord1675
ord3353
ord6408
ord1492
ord4682
ord5653
ord4774
ord5167
ord6275
ord6579
ord5008
ord2904
ord4000
ord1938
ord710
ord462
ord750
ord3627
ord1708
ord1779
ord639
ord374
ord3794
ord3768
ord2360
ord3933
ord4398
ord1607
ord285
ord3061
ord3165
ord1254
ord4010
ord6780
ord1047
ord6065
ord613
ord337
ord4131
ord6666
ord5078
ord4527
ord4044
ord790
ord586
ord611
ord3489
ord3286
ord4652
ord1665
ord2274
ord334
ord6527
ord2069
ord744
ord524
ord2593
ord333
ord4036
ord785
ord595
ord2139
ord5625
ord5404
ord1433
ord5428
ord1423
ord1430
ord4661
ord5622
ord5322
ord6636
ord3143
ord616
ord1668
ord1769
ord3776
ord615
ord3496
ord4654
ord1667
ord2277
ord4510
ord1601
ord2103
ord3775
ord5676
ord5373
ord6338
ord3381
ord3383
ord3156
ord4035
ord779
ord576
ord3934
ord1166
ord6172
ord2206
ord792
ord587
ord3637
ord2907
ord400
ord3646
ord3559
ord2953
ord2959
ord5943
ord306
ord601
ord2695
ord936
ord2081
ord899
ord3515
ord4815
ord6424
ord4268
ord4262
ord2267
ord5947
ord4516
ord782
ord580
ord6170
ord6514
ord2490
ord665
ord406
ord4265
ord2628
ord5664
ord6800
ord5602
ord4663
ord1722
ord1786
ord3940
ord935
ord1599
ord2478
ord2479
ord5979
ord4490
ord4518
ord4405
ord293
ord6524
ord4320
ord5802
ord4396
ord2078
ord2289
ord2297
ord2288
ord2269
ord2265
ord2227
ord3355
ord6411
ord1754
ord1751
ord4345
ord1493
ord4664
ord5595
ord2909
ord3146
ord3167
ord6349
ord4270
ord3183
ord6426
ord5182
ord2074
ord5512
ord6794
ord4603
ord2057
ord3665
ord3282
ord585
ord788
ord2595
ord4543
ord2901
ord3654
ord5652
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord5674
ord3217
ord2087
ord4213
ord5830
ord6741
ord5548
ord1048
ord4179
ord6035
ord2726
ord3742
ord3842
ord3685
ord693
ord4658
ord6273
ord2640
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord1943
ord2042
ord775
ord3651
ord1716
ord1783
ord6686
ord814
ord4660
ord1719
ord2283
ord2146
ord5851
ord6604
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2141
ord2243
ord6204
ord339
ord4174
ord6804
ord3682
ord6376
ord3226
ord1442
ord2137
ord1792
ord1791
ord1727
ord5650
ord2771
ord2983
ord3112
ord4728
ord2966
ord5938
ord2284
ord1784
ord1720
ord290
ord3140
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4910
ord4681
ord3630
ord3589
ord5767
ord1243
ord6811
ord5778
ord6822
ord3220
ord525
ord2469
ord4410
ord4541
ord6094
ord938
ord3231
ord1357
ord1108
ord4451
ord3149
ord1723
ord286
ord2597
ord1144
ord2097
ord6096
ord799
ord3537
ord6547
ord6187
ord1063
ord1088
ord1137
ord2263
ord6095
ord811
ord3622
ord3488
ord2592
ord2596
ord265
ord266
ord2130
ord3577
ord2282
ord4615
ord4512
ord757
ord553
ord280
ord2326
ord813
ord686
ord436
ord1248
ord6091
ord1354
ord1353
ord3543
ord2106
ord1250
ord296
ord600
ord2537
ord1272
ord1183
ord3486
ord636
ord367
ord801

msvcr90

memcpy
realloc
memset
floor
_strnicmp
__CxxFrameHandler3
fopen
_CIsqrt
strncpy
sprintf
_CIpow
_CxxThrowException
_swab
_setjmp3
__CxxLongjmpUnwind
longjmp
strncmp
_CIcos
_CIsin
ldiv
_CIexp
_CIfmod
qsort
rand
ceil
_CIlog
isprint
printf
fprintf
__iob_func
sscanf
getenv
_snprintf
abort
_gmtime64
strtod
strlen
strcpy
memmove
pow
exp
log
sqrt
fabs
atan2
strstr
_stricmp
putc
strchr
_getcwd
_errno
isspace
isdigit
fgetc
perror
atoi
atof
tmpfile
isupper
strrchr
tmpnam
vsprintf
isalpha
vfprintf
strtok
_read
_write
_lseek
_unlink
_close
_open
_setmode
_wfopen
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
wcstod
_wtof
_time64
__wargv
__argc
_mktime64
swscanf
_localtime64_s
wcsftime
_wcsnicmp
_resetstkoflw
wcstol
wcsstr
_purecall
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
_wcsicmp
fscanf
fgets
getc
fputc
ferror
feof
fflush
ftell
fseek
fwrite
fread
fclose
calloc
_recalloc
memmove_s
memcpy_s
free
malloc

kernel32

TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
UnhandledExceptionFilter
GlobalFree
LocalFree
GetCommandLineW
GetVersionExW
SetLastError
GetLastError
IsDebuggerPresent
GetCurrentProcess
LoadLibraryW
ResumeThread
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleW
GetProcAddress
lstrlenW
FreeLibrary
CloseHandle
CreateThread
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
GetVersion
MulDiv
GlobalAlloc
LocalFileTimeToFileTime
SystemTimeToFileTime
lstrcmpW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
WaitForSingleObject
DeleteFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemDirectoryW
lstrcpynW

user32

DrawStateW
GetWindowDC
UpdateWindow
TrackMouseEvent
MessageBoxW
GetComboBoxInfo
IsWindow
IsWindowVisible
SetWindowLongW
UnionRect
GetMenuBarInfo
CheckMenuItem
EnableMenuItem
EnumChildWindows
GetClassNameW
SetWindowPos
SetDlgItemTextW
GetFocus
GetMessagePos
DrawIcon
IsIconic
LoadIconW
ReleaseCapture
SetCapture
GetCursorPos
LoadMenuW
SetRectEmpty
KillTimer
SetTimer
ScreenToClient
GetIconInfo
DrawFocusRect
OffsetRect
InflateRect
FrameRect
PostMessageW
GetWindowRect
ClientToScreen
InvalidateRect
LoadCursorW
SetCursor
GetParent
GetWindowLongW
PtInRect
RedrawWindow
GetClientRect
SendMessageW
EnableWindow
GetSubMenu
CreateMenu
GetMenuItemID
GetMenuState
ModifyMenuW
InsertMenuW
GetMenuItemCount
AppendMenuW
ReleaseDC
GetDC
GetDesktopWindow
GetSystemMetrics
DestroyIcon
DrawTextW
GetMenuItemInfoW
SetRect
DrawEdge
FillRect
GetSysColor
CopyRect

gdi32

StretchBlt
GetStockObject
SetBkColor
GetCurrentObject
GetTextMetricsW
GetDIBColorTable
SetDIBColorTable
CreateFontW
CreateRoundRectRgn
DeleteEnhMetaFile
SetBrushOrgEx
FillRgn
FrameRgn
BeginPath
EndPath
FillPath
SetTextColor
GetDIBits
GetEnhMetaFileHeader
SetEnhMetaFileBits
PlayEnhMetaFile
SelectPalette
CreatePalette
GetEnhMetaFilePaletteEntries
ExtTextOutA
SetBkMode
RealizePalette
RestoreDC
SetDIBitsToDevice
SetStretchBltMode
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
SaveDC
SetWinMetaFileBits
CreatePatternBrush
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetDeviceCaps
CreateSolidBrush
CreatePen
GetBkMode
CreateFontIndirectW
GetTextExtentPoint32W
CreateDIBSection
SelectObject
DeleteObject
GetObjectW

msimg32

AlphaBlend
GradientFill
TransparentBlt

advapi32

RegCloseKey

shell32

SHBrowseForFolderW
ShellExecuteW
SHGetPathFromIDListW
CommandLineToArgvW
SHGetSpecialFolderLocation
SHGetFileInfoW

comctl32

_TrackMouseEvent
InitCommonControlsEx

shlwapi

ColorAdjustLuma

oleaut32

VariantTimeToSystemTime
SysFreeString
SystemTimeToVariantTime

msvcp90

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

gdiplus

GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipCloneImage
GdipAlloc
GdipFree
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdiplusShutdown
GdiplusStartup

guwndmanager

WindowsPosInitialize
WindowsPosHookWnd

languages

ord8
ord5
ord3
ord6
ord4

undelete

ScanAllFile
FindItemFile
IsScanAllFileStop
StopScanAllFileThread
RecoverFileByFileNumberList
IsRecoverFileThreadStop
StopRecoverFileThread
GetFileTreeByParentId
GetFileInfoToMemoryEx
StopFindThread

scanfile

MatchMask

register

GoHelp
OpenURL

skinsmanager

GetSkinsColor
GetSkinsToInt
GetSkinsOption
GetSkinsFile
GetAllKeyArrBySection
InitializeLibrary
InitializeSkins

uxtheme

DrawThemeBackground
CloseThemeData
SetWindowTheme
OpenThemeData

crashreport

ord1

config

ord12
ord3
ord1
ord13
ord11
GUCIsSeparate

checkupdate

ord6

ws2_32

htonl
ntohl
htons
ntohs

Exports

Exports

??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??0CxMemFile@@QAE@ABV0@@Z
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??1CxImage@@UAE@XZ
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??4CxMemFile@@QAEAAV0@ABV0@@Z
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_7CxImage@@6B@
??_7CxMemFile@@6B@
??_FCxIOFile@@QAEXXZ
??_FCxImage@@QAEXXZ
??_FCxMemFile@@QAEXXZ
??_OCxImage@@QAEXAAV0@@Z
?Close@CxIOFile@@UAE_NXZ
?Eof@CxIOFile@@UAE_NXZ
?Error@CxIOFile@@UAEJXZ
?Flush@CxIOFile@@UAE_NXZ
?GetC@CxIOFile@@UAEJXZ
?GetS@CxIOFile@@UAEPADPADH@Z
?Open@CxIOFile@@QAE_NPB_W0@Z
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Scanf@CxIOFile@@UAEJPBDPAX@Z
?Seek@CxIOFile@@UAE_NJH@Z
?Size@CxIOFile@@UAEJXZ
?Tell@CxIOFile@@UAEJXZ
?Write@CxIOFile@@UAEIPBXII@Z

Sections

.text
Size: 1009KB - Virtual size: 1008KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 14KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 690KB - Virtual size: 690KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 133KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

62a807b478e7db8db9d6155078e5f71e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc90u

msvcr90

kernel32

user32

gdi32

msimg32

advapi32

shell32

comctl32

shlwapi

oleaut32

msvcp90

gdiplus

guwndmanager

languages

undelete

scanfile

register

skinsmanager

uxtheme

crashreport

config

checkupdate

ws2_32

Exports

Exports

Sections

.text Size: 1009KB - Virtual size: 1008KB

.rdata Size: 246KB - Virtual size: 245KB

.data Size: 14KB - Virtual size: 43KB

.rsrc Size: 690KB - Virtual size: 690KB

.reloc Size: 133KB - Virtual size: 136KB

.text
Size: 1009KB - Virtual size: 1008KB

.rdata
Size: 246KB - Virtual size: 245KB

.data
Size: 14KB - Virtual size: 43KB

.rsrc
Size: 690KB - Virtual size: 690KB

.reloc
Size: 133KB - Virtual size: 136KB