f667be1389de32bd228e98be3e563d28f8c685b0e02075c8ff7b916de8c91037

Sharing

Copy URL Twitter E-mail

General

Target

f667be1389de32bd228e98be3e563d28f8c685b0e02075c8ff7b916de8c91037
Size

704KB
MD5

88f1e8e23cd1d930cca94bdaecd193be
SHA1

965087b0ae77a5e7d5c0a215c6bc8ee6c2ba23af
SHA256

f667be1389de32bd228e98be3e563d28f8c685b0e02075c8ff7b916de8c91037
SHA512

9d1af4c08038a319ea81b6f42ecfb0df9368dd1c5f7741b667a12284bff24fc7494110ba81ea9f4d8c72de02a060d5fa65c26ecf700939a8cca78c95ce6387e7
SSDEEP

12288:4WfYZQeczGn/sC9T0LAy0wh+2sg0xTPwT1FN:4eYZfczKo0A+2d0xT4hFN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f667be1389de32bd228e98be3e563d28f8c685b0e02075c8ff7b916de8c91037

Files

f667be1389de32bd228e98be3e563d28f8c685b0e02075c8ff7b916de8c91037
.exe windows:5 windows x86 arch:x86

aacf1a67932300b36638499e7c8e11ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\WorkFolder\Glarysoft\gu6\exe\vc\DupeFinder\sourcecode\Release\Dupefinder.pdb

Imports

skinsmanager

GetSkinsFile
GetSkinsToInt
GetSkinsColor
UnitializeLibrary
GetSkinsOption
InitializeLibrary

mfc90u

ord6636
ord2137
ord5622
ord5652
ord6794
ord5595
ord4661
ord1430
ord1423
ord5428
ord1433
ord2227
ord2265
ord2269
ord2288
ord2297
ord2289
ord2078
ord4396
ord5802
ord4320
ord4615
ord6524
ord1720
ord1784
ord2284
ord5611
ord5403
ord2627
ord1431
ord1425
ord5429
ord3622
ord4616
ord4519
ord4518
ord2478
ord5938
ord2676
ord404
ord663
ord5535
ord3187
ord6079
ord5770
ord1552
ord339
ord6204
ord2243
ord6659
ord4268
ord1779
ord1708
ord3627
ord750
ord5895
ord5867
ord294
ord3842
ord677
ord4010
ord3742
ord6527
ord3826
ord2278
ord1770
ord1682
ord4656
ord5194
ord3537
ord2470
ord2694
ord266
ord265
ord6171
ord6355
ord1503
ord654
ord3528
ord400
ord3646
ord3559
ord2953
ord2959
ord5943
ord899
ord6164
ord5979
ord4490
ord1651
ord2695
ord6013
ord1599
ord3515
ord2267
ord4527
ord3061
ord1533
ord6353
ord280
ord4774
ord5078
ord4815
ord6666
ord6604
ord2263
ord744
ord524
ord2097
ord6547
ord6187
ord3488
ord333
ord6091
ord1354
ord1353
ord3543
ord2106
ord1183
ord3486
ord636
ord367
ord5947
ord6517
ord2595
ord1063
ord1088
ord2706
ord6196
ord6426
ord6096
ord6424
ord2596
ord4442
ord933
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord6035
ord4179
ord1048
ord5548
ord6741
ord5830
ord4213
ord2087
ord3217
ord5674
ord5676
ord2447
ord1786
ord5680
ord5663
ord6018
ord3115
ord4905
ord3670
ord6482
ord1098
ord4211
ord794
ord589
ord4043
ord4967
ord935
ord938
ord1603
ord2479
ord6686
ord4405
ord6514
ord4516
ord811
ord6205
ord4266
ord6170
ord4262
ord6065
ord2360
ord2597
ord6550
ord4045
ord2286
ord525
ord2707
ord6577
ord6197
ord1787
ord5399
ord1585
ord2708
ord2705
ord3157
ord2758
ord2143
ord2144
ord4037
ord3941
ord2431
ord5373
ord6338
ord3381
ord3383
ord3156
ord3741
ord4035
ord779
ord576
ord3934
ord1688
ord2146
ord1166
ord1357
ord3231
ord6172
ord3149
ord4451
ord1723
ord788
ord585
ord686
ord436
ord792
ord587
ord2130
ord3577
ord2282
ord4512
ord4044
ord6094
ord3637
ord5851
ord290
ord3165
ord6760
ord2726
ord2537
ord2045
ord1938
ord782
ord580
ord693
ord3563
ord3252
ord4658
ord2280
ord775
ord3651
ord1716
ord1783
ord633
ord3511
ord1674
ord611
ord595
ord3489
ord4681
ord3286
ord5664
ord4652
ord1493
ord6411
ord3355
ord1665
ord2274
ord2326
ord286
ord799
ord1248
ord1250
ord1254
ord5632
ord4631
ord5324
ord2208
ord1810
ord1809
ord1675
ord3353
ord6408
ord1754
ord1751
ord4345
ord1492
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord5653
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord801
ord1137
ord296
ord1272
ord969
ord967
ord971
ord2615
ord2635
ord785
ord3661
ord3278
ord4663
ord4347
ord1722
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord2139
ord1792
ord1791
ord1727
ord5650
ord2771
ord2983
ord3112
ord4728
ord2966
ord3140
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4910
ord4682
ord6311
ord5167
ord4543
ord4131
ord2593
ord2592
ord2069
ord2904
ord6579
ord1108
ord5008
ord4000
ord639
ord374
ord3794
ord813
ord4410
ord4541
ord4996
ord6095
ord600
ord1432

msvcr90

_wtoi
_purecall
calloc
_recalloc
_wcsicmp
fclose
fflush
fwprintf_s
_wfopen_s
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_localtime64_s
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
wcstod
_ultow_s
__wargv
__argc
swprintf_s
wcsrchr
_time64
memcpy
__CxxFrameHandler3
memset
memmove_s
_resetstkoflw
malloc
memcpy_s
_CxxThrowException
free
?what@exception@std@@UBEPBDXZ
_wtof
__dllonexit
wprintf_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
??0exception@std@@QAE@ABQBD@Z

kernel32

EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
GetModuleHandleW
GetProcAddress
lstrlenW
GetLastError
FindResourceW
LoadResource
SizeofResource
LoadLibraryW
SetLastError
LockResource
SystemTimeToFileTime
lstrcpynW
DeleteFileW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CreateFileW
CreateFileMappingW
GetFileSize
CloseHandle
GetSystemInfo
MapViewOfFile
UnmapViewOfFile
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDriveTypeW
GetCurrentProcess
GetModuleFileNameW
GetCommandLineW
LocalFree
CreateThread
MultiByteToWideChar
QueryPerformanceFrequency
QueryPerformanceCounter
Sleep
FindFirstFileW
FindClose
FindNextFileW
GetDiskFreeSpaceExW
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
InitializeCriticalSection
GetWindowsDirectoryW
GetLogicalDriveStringsW
ExpandEnvironmentStringsW

user32

OffsetRect
LoadIconW
SetTimer
DrawFrameControl
PeekMessageW
MsgWaitForMultipleObjects
DispatchMessageW
MessageBoxW
InsertMenuW
CreateMenu
AppendMenuW
CreatePopupMenu
IsWindow
IsWindowVisible
ScreenToClient
InflateRect
GetMenuItemInfoW
UnionRect
GetMenuBarInfo
LoadMenuW
ModifyMenuW
GetMenuState
GetMenuItemID
GetMenuItemCount
RedrawWindow
GetParent
SendMessageW
FrameRect
LoadImageW
CheckMenuItem
CopyRect
ReleaseCapture
SetCapture
LoadCursorW
SetCursor
PtInRect
EnableMenuItem
GetCursorPos
IsRectEmpty
DrawIcon
GetSystemMetrics
IsIconic
FillRect
GetSysColor
GetSubMenu
SetRect
SetRectEmpty
InvalidateRect
SetWindowLongW
GetWindowLongW
EnableWindow
KillTimer
GetWindowRect
ReleaseDC
GetDC
GetClientRect

gdi32

CreateRoundRectRgn
CreatePatternBrush
SetBrushOrgEx
FillRgn
FrameRgn
BeginPath
EndPath
FillPath
CreateFontIndirectW
GetDeviceCaps
CreateSolidBrush
CreateFontW
GetBkMode
StretchBlt
GetDIBColorTable
CreateCompatibleBitmap
GetTextExtentPoint32W
GetObjectW
SetDIBColorTable
SelectObject
GetCurrentObject
CreateDIBSection
BitBlt
CreateCompatibleDC
DeleteDC
DeleteObject
CreatePen

msimg32

TransparentBlt
AlphaBlend
GradientFill

comdlg32

GetSaveFileNameW

advapi32

CryptGetHashParam
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW

shell32

SHBrowseForFolderW
ShellExecuteW
ShellExecuteExW
SHFileOperationW
CommandLineToArgvW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderLocation

comctl32

_TrackMouseEvent
InitCommonControlsEx

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathFindFileNameW
PathIsUNCServerShareW
ColorAdjustLuma
PathIsDirectoryW
PathFindExtensionW

ole32

CreateStreamOnHGlobal

oleaut32

VariantTimeToSystemTime
VarBstrFromDate
SysFreeString
SystemTimeToVariantTime

gdiplus

GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup

msvcp90

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

languages

ord3
ord5
ord8
ord9
ord4
ord6

crashreport

ord1

memfiles

ReleaseFilePath
ReleaseFileInfo
GetMulteFilePathByResult
GetFileInfoByResult
SortByResult
QuickSearch
ReleaseCurLoadDiskInfo
GetCurLoadDiskInfo
LoadDisk
IsLoadDisk
UninitMemfilesService
InitMemfilesService

register

ShowDlgWindow
GoHelp
OpenURL

checkupdate

ord6

config

ord9
ord10
ord12
ord7
ord20
ord19
ord1
ord13
ord11
GUCIsSeparate
ord5

guwndmanager

WindowsPosInitialize
WindowsPosHookWnd

uxtheme

DrawThemeBackground
OpenThemeData
CloseThemeData

zlib1

uncompress

Sections

.text
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 310KB - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

aacf1a67932300b36638499e7c8e11ba

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

skinsmanager

mfc90u

msvcr90

kernel32

user32

gdi32

msimg32

comdlg32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

msvcp90

languages

crashreport

memfiles

register

checkupdate

config

guwndmanager

uxtheme

zlib1

Sections

.text Size: 219KB - Virtual size: 218KB

.rdata Size: 55KB - Virtual size: 55KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 310KB - Virtual size: 310KB

.reloc Size: 96KB - Virtual size: 96KB

.text
Size: 219KB - Virtual size: 218KB

.rdata
Size: 55KB - Virtual size: 55KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 310KB - Virtual size: 310KB

.reloc
Size: 96KB - Virtual size: 96KB